Deal with anonymous SSL giving us no peer certificate.
[exim.git] / src / src / tls-openssl.c
1 /* $Cambridge: exim/src/src/tls-openssl.c,v 1.26 2010/06/05 10:34:29 pdp Exp $ */
2
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
6
7 /* Copyright (c) University of Cambridge 1995 - 2009 */
8 /* See the file NOTICE for conditions of use and distribution. */
9
10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11 library. It is #included into the tls.c file when that library is used. The
12 code herein is based on a patch that was originally contributed by Steve
13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15 No cryptographic code is included in Exim. All this module does is to call
16 functions from the OpenSSL library. */
17
18
19 /* Heading stuff */
20
21 #include <openssl/lhash.h>
22 #include <openssl/ssl.h>
23 #include <openssl/err.h>
24 #include <openssl/rand.h>
25
26 /* Structure for collecting random data for seeding. */
27
28 typedef struct randstuff {
29 struct timeval tv;
30 pid_t p;
31 } randstuff;
32
33 /* Local static variables */
34
35 static BOOL verify_callback_called = FALSE;
36 static const uschar *sid_ctx = US"exim";
37
38 static SSL_CTX *ctx = NULL;
39 static SSL *ssl = NULL;
40
41 static char ssl_errstring[256];
42
43 static int ssl_session_timeout = 200;
44 static BOOL verify_optional = FALSE;
45
46
47
48
49
50 /*************************************************
51 * Handle TLS error *
52 *************************************************/
53
54 /* Called from lots of places when errors occur before actually starting to do
55 the TLS handshake, that is, while the session is still in clear. Always returns
56 DEFER for a server and FAIL for a client so that most calls can use "return
57 tls_error(...)" to do this processing and then give an appropriate return. A
58 single function is used for both server and client, because it is called from
59 some shared functions.
60
61 Argument:
62 prefix text to include in the logged error
63 host NULL if setting up a server;
64 the connected host if setting up a client
65 msg error message or NULL if we should ask OpenSSL
66
67 Returns: OK/DEFER/FAIL
68 */
69
70 static int
71 tls_error(uschar *prefix, host_item *host, uschar *msg)
72 {
73 if (msg == NULL)
74 {
75 ERR_error_string(ERR_get_error(), ssl_errstring);
76 msg = (uschar *)ssl_errstring;
77 }
78
79 if (host == NULL)
80 {
81 uschar *conn_info = smtp_get_connection_info();
82 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
83 conn_info += 5;
84 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
85 conn_info, prefix, msg);
86 return DEFER;
87 }
88 else
89 {
90 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s): %s",
91 host->name, host->address, prefix, msg);
92 return FAIL;
93 }
94 }
95
96
97
98 /*************************************************
99 * Callback to generate RSA key *
100 *************************************************/
101
102 /*
103 Arguments:
104 s SSL connection
105 export not used
106 keylength keylength
107
108 Returns: pointer to generated key
109 */
110
111 static RSA *
112 rsa_callback(SSL *s, int export, int keylength)
113 {
114 RSA *rsa_key;
115 export = export; /* Shut picky compilers up */
116 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
117 rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
118 if (rsa_key == NULL)
119 {
120 ERR_error_string(ERR_get_error(), ssl_errstring);
121 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
122 ssl_errstring);
123 return NULL;
124 }
125 return rsa_key;
126 }
127
128
129
130
131 /*************************************************
132 * Callback for verification *
133 *************************************************/
134
135 /* The SSL library does certificate verification if set up to do so. This
136 callback has the current yes/no state is in "state". If verification succeeded,
137 we set up the tls_peerdn string. If verification failed, what happens depends
138 on whether the client is required to present a verifiable certificate or not.
139
140 If verification is optional, we change the state to yes, but still log the
141 verification error. For some reason (it really would help to have proper
142 documentation of OpenSSL), this callback function then gets called again, this
143 time with state = 1. In fact, that's useful, because we can set up the peerdn
144 value, but we must take care not to set the private verified flag on the second
145 time through.
146
147 Note: this function is not called if the client fails to present a certificate
148 when asked. We get here only if a certificate has been received. Handling of
149 optional verification for this case is done when requesting SSL to verify, by
150 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
151
152 Arguments:
153 state current yes/no state as 1/0
154 x509ctx certificate information.
155
156 Returns: 1 if verified, 0 if not
157 */
158
159 static int
160 verify_callback(int state, X509_STORE_CTX *x509ctx)
161 {
162 static uschar txt[256];
163
164 X509_NAME_oneline(X509_get_subject_name(x509ctx->current_cert),
165 CS txt, sizeof(txt));
166
167 if (state == 0)
168 {
169 log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
170 x509ctx->error_depth,
171 X509_verify_cert_error_string(x509ctx->error),
172 txt);
173 tls_certificate_verified = FALSE;
174 verify_callback_called = TRUE;
175 if (!verify_optional) return 0; /* reject */
176 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
177 "tls_try_verify_hosts)\n");
178 return 1; /* accept */
179 }
180
181 if (x509ctx->error_depth != 0)
182 {
183 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d cert=%s\n",
184 x509ctx->error_depth, txt);
185 }
186 else
187 {
188 DEBUG(D_tls) debug_printf("SSL%s peer: %s\n",
189 verify_callback_called? "" : " authenticated", txt);
190 tls_peerdn = txt;
191 }
192
193 if (!verify_callback_called) tls_certificate_verified = TRUE;
194 verify_callback_called = TRUE;
195
196 return 1; /* accept */
197 }
198
199
200
201 /*************************************************
202 * Information callback *
203 *************************************************/
204
205 /* The SSL library functions call this from time to time to indicate what they
206 are doing. We copy the string to the debugging output when the level is high
207 enough.
208
209 Arguments:
210 s the SSL connection
211 where
212 ret
213
214 Returns: nothing
215 */
216
217 static void
218 info_callback(SSL *s, int where, int ret)
219 {
220 where = where;
221 ret = ret;
222 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
223 }
224
225
226
227 /*************************************************
228 * Initialize for DH *
229 *************************************************/
230
231 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
232
233 Arguments:
234 dhparam DH parameter file
235 host connected host, if client; NULL if server
236
237 Returns: TRUE if OK (nothing to set up, or setup worked)
238 */
239
240 static BOOL
241 init_dh(uschar *dhparam, host_item *host)
242 {
243 BOOL yield = TRUE;
244 BIO *bio;
245 DH *dh;
246 uschar *dhexpanded;
247
248 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
249 return FALSE;
250
251 if (dhexpanded == NULL) return TRUE;
252
253 if ((bio = BIO_new_file(CS dhexpanded, "r")) == NULL)
254 {
255 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
256 host, (uschar *)strerror(errno));
257 yield = FALSE;
258 }
259 else
260 {
261 if ((dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)) == NULL)
262 {
263 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
264 host, NULL);
265 yield = FALSE;
266 }
267 else
268 {
269 SSL_CTX_set_tmp_dh(ctx, dh);
270 DEBUG(D_tls)
271 debug_printf("Diffie-Hellman initialized from %s with %d-bit key\n",
272 dhexpanded, 8*DH_size(dh));
273 DH_free(dh);
274 }
275 BIO_free(bio);
276 }
277
278 return yield;
279 }
280
281
282
283
284 /*************************************************
285 * Initialize for TLS *
286 *************************************************/
287
288 /* Called from both server and client code, to do preliminary initialization of
289 the library.
290
291 Arguments:
292 host connected host, if client; NULL if server
293 dhparam DH parameter file
294 certificate certificate file
295 privatekey private key
296 addr address if client; NULL if server (for some randomness)
297
298 Returns: OK/DEFER/FAIL
299 */
300
301 static int
302 tls_init(host_item *host, uschar *dhparam, uschar *certificate,
303 uschar *privatekey, address_item *addr)
304 {
305 long init_options;
306 BOOL okay;
307
308 SSL_load_error_strings(); /* basic set up */
309 OpenSSL_add_ssl_algorithms();
310
311 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
312 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
313 list of available digests. */
314 EVP_add_digest(EVP_sha256());
315 #endif
316
317 /* Create a context */
318
319 ctx = SSL_CTX_new((host == NULL)?
320 SSLv23_server_method() : SSLv23_client_method());
321
322 if (ctx == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
323
324 /* It turns out that we need to seed the random number generator this early in
325 order to get the full complement of ciphers to work. It took me roughly a day
326 of work to discover this by experiment.
327
328 On systems that have /dev/urandom, SSL may automatically seed itself from
329 there. Otherwise, we have to make something up as best we can. Double check
330 afterwards. */
331
332 if (!RAND_status())
333 {
334 randstuff r;
335 gettimeofday(&r.tv, NULL);
336 r.p = getpid();
337
338 RAND_seed((uschar *)(&r), sizeof(r));
339 RAND_seed((uschar *)big_buffer, big_buffer_size);
340 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
341
342 if (!RAND_status())
343 return tls_error(US"RAND_status", host,
344 US"unable to seed random number generator");
345 }
346
347 /* Set up the information callback, which outputs if debugging is at a suitable
348 level. */
349
350 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
351
352 /* Apply administrator-supplied work-arounds.
353 Historically we applied just one requested option,
354 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
355 moved to an administrator-controlled list of options to specify and
356 grandfathered in the first one as the default value for "openssl_options".
357
358 No OpenSSL version number checks: the options we accept depend upon the
359 availability of the option value macros from OpenSSL. */
360
361 okay = tls_openssl_options_parse(openssl_options, &init_options);
362 if (!okay)
363 return tls_error("openssl_options parsing failed", host, NULL);
364
365 if (init_options)
366 {
367 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
368 if (!(SSL_CTX_set_options(ctx, init_options)))
369 return tls_error(string_sprintf(
370 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
371 }
372 else
373 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
374
375 /* Initialize with DH parameters if supplied */
376
377 if (!init_dh(dhparam, host)) return DEFER;
378
379 /* Set up certificate and key */
380
381 if (certificate != NULL)
382 {
383 uschar *expanded;
384 if (!expand_check(certificate, US"tls_certificate", &expanded))
385 return DEFER;
386
387 if (expanded != NULL)
388 {
389 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
390 if (!SSL_CTX_use_certificate_chain_file(ctx, CS expanded))
391 return tls_error(string_sprintf(
392 "SSL_CTX_use_certificate_chain_file file=%s", expanded), host, NULL);
393 }
394
395 if (privatekey != NULL &&
396 !expand_check(privatekey, US"tls_privatekey", &expanded))
397 return DEFER;
398
399 /* If expansion was forced to fail, key_expanded will be NULL. If the result
400 of the expansion is an empty string, ignore it also, and assume the private
401 key is in the same file as the certificate. */
402
403 if (expanded != NULL && *expanded != 0)
404 {
405 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
406 if (!SSL_CTX_use_PrivateKey_file(ctx, CS expanded, SSL_FILETYPE_PEM))
407 return tls_error(string_sprintf(
408 "SSL_CTX_use_PrivateKey_file file=%s", expanded), host, NULL);
409 }
410 }
411
412 /* Set up the RSA callback */
413
414 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
415
416 /* Finally, set the timeout, and we are done */
417
418 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
419 DEBUG(D_tls) debug_printf("Initialized TLS\n");
420 return OK;
421 }
422
423
424
425
426 /*************************************************
427 * Get name of cipher in use *
428 *************************************************/
429
430 /* The answer is left in a static buffer, and tls_cipher is set to point
431 to it.
432
433 Argument: pointer to an SSL structure for the connection
434 Returns: nothing
435 */
436
437 static void
438 construct_cipher_name(SSL *ssl)
439 {
440 static uschar cipherbuf[256];
441 SSL_CIPHER *c;
442 uschar *ver;
443 int bits;
444
445 switch (ssl->session->ssl_version)
446 {
447 case SSL2_VERSION:
448 ver = US"SSLv2";
449 break;
450
451 case SSL3_VERSION:
452 ver = US"SSLv3";
453 break;
454
455 case TLS1_VERSION:
456 ver = US"TLSv1";
457 break;
458
459 default:
460 ver = US"UNKNOWN";
461 }
462
463 c = SSL_get_current_cipher(ssl);
464 SSL_CIPHER_get_bits(c, &bits);
465
466 string_format(cipherbuf, sizeof(cipherbuf), "%s:%s:%u", ver,
467 SSL_CIPHER_get_name(c), bits);
468 tls_cipher = cipherbuf;
469
470 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
471 }
472
473
474
475
476
477 /*************************************************
478 * Set up for verifying certificates *
479 *************************************************/
480
481 /* Called by both client and server startup
482
483 Arguments:
484 certs certs file or NULL
485 crl CRL file or NULL
486 host NULL in a server; the remote host in a client
487 optional TRUE if called from a server for a host in tls_try_verify_hosts;
488 otherwise passed as FALSE
489
490 Returns: OK/DEFER/FAIL
491 */
492
493 static int
494 setup_certs(uschar *certs, uschar *crl, host_item *host, BOOL optional)
495 {
496 uschar *expcerts, *expcrl;
497
498 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
499 return DEFER;
500
501 if (expcerts != NULL)
502 {
503 struct stat statbuf;
504 if (!SSL_CTX_set_default_verify_paths(ctx))
505 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
506
507 if (Ustat(expcerts, &statbuf) < 0)
508 {
509 log_write(0, LOG_MAIN|LOG_PANIC,
510 "failed to stat %s for certificates", expcerts);
511 return DEFER;
512 }
513 else
514 {
515 uschar *file, *dir;
516 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
517 { file = NULL; dir = expcerts; }
518 else
519 { file = expcerts; dir = NULL; }
520
521 /* If a certificate file is empty, the next function fails with an
522 unhelpful error message. If we skip it, we get the correct behaviour (no
523 certificates are recognized, but the error message is still misleading (it
524 says no certificate was supplied.) But this is better. */
525
526 if ((file == NULL || statbuf.st_size > 0) &&
527 !SSL_CTX_load_verify_locations(ctx, CS file, CS dir))
528 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
529
530 if (file != NULL)
531 {
532 SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(CS file));
533 }
534 }
535
536 /* Handle a certificate revocation list. */
537
538 #if OPENSSL_VERSION_NUMBER > 0x00907000L
539
540 /* This bit of code is now the version supplied by Lars Mainka. (I have
541 * merely reformatted it into the Exim code style.)
542
543 * "From here I changed the code to add support for multiple crl's
544 * in pem format in one file or to support hashed directory entries in
545 * pem format instead of a file. This method now uses the library function
546 * X509_STORE_load_locations to add the CRL location to the SSL context.
547 * OpenSSL will then handle the verify against CA certs and CRLs by
548 * itself in the verify callback." */
549
550 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
551 if (expcrl != NULL && *expcrl != 0)
552 {
553 struct stat statbufcrl;
554 if (Ustat(expcrl, &statbufcrl) < 0)
555 {
556 log_write(0, LOG_MAIN|LOG_PANIC,
557 "failed to stat %s for certificates revocation lists", expcrl);
558 return DEFER;
559 }
560 else
561 {
562 /* is it a file or directory? */
563 uschar *file, *dir;
564 X509_STORE *cvstore = SSL_CTX_get_cert_store(ctx);
565 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
566 {
567 file = NULL;
568 dir = expcrl;
569 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
570 }
571 else
572 {
573 file = expcrl;
574 dir = NULL;
575 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
576 }
577 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
578 return tls_error(US"X509_STORE_load_locations", host, NULL);
579
580 /* setting the flags to check against the complete crl chain */
581
582 X509_STORE_set_flags(cvstore,
583 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
584 }
585 }
586
587 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
588
589 /* If verification is optional, don't fail if no certificate */
590
591 SSL_CTX_set_verify(ctx,
592 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
593 verify_callback);
594 }
595
596 return OK;
597 }
598
599
600
601 /*************************************************
602 * Start a TLS session in a server *
603 *************************************************/
604
605 /* This is called when Exim is running as a server, after having received
606 the STARTTLS command. It must respond to that command, and then negotiate
607 a TLS session.
608
609 Arguments:
610 require_ciphers allowed ciphers
611 ------------------------------------------------------
612 require_mac list of allowed MACs ) Not used
613 require_kx list of allowed key_exchange methods ) for
614 require_proto list of allowed protocols ) OpenSSL
615 ------------------------------------------------------
616
617 Returns: OK on success
618 DEFER for errors before the start of the negotiation
619 FAIL for errors during the negotation; the server can't
620 continue running.
621 */
622
623 int
624 tls_server_start(uschar *require_ciphers, uschar *require_mac,
625 uschar *require_kx, uschar *require_proto)
626 {
627 int rc;
628 uschar *expciphers;
629
630 /* Check for previous activation */
631
632 if (tls_active >= 0)
633 {
634 tls_error(US"STARTTLS received after TLS started", NULL, US"");
635 smtp_printf("554 Already in TLS\r\n");
636 return FAIL;
637 }
638
639 /* Initialize the SSL library. If it fails, it will already have logged
640 the error. */
641
642 rc = tls_init(NULL, tls_dhparam, tls_certificate, tls_privatekey, NULL);
643 if (rc != OK) return rc;
644
645 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
646 return FAIL;
647
648 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
649 are separated by underscores. So that I can use either form in my tests, and
650 also for general convenience, we turn underscores into hyphens here. */
651
652 if (expciphers != NULL)
653 {
654 uschar *s = expciphers;
655 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
656 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
657 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
658 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
659 }
660
661 /* If this is a host for which certificate verification is mandatory or
662 optional, set up appropriately. */
663
664 tls_certificate_verified = FALSE;
665 verify_callback_called = FALSE;
666
667 if (verify_check_host(&tls_verify_hosts) == OK)
668 {
669 rc = setup_certs(tls_verify_certificates, tls_crl, NULL, FALSE);
670 if (rc != OK) return rc;
671 verify_optional = FALSE;
672 }
673 else if (verify_check_host(&tls_try_verify_hosts) == OK)
674 {
675 rc = setup_certs(tls_verify_certificates, tls_crl, NULL, TRUE);
676 if (rc != OK) return rc;
677 verify_optional = TRUE;
678 }
679
680 /* Prepare for new connection */
681
682 if ((ssl = SSL_new(ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
683 SSL_clear(ssl);
684
685 /* Set context and tell client to go ahead, except in the case of TLS startup
686 on connection, where outputting anything now upsets the clients and tends to
687 make them disconnect. We need to have an explicit fflush() here, to force out
688 the response. Other smtp_printf() calls do not need it, because in non-TLS
689 mode, the fflush() happens when smtp_getc() is called. */
690
691 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
692 if (!tls_on_connect)
693 {
694 smtp_printf("220 TLS go ahead\r\n");
695 fflush(smtp_out);
696 }
697
698 /* Now negotiate the TLS session. We put our own timer on it, since it seems
699 that the OpenSSL library doesn't. */
700
701 SSL_set_wfd(ssl, fileno(smtp_out));
702 SSL_set_rfd(ssl, fileno(smtp_in));
703 SSL_set_accept_state(ssl);
704
705 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
706
707 sigalrm_seen = FALSE;
708 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
709 rc = SSL_accept(ssl);
710 alarm(0);
711
712 if (rc <= 0)
713 {
714 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
715 if (ERR_get_error() == 0)
716 log_write(0, LOG_MAIN,
717 " => client disconnected cleanly (rejected our certificate?)\n");
718 return FAIL;
719 }
720
721 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
722
723 /* TLS has been set up. Adjust the input functions to read via TLS,
724 and initialize things. */
725
726 construct_cipher_name(ssl);
727
728 DEBUG(D_tls)
729 {
730 uschar buf[2048];
731 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)) != NULL)
732 debug_printf("Shared ciphers: %s\n", buf);
733 }
734
735
736 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
737 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
738 ssl_xfer_eof = ssl_xfer_error = 0;
739
740 receive_getc = tls_getc;
741 receive_ungetc = tls_ungetc;
742 receive_feof = tls_feof;
743 receive_ferror = tls_ferror;
744 receive_smtp_buffered = tls_smtp_buffered;
745
746 tls_active = fileno(smtp_out);
747 return OK;
748 }
749
750
751
752
753
754 /*************************************************
755 * Start a TLS session in a client *
756 *************************************************/
757
758 /* Called from the smtp transport after STARTTLS has been accepted.
759
760 Argument:
761 fd the fd of the connection
762 host connected host (for messages)
763 addr the first address
764 dhparam DH parameter file
765 certificate certificate file
766 privatekey private key file
767 verify_certs file for certificate verify
768 crl file containing CRL
769 require_ciphers list of allowed ciphers
770 ------------------------------------------------------
771 require_mac list of allowed MACs ) Not used
772 require_kx list of allowed key_exchange methods ) for
773 require_proto list of allowed protocols ) OpenSSL
774 ------------------------------------------------------
775 timeout startup timeout
776
777 Returns: OK on success
778 FAIL otherwise - note that tls_error() will not give DEFER
779 because this is not a server
780 */
781
782 int
783 tls_client_start(int fd, host_item *host, address_item *addr, uschar *dhparam,
784 uschar *certificate, uschar *privatekey, uschar *verify_certs, uschar *crl,
785 uschar *require_ciphers, uschar *require_mac, uschar *require_kx,
786 uschar *require_proto, int timeout)
787 {
788 static uschar txt[256];
789 uschar *expciphers;
790 X509* server_cert;
791 int rc;
792
793 rc = tls_init(host, dhparam, certificate, privatekey, addr);
794 if (rc != OK) return rc;
795
796 tls_certificate_verified = FALSE;
797 verify_callback_called = FALSE;
798
799 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
800 return FAIL;
801
802 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
803 are separated by underscores. So that I can use either form in my tests, and
804 also for general convenience, we turn underscores into hyphens here. */
805
806 if (expciphers != NULL)
807 {
808 uschar *s = expciphers;
809 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
810 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
811 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
812 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
813 }
814
815 rc = setup_certs(verify_certs, crl, host, FALSE);
816 if (rc != OK) return rc;
817
818 if ((ssl = SSL_new(ctx)) == NULL) return tls_error(US"SSL_new", host, NULL);
819 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
820 SSL_set_fd(ssl, fd);
821 SSL_set_connect_state(ssl);
822
823 /* There doesn't seem to be a built-in timeout on connection. */
824
825 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
826 sigalrm_seen = FALSE;
827 alarm(timeout);
828 rc = SSL_connect(ssl);
829 alarm(0);
830
831 if (rc <= 0)
832 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
833
834 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
835
836 /* Beware anonymous ciphers which lead to server_cert being NULL */
837 server_cert = SSL_get_peer_certificate (ssl);
838 if (server_cert)
839 {
840 tls_peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
841 CS txt, sizeof(txt));
842 tls_peerdn = txt;
843 }
844 else
845 tls_peerdn = NULL;
846
847 construct_cipher_name(ssl); /* Sets tls_cipher */
848
849 tls_active = fd;
850 return OK;
851 }
852
853
854
855
856
857 /*************************************************
858 * TLS version of getc *
859 *************************************************/
860
861 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
862 it refills the buffer via the SSL reading function.
863
864 Arguments: none
865 Returns: the next character or EOF
866 */
867
868 int
869 tls_getc(void)
870 {
871 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
872 {
873 int error;
874 int inbytes;
875
876 DEBUG(D_tls) debug_printf("Calling SSL_read(%lx, %lx, %u)\n", (long)ssl,
877 (long)ssl_xfer_buffer, ssl_xfer_buffer_size);
878
879 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
880 inbytes = SSL_read(ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
881 error = SSL_get_error(ssl, inbytes);
882 alarm(0);
883
884 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
885 closed down, not that the socket itself has been closed down. Revert to
886 non-SSL handling. */
887
888 if (error == SSL_ERROR_ZERO_RETURN)
889 {
890 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
891
892 receive_getc = smtp_getc;
893 receive_ungetc = smtp_ungetc;
894 receive_feof = smtp_feof;
895 receive_ferror = smtp_ferror;
896 receive_smtp_buffered = smtp_buffered;
897
898 SSL_free(ssl);
899 ssl = NULL;
900 tls_active = -1;
901 tls_cipher = NULL;
902 tls_peerdn = NULL;
903
904 return smtp_getc();
905 }
906
907 /* Handle genuine errors */
908
909 else if (error == SSL_ERROR_SSL)
910 {
911 ERR_error_string(ERR_get_error(), ssl_errstring);
912 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
913 ssl_xfer_error = 1;
914 return EOF;
915 }
916
917 else if (error != SSL_ERROR_NONE)
918 {
919 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
920 ssl_xfer_error = 1;
921 return EOF;
922 }
923 #ifndef DISABLE_DKIM
924 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
925 #endif
926 ssl_xfer_buffer_hwm = inbytes;
927 ssl_xfer_buffer_lwm = 0;
928 }
929
930 /* Something in the buffer; return next uschar */
931
932 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
933 }
934
935
936
937 /*************************************************
938 * Read bytes from TLS channel *
939 *************************************************/
940
941 /*
942 Arguments:
943 buff buffer of data
944 len size of buffer
945
946 Returns: the number of bytes read
947 -1 after a failed read
948 */
949
950 int
951 tls_read(uschar *buff, size_t len)
952 {
953 int inbytes;
954 int error;
955
956 DEBUG(D_tls) debug_printf("Calling SSL_read(%lx, %lx, %u)\n", (long)ssl,
957 (long)buff, (unsigned int)len);
958
959 inbytes = SSL_read(ssl, CS buff, len);
960 error = SSL_get_error(ssl, inbytes);
961
962 if (error == SSL_ERROR_ZERO_RETURN)
963 {
964 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
965 return -1;
966 }
967 else if (error != SSL_ERROR_NONE)
968 {
969 return -1;
970 }
971
972 return inbytes;
973 }
974
975
976
977
978
979 /*************************************************
980 * Write bytes down TLS channel *
981 *************************************************/
982
983 /*
984 Arguments:
985 buff buffer of data
986 len number of bytes
987
988 Returns: the number of bytes after a successful write,
989 -1 after a failed write
990 */
991
992 int
993 tls_write(const uschar *buff, size_t len)
994 {
995 int outbytes;
996 int error;
997 int left = len;
998
999 DEBUG(D_tls) debug_printf("tls_do_write(%lx, %d)\n", (long)buff, left);
1000 while (left > 0)
1001 {
1002 DEBUG(D_tls) debug_printf("SSL_write(SSL, %lx, %d)\n", (long)buff, left);
1003 outbytes = SSL_write(ssl, CS buff, left);
1004 error = SSL_get_error(ssl, outbytes);
1005 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
1006 switch (error)
1007 {
1008 case SSL_ERROR_SSL:
1009 ERR_error_string(ERR_get_error(), ssl_errstring);
1010 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
1011 return -1;
1012
1013 case SSL_ERROR_NONE:
1014 left -= outbytes;
1015 buff += outbytes;
1016 break;
1017
1018 case SSL_ERROR_ZERO_RETURN:
1019 log_write(0, LOG_MAIN, "SSL channel closed on write");
1020 return -1;
1021
1022 default:
1023 log_write(0, LOG_MAIN, "SSL_write error %d", error);
1024 return -1;
1025 }
1026 }
1027 return len;
1028 }
1029
1030
1031
1032 /*************************************************
1033 * Close down a TLS session *
1034 *************************************************/
1035
1036 /* This is also called from within a delivery subprocess forked from the
1037 daemon, to shut down the TLS library, without actually doing a shutdown (which
1038 would tamper with the SSL session in the parent process).
1039
1040 Arguments: TRUE if SSL_shutdown is to be called
1041 Returns: nothing
1042 */
1043
1044 void
1045 tls_close(BOOL shutdown)
1046 {
1047 if (tls_active < 0) return; /* TLS was not active */
1048
1049 if (shutdown)
1050 {
1051 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
1052 SSL_shutdown(ssl);
1053 }
1054
1055 SSL_free(ssl);
1056 ssl = NULL;
1057
1058 tls_active = -1;
1059 }
1060
1061
1062
1063
1064 /*************************************************
1065 * Report the library versions. *
1066 *************************************************/
1067
1068 /* There have historically been some issues with binary compatibility in
1069 OpenSSL libraries; if Exim (like many other applications) is built against
1070 one version of OpenSSL but the run-time linker picks up another version,
1071 it can result in serious failures, including crashing with a SIGSEGV. So
1072 report the version found by the compiler and the run-time version.
1073
1074 Arguments: a FILE* to print the results to
1075 Returns: nothing
1076 */
1077
1078 void
1079 tls_version_report(FILE *f)
1080 {
1081 fprintf(f, "OpenSSL compile-time version: %s\n", OPENSSL_VERSION_TEXT);
1082 fprintf(f, "OpenSSL runtime version: %s\n", SSLeay_version(SSLEAY_VERSION));
1083 }
1084
1085
1086
1087
1088 /*************************************************
1089 * Pseudo-random number generation *
1090 *************************************************/
1091
1092 /* Pseudo-random number generation. The result is not expected to be
1093 cryptographically strong but not so weak that someone will shoot themselves
1094 in the foot using it as a nonce in input in some email header scheme or
1095 whatever weirdness they'll twist this into. The result should handle fork()
1096 and avoid repeating sequences. OpenSSL handles that for us.
1097
1098 Arguments:
1099 max range maximum
1100 Returns a random number in range [0, max-1]
1101 */
1102
1103 int
1104 pseudo_random_number(int max)
1105 {
1106 unsigned int r;
1107 int i, needed_len;
1108 uschar *p;
1109 uschar smallbuf[sizeof(r)];
1110
1111 if (max <= 1)
1112 return 0;
1113
1114 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
1115 if (!RAND_status())
1116 {
1117 randstuff r;
1118 gettimeofday(&r.tv, NULL);
1119 r.p = getpid();
1120
1121 RAND_seed((uschar *)(&r), sizeof(r));
1122 }
1123 /* We're after pseudo-random, not random; if we still don't have enough data
1124 in the internal PRNG then our options are limited. We could sleep and hope
1125 for entropy to come along (prayer technique) but if the system is so depleted
1126 in the first place then something is likely to just keep taking it. Instead,
1127 we'll just take whatever little bit of pseudo-random we can still manage to
1128 get. */
1129
1130 needed_len = sizeof(r);
1131 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
1132 asked for a number less than 10. */
1133 for (r = max, i = 0; r; ++i)
1134 r >>= 1;
1135 i = (i + 7) / 8;
1136 if (i < needed_len)
1137 needed_len = i;
1138
1139 /* We do not care if crypto-strong */
1140 (void) RAND_pseudo_bytes(smallbuf, needed_len);
1141 r = 0;
1142 for (p = smallbuf; needed_len; --needed_len, ++p)
1143 {
1144 r *= 256;
1145 r += *p;
1146 }
1147
1148 /* We don't particularly care about weighted results; if someone wants
1149 smooth distribution and cares enough then they should submit a patch then. */
1150 return r % max;
1151 }
1152
1153
1154
1155
1156 /*************************************************
1157 * OpenSSL option parse *
1158 *************************************************/
1159
1160 /* Parse one option for tls_openssl_options_parse below
1161
1162 Arguments:
1163 name one option name
1164 value place to store a value for it
1165 Returns success or failure in parsing
1166 */
1167
1168 struct exim_openssl_option {
1169 uschar *name;
1170 long value;
1171 };
1172 /* We could use a macro to expand, but we need the ifdef and not all the
1173 options document which version they were introduced in. Policylet: include
1174 all options unless explicitly for DTLS, let the administrator choose which
1175 to apply.
1176
1177 This list is current as of:
1178 ==> 0.9.8n <== */
1179 static struct exim_openssl_option exim_openssl_options[] = {
1180 /* KEEP SORTED ALPHABETICALLY! */
1181 #ifdef SSL_OP_ALL
1182 { "all", SSL_OP_ALL },
1183 #endif
1184 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
1185 { "allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
1186 #endif
1187 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
1188 { "cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
1189 #endif
1190 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
1191 { "dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
1192 #endif
1193 #ifdef SSL_OP_EPHEMERAL_RSA
1194 { "ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
1195 #endif
1196 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
1197 { "legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
1198 #endif
1199 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
1200 { "microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
1201 #endif
1202 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
1203 { "microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
1204 #endif
1205 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
1206 { "msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
1207 #endif
1208 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
1209 { "netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
1210 #endif
1211 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
1212 { "netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
1213 #endif
1214 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1215 { "no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
1216 #endif
1217 #ifdef SSL_OP_SINGLE_DH_USE
1218 { "single_dh_use", SSL_OP_SINGLE_DH_USE },
1219 #endif
1220 #ifdef SSL_OP_SINGLE_ECDH_USE
1221 { "single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
1222 #endif
1223 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
1224 { "ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
1225 #endif
1226 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
1227 { "sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
1228 #endif
1229 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
1230 { "tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
1231 #endif
1232 #ifdef SSL_OP_TLS_D5_BUG
1233 { "tls_d5_bug", SSL_OP_TLS_D5_BUG },
1234 #endif
1235 #ifdef SSL_OP_TLS_ROLLBACK_BUG
1236 { "tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
1237 #endif
1238 };
1239 static int exim_openssl_options_size =
1240 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
1241
1242 static BOOL
1243 tls_openssl_one_option_parse(uschar *name, long *value)
1244 {
1245 int first = 0;
1246 int last = exim_openssl_options_size;
1247 while (last > first)
1248 {
1249 int middle = (first + last)/2;
1250 int c = Ustrcmp(name, exim_openssl_options[middle].name);
1251 if (c == 0)
1252 {
1253 *value = exim_openssl_options[middle].value;
1254 return TRUE;
1255 }
1256 else if (c > 0)
1257 first = middle + 1;
1258 else
1259 last = middle;
1260 }
1261 return FALSE;
1262 }
1263
1264
1265
1266
1267 /*************************************************
1268 * OpenSSL option parsing logic *
1269 *************************************************/
1270
1271 /* OpenSSL has a number of compatibility options which an administrator might
1272 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
1273 we look like log_selector.
1274
1275 Arguments:
1276 option_spec the administrator-supplied string of options
1277 results ptr to long storage for the options bitmap
1278 Returns success or failure
1279 */
1280
1281 BOOL
1282 tls_openssl_options_parse(uschar *option_spec, long *results)
1283 {
1284 long result, item;
1285 uschar *s, *end;
1286 uschar keep_c;
1287 BOOL adding, item_parsed;
1288
1289 /* We grandfather in as default the one option which we used to set always. */
1290 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
1291 result = SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
1292 #else
1293 result = 0L;
1294 #endif
1295
1296 if (option_spec == NULL)
1297 {
1298 *results = result;
1299 return TRUE;
1300 }
1301
1302 for (s=option_spec; *s != '\0'; /**/)
1303 {
1304 while (isspace(*s)) ++s;
1305 if (*s == '\0')
1306 break;
1307 if (*s != '+' && *s != '-')
1308 {
1309 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
1310 "+ or - expected but found \"%s\"", s);
1311 return FALSE;
1312 }
1313 adding = *s++ == '+';
1314 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
1315 keep_c = *end;
1316 *end = '\0';
1317 item_parsed = tls_openssl_one_option_parse(s, &item);
1318 if (!item_parsed)
1319 {
1320 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"", s);
1321 return FALSE;
1322 }
1323 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
1324 adding ? "adding" : "removing", result, item, s);
1325 if (adding)
1326 result |= item;
1327 else
1328 result &= ~item;
1329 *end = keep_c;
1330 s = end;
1331 }
1332
1333 *results = result;
1334 return TRUE;
1335 }
1336
1337 /* End of tls-openssl.c */