src/src/tls-openssl.c

   1 /*************************************************
   2 *     Exim - an Internet mail transport agent    *
   3 *************************************************/
   4
   5 /* Copyright (c) University of Cambridge 1995 - 2014 */
   6 /* See the file NOTICE for conditions of use and distribution. */
   7
   8 /* Portions Copyright (c) The OpenSSL Project 1999 */
   9
  10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
  11 library. It is #included into the tls.c file when that library is used. The
  12 code herein is based on a patch that was originally contributed by Steve
  13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
  14
  15 No cryptographic code is included in Exim. All this module does is to call
  16 functions from the OpenSSL library. */
  17
  18
  19 /* Heading stuff */
  20
  21 #include <openssl/lhash.h>
  22 #include <openssl/ssl.h>
  23 #include <openssl/err.h>
  24 #include <openssl/rand.h>
  25 #ifndef DISABLE_OCSP
  26 # include <openssl/ocsp.h>
  27 #endif
  28 #ifdef EXPERIMENTAL_DANE
  29 # include <danessl.h>
  30 #endif
  31
  32
  33 #ifndef DISABLE_OCSP
  34 # define EXIM_OCSP_SKEW_SECONDS (300L)
  35 # define EXIM_OCSP_MAX_AGE (-1L)
  36 #endif
  37
  38 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
  39 # define EXIM_HAVE_OPENSSL_TLSEXT
  40 #endif
  41 #if OPENSSL_VERSION_NUMBER >= 0x010100000L
  42 # define EXIM_HAVE_OPENSSL_CHECKHOST
  43 #endif
  44 #if OPENSSL_VERSION_NUMBER >= 0x010000000L \
  45     && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
  46 # define EXIM_HAVE_OPENSSL_CHECKHOST
  47 #endif
  48
  49 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
  50 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
  51 # define DISABLE_OCSP
  52 #endif
  53
  54 /* Structure for collecting random data for seeding. */
  55
  56 typedef struct randstuff {
  57   struct timeval tv;
  58   pid_t          p;
  59 } randstuff;
  60
  61 /* Local static variables */
  62
  63 static BOOL client_verify_callback_called = FALSE;
  64 static BOOL server_verify_callback_called = FALSE;
  65 static const uschar *sid_ctx = US"exim";
  66
  67 /* We have three different contexts to care about.
  68
  69 Simple case: client, `client_ctx`
  70  As a client, we can be doing a callout or cut-through delivery while receiving
  71  a message.  So we have a client context, which should have options initialised
  72  from the SMTP Transport.
  73
  74 Server:
  75  There are two cases: with and without ServerNameIndication from the client.
  76  Given TLS SNI, we can be using different keys, certs and various other
  77  configuration settings, because they're re-expanded with $tls_sni set.  This
  78  allows vhosting with TLS.  This SNI is sent in the handshake.
  79  A client might not send SNI, so we need a fallback, and an initial setup too.
  80  So as a server, we start out using `server_ctx`.
  81  If SNI is sent by the client, then we as server, mid-negotiation, try to clone
  82  `server_sni` from `server_ctx` and then initialise settings by re-expanding
  83  configuration.
  84 */
  85
  86 static SSL_CTX *client_ctx = NULL;
  87 static SSL_CTX *server_ctx = NULL;
  88 static SSL     *client_ssl = NULL;
  89 static SSL     *server_ssl = NULL;
  90
  91 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
  92 static SSL_CTX *server_sni = NULL;
  93 #endif
  94
  95 static char ssl_errstring[256];
  96
  97 static int  ssl_session_timeout = 200;
  98 static BOOL client_verify_optional = FALSE;
  99 static BOOL server_verify_optional = FALSE;
 100
 101 static BOOL reexpand_tls_files_for_sni = FALSE;
 102
 103
 104 typedef struct tls_ext_ctx_cb {
 105   uschar *certificate;
 106   uschar *privatekey;
 107 #ifndef DISABLE_OCSP
 108   BOOL is_server;
 109   union {
 110     struct {
 111       uschar        *file;
 112       uschar        *file_expanded;
 113       OCSP_RESPONSE *response;
 114     } server;
 115     struct {
 116       X509_STORE    *verify_store;      /* non-null if status requested */
 117       BOOL          verify_required;
 118     } client;
 119   } u_ocsp;
 120 #endif
 121   uschar *dhparam;
 122   /* these are cached from first expand */
 123   uschar *server_cipher_list;
 124   /* only passed down to tls_error: */
 125   host_item *host;
 126   const uschar * verify_cert_hostnames;
 127 #ifdef EXPERIMENTAL_EVENT
 128   uschar * event_action;
 129 #endif
 130 } tls_ext_ctx_cb;
 131
 132 /* should figure out a cleanup of API to handle state preserved per
 133 implementation, for various reasons, which can be void * in the APIs.
 134 For now, we hack around it. */
 135 tls_ext_ctx_cb *client_static_cbinfo = NULL;
 136 tls_ext_ctx_cb *server_static_cbinfo = NULL;
 137
 138 static int
 139 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
 140     int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
 141
 142 /* Callbacks */
 143 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
 144 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
 145 #endif
 146 #ifndef DISABLE_OCSP
 147 static int tls_server_stapling_cb(SSL *s, void *arg);
 148 #endif
 149
 150
 151 /*************************************************
 152 *               Handle TLS error                 *
 153 *************************************************/
 154
 155 /* Called from lots of places when errors occur before actually starting to do
 156 the TLS handshake, that is, while the session is still in clear. Always returns
 157 DEFER for a server and FAIL for a client so that most calls can use "return
 158 tls_error(...)" to do this processing and then give an appropriate return. A
 159 single function is used for both server and client, because it is called from
 160 some shared functions.
 161
 162 Argument:
 163   prefix    text to include in the logged error
 164   host      NULL if setting up a server;
 165             the connected host if setting up a client
 166   msg       error message or NULL if we should ask OpenSSL
 167
 168 Returns:    OK/DEFER/FAIL
 169 */
 170
 171 static int
 172 tls_error(uschar * prefix, const host_item * host, uschar *  msg)
 173 {
 174 if (!msg)
 175   {
 176   ERR_error_string(ERR_get_error(), ssl_errstring);
 177   msg = (uschar *)ssl_errstring;
 178   }
 179
 180 if (host)
 181   {
 182   log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s): %s",
 183     host->name, host->address, prefix, msg);
 184   return FAIL;
 185   }
 186 else
 187   {
 188   uschar *conn_info = smtp_get_connection_info();
 189   if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
 190     conn_info += 5;
 191   /* I'd like to get separated H= here, but too hard for now */
 192   log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
 193     conn_info, prefix, msg);
 194   return DEFER;
 195   }
 196 }
 197
 198
 199
 200 /*************************************************
 201 *        Callback to generate RSA key            *
 202 *************************************************/
 203
 204 /*
 205 Arguments:
 206   s          SSL connection
 207   export     not used
 208   keylength  keylength
 209
 210 Returns:     pointer to generated key
 211 */
 212
 213 static RSA *
 214 rsa_callback(SSL *s, int export, int keylength)
 215 {
 216 RSA *rsa_key;
 217 export = export;     /* Shut picky compilers up */
 218 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
 219 rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
 220 if (rsa_key == NULL)
 221   {
 222   ERR_error_string(ERR_get_error(), ssl_errstring);
 223   log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
 224     ssl_errstring);
 225   return NULL;
 226   }
 227 return rsa_key;
 228 }
 229
 230
 231
 232 /* Extreme debug
 233 #ifndef DISABLE_OCSP
 234 void
 235 x509_store_dump_cert_s_names(X509_STORE * store)
 236 {
 237 STACK_OF(X509_OBJECT) * roots= store->objs;
 238 int i;
 239 static uschar name[256];
 240
 241 for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
 242   {
 243   X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
 244   if(tmp_obj->type == X509_LU_X509)
 245     {
 246     X509 * current_cert= tmp_obj->data.x509;
 247     X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
 248         name[sizeof(name)-1] = '\0';
 249     debug_printf(" %s\n", name);
 250     }
 251   }
 252 }
 253 #endif
 254 */
 255
 256
 257 #ifdef EXPERIMENTAL_EVENT
 258 static int
 259 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
 260   BOOL *calledp, const BOOL *optionalp, const uschar * what)
 261 {
 262 uschar * ev;
 263 uschar * yield;
 264 X509 * old_cert;
 265
 266 ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
 267 if (ev)
 268   {
 269   old_cert = tlsp->peercert;
 270   tlsp->peercert = X509_dup(cert);
 271   /* NB we do not bother setting peerdn */
 272   if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
 273     {
 274     log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
 275                 "depth=%d cert=%s: %s",
 276               tlsp == &tls_out ? deliver_host_address : sender_host_address,
 277               what, depth, dn, yield);
 278     *calledp = TRUE;
 279     if (!*optionalp)
 280       {
 281       if (old_cert) tlsp->peercert = old_cert;  /* restore 1st failing cert */
 282       return 1;                     /* reject (leaving peercert set) */
 283       }
 284     DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
 285       "(host in tls_try_verify_hosts)\n");
 286     }
 287   X509_free(tlsp->peercert);
 288   tlsp->peercert = old_cert;
 289   }
 290 return 0;
 291 }
 292 #endif
 293
 294 /*************************************************
 295 *        Callback for verification               *
 296 *************************************************/
 297
 298 /* The SSL library does certificate verification if set up to do so. This
 299 callback has the current yes/no state is in "state". If verification succeeded,
 300 we set the certificate-verified flag. If verification failed, what happens
 301 depends on whether the client is required to present a verifiable certificate
 302 or not.
 303
 304 If verification is optional, we change the state to yes, but still log the
 305 verification error. For some reason (it really would help to have proper
 306 documentation of OpenSSL), this callback function then gets called again, this
 307 time with state = 1.  We must take care not to set the private verified flag on
 308 the second time through.
 309
 310 Note: this function is not called if the client fails to present a certificate
 311 when asked. We get here only if a certificate has been received. Handling of
 312 optional verification for this case is done when requesting SSL to verify, by
 313 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
 314
 315 May be called multiple times for different issues with a certificate, even
 316 for a given "depth" in the certificate chain.
 317
 318 Arguments:
 319   state      current yes/no state as 1/0
 320   x509ctx    certificate information.
 321   client     TRUE for client startup, FALSE for server startup
 322
 323 Returns:     1 if verified, 0 if not
 324 */
 325
 326 static int
 327 verify_callback(int state, X509_STORE_CTX *x509ctx,
 328   tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
 329 {
 330 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 331 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 332 uschar dn[256];
 333
 334 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
 335 dn[sizeof(dn)-1] = '\0';
 336
 337 if (state == 0)
 338   {
 339   log_write(0, LOG_MAIN, "[%s] SSL verify error: depth=%d error=%s cert=%s",
 340         tlsp == &tls_out ? deliver_host_address : sender_host_address,
 341     depth,
 342     X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
 343     dn);
 344   *calledp = TRUE;
 345   if (!*optionalp)
 346     {
 347     if (!tlsp->peercert)
 348       tlsp->peercert = X509_dup(cert);  /* record failing cert */
 349     return 0;                           /* reject */
 350     }
 351   DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
 352     "tls_try_verify_hosts)\n");
 353   }
 354
 355 else if (depth != 0)
 356   {
 357   DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
 358 #ifndef DISABLE_OCSP
 359   if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
 360     {   /* client, wanting stapling  */
 361     /* Add the server cert's signing chain as the one
 362     for the verification of the OCSP stapled information. */
 363
 364     if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
 365                              cert))
 366       ERR_clear_error();
 367     }
 368 #endif
 369 #ifdef EXPERIMENTAL_EVENT
 370     if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
 371       return 0;                         /* reject, with peercert set */
 372 #endif
 373   }
 374 else
 375   {
 376   const uschar * verify_cert_hostnames;
 377
 378   if (  tlsp == &tls_out
 379      && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
 380         /* client, wanting hostname check */
 381     {
 382
 383 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
 384 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
 385 #  define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
 386 # endif
 387 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
 388 #  define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
 389 # endif
 390     int sep = 0;
 391     const uschar * list = verify_cert_hostnames;
 392     uschar * name;
 393     int rc;
 394     while ((name = string_nextinlist(&list, &sep, NULL, 0)))
 395       if ((rc = X509_check_host(cert, name, 0,
 396                   X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
 397                   | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
 398                   NULL)))
 399         {
 400         if (rc < 0)
 401           {
 402           log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
 403                 tlsp == &tls_out ? deliver_host_address : sender_host_address);
 404           name = NULL;
 405           }
 406         break;
 407         }
 408     if (!name)
 409 #else
 410     if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
 411 #endif
 412       {
 413       log_write(0, LOG_MAIN,
 414                 "[%s] SSL verify error: certificate name mismatch: \"%s\"",
 415                 tlsp == &tls_out ? deliver_host_address : sender_host_address,
 416                 dn);
 417       *calledp = TRUE;
 418       if (!*optionalp)
 419         {
 420         if (!tlsp->peercert)
 421           tlsp->peercert = X509_dup(cert);      /* record failing cert */
 422         return 0;                               /* reject */
 423         }
 424       DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
 425         "tls_try_verify_hosts)\n");
 426       }
 427     }
 428
 429 #ifdef EXPERIMENTAL_EVENT
 430   if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
 431     return 0;                           /* reject, with peercert set */
 432 #endif
 433
 434   DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
 435     *calledp ? "" : " authenticated", dn);
 436   if (!*calledp) tlsp->certificate_verified = TRUE;
 437   *calledp = TRUE;
 438   }
 439
 440 return 1;   /* accept, at least for this level */
 441 }
 442
 443 static int
 444 verify_callback_client(int state, X509_STORE_CTX *x509ctx)
 445 {
 446 return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
 447 }
 448
 449 static int
 450 verify_callback_server(int state, X509_STORE_CTX *x509ctx)
 451 {
 452 return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
 453 }
 454
 455
 456 #ifdef EXPERIMENTAL_DANE
 457
 458 /* This gets called *by* the dane library verify callback, which interposes
 459 itself.
 460 */
 461 static int
 462 verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
 463 {
 464 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 465 uschar dn[256];
 466 #ifdef EXPERIMENTAL_EVENT
 467 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 468 uschar * yield;
 469 BOOL dummy_called, optional = FALSE;
 470 #endif
 471
 472 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
 473 dn[sizeof(dn)-1] = '\0';
 474
 475 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", dn);
 476
 477 #ifdef EXPERIMENTAL_EVENT
 478   if (verify_event(&tls_out, cert, depth, dn,
 479           &dummy_called, &optional, US"DANE"))
 480     return 0;                           /* reject, with peercert set */
 481 #endif
 482
 483 if (state == 1)
 484   tls_out.dane_verified =
 485   tls_out.certificate_verified = TRUE;
 486 return 1;
 487 }
 488
 489 #endif  /*EXPERIMENTAL_DANE*/
 490
 491
 492 /*************************************************
 493 *           Information callback                 *
 494 *************************************************/
 495
 496 /* The SSL library functions call this from time to time to indicate what they
 497 are doing. We copy the string to the debugging output when TLS debugging has
 498 been requested.
 499
 500 Arguments:
 501   s         the SSL connection
 502   where
 503   ret
 504
 505 Returns:    nothing
 506 */
 507
 508 static void
 509 info_callback(SSL *s, int where, int ret)
 510 {
 511 where = where;
 512 ret = ret;
 513 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
 514 }
 515
 516
 517
 518 /*************************************************
 519 *                Initialize for DH               *
 520 *************************************************/
 521
 522 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
 523
 524 Arguments:
 525   dhparam   DH parameter file or fixed parameter identity string
 526   host      connected host, if client; NULL if server
 527
 528 Returns:    TRUE if OK (nothing to set up, or setup worked)
 529 */
 530
 531 static BOOL
 532 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host)
 533 {
 534 BIO *bio;
 535 DH *dh;
 536 uschar *dhexpanded;
 537 const char *pem;
 538
 539 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
 540   return FALSE;
 541
 542 if (!dhexpanded || !*dhexpanded)
 543   bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
 544 else if (dhexpanded[0] == '/')
 545   {
 546   if (!(bio = BIO_new_file(CS dhexpanded, "r")))
 547     {
 548     tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
 549           host, US strerror(errno));
 550     return FALSE;
 551     }
 552   }
 553 else
 554   {
 555   if (Ustrcmp(dhexpanded, "none") == 0)
 556     {
 557     DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
 558     return TRUE;
 559     }
 560
 561   if (!(pem = std_dh_prime_named(dhexpanded)))
 562     {
 563     tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
 564         host, US strerror(errno));
 565     return FALSE;
 566     }
 567   bio = BIO_new_mem_buf(CS pem, -1);
 568   }
 569
 570 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
 571   {
 572   BIO_free(bio);
 573   tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
 574       host, NULL);
 575   return FALSE;
 576   }
 577
 578 /* Even if it is larger, we silently return success rather than cause things
 579  * to fail out, so that a too-large DH will not knock out all TLS; it's a
 580  * debatable choice. */
 581 if ((8*DH_size(dh)) > tls_dh_max_bits)
 582   {
 583   DEBUG(D_tls)
 584     debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
 585         8*DH_size(dh), tls_dh_max_bits);
 586   }
 587 else
 588   {
 589   SSL_CTX_set_tmp_dh(sctx, dh);
 590   DEBUG(D_tls)
 591     debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
 592       dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
 593   }
 594
 595 DH_free(dh);
 596 BIO_free(bio);
 597
 598 return TRUE;
 599 }
 600
 601
 602
 603
 604 #ifndef DISABLE_OCSP
 605 /*************************************************
 606 *       Load OCSP information into state         *
 607 *************************************************/
 608
 609 /* Called to load the server OCSP response from the given file into memory, once
 610 caller has determined this is needed.  Checks validity.  Debugs a message
 611 if invalid.
 612
 613 ASSUMES: single response, for single cert.
 614
 615 Arguments:
 616   sctx            the SSL_CTX* to update
 617   cbinfo          various parts of session state
 618   expanded        the filename putatively holding an OCSP response
 619
 620 */
 621
 622 static void
 623 ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
 624 {
 625 BIO *bio;
 626 OCSP_RESPONSE *resp;
 627 OCSP_BASICRESP *basic_response;
 628 OCSP_SINGLERESP *single_response;
 629 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
 630 X509_STORE *store;
 631 unsigned long verify_flags;
 632 int status, reason, i;
 633
 634 cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
 635 if (cbinfo->u_ocsp.server.response)
 636   {
 637   OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
 638   cbinfo->u_ocsp.server.response = NULL;
 639   }
 640
 641 bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
 642 if (!bio)
 643   {
 644   DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
 645       cbinfo->u_ocsp.server.file_expanded);
 646   return;
 647   }
 648
 649 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
 650 BIO_free(bio);
 651 if (!resp)
 652   {
 653   DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
 654   return;
 655   }
 656
 657 status = OCSP_response_status(resp);
 658 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
 659   {
 660   DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
 661       OCSP_response_status_str(status), status);
 662   goto bad;
 663   }
 664
 665 basic_response = OCSP_response_get1_basic(resp);
 666 if (!basic_response)
 667   {
 668   DEBUG(D_tls)
 669     debug_printf("OCSP response parse error: unable to extract basic response.\n");
 670   goto bad;
 671   }
 672
 673 store = SSL_CTX_get_cert_store(sctx);
 674 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
 675
 676 /* May need to expose ability to adjust those flags?
 677 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
 678 OCSP_TRUSTOTHER OCSP_NOINTERN */
 679
 680 i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
 681 if (i <= 0)
 682   {
 683   DEBUG(D_tls) {
 684     ERR_error_string(ERR_get_error(), ssl_errstring);
 685     debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
 686     }
 687   goto bad;
 688   }
 689
 690 /* Here's the simplifying assumption: there's only one response, for the
 691 one certificate we use, and nothing for anything else in a chain.  If this
 692 proves false, we need to extract a cert id from our issued cert
 693 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
 694 right cert in the stack and then calls OCSP_single_get0_status()).
 695
 696 I'm hoping to avoid reworking a bunch more of how we handle state here. */
 697 single_response = OCSP_resp_get0(basic_response, 0);
 698 if (!single_response)
 699   {
 700   DEBUG(D_tls)
 701     debug_printf("Unable to get first response from OCSP basic response.\n");
 702   goto bad;
 703   }
 704
 705 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
 706 if (status != V_OCSP_CERTSTATUS_GOOD)
 707   {
 708   DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
 709       OCSP_cert_status_str(status), status,
 710       OCSP_crl_reason_str(reason), reason);
 711   goto bad;
 712   }
 713
 714 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
 715   {
 716   DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
 717   goto bad;
 718   }
 719
 720 supply_response:
 721   cbinfo->u_ocsp.server.response = resp;
 722 return;
 723
 724 bad:
 725   if (running_in_test_harness)
 726     {
 727     extern char ** environ;
 728     uschar ** p;
 729     for (p = USS environ; *p != NULL; p++)
 730       if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
 731         {
 732         DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
 733         goto supply_response;
 734         }
 735     }
 736 return;
 737 }
 738 #endif  /*!DISABLE_OCSP*/
 739
 740
 741
 742
 743 /*************************************************
 744 *        Expand key and cert file specs          *
 745 *************************************************/
 746
 747 /* Called once during tls_init and possibly again during TLS setup, for a
 748 new context, if Server Name Indication was used and tls_sni was seen in
 749 the certificate string.
 750
 751 Arguments:
 752   sctx            the SSL_CTX* to update
 753   cbinfo          various parts of session state
 754
 755 Returns:          OK/DEFER/FAIL
 756 */
 757
 758 static int
 759 tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
 760 {
 761 uschar *expanded;
 762
 763 if (cbinfo->certificate == NULL)
 764   return OK;
 765
 766 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
 767     Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
 768     Ustrstr(cbinfo->certificate, US"tls_out_sni")
 769    )
 770   reexpand_tls_files_for_sni = TRUE;
 771
 772 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
 773   return DEFER;
 774
 775 if (expanded != NULL)
 776   {
 777   DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
 778   if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
 779     return tls_error(string_sprintf(
 780       "SSL_CTX_use_certificate_chain_file file=%s", expanded),
 781         cbinfo->host, NULL);
 782   }
 783
 784 if (cbinfo->privatekey != NULL &&
 785     !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
 786   return DEFER;
 787
 788 /* If expansion was forced to fail, key_expanded will be NULL. If the result
 789 of the expansion is an empty string, ignore it also, and assume the private
 790 key is in the same file as the certificate. */
 791
 792 if (expanded != NULL && *expanded != 0)
 793   {
 794   DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
 795   if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
 796     return tls_error(string_sprintf(
 797       "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
 798   }
 799
 800 #ifndef DISABLE_OCSP
 801 if (cbinfo->is_server &&  cbinfo->u_ocsp.server.file != NULL)
 802   {
 803   if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
 804     return DEFER;
 805
 806   if (expanded != NULL && *expanded != 0)
 807     {
 808     DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
 809     if (cbinfo->u_ocsp.server.file_expanded &&
 810         (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
 811       {
 812       DEBUG(D_tls)
 813         debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
 814       } else {
 815         ocsp_load_response(sctx, cbinfo, expanded);
 816       }
 817     }
 818   }
 819 #endif
 820
 821 return OK;
 822 }
 823
 824
 825
 826
 827 /*************************************************
 828 *            Callback to handle SNI              *
 829 *************************************************/
 830
 831 /* Called when acting as server during the TLS session setup if a Server Name
 832 Indication extension was sent by the client.
 833
 834 API documentation is OpenSSL s_server.c implementation.
 835
 836 Arguments:
 837   s               SSL* of the current session
 838   ad              unknown (part of OpenSSL API) (unused)
 839   arg             Callback of "our" registered data
 840
 841 Returns:          SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
 842 */
 843
 844 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
 845 static int
 846 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
 847 {
 848 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
 849 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
 850 int rc;
 851 int old_pool = store_pool;
 852
 853 if (!servername)
 854   return SSL_TLSEXT_ERR_OK;
 855
 856 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
 857     reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
 858
 859 /* Make the extension value available for expansion */
 860 store_pool = POOL_PERM;
 861 tls_in.sni = string_copy(US servername);
 862 store_pool = old_pool;
 863
 864 if (!reexpand_tls_files_for_sni)
 865   return SSL_TLSEXT_ERR_OK;
 866
 867 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
 868 not confident that memcpy wouldn't break some internal reference counting.
 869 Especially since there's a references struct member, which would be off. */
 870
 871 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
 872   {
 873   ERR_error_string(ERR_get_error(), ssl_errstring);
 874   DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
 875   return SSL_TLSEXT_ERR_NOACK;
 876   }
 877
 878 /* Not sure how many of these are actually needed, since SSL object
 879 already exists.  Might even need this selfsame callback, for reneg? */
 880
 881 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
 882 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
 883 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
 884 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
 885 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
 886 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
 887 if (cbinfo->server_cipher_list)
 888   SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
 889 #ifndef DISABLE_OCSP
 890 if (cbinfo->u_ocsp.server.file)
 891   {
 892   SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
 893   SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
 894   }
 895 #endif
 896
 897 rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
 898 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
 899
 900 /* do this after setup_certs, because this can require the certs for verifying
 901 OCSP information. */
 902 rc = tls_expand_session_files(server_sni, cbinfo);
 903 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
 904
 905 if (!init_dh(server_sni, cbinfo->dhparam, NULL))
 906   return SSL_TLSEXT_ERR_NOACK;
 907
 908 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
 909 SSL_set_SSL_CTX(s, server_sni);
 910
 911 return SSL_TLSEXT_ERR_OK;
 912 }
 913 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
 914
 915
 916
 917
 918 #ifndef DISABLE_OCSP
 919
 920 /*************************************************
 921 *        Callback to handle OCSP Stapling        *
 922 *************************************************/
 923
 924 /* Called when acting as server during the TLS session setup if the client
 925 requests OCSP information with a Certificate Status Request.
 926
 927 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
 928 project.
 929
 930 */
 931
 932 static int
 933 tls_server_stapling_cb(SSL *s, void *arg)
 934 {
 935 const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
 936 uschar *response_der;
 937 int response_der_len;
 938
 939 DEBUG(D_tls)
 940   debug_printf("Received TLS status request (OCSP stapling); %s response.",
 941     cbinfo->u_ocsp.server.response ? "have" : "lack");
 942
 943 tls_in.ocsp = OCSP_NOT_RESP;
 944 if (!cbinfo->u_ocsp.server.response)
 945   return SSL_TLSEXT_ERR_NOACK;
 946
 947 response_der = NULL;
 948 response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
 949                       &response_der);
 950 if (response_der_len <= 0)
 951   return SSL_TLSEXT_ERR_NOACK;
 952
 953 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
 954 tls_in.ocsp = OCSP_VFIED;
 955 return SSL_TLSEXT_ERR_OK;
 956 }
 957
 958
 959 static void
 960 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
 961 {
 962 BIO_printf(bp, "\t%s: ", str);
 963 ASN1_GENERALIZEDTIME_print(bp, time);
 964 BIO_puts(bp, "\n");
 965 }
 966
 967 static int
 968 tls_client_stapling_cb(SSL *s, void *arg)
 969 {
 970 tls_ext_ctx_cb * cbinfo = arg;
 971 const unsigned char * p;
 972 int len;
 973 OCSP_RESPONSE * rsp;
 974 OCSP_BASICRESP * bs;
 975 int i;
 976
 977 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
 978 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
 979 if(!p)
 980  {
 981   /* Expect this when we requested ocsp but got none */
 982   if (  cbinfo->u_ocsp.client.verify_required
 983      && log_extra_selector & LX_tls_cipher)
 984     log_write(0, LOG_MAIN, "Received TLS status callback, null content");
 985   else
 986     DEBUG(D_tls) debug_printf(" null\n");
 987   return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
 988  }
 989
 990 if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
 991  {
 992   tls_out.ocsp = OCSP_FAILED;
 993   if (log_extra_selector & LX_tls_cipher)
 994     log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
 995   else
 996     DEBUG(D_tls) debug_printf(" parse error\n");
 997   return 0;
 998  }
 999
1000 if(!(bs = OCSP_response_get1_basic(rsp)))
1001   {
1002   tls_out.ocsp = OCSP_FAILED;
1003   if (log_extra_selector & LX_tls_cipher)
1004     log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
1005   else
1006     DEBUG(D_tls) debug_printf(" error parsing response\n");
1007   OCSP_RESPONSE_free(rsp);
1008   return 0;
1009   }
1010
1011 /* We'd check the nonce here if we'd put one in the request. */
1012 /* However that would defeat cacheability on the server so we don't. */
1013
1014 /* This section of code reworked from OpenSSL apps source;
1015    The OpenSSL Project retains copyright:
1016    Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
1017 */
1018   {
1019     BIO * bp = NULL;
1020     int status, reason;
1021     ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1022
1023     DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1024
1025     /*OCSP_RESPONSE_print(bp, rsp, 0);   extreme debug: stapling content */
1026
1027     /* Use the chain that verified the server cert to verify the stapled info */
1028     /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1029
1030     if ((i = OCSP_basic_verify(bs, NULL,
1031               cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
1032       {
1033       tls_out.ocsp = OCSP_FAILED;
1034       if (log_extra_selector & LX_tls_cipher)
1035         log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
1036       BIO_printf(bp, "OCSP response verify failure\n");
1037       ERR_print_errors(bp);
1038       i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1039       goto out;
1040       }
1041
1042     BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1043
1044       {
1045       STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1046       OCSP_SINGLERESP * single;
1047
1048       if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1049         {
1050         tls_out.ocsp = OCSP_FAILED;
1051         log_write(0, LOG_MAIN, "OCSP stapling "
1052             "with multiple responses not handled");
1053         i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1054         goto out;
1055         }
1056       single = OCSP_resp_get0(bs, 0);
1057       status = OCSP_single_get0_status(single, &reason, &rev,
1058                   &thisupd, &nextupd);
1059       }
1060
1061     DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1062     DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1063     if (!OCSP_check_validity(thisupd, nextupd,
1064           EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1065       {
1066       tls_out.ocsp = OCSP_FAILED;
1067       DEBUG(D_tls) ERR_print_errors(bp);
1068       log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1069       i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1070       }
1071     else
1072       {
1073       DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1074                     OCSP_cert_status_str(status));
1075       switch(status)
1076         {
1077         case V_OCSP_CERTSTATUS_GOOD:
1078           tls_out.ocsp = OCSP_VFIED;
1079           i = 1;
1080           break;
1081         case V_OCSP_CERTSTATUS_REVOKED:
1082           tls_out.ocsp = OCSP_FAILED;
1083           log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1084               reason != -1 ? "; reason: " : "",
1085               reason != -1 ? OCSP_crl_reason_str(reason) : "");
1086           DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1087           i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1088           break;
1089         default:
1090           tls_out.ocsp = OCSP_FAILED;
1091           log_write(0, LOG_MAIN,
1092               "Server certificate status unknown, in OCSP stapling");
1093           i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1094           break;
1095         }
1096       }
1097   out:
1098     BIO_free(bp);
1099   }
1100
1101 OCSP_RESPONSE_free(rsp);
1102 return i;
1103 }
1104 #endif  /*!DISABLE_OCSP*/
1105
1106
1107 /*************************************************
1108 *            Initialize for TLS                  *
1109 *************************************************/
1110
1111 /* Called from both server and client code, to do preliminary initialization
1112 of the library.  We allocate and return a context structure.
1113
1114 Arguments:
1115   ctxp            returned SSL context
1116   host            connected host, if client; NULL if server
1117   dhparam         DH parameter file
1118   certificate     certificate file
1119   privatekey      private key
1120   ocsp_file       file of stapling info (server); flag for require ocsp (client)
1121   addr            address if client; NULL if server (for some randomness)
1122   cbp             place to put allocated callback context
1123
1124 Returns:          OK/DEFER/FAIL
1125 */
1126
1127 static int
1128 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
1129   uschar *privatekey,
1130 #ifndef DISABLE_OCSP
1131   uschar *ocsp_file,
1132 #endif
1133   address_item *addr, tls_ext_ctx_cb ** cbp)
1134 {
1135 long init_options;
1136 int rc;
1137 BOOL okay;
1138 tls_ext_ctx_cb * cbinfo;
1139
1140 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1141 cbinfo->certificate = certificate;
1142 cbinfo->privatekey = privatekey;
1143 #ifndef DISABLE_OCSP
1144 if ((cbinfo->is_server = host==NULL))
1145   {
1146   cbinfo->u_ocsp.server.file = ocsp_file;
1147   cbinfo->u_ocsp.server.file_expanded = NULL;
1148   cbinfo->u_ocsp.server.response = NULL;
1149   }
1150 else
1151   cbinfo->u_ocsp.client.verify_store = NULL;
1152 #endif
1153 cbinfo->dhparam = dhparam;
1154 cbinfo->server_cipher_list = NULL;
1155 cbinfo->host = host;
1156 #ifdef EXPERIMENTAL_EVENT
1157 cbinfo->event_action = NULL;
1158 #endif
1159
1160 SSL_load_error_strings();          /* basic set up */
1161 OpenSSL_add_ssl_algorithms();
1162
1163 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
1164 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1165 list of available digests. */
1166 EVP_add_digest(EVP_sha256());
1167 #endif
1168
1169 /* Create a context.
1170 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1171 negotiation in the different methods; as far as I can tell, the only
1172 *_{server,client}_method which allows negotiation is SSLv23, which exists even
1173 when OpenSSL is built without SSLv2 support.
1174 By disabling with openssl_options, we can let admins re-enable with the
1175 existing knob. */
1176
1177 *ctxp = SSL_CTX_new((host == NULL)?
1178   SSLv23_server_method() : SSLv23_client_method());
1179
1180 if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
1181
1182 /* It turns out that we need to seed the random number generator this early in
1183 order to get the full complement of ciphers to work. It took me roughly a day
1184 of work to discover this by experiment.
1185
1186 On systems that have /dev/urandom, SSL may automatically seed itself from
1187 there. Otherwise, we have to make something up as best we can. Double check
1188 afterwards. */
1189
1190 if (!RAND_status())
1191   {
1192   randstuff r;
1193   gettimeofday(&r.tv, NULL);
1194   r.p = getpid();
1195
1196   RAND_seed((uschar *)(&r), sizeof(r));
1197   RAND_seed((uschar *)big_buffer, big_buffer_size);
1198   if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1199
1200   if (!RAND_status())
1201     return tls_error(US"RAND_status", host,
1202       US"unable to seed random number generator");
1203   }
1204
1205 /* Set up the information callback, which outputs if debugging is at a suitable
1206 level. */
1207
1208 DEBUG(D_tls) SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
1209
1210 /* Automatically re-try reads/writes after renegotiation. */
1211 (void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
1212
1213 /* Apply administrator-supplied work-arounds.
1214 Historically we applied just one requested option,
1215 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1216 moved to an administrator-controlled list of options to specify and
1217 grandfathered in the first one as the default value for "openssl_options".
1218
1219 No OpenSSL version number checks: the options we accept depend upon the
1220 availability of the option value macros from OpenSSL.  */
1221
1222 okay = tls_openssl_options_parse(openssl_options, &init_options);
1223 if (!okay)
1224   return tls_error(US"openssl_options parsing failed", host, NULL);
1225
1226 if (init_options)
1227   {
1228   DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
1229   if (!(SSL_CTX_set_options(*ctxp, init_options)))
1230     return tls_error(string_sprintf(
1231           "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1232   }
1233 else
1234   DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
1235
1236 /* Initialize with DH parameters if supplied */
1237
1238 if (!init_dh(*ctxp, dhparam, host)) return DEFER;
1239
1240 /* Set up certificate and key (and perhaps OCSP info) */
1241
1242 rc = tls_expand_session_files(*ctxp, cbinfo);
1243 if (rc != OK) return rc;
1244
1245 /* If we need to handle SNI, do so */
1246 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1247 if (host == NULL)               /* server */
1248   {
1249 # ifndef DISABLE_OCSP
1250   /* We check u_ocsp.server.file, not server.response, because we care about if
1251   the option exists, not what the current expansion might be, as SNI might
1252   change the certificate and OCSP file in use between now and the time the
1253   callback is invoked. */
1254   if (cbinfo->u_ocsp.server.file)
1255     {
1256     SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
1257     SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
1258     }
1259 # endif
1260   /* We always do this, so that $tls_sni is available even if not used in
1261   tls_certificate */
1262   SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1263   SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
1264   }
1265 # ifndef DISABLE_OCSP
1266 else                    /* client */
1267   if(ocsp_file)         /* wanting stapling */
1268     {
1269     if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1270       {
1271       DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1272       return FAIL;
1273       }
1274     SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1275     SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1276     }
1277 # endif
1278 #endif
1279
1280 cbinfo->verify_cert_hostnames = NULL;
1281
1282 /* Set up the RSA callback */
1283
1284 SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
1285
1286 /* Finally, set the timeout, and we are done */
1287
1288 SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
1289 DEBUG(D_tls) debug_printf("Initialized TLS\n");
1290
1291 *cbp = cbinfo;
1292
1293 return OK;
1294 }
1295
1296
1297
1298
1299 /*************************************************
1300 *           Get name of cipher in use            *
1301 *************************************************/
1302
1303 /*
1304 Argument:   pointer to an SSL structure for the connection
1305             buffer to use for answer
1306             size of buffer
1307             pointer to number of bits for cipher
1308 Returns:    nothing
1309 */
1310
1311 static void
1312 construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
1313 {
1314 /* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1315 yet reflect that.  It should be a safe change anyway, even 0.9.8 versions have
1316 the accessor functions use const in the prototype. */
1317 const SSL_CIPHER *c;
1318 const uschar *ver;
1319
1320 ver = (const uschar *)SSL_get_version(ssl);
1321
1322 c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
1323 SSL_CIPHER_get_bits(c, bits);
1324
1325 string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1326   SSL_CIPHER_get_name(c), *bits);
1327
1328 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1329 }
1330
1331
1332 static void
1333 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned bsize)
1334 {
1335 /*XXX we might consider a list-of-certs variable for the cert chain.
1336 SSL_get_peer_cert_chain(SSL*).  We'd need a new variable type and support
1337 in list-handling functions, also consider the difference between the entire
1338 chain and the elements sent by the peer. */
1339
1340 /* Will have already noted peercert on a verify fail; possibly not the leaf */
1341 if (!tlsp->peercert)
1342   tlsp->peercert = SSL_get_peer_certificate(ssl);
1343 /* Beware anonymous ciphers which lead to server_cert being NULL */
1344 if (tlsp->peercert)
1345   {
1346   X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, bsize);
1347   peerdn[bsize-1] = '\0';
1348   tlsp->peerdn = peerdn;                /*XXX a static buffer... */
1349   }
1350 else
1351   tlsp->peerdn = NULL;
1352 }
1353
1354
1355
1356
1357
1358 /*************************************************
1359 *        Set up for verifying certificates       *
1360 *************************************************/
1361
1362 /* Called by both client and server startup
1363
1364 Arguments:
1365   sctx          SSL_CTX* to initialise
1366   certs         certs file or NULL
1367   crl           CRL file or NULL
1368   host          NULL in a server; the remote host in a client
1369   optional      TRUE if called from a server for a host in tls_try_verify_hosts;
1370                 otherwise passed as FALSE
1371   cert_vfy_cb   Callback function for certificate verification
1372
1373 Returns:        OK/DEFER/FAIL
1374 */
1375
1376 static int
1377 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1378     int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
1379 {
1380 uschar *expcerts, *expcrl;
1381
1382 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1383   return DEFER;
1384
1385 if (expcerts != NULL && *expcerts != '\0')
1386   {
1387   if (Ustrcmp(expcerts, "system") == 0)
1388     {
1389     /* Tell the library to use its compiled-in location for the system default
1390     CA bundle, only */
1391
1392     if (!SSL_CTX_set_default_verify_paths(sctx))
1393       return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1394     }
1395   else
1396     {
1397     struct stat statbuf;
1398
1399     /* Tell the library to use its compiled-in location for the system default
1400     CA bundle. Those given by the exim config are additional to these */
1401
1402     if (!SSL_CTX_set_default_verify_paths(sctx))
1403       return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1404
1405     if (Ustat(expcerts, &statbuf) < 0)
1406       {
1407       log_write(0, LOG_MAIN|LOG_PANIC,
1408         "failed to stat %s for certificates", expcerts);
1409       return DEFER;
1410       }
1411     else
1412       {
1413       uschar *file, *dir;
1414       if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1415         { file = NULL; dir = expcerts; }
1416       else
1417         { file = expcerts; dir = NULL; }
1418
1419       /* If a certificate file is empty, the next function fails with an
1420       unhelpful error message. If we skip it, we get the correct behaviour (no
1421       certificates are recognized, but the error message is still misleading (it
1422       says no certificate was supplied.) But this is better. */
1423
1424       if ((file == NULL || statbuf.st_size > 0) &&
1425             !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1426         return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1427
1428       /* Load the list of CAs for which we will accept certs, for sending
1429       to the client.  This is only for the one-file tls_verify_certificates
1430       variant.
1431       If a list isn't loaded into the server, but
1432       some verify locations are set, the server end appears to make
1433       a wildcard reqest for client certs.
1434       Meanwhile, the client library as deafult behaviour *ignores* the list
1435       we send over the wire - see man SSL_CTX_set_client_cert_cb.
1436       Because of this, and that the dir variant is likely only used for
1437       the public-CA bundle (not for a private CA), not worth fixing.
1438       */
1439       if (file != NULL)
1440         {
1441         STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
1442   DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
1443                                     sk_X509_NAME_num(names));
1444         SSL_CTX_set_client_CA_list(sctx, names);
1445         }
1446       }
1447     }
1448
1449   /* Handle a certificate revocation list. */
1450
1451   #if OPENSSL_VERSION_NUMBER > 0x00907000L
1452
1453   /* This bit of code is now the version supplied by Lars Mainka. (I have
1454    * merely reformatted it into the Exim code style.)
1455
1456    * "From here I changed the code to add support for multiple crl's
1457    * in pem format in one file or to support hashed directory entries in
1458    * pem format instead of a file. This method now uses the library function
1459    * X509_STORE_load_locations to add the CRL location to the SSL context.
1460    * OpenSSL will then handle the verify against CA certs and CRLs by
1461    * itself in the verify callback." */
1462
1463   if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1464   if (expcrl != NULL && *expcrl != 0)
1465     {
1466     struct stat statbufcrl;
1467     if (Ustat(expcrl, &statbufcrl) < 0)
1468       {
1469       log_write(0, LOG_MAIN|LOG_PANIC,
1470         "failed to stat %s for certificates revocation lists", expcrl);
1471       return DEFER;
1472       }
1473     else
1474       {
1475       /* is it a file or directory? */
1476       uschar *file, *dir;
1477       X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
1478       if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
1479         {
1480         file = NULL;
1481         dir = expcrl;
1482         DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
1483         }
1484       else
1485         {
1486         file = expcrl;
1487         dir = NULL;
1488         DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
1489         }
1490       if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
1491         return tls_error(US"X509_STORE_load_locations", host, NULL);
1492
1493       /* setting the flags to check against the complete crl chain */
1494
1495       X509_STORE_set_flags(cvstore,
1496         X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
1497       }
1498     }
1499
1500   #endif  /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1501
1502   /* If verification is optional, don't fail if no certificate */
1503
1504   SSL_CTX_set_verify(sctx,
1505     SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
1506     cert_vfy_cb);
1507   }
1508
1509 return OK;
1510 }
1511
1512
1513
1514 /*************************************************
1515 *       Start a TLS session in a server          *
1516 *************************************************/
1517
1518 /* This is called when Exim is running as a server, after having received
1519 the STARTTLS command. It must respond to that command, and then negotiate
1520 a TLS session.
1521
1522 Arguments:
1523   require_ciphers   allowed ciphers
1524
1525 Returns:            OK on success
1526                     DEFER for errors before the start of the negotiation
1527                     FAIL for errors during the negotation; the server can't
1528                       continue running.
1529 */
1530
1531 int
1532 tls_server_start(const uschar *require_ciphers)
1533 {
1534 int rc;
1535 uschar *expciphers;
1536 tls_ext_ctx_cb *cbinfo;
1537 X509 * peercert;
1538 static uschar peerdn[256];
1539 static uschar cipherbuf[256];
1540
1541 /* Check for previous activation */
1542
1543 if (tls_in.active >= 0)
1544   {
1545   tls_error(US"STARTTLS received after TLS started", NULL, US"");
1546   smtp_printf("554 Already in TLS\r\n");
1547   return FAIL;
1548   }
1549
1550 /* Initialize the SSL library. If it fails, it will already have logged
1551 the error. */
1552
1553 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
1554 #ifndef DISABLE_OCSP
1555     tls_ocsp_file,
1556 #endif
1557     NULL, &server_static_cbinfo);
1558 if (rc != OK) return rc;
1559 cbinfo = server_static_cbinfo;
1560
1561 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1562   return FAIL;
1563
1564 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1565 were historically separated by underscores. So that I can use either form in my
1566 tests, and also for general convenience, we turn underscores into hyphens here.
1567 */
1568
1569 if (expciphers != NULL)
1570   {
1571   uschar *s = expciphers;
1572   while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1573   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1574   if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
1575     return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
1576   cbinfo->server_cipher_list = expciphers;
1577   }
1578
1579 /* If this is a host for which certificate verification is mandatory or
1580 optional, set up appropriately. */
1581
1582 tls_in.certificate_verified = FALSE;
1583 #ifdef EXPERIMENTAL_DANE
1584 tls_in.dane_verified = FALSE;
1585 #endif
1586 server_verify_callback_called = FALSE;
1587
1588 if (verify_check_host(&tls_verify_hosts) == OK)
1589   {
1590   rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1591                         FALSE, verify_callback_server);
1592   if (rc != OK) return rc;
1593   server_verify_optional = FALSE;
1594   }
1595 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1596   {
1597   rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1598                         TRUE, verify_callback_server);
1599   if (rc != OK) return rc;
1600   server_verify_optional = TRUE;
1601   }
1602
1603 /* Prepare for new connection */
1604
1605 if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
1606
1607 /* Warning: we used to SSL_clear(ssl) here, it was removed.
1608  *
1609  * With the SSL_clear(), we get strange interoperability bugs with
1610  * OpenSSL 1.0.1b and TLS1.1/1.2.  It looks as though this may be a bug in
1611  * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1612  *
1613  * The SSL_clear() call is to let an existing SSL* be reused, typically after
1614  * session shutdown.  In this case, we have a brand new object and there's no
1615  * obvious reason to immediately clear it.  I'm guessing that this was
1616  * originally added because of incomplete initialisation which the clear fixed,
1617  * in some historic release.
1618  */
1619
1620 /* Set context and tell client to go ahead, except in the case of TLS startup
1621 on connection, where outputting anything now upsets the clients and tends to
1622 make them disconnect. We need to have an explicit fflush() here, to force out
1623 the response. Other smtp_printf() calls do not need it, because in non-TLS
1624 mode, the fflush() happens when smtp_getc() is called. */
1625
1626 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1627 if (!tls_in.on_connect)
1628   {
1629   smtp_printf("220 TLS go ahead\r\n");
1630   fflush(smtp_out);
1631   }
1632
1633 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1634 that the OpenSSL library doesn't. */
1635
1636 SSL_set_wfd(server_ssl, fileno(smtp_out));
1637 SSL_set_rfd(server_ssl, fileno(smtp_in));
1638 SSL_set_accept_state(server_ssl);
1639
1640 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1641
1642 sigalrm_seen = FALSE;
1643 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1644 rc = SSL_accept(server_ssl);
1645 alarm(0);
1646
1647 if (rc <= 0)
1648   {
1649   tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
1650   if (ERR_get_error() == 0)
1651     log_write(0, LOG_MAIN,
1652         "TLS client disconnected cleanly (rejected our certificate?)");
1653   return FAIL;
1654   }
1655
1656 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1657
1658 /* TLS has been set up. Adjust the input functions to read via TLS,
1659 and initialize things. */
1660
1661 peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
1662
1663 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1664 tls_in.cipher = cipherbuf;
1665
1666 DEBUG(D_tls)
1667   {
1668   uschar buf[2048];
1669   if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
1670     debug_printf("Shared ciphers: %s\n", buf);
1671   }
1672
1673 /* Record the certificate we presented */
1674   {
1675   X509 * crt = SSL_get_certificate(server_ssl);
1676   tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1677   }
1678
1679 /* Only used by the server-side tls (tls_in), including tls_getc.
1680    Client-side (tls_out) reads (seem to?) go via
1681    smtp_read_response()/ip_recv().
1682    Hence no need to duplicate for _in and _out.
1683  */
1684 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1685 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1686 ssl_xfer_eof = ssl_xfer_error = 0;
1687
1688 receive_getc = tls_getc;
1689 receive_ungetc = tls_ungetc;
1690 receive_feof = tls_feof;
1691 receive_ferror = tls_ferror;
1692 receive_smtp_buffered = tls_smtp_buffered;
1693
1694 tls_in.active = fileno(smtp_out);
1695 return OK;
1696 }
1697
1698
1699
1700
1701 static int
1702 tls_client_basic_ctx_init(SSL_CTX * ctx,
1703     host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo
1704                           )
1705 {
1706 int rc;
1707 /* stick to the old behaviour for compatibility if tls_verify_certificates is
1708    set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1709    the specified host patterns if one of them is defined */
1710
1711 if (  (  !ob->tls_verify_hosts
1712       && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
1713       )
1714    || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
1715    )
1716   client_verify_optional = FALSE;
1717 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
1718   client_verify_optional = TRUE;
1719 else
1720   return OK;
1721
1722 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1723       ob->tls_crl, host, client_verify_optional, verify_callback_client)) != OK)
1724   return rc;
1725
1726 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
1727   {
1728   cbinfo->verify_cert_hostnames =
1729 #ifdef EXPERIMENTAL_INTERNATIONAL
1730     string_domain_utf8_to_alabel(host->name, NULL);
1731 #else
1732     host->name;
1733 #endif
1734   DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1735                     cbinfo->verify_cert_hostnames);
1736   }
1737 return OK;
1738 }
1739
1740
1741 #ifdef EXPERIMENTAL_DANE
1742 static int
1743 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
1744 {
1745 dns_record * rr;
1746 dns_scan dnss;
1747 const char * hostnames[2] = { CS host->name, NULL };
1748 int found = 0;
1749
1750 if (DANESSL_init(ssl, NULL, hostnames) != 1)
1751   return tls_error(US"hostnames load", host, NULL);
1752
1753 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1754      rr;
1755      rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1756     ) if (rr->type == T_TLSA)
1757   {
1758   uschar * p = rr->data;
1759   uint8_t usage, selector, mtype;
1760   const char * mdname;
1761
1762   usage = *p++;
1763
1764   /* Only DANE-TA(2) and DANE-EE(3) are supported */
1765   if (usage != 2 && usage != 3) continue;
1766
1767   selector = *p++;
1768   mtype = *p++;
1769
1770   switch (mtype)
1771     {
1772     default: continue;  /* Only match-types 0, 1, 2 are supported */
1773     case 0:  mdname = NULL; break;
1774     case 1:  mdname = "sha256"; break;
1775     case 2:  mdname = "sha512"; break;
1776     }
1777
1778   found++;
1779   switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
1780     {
1781     default:
1782     case 0:     /* action not taken */
1783       return tls_error(US"tlsa load", host, NULL);
1784     case 1:     break;
1785     }
1786
1787   tls_out.tlsa_usage |= 1<<usage;
1788   }
1789
1790 if (found)
1791   return OK;
1792
1793 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
1794 return DEFER;
1795 }
1796 #endif  /*EXPERIMENTAL_DANE*/
1797
1798
1799
1800 /*************************************************
1801 *    Start a TLS session in a client             *
1802 *************************************************/
1803
1804 /* Called from the smtp transport after STARTTLS has been accepted.
1805
1806 Argument:
1807   fd               the fd of the connection
1808   host             connected host (for messages)
1809   addr             the first address
1810   tb               transport (always smtp)
1811   tlsa_dnsa        tlsa lookup, if DANE, else null
1812
1813 Returns:           OK on success
1814                    FAIL otherwise - note that tls_error() will not give DEFER
1815                      because this is not a server
1816 */
1817
1818 int
1819 tls_client_start(int fd, host_item *host, address_item *addr,
1820   transport_instance *tb
1821 #ifdef EXPERIMENTAL_DANE
1822   , dns_answer * tlsa_dnsa
1823 #endif
1824   )
1825 {
1826 smtp_transport_options_block * ob =
1827   (smtp_transport_options_block *)tb->options_block;
1828 static uschar peerdn[256];
1829 uschar * expciphers;
1830 int rc;
1831 static uschar cipherbuf[256];
1832
1833 #ifndef DISABLE_OCSP
1834 BOOL request_ocsp = FALSE;
1835 BOOL require_ocsp = FALSE;
1836 #endif
1837
1838 #ifdef EXPERIMENTAL_DANE
1839 tls_out.tlsa_usage = 0;
1840 #endif
1841
1842 #ifndef DISABLE_OCSP
1843   {
1844 # ifdef EXPERIMENTAL_DANE
1845   if (  tlsa_dnsa
1846      && ob->hosts_request_ocsp[0] == '*'
1847      && ob->hosts_request_ocsp[1] == '\0'
1848      )
1849     {
1850     /* Unchanged from default.  Use a safer one under DANE */
1851     request_ocsp = TRUE;
1852     ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
1853                                       "   {= {4}{$tls_out_tlsa_usage}} } "
1854                                  " {*}{}}";
1855     }
1856 # endif
1857
1858   if ((require_ocsp =
1859         verify_check_given_host(&ob->hosts_require_ocsp, host) == OK))
1860     request_ocsp = TRUE;
1861   else
1862 # ifdef EXPERIMENTAL_DANE
1863     if (!request_ocsp)
1864 # endif
1865       request_ocsp =
1866         verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
1867   }
1868 #endif
1869
1870 rc = tls_init(&client_ctx, host, NULL,
1871     ob->tls_certificate, ob->tls_privatekey,
1872 #ifndef DISABLE_OCSP
1873     (void *)(long)request_ocsp,
1874 #endif
1875     addr, &client_static_cbinfo);
1876 if (rc != OK) return rc;
1877
1878 tls_out.certificate_verified = FALSE;
1879 client_verify_callback_called = FALSE;
1880
1881 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
1882     &expciphers))
1883   return FAIL;
1884
1885 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1886 are separated by underscores. So that I can use either form in my tests, and
1887 also for general convenience, we turn underscores into hyphens here. */
1888
1889 if (expciphers != NULL)
1890   {
1891   uschar *s = expciphers;
1892   while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1893   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1894   if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
1895     return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
1896   }
1897
1898 #ifdef EXPERIMENTAL_DANE
1899 if (tlsa_dnsa)
1900   {
1901   SSL_CTX_set_verify(client_ctx,
1902     SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
1903     verify_callback_client_dane);
1904
1905   if (!DANESSL_library_init())
1906     return tls_error(US"library init", host, NULL);
1907   if (DANESSL_CTX_init(client_ctx) <= 0)
1908     return tls_error(US"context init", host, NULL);
1909   }
1910 else
1911
1912 #endif
1913
1914   if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob, client_static_cbinfo))
1915       != OK)
1916     return rc;
1917
1918 if ((client_ssl = SSL_new(client_ctx)) == NULL)
1919   return tls_error(US"SSL_new", host, NULL);
1920 SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1921 SSL_set_fd(client_ssl, fd);
1922 SSL_set_connect_state(client_ssl);
1923
1924 if (ob->tls_sni)
1925   {
1926   if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
1927     return FAIL;
1928   if (tls_out.sni == NULL)
1929     {
1930     DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1931     }
1932   else if (!Ustrlen(tls_out.sni))
1933     tls_out.sni = NULL;
1934   else
1935     {
1936 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1937     DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1938     SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
1939 #else
1940     DEBUG(D_tls)
1941       debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
1942           tls_out.sni);
1943 #endif
1944     }
1945   }
1946
1947 #ifdef EXPERIMENTAL_DANE
1948 if (tlsa_dnsa)
1949   if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa)) != OK)
1950     return rc;
1951 #endif
1952
1953 #ifndef DISABLE_OCSP
1954 /* Request certificate status at connection-time.  If the server
1955 does OCSP stapling we will get the callback (set in tls_init()) */
1956 # ifdef EXPERIMENTAL_DANE
1957 if (request_ocsp)
1958   {
1959   const uschar * s;
1960   if (  ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
1961      || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
1962      )
1963     {   /* Re-eval now $tls_out_tlsa_usage is populated.  If
1964         this means we avoid the OCSP request, we wasted the setup
1965         cost in tls_init(). */
1966     require_ocsp = verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
1967     request_ocsp = require_ocsp
1968       || verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
1969     }
1970   }
1971 # endif
1972
1973 if (request_ocsp)
1974   {
1975   SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
1976   client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
1977   tls_out.ocsp = OCSP_NOT_RESP;
1978   }
1979 #endif
1980
1981 #ifdef EXPERIMENTAL_EVENT
1982 client_static_cbinfo->event_action = tb->event_action;
1983 #endif
1984
1985 /* There doesn't seem to be a built-in timeout on connection. */
1986
1987 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1988 sigalrm_seen = FALSE;
1989 alarm(ob->command_timeout);
1990 rc = SSL_connect(client_ssl);
1991 alarm(0);
1992
1993 #ifdef EXPERIMENTAL_DANE
1994 if (tlsa_dnsa)
1995   DANESSL_cleanup(client_ssl);
1996 #endif
1997
1998 if (rc <= 0)
1999   return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
2000
2001 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
2002
2003 peer_cert(client_ssl, &tls_out, peerdn, sizeof(peerdn));
2004
2005 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
2006 tls_out.cipher = cipherbuf;
2007
2008 /* Record the certificate we presented */
2009   {
2010   X509 * crt = SSL_get_certificate(client_ssl);
2011   tls_out.ourcert = crt ? X509_dup(crt) : NULL;
2012   }
2013
2014 tls_out.active = fd;
2015 return OK;
2016 }
2017
2018
2019
2020
2021
2022 /*************************************************
2023 *            TLS version of getc                 *
2024 *************************************************/
2025
2026 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2027 it refills the buffer via the SSL reading function.
2028
2029 Arguments:  none
2030 Returns:    the next character or EOF
2031
2032 Only used by the server-side TLS.
2033 */
2034
2035 int
2036 tls_getc(void)
2037 {
2038 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2039   {
2040   int error;
2041   int inbytes;
2042
2043   DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
2044     ssl_xfer_buffer, ssl_xfer_buffer_size);
2045
2046   if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2047   inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
2048   error = SSL_get_error(server_ssl, inbytes);
2049   alarm(0);
2050
2051   /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2052   closed down, not that the socket itself has been closed down. Revert to
2053   non-SSL handling. */
2054
2055   if (error == SSL_ERROR_ZERO_RETURN)
2056     {
2057     DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2058
2059     receive_getc = smtp_getc;
2060     receive_ungetc = smtp_ungetc;
2061     receive_feof = smtp_feof;
2062     receive_ferror = smtp_ferror;
2063     receive_smtp_buffered = smtp_buffered;
2064
2065     SSL_free(server_ssl);
2066     server_ssl = NULL;
2067     tls_in.active = -1;
2068     tls_in.bits = 0;
2069     tls_in.cipher = NULL;
2070     tls_in.peerdn = NULL;
2071     tls_in.sni = NULL;
2072
2073     return smtp_getc();
2074     }
2075
2076   /* Handle genuine errors */
2077
2078   else if (error == SSL_ERROR_SSL)
2079     {
2080     ERR_error_string(ERR_get_error(), ssl_errstring);
2081     log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
2082     ssl_xfer_error = 1;
2083     return EOF;
2084     }
2085
2086   else if (error != SSL_ERROR_NONE)
2087     {
2088     DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2089     ssl_xfer_error = 1;
2090     return EOF;
2091     }
2092
2093 #ifndef DISABLE_DKIM
2094   dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2095 #endif
2096   ssl_xfer_buffer_hwm = inbytes;
2097   ssl_xfer_buffer_lwm = 0;
2098   }
2099
2100 /* Something in the buffer; return next uschar */
2101
2102 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2103 }
2104
2105
2106
2107 /*************************************************
2108 *          Read bytes from TLS channel           *
2109 *************************************************/
2110
2111 /*
2112 Arguments:
2113   buff      buffer of data
2114   len       size of buffer
2115
2116 Returns:    the number of bytes read
2117             -1 after a failed read
2118
2119 Only used by the client-side TLS.
2120 */
2121
2122 int
2123 tls_read(BOOL is_server, uschar *buff, size_t len)
2124 {
2125 SSL *ssl = is_server ? server_ssl : client_ssl;
2126 int inbytes;
2127 int error;
2128
2129 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
2130   buff, (unsigned int)len);
2131
2132 inbytes = SSL_read(ssl, CS buff, len);
2133 error = SSL_get_error(ssl, inbytes);
2134
2135 if (error == SSL_ERROR_ZERO_RETURN)
2136   {
2137   DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2138   return -1;
2139   }
2140 else if (error != SSL_ERROR_NONE)
2141   {
2142   return -1;
2143   }
2144
2145 return inbytes;
2146 }
2147
2148
2149
2150
2151
2152 /*************************************************
2153 *         Write bytes down TLS channel           *
2154 *************************************************/
2155
2156 /*
2157 Arguments:
2158   is_server channel specifier
2159   buff      buffer of data
2160   len       number of bytes
2161
2162 Returns:    the number of bytes after a successful write,
2163             -1 after a failed write
2164
2165 Used by both server-side and client-side TLS.
2166 */
2167
2168 int
2169 tls_write(BOOL is_server, const uschar *buff, size_t len)
2170 {
2171 int outbytes;
2172 int error;
2173 int left = len;
2174 SSL *ssl = is_server ? server_ssl : client_ssl;
2175
2176 DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
2177 while (left > 0)
2178   {
2179   DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
2180   outbytes = SSL_write(ssl, CS buff, left);
2181   error = SSL_get_error(ssl, outbytes);
2182   DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2183   switch (error)
2184     {
2185     case SSL_ERROR_SSL:
2186     ERR_error_string(ERR_get_error(), ssl_errstring);
2187     log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2188     return -1;
2189
2190     case SSL_ERROR_NONE:
2191     left -= outbytes;
2192     buff += outbytes;
2193     break;
2194
2195     case SSL_ERROR_ZERO_RETURN:
2196     log_write(0, LOG_MAIN, "SSL channel closed on write");
2197     return -1;
2198
2199     case SSL_ERROR_SYSCALL:
2200     log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2201       sender_fullhost ? sender_fullhost : US"<unknown>",
2202       strerror(errno));
2203
2204     default:
2205     log_write(0, LOG_MAIN, "SSL_write error %d", error);
2206     return -1;
2207     }
2208   }
2209 return len;
2210 }
2211
2212
2213
2214 /*************************************************
2215 *         Close down a TLS session               *
2216 *************************************************/
2217
2218 /* This is also called from within a delivery subprocess forked from the
2219 daemon, to shut down the TLS library, without actually doing a shutdown (which
2220 would tamper with the SSL session in the parent process).
2221
2222 Arguments:   TRUE if SSL_shutdown is to be called
2223 Returns:     nothing
2224
2225 Used by both server-side and client-side TLS.
2226 */
2227
2228 void
2229 tls_close(BOOL is_server, BOOL shutdown)
2230 {
2231 SSL **sslp = is_server ? &server_ssl : &client_ssl;
2232 int *fdp = is_server ? &tls_in.active : &tls_out.active;
2233
2234 if (*fdp < 0) return;  /* TLS was not active */
2235
2236 if (shutdown)
2237   {
2238   DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
2239   SSL_shutdown(*sslp);
2240   }
2241
2242 SSL_free(*sslp);
2243 *sslp = NULL;
2244
2245 *fdp = -1;
2246 }
2247
2248
2249
2250
2251 /*************************************************
2252 *  Let tls_require_ciphers be checked at startup *
2253 *************************************************/
2254
2255 /* The tls_require_ciphers option, if set, must be something which the
2256 library can parse.
2257
2258 Returns:     NULL on success, or error message
2259 */
2260
2261 uschar *
2262 tls_validate_require_cipher(void)
2263 {
2264 SSL_CTX *ctx;
2265 uschar *s, *expciphers, *err;
2266
2267 /* this duplicates from tls_init(), we need a better "init just global
2268 state, for no specific purpose" singleton function of our own */
2269
2270 SSL_load_error_strings();
2271 OpenSSL_add_ssl_algorithms();
2272 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2273 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2274 list of available digests. */
2275 EVP_add_digest(EVP_sha256());
2276 #endif
2277
2278 if (!(tls_require_ciphers && *tls_require_ciphers))
2279   return NULL;
2280
2281 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2282   return US"failed to expand tls_require_ciphers";
2283
2284 if (!(expciphers && *expciphers))
2285   return NULL;
2286
2287 /* normalisation ripped from above */
2288 s = expciphers;
2289 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2290
2291 err = NULL;
2292
2293 ctx = SSL_CTX_new(SSLv23_server_method());
2294 if (!ctx)
2295   {
2296   ERR_error_string(ERR_get_error(), ssl_errstring);
2297   return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2298   }
2299
2300 DEBUG(D_tls)
2301   debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2302
2303 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2304   {
2305   ERR_error_string(ERR_get_error(), ssl_errstring);
2306   err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2307   }
2308
2309 SSL_CTX_free(ctx);
2310
2311 return err;
2312 }
2313
2314
2315
2316
2317 /*************************************************
2318 *         Report the library versions.           *
2319 *************************************************/
2320
2321 /* There have historically been some issues with binary compatibility in
2322 OpenSSL libraries; if Exim (like many other applications) is built against
2323 one version of OpenSSL but the run-time linker picks up another version,
2324 it can result in serious failures, including crashing with a SIGSEGV.  So
2325 report the version found by the compiler and the run-time version.
2326
2327 Note: some OS vendors backport security fixes without changing the version
2328 number/string, and the version date remains unchanged.  The _build_ date
2329 will change, so we can more usefully assist with version diagnosis by also
2330 reporting the build date.
2331
2332 Arguments:   a FILE* to print the results to
2333 Returns:     nothing
2334 */
2335
2336 void
2337 tls_version_report(FILE *f)
2338 {
2339 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
2340            "                          Runtime: %s\n"
2341            "                                 : %s\n",
2342            OPENSSL_VERSION_TEXT,
2343            SSLeay_version(SSLEAY_VERSION),
2344            SSLeay_version(SSLEAY_BUILT_ON));
2345 /* third line is 38 characters for the %s and the line is 73 chars long;
2346 the OpenSSL output includes a "built on: " prefix already. */
2347 }
2348
2349
2350
2351
2352 /*************************************************
2353 *            Random number generation            *
2354 *************************************************/
2355
2356 /* Pseudo-random number generation.  The result is not expected to be
2357 cryptographically strong but not so weak that someone will shoot themselves
2358 in the foot using it as a nonce in input in some email header scheme or
2359 whatever weirdness they'll twist this into.  The result should handle fork()
2360 and avoid repeating sequences.  OpenSSL handles that for us.
2361
2362 Arguments:
2363   max       range maximum
2364 Returns     a random number in range [0, max-1]
2365 */
2366
2367 int
2368 vaguely_random_number(int max)
2369 {
2370 unsigned int r;
2371 int i, needed_len;
2372 static pid_t pidlast = 0;
2373 pid_t pidnow;
2374 uschar *p;
2375 uschar smallbuf[sizeof(r)];
2376
2377 if (max <= 1)
2378   return 0;
2379
2380 pidnow = getpid();
2381 if (pidnow != pidlast)
2382   {
2383   /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2384   is unique for each thread", this doesn't apparently apply across processes,
2385   so our own warning from vaguely_random_number_fallback() applies here too.
2386   Fix per PostgreSQL. */
2387   if (pidlast != 0)
2388     RAND_cleanup();
2389   pidlast = pidnow;
2390   }
2391
2392 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2393 if (!RAND_status())
2394   {
2395   randstuff r;
2396   gettimeofday(&r.tv, NULL);
2397   r.p = getpid();
2398
2399   RAND_seed((uschar *)(&r), sizeof(r));
2400   }
2401 /* We're after pseudo-random, not random; if we still don't have enough data
2402 in the internal PRNG then our options are limited.  We could sleep and hope
2403 for entropy to come along (prayer technique) but if the system is so depleted
2404 in the first place then something is likely to just keep taking it.  Instead,
2405 we'll just take whatever little bit of pseudo-random we can still manage to
2406 get. */
2407
2408 needed_len = sizeof(r);
2409 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2410 asked for a number less than 10. */
2411 for (r = max, i = 0; r; ++i)
2412   r >>= 1;
2413 i = (i + 7) / 8;
2414 if (i < needed_len)
2415   needed_len = i;
2416
2417 /* We do not care if crypto-strong */
2418 i = RAND_pseudo_bytes(smallbuf, needed_len);
2419 if (i < 0)
2420   {
2421   DEBUG(D_all)
2422     debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2423   return vaguely_random_number_fallback(max);
2424   }
2425
2426 r = 0;
2427 for (p = smallbuf; needed_len; --needed_len, ++p)
2428   {
2429   r *= 256;
2430   r += *p;
2431   }
2432
2433 /* We don't particularly care about weighted results; if someone wants
2434 smooth distribution and cares enough then they should submit a patch then. */
2435 return r % max;
2436 }
2437
2438
2439
2440
2441 /*************************************************
2442 *        OpenSSL option parse                    *
2443 *************************************************/
2444
2445 /* Parse one option for tls_openssl_options_parse below
2446
2447 Arguments:
2448   name    one option name
2449   value   place to store a value for it
2450 Returns   success or failure in parsing
2451 */
2452
2453 struct exim_openssl_option {
2454   uschar *name;
2455   long    value;
2456 };
2457 /* We could use a macro to expand, but we need the ifdef and not all the
2458 options document which version they were introduced in.  Policylet: include
2459 all options unless explicitly for DTLS, let the administrator choose which
2460 to apply.
2461
2462 This list is current as of:
2463   ==>  1.0.1b  <==
2464 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2465 */
2466 static struct exim_openssl_option exim_openssl_options[] = {
2467 /* KEEP SORTED ALPHABETICALLY! */
2468 #ifdef SSL_OP_ALL
2469   { US"all", SSL_OP_ALL },
2470 #endif
2471 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
2472   { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
2473 #endif
2474 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
2475   { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
2476 #endif
2477 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
2478   { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
2479 #endif
2480 #ifdef SSL_OP_EPHEMERAL_RSA
2481   { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
2482 #endif
2483 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
2484   { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
2485 #endif
2486 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
2487   { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
2488 #endif
2489 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
2490   { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
2491 #endif
2492 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
2493   { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
2494 #endif
2495 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
2496   { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
2497 #endif
2498 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
2499   { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
2500 #endif
2501 #ifdef SSL_OP_NO_COMPRESSION
2502   { US"no_compression", SSL_OP_NO_COMPRESSION },
2503 #endif
2504 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2505   { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
2506 #endif
2507 #ifdef SSL_OP_NO_SSLv2
2508   { US"no_sslv2", SSL_OP_NO_SSLv2 },
2509 #endif
2510 #ifdef SSL_OP_NO_SSLv3
2511   { US"no_sslv3", SSL_OP_NO_SSLv3 },
2512 #endif
2513 #ifdef SSL_OP_NO_TICKET
2514   { US"no_ticket", SSL_OP_NO_TICKET },
2515 #endif
2516 #ifdef SSL_OP_NO_TLSv1
2517   { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2518 #endif
2519 #ifdef SSL_OP_NO_TLSv1_1
2520 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
2521   /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2522 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2523 #else
2524   { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2525 #endif
2526 #endif
2527 #ifdef SSL_OP_NO_TLSv1_2
2528   { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2529 #endif
2530 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2531   { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2532 #endif
2533 #ifdef SSL_OP_SINGLE_DH_USE
2534   { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
2535 #endif
2536 #ifdef SSL_OP_SINGLE_ECDH_USE
2537   { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
2538 #endif
2539 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
2540   { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
2541 #endif
2542 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
2543   { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
2544 #endif
2545 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
2546   { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
2547 #endif
2548 #ifdef SSL_OP_TLS_D5_BUG
2549   { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
2550 #endif
2551 #ifdef SSL_OP_TLS_ROLLBACK_BUG
2552   { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
2553 #endif
2554 };
2555 static int exim_openssl_options_size =
2556   sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2557
2558
2559 static BOOL
2560 tls_openssl_one_option_parse(uschar *name, long *value)
2561 {
2562 int first = 0;
2563 int last = exim_openssl_options_size;
2564 while (last > first)
2565   {
2566   int middle = (first + last)/2;
2567   int c = Ustrcmp(name, exim_openssl_options[middle].name);
2568   if (c == 0)
2569     {
2570     *value = exim_openssl_options[middle].value;
2571     return TRUE;
2572     }
2573   else if (c > 0)
2574     first = middle + 1;
2575   else
2576     last = middle;
2577   }
2578 return FALSE;
2579 }
2580
2581
2582
2583
2584 /*************************************************
2585 *        OpenSSL option parsing logic            *
2586 *************************************************/
2587
2588 /* OpenSSL has a number of compatibility options which an administrator might
2589 reasonably wish to set.  Interpret a list similarly to decode_bits(), so that
2590 we look like log_selector.
2591
2592 Arguments:
2593   option_spec  the administrator-supplied string of options
2594   results      ptr to long storage for the options bitmap
2595 Returns        success or failure
2596 */
2597
2598 BOOL
2599 tls_openssl_options_parse(uschar *option_spec, long *results)
2600 {
2601 long result, item;
2602 uschar *s, *end;
2603 uschar keep_c;
2604 BOOL adding, item_parsed;
2605
2606 result = 0L;
2607 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
2608  * from default because it increases BEAST susceptibility. */
2609 #ifdef SSL_OP_NO_SSLv2
2610 result |= SSL_OP_NO_SSLv2;
2611 #endif
2612
2613 if (option_spec == NULL)
2614   {
2615   *results = result;
2616   return TRUE;
2617   }
2618
2619 for (s=option_spec; *s != '\0'; /**/)
2620   {
2621   while (isspace(*s)) ++s;
2622   if (*s == '\0')
2623     break;
2624   if (*s != '+' && *s != '-')
2625     {
2626     DEBUG(D_tls) debug_printf("malformed openssl option setting: "
2627         "+ or - expected but found \"%s\"\n", s);
2628     return FALSE;
2629     }
2630   adding = *s++ == '+';
2631   for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2632   keep_c = *end;
2633   *end = '\0';
2634   item_parsed = tls_openssl_one_option_parse(s, &item);
2635   if (!item_parsed)
2636     {
2637     DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
2638     return FALSE;
2639     }
2640   DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2641       adding ? "adding" : "removing", result, item, s);
2642   if (adding)
2643     result |= item;
2644   else
2645     result &= ~item;
2646   *end = keep_c;
2647   s = end;
2648   }
2649
2650 *results = result;
2651 return TRUE;
2652 }
2653
2654 /* vi: aw ai sw=2
2655 */
2656 /* End of tls-openssl.c */