64e2fb061298734d69ffd1be7d45c9ba8d18ecbc
[exim.git] / src / src / tls-openssl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2014 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Portions Copyright (c) The OpenSSL Project 1999 */
9
10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11 library. It is #included into the tls.c file when that library is used. The
12 code herein is based on a patch that was originally contributed by Steve
13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15 No cryptographic code is included in Exim. All this module does is to call
16 functions from the OpenSSL library. */
17
18
19 /* Heading stuff */
20
21 #include <openssl/lhash.h>
22 #include <openssl/ssl.h>
23 #include <openssl/err.h>
24 #include <openssl/rand.h>
25 #ifndef DISABLE_OCSP
26 # include <openssl/ocsp.h>
27 #endif
28 #ifdef EXPERIMENTAL_DANE
29 # include <danessl.h>
30 #endif
31
32
33 #ifndef DISABLE_OCSP
34 # define EXIM_OCSP_SKEW_SECONDS (300L)
35 # define EXIM_OCSP_MAX_AGE (-1L)
36 #endif
37
38 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
39 # define EXIM_HAVE_OPENSSL_TLSEXT
40 #endif
41 #if OPENSSL_VERSION_NUMBER >= 0x010100000L
42 # define EXIM_HAVE_OPENSSL_CHECKHOST
43 #endif
44 #if OPENSSL_VERSION_NUMBER >= 0x010000000L \
45 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
46 # define EXIM_HAVE_OPENSSL_CHECKHOST
47 #endif
48
49 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
50 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
51 # define DISABLE_OCSP
52 #endif
53
54 /* Structure for collecting random data for seeding. */
55
56 typedef struct randstuff {
57 struct timeval tv;
58 pid_t p;
59 } randstuff;
60
61 /* Local static variables */
62
63 static BOOL client_verify_callback_called = FALSE;
64 static BOOL server_verify_callback_called = FALSE;
65 static const uschar *sid_ctx = US"exim";
66
67 /* We have three different contexts to care about.
68
69 Simple case: client, `client_ctx`
70 As a client, we can be doing a callout or cut-through delivery while receiving
71 a message. So we have a client context, which should have options initialised
72 from the SMTP Transport.
73
74 Server:
75 There are two cases: with and without ServerNameIndication from the client.
76 Given TLS SNI, we can be using different keys, certs and various other
77 configuration settings, because they're re-expanded with $tls_sni set. This
78 allows vhosting with TLS. This SNI is sent in the handshake.
79 A client might not send SNI, so we need a fallback, and an initial setup too.
80 So as a server, we start out using `server_ctx`.
81 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
82 `server_sni` from `server_ctx` and then initialise settings by re-expanding
83 configuration.
84 */
85
86 static SSL_CTX *client_ctx = NULL;
87 static SSL_CTX *server_ctx = NULL;
88 static SSL *client_ssl = NULL;
89 static SSL *server_ssl = NULL;
90
91 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
92 static SSL_CTX *server_sni = NULL;
93 #endif
94
95 static char ssl_errstring[256];
96
97 static int ssl_session_timeout = 200;
98 static BOOL client_verify_optional = FALSE;
99 static BOOL server_verify_optional = FALSE;
100
101 static BOOL reexpand_tls_files_for_sni = FALSE;
102
103
104 typedef struct tls_ext_ctx_cb {
105 uschar *certificate;
106 uschar *privatekey;
107 #ifndef DISABLE_OCSP
108 BOOL is_server;
109 union {
110 struct {
111 uschar *file;
112 uschar *file_expanded;
113 OCSP_RESPONSE *response;
114 } server;
115 struct {
116 X509_STORE *verify_store; /* non-null if status requested */
117 BOOL verify_required;
118 } client;
119 } u_ocsp;
120 #endif
121 uschar *dhparam;
122 /* these are cached from first expand */
123 uschar *server_cipher_list;
124 /* only passed down to tls_error: */
125 host_item *host;
126 const uschar * verify_cert_hostnames;
127 #ifdef EXPERIMENTAL_EVENT
128 uschar * event_action;
129 #endif
130 } tls_ext_ctx_cb;
131
132 /* should figure out a cleanup of API to handle state preserved per
133 implementation, for various reasons, which can be void * in the APIs.
134 For now, we hack around it. */
135 tls_ext_ctx_cb *client_static_cbinfo = NULL;
136 tls_ext_ctx_cb *server_static_cbinfo = NULL;
137
138 static int
139 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
140 int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
141
142 /* Callbacks */
143 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
144 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
145 #endif
146 #ifndef DISABLE_OCSP
147 static int tls_server_stapling_cb(SSL *s, void *arg);
148 #endif
149
150
151 /*************************************************
152 * Handle TLS error *
153 *************************************************/
154
155 /* Called from lots of places when errors occur before actually starting to do
156 the TLS handshake, that is, while the session is still in clear. Always returns
157 DEFER for a server and FAIL for a client so that most calls can use "return
158 tls_error(...)" to do this processing and then give an appropriate return. A
159 single function is used for both server and client, because it is called from
160 some shared functions.
161
162 Argument:
163 prefix text to include in the logged error
164 host NULL if setting up a server;
165 the connected host if setting up a client
166 msg error message or NULL if we should ask OpenSSL
167
168 Returns: OK/DEFER/FAIL
169 */
170
171 static int
172 tls_error(uschar * prefix, const host_item * host, uschar * msg)
173 {
174 if (!msg)
175 {
176 ERR_error_string(ERR_get_error(), ssl_errstring);
177 msg = (uschar *)ssl_errstring;
178 }
179
180 if (host)
181 {
182 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s): %s",
183 host->name, host->address, prefix, msg);
184 return FAIL;
185 }
186 else
187 {
188 uschar *conn_info = smtp_get_connection_info();
189 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
190 conn_info += 5;
191 /* I'd like to get separated H= here, but too hard for now */
192 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
193 conn_info, prefix, msg);
194 return DEFER;
195 }
196 }
197
198
199
200 /*************************************************
201 * Callback to generate RSA key *
202 *************************************************/
203
204 /*
205 Arguments:
206 s SSL connection
207 export not used
208 keylength keylength
209
210 Returns: pointer to generated key
211 */
212
213 static RSA *
214 rsa_callback(SSL *s, int export, int keylength)
215 {
216 RSA *rsa_key;
217 export = export; /* Shut picky compilers up */
218 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
219 rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
220 if (rsa_key == NULL)
221 {
222 ERR_error_string(ERR_get_error(), ssl_errstring);
223 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
224 ssl_errstring);
225 return NULL;
226 }
227 return rsa_key;
228 }
229
230
231
232 /* Extreme debug
233 #ifndef DISABLE_OCSP
234 void
235 x509_store_dump_cert_s_names(X509_STORE * store)
236 {
237 STACK_OF(X509_OBJECT) * roots= store->objs;
238 int i;
239 static uschar name[256];
240
241 for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
242 {
243 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
244 if(tmp_obj->type == X509_LU_X509)
245 {
246 X509 * current_cert= tmp_obj->data.x509;
247 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
248 name[sizeof(name)-1] = '\0';
249 debug_printf(" %s\n", name);
250 }
251 }
252 }
253 #endif
254 */
255
256
257 #ifdef EXPERIMENTAL_EVENT
258 static int
259 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
260 BOOL *calledp, const BOOL *optionalp, const uschar * what)
261 {
262 uschar * ev;
263 uschar * yield;
264 X509 * old_cert;
265
266 ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
267 if (ev)
268 {
269 old_cert = tlsp->peercert;
270 tlsp->peercert = X509_dup(cert);
271 /* NB we do not bother setting peerdn */
272 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
273 {
274 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
275 "depth=%d cert=%s: %s",
276 tlsp == &tls_out ? deliver_host_address : sender_host_address,
277 what, depth, dn, yield);
278 *calledp = TRUE;
279 if (!*optionalp)
280 {
281 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
282 return 1; /* reject (leaving peercert set) */
283 }
284 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
285 "(host in tls_try_verify_hosts)\n");
286 }
287 X509_free(tlsp->peercert);
288 tlsp->peercert = old_cert;
289 }
290 return 0;
291 }
292 #endif
293
294 /*************************************************
295 * Callback for verification *
296 *************************************************/
297
298 /* The SSL library does certificate verification if set up to do so. This
299 callback has the current yes/no state is in "state". If verification succeeded,
300 we set the certificate-verified flag. If verification failed, what happens
301 depends on whether the client is required to present a verifiable certificate
302 or not.
303
304 If verification is optional, we change the state to yes, but still log the
305 verification error. For some reason (it really would help to have proper
306 documentation of OpenSSL), this callback function then gets called again, this
307 time with state = 1. We must take care not to set the private verified flag on
308 the second time through.
309
310 Note: this function is not called if the client fails to present a certificate
311 when asked. We get here only if a certificate has been received. Handling of
312 optional verification for this case is done when requesting SSL to verify, by
313 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
314
315 May be called multiple times for different issues with a certificate, even
316 for a given "depth" in the certificate chain.
317
318 Arguments:
319 state current yes/no state as 1/0
320 x509ctx certificate information.
321 client TRUE for client startup, FALSE for server startup
322
323 Returns: 1 if verified, 0 if not
324 */
325
326 static int
327 verify_callback(int state, X509_STORE_CTX *x509ctx,
328 tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
329 {
330 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
331 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
332 uschar dn[256];
333
334 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
335 dn[sizeof(dn)-1] = '\0';
336
337 if (state == 0)
338 {
339 log_write(0, LOG_MAIN, "[%s] SSL verify error: depth=%d error=%s cert=%s",
340 tlsp == &tls_out ? deliver_host_address : sender_host_address,
341 depth,
342 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
343 dn);
344 *calledp = TRUE;
345 if (!*optionalp)
346 {
347 if (!tlsp->peercert)
348 tlsp->peercert = X509_dup(cert); /* record failing cert */
349 return 0; /* reject */
350 }
351 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
352 "tls_try_verify_hosts)\n");
353 }
354
355 else if (depth != 0)
356 {
357 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
358 #ifndef DISABLE_OCSP
359 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
360 { /* client, wanting stapling */
361 /* Add the server cert's signing chain as the one
362 for the verification of the OCSP stapled information. */
363
364 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
365 cert))
366 ERR_clear_error();
367 }
368 #endif
369 #ifdef EXPERIMENTAL_EVENT
370 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
371 return 0; /* reject, with peercert set */
372 #endif
373 }
374 else
375 {
376 const uschar * verify_cert_hostnames;
377
378 if ( tlsp == &tls_out
379 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
380 /* client, wanting hostname check */
381 {
382
383 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
384 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
385 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
386 # endif
387 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
388 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
389 # endif
390 int sep = 0;
391 const uschar * list = verify_cert_hostnames;
392 uschar * name;
393 int rc;
394 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
395 if ((rc = X509_check_host(cert, name, 0,
396 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
397 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
398 NULL)))
399 {
400 if (rc < 0)
401 {
402 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
403 tlsp == &tls_out ? deliver_host_address : sender_host_address);
404 name = NULL;
405 }
406 break;
407 }
408 if (!name)
409 #else
410 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
411 #endif
412 {
413 log_write(0, LOG_MAIN,
414 "[%s] SSL verify error: certificate name mismatch: \"%s\"",
415 tlsp == &tls_out ? deliver_host_address : sender_host_address,
416 dn);
417 *calledp = TRUE;
418 if (!*optionalp)
419 {
420 if (!tlsp->peercert)
421 tlsp->peercert = X509_dup(cert); /* record failing cert */
422 return 0; /* reject */
423 }
424 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
425 "tls_try_verify_hosts)\n");
426 }
427 }
428
429 #ifdef EXPERIMENTAL_EVENT
430 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
431 return 0; /* reject, with peercert set */
432 #endif
433
434 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
435 *calledp ? "" : " authenticated", dn);
436 if (!*calledp) tlsp->certificate_verified = TRUE;
437 *calledp = TRUE;
438 }
439
440 return 1; /* accept, at least for this level */
441 }
442
443 static int
444 verify_callback_client(int state, X509_STORE_CTX *x509ctx)
445 {
446 return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
447 }
448
449 static int
450 verify_callback_server(int state, X509_STORE_CTX *x509ctx)
451 {
452 return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
453 }
454
455
456 #ifdef EXPERIMENTAL_DANE
457
458 /* This gets called *by* the dane library verify callback, which interposes
459 itself.
460 */
461 static int
462 verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
463 {
464 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
465 uschar dn[256];
466 #ifdef EXPERIMENTAL_EVENT
467 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
468 BOOL dummy_called, optional = FALSE;
469 #endif
470
471 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
472 dn[sizeof(dn)-1] = '\0';
473
474 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", dn);
475
476 #ifdef EXPERIMENTAL_EVENT
477 if (verify_event(&tls_out, cert, depth, dn,
478 &dummy_called, &optional, US"DANE"))
479 return 0; /* reject, with peercert set */
480 #endif
481
482 if (state == 1)
483 tls_out.dane_verified =
484 tls_out.certificate_verified = TRUE;
485 return 1;
486 }
487
488 #endif /*EXPERIMENTAL_DANE*/
489
490
491 /*************************************************
492 * Information callback *
493 *************************************************/
494
495 /* The SSL library functions call this from time to time to indicate what they
496 are doing. We copy the string to the debugging output when TLS debugging has
497 been requested.
498
499 Arguments:
500 s the SSL connection
501 where
502 ret
503
504 Returns: nothing
505 */
506
507 static void
508 info_callback(SSL *s, int where, int ret)
509 {
510 where = where;
511 ret = ret;
512 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
513 }
514
515
516
517 /*************************************************
518 * Initialize for DH *
519 *************************************************/
520
521 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
522
523 Arguments:
524 dhparam DH parameter file or fixed parameter identity string
525 host connected host, if client; NULL if server
526
527 Returns: TRUE if OK (nothing to set up, or setup worked)
528 */
529
530 static BOOL
531 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host)
532 {
533 BIO *bio;
534 DH *dh;
535 uschar *dhexpanded;
536 const char *pem;
537
538 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
539 return FALSE;
540
541 if (!dhexpanded || !*dhexpanded)
542 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
543 else if (dhexpanded[0] == '/')
544 {
545 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
546 {
547 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
548 host, US strerror(errno));
549 return FALSE;
550 }
551 }
552 else
553 {
554 if (Ustrcmp(dhexpanded, "none") == 0)
555 {
556 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
557 return TRUE;
558 }
559
560 if (!(pem = std_dh_prime_named(dhexpanded)))
561 {
562 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
563 host, US strerror(errno));
564 return FALSE;
565 }
566 bio = BIO_new_mem_buf(CS pem, -1);
567 }
568
569 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
570 {
571 BIO_free(bio);
572 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
573 host, NULL);
574 return FALSE;
575 }
576
577 /* Even if it is larger, we silently return success rather than cause things
578 * to fail out, so that a too-large DH will not knock out all TLS; it's a
579 * debatable choice. */
580 if ((8*DH_size(dh)) > tls_dh_max_bits)
581 {
582 DEBUG(D_tls)
583 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
584 8*DH_size(dh), tls_dh_max_bits);
585 }
586 else
587 {
588 SSL_CTX_set_tmp_dh(sctx, dh);
589 DEBUG(D_tls)
590 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
591 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
592 }
593
594 DH_free(dh);
595 BIO_free(bio);
596
597 return TRUE;
598 }
599
600
601
602
603 #ifndef DISABLE_OCSP
604 /*************************************************
605 * Load OCSP information into state *
606 *************************************************/
607
608 /* Called to load the server OCSP response from the given file into memory, once
609 caller has determined this is needed. Checks validity. Debugs a message
610 if invalid.
611
612 ASSUMES: single response, for single cert.
613
614 Arguments:
615 sctx the SSL_CTX* to update
616 cbinfo various parts of session state
617 expanded the filename putatively holding an OCSP response
618
619 */
620
621 static void
622 ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
623 {
624 BIO *bio;
625 OCSP_RESPONSE *resp;
626 OCSP_BASICRESP *basic_response;
627 OCSP_SINGLERESP *single_response;
628 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
629 X509_STORE *store;
630 unsigned long verify_flags;
631 int status, reason, i;
632
633 cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
634 if (cbinfo->u_ocsp.server.response)
635 {
636 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
637 cbinfo->u_ocsp.server.response = NULL;
638 }
639
640 bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
641 if (!bio)
642 {
643 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
644 cbinfo->u_ocsp.server.file_expanded);
645 return;
646 }
647
648 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
649 BIO_free(bio);
650 if (!resp)
651 {
652 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
653 return;
654 }
655
656 status = OCSP_response_status(resp);
657 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
658 {
659 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
660 OCSP_response_status_str(status), status);
661 goto bad;
662 }
663
664 basic_response = OCSP_response_get1_basic(resp);
665 if (!basic_response)
666 {
667 DEBUG(D_tls)
668 debug_printf("OCSP response parse error: unable to extract basic response.\n");
669 goto bad;
670 }
671
672 store = SSL_CTX_get_cert_store(sctx);
673 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
674
675 /* May need to expose ability to adjust those flags?
676 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
677 OCSP_TRUSTOTHER OCSP_NOINTERN */
678
679 i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
680 if (i <= 0)
681 {
682 DEBUG(D_tls) {
683 ERR_error_string(ERR_get_error(), ssl_errstring);
684 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
685 }
686 goto bad;
687 }
688
689 /* Here's the simplifying assumption: there's only one response, for the
690 one certificate we use, and nothing for anything else in a chain. If this
691 proves false, we need to extract a cert id from our issued cert
692 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
693 right cert in the stack and then calls OCSP_single_get0_status()).
694
695 I'm hoping to avoid reworking a bunch more of how we handle state here. */
696 single_response = OCSP_resp_get0(basic_response, 0);
697 if (!single_response)
698 {
699 DEBUG(D_tls)
700 debug_printf("Unable to get first response from OCSP basic response.\n");
701 goto bad;
702 }
703
704 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
705 if (status != V_OCSP_CERTSTATUS_GOOD)
706 {
707 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
708 OCSP_cert_status_str(status), status,
709 OCSP_crl_reason_str(reason), reason);
710 goto bad;
711 }
712
713 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
714 {
715 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
716 goto bad;
717 }
718
719 supply_response:
720 cbinfo->u_ocsp.server.response = resp;
721 return;
722
723 bad:
724 if (running_in_test_harness)
725 {
726 extern char ** environ;
727 uschar ** p;
728 for (p = USS environ; *p != NULL; p++)
729 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
730 {
731 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
732 goto supply_response;
733 }
734 }
735 return;
736 }
737 #endif /*!DISABLE_OCSP*/
738
739
740
741
742 /*************************************************
743 * Expand key and cert file specs *
744 *************************************************/
745
746 /* Called once during tls_init and possibly again during TLS setup, for a
747 new context, if Server Name Indication was used and tls_sni was seen in
748 the certificate string.
749
750 Arguments:
751 sctx the SSL_CTX* to update
752 cbinfo various parts of session state
753
754 Returns: OK/DEFER/FAIL
755 */
756
757 static int
758 tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
759 {
760 uschar *expanded;
761
762 if (cbinfo->certificate == NULL)
763 return OK;
764
765 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
766 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
767 Ustrstr(cbinfo->certificate, US"tls_out_sni")
768 )
769 reexpand_tls_files_for_sni = TRUE;
770
771 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
772 return DEFER;
773
774 if (expanded != NULL)
775 {
776 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
777 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
778 return tls_error(string_sprintf(
779 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
780 cbinfo->host, NULL);
781 }
782
783 if (cbinfo->privatekey != NULL &&
784 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
785 return DEFER;
786
787 /* If expansion was forced to fail, key_expanded will be NULL. If the result
788 of the expansion is an empty string, ignore it also, and assume the private
789 key is in the same file as the certificate. */
790
791 if (expanded != NULL && *expanded != 0)
792 {
793 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
794 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
795 return tls_error(string_sprintf(
796 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
797 }
798
799 #ifndef DISABLE_OCSP
800 if (cbinfo->is_server && cbinfo->u_ocsp.server.file != NULL)
801 {
802 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
803 return DEFER;
804
805 if (expanded != NULL && *expanded != 0)
806 {
807 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
808 if (cbinfo->u_ocsp.server.file_expanded &&
809 (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
810 {
811 DEBUG(D_tls)
812 debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
813 } else {
814 ocsp_load_response(sctx, cbinfo, expanded);
815 }
816 }
817 }
818 #endif
819
820 return OK;
821 }
822
823
824
825
826 /*************************************************
827 * Callback to handle SNI *
828 *************************************************/
829
830 /* Called when acting as server during the TLS session setup if a Server Name
831 Indication extension was sent by the client.
832
833 API documentation is OpenSSL s_server.c implementation.
834
835 Arguments:
836 s SSL* of the current session
837 ad unknown (part of OpenSSL API) (unused)
838 arg Callback of "our" registered data
839
840 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
841 */
842
843 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
844 static int
845 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
846 {
847 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
848 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
849 int rc;
850 int old_pool = store_pool;
851
852 if (!servername)
853 return SSL_TLSEXT_ERR_OK;
854
855 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
856 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
857
858 /* Make the extension value available for expansion */
859 store_pool = POOL_PERM;
860 tls_in.sni = string_copy(US servername);
861 store_pool = old_pool;
862
863 if (!reexpand_tls_files_for_sni)
864 return SSL_TLSEXT_ERR_OK;
865
866 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
867 not confident that memcpy wouldn't break some internal reference counting.
868 Especially since there's a references struct member, which would be off. */
869
870 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
871 {
872 ERR_error_string(ERR_get_error(), ssl_errstring);
873 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
874 return SSL_TLSEXT_ERR_NOACK;
875 }
876
877 /* Not sure how many of these are actually needed, since SSL object
878 already exists. Might even need this selfsame callback, for reneg? */
879
880 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
881 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
882 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
883 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
884 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
885 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
886 if (cbinfo->server_cipher_list)
887 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
888 #ifndef DISABLE_OCSP
889 if (cbinfo->u_ocsp.server.file)
890 {
891 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
892 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
893 }
894 #endif
895
896 rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
897 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
898
899 /* do this after setup_certs, because this can require the certs for verifying
900 OCSP information. */
901 rc = tls_expand_session_files(server_sni, cbinfo);
902 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
903
904 if (!init_dh(server_sni, cbinfo->dhparam, NULL))
905 return SSL_TLSEXT_ERR_NOACK;
906
907 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
908 SSL_set_SSL_CTX(s, server_sni);
909
910 return SSL_TLSEXT_ERR_OK;
911 }
912 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
913
914
915
916
917 #ifndef DISABLE_OCSP
918
919 /*************************************************
920 * Callback to handle OCSP Stapling *
921 *************************************************/
922
923 /* Called when acting as server during the TLS session setup if the client
924 requests OCSP information with a Certificate Status Request.
925
926 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
927 project.
928
929 */
930
931 static int
932 tls_server_stapling_cb(SSL *s, void *arg)
933 {
934 const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
935 uschar *response_der;
936 int response_der_len;
937
938 DEBUG(D_tls)
939 debug_printf("Received TLS status request (OCSP stapling); %s response.",
940 cbinfo->u_ocsp.server.response ? "have" : "lack");
941
942 tls_in.ocsp = OCSP_NOT_RESP;
943 if (!cbinfo->u_ocsp.server.response)
944 return SSL_TLSEXT_ERR_NOACK;
945
946 response_der = NULL;
947 response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
948 &response_der);
949 if (response_der_len <= 0)
950 return SSL_TLSEXT_ERR_NOACK;
951
952 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
953 tls_in.ocsp = OCSP_VFIED;
954 return SSL_TLSEXT_ERR_OK;
955 }
956
957
958 static void
959 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
960 {
961 BIO_printf(bp, "\t%s: ", str);
962 ASN1_GENERALIZEDTIME_print(bp, time);
963 BIO_puts(bp, "\n");
964 }
965
966 static int
967 tls_client_stapling_cb(SSL *s, void *arg)
968 {
969 tls_ext_ctx_cb * cbinfo = arg;
970 const unsigned char * p;
971 int len;
972 OCSP_RESPONSE * rsp;
973 OCSP_BASICRESP * bs;
974 int i;
975
976 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
977 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
978 if(!p)
979 {
980 /* Expect this when we requested ocsp but got none */
981 if ( cbinfo->u_ocsp.client.verify_required
982 && log_extra_selector & LX_tls_cipher)
983 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
984 else
985 DEBUG(D_tls) debug_printf(" null\n");
986 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
987 }
988
989 if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
990 {
991 tls_out.ocsp = OCSP_FAILED;
992 if (log_extra_selector & LX_tls_cipher)
993 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
994 else
995 DEBUG(D_tls) debug_printf(" parse error\n");
996 return 0;
997 }
998
999 if(!(bs = OCSP_response_get1_basic(rsp)))
1000 {
1001 tls_out.ocsp = OCSP_FAILED;
1002 if (log_extra_selector & LX_tls_cipher)
1003 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
1004 else
1005 DEBUG(D_tls) debug_printf(" error parsing response\n");
1006 OCSP_RESPONSE_free(rsp);
1007 return 0;
1008 }
1009
1010 /* We'd check the nonce here if we'd put one in the request. */
1011 /* However that would defeat cacheability on the server so we don't. */
1012
1013 /* This section of code reworked from OpenSSL apps source;
1014 The OpenSSL Project retains copyright:
1015 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1016 */
1017 {
1018 BIO * bp = NULL;
1019 int status, reason;
1020 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1021
1022 DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1023
1024 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1025
1026 /* Use the chain that verified the server cert to verify the stapled info */
1027 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1028
1029 if ((i = OCSP_basic_verify(bs, NULL,
1030 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
1031 {
1032 tls_out.ocsp = OCSP_FAILED;
1033 if (log_extra_selector & LX_tls_cipher)
1034 log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
1035 BIO_printf(bp, "OCSP response verify failure\n");
1036 ERR_print_errors(bp);
1037 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1038 goto out;
1039 }
1040
1041 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1042
1043 {
1044 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1045 OCSP_SINGLERESP * single;
1046
1047 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1048 {
1049 tls_out.ocsp = OCSP_FAILED;
1050 log_write(0, LOG_MAIN, "OCSP stapling "
1051 "with multiple responses not handled");
1052 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1053 goto out;
1054 }
1055 single = OCSP_resp_get0(bs, 0);
1056 status = OCSP_single_get0_status(single, &reason, &rev,
1057 &thisupd, &nextupd);
1058 }
1059
1060 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1061 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1062 if (!OCSP_check_validity(thisupd, nextupd,
1063 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1064 {
1065 tls_out.ocsp = OCSP_FAILED;
1066 DEBUG(D_tls) ERR_print_errors(bp);
1067 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1068 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1069 }
1070 else
1071 {
1072 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1073 OCSP_cert_status_str(status));
1074 switch(status)
1075 {
1076 case V_OCSP_CERTSTATUS_GOOD:
1077 tls_out.ocsp = OCSP_VFIED;
1078 i = 1;
1079 break;
1080 case V_OCSP_CERTSTATUS_REVOKED:
1081 tls_out.ocsp = OCSP_FAILED;
1082 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1083 reason != -1 ? "; reason: " : "",
1084 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1085 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1086 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1087 break;
1088 default:
1089 tls_out.ocsp = OCSP_FAILED;
1090 log_write(0, LOG_MAIN,
1091 "Server certificate status unknown, in OCSP stapling");
1092 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1093 break;
1094 }
1095 }
1096 out:
1097 BIO_free(bp);
1098 }
1099
1100 OCSP_RESPONSE_free(rsp);
1101 return i;
1102 }
1103 #endif /*!DISABLE_OCSP*/
1104
1105
1106 /*************************************************
1107 * Initialize for TLS *
1108 *************************************************/
1109
1110 /* Called from both server and client code, to do preliminary initialization
1111 of the library. We allocate and return a context structure.
1112
1113 Arguments:
1114 ctxp returned SSL context
1115 host connected host, if client; NULL if server
1116 dhparam DH parameter file
1117 certificate certificate file
1118 privatekey private key
1119 ocsp_file file of stapling info (server); flag for require ocsp (client)
1120 addr address if client; NULL if server (for some randomness)
1121 cbp place to put allocated callback context
1122
1123 Returns: OK/DEFER/FAIL
1124 */
1125
1126 static int
1127 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
1128 uschar *privatekey,
1129 #ifndef DISABLE_OCSP
1130 uschar *ocsp_file,
1131 #endif
1132 address_item *addr, tls_ext_ctx_cb ** cbp)
1133 {
1134 long init_options;
1135 int rc;
1136 BOOL okay;
1137 tls_ext_ctx_cb * cbinfo;
1138
1139 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1140 cbinfo->certificate = certificate;
1141 cbinfo->privatekey = privatekey;
1142 #ifndef DISABLE_OCSP
1143 if ((cbinfo->is_server = host==NULL))
1144 {
1145 cbinfo->u_ocsp.server.file = ocsp_file;
1146 cbinfo->u_ocsp.server.file_expanded = NULL;
1147 cbinfo->u_ocsp.server.response = NULL;
1148 }
1149 else
1150 cbinfo->u_ocsp.client.verify_store = NULL;
1151 #endif
1152 cbinfo->dhparam = dhparam;
1153 cbinfo->server_cipher_list = NULL;
1154 cbinfo->host = host;
1155 #ifdef EXPERIMENTAL_EVENT
1156 cbinfo->event_action = NULL;
1157 #endif
1158
1159 SSL_load_error_strings(); /* basic set up */
1160 OpenSSL_add_ssl_algorithms();
1161
1162 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
1163 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1164 list of available digests. */
1165 EVP_add_digest(EVP_sha256());
1166 #endif
1167
1168 /* Create a context.
1169 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1170 negotiation in the different methods; as far as I can tell, the only
1171 *_{server,client}_method which allows negotiation is SSLv23, which exists even
1172 when OpenSSL is built without SSLv2 support.
1173 By disabling with openssl_options, we can let admins re-enable with the
1174 existing knob. */
1175
1176 *ctxp = SSL_CTX_new((host == NULL)?
1177 SSLv23_server_method() : SSLv23_client_method());
1178
1179 if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
1180
1181 /* It turns out that we need to seed the random number generator this early in
1182 order to get the full complement of ciphers to work. It took me roughly a day
1183 of work to discover this by experiment.
1184
1185 On systems that have /dev/urandom, SSL may automatically seed itself from
1186 there. Otherwise, we have to make something up as best we can. Double check
1187 afterwards. */
1188
1189 if (!RAND_status())
1190 {
1191 randstuff r;
1192 gettimeofday(&r.tv, NULL);
1193 r.p = getpid();
1194
1195 RAND_seed((uschar *)(&r), sizeof(r));
1196 RAND_seed((uschar *)big_buffer, big_buffer_size);
1197 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1198
1199 if (!RAND_status())
1200 return tls_error(US"RAND_status", host,
1201 US"unable to seed random number generator");
1202 }
1203
1204 /* Set up the information callback, which outputs if debugging is at a suitable
1205 level. */
1206
1207 DEBUG(D_tls) SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
1208
1209 /* Automatically re-try reads/writes after renegotiation. */
1210 (void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
1211
1212 /* Apply administrator-supplied work-arounds.
1213 Historically we applied just one requested option,
1214 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1215 moved to an administrator-controlled list of options to specify and
1216 grandfathered in the first one as the default value for "openssl_options".
1217
1218 No OpenSSL version number checks: the options we accept depend upon the
1219 availability of the option value macros from OpenSSL. */
1220
1221 okay = tls_openssl_options_parse(openssl_options, &init_options);
1222 if (!okay)
1223 return tls_error(US"openssl_options parsing failed", host, NULL);
1224
1225 if (init_options)
1226 {
1227 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
1228 if (!(SSL_CTX_set_options(*ctxp, init_options)))
1229 return tls_error(string_sprintf(
1230 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1231 }
1232 else
1233 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
1234
1235 /* Initialize with DH parameters if supplied */
1236
1237 if (!init_dh(*ctxp, dhparam, host)) return DEFER;
1238
1239 /* Set up certificate and key (and perhaps OCSP info) */
1240
1241 rc = tls_expand_session_files(*ctxp, cbinfo);
1242 if (rc != OK) return rc;
1243
1244 /* If we need to handle SNI, do so */
1245 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1246 if (host == NULL) /* server */
1247 {
1248 # ifndef DISABLE_OCSP
1249 /* We check u_ocsp.server.file, not server.response, because we care about if
1250 the option exists, not what the current expansion might be, as SNI might
1251 change the certificate and OCSP file in use between now and the time the
1252 callback is invoked. */
1253 if (cbinfo->u_ocsp.server.file)
1254 {
1255 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
1256 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
1257 }
1258 # endif
1259 /* We always do this, so that $tls_sni is available even if not used in
1260 tls_certificate */
1261 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1262 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
1263 }
1264 # ifndef DISABLE_OCSP
1265 else /* client */
1266 if(ocsp_file) /* wanting stapling */
1267 {
1268 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1269 {
1270 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1271 return FAIL;
1272 }
1273 SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1274 SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1275 }
1276 # endif
1277 #endif
1278
1279 cbinfo->verify_cert_hostnames = NULL;
1280
1281 /* Set up the RSA callback */
1282
1283 SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
1284
1285 /* Finally, set the timeout, and we are done */
1286
1287 SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
1288 DEBUG(D_tls) debug_printf("Initialized TLS\n");
1289
1290 *cbp = cbinfo;
1291
1292 return OK;
1293 }
1294
1295
1296
1297
1298 /*************************************************
1299 * Get name of cipher in use *
1300 *************************************************/
1301
1302 /*
1303 Argument: pointer to an SSL structure for the connection
1304 buffer to use for answer
1305 size of buffer
1306 pointer to number of bits for cipher
1307 Returns: nothing
1308 */
1309
1310 static void
1311 construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
1312 {
1313 /* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1314 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1315 the accessor functions use const in the prototype. */
1316 const SSL_CIPHER *c;
1317 const uschar *ver;
1318
1319 ver = (const uschar *)SSL_get_version(ssl);
1320
1321 c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
1322 SSL_CIPHER_get_bits(c, bits);
1323
1324 string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1325 SSL_CIPHER_get_name(c), *bits);
1326
1327 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1328 }
1329
1330
1331 static void
1332 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned bsize)
1333 {
1334 /*XXX we might consider a list-of-certs variable for the cert chain.
1335 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
1336 in list-handling functions, also consider the difference between the entire
1337 chain and the elements sent by the peer. */
1338
1339 /* Will have already noted peercert on a verify fail; possibly not the leaf */
1340 if (!tlsp->peercert)
1341 tlsp->peercert = SSL_get_peer_certificate(ssl);
1342 /* Beware anonymous ciphers which lead to server_cert being NULL */
1343 if (tlsp->peercert)
1344 {
1345 X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, bsize);
1346 peerdn[bsize-1] = '\0';
1347 tlsp->peerdn = peerdn; /*XXX a static buffer... */
1348 }
1349 else
1350 tlsp->peerdn = NULL;
1351 }
1352
1353
1354
1355
1356
1357 /*************************************************
1358 * Set up for verifying certificates *
1359 *************************************************/
1360
1361 /* Called by both client and server startup
1362
1363 Arguments:
1364 sctx SSL_CTX* to initialise
1365 certs certs file or NULL
1366 crl CRL file or NULL
1367 host NULL in a server; the remote host in a client
1368 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1369 otherwise passed as FALSE
1370 cert_vfy_cb Callback function for certificate verification
1371
1372 Returns: OK/DEFER/FAIL
1373 */
1374
1375 static int
1376 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1377 int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
1378 {
1379 uschar *expcerts, *expcrl;
1380
1381 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1382 return DEFER;
1383
1384 if (expcerts != NULL && *expcerts != '\0')
1385 {
1386 if (Ustrcmp(expcerts, "system") == 0)
1387 {
1388 /* Tell the library to use its compiled-in location for the system default
1389 CA bundle, only */
1390
1391 if (!SSL_CTX_set_default_verify_paths(sctx))
1392 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1393 }
1394 else
1395 {
1396 struct stat statbuf;
1397
1398 /* Tell the library to use its compiled-in location for the system default
1399 CA bundle. Those given by the exim config are additional to these */
1400
1401 if (!SSL_CTX_set_default_verify_paths(sctx))
1402 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1403
1404 if (Ustat(expcerts, &statbuf) < 0)
1405 {
1406 log_write(0, LOG_MAIN|LOG_PANIC,
1407 "failed to stat %s for certificates", expcerts);
1408 return DEFER;
1409 }
1410 else
1411 {
1412 uschar *file, *dir;
1413 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1414 { file = NULL; dir = expcerts; }
1415 else
1416 { file = expcerts; dir = NULL; }
1417
1418 /* If a certificate file is empty, the next function fails with an
1419 unhelpful error message. If we skip it, we get the correct behaviour (no
1420 certificates are recognized, but the error message is still misleading (it
1421 says no certificate was supplied.) But this is better. */
1422
1423 if ((file == NULL || statbuf.st_size > 0) &&
1424 !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1425 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1426
1427 /* Load the list of CAs for which we will accept certs, for sending
1428 to the client. This is only for the one-file tls_verify_certificates
1429 variant.
1430 If a list isn't loaded into the server, but
1431 some verify locations are set, the server end appears to make
1432 a wildcard reqest for client certs.
1433 Meanwhile, the client library as deafult behaviour *ignores* the list
1434 we send over the wire - see man SSL_CTX_set_client_cert_cb.
1435 Because of this, and that the dir variant is likely only used for
1436 the public-CA bundle (not for a private CA), not worth fixing.
1437 */
1438 if (file != NULL)
1439 {
1440 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
1441 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
1442 sk_X509_NAME_num(names));
1443 SSL_CTX_set_client_CA_list(sctx, names);
1444 }
1445 }
1446 }
1447
1448 /* Handle a certificate revocation list. */
1449
1450 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1451
1452 /* This bit of code is now the version supplied by Lars Mainka. (I have
1453 * merely reformatted it into the Exim code style.)
1454
1455 * "From here I changed the code to add support for multiple crl's
1456 * in pem format in one file or to support hashed directory entries in
1457 * pem format instead of a file. This method now uses the library function
1458 * X509_STORE_load_locations to add the CRL location to the SSL context.
1459 * OpenSSL will then handle the verify against CA certs and CRLs by
1460 * itself in the verify callback." */
1461
1462 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1463 if (expcrl != NULL && *expcrl != 0)
1464 {
1465 struct stat statbufcrl;
1466 if (Ustat(expcrl, &statbufcrl) < 0)
1467 {
1468 log_write(0, LOG_MAIN|LOG_PANIC,
1469 "failed to stat %s for certificates revocation lists", expcrl);
1470 return DEFER;
1471 }
1472 else
1473 {
1474 /* is it a file or directory? */
1475 uschar *file, *dir;
1476 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
1477 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
1478 {
1479 file = NULL;
1480 dir = expcrl;
1481 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
1482 }
1483 else
1484 {
1485 file = expcrl;
1486 dir = NULL;
1487 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
1488 }
1489 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
1490 return tls_error(US"X509_STORE_load_locations", host, NULL);
1491
1492 /* setting the flags to check against the complete crl chain */
1493
1494 X509_STORE_set_flags(cvstore,
1495 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
1496 }
1497 }
1498
1499 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1500
1501 /* If verification is optional, don't fail if no certificate */
1502
1503 SSL_CTX_set_verify(sctx,
1504 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
1505 cert_vfy_cb);
1506 }
1507
1508 return OK;
1509 }
1510
1511
1512
1513 /*************************************************
1514 * Start a TLS session in a server *
1515 *************************************************/
1516
1517 /* This is called when Exim is running as a server, after having received
1518 the STARTTLS command. It must respond to that command, and then negotiate
1519 a TLS session.
1520
1521 Arguments:
1522 require_ciphers allowed ciphers
1523
1524 Returns: OK on success
1525 DEFER for errors before the start of the negotiation
1526 FAIL for errors during the negotation; the server can't
1527 continue running.
1528 */
1529
1530 int
1531 tls_server_start(const uschar *require_ciphers)
1532 {
1533 int rc;
1534 uschar *expciphers;
1535 tls_ext_ctx_cb *cbinfo;
1536 static uschar peerdn[256];
1537 static uschar cipherbuf[256];
1538
1539 /* Check for previous activation */
1540
1541 if (tls_in.active >= 0)
1542 {
1543 tls_error(US"STARTTLS received after TLS started", NULL, US"");
1544 smtp_printf("554 Already in TLS\r\n");
1545 return FAIL;
1546 }
1547
1548 /* Initialize the SSL library. If it fails, it will already have logged
1549 the error. */
1550
1551 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
1552 #ifndef DISABLE_OCSP
1553 tls_ocsp_file,
1554 #endif
1555 NULL, &server_static_cbinfo);
1556 if (rc != OK) return rc;
1557 cbinfo = server_static_cbinfo;
1558
1559 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1560 return FAIL;
1561
1562 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1563 were historically separated by underscores. So that I can use either form in my
1564 tests, and also for general convenience, we turn underscores into hyphens here.
1565 */
1566
1567 if (expciphers != NULL)
1568 {
1569 uschar *s = expciphers;
1570 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1571 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1572 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
1573 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
1574 cbinfo->server_cipher_list = expciphers;
1575 }
1576
1577 /* If this is a host for which certificate verification is mandatory or
1578 optional, set up appropriately. */
1579
1580 tls_in.certificate_verified = FALSE;
1581 #ifdef EXPERIMENTAL_DANE
1582 tls_in.dane_verified = FALSE;
1583 #endif
1584 server_verify_callback_called = FALSE;
1585
1586 if (verify_check_host(&tls_verify_hosts) == OK)
1587 {
1588 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1589 FALSE, verify_callback_server);
1590 if (rc != OK) return rc;
1591 server_verify_optional = FALSE;
1592 }
1593 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1594 {
1595 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1596 TRUE, verify_callback_server);
1597 if (rc != OK) return rc;
1598 server_verify_optional = TRUE;
1599 }
1600
1601 /* Prepare for new connection */
1602
1603 if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
1604
1605 /* Warning: we used to SSL_clear(ssl) here, it was removed.
1606 *
1607 * With the SSL_clear(), we get strange interoperability bugs with
1608 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1609 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1610 *
1611 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1612 * session shutdown. In this case, we have a brand new object and there's no
1613 * obvious reason to immediately clear it. I'm guessing that this was
1614 * originally added because of incomplete initialisation which the clear fixed,
1615 * in some historic release.
1616 */
1617
1618 /* Set context and tell client to go ahead, except in the case of TLS startup
1619 on connection, where outputting anything now upsets the clients and tends to
1620 make them disconnect. We need to have an explicit fflush() here, to force out
1621 the response. Other smtp_printf() calls do not need it, because in non-TLS
1622 mode, the fflush() happens when smtp_getc() is called. */
1623
1624 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1625 if (!tls_in.on_connect)
1626 {
1627 smtp_printf("220 TLS go ahead\r\n");
1628 fflush(smtp_out);
1629 }
1630
1631 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1632 that the OpenSSL library doesn't. */
1633
1634 SSL_set_wfd(server_ssl, fileno(smtp_out));
1635 SSL_set_rfd(server_ssl, fileno(smtp_in));
1636 SSL_set_accept_state(server_ssl);
1637
1638 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1639
1640 sigalrm_seen = FALSE;
1641 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1642 rc = SSL_accept(server_ssl);
1643 alarm(0);
1644
1645 if (rc <= 0)
1646 {
1647 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
1648 if (ERR_get_error() == 0)
1649 log_write(0, LOG_MAIN,
1650 "TLS client disconnected cleanly (rejected our certificate?)");
1651 return FAIL;
1652 }
1653
1654 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1655
1656 /* TLS has been set up. Adjust the input functions to read via TLS,
1657 and initialize things. */
1658
1659 peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
1660
1661 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1662 tls_in.cipher = cipherbuf;
1663
1664 DEBUG(D_tls)
1665 {
1666 uschar buf[2048];
1667 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
1668 debug_printf("Shared ciphers: %s\n", buf);
1669 }
1670
1671 /* Record the certificate we presented */
1672 {
1673 X509 * crt = SSL_get_certificate(server_ssl);
1674 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1675 }
1676
1677 /* Only used by the server-side tls (tls_in), including tls_getc.
1678 Client-side (tls_out) reads (seem to?) go via
1679 smtp_read_response()/ip_recv().
1680 Hence no need to duplicate for _in and _out.
1681 */
1682 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1683 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1684 ssl_xfer_eof = ssl_xfer_error = 0;
1685
1686 receive_getc = tls_getc;
1687 receive_ungetc = tls_ungetc;
1688 receive_feof = tls_feof;
1689 receive_ferror = tls_ferror;
1690 receive_smtp_buffered = tls_smtp_buffered;
1691
1692 tls_in.active = fileno(smtp_out);
1693 return OK;
1694 }
1695
1696
1697
1698
1699 static int
1700 tls_client_basic_ctx_init(SSL_CTX * ctx,
1701 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo
1702 )
1703 {
1704 int rc;
1705 /* stick to the old behaviour for compatibility if tls_verify_certificates is
1706 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1707 the specified host patterns if one of them is defined */
1708
1709 if ( ( !ob->tls_verify_hosts
1710 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
1711 )
1712 || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
1713 )
1714 client_verify_optional = FALSE;
1715 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
1716 client_verify_optional = TRUE;
1717 else
1718 return OK;
1719
1720 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1721 ob->tls_crl, host, client_verify_optional, verify_callback_client)) != OK)
1722 return rc;
1723
1724 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
1725 {
1726 cbinfo->verify_cert_hostnames =
1727 #ifdef EXPERIMENTAL_INTERNATIONAL
1728 string_domain_utf8_to_alabel(host->name, NULL);
1729 #else
1730 host->name;
1731 #endif
1732 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1733 cbinfo->verify_cert_hostnames);
1734 }
1735 return OK;
1736 }
1737
1738
1739 #ifdef EXPERIMENTAL_DANE
1740 static int
1741 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
1742 {
1743 dns_record * rr;
1744 dns_scan dnss;
1745 const char * hostnames[2] = { CS host->name, NULL };
1746 int found = 0;
1747
1748 if (DANESSL_init(ssl, NULL, hostnames) != 1)
1749 return tls_error(US"hostnames load", host, NULL);
1750
1751 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1752 rr;
1753 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1754 ) if (rr->type == T_TLSA)
1755 {
1756 uschar * p = rr->data;
1757 uint8_t usage, selector, mtype;
1758 const char * mdname;
1759
1760 usage = *p++;
1761
1762 /* Only DANE-TA(2) and DANE-EE(3) are supported */
1763 if (usage != 2 && usage != 3) continue;
1764
1765 selector = *p++;
1766 mtype = *p++;
1767
1768 switch (mtype)
1769 {
1770 default: continue; /* Only match-types 0, 1, 2 are supported */
1771 case 0: mdname = NULL; break;
1772 case 1: mdname = "sha256"; break;
1773 case 2: mdname = "sha512"; break;
1774 }
1775
1776 found++;
1777 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
1778 {
1779 default:
1780 case 0: /* action not taken */
1781 return tls_error(US"tlsa load", host, NULL);
1782 case 1: break;
1783 }
1784
1785 tls_out.tlsa_usage |= 1<<usage;
1786 }
1787
1788 if (found)
1789 return OK;
1790
1791 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
1792 return DEFER;
1793 }
1794 #endif /*EXPERIMENTAL_DANE*/
1795
1796
1797
1798 /*************************************************
1799 * Start a TLS session in a client *
1800 *************************************************/
1801
1802 /* Called from the smtp transport after STARTTLS has been accepted.
1803
1804 Argument:
1805 fd the fd of the connection
1806 host connected host (for messages)
1807 addr the first address
1808 tb transport (always smtp)
1809 tlsa_dnsa tlsa lookup, if DANE, else null
1810
1811 Returns: OK on success
1812 FAIL otherwise - note that tls_error() will not give DEFER
1813 because this is not a server
1814 */
1815
1816 int
1817 tls_client_start(int fd, host_item *host, address_item *addr,
1818 transport_instance *tb
1819 #ifdef EXPERIMENTAL_DANE
1820 , dns_answer * tlsa_dnsa
1821 #endif
1822 )
1823 {
1824 smtp_transport_options_block * ob =
1825 (smtp_transport_options_block *)tb->options_block;
1826 static uschar peerdn[256];
1827 uschar * expciphers;
1828 int rc;
1829 static uschar cipherbuf[256];
1830
1831 #ifndef DISABLE_OCSP
1832 BOOL request_ocsp = FALSE;
1833 BOOL require_ocsp = FALSE;
1834 #endif
1835
1836 #ifdef EXPERIMENTAL_DANE
1837 tls_out.tlsa_usage = 0;
1838 #endif
1839
1840 #ifndef DISABLE_OCSP
1841 {
1842 # ifdef EXPERIMENTAL_DANE
1843 if ( tlsa_dnsa
1844 && ob->hosts_request_ocsp[0] == '*'
1845 && ob->hosts_request_ocsp[1] == '\0'
1846 )
1847 {
1848 /* Unchanged from default. Use a safer one under DANE */
1849 request_ocsp = TRUE;
1850 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
1851 " {= {4}{$tls_out_tlsa_usage}} } "
1852 " {*}{}}";
1853 }
1854 # endif
1855
1856 if ((require_ocsp =
1857 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK))
1858 request_ocsp = TRUE;
1859 else
1860 # ifdef EXPERIMENTAL_DANE
1861 if (!request_ocsp)
1862 # endif
1863 request_ocsp =
1864 verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
1865 }
1866 #endif
1867
1868 rc = tls_init(&client_ctx, host, NULL,
1869 ob->tls_certificate, ob->tls_privatekey,
1870 #ifndef DISABLE_OCSP
1871 (void *)(long)request_ocsp,
1872 #endif
1873 addr, &client_static_cbinfo);
1874 if (rc != OK) return rc;
1875
1876 tls_out.certificate_verified = FALSE;
1877 client_verify_callback_called = FALSE;
1878
1879 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
1880 &expciphers))
1881 return FAIL;
1882
1883 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1884 are separated by underscores. So that I can use either form in my tests, and
1885 also for general convenience, we turn underscores into hyphens here. */
1886
1887 if (expciphers != NULL)
1888 {
1889 uschar *s = expciphers;
1890 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1891 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1892 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
1893 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
1894 }
1895
1896 #ifdef EXPERIMENTAL_DANE
1897 if (tlsa_dnsa)
1898 {
1899 SSL_CTX_set_verify(client_ctx,
1900 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
1901 verify_callback_client_dane);
1902
1903 if (!DANESSL_library_init())
1904 return tls_error(US"library init", host, NULL);
1905 if (DANESSL_CTX_init(client_ctx) <= 0)
1906 return tls_error(US"context init", host, NULL);
1907 }
1908 else
1909
1910 #endif
1911
1912 if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob, client_static_cbinfo))
1913 != OK)
1914 return rc;
1915
1916 if ((client_ssl = SSL_new(client_ctx)) == NULL)
1917 return tls_error(US"SSL_new", host, NULL);
1918 SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1919 SSL_set_fd(client_ssl, fd);
1920 SSL_set_connect_state(client_ssl);
1921
1922 if (ob->tls_sni)
1923 {
1924 if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
1925 return FAIL;
1926 if (tls_out.sni == NULL)
1927 {
1928 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1929 }
1930 else if (!Ustrlen(tls_out.sni))
1931 tls_out.sni = NULL;
1932 else
1933 {
1934 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1935 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1936 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
1937 #else
1938 DEBUG(D_tls)
1939 debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
1940 tls_out.sni);
1941 #endif
1942 }
1943 }
1944
1945 #ifdef EXPERIMENTAL_DANE
1946 if (tlsa_dnsa)
1947 if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa)) != OK)
1948 return rc;
1949 #endif
1950
1951 #ifndef DISABLE_OCSP
1952 /* Request certificate status at connection-time. If the server
1953 does OCSP stapling we will get the callback (set in tls_init()) */
1954 # ifdef EXPERIMENTAL_DANE
1955 if (request_ocsp)
1956 {
1957 const uschar * s;
1958 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
1959 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
1960 )
1961 { /* Re-eval now $tls_out_tlsa_usage is populated. If
1962 this means we avoid the OCSP request, we wasted the setup
1963 cost in tls_init(). */
1964 require_ocsp = verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
1965 request_ocsp = require_ocsp
1966 || verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
1967 }
1968 }
1969 # endif
1970
1971 if (request_ocsp)
1972 {
1973 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
1974 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
1975 tls_out.ocsp = OCSP_NOT_RESP;
1976 }
1977 #endif
1978
1979 #ifdef EXPERIMENTAL_EVENT
1980 client_static_cbinfo->event_action = tb->event_action;
1981 #endif
1982
1983 /* There doesn't seem to be a built-in timeout on connection. */
1984
1985 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1986 sigalrm_seen = FALSE;
1987 alarm(ob->command_timeout);
1988 rc = SSL_connect(client_ssl);
1989 alarm(0);
1990
1991 #ifdef EXPERIMENTAL_DANE
1992 if (tlsa_dnsa)
1993 DANESSL_cleanup(client_ssl);
1994 #endif
1995
1996 if (rc <= 0)
1997 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
1998
1999 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
2000
2001 peer_cert(client_ssl, &tls_out, peerdn, sizeof(peerdn));
2002
2003 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
2004 tls_out.cipher = cipherbuf;
2005
2006 /* Record the certificate we presented */
2007 {
2008 X509 * crt = SSL_get_certificate(client_ssl);
2009 tls_out.ourcert = crt ? X509_dup(crt) : NULL;
2010 }
2011
2012 tls_out.active = fd;
2013 return OK;
2014 }
2015
2016
2017
2018
2019
2020 /*************************************************
2021 * TLS version of getc *
2022 *************************************************/
2023
2024 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2025 it refills the buffer via the SSL reading function.
2026
2027 Arguments: none
2028 Returns: the next character or EOF
2029
2030 Only used by the server-side TLS.
2031 */
2032
2033 int
2034 tls_getc(void)
2035 {
2036 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2037 {
2038 int error;
2039 int inbytes;
2040
2041 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
2042 ssl_xfer_buffer, ssl_xfer_buffer_size);
2043
2044 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2045 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
2046 error = SSL_get_error(server_ssl, inbytes);
2047 alarm(0);
2048
2049 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2050 closed down, not that the socket itself has been closed down. Revert to
2051 non-SSL handling. */
2052
2053 if (error == SSL_ERROR_ZERO_RETURN)
2054 {
2055 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2056
2057 receive_getc = smtp_getc;
2058 receive_ungetc = smtp_ungetc;
2059 receive_feof = smtp_feof;
2060 receive_ferror = smtp_ferror;
2061 receive_smtp_buffered = smtp_buffered;
2062
2063 SSL_free(server_ssl);
2064 server_ssl = NULL;
2065 tls_in.active = -1;
2066 tls_in.bits = 0;
2067 tls_in.cipher = NULL;
2068 tls_in.peerdn = NULL;
2069 tls_in.sni = NULL;
2070
2071 return smtp_getc();
2072 }
2073
2074 /* Handle genuine errors */
2075
2076 else if (error == SSL_ERROR_SSL)
2077 {
2078 ERR_error_string(ERR_get_error(), ssl_errstring);
2079 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
2080 ssl_xfer_error = 1;
2081 return EOF;
2082 }
2083
2084 else if (error != SSL_ERROR_NONE)
2085 {
2086 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2087 ssl_xfer_error = 1;
2088 return EOF;
2089 }
2090
2091 #ifndef DISABLE_DKIM
2092 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2093 #endif
2094 ssl_xfer_buffer_hwm = inbytes;
2095 ssl_xfer_buffer_lwm = 0;
2096 }
2097
2098 /* Something in the buffer; return next uschar */
2099
2100 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2101 }
2102
2103
2104
2105 /*************************************************
2106 * Read bytes from TLS channel *
2107 *************************************************/
2108
2109 /*
2110 Arguments:
2111 buff buffer of data
2112 len size of buffer
2113
2114 Returns: the number of bytes read
2115 -1 after a failed read
2116
2117 Only used by the client-side TLS.
2118 */
2119
2120 int
2121 tls_read(BOOL is_server, uschar *buff, size_t len)
2122 {
2123 SSL *ssl = is_server ? server_ssl : client_ssl;
2124 int inbytes;
2125 int error;
2126
2127 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
2128 buff, (unsigned int)len);
2129
2130 inbytes = SSL_read(ssl, CS buff, len);
2131 error = SSL_get_error(ssl, inbytes);
2132
2133 if (error == SSL_ERROR_ZERO_RETURN)
2134 {
2135 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2136 return -1;
2137 }
2138 else if (error != SSL_ERROR_NONE)
2139 {
2140 return -1;
2141 }
2142
2143 return inbytes;
2144 }
2145
2146
2147
2148
2149
2150 /*************************************************
2151 * Write bytes down TLS channel *
2152 *************************************************/
2153
2154 /*
2155 Arguments:
2156 is_server channel specifier
2157 buff buffer of data
2158 len number of bytes
2159
2160 Returns: the number of bytes after a successful write,
2161 -1 after a failed write
2162
2163 Used by both server-side and client-side TLS.
2164 */
2165
2166 int
2167 tls_write(BOOL is_server, const uschar *buff, size_t len)
2168 {
2169 int outbytes;
2170 int error;
2171 int left = len;
2172 SSL *ssl = is_server ? server_ssl : client_ssl;
2173
2174 DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
2175 while (left > 0)
2176 {
2177 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
2178 outbytes = SSL_write(ssl, CS buff, left);
2179 error = SSL_get_error(ssl, outbytes);
2180 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2181 switch (error)
2182 {
2183 case SSL_ERROR_SSL:
2184 ERR_error_string(ERR_get_error(), ssl_errstring);
2185 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2186 return -1;
2187
2188 case SSL_ERROR_NONE:
2189 left -= outbytes;
2190 buff += outbytes;
2191 break;
2192
2193 case SSL_ERROR_ZERO_RETURN:
2194 log_write(0, LOG_MAIN, "SSL channel closed on write");
2195 return -1;
2196
2197 case SSL_ERROR_SYSCALL:
2198 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2199 sender_fullhost ? sender_fullhost : US"<unknown>",
2200 strerror(errno));
2201
2202 default:
2203 log_write(0, LOG_MAIN, "SSL_write error %d", error);
2204 return -1;
2205 }
2206 }
2207 return len;
2208 }
2209
2210
2211
2212 /*************************************************
2213 * Close down a TLS session *
2214 *************************************************/
2215
2216 /* This is also called from within a delivery subprocess forked from the
2217 daemon, to shut down the TLS library, without actually doing a shutdown (which
2218 would tamper with the SSL session in the parent process).
2219
2220 Arguments: TRUE if SSL_shutdown is to be called
2221 Returns: nothing
2222
2223 Used by both server-side and client-side TLS.
2224 */
2225
2226 void
2227 tls_close(BOOL is_server, BOOL shutdown)
2228 {
2229 SSL **sslp = is_server ? &server_ssl : &client_ssl;
2230 int *fdp = is_server ? &tls_in.active : &tls_out.active;
2231
2232 if (*fdp < 0) return; /* TLS was not active */
2233
2234 if (shutdown)
2235 {
2236 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
2237 SSL_shutdown(*sslp);
2238 }
2239
2240 SSL_free(*sslp);
2241 *sslp = NULL;
2242
2243 *fdp = -1;
2244 }
2245
2246
2247
2248
2249 /*************************************************
2250 * Let tls_require_ciphers be checked at startup *
2251 *************************************************/
2252
2253 /* The tls_require_ciphers option, if set, must be something which the
2254 library can parse.
2255
2256 Returns: NULL on success, or error message
2257 */
2258
2259 uschar *
2260 tls_validate_require_cipher(void)
2261 {
2262 SSL_CTX *ctx;
2263 uschar *s, *expciphers, *err;
2264
2265 /* this duplicates from tls_init(), we need a better "init just global
2266 state, for no specific purpose" singleton function of our own */
2267
2268 SSL_load_error_strings();
2269 OpenSSL_add_ssl_algorithms();
2270 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2271 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2272 list of available digests. */
2273 EVP_add_digest(EVP_sha256());
2274 #endif
2275
2276 if (!(tls_require_ciphers && *tls_require_ciphers))
2277 return NULL;
2278
2279 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2280 return US"failed to expand tls_require_ciphers";
2281
2282 if (!(expciphers && *expciphers))
2283 return NULL;
2284
2285 /* normalisation ripped from above */
2286 s = expciphers;
2287 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2288
2289 err = NULL;
2290
2291 ctx = SSL_CTX_new(SSLv23_server_method());
2292 if (!ctx)
2293 {
2294 ERR_error_string(ERR_get_error(), ssl_errstring);
2295 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2296 }
2297
2298 DEBUG(D_tls)
2299 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2300
2301 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2302 {
2303 ERR_error_string(ERR_get_error(), ssl_errstring);
2304 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2305 }
2306
2307 SSL_CTX_free(ctx);
2308
2309 return err;
2310 }
2311
2312
2313
2314
2315 /*************************************************
2316 * Report the library versions. *
2317 *************************************************/
2318
2319 /* There have historically been some issues with binary compatibility in
2320 OpenSSL libraries; if Exim (like many other applications) is built against
2321 one version of OpenSSL but the run-time linker picks up another version,
2322 it can result in serious failures, including crashing with a SIGSEGV. So
2323 report the version found by the compiler and the run-time version.
2324
2325 Note: some OS vendors backport security fixes without changing the version
2326 number/string, and the version date remains unchanged. The _build_ date
2327 will change, so we can more usefully assist with version diagnosis by also
2328 reporting the build date.
2329
2330 Arguments: a FILE* to print the results to
2331 Returns: nothing
2332 */
2333
2334 void
2335 tls_version_report(FILE *f)
2336 {
2337 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
2338 " Runtime: %s\n"
2339 " : %s\n",
2340 OPENSSL_VERSION_TEXT,
2341 SSLeay_version(SSLEAY_VERSION),
2342 SSLeay_version(SSLEAY_BUILT_ON));
2343 /* third line is 38 characters for the %s and the line is 73 chars long;
2344 the OpenSSL output includes a "built on: " prefix already. */
2345 }
2346
2347
2348
2349
2350 /*************************************************
2351 * Random number generation *
2352 *************************************************/
2353
2354 /* Pseudo-random number generation. The result is not expected to be
2355 cryptographically strong but not so weak that someone will shoot themselves
2356 in the foot using it as a nonce in input in some email header scheme or
2357 whatever weirdness they'll twist this into. The result should handle fork()
2358 and avoid repeating sequences. OpenSSL handles that for us.
2359
2360 Arguments:
2361 max range maximum
2362 Returns a random number in range [0, max-1]
2363 */
2364
2365 int
2366 vaguely_random_number(int max)
2367 {
2368 unsigned int r;
2369 int i, needed_len;
2370 static pid_t pidlast = 0;
2371 pid_t pidnow;
2372 uschar *p;
2373 uschar smallbuf[sizeof(r)];
2374
2375 if (max <= 1)
2376 return 0;
2377
2378 pidnow = getpid();
2379 if (pidnow != pidlast)
2380 {
2381 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2382 is unique for each thread", this doesn't apparently apply across processes,
2383 so our own warning from vaguely_random_number_fallback() applies here too.
2384 Fix per PostgreSQL. */
2385 if (pidlast != 0)
2386 RAND_cleanup();
2387 pidlast = pidnow;
2388 }
2389
2390 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2391 if (!RAND_status())
2392 {
2393 randstuff r;
2394 gettimeofday(&r.tv, NULL);
2395 r.p = getpid();
2396
2397 RAND_seed((uschar *)(&r), sizeof(r));
2398 }
2399 /* We're after pseudo-random, not random; if we still don't have enough data
2400 in the internal PRNG then our options are limited. We could sleep and hope
2401 for entropy to come along (prayer technique) but if the system is so depleted
2402 in the first place then something is likely to just keep taking it. Instead,
2403 we'll just take whatever little bit of pseudo-random we can still manage to
2404 get. */
2405
2406 needed_len = sizeof(r);
2407 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2408 asked for a number less than 10. */
2409 for (r = max, i = 0; r; ++i)
2410 r >>= 1;
2411 i = (i + 7) / 8;
2412 if (i < needed_len)
2413 needed_len = i;
2414
2415 /* We do not care if crypto-strong */
2416 i = RAND_pseudo_bytes(smallbuf, needed_len);
2417 if (i < 0)
2418 {
2419 DEBUG(D_all)
2420 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2421 return vaguely_random_number_fallback(max);
2422 }
2423
2424 r = 0;
2425 for (p = smallbuf; needed_len; --needed_len, ++p)
2426 {
2427 r *= 256;
2428 r += *p;
2429 }
2430
2431 /* We don't particularly care about weighted results; if someone wants
2432 smooth distribution and cares enough then they should submit a patch then. */
2433 return r % max;
2434 }
2435
2436
2437
2438
2439 /*************************************************
2440 * OpenSSL option parse *
2441 *************************************************/
2442
2443 /* Parse one option for tls_openssl_options_parse below
2444
2445 Arguments:
2446 name one option name
2447 value place to store a value for it
2448 Returns success or failure in parsing
2449 */
2450
2451 struct exim_openssl_option {
2452 uschar *name;
2453 long value;
2454 };
2455 /* We could use a macro to expand, but we need the ifdef and not all the
2456 options document which version they were introduced in. Policylet: include
2457 all options unless explicitly for DTLS, let the administrator choose which
2458 to apply.
2459
2460 This list is current as of:
2461 ==> 1.0.1b <==
2462 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2463 */
2464 static struct exim_openssl_option exim_openssl_options[] = {
2465 /* KEEP SORTED ALPHABETICALLY! */
2466 #ifdef SSL_OP_ALL
2467 { US"all", SSL_OP_ALL },
2468 #endif
2469 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
2470 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
2471 #endif
2472 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
2473 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
2474 #endif
2475 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
2476 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
2477 #endif
2478 #ifdef SSL_OP_EPHEMERAL_RSA
2479 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
2480 #endif
2481 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
2482 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
2483 #endif
2484 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
2485 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
2486 #endif
2487 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
2488 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
2489 #endif
2490 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
2491 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
2492 #endif
2493 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
2494 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
2495 #endif
2496 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
2497 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
2498 #endif
2499 #ifdef SSL_OP_NO_COMPRESSION
2500 { US"no_compression", SSL_OP_NO_COMPRESSION },
2501 #endif
2502 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2503 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
2504 #endif
2505 #ifdef SSL_OP_NO_SSLv2
2506 { US"no_sslv2", SSL_OP_NO_SSLv2 },
2507 #endif
2508 #ifdef SSL_OP_NO_SSLv3
2509 { US"no_sslv3", SSL_OP_NO_SSLv3 },
2510 #endif
2511 #ifdef SSL_OP_NO_TICKET
2512 { US"no_ticket", SSL_OP_NO_TICKET },
2513 #endif
2514 #ifdef SSL_OP_NO_TLSv1
2515 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2516 #endif
2517 #ifdef SSL_OP_NO_TLSv1_1
2518 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
2519 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2520 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2521 #else
2522 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2523 #endif
2524 #endif
2525 #ifdef SSL_OP_NO_TLSv1_2
2526 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2527 #endif
2528 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2529 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2530 #endif
2531 #ifdef SSL_OP_SINGLE_DH_USE
2532 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
2533 #endif
2534 #ifdef SSL_OP_SINGLE_ECDH_USE
2535 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
2536 #endif
2537 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
2538 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
2539 #endif
2540 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
2541 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
2542 #endif
2543 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
2544 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
2545 #endif
2546 #ifdef SSL_OP_TLS_D5_BUG
2547 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
2548 #endif
2549 #ifdef SSL_OP_TLS_ROLLBACK_BUG
2550 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
2551 #endif
2552 };
2553 static int exim_openssl_options_size =
2554 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2555
2556
2557 static BOOL
2558 tls_openssl_one_option_parse(uschar *name, long *value)
2559 {
2560 int first = 0;
2561 int last = exim_openssl_options_size;
2562 while (last > first)
2563 {
2564 int middle = (first + last)/2;
2565 int c = Ustrcmp(name, exim_openssl_options[middle].name);
2566 if (c == 0)
2567 {
2568 *value = exim_openssl_options[middle].value;
2569 return TRUE;
2570 }
2571 else if (c > 0)
2572 first = middle + 1;
2573 else
2574 last = middle;
2575 }
2576 return FALSE;
2577 }
2578
2579
2580
2581
2582 /*************************************************
2583 * OpenSSL option parsing logic *
2584 *************************************************/
2585
2586 /* OpenSSL has a number of compatibility options which an administrator might
2587 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
2588 we look like log_selector.
2589
2590 Arguments:
2591 option_spec the administrator-supplied string of options
2592 results ptr to long storage for the options bitmap
2593 Returns success or failure
2594 */
2595
2596 BOOL
2597 tls_openssl_options_parse(uschar *option_spec, long *results)
2598 {
2599 long result, item;
2600 uschar *s, *end;
2601 uschar keep_c;
2602 BOOL adding, item_parsed;
2603
2604 result = 0L;
2605 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
2606 * from default because it increases BEAST susceptibility. */
2607 #ifdef SSL_OP_NO_SSLv2
2608 result |= SSL_OP_NO_SSLv2;
2609 #endif
2610
2611 if (option_spec == NULL)
2612 {
2613 *results = result;
2614 return TRUE;
2615 }
2616
2617 for (s=option_spec; *s != '\0'; /**/)
2618 {
2619 while (isspace(*s)) ++s;
2620 if (*s == '\0')
2621 break;
2622 if (*s != '+' && *s != '-')
2623 {
2624 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
2625 "+ or - expected but found \"%s\"\n", s);
2626 return FALSE;
2627 }
2628 adding = *s++ == '+';
2629 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2630 keep_c = *end;
2631 *end = '\0';
2632 item_parsed = tls_openssl_one_option_parse(s, &item);
2633 if (!item_parsed)
2634 {
2635 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
2636 return FALSE;
2637 }
2638 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2639 adding ? "adding" : "removing", result, item, s);
2640 if (adding)
2641 result |= item;
2642 else
2643 result &= ~item;
2644 *end = keep_c;
2645 s = end;
2646 }
2647
2648 *results = result;
2649 return TRUE;
2650 }
2651
2652 /* vi: aw ai sw=2
2653 */
2654 /* End of tls-openssl.c */