Initialise OCSP-related pointers before use.
[exim.git] / src / src / tls-openssl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2012 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
9 library. It is #included into the tls.c file when that library is used. The
10 code herein is based on a patch that was originally contributed by Steve
11 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
12
13 No cryptographic code is included in Exim. All this module does is to call
14 functions from the OpenSSL library. */
15
16
17 /* Heading stuff */
18
19 #include <openssl/lhash.h>
20 #include <openssl/ssl.h>
21 #include <openssl/err.h>
22 #include <openssl/rand.h>
23 #ifdef EXPERIMENTAL_OCSP
24 #include <openssl/ocsp.h>
25 #endif
26
27 #ifdef EXPERIMENTAL_OCSP
28 #define EXIM_OCSP_SKEW_SECONDS (300L)
29 #define EXIM_OCSP_MAX_AGE (-1L)
30 #endif
31
32 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
33 #define EXIM_HAVE_OPENSSL_TLSEXT
34 #endif
35
36 /* Structure for collecting random data for seeding. */
37
38 typedef struct randstuff {
39 struct timeval tv;
40 pid_t p;
41 } randstuff;
42
43 /* Local static variables */
44
45 static BOOL client_verify_callback_called = FALSE;
46 static BOOL server_verify_callback_called = FALSE;
47 static const uschar *sid_ctx = US"exim";
48
49 /* We have three different contexts to care about.
50
51 Simple case: client, `client_ctx`
52 As a client, we can be doing a callout or cut-through delivery while receiving
53 a message. So we have a client context, which should have options initialised
54 from the SMTP Transport.
55
56 Server:
57 There are two cases: with and without ServerNameIndication from the client.
58 Given TLS SNI, we can be using different keys, certs and various other
59 configuration settings, because they're re-expanded with $tls_sni set. This
60 allows vhosting with TLS. This SNI is sent in the handshake.
61 A client might not send SNI, so we need a fallback, and an initial setup too.
62 So as a server, we start out using `server_ctx`.
63 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
64 `server_sni` from `server_ctx` and then initialise settings by re-expanding
65 configuration.
66 */
67
68 static SSL_CTX *client_ctx = NULL;
69 static SSL_CTX *server_ctx = NULL;
70 static SSL *client_ssl = NULL;
71 static SSL *server_ssl = NULL;
72
73 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
74 static SSL_CTX *server_sni = NULL;
75 #endif
76
77 static char ssl_errstring[256];
78
79 static int ssl_session_timeout = 200;
80 static BOOL client_verify_optional = FALSE;
81 static BOOL server_verify_optional = FALSE;
82
83 static BOOL reexpand_tls_files_for_sni = FALSE;
84
85
86 typedef struct tls_ext_ctx_cb {
87 uschar *certificate;
88 uschar *privatekey;
89 #ifdef EXPERIMENTAL_OCSP
90 uschar *ocsp_file;
91 uschar *ocsp_file_expanded;
92 OCSP_RESPONSE *ocsp_response;
93 #endif
94 uschar *dhparam;
95 /* these are cached from first expand */
96 uschar *server_cipher_list;
97 /* only passed down to tls_error: */
98 host_item *host;
99 } tls_ext_ctx_cb;
100
101 /* should figure out a cleanup of API to handle state preserved per
102 implementation, for various reasons, which can be void * in the APIs.
103 For now, we hack around it. */
104 tls_ext_ctx_cb *client_static_cbinfo = NULL;
105 tls_ext_ctx_cb *server_static_cbinfo = NULL;
106
107 static int
108 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional, BOOL client);
109
110 /* Callbacks */
111 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
112 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
113 #endif
114 #ifdef EXPERIMENTAL_OCSP
115 static int tls_stapling_cb(SSL *s, void *arg);
116 #endif
117
118
119 /*************************************************
120 * Handle TLS error *
121 *************************************************/
122
123 /* Called from lots of places when errors occur before actually starting to do
124 the TLS handshake, that is, while the session is still in clear. Always returns
125 DEFER for a server and FAIL for a client so that most calls can use "return
126 tls_error(...)" to do this processing and then give an appropriate return. A
127 single function is used for both server and client, because it is called from
128 some shared functions.
129
130 Argument:
131 prefix text to include in the logged error
132 host NULL if setting up a server;
133 the connected host if setting up a client
134 msg error message or NULL if we should ask OpenSSL
135
136 Returns: OK/DEFER/FAIL
137 */
138
139 static int
140 tls_error(uschar *prefix, host_item *host, uschar *msg)
141 {
142 if (msg == NULL)
143 {
144 ERR_error_string(ERR_get_error(), ssl_errstring);
145 msg = (uschar *)ssl_errstring;
146 }
147
148 if (host == NULL)
149 {
150 uschar *conn_info = smtp_get_connection_info();
151 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
152 conn_info += 5;
153 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
154 conn_info, prefix, msg);
155 return DEFER;
156 }
157 else
158 {
159 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s): %s",
160 host->name, host->address, prefix, msg);
161 return FAIL;
162 }
163 }
164
165
166
167 /*************************************************
168 * Callback to generate RSA key *
169 *************************************************/
170
171 /*
172 Arguments:
173 s SSL connection
174 export not used
175 keylength keylength
176
177 Returns: pointer to generated key
178 */
179
180 static RSA *
181 rsa_callback(SSL *s, int export, int keylength)
182 {
183 RSA *rsa_key;
184 export = export; /* Shut picky compilers up */
185 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
186 rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
187 if (rsa_key == NULL)
188 {
189 ERR_error_string(ERR_get_error(), ssl_errstring);
190 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
191 ssl_errstring);
192 return NULL;
193 }
194 return rsa_key;
195 }
196
197
198
199
200 /*************************************************
201 * Callback for verification *
202 *************************************************/
203
204 /* The SSL library does certificate verification if set up to do so. This
205 callback has the current yes/no state is in "state". If verification succeeded,
206 we set up the tls_peerdn string. If verification failed, what happens depends
207 on whether the client is required to present a verifiable certificate or not.
208
209 If verification is optional, we change the state to yes, but still log the
210 verification error. For some reason (it really would help to have proper
211 documentation of OpenSSL), this callback function then gets called again, this
212 time with state = 1. In fact, that's useful, because we can set up the peerdn
213 value, but we must take care not to set the private verified flag on the second
214 time through.
215
216 Note: this function is not called if the client fails to present a certificate
217 when asked. We get here only if a certificate has been received. Handling of
218 optional verification for this case is done when requesting SSL to verify, by
219 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
220
221 Arguments:
222 state current yes/no state as 1/0
223 x509ctx certificate information.
224 client TRUE for client startup, FALSE for server startup
225
226 Returns: 1 if verified, 0 if not
227 */
228
229 static int
230 verify_callback(int state, X509_STORE_CTX *x509ctx, BOOL client)
231 {
232 static uschar txt[256];
233 tls_support * tlsp;
234 BOOL * calledp;
235 BOOL * optionalp;
236
237 if (client)
238 {
239 tlsp= &tls_out;
240 calledp= &client_verify_callback_called;
241 optionalp= &client_verify_optional;
242 }
243 else
244 {
245 tlsp= &tls_in;
246 calledp= &server_verify_callback_called;
247 optionalp= &server_verify_optional;
248 }
249
250 X509_NAME_oneline(X509_get_subject_name(x509ctx->current_cert),
251 CS txt, sizeof(txt));
252
253 if (state == 0)
254 {
255 log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
256 x509ctx->error_depth,
257 X509_verify_cert_error_string(x509ctx->error),
258 txt);
259 tlsp->certificate_verified = FALSE;
260 *calledp = TRUE;
261 if (!*optionalp) return 0; /* reject */
262 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
263 "tls_try_verify_hosts)\n");
264 return 1; /* accept */
265 }
266
267 if (x509ctx->error_depth != 0)
268 {
269 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d cert=%s\n",
270 x509ctx->error_depth, txt);
271 }
272 else
273 {
274 DEBUG(D_tls) debug_printf("SSL%s peer: %s\n",
275 *calledp ? "" : " authenticated", txt);
276 tlsp->peerdn = txt;
277 }
278
279 if (!*calledp) tlsp->certificate_verified = TRUE;
280 *calledp = TRUE;
281
282 return 1; /* accept */
283 }
284
285 static int
286 verify_callback_client(int state, X509_STORE_CTX *x509ctx)
287 {
288 return verify_callback(state, x509ctx, TRUE);
289 }
290
291 static int
292 verify_callback_server(int state, X509_STORE_CTX *x509ctx)
293 {
294 return verify_callback(state, x509ctx, FALSE);
295 }
296
297
298
299 /*************************************************
300 * Information callback *
301 *************************************************/
302
303 /* The SSL library functions call this from time to time to indicate what they
304 are doing. We copy the string to the debugging output when TLS debugging has
305 been requested.
306
307 Arguments:
308 s the SSL connection
309 where
310 ret
311
312 Returns: nothing
313 */
314
315 static void
316 info_callback(SSL *s, int where, int ret)
317 {
318 where = where;
319 ret = ret;
320 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
321 }
322
323
324
325 /*************************************************
326 * Initialize for DH *
327 *************************************************/
328
329 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
330
331 Arguments:
332 dhparam DH parameter file or fixed parameter identity string
333 host connected host, if client; NULL if server
334
335 Returns: TRUE if OK (nothing to set up, or setup worked)
336 */
337
338 static BOOL
339 init_dh(SSL_CTX *sctx, uschar *dhparam, host_item *host)
340 {
341 BIO *bio;
342 DH *dh;
343 uschar *dhexpanded;
344 const char *pem;
345
346 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
347 return FALSE;
348
349 if (dhexpanded == NULL || *dhexpanded == '\0')
350 {
351 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
352 }
353 else if (dhexpanded[0] == '/')
354 {
355 bio = BIO_new_file(CS dhexpanded, "r");
356 if (bio == NULL)
357 {
358 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
359 host, US strerror(errno));
360 return FALSE;
361 }
362 }
363 else
364 {
365 if (Ustrcmp(dhexpanded, "none") == 0)
366 {
367 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
368 return TRUE;
369 }
370
371 pem = std_dh_prime_named(dhexpanded);
372 if (!pem)
373 {
374 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
375 host, US strerror(errno));
376 return FALSE;
377 }
378 bio = BIO_new_mem_buf(CS pem, -1);
379 }
380
381 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
382 if (dh == NULL)
383 {
384 BIO_free(bio);
385 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
386 host, NULL);
387 return FALSE;
388 }
389
390 /* Even if it is larger, we silently return success rather than cause things
391 * to fail out, so that a too-large DH will not knock out all TLS; it's a
392 * debatable choice. */
393 if ((8*DH_size(dh)) > tls_dh_max_bits)
394 {
395 DEBUG(D_tls)
396 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
397 8*DH_size(dh), tls_dh_max_bits);
398 }
399 else
400 {
401 SSL_CTX_set_tmp_dh(sctx, dh);
402 DEBUG(D_tls)
403 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
404 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
405 }
406
407 DH_free(dh);
408 BIO_free(bio);
409
410 return TRUE;
411 }
412
413
414
415
416 #ifdef EXPERIMENTAL_OCSP
417 /*************************************************
418 * Load OCSP information into state *
419 *************************************************/
420
421 /* Called to load the OCSP response from the given file into memory, once
422 caller has determined this is needed. Checks validity. Debugs a message
423 if invalid.
424
425 ASSUMES: single response, for single cert.
426
427 Arguments:
428 sctx the SSL_CTX* to update
429 cbinfo various parts of session state
430 expanded the filename putatively holding an OCSP response
431
432 */
433
434 static void
435 ocsp_load_response(SSL_CTX *sctx,
436 tls_ext_ctx_cb *cbinfo,
437 const uschar *expanded)
438 {
439 BIO *bio;
440 OCSP_RESPONSE *resp;
441 OCSP_BASICRESP *basic_response;
442 OCSP_SINGLERESP *single_response;
443 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
444 X509_STORE *store;
445 unsigned long verify_flags;
446 int status, reason, i;
447
448 cbinfo->ocsp_file_expanded = string_copy(expanded);
449 if (cbinfo->ocsp_response)
450 {
451 OCSP_RESPONSE_free(cbinfo->ocsp_response);
452 cbinfo->ocsp_response = NULL;
453 }
454
455 bio = BIO_new_file(CS cbinfo->ocsp_file_expanded, "rb");
456 if (!bio)
457 {
458 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
459 cbinfo->ocsp_file_expanded);
460 return;
461 }
462
463 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
464 BIO_free(bio);
465 if (!resp)
466 {
467 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
468 return;
469 }
470
471 status = OCSP_response_status(resp);
472 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
473 {
474 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
475 OCSP_response_status_str(status), status);
476 return;
477 }
478
479 basic_response = OCSP_response_get1_basic(resp);
480 if (!basic_response)
481 {
482 DEBUG(D_tls)
483 debug_printf("OCSP response parse error: unable to extract basic response.\n");
484 return;
485 }
486
487 store = SSL_CTX_get_cert_store(sctx);
488 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
489
490 /* May need to expose ability to adjust those flags?
491 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
492 OCSP_TRUSTOTHER OCSP_NOINTERN */
493
494 i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
495 if (i <= 0)
496 {
497 DEBUG(D_tls) {
498 ERR_error_string(ERR_get_error(), ssl_errstring);
499 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
500 }
501 return;
502 }
503
504 /* Here's the simplifying assumption: there's only one response, for the
505 one certificate we use, and nothing for anything else in a chain. If this
506 proves false, we need to extract a cert id from our issued cert
507 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
508 right cert in the stack and then calls OCSP_single_get0_status()).
509
510 I'm hoping to avoid reworking a bunch more of how we handle state here. */
511 single_response = OCSP_resp_get0(basic_response, 0);
512 if (!single_response)
513 {
514 DEBUG(D_tls)
515 debug_printf("Unable to get first response from OCSP basic response.\n");
516 return;
517 }
518
519 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
520 /* how does this status differ from the one above? */
521 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
522 {
523 DEBUG(D_tls) debug_printf("OCSP response not valid (take 2): %s (%d)\n",
524 OCSP_response_status_str(status), status);
525 return;
526 }
527
528 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
529 {
530 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
531 return;
532 }
533
534 cbinfo->ocsp_response = resp;
535 }
536 #endif
537
538
539
540
541 /*************************************************
542 * Expand key and cert file specs *
543 *************************************************/
544
545 /* Called once during tls_init and possibly againt during TLS setup, for a
546 new context, if Server Name Indication was used and tls_sni was seen in
547 the certificate string.
548
549 Arguments:
550 sctx the SSL_CTX* to update
551 cbinfo various parts of session state
552
553 Returns: OK/DEFER/FAIL
554 */
555
556 static int
557 tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
558 {
559 uschar *expanded;
560
561 if (cbinfo->certificate == NULL)
562 return OK;
563
564 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
565 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
566 Ustrstr(cbinfo->certificate, US"tls_out_sni")
567 )
568 reexpand_tls_files_for_sni = TRUE;
569
570 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
571 return DEFER;
572
573 if (expanded != NULL)
574 {
575 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
576 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
577 return tls_error(string_sprintf(
578 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
579 cbinfo->host, NULL);
580 }
581
582 if (cbinfo->privatekey != NULL &&
583 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
584 return DEFER;
585
586 /* If expansion was forced to fail, key_expanded will be NULL. If the result
587 of the expansion is an empty string, ignore it also, and assume the private
588 key is in the same file as the certificate. */
589
590 if (expanded != NULL && *expanded != 0)
591 {
592 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
593 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
594 return tls_error(string_sprintf(
595 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
596 }
597
598 #ifdef EXPERIMENTAL_OCSP
599 if (cbinfo->ocsp_file != NULL)
600 {
601 if (!expand_check(cbinfo->ocsp_file, US"tls_ocsp_file", &expanded))
602 return DEFER;
603
604 if (expanded != NULL && *expanded != 0)
605 {
606 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
607 if (cbinfo->ocsp_file_expanded &&
608 (Ustrcmp(expanded, cbinfo->ocsp_file_expanded) == 0))
609 {
610 DEBUG(D_tls)
611 debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
612 } else {
613 ocsp_load_response(sctx, cbinfo, expanded);
614 }
615 }
616 }
617 #endif
618
619 return OK;
620 }
621
622
623
624
625 /*************************************************
626 * Callback to handle SNI *
627 *************************************************/
628
629 /* Called when acting as server during the TLS session setup if a Server Name
630 Indication extension was sent by the client.
631
632 API documentation is OpenSSL s_server.c implementation.
633
634 Arguments:
635 s SSL* of the current session
636 ad unknown (part of OpenSSL API) (unused)
637 arg Callback of "our" registered data
638
639 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
640 */
641
642 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
643 static int
644 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
645 {
646 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
647 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
648 int rc;
649 int old_pool = store_pool;
650
651 if (!servername)
652 return SSL_TLSEXT_ERR_OK;
653
654 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
655 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
656
657 /* Make the extension value available for expansion */
658 store_pool = POOL_PERM;
659 tls_in.sni = string_copy(US servername);
660 store_pool = old_pool;
661
662 if (!reexpand_tls_files_for_sni)
663 return SSL_TLSEXT_ERR_OK;
664
665 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
666 not confident that memcpy wouldn't break some internal reference counting.
667 Especially since there's a references struct member, which would be off. */
668
669 server_sni = SSL_CTX_new(SSLv23_server_method());
670 if (!server_sni)
671 {
672 ERR_error_string(ERR_get_error(), ssl_errstring);
673 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
674 return SSL_TLSEXT_ERR_NOACK;
675 }
676
677 /* Not sure how many of these are actually needed, since SSL object
678 already exists. Might even need this selfsame callback, for reneg? */
679
680 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
681 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
682 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
683 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
684 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
685 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
686 if (cbinfo->server_cipher_list)
687 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
688 #ifdef EXPERIMENTAL_OCSP
689 if (cbinfo->ocsp_file)
690 {
691 SSL_CTX_set_tlsext_status_cb(server_sni, tls_stapling_cb);
692 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
693 }
694 #endif
695
696 rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, FALSE);
697 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
698
699 /* do this after setup_certs, because this can require the certs for verifying
700 OCSP information. */
701 rc = tls_expand_session_files(server_sni, cbinfo);
702 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
703
704 rc = init_dh(server_sni, cbinfo->dhparam, NULL);
705 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
706
707 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
708 SSL_set_SSL_CTX(s, server_sni);
709
710 return SSL_TLSEXT_ERR_OK;
711 }
712 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
713
714
715
716
717 #ifdef EXPERIMENTAL_OCSP
718 /*************************************************
719 * Callback to handle OCSP Stapling *
720 *************************************************/
721
722 /* Called when acting as server during the TLS session setup if the client
723 requests OCSP information with a Certificate Status Request.
724
725 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
726 project.
727
728 */
729
730 static int
731 tls_stapling_cb(SSL *s, void *arg)
732 {
733 const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
734 uschar *response_der;
735 int response_der_len;
736
737 DEBUG(D_tls) debug_printf("Received TLS status request (OCSP stapling); %s response.\n",
738 cbinfo->ocsp_response ? "have" : "lack");
739 if (!cbinfo->ocsp_response)
740 return SSL_TLSEXT_ERR_NOACK;
741
742 response_der = NULL;
743 response_der_len = i2d_OCSP_RESPONSE(cbinfo->ocsp_response, &response_der);
744 if (response_der_len <= 0)
745 return SSL_TLSEXT_ERR_NOACK;
746
747 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
748 return SSL_TLSEXT_ERR_OK;
749 }
750
751 #endif /* EXPERIMENTAL_OCSP */
752
753
754
755
756 /*************************************************
757 * Initialize for TLS *
758 *************************************************/
759
760 /* Called from both server and client code, to do preliminary initialization of
761 the library.
762
763 Arguments:
764 host connected host, if client; NULL if server
765 dhparam DH parameter file
766 certificate certificate file
767 privatekey private key
768 addr address if client; NULL if server (for some randomness)
769
770 Returns: OK/DEFER/FAIL
771 */
772
773 static int
774 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
775 uschar *privatekey,
776 #ifdef EXPERIMENTAL_OCSP
777 uschar *ocsp_file,
778 #endif
779 address_item *addr, tls_ext_ctx_cb ** cbp)
780 {
781 long init_options;
782 int rc;
783 BOOL okay;
784 tls_ext_ctx_cb *cbinfo;
785
786 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
787 cbinfo->certificate = certificate;
788 cbinfo->privatekey = privatekey;
789 #ifdef EXPERIMENTAL_OCSP
790 cbinfo->ocsp_file = ocsp_file;
791 cbinfo->ocsp_file_expanded = NULL;
792 cbinfo->ocsp_response = NULL;
793 #endif
794 cbinfo->dhparam = dhparam;
795 cbinfo->host = host;
796
797 SSL_load_error_strings(); /* basic set up */
798 OpenSSL_add_ssl_algorithms();
799
800 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
801 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
802 list of available digests. */
803 EVP_add_digest(EVP_sha256());
804 #endif
805
806 /* Create a context.
807 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
808 negotiation in the different methods; as far as I can tell, the only
809 *_{server,client}_method which allows negotiation is SSLv23, which exists even
810 when OpenSSL is built without SSLv2 support.
811 By disabling with openssl_options, we can let admins re-enable with the
812 existing knob. */
813
814 *ctxp = SSL_CTX_new((host == NULL)?
815 SSLv23_server_method() : SSLv23_client_method());
816
817 if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
818
819 /* It turns out that we need to seed the random number generator this early in
820 order to get the full complement of ciphers to work. It took me roughly a day
821 of work to discover this by experiment.
822
823 On systems that have /dev/urandom, SSL may automatically seed itself from
824 there. Otherwise, we have to make something up as best we can. Double check
825 afterwards. */
826
827 if (!RAND_status())
828 {
829 randstuff r;
830 gettimeofday(&r.tv, NULL);
831 r.p = getpid();
832
833 RAND_seed((uschar *)(&r), sizeof(r));
834 RAND_seed((uschar *)big_buffer, big_buffer_size);
835 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
836
837 if (!RAND_status())
838 return tls_error(US"RAND_status", host,
839 US"unable to seed random number generator");
840 }
841
842 /* Set up the information callback, which outputs if debugging is at a suitable
843 level. */
844
845 SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
846
847 /* Automatically re-try reads/writes after renegotiation. */
848 (void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
849
850 /* Apply administrator-supplied work-arounds.
851 Historically we applied just one requested option,
852 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
853 moved to an administrator-controlled list of options to specify and
854 grandfathered in the first one as the default value for "openssl_options".
855
856 No OpenSSL version number checks: the options we accept depend upon the
857 availability of the option value macros from OpenSSL. */
858
859 okay = tls_openssl_options_parse(openssl_options, &init_options);
860 if (!okay)
861 return tls_error(US"openssl_options parsing failed", host, NULL);
862
863 if (init_options)
864 {
865 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
866 if (!(SSL_CTX_set_options(*ctxp, init_options)))
867 return tls_error(string_sprintf(
868 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
869 }
870 else
871 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
872
873 /* Initialize with DH parameters if supplied */
874
875 if (!init_dh(*ctxp, dhparam, host)) return DEFER;
876
877 /* Set up certificate and key (and perhaps OCSP info) */
878
879 rc = tls_expand_session_files(*ctxp, cbinfo);
880 if (rc != OK) return rc;
881
882 /* If we need to handle SNI, do so */
883 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
884 if (host == NULL)
885 {
886 #ifdef EXPERIMENTAL_OCSP
887 /* We check ocsp_file, not ocsp_response, because we care about if
888 the option exists, not what the current expansion might be, as SNI might
889 change the certificate and OCSP file in use between now and the time the
890 callback is invoked. */
891 if (cbinfo->ocsp_file)
892 {
893 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_stapling_cb);
894 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
895 }
896 #endif
897 /* We always do this, so that $tls_sni is available even if not used in
898 tls_certificate */
899 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
900 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
901 }
902 #endif
903
904 /* Set up the RSA callback */
905
906 SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
907
908 /* Finally, set the timeout, and we are done */
909
910 SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
911 DEBUG(D_tls) debug_printf("Initialized TLS\n");
912
913 *cbp = cbinfo;
914
915 return OK;
916 }
917
918
919
920
921 /*************************************************
922 * Get name of cipher in use *
923 *************************************************/
924
925 /*
926 Argument: pointer to an SSL structure for the connection
927 buffer to use for answer
928 size of buffer
929 pointer to number of bits for cipher
930 Returns: nothing
931 */
932
933 static void
934 construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
935 {
936 /* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
937 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
938 the accessor functions use const in the prototype. */
939 const SSL_CIPHER *c;
940 uschar *ver;
941
942 switch (ssl->session->ssl_version)
943 {
944 case SSL2_VERSION:
945 ver = US"SSLv2";
946 break;
947
948 case SSL3_VERSION:
949 ver = US"SSLv3";
950 break;
951
952 case TLS1_VERSION:
953 ver = US"TLSv1";
954 break;
955
956 #ifdef TLS1_1_VERSION
957 case TLS1_1_VERSION:
958 ver = US"TLSv1.1";
959 break;
960 #endif
961
962 #ifdef TLS1_2_VERSION
963 case TLS1_2_VERSION:
964 ver = US"TLSv1.2";
965 break;
966 #endif
967
968 default:
969 ver = US"UNKNOWN";
970 }
971
972 c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
973 SSL_CIPHER_get_bits(c, bits);
974
975 string_format(cipherbuf, bsize, "%s:%s:%u", ver,
976 SSL_CIPHER_get_name(c), *bits);
977
978 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
979 }
980
981
982
983
984
985 /*************************************************
986 * Set up for verifying certificates *
987 *************************************************/
988
989 /* Called by both client and server startup
990
991 Arguments:
992 sctx SSL_CTX* to initialise
993 certs certs file or NULL
994 crl CRL file or NULL
995 host NULL in a server; the remote host in a client
996 optional TRUE if called from a server for a host in tls_try_verify_hosts;
997 otherwise passed as FALSE
998 client TRUE if called for client startup, FALSE for server startup
999
1000 Returns: OK/DEFER/FAIL
1001 */
1002
1003 static int
1004 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional, BOOL client)
1005 {
1006 uschar *expcerts, *expcrl;
1007
1008 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1009 return DEFER;
1010
1011 if (expcerts != NULL)
1012 {
1013 struct stat statbuf;
1014 if (!SSL_CTX_set_default_verify_paths(sctx))
1015 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1016
1017 if (Ustat(expcerts, &statbuf) < 0)
1018 {
1019 log_write(0, LOG_MAIN|LOG_PANIC,
1020 "failed to stat %s for certificates", expcerts);
1021 return DEFER;
1022 }
1023 else
1024 {
1025 uschar *file, *dir;
1026 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1027 { file = NULL; dir = expcerts; }
1028 else
1029 { file = expcerts; dir = NULL; }
1030
1031 /* If a certificate file is empty, the next function fails with an
1032 unhelpful error message. If we skip it, we get the correct behaviour (no
1033 certificates are recognized, but the error message is still misleading (it
1034 says no certificate was supplied.) But this is better. */
1035
1036 if ((file == NULL || statbuf.st_size > 0) &&
1037 !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1038 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1039
1040 if (file != NULL)
1041 {
1042 SSL_CTX_set_client_CA_list(sctx, SSL_load_client_CA_file(CS file));
1043 }
1044 }
1045
1046 /* Handle a certificate revocation list. */
1047
1048 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1049
1050 /* This bit of code is now the version supplied by Lars Mainka. (I have
1051 * merely reformatted it into the Exim code style.)
1052
1053 * "From here I changed the code to add support for multiple crl's
1054 * in pem format in one file or to support hashed directory entries in
1055 * pem format instead of a file. This method now uses the library function
1056 * X509_STORE_load_locations to add the CRL location to the SSL context.
1057 * OpenSSL will then handle the verify against CA certs and CRLs by
1058 * itself in the verify callback." */
1059
1060 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1061 if (expcrl != NULL && *expcrl != 0)
1062 {
1063 struct stat statbufcrl;
1064 if (Ustat(expcrl, &statbufcrl) < 0)
1065 {
1066 log_write(0, LOG_MAIN|LOG_PANIC,
1067 "failed to stat %s for certificates revocation lists", expcrl);
1068 return DEFER;
1069 }
1070 else
1071 {
1072 /* is it a file or directory? */
1073 uschar *file, *dir;
1074 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
1075 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
1076 {
1077 file = NULL;
1078 dir = expcrl;
1079 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
1080 }
1081 else
1082 {
1083 file = expcrl;
1084 dir = NULL;
1085 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
1086 }
1087 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
1088 return tls_error(US"X509_STORE_load_locations", host, NULL);
1089
1090 /* setting the flags to check against the complete crl chain */
1091
1092 X509_STORE_set_flags(cvstore,
1093 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
1094 }
1095 }
1096
1097 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1098
1099 /* If verification is optional, don't fail if no certificate */
1100
1101 SSL_CTX_set_verify(sctx,
1102 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
1103 client ? verify_callback_client : verify_callback_server);
1104 }
1105
1106 return OK;
1107 }
1108
1109
1110
1111 /*************************************************
1112 * Start a TLS session in a server *
1113 *************************************************/
1114
1115 /* This is called when Exim is running as a server, after having received
1116 the STARTTLS command. It must respond to that command, and then negotiate
1117 a TLS session.
1118
1119 Arguments:
1120 require_ciphers allowed ciphers
1121
1122 Returns: OK on success
1123 DEFER for errors before the start of the negotiation
1124 FAIL for errors during the negotation; the server can't
1125 continue running.
1126 */
1127
1128 int
1129 tls_server_start(const uschar *require_ciphers)
1130 {
1131 int rc;
1132 uschar *expciphers;
1133 tls_ext_ctx_cb *cbinfo;
1134 static uschar cipherbuf[256];
1135
1136 /* Check for previous activation */
1137
1138 if (tls_in.active >= 0)
1139 {
1140 tls_error(US"STARTTLS received after TLS started", NULL, US"");
1141 smtp_printf("554 Already in TLS\r\n");
1142 return FAIL;
1143 }
1144
1145 /* Initialize the SSL library. If it fails, it will already have logged
1146 the error. */
1147
1148 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
1149 #ifdef EXPERIMENTAL_OCSP
1150 tls_ocsp_file,
1151 #endif
1152 NULL, &server_static_cbinfo);
1153 if (rc != OK) return rc;
1154 cbinfo = server_static_cbinfo;
1155
1156 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1157 return FAIL;
1158
1159 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1160 were historically separated by underscores. So that I can use either form in my
1161 tests, and also for general convenience, we turn underscores into hyphens here.
1162 */
1163
1164 if (expciphers != NULL)
1165 {
1166 uschar *s = expciphers;
1167 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1168 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1169 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
1170 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
1171 cbinfo->server_cipher_list = expciphers;
1172 }
1173
1174 /* If this is a host for which certificate verification is mandatory or
1175 optional, set up appropriately. */
1176
1177 tls_in.certificate_verified = FALSE;
1178 server_verify_callback_called = FALSE;
1179
1180 if (verify_check_host(&tls_verify_hosts) == OK)
1181 {
1182 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL, FALSE, FALSE);
1183 if (rc != OK) return rc;
1184 server_verify_optional = FALSE;
1185 }
1186 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1187 {
1188 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL, TRUE, FALSE);
1189 if (rc != OK) return rc;
1190 server_verify_optional = TRUE;
1191 }
1192
1193 /* Prepare for new connection */
1194
1195 if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
1196
1197 /* Warning: we used to SSL_clear(ssl) here, it was removed.
1198 *
1199 * With the SSL_clear(), we get strange interoperability bugs with
1200 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1201 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1202 *
1203 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1204 * session shutdown. In this case, we have a brand new object and there's no
1205 * obvious reason to immediately clear it. I'm guessing that this was
1206 * originally added because of incomplete initialisation which the clear fixed,
1207 * in some historic release.
1208 */
1209
1210 /* Set context and tell client to go ahead, except in the case of TLS startup
1211 on connection, where outputting anything now upsets the clients and tends to
1212 make them disconnect. We need to have an explicit fflush() here, to force out
1213 the response. Other smtp_printf() calls do not need it, because in non-TLS
1214 mode, the fflush() happens when smtp_getc() is called. */
1215
1216 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1217 if (!tls_in.on_connect)
1218 {
1219 smtp_printf("220 TLS go ahead\r\n");
1220 fflush(smtp_out);
1221 }
1222
1223 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1224 that the OpenSSL library doesn't. */
1225
1226 SSL_set_wfd(server_ssl, fileno(smtp_out));
1227 SSL_set_rfd(server_ssl, fileno(smtp_in));
1228 SSL_set_accept_state(server_ssl);
1229
1230 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1231
1232 sigalrm_seen = FALSE;
1233 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1234 rc = SSL_accept(server_ssl);
1235 alarm(0);
1236
1237 if (rc <= 0)
1238 {
1239 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
1240 if (ERR_get_error() == 0)
1241 log_write(0, LOG_MAIN,
1242 "TLS client disconnected cleanly (rejected our certificate?)");
1243 return FAIL;
1244 }
1245
1246 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1247
1248 /* TLS has been set up. Adjust the input functions to read via TLS,
1249 and initialize things. */
1250
1251 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1252 tls_in.cipher = cipherbuf;
1253
1254 DEBUG(D_tls)
1255 {
1256 uschar buf[2048];
1257 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
1258 debug_printf("Shared ciphers: %s\n", buf);
1259 }
1260
1261
1262 /* Only used by the server-side tls (tls_in), including tls_getc.
1263 Client-side (tls_out) reads (seem to?) go via
1264 smtp_read_response()/ip_recv().
1265 Hence no need to duplicate for _in and _out.
1266 */
1267 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1268 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1269 ssl_xfer_eof = ssl_xfer_error = 0;
1270
1271 receive_getc = tls_getc;
1272 receive_ungetc = tls_ungetc;
1273 receive_feof = tls_feof;
1274 receive_ferror = tls_ferror;
1275 receive_smtp_buffered = tls_smtp_buffered;
1276
1277 tls_in.active = fileno(smtp_out);
1278 return OK;
1279 }
1280
1281
1282
1283
1284
1285 /*************************************************
1286 * Start a TLS session in a client *
1287 *************************************************/
1288
1289 /* Called from the smtp transport after STARTTLS has been accepted.
1290
1291 Argument:
1292 fd the fd of the connection
1293 host connected host (for messages)
1294 addr the first address
1295 dhparam DH parameter file
1296 certificate certificate file
1297 privatekey private key file
1298 sni TLS SNI to send to remote host
1299 verify_certs file for certificate verify
1300 crl file containing CRL
1301 require_ciphers list of allowed ciphers
1302 dh_min_bits minimum number of bits acceptable in server's DH prime
1303 (unused in OpenSSL)
1304 timeout startup timeout
1305
1306 Returns: OK on success
1307 FAIL otherwise - note that tls_error() will not give DEFER
1308 because this is not a server
1309 */
1310
1311 int
1312 tls_client_start(int fd, host_item *host, address_item *addr, uschar *dhparam,
1313 uschar *certificate, uschar *privatekey, uschar *sni,
1314 uschar *verify_certs, uschar *crl,
1315 uschar *require_ciphers, int dh_min_bits ARG_UNUSED, int timeout)
1316 {
1317 static uschar txt[256];
1318 uschar *expciphers;
1319 X509* server_cert;
1320 int rc;
1321 static uschar cipherbuf[256];
1322
1323 rc = tls_init(&client_ctx, host, dhparam, certificate, privatekey,
1324 #ifdef EXPERIMENTAL_OCSP
1325 NULL,
1326 #endif
1327 addr, &client_static_cbinfo);
1328 if (rc != OK) return rc;
1329
1330 tls_out.certificate_verified = FALSE;
1331 client_verify_callback_called = FALSE;
1332
1333 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1334 return FAIL;
1335
1336 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1337 are separated by underscores. So that I can use either form in my tests, and
1338 also for general convenience, we turn underscores into hyphens here. */
1339
1340 if (expciphers != NULL)
1341 {
1342 uschar *s = expciphers;
1343 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1344 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1345 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
1346 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
1347 }
1348
1349 rc = setup_certs(client_ctx, verify_certs, crl, host, FALSE, TRUE);
1350 if (rc != OK) return rc;
1351
1352 if ((client_ssl = SSL_new(client_ctx)) == NULL) return tls_error(US"SSL_new", host, NULL);
1353 SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1354 SSL_set_fd(client_ssl, fd);
1355 SSL_set_connect_state(client_ssl);
1356
1357 if (sni)
1358 {
1359 if (!expand_check(sni, US"tls_sni", &tls_out.sni))
1360 return FAIL;
1361 if (tls_out.sni == NULL)
1362 {
1363 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1364 }
1365 else if (!Ustrlen(tls_out.sni))
1366 tls_out.sni = NULL;
1367 else
1368 {
1369 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1370 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1371 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
1372 #else
1373 DEBUG(D_tls)
1374 debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
1375 tls_sni);
1376 #endif
1377 }
1378 }
1379
1380 /* There doesn't seem to be a built-in timeout on connection. */
1381
1382 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1383 sigalrm_seen = FALSE;
1384 alarm(timeout);
1385 rc = SSL_connect(client_ssl);
1386 alarm(0);
1387
1388 if (rc <= 0)
1389 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
1390
1391 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
1392
1393 /* Beware anonymous ciphers which lead to server_cert being NULL */
1394 server_cert = SSL_get_peer_certificate (client_ssl);
1395 if (server_cert)
1396 {
1397 tls_out.peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
1398 CS txt, sizeof(txt));
1399 tls_out.peerdn = txt;
1400 }
1401 else
1402 tls_out.peerdn = NULL;
1403
1404 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
1405 tls_out.cipher = cipherbuf;
1406
1407 tls_out.active = fd;
1408 return OK;
1409 }
1410
1411
1412
1413
1414
1415 /*************************************************
1416 * TLS version of getc *
1417 *************************************************/
1418
1419 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
1420 it refills the buffer via the SSL reading function.
1421
1422 Arguments: none
1423 Returns: the next character or EOF
1424
1425 Only used by the server-side TLS.
1426 */
1427
1428 int
1429 tls_getc(void)
1430 {
1431 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
1432 {
1433 int error;
1434 int inbytes;
1435
1436 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
1437 ssl_xfer_buffer, ssl_xfer_buffer_size);
1438
1439 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1440 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
1441 error = SSL_get_error(server_ssl, inbytes);
1442 alarm(0);
1443
1444 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
1445 closed down, not that the socket itself has been closed down. Revert to
1446 non-SSL handling. */
1447
1448 if (error == SSL_ERROR_ZERO_RETURN)
1449 {
1450 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
1451
1452 receive_getc = smtp_getc;
1453 receive_ungetc = smtp_ungetc;
1454 receive_feof = smtp_feof;
1455 receive_ferror = smtp_ferror;
1456 receive_smtp_buffered = smtp_buffered;
1457
1458 SSL_free(server_ssl);
1459 server_ssl = NULL;
1460 tls_in.active = -1;
1461 tls_in.bits = 0;
1462 tls_in.cipher = NULL;
1463 tls_in.peerdn = NULL;
1464 tls_in.sni = NULL;
1465
1466 return smtp_getc();
1467 }
1468
1469 /* Handle genuine errors */
1470
1471 else if (error == SSL_ERROR_SSL)
1472 {
1473 ERR_error_string(ERR_get_error(), ssl_errstring);
1474 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
1475 ssl_xfer_error = 1;
1476 return EOF;
1477 }
1478
1479 else if (error != SSL_ERROR_NONE)
1480 {
1481 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
1482 ssl_xfer_error = 1;
1483 return EOF;
1484 }
1485
1486 #ifndef DISABLE_DKIM
1487 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
1488 #endif
1489 ssl_xfer_buffer_hwm = inbytes;
1490 ssl_xfer_buffer_lwm = 0;
1491 }
1492
1493 /* Something in the buffer; return next uschar */
1494
1495 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
1496 }
1497
1498
1499
1500 /*************************************************
1501 * Read bytes from TLS channel *
1502 *************************************************/
1503
1504 /*
1505 Arguments:
1506 buff buffer of data
1507 len size of buffer
1508
1509 Returns: the number of bytes read
1510 -1 after a failed read
1511
1512 Only used by the client-side TLS.
1513 */
1514
1515 int
1516 tls_read(BOOL is_server, uschar *buff, size_t len)
1517 {
1518 SSL *ssl = is_server ? server_ssl : client_ssl;
1519 int inbytes;
1520 int error;
1521
1522 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
1523 buff, (unsigned int)len);
1524
1525 inbytes = SSL_read(ssl, CS buff, len);
1526 error = SSL_get_error(ssl, inbytes);
1527
1528 if (error == SSL_ERROR_ZERO_RETURN)
1529 {
1530 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
1531 return -1;
1532 }
1533 else if (error != SSL_ERROR_NONE)
1534 {
1535 return -1;
1536 }
1537
1538 return inbytes;
1539 }
1540
1541
1542
1543
1544
1545 /*************************************************
1546 * Write bytes down TLS channel *
1547 *************************************************/
1548
1549 /*
1550 Arguments:
1551 is_server channel specifier
1552 buff buffer of data
1553 len number of bytes
1554
1555 Returns: the number of bytes after a successful write,
1556 -1 after a failed write
1557
1558 Used by both server-side and client-side TLS.
1559 */
1560
1561 int
1562 tls_write(BOOL is_server, const uschar *buff, size_t len)
1563 {
1564 int outbytes;
1565 int error;
1566 int left = len;
1567 SSL *ssl = is_server ? server_ssl : client_ssl;
1568
1569 DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
1570 while (left > 0)
1571 {
1572 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
1573 outbytes = SSL_write(ssl, CS buff, left);
1574 error = SSL_get_error(ssl, outbytes);
1575 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
1576 switch (error)
1577 {
1578 case SSL_ERROR_SSL:
1579 ERR_error_string(ERR_get_error(), ssl_errstring);
1580 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
1581 return -1;
1582
1583 case SSL_ERROR_NONE:
1584 left -= outbytes;
1585 buff += outbytes;
1586 break;
1587
1588 case SSL_ERROR_ZERO_RETURN:
1589 log_write(0, LOG_MAIN, "SSL channel closed on write");
1590 return -1;
1591
1592 case SSL_ERROR_SYSCALL:
1593 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
1594 sender_fullhost ? sender_fullhost : US"<unknown>",
1595 strerror(errno));
1596
1597 default:
1598 log_write(0, LOG_MAIN, "SSL_write error %d", error);
1599 return -1;
1600 }
1601 }
1602 return len;
1603 }
1604
1605
1606
1607 /*************************************************
1608 * Close down a TLS session *
1609 *************************************************/
1610
1611 /* This is also called from within a delivery subprocess forked from the
1612 daemon, to shut down the TLS library, without actually doing a shutdown (which
1613 would tamper with the SSL session in the parent process).
1614
1615 Arguments: TRUE if SSL_shutdown is to be called
1616 Returns: nothing
1617
1618 Used by both server-side and client-side TLS.
1619 */
1620
1621 void
1622 tls_close(BOOL is_server, BOOL shutdown)
1623 {
1624 SSL **sslp = is_server ? &server_ssl : &client_ssl;
1625 int *fdp = is_server ? &tls_in.active : &tls_out.active;
1626
1627 if (*fdp < 0) return; /* TLS was not active */
1628
1629 if (shutdown)
1630 {
1631 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
1632 SSL_shutdown(*sslp);
1633 }
1634
1635 SSL_free(*sslp);
1636 *sslp = NULL;
1637
1638 *fdp = -1;
1639 }
1640
1641
1642
1643
1644 /*************************************************
1645 * Let tls_require_ciphers be checked at startup *
1646 *************************************************/
1647
1648 /* The tls_require_ciphers option, if set, must be something which the
1649 library can parse.
1650
1651 Returns: NULL on success, or error message
1652 */
1653
1654 uschar *
1655 tls_validate_require_cipher(void)
1656 {
1657 SSL_CTX *ctx;
1658 uschar *s, *expciphers, *err;
1659
1660 /* this duplicates from tls_init(), we need a better "init just global
1661 state, for no specific purpose" singleton function of our own */
1662
1663 SSL_load_error_strings();
1664 OpenSSL_add_ssl_algorithms();
1665 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
1666 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1667 list of available digests. */
1668 EVP_add_digest(EVP_sha256());
1669 #endif
1670
1671 if (!(tls_require_ciphers && *tls_require_ciphers))
1672 return NULL;
1673
1674 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
1675 return US"failed to expand tls_require_ciphers";
1676
1677 if (!(expciphers && *expciphers))
1678 return NULL;
1679
1680 /* normalisation ripped from above */
1681 s = expciphers;
1682 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1683
1684 err = NULL;
1685
1686 ctx = SSL_CTX_new(SSLv23_server_method());
1687 if (!ctx)
1688 {
1689 ERR_error_string(ERR_get_error(), ssl_errstring);
1690 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
1691 }
1692
1693 DEBUG(D_tls)
1694 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
1695
1696 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
1697 {
1698 ERR_error_string(ERR_get_error(), ssl_errstring);
1699 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
1700 }
1701
1702 SSL_CTX_free(ctx);
1703
1704 return err;
1705 }
1706
1707
1708
1709
1710 /*************************************************
1711 * Report the library versions. *
1712 *************************************************/
1713
1714 /* There have historically been some issues with binary compatibility in
1715 OpenSSL libraries; if Exim (like many other applications) is built against
1716 one version of OpenSSL but the run-time linker picks up another version,
1717 it can result in serious failures, including crashing with a SIGSEGV. So
1718 report the version found by the compiler and the run-time version.
1719
1720 Arguments: a FILE* to print the results to
1721 Returns: nothing
1722 */
1723
1724 void
1725 tls_version_report(FILE *f)
1726 {
1727 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
1728 " Runtime: %s\n",
1729 OPENSSL_VERSION_TEXT,
1730 SSLeay_version(SSLEAY_VERSION));
1731 }
1732
1733
1734
1735
1736 /*************************************************
1737 * Random number generation *
1738 *************************************************/
1739
1740 /* Pseudo-random number generation. The result is not expected to be
1741 cryptographically strong but not so weak that someone will shoot themselves
1742 in the foot using it as a nonce in input in some email header scheme or
1743 whatever weirdness they'll twist this into. The result should handle fork()
1744 and avoid repeating sequences. OpenSSL handles that for us.
1745
1746 Arguments:
1747 max range maximum
1748 Returns a random number in range [0, max-1]
1749 */
1750
1751 int
1752 vaguely_random_number(int max)
1753 {
1754 unsigned int r;
1755 int i, needed_len;
1756 uschar *p;
1757 uschar smallbuf[sizeof(r)];
1758
1759 if (max <= 1)
1760 return 0;
1761
1762 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
1763 if (!RAND_status())
1764 {
1765 randstuff r;
1766 gettimeofday(&r.tv, NULL);
1767 r.p = getpid();
1768
1769 RAND_seed((uschar *)(&r), sizeof(r));
1770 }
1771 /* We're after pseudo-random, not random; if we still don't have enough data
1772 in the internal PRNG then our options are limited. We could sleep and hope
1773 for entropy to come along (prayer technique) but if the system is so depleted
1774 in the first place then something is likely to just keep taking it. Instead,
1775 we'll just take whatever little bit of pseudo-random we can still manage to
1776 get. */
1777
1778 needed_len = sizeof(r);
1779 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
1780 asked for a number less than 10. */
1781 for (r = max, i = 0; r; ++i)
1782 r >>= 1;
1783 i = (i + 7) / 8;
1784 if (i < needed_len)
1785 needed_len = i;
1786
1787 /* We do not care if crypto-strong */
1788 i = RAND_pseudo_bytes(smallbuf, needed_len);
1789 if (i < 0)
1790 {
1791 DEBUG(D_all)
1792 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
1793 return vaguely_random_number_fallback(max);
1794 }
1795
1796 r = 0;
1797 for (p = smallbuf; needed_len; --needed_len, ++p)
1798 {
1799 r *= 256;
1800 r += *p;
1801 }
1802
1803 /* We don't particularly care about weighted results; if someone wants
1804 smooth distribution and cares enough then they should submit a patch then. */
1805 return r % max;
1806 }
1807
1808
1809
1810
1811 /*************************************************
1812 * OpenSSL option parse *
1813 *************************************************/
1814
1815 /* Parse one option for tls_openssl_options_parse below
1816
1817 Arguments:
1818 name one option name
1819 value place to store a value for it
1820 Returns success or failure in parsing
1821 */
1822
1823 struct exim_openssl_option {
1824 uschar *name;
1825 long value;
1826 };
1827 /* We could use a macro to expand, but we need the ifdef and not all the
1828 options document which version they were introduced in. Policylet: include
1829 all options unless explicitly for DTLS, let the administrator choose which
1830 to apply.
1831
1832 This list is current as of:
1833 ==> 1.0.1b <== */
1834 static struct exim_openssl_option exim_openssl_options[] = {
1835 /* KEEP SORTED ALPHABETICALLY! */
1836 #ifdef SSL_OP_ALL
1837 { US"all", SSL_OP_ALL },
1838 #endif
1839 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
1840 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
1841 #endif
1842 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
1843 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
1844 #endif
1845 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
1846 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
1847 #endif
1848 #ifdef SSL_OP_EPHEMERAL_RSA
1849 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
1850 #endif
1851 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
1852 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
1853 #endif
1854 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
1855 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
1856 #endif
1857 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
1858 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
1859 #endif
1860 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
1861 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
1862 #endif
1863 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
1864 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
1865 #endif
1866 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
1867 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
1868 #endif
1869 #ifdef SSL_OP_NO_COMPRESSION
1870 { US"no_compression", SSL_OP_NO_COMPRESSION },
1871 #endif
1872 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1873 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
1874 #endif
1875 #ifdef SSL_OP_NO_SSLv2
1876 { US"no_sslv2", SSL_OP_NO_SSLv2 },
1877 #endif
1878 #ifdef SSL_OP_NO_SSLv3
1879 { US"no_sslv3", SSL_OP_NO_SSLv3 },
1880 #endif
1881 #ifdef SSL_OP_NO_TICKET
1882 { US"no_ticket", SSL_OP_NO_TICKET },
1883 #endif
1884 #ifdef SSL_OP_NO_TLSv1
1885 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
1886 #endif
1887 #ifdef SSL_OP_NO_TLSv1_1
1888 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
1889 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
1890 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
1891 #else
1892 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
1893 #endif
1894 #endif
1895 #ifdef SSL_OP_NO_TLSv1_2
1896 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
1897 #endif
1898 #ifdef SSL_OP_SINGLE_DH_USE
1899 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
1900 #endif
1901 #ifdef SSL_OP_SINGLE_ECDH_USE
1902 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
1903 #endif
1904 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
1905 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
1906 #endif
1907 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
1908 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
1909 #endif
1910 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
1911 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
1912 #endif
1913 #ifdef SSL_OP_TLS_D5_BUG
1914 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
1915 #endif
1916 #ifdef SSL_OP_TLS_ROLLBACK_BUG
1917 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
1918 #endif
1919 };
1920 static int exim_openssl_options_size =
1921 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
1922
1923
1924 static BOOL
1925 tls_openssl_one_option_parse(uschar *name, long *value)
1926 {
1927 int first = 0;
1928 int last = exim_openssl_options_size;
1929 while (last > first)
1930 {
1931 int middle = (first + last)/2;
1932 int c = Ustrcmp(name, exim_openssl_options[middle].name);
1933 if (c == 0)
1934 {
1935 *value = exim_openssl_options[middle].value;
1936 return TRUE;
1937 }
1938 else if (c > 0)
1939 first = middle + 1;
1940 else
1941 last = middle;
1942 }
1943 return FALSE;
1944 }
1945
1946
1947
1948
1949 /*************************************************
1950 * OpenSSL option parsing logic *
1951 *************************************************/
1952
1953 /* OpenSSL has a number of compatibility options which an administrator might
1954 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
1955 we look like log_selector.
1956
1957 Arguments:
1958 option_spec the administrator-supplied string of options
1959 results ptr to long storage for the options bitmap
1960 Returns success or failure
1961 */
1962
1963 BOOL
1964 tls_openssl_options_parse(uschar *option_spec, long *results)
1965 {
1966 long result, item;
1967 uschar *s, *end;
1968 uschar keep_c;
1969 BOOL adding, item_parsed;
1970
1971 result = 0L;
1972 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
1973 * from default because it increases BEAST susceptibility. */
1974 #ifdef SSL_OP_NO_SSLv2
1975 result |= SSL_OP_NO_SSLv2;
1976 #endif
1977
1978 if (option_spec == NULL)
1979 {
1980 *results = result;
1981 return TRUE;
1982 }
1983
1984 for (s=option_spec; *s != '\0'; /**/)
1985 {
1986 while (isspace(*s)) ++s;
1987 if (*s == '\0')
1988 break;
1989 if (*s != '+' && *s != '-')
1990 {
1991 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
1992 "+ or - expected but found \"%s\"\n", s);
1993 return FALSE;
1994 }
1995 adding = *s++ == '+';
1996 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
1997 keep_c = *end;
1998 *end = '\0';
1999 item_parsed = tls_openssl_one_option_parse(s, &item);
2000 if (!item_parsed)
2001 {
2002 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
2003 return FALSE;
2004 }
2005 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2006 adding ? "adding" : "removing", result, item, s);
2007 if (adding)
2008 result |= item;
2009 else
2010 result &= ~item;
2011 *end = keep_c;
2012 s = end;
2013 }
2014
2015 *results = result;
2016 return TRUE;
2017 }
2018
2019 /* End of tls-openssl.c */