src/src/tls-openssl.c

   1 /*************************************************
   2 *     Exim - an Internet mail transport agent    *
   3 *************************************************/
   4
   5 /* Copyright (c) University of Cambridge 1995 - 2014 */
   6 /* See the file NOTICE for conditions of use and distribution. */
   7
   8 /* Portions Copyright (c) The OpenSSL Project 1999 */
   9
  10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
  11 library. It is #included into the tls.c file when that library is used. The
  12 code herein is based on a patch that was originally contributed by Steve
  13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
  14
  15 No cryptographic code is included in Exim. All this module does is to call
  16 functions from the OpenSSL library. */
  17
  18
  19 /* Heading stuff */
  20
  21 #include <openssl/lhash.h>
  22 #include <openssl/ssl.h>
  23 #include <openssl/err.h>
  24 #include <openssl/rand.h>
  25 #ifndef DISABLE_OCSP
  26 # include <openssl/ocsp.h>
  27 #endif
  28 #ifdef EXPERIMENTAL_DANE
  29 # include <danessl.h>
  30 #endif
  31
  32
  33 #ifndef DISABLE_OCSP
  34 # define EXIM_OCSP_SKEW_SECONDS (300L)
  35 # define EXIM_OCSP_MAX_AGE (-1L)
  36 #endif
  37
  38 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
  39 # define EXIM_HAVE_OPENSSL_TLSEXT
  40 #endif
  41
  42 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
  43 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
  44 # define DISABLE_OCSP
  45 #endif
  46
  47 /* Structure for collecting random data for seeding. */
  48
  49 typedef struct randstuff {
  50   struct timeval tv;
  51   pid_t          p;
  52 } randstuff;
  53
  54 /* Local static variables */
  55
  56 static BOOL client_verify_callback_called = FALSE;
  57 static BOOL server_verify_callback_called = FALSE;
  58 static const uschar *sid_ctx = US"exim";
  59
  60 /* We have three different contexts to care about.
  61
  62 Simple case: client, `client_ctx`
  63  As a client, we can be doing a callout or cut-through delivery while receiving
  64  a message.  So we have a client context, which should have options initialised
  65  from the SMTP Transport.
  66
  67 Server:
  68  There are two cases: with and without ServerNameIndication from the client.
  69  Given TLS SNI, we can be using different keys, certs and various other
  70  configuration settings, because they're re-expanded with $tls_sni set.  This
  71  allows vhosting with TLS.  This SNI is sent in the handshake.
  72  A client might not send SNI, so we need a fallback, and an initial setup too.
  73  So as a server, we start out using `server_ctx`.
  74  If SNI is sent by the client, then we as server, mid-negotiation, try to clone
  75  `server_sni` from `server_ctx` and then initialise settings by re-expanding
  76  configuration.
  77 */
  78
  79 static SSL_CTX *client_ctx = NULL;
  80 static SSL_CTX *server_ctx = NULL;
  81 static SSL     *client_ssl = NULL;
  82 static SSL     *server_ssl = NULL;
  83
  84 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
  85 static SSL_CTX *server_sni = NULL;
  86 #endif
  87
  88 static char ssl_errstring[256];
  89
  90 static int  ssl_session_timeout = 200;
  91 static BOOL client_verify_optional = FALSE;
  92 static BOOL server_verify_optional = FALSE;
  93
  94 static BOOL reexpand_tls_files_for_sni = FALSE;
  95
  96
  97 typedef struct tls_ext_ctx_cb {
  98   uschar *certificate;
  99   uschar *privatekey;
 100 #ifndef DISABLE_OCSP
 101   BOOL is_server;
 102   union {
 103     struct {
 104       uschar        *file;
 105       uschar        *file_expanded;
 106       OCSP_RESPONSE *response;
 107     } server;
 108     struct {
 109       X509_STORE    *verify_store;      /* non-null if status requested */
 110       BOOL          verify_required;
 111     } client;
 112   } u_ocsp;
 113 #endif
 114   uschar *dhparam;
 115   /* these are cached from first expand */
 116   uschar *server_cipher_list;
 117   /* only passed down to tls_error: */
 118   host_item *host;
 119
 120 #ifdef EXPERIMENTAL_CERTNAMES
 121   uschar * verify_cert_hostnames;
 122 #endif
 123 #ifdef EXPERIMENTAL_TPDA
 124   uschar * event_action;
 125 #endif
 126 } tls_ext_ctx_cb;
 127
 128 /* should figure out a cleanup of API to handle state preserved per
 129 implementation, for various reasons, which can be void * in the APIs.
 130 For now, we hack around it. */
 131 tls_ext_ctx_cb *client_static_cbinfo = NULL;
 132 tls_ext_ctx_cb *server_static_cbinfo = NULL;
 133
 134 static int
 135 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
 136     int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
 137
 138 /* Callbacks */
 139 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
 140 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
 141 #endif
 142 #ifndef DISABLE_OCSP
 143 static int tls_server_stapling_cb(SSL *s, void *arg);
 144 #endif
 145
 146
 147 /*************************************************
 148 *               Handle TLS error                 *
 149 *************************************************/
 150
 151 /* Called from lots of places when errors occur before actually starting to do
 152 the TLS handshake, that is, while the session is still in clear. Always returns
 153 DEFER for a server and FAIL for a client so that most calls can use "return
 154 tls_error(...)" to do this processing and then give an appropriate return. A
 155 single function is used for both server and client, because it is called from
 156 some shared functions.
 157
 158 Argument:
 159   prefix    text to include in the logged error
 160   host      NULL if setting up a server;
 161             the connected host if setting up a client
 162   msg       error message or NULL if we should ask OpenSSL
 163
 164 Returns:    OK/DEFER/FAIL
 165 */
 166
 167 static int
 168 tls_error(uschar *prefix, host_item *host, uschar *msg)
 169 {
 170 if (msg == NULL)
 171   {
 172   ERR_error_string(ERR_get_error(), ssl_errstring);
 173   msg = (uschar *)ssl_errstring;
 174   }
 175
 176 if (host == NULL)
 177   {
 178   uschar *conn_info = smtp_get_connection_info();
 179   if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
 180     conn_info += 5;
 181   log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
 182     conn_info, prefix, msg);
 183   return DEFER;
 184   }
 185 else
 186   {
 187   log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s): %s",
 188     host->name, host->address, prefix, msg);
 189   return FAIL;
 190   }
 191 }
 192
 193
 194
 195 /*************************************************
 196 *        Callback to generate RSA key            *
 197 *************************************************/
 198
 199 /*
 200 Arguments:
 201   s          SSL connection
 202   export     not used
 203   keylength  keylength
 204
 205 Returns:     pointer to generated key
 206 */
 207
 208 static RSA *
 209 rsa_callback(SSL *s, int export, int keylength)
 210 {
 211 RSA *rsa_key;
 212 export = export;     /* Shut picky compilers up */
 213 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
 214 rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
 215 if (rsa_key == NULL)
 216   {
 217   ERR_error_string(ERR_get_error(), ssl_errstring);
 218   log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
 219     ssl_errstring);
 220   return NULL;
 221   }
 222 return rsa_key;
 223 }
 224
 225
 226
 227 /* Extreme debug
 228 #ifndef DISABLE_OCSP
 229 void
 230 x509_store_dump_cert_s_names(X509_STORE * store)
 231 {
 232 STACK_OF(X509_OBJECT) * roots= store->objs;
 233 int i;
 234 static uschar name[256];
 235
 236 for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
 237   {
 238   X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
 239   if(tmp_obj->type == X509_LU_X509)
 240     {
 241     X509 * current_cert= tmp_obj->data.x509;
 242     X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
 243     debug_printf(" %s\n", name);
 244     }
 245   }
 246 }
 247 #endif
 248 */
 249
 250
 251 /*************************************************
 252 *        Callback for verification               *
 253 *************************************************/
 254
 255 /* The SSL library does certificate verification if set up to do so. This
 256 callback has the current yes/no state is in "state". If verification succeeded,
 257 we set up the tls_peerdn string. If verification failed, what happens depends
 258 on whether the client is required to present a verifiable certificate or not.
 259
 260 If verification is optional, we change the state to yes, but still log the
 261 verification error. For some reason (it really would help to have proper
 262 documentation of OpenSSL), this callback function then gets called again, this
 263 time with state = 1. In fact, that's useful, because we can set up the peerdn
 264 value, but we must take care not to set the private verified flag on the second
 265 time through.
 266
 267 Note: this function is not called if the client fails to present a certificate
 268 when asked. We get here only if a certificate has been received. Handling of
 269 optional verification for this case is done when requesting SSL to verify, by
 270 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
 271
 272 May be called multiple times for different issues with a certificate, even
 273 for a given "depth" in the certificate chain.
 274
 275 Arguments:
 276   state      current yes/no state as 1/0
 277   x509ctx    certificate information.
 278   client     TRUE for client startup, FALSE for server startup
 279
 280 Returns:     1 if verified, 0 if not
 281 */
 282
 283 static int
 284 verify_callback(int state, X509_STORE_CTX *x509ctx,
 285   tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
 286 {
 287 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 288 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 289 static uschar txt[256];
 290
 291 X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
 292
 293 if (state == 0)
 294   {
 295   log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
 296     depth,
 297     X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
 298     txt);
 299   tlsp->certificate_verified = FALSE;
 300   *calledp = TRUE;
 301   if (!*optionalp)
 302     {
 303     tlsp->peercert = X509_dup(cert);
 304     return 0;                       /* reject */
 305     }
 306   DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
 307     "tls_try_verify_hosts)\n");
 308   }
 309
 310 else if (depth != 0)
 311   {
 312   DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, txt);
 313 #ifndef DISABLE_OCSP
 314   if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
 315     {   /* client, wanting stapling  */
 316     /* Add the server cert's signing chain as the one
 317     for the verification of the OCSP stapled information. */
 318
 319     if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
 320                              cert))
 321       ERR_clear_error();
 322     }
 323 #endif
 324 #ifdef EXPERIMENTAL_TPDA
 325   if (tlsp == &tls_out && client_static_cbinfo->event_action)
 326     {
 327     tlsp->peercert = X509_dup(cert);
 328     if (tpda_raise_event(client_static_cbinfo->event_action,
 329                     US"tls:cert", string_sprintf("%d", depth)) == DEFER)
 330       {
 331       log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
 332                               "depth=%d cert=%s", depth, txt);
 333       tlsp->certificate_verified = FALSE;
 334       *calledp = TRUE;
 335       return 0;                     /* reject */
 336       }
 337     X509_free(tlsp->peercert);
 338     tlsp->peercert = NULL;
 339     }
 340 #endif
 341   }
 342 else
 343   {
 344 #ifdef EXPERIMENTAL_CERTNAMES
 345   uschar * verify_cert_hostnames;
 346 #endif
 347
 348   tlsp->peerdn = txt;
 349   tlsp->peercert = X509_dup(cert);
 350
 351 #ifdef EXPERIMENTAL_CERTNAMES
 352   if (  tlsp == &tls_out
 353      && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
 354         /* client, wanting hostname check */
 355
 356 # if OPENSSL_VERSION_NUMBER >= 0x010100000L || OPENSSL_VERSION_NUMBER >= 0x010002000L
 357 #  ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
 358 #   define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
 359 #  endif
 360     {
 361     int sep = 0;
 362     uschar * list = verify_cert_hostnames;
 363     uschar * name;
 364     int rc;
 365     while ((name = string_nextinlist(&list, &sep, NULL, 0)))
 366       if ((rc = X509_check_host(cert, name, 0,
 367                   X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS)))
 368         {
 369         if (rc < 0)
 370           {
 371           log_write(0, LOG_MAIN, "SSL verify error: internal error\n");
 372           name = NULL;
 373           }
 374         break;
 375         }
 376     if (!name)
 377       {
 378       log_write(0, LOG_MAIN,
 379         "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
 380       return 0;                         /* reject */
 381       }
 382     }
 383 # else
 384     if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
 385       {
 386       log_write(0, LOG_MAIN,
 387         "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
 388       return 0;                         /* reject */
 389       }
 390 # endif
 391 #endif  /*EXPERIMENTAL_CERTNAMES*/
 392
 393 #ifdef EXPERIMENTAL_TPDA
 394   if (tlsp == &tls_out)
 395     {
 396     if (tpda_raise_event(client_static_cbinfo->event_action,
 397                     US"tls:cert", US"0") == DEFER)
 398       {
 399       log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
 400                               "depth=0 cert=%s", txt);
 401       tlsp->certificate_verified = FALSE;
 402       *calledp = TRUE;
 403       return 0;                     /* reject */
 404       }
 405     }
 406 #endif
 407
 408   DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
 409     *calledp ? "" : " authenticated", txt);
 410   if (!*calledp) tlsp->certificate_verified = TRUE;
 411   *calledp = TRUE;
 412   }
 413
 414 return 1;   /* accept, at least for this level */
 415 }
 416
 417 static int
 418 verify_callback_client(int state, X509_STORE_CTX *x509ctx)
 419 {
 420 return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
 421 }
 422
 423 static int
 424 verify_callback_server(int state, X509_STORE_CTX *x509ctx)
 425 {
 426 return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
 427 }
 428
 429
 430 #ifdef EXPERIMENTAL_DANE
 431
 432 /* This gets called *by* the dane library verify callback, which interposes
 433 itself.
 434 */
 435 static int
 436 verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
 437 {
 438 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 439 static uschar txt[256];
 440 #ifdef EXPERIMENTAL_TPDA
 441 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 442 #endif
 443
 444 X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
 445
 446 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", txt);
 447 tls_out.peerdn = txt;
 448 tls_out.peercert = X509_dup(cert);
 449
 450 #ifdef EXPERIMENTAL_TPDA
 451   if (client_static_cbinfo->event_action)
 452     {
 453     if (tpda_raise_event(client_static_cbinfo->event_action,
 454                     US"tls:cert", string_sprintf("%d", depth)) == DEFER)
 455       {
 456       log_write(0, LOG_MAIN, "DANE verify denied by event-action: "
 457                               "depth=%d cert=%s", depth, txt);
 458       tls_out.certificate_verified = FALSE;
 459       return 0;                     /* reject */
 460       }
 461     if (depth != 0)
 462       {
 463       X509_free(tls_out.peercert);
 464       tls_out.peercert = NULL;
 465       }
 466     }
 467 #endif
 468
 469 if (state == 1)
 470   tls_out.dane_verified =
 471   tls_out.certificate_verified = TRUE;
 472 return 1;
 473 }
 474
 475 #endif  /*EXPERIMENTAL_DANE*/
 476
 477
 478 /*************************************************
 479 *           Information callback                 *
 480 *************************************************/
 481
 482 /* The SSL library functions call this from time to time to indicate what they
 483 are doing. We copy the string to the debugging output when TLS debugging has
 484 been requested.
 485
 486 Arguments:
 487   s         the SSL connection
 488   where
 489   ret
 490
 491 Returns:    nothing
 492 */
 493
 494 static void
 495 info_callback(SSL *s, int where, int ret)
 496 {
 497 where = where;
 498 ret = ret;
 499 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
 500 }
 501
 502
 503
 504 /*************************************************
 505 *                Initialize for DH               *
 506 *************************************************/
 507
 508 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
 509
 510 Arguments:
 511   dhparam   DH parameter file or fixed parameter identity string
 512   host      connected host, if client; NULL if server
 513
 514 Returns:    TRUE if OK (nothing to set up, or setup worked)
 515 */
 516
 517 static BOOL
 518 init_dh(SSL_CTX *sctx, uschar *dhparam, host_item *host)
 519 {
 520 BIO *bio;
 521 DH *dh;
 522 uschar *dhexpanded;
 523 const char *pem;
 524
 525 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
 526   return FALSE;
 527
 528 if (!dhexpanded || !*dhexpanded)
 529   bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
 530 else if (dhexpanded[0] == '/')
 531   {
 532   if (!(bio = BIO_new_file(CS dhexpanded, "r")))
 533     {
 534     tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
 535           host, US strerror(errno));
 536     return FALSE;
 537     }
 538   }
 539 else
 540   {
 541   if (Ustrcmp(dhexpanded, "none") == 0)
 542     {
 543     DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
 544     return TRUE;
 545     }
 546
 547   if (!(pem = std_dh_prime_named(dhexpanded)))
 548     {
 549     tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
 550         host, US strerror(errno));
 551     return FALSE;
 552     }
 553   bio = BIO_new_mem_buf(CS pem, -1);
 554   }
 555
 556 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
 557   {
 558   BIO_free(bio);
 559   tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
 560       host, NULL);
 561   return FALSE;
 562   }
 563
 564 /* Even if it is larger, we silently return success rather than cause things
 565  * to fail out, so that a too-large DH will not knock out all TLS; it's a
 566  * debatable choice. */
 567 if ((8*DH_size(dh)) > tls_dh_max_bits)
 568   {
 569   DEBUG(D_tls)
 570     debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
 571         8*DH_size(dh), tls_dh_max_bits);
 572   }
 573 else
 574   {
 575   SSL_CTX_set_tmp_dh(sctx, dh);
 576   DEBUG(D_tls)
 577     debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
 578       dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
 579   }
 580
 581 DH_free(dh);
 582 BIO_free(bio);
 583
 584 return TRUE;
 585 }
 586
 587
 588
 589
 590 #ifndef DISABLE_OCSP
 591 /*************************************************
 592 *       Load OCSP information into state         *
 593 *************************************************/
 594
 595 /* Called to load the server OCSP response from the given file into memory, once
 596 caller has determined this is needed.  Checks validity.  Debugs a message
 597 if invalid.
 598
 599 ASSUMES: single response, for single cert.
 600
 601 Arguments:
 602   sctx            the SSL_CTX* to update
 603   cbinfo          various parts of session state
 604   expanded        the filename putatively holding an OCSP response
 605
 606 */
 607
 608 static void
 609 ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
 610 {
 611 BIO *bio;
 612 OCSP_RESPONSE *resp;
 613 OCSP_BASICRESP *basic_response;
 614 OCSP_SINGLERESP *single_response;
 615 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
 616 X509_STORE *store;
 617 unsigned long verify_flags;
 618 int status, reason, i;
 619
 620 cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
 621 if (cbinfo->u_ocsp.server.response)
 622   {
 623   OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
 624   cbinfo->u_ocsp.server.response = NULL;
 625   }
 626
 627 bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
 628 if (!bio)
 629   {
 630   DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
 631       cbinfo->u_ocsp.server.file_expanded);
 632   return;
 633   }
 634
 635 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
 636 BIO_free(bio);
 637 if (!resp)
 638   {
 639   DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
 640   return;
 641   }
 642
 643 status = OCSP_response_status(resp);
 644 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
 645   {
 646   DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
 647       OCSP_response_status_str(status), status);
 648   goto bad;
 649   }
 650
 651 basic_response = OCSP_response_get1_basic(resp);
 652 if (!basic_response)
 653   {
 654   DEBUG(D_tls)
 655     debug_printf("OCSP response parse error: unable to extract basic response.\n");
 656   goto bad;
 657   }
 658
 659 store = SSL_CTX_get_cert_store(sctx);
 660 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
 661
 662 /* May need to expose ability to adjust those flags?
 663 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
 664 OCSP_TRUSTOTHER OCSP_NOINTERN */
 665
 666 i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
 667 if (i <= 0)
 668   {
 669   DEBUG(D_tls) {
 670     ERR_error_string(ERR_get_error(), ssl_errstring);
 671     debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
 672     }
 673   goto bad;
 674   }
 675
 676 /* Here's the simplifying assumption: there's only one response, for the
 677 one certificate we use, and nothing for anything else in a chain.  If this
 678 proves false, we need to extract a cert id from our issued cert
 679 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
 680 right cert in the stack and then calls OCSP_single_get0_status()).
 681
 682 I'm hoping to avoid reworking a bunch more of how we handle state here. */
 683 single_response = OCSP_resp_get0(basic_response, 0);
 684 if (!single_response)
 685   {
 686   DEBUG(D_tls)
 687     debug_printf("Unable to get first response from OCSP basic response.\n");
 688   goto bad;
 689   }
 690
 691 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
 692 if (status != V_OCSP_CERTSTATUS_GOOD)
 693   {
 694   DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
 695       OCSP_cert_status_str(status), status,
 696       OCSP_crl_reason_str(reason), reason);
 697   goto bad;
 698   }
 699
 700 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
 701   {
 702   DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
 703   goto bad;
 704   }
 705
 706 supply_response:
 707   cbinfo->u_ocsp.server.response = resp;
 708 return;
 709
 710 bad:
 711   if (running_in_test_harness)
 712     {
 713     extern char ** environ;
 714     uschar ** p;
 715     for (p = USS environ; *p != NULL; p++)
 716       if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
 717         {
 718         DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
 719         goto supply_response;
 720         }
 721     }
 722 return;
 723 }
 724 #endif  /*!DISABLE_OCSP*/
 725
 726
 727
 728
 729 /*************************************************
 730 *        Expand key and cert file specs          *
 731 *************************************************/
 732
 733 /* Called once during tls_init and possibly again during TLS setup, for a
 734 new context, if Server Name Indication was used and tls_sni was seen in
 735 the certificate string.
 736
 737 Arguments:
 738   sctx            the SSL_CTX* to update
 739   cbinfo          various parts of session state
 740
 741 Returns:          OK/DEFER/FAIL
 742 */
 743
 744 static int
 745 tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
 746 {
 747 uschar *expanded;
 748
 749 if (cbinfo->certificate == NULL)
 750   return OK;
 751
 752 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
 753     Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
 754     Ustrstr(cbinfo->certificate, US"tls_out_sni")
 755    )
 756   reexpand_tls_files_for_sni = TRUE;
 757
 758 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
 759   return DEFER;
 760
 761 if (expanded != NULL)
 762   {
 763   DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
 764   if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
 765     return tls_error(string_sprintf(
 766       "SSL_CTX_use_certificate_chain_file file=%s", expanded),
 767         cbinfo->host, NULL);
 768   }
 769
 770 if (cbinfo->privatekey != NULL &&
 771     !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
 772   return DEFER;
 773
 774 /* If expansion was forced to fail, key_expanded will be NULL. If the result
 775 of the expansion is an empty string, ignore it also, and assume the private
 776 key is in the same file as the certificate. */
 777
 778 if (expanded != NULL && *expanded != 0)
 779   {
 780   DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
 781   if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
 782     return tls_error(string_sprintf(
 783       "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
 784   }
 785
 786 #ifndef DISABLE_OCSP
 787 if (cbinfo->is_server &&  cbinfo->u_ocsp.server.file != NULL)
 788   {
 789   if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
 790     return DEFER;
 791
 792   if (expanded != NULL && *expanded != 0)
 793     {
 794     DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
 795     if (cbinfo->u_ocsp.server.file_expanded &&
 796         (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
 797       {
 798       DEBUG(D_tls)
 799         debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
 800       } else {
 801         ocsp_load_response(sctx, cbinfo, expanded);
 802       }
 803     }
 804   }
 805 #endif
 806
 807 return OK;
 808 }
 809
 810
 811
 812
 813 /*************************************************
 814 *            Callback to handle SNI              *
 815 *************************************************/
 816
 817 /* Called when acting as server during the TLS session setup if a Server Name
 818 Indication extension was sent by the client.
 819
 820 API documentation is OpenSSL s_server.c implementation.
 821
 822 Arguments:
 823   s               SSL* of the current session
 824   ad              unknown (part of OpenSSL API) (unused)
 825   arg             Callback of "our" registered data
 826
 827 Returns:          SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
 828 */
 829
 830 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
 831 static int
 832 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
 833 {
 834 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
 835 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
 836 int rc;
 837 int old_pool = store_pool;
 838
 839 if (!servername)
 840   return SSL_TLSEXT_ERR_OK;
 841
 842 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
 843     reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
 844
 845 /* Make the extension value available for expansion */
 846 store_pool = POOL_PERM;
 847 tls_in.sni = string_copy(US servername);
 848 store_pool = old_pool;
 849
 850 if (!reexpand_tls_files_for_sni)
 851   return SSL_TLSEXT_ERR_OK;
 852
 853 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
 854 not confident that memcpy wouldn't break some internal reference counting.
 855 Especially since there's a references struct member, which would be off. */
 856
 857 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
 858   {
 859   ERR_error_string(ERR_get_error(), ssl_errstring);
 860   DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
 861   return SSL_TLSEXT_ERR_NOACK;
 862   }
 863
 864 /* Not sure how many of these are actually needed, since SSL object
 865 already exists.  Might even need this selfsame callback, for reneg? */
 866
 867 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
 868 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
 869 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
 870 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
 871 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
 872 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
 873 if (cbinfo->server_cipher_list)
 874   SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
 875 #ifndef DISABLE_OCSP
 876 if (cbinfo->u_ocsp.server.file)
 877   {
 878   SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
 879   SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
 880   }
 881 #endif
 882
 883 rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
 884 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
 885
 886 /* do this after setup_certs, because this can require the certs for verifying
 887 OCSP information. */
 888 rc = tls_expand_session_files(server_sni, cbinfo);
 889 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
 890
 891 if (!init_dh(server_sni, cbinfo->dhparam, NULL))
 892   return SSL_TLSEXT_ERR_NOACK;
 893
 894 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
 895 SSL_set_SSL_CTX(s, server_sni);
 896
 897 return SSL_TLSEXT_ERR_OK;
 898 }
 899 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
 900
 901
 902
 903
 904 #ifndef DISABLE_OCSP
 905
 906 /*************************************************
 907 *        Callback to handle OCSP Stapling        *
 908 *************************************************/
 909
 910 /* Called when acting as server during the TLS session setup if the client
 911 requests OCSP information with a Certificate Status Request.
 912
 913 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
 914 project.
 915
 916 */
 917
 918 static int
 919 tls_server_stapling_cb(SSL *s, void *arg)
 920 {
 921 const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
 922 uschar *response_der;
 923 int response_der_len;
 924
 925 DEBUG(D_tls)
 926   debug_printf("Received TLS status request (OCSP stapling); %s response.",
 927     cbinfo->u_ocsp.server.response ? "have" : "lack");
 928
 929 tls_in.ocsp = OCSP_NOT_RESP;
 930 if (!cbinfo->u_ocsp.server.response)
 931   return SSL_TLSEXT_ERR_NOACK;
 932
 933 response_der = NULL;
 934 response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
 935                       &response_der);
 936 if (response_der_len <= 0)
 937   return SSL_TLSEXT_ERR_NOACK;
 938
 939 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
 940 tls_in.ocsp = OCSP_VFIED;
 941 return SSL_TLSEXT_ERR_OK;
 942 }
 943
 944
 945 static void
 946 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
 947 {
 948 BIO_printf(bp, "\t%s: ", str);
 949 ASN1_GENERALIZEDTIME_print(bp, time);
 950 BIO_puts(bp, "\n");
 951 }
 952
 953 static int
 954 tls_client_stapling_cb(SSL *s, void *arg)
 955 {
 956 tls_ext_ctx_cb * cbinfo = arg;
 957 const unsigned char * p;
 958 int len;
 959 OCSP_RESPONSE * rsp;
 960 OCSP_BASICRESP * bs;
 961 int i;
 962
 963 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
 964 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
 965 if(!p)
 966  {
 967   /* Expect this when we requested ocsp but got none */
 968   if (  cbinfo->u_ocsp.client.verify_required
 969      && log_extra_selector & LX_tls_cipher)
 970     log_write(0, LOG_MAIN, "Received TLS status callback, null content");
 971   else
 972     DEBUG(D_tls) debug_printf(" null\n");
 973   return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
 974  }
 975
 976 if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
 977  {
 978   tls_out.ocsp = OCSP_FAILED;
 979   if (log_extra_selector & LX_tls_cipher)
 980     log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
 981   else
 982     DEBUG(D_tls) debug_printf(" parse error\n");
 983   return 0;
 984  }
 985
 986 if(!(bs = OCSP_response_get1_basic(rsp)))
 987   {
 988   tls_out.ocsp = OCSP_FAILED;
 989   if (log_extra_selector & LX_tls_cipher)
 990     log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
 991   else
 992     DEBUG(D_tls) debug_printf(" error parsing response\n");
 993   OCSP_RESPONSE_free(rsp);
 994   return 0;
 995   }
 996
 997 /* We'd check the nonce here if we'd put one in the request. */
 998 /* However that would defeat cacheability on the server so we don't. */
 999
1000 /* This section of code reworked from OpenSSL apps source;
1001    The OpenSSL Project retains copyright:
1002    Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
1003 */
1004   {
1005     BIO * bp = NULL;
1006     int status, reason;
1007     ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1008
1009     DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1010
1011     /*OCSP_RESPONSE_print(bp, rsp, 0);   extreme debug: stapling content */
1012
1013     /* Use the chain that verified the server cert to verify the stapled info */
1014     /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1015
1016     if ((i = OCSP_basic_verify(bs, NULL,
1017               cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
1018       {
1019       tls_out.ocsp = OCSP_FAILED;
1020       if (log_extra_selector & LX_tls_cipher)
1021         log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
1022       BIO_printf(bp, "OCSP response verify failure\n");
1023       ERR_print_errors(bp);
1024       i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1025       goto out;
1026       }
1027
1028     BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1029
1030       {
1031       STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1032       OCSP_SINGLERESP * single;
1033
1034       if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1035         {
1036         tls_out.ocsp = OCSP_FAILED;
1037         log_write(0, LOG_MAIN, "OCSP stapling "
1038             "with multiple responses not handled");
1039         i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1040         goto out;
1041         }
1042       single = OCSP_resp_get0(bs, 0);
1043       status = OCSP_single_get0_status(single, &reason, &rev,
1044                   &thisupd, &nextupd);
1045       }
1046
1047     DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1048     DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1049     if (!OCSP_check_validity(thisupd, nextupd,
1050           EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1051       {
1052       tls_out.ocsp = OCSP_FAILED;
1053       DEBUG(D_tls) ERR_print_errors(bp);
1054       log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1055       i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1056       }
1057     else
1058       {
1059       DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1060                     OCSP_cert_status_str(status));
1061       switch(status)
1062         {
1063         case V_OCSP_CERTSTATUS_GOOD:
1064           tls_out.ocsp = OCSP_VFIED;
1065           i = 1;
1066           break;
1067         case V_OCSP_CERTSTATUS_REVOKED:
1068           tls_out.ocsp = OCSP_FAILED;
1069           log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1070               reason != -1 ? "; reason: " : "",
1071               reason != -1 ? OCSP_crl_reason_str(reason) : "");
1072           DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1073           i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1074           break;
1075         default:
1076           tls_out.ocsp = OCSP_FAILED;
1077           log_write(0, LOG_MAIN,
1078               "Server certificate status unknown, in OCSP stapling");
1079           i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1080           break;
1081         }
1082       }
1083   out:
1084     BIO_free(bp);
1085   }
1086
1087 OCSP_RESPONSE_free(rsp);
1088 return i;
1089 }
1090 #endif  /*!DISABLE_OCSP*/
1091
1092
1093 /*************************************************
1094 *            Initialize for TLS                  *
1095 *************************************************/
1096
1097 /* Called from both server and client code, to do preliminary initialization
1098 of the library.  We allocate and return a context structure.
1099
1100 Arguments:
1101   ctxp            returned SSL context
1102   host            connected host, if client; NULL if server
1103   dhparam         DH parameter file
1104   certificate     certificate file
1105   privatekey      private key
1106   ocsp_file       file of stapling info (server); flag for require ocsp (client)
1107   addr            address if client; NULL if server (for some randomness)
1108   cbp             place to put allocated callback context
1109
1110 Returns:          OK/DEFER/FAIL
1111 */
1112
1113 static int
1114 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
1115   uschar *privatekey,
1116 #ifndef DISABLE_OCSP
1117   uschar *ocsp_file,
1118 #endif
1119   address_item *addr, tls_ext_ctx_cb ** cbp)
1120 {
1121 long init_options;
1122 int rc;
1123 BOOL okay;
1124 tls_ext_ctx_cb * cbinfo;
1125
1126 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1127 cbinfo->certificate = certificate;
1128 cbinfo->privatekey = privatekey;
1129 #ifndef DISABLE_OCSP
1130 if ((cbinfo->is_server = host==NULL))
1131   {
1132   cbinfo->u_ocsp.server.file = ocsp_file;
1133   cbinfo->u_ocsp.server.file_expanded = NULL;
1134   cbinfo->u_ocsp.server.response = NULL;
1135   }
1136 else
1137   cbinfo->u_ocsp.client.verify_store = NULL;
1138 #endif
1139 cbinfo->dhparam = dhparam;
1140 cbinfo->server_cipher_list = NULL;
1141 cbinfo->host = host;
1142 #ifdef EXPERIMENTAL_TPDA
1143 cbinfo->event_action = NULL;
1144 #endif
1145
1146 SSL_load_error_strings();          /* basic set up */
1147 OpenSSL_add_ssl_algorithms();
1148
1149 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
1150 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1151 list of available digests. */
1152 EVP_add_digest(EVP_sha256());
1153 #endif
1154
1155 /* Create a context.
1156 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1157 negotiation in the different methods; as far as I can tell, the only
1158 *_{server,client}_method which allows negotiation is SSLv23, which exists even
1159 when OpenSSL is built without SSLv2 support.
1160 By disabling with openssl_options, we can let admins re-enable with the
1161 existing knob. */
1162
1163 *ctxp = SSL_CTX_new((host == NULL)?
1164   SSLv23_server_method() : SSLv23_client_method());
1165
1166 if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
1167
1168 /* It turns out that we need to seed the random number generator this early in
1169 order to get the full complement of ciphers to work. It took me roughly a day
1170 of work to discover this by experiment.
1171
1172 On systems that have /dev/urandom, SSL may automatically seed itself from
1173 there. Otherwise, we have to make something up as best we can. Double check
1174 afterwards. */
1175
1176 if (!RAND_status())
1177   {
1178   randstuff r;
1179   gettimeofday(&r.tv, NULL);
1180   r.p = getpid();
1181
1182   RAND_seed((uschar *)(&r), sizeof(r));
1183   RAND_seed((uschar *)big_buffer, big_buffer_size);
1184   if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1185
1186   if (!RAND_status())
1187     return tls_error(US"RAND_status", host,
1188       US"unable to seed random number generator");
1189   }
1190
1191 /* Set up the information callback, which outputs if debugging is at a suitable
1192 level. */
1193
1194 SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
1195
1196 /* Automatically re-try reads/writes after renegotiation. */
1197 (void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
1198
1199 /* Apply administrator-supplied work-arounds.
1200 Historically we applied just one requested option,
1201 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1202 moved to an administrator-controlled list of options to specify and
1203 grandfathered in the first one as the default value for "openssl_options".
1204
1205 No OpenSSL version number checks: the options we accept depend upon the
1206 availability of the option value macros from OpenSSL.  */
1207
1208 okay = tls_openssl_options_parse(openssl_options, &init_options);
1209 if (!okay)
1210   return tls_error(US"openssl_options parsing failed", host, NULL);
1211
1212 if (init_options)
1213   {
1214   DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
1215   if (!(SSL_CTX_set_options(*ctxp, init_options)))
1216     return tls_error(string_sprintf(
1217           "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1218   }
1219 else
1220   DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
1221
1222 /* Initialize with DH parameters if supplied */
1223
1224 if (!init_dh(*ctxp, dhparam, host)) return DEFER;
1225
1226 /* Set up certificate and key (and perhaps OCSP info) */
1227
1228 rc = tls_expand_session_files(*ctxp, cbinfo);
1229 if (rc != OK) return rc;
1230
1231 /* If we need to handle SNI, do so */
1232 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1233 if (host == NULL)               /* server */
1234   {
1235 # ifndef DISABLE_OCSP
1236   /* We check u_ocsp.server.file, not server.response, because we care about if
1237   the option exists, not what the current expansion might be, as SNI might
1238   change the certificate and OCSP file in use between now and the time the
1239   callback is invoked. */
1240   if (cbinfo->u_ocsp.server.file)
1241     {
1242     SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
1243     SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
1244     }
1245 # endif
1246   /* We always do this, so that $tls_sni is available even if not used in
1247   tls_certificate */
1248   SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1249   SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
1250   }
1251 # ifndef DISABLE_OCSP
1252 else                    /* client */
1253   if(ocsp_file)         /* wanting stapling */
1254     {
1255     if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1256       {
1257       DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1258       return FAIL;
1259       }
1260     SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1261     SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1262     }
1263 # endif
1264 #endif
1265
1266 #ifdef EXPERIMENTAL_CERTNAMES
1267 cbinfo->verify_cert_hostnames = NULL;
1268 #endif
1269
1270 /* Set up the RSA callback */
1271
1272 SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
1273
1274 /* Finally, set the timeout, and we are done */
1275
1276 SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
1277 DEBUG(D_tls) debug_printf("Initialized TLS\n");
1278
1279 *cbp = cbinfo;
1280
1281 return OK;
1282 }
1283
1284
1285
1286
1287 /*************************************************
1288 *           Get name of cipher in use            *
1289 *************************************************/
1290
1291 /*
1292 Argument:   pointer to an SSL structure for the connection
1293             buffer to use for answer
1294             size of buffer
1295             pointer to number of bits for cipher
1296 Returns:    nothing
1297 */
1298
1299 static void
1300 construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
1301 {
1302 /* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1303 yet reflect that.  It should be a safe change anyway, even 0.9.8 versions have
1304 the accessor functions use const in the prototype. */
1305 const SSL_CIPHER *c;
1306 const uschar *ver;
1307
1308 ver = (const uschar *)SSL_get_version(ssl);
1309
1310 c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
1311 SSL_CIPHER_get_bits(c, bits);
1312
1313 string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1314   SSL_CIPHER_get_name(c), *bits);
1315
1316 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1317 }
1318
1319
1320
1321
1322
1323 /*************************************************
1324 *        Set up for verifying certificates       *
1325 *************************************************/
1326
1327 /* Called by both client and server startup
1328
1329 Arguments:
1330   sctx          SSL_CTX* to initialise
1331   certs         certs file or NULL
1332   crl           CRL file or NULL
1333   host          NULL in a server; the remote host in a client
1334   optional      TRUE if called from a server for a host in tls_try_verify_hosts;
1335                 otherwise passed as FALSE
1336   cert_vfy_cb   Callback function for certificate verification
1337
1338 Returns:        OK/DEFER/FAIL
1339 */
1340
1341 static int
1342 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1343     int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
1344 {
1345 uschar *expcerts, *expcrl;
1346
1347 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1348   return DEFER;
1349
1350 if (expcerts != NULL && *expcerts != '\0')
1351   {
1352   struct stat statbuf;
1353   if (!SSL_CTX_set_default_verify_paths(sctx))
1354     return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1355
1356   if (Ustat(expcerts, &statbuf) < 0)
1357     {
1358     log_write(0, LOG_MAIN|LOG_PANIC,
1359       "failed to stat %s for certificates", expcerts);
1360     return DEFER;
1361     }
1362   else
1363     {
1364     uschar *file, *dir;
1365     if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1366       { file = NULL; dir = expcerts; }
1367     else
1368       { file = expcerts; dir = NULL; }
1369
1370     /* If a certificate file is empty, the next function fails with an
1371     unhelpful error message. If we skip it, we get the correct behaviour (no
1372     certificates are recognized, but the error message is still misleading (it
1373     says no certificate was supplied.) But this is better. */
1374
1375     if ((file == NULL || statbuf.st_size > 0) &&
1376           !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1377       return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1378
1379     /* Load the list of CAs for which we will accept certs, for sending
1380     to the client.  XXX only for file source, not dir? */
1381     if (file != NULL)
1382       {
1383       STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
1384 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
1385                                   sk_X509_NAME_num(names));
1386       SSL_CTX_set_client_CA_list(sctx, names);
1387       }
1388     }
1389
1390   /* Handle a certificate revocation list. */
1391
1392   #if OPENSSL_VERSION_NUMBER > 0x00907000L
1393
1394   /* This bit of code is now the version supplied by Lars Mainka. (I have
1395    * merely reformatted it into the Exim code style.)
1396
1397    * "From here I changed the code to add support for multiple crl's
1398    * in pem format in one file or to support hashed directory entries in
1399    * pem format instead of a file. This method now uses the library function
1400    * X509_STORE_load_locations to add the CRL location to the SSL context.
1401    * OpenSSL will then handle the verify against CA certs and CRLs by
1402    * itself in the verify callback." */
1403
1404   if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1405   if (expcrl != NULL && *expcrl != 0)
1406     {
1407     struct stat statbufcrl;
1408     if (Ustat(expcrl, &statbufcrl) < 0)
1409       {
1410       log_write(0, LOG_MAIN|LOG_PANIC,
1411         "failed to stat %s for certificates revocation lists", expcrl);
1412       return DEFER;
1413       }
1414     else
1415       {
1416       /* is it a file or directory? */
1417       uschar *file, *dir;
1418       X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
1419       if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
1420         {
1421         file = NULL;
1422         dir = expcrl;
1423         DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
1424         }
1425       else
1426         {
1427         file = expcrl;
1428         dir = NULL;
1429         DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
1430         }
1431       if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
1432         return tls_error(US"X509_STORE_load_locations", host, NULL);
1433
1434       /* setting the flags to check against the complete crl chain */
1435
1436       X509_STORE_set_flags(cvstore,
1437         X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
1438       }
1439     }
1440
1441   #endif  /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1442
1443   /* If verification is optional, don't fail if no certificate */
1444
1445   SSL_CTX_set_verify(sctx,
1446     SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
1447     cert_vfy_cb);
1448   }
1449
1450 return OK;
1451 }
1452
1453
1454
1455 /*************************************************
1456 *       Start a TLS session in a server          *
1457 *************************************************/
1458
1459 /* This is called when Exim is running as a server, after having received
1460 the STARTTLS command. It must respond to that command, and then negotiate
1461 a TLS session.
1462
1463 Arguments:
1464   require_ciphers   allowed ciphers
1465
1466 Returns:            OK on success
1467                     DEFER for errors before the start of the negotiation
1468                     FAIL for errors during the negotation; the server can't
1469                       continue running.
1470 */
1471
1472 int
1473 tls_server_start(const uschar *require_ciphers)
1474 {
1475 int rc;
1476 uschar *expciphers;
1477 tls_ext_ctx_cb *cbinfo;
1478 static uschar cipherbuf[256];
1479
1480 /* Check for previous activation */
1481
1482 if (tls_in.active >= 0)
1483   {
1484   tls_error(US"STARTTLS received after TLS started", NULL, US"");
1485   smtp_printf("554 Already in TLS\r\n");
1486   return FAIL;
1487   }
1488
1489 /* Initialize the SSL library. If it fails, it will already have logged
1490 the error. */
1491
1492 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
1493 #ifndef DISABLE_OCSP
1494     tls_ocsp_file,
1495 #endif
1496     NULL, &server_static_cbinfo);
1497 if (rc != OK) return rc;
1498 cbinfo = server_static_cbinfo;
1499
1500 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1501   return FAIL;
1502
1503 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1504 were historically separated by underscores. So that I can use either form in my
1505 tests, and also for general convenience, we turn underscores into hyphens here.
1506 */
1507
1508 if (expciphers != NULL)
1509   {
1510   uschar *s = expciphers;
1511   while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1512   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1513   if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
1514     return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
1515   cbinfo->server_cipher_list = expciphers;
1516   }
1517
1518 /* If this is a host for which certificate verification is mandatory or
1519 optional, set up appropriately. */
1520
1521 tls_in.certificate_verified = FALSE;
1522 #ifdef EXPERIMENTAL_DANE
1523 tls_in.dane_verified = FALSE;
1524 #endif
1525 server_verify_callback_called = FALSE;
1526
1527 if (verify_check_host(&tls_verify_hosts) == OK)
1528   {
1529   rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1530                         FALSE, verify_callback_server);
1531   if (rc != OK) return rc;
1532   server_verify_optional = FALSE;
1533   }
1534 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1535   {
1536   rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1537                         TRUE, verify_callback_server);
1538   if (rc != OK) return rc;
1539   server_verify_optional = TRUE;
1540   }
1541
1542 /* Prepare for new connection */
1543
1544 if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
1545
1546 /* Warning: we used to SSL_clear(ssl) here, it was removed.
1547  *
1548  * With the SSL_clear(), we get strange interoperability bugs with
1549  * OpenSSL 1.0.1b and TLS1.1/1.2.  It looks as though this may be a bug in
1550  * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1551  *
1552  * The SSL_clear() call is to let an existing SSL* be reused, typically after
1553  * session shutdown.  In this case, we have a brand new object and there's no
1554  * obvious reason to immediately clear it.  I'm guessing that this was
1555  * originally added because of incomplete initialisation which the clear fixed,
1556  * in some historic release.
1557  */
1558
1559 /* Set context and tell client to go ahead, except in the case of TLS startup
1560 on connection, where outputting anything now upsets the clients and tends to
1561 make them disconnect. We need to have an explicit fflush() here, to force out
1562 the response. Other smtp_printf() calls do not need it, because in non-TLS
1563 mode, the fflush() happens when smtp_getc() is called. */
1564
1565 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1566 if (!tls_in.on_connect)
1567   {
1568   smtp_printf("220 TLS go ahead\r\n");
1569   fflush(smtp_out);
1570   }
1571
1572 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1573 that the OpenSSL library doesn't. */
1574
1575 SSL_set_wfd(server_ssl, fileno(smtp_out));
1576 SSL_set_rfd(server_ssl, fileno(smtp_in));
1577 SSL_set_accept_state(server_ssl);
1578
1579 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1580
1581 sigalrm_seen = FALSE;
1582 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1583 rc = SSL_accept(server_ssl);
1584 alarm(0);
1585
1586 if (rc <= 0)
1587   {
1588   tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
1589   if (ERR_get_error() == 0)
1590     log_write(0, LOG_MAIN,
1591         "TLS client disconnected cleanly (rejected our certificate?)");
1592   return FAIL;
1593   }
1594
1595 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1596
1597 /* TLS has been set up. Adjust the input functions to read via TLS,
1598 and initialize things. */
1599
1600 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1601 tls_in.cipher = cipherbuf;
1602
1603 DEBUG(D_tls)
1604   {
1605   uschar buf[2048];
1606   if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
1607     debug_printf("Shared ciphers: %s\n", buf);
1608   }
1609
1610 /* Record the certificate we presented */
1611   {
1612   X509 * crt = SSL_get_certificate(server_ssl);
1613   tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1614   }
1615
1616 /* Only used by the server-side tls (tls_in), including tls_getc.
1617    Client-side (tls_out) reads (seem to?) go via
1618    smtp_read_response()/ip_recv().
1619    Hence no need to duplicate for _in and _out.
1620  */
1621 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1622 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1623 ssl_xfer_eof = ssl_xfer_error = 0;
1624
1625 receive_getc = tls_getc;
1626 receive_ungetc = tls_ungetc;
1627 receive_feof = tls_feof;
1628 receive_ferror = tls_ferror;
1629 receive_smtp_buffered = tls_smtp_buffered;
1630
1631 tls_in.active = fileno(smtp_out);
1632 return OK;
1633 }
1634
1635
1636
1637
1638 static int
1639 tls_client_basic_ctx_init(SSL_CTX * ctx,
1640     host_item * host, smtp_transport_options_block * ob
1641 #ifdef EXPERIMENTAL_CERTNAMES
1642     , tls_ext_ctx_cb * cbinfo
1643 #endif
1644                           )
1645 {
1646 int rc;
1647 /* stick to the old behaviour for compatibility if tls_verify_certificates is
1648    set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1649    the specified host patterns if one of them is defined */
1650
1651 if ((!ob->tls_verify_hosts && !ob->tls_try_verify_hosts) ||
1652     (verify_check_host(&ob->tls_verify_hosts) == OK))
1653   {
1654   if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1655         ob->tls_crl, host, FALSE, verify_callback_client)) != OK)
1656     return rc;
1657   client_verify_optional = FALSE;
1658
1659 #ifdef EXPERIMENTAL_CERTNAMES
1660   if (ob->tls_verify_cert_hostnames)
1661     {
1662     if (!expand_check(ob->tls_verify_cert_hostnames,
1663                       US"tls_verify_cert_hostnames",
1664                       &cbinfo->verify_cert_hostnames))
1665       return FAIL;
1666     if (cbinfo->verify_cert_hostnames)
1667       DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1668                       cbinfo->verify_cert_hostnames);
1669     }
1670 #endif
1671   }
1672 else if (verify_check_host(&ob->tls_try_verify_hosts) == OK)
1673   {
1674   if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1675         ob->tls_crl, host, TRUE, verify_callback_client)) != OK)
1676     return rc;
1677   client_verify_optional = TRUE;
1678   }
1679
1680 return OK;
1681 }
1682
1683
1684 #ifdef EXPERIMENTAL_DANE
1685 static int
1686 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
1687 {
1688 dns_record * rr;
1689 dns_scan dnss;
1690 const char * hostnames[2] = { CS host->name, NULL };
1691 int found = 0;
1692
1693 if (DANESSL_init(ssl, NULL, hostnames) != 1)
1694   return tls_error(US"hostnames load", host, NULL);
1695
1696 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1697      rr;
1698      rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1699     ) if (rr->type == T_TLSA)
1700   {
1701   uschar * p = rr->data;
1702   uint8_t usage, selector, mtype;
1703   const char * mdname;
1704
1705   found++;
1706   usage = *p++;
1707   selector = *p++;
1708   mtype = *p++;
1709
1710   switch (mtype)
1711     {
1712     default:
1713       log_write(0, LOG_MAIN,
1714                 "DANE error: TLSA record w/bad mtype 0x%x", mtype);
1715       return FAIL;
1716     case 0:     mdname = NULL; break;
1717     case 1:     mdname = "sha256"; break;
1718     case 2:     mdname = "sha512"; break;
1719     }
1720
1721   switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
1722     {
1723     default:
1724     case 0:     /* action not taken */
1725       return tls_error(US"tlsa load", host, NULL);
1726     case 1:     break;
1727     }
1728
1729   tls_out.tlsa_usage |= 1<<usage;
1730   }
1731
1732 if (found)
1733   return OK;
1734
1735 log_write(0, LOG_MAIN, "DANE error: No TLSA records");
1736 return FAIL;
1737 }
1738 #endif  /*EXPERIMENTAL_DANE*/
1739
1740
1741
1742 /*************************************************
1743 *    Start a TLS session in a client             *
1744 *************************************************/
1745
1746 /* Called from the smtp transport after STARTTLS has been accepted.
1747
1748 Argument:
1749   fd               the fd of the connection
1750   host             connected host (for messages)
1751   addr             the first address
1752   tb               transport (always smtp)
1753   tlsa_dnsa        tlsa lookup, if DANE, else null
1754
1755 Returns:           OK on success
1756                    FAIL otherwise - note that tls_error() will not give DEFER
1757                      because this is not a server
1758 */
1759
1760 int
1761 tls_client_start(int fd, host_item *host, address_item *addr,
1762   transport_instance *tb
1763 #ifdef EXPERIMENTAL_DANE
1764   , dns_answer * tlsa_dnsa
1765 #endif
1766   )
1767 {
1768 smtp_transport_options_block * ob =
1769   (smtp_transport_options_block *)tb->options_block;
1770 static uschar txt[256];
1771 uschar * expciphers;
1772 X509 * server_cert;
1773 int rc;
1774 static uschar cipherbuf[256];
1775
1776 #ifndef DISABLE_OCSP
1777 BOOL request_ocsp = FALSE;
1778 BOOL require_ocsp = FALSE;
1779 #endif
1780
1781 #ifdef EXPERIMENTAL_DANE
1782 tls_out.tlsa_usage = 0;
1783 #endif
1784
1785 #ifndef DISABLE_OCSP
1786   {
1787   if ((require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1788     NULL, host->name, host->address, NULL) == OK))
1789     request_ocsp = TRUE;
1790   else
1791     {
1792 # ifdef EXPERIMENTAL_DANE
1793     if (  tlsa_dnsa
1794        && ob->hosts_request_ocsp[0] == '*'
1795        && ob->hosts_request_ocsp[1] == '\0'
1796        )
1797       {
1798       /* Unchanged from default.  Use a safer one under DANE */
1799       request_ocsp = TRUE;
1800       ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
1801                                         "   {= {4}{$tls_out_tlsa_usage}} } "
1802                                    " {*}{}}";
1803       }
1804     else
1805 # endif
1806       request_ocsp = verify_check_this_host(&ob->hosts_request_ocsp,
1807           NULL, host->name, host->address, NULL) == OK;
1808     }
1809   }
1810 #endif
1811
1812 rc = tls_init(&client_ctx, host, NULL,
1813     ob->tls_certificate, ob->tls_privatekey,
1814 #ifndef DISABLE_OCSP
1815     (void *)(long)request_ocsp,
1816 #endif
1817     addr, &client_static_cbinfo);
1818 if (rc != OK) return rc;
1819
1820 tls_out.certificate_verified = FALSE;
1821 client_verify_callback_called = FALSE;
1822
1823 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
1824     &expciphers))
1825   return FAIL;
1826
1827 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1828 are separated by underscores. So that I can use either form in my tests, and
1829 also for general convenience, we turn underscores into hyphens here. */
1830
1831 if (expciphers != NULL)
1832   {
1833   uschar *s = expciphers;
1834   while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1835   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1836   if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
1837     return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
1838   }
1839
1840 #ifdef EXPERIMENTAL_DANE
1841 if (tlsa_dnsa)
1842   {
1843   SSL_CTX_set_verify(client_ctx, SSL_VERIFY_PEER, verify_callback_client_dane);
1844
1845   if (!DANESSL_library_init())
1846     return tls_error(US"library init", host, NULL);
1847   if (DANESSL_CTX_init(client_ctx) <= 0)
1848     return tls_error(US"context init", host, NULL);
1849   }
1850 else
1851
1852 #endif
1853
1854   if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob
1855 #ifdef EXPERIMENTAL_CERTNAMES
1856                                 , client_static_cbinfo
1857 #endif
1858                                 )) != OK)
1859     return rc;
1860
1861 if ((client_ssl = SSL_new(client_ctx)) == NULL)
1862   return tls_error(US"SSL_new", host, NULL);
1863 SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1864 SSL_set_fd(client_ssl, fd);
1865 SSL_set_connect_state(client_ssl);
1866
1867 if (ob->tls_sni)
1868   {
1869   if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
1870     return FAIL;
1871   if (tls_out.sni == NULL)
1872     {
1873     DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1874     }
1875   else if (!Ustrlen(tls_out.sni))
1876     tls_out.sni = NULL;
1877   else
1878     {
1879 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1880     DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1881     SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
1882 #else
1883     DEBUG(D_tls)
1884       debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
1885           tls_out.sni);
1886 #endif
1887     }
1888   }
1889
1890 #ifdef EXPERIMENTAL_DANE
1891 if (tlsa_dnsa)
1892   if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa)) != OK)
1893     return rc;
1894 #endif
1895
1896 #ifndef DISABLE_OCSP
1897 /* Request certificate status at connection-time.  If the server
1898 does OCSP stapling we will get the callback (set in tls_init()) */
1899 # ifdef EXPERIMENTAL_DANE
1900 if (request_ocsp)
1901   {
1902   const uschar * s;
1903   if (  ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
1904      || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
1905      )
1906     {   /* Re-eval now $tls_out_tlsa_usage is populated.  If
1907         this means we avoid the OCSP request, we wasted the setup
1908         cost in tls_init(). */
1909     require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1910       NULL, host->name, host->address, NULL) == OK;
1911     request_ocsp = require_ocsp ? TRUE
1912       : verify_check_this_host(&ob->hosts_request_ocsp,
1913           NULL, host->name, host->address, NULL) == OK;
1914     }
1915   }
1916 # endif
1917
1918 if (request_ocsp)
1919   {
1920   SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
1921   client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
1922   tls_out.ocsp = OCSP_NOT_RESP;
1923   }
1924 #endif
1925
1926 #ifdef EXPERIMENTAL_TPDA
1927 client_static_cbinfo->event_action = tb->tpda_event_action;
1928 #endif
1929
1930 /* There doesn't seem to be a built-in timeout on connection. */
1931
1932 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1933 sigalrm_seen = FALSE;
1934 alarm(ob->command_timeout);
1935 rc = SSL_connect(client_ssl);
1936 alarm(0);
1937
1938 #ifdef EXPERIMENTAL_DANE
1939 if (tlsa_dnsa)
1940   DANESSL_cleanup(client_ssl);
1941 #endif
1942
1943 if (rc <= 0)
1944   return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
1945
1946 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
1947
1948 /* Beware anonymous ciphers which lead to server_cert being NULL */
1949 /*XXX server_cert is never freed... use X509_free() */
1950 server_cert = SSL_get_peer_certificate (client_ssl);
1951 if (server_cert)
1952   {
1953   tls_out.peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
1954     CS txt, sizeof(txt));
1955   tls_out.peerdn = txt;         /*XXX a static buffer... */
1956   }
1957 else
1958   tls_out.peerdn = NULL;
1959
1960 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
1961 tls_out.cipher = cipherbuf;
1962
1963 /* Record the certificate we presented */
1964   {
1965   X509 * crt = SSL_get_certificate(client_ssl);
1966   tls_out.ourcert = crt ? X509_dup(crt) : NULL;
1967   }
1968
1969 tls_out.active = fd;
1970 return OK;
1971 }
1972
1973
1974
1975
1976
1977 /*************************************************
1978 *            TLS version of getc                 *
1979 *************************************************/
1980
1981 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
1982 it refills the buffer via the SSL reading function.
1983
1984 Arguments:  none
1985 Returns:    the next character or EOF
1986
1987 Only used by the server-side TLS.
1988 */
1989
1990 int
1991 tls_getc(void)
1992 {
1993 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
1994   {
1995   int error;
1996   int inbytes;
1997
1998   DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
1999     ssl_xfer_buffer, ssl_xfer_buffer_size);
2000
2001   if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2002   inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
2003   error = SSL_get_error(server_ssl, inbytes);
2004   alarm(0);
2005
2006   /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2007   closed down, not that the socket itself has been closed down. Revert to
2008   non-SSL handling. */
2009
2010   if (error == SSL_ERROR_ZERO_RETURN)
2011     {
2012     DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2013
2014     receive_getc = smtp_getc;
2015     receive_ungetc = smtp_ungetc;
2016     receive_feof = smtp_feof;
2017     receive_ferror = smtp_ferror;
2018     receive_smtp_buffered = smtp_buffered;
2019
2020     SSL_free(server_ssl);
2021     server_ssl = NULL;
2022     tls_in.active = -1;
2023     tls_in.bits = 0;
2024     tls_in.cipher = NULL;
2025     tls_in.peerdn = NULL;
2026     tls_in.sni = NULL;
2027
2028     return smtp_getc();
2029     }
2030
2031   /* Handle genuine errors */
2032
2033   else if (error == SSL_ERROR_SSL)
2034     {
2035     ERR_error_string(ERR_get_error(), ssl_errstring);
2036     log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
2037     ssl_xfer_error = 1;
2038     return EOF;
2039     }
2040
2041   else if (error != SSL_ERROR_NONE)
2042     {
2043     DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2044     ssl_xfer_error = 1;
2045     return EOF;
2046     }
2047
2048 #ifndef DISABLE_DKIM
2049   dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2050 #endif
2051   ssl_xfer_buffer_hwm = inbytes;
2052   ssl_xfer_buffer_lwm = 0;
2053   }
2054
2055 /* Something in the buffer; return next uschar */
2056
2057 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2058 }
2059
2060
2061
2062 /*************************************************
2063 *          Read bytes from TLS channel           *
2064 *************************************************/
2065
2066 /*
2067 Arguments:
2068   buff      buffer of data
2069   len       size of buffer
2070
2071 Returns:    the number of bytes read
2072             -1 after a failed read
2073
2074 Only used by the client-side TLS.
2075 */
2076
2077 int
2078 tls_read(BOOL is_server, uschar *buff, size_t len)
2079 {
2080 SSL *ssl = is_server ? server_ssl : client_ssl;
2081 int inbytes;
2082 int error;
2083
2084 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
2085   buff, (unsigned int)len);
2086
2087 inbytes = SSL_read(ssl, CS buff, len);
2088 error = SSL_get_error(ssl, inbytes);
2089
2090 if (error == SSL_ERROR_ZERO_RETURN)
2091   {
2092   DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2093   return -1;
2094   }
2095 else if (error != SSL_ERROR_NONE)
2096   {
2097   return -1;
2098   }
2099
2100 return inbytes;
2101 }
2102
2103
2104
2105
2106
2107 /*************************************************
2108 *         Write bytes down TLS channel           *
2109 *************************************************/
2110
2111 /*
2112 Arguments:
2113   is_server channel specifier
2114   buff      buffer of data
2115   len       number of bytes
2116
2117 Returns:    the number of bytes after a successful write,
2118             -1 after a failed write
2119
2120 Used by both server-side and client-side TLS.
2121 */
2122
2123 int
2124 tls_write(BOOL is_server, const uschar *buff, size_t len)
2125 {
2126 int outbytes;
2127 int error;
2128 int left = len;
2129 SSL *ssl = is_server ? server_ssl : client_ssl;
2130
2131 DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
2132 while (left > 0)
2133   {
2134   DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
2135   outbytes = SSL_write(ssl, CS buff, left);
2136   error = SSL_get_error(ssl, outbytes);
2137   DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2138   switch (error)
2139     {
2140     case SSL_ERROR_SSL:
2141     ERR_error_string(ERR_get_error(), ssl_errstring);
2142     log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2143     return -1;
2144
2145     case SSL_ERROR_NONE:
2146     left -= outbytes;
2147     buff += outbytes;
2148     break;
2149
2150     case SSL_ERROR_ZERO_RETURN:
2151     log_write(0, LOG_MAIN, "SSL channel closed on write");
2152     return -1;
2153
2154     case SSL_ERROR_SYSCALL:
2155     log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2156       sender_fullhost ? sender_fullhost : US"<unknown>",
2157       strerror(errno));
2158
2159     default:
2160     log_write(0, LOG_MAIN, "SSL_write error %d", error);
2161     return -1;
2162     }
2163   }
2164 return len;
2165 }
2166
2167
2168
2169 /*************************************************
2170 *         Close down a TLS session               *
2171 *************************************************/
2172
2173 /* This is also called from within a delivery subprocess forked from the
2174 daemon, to shut down the TLS library, without actually doing a shutdown (which
2175 would tamper with the SSL session in the parent process).
2176
2177 Arguments:   TRUE if SSL_shutdown is to be called
2178 Returns:     nothing
2179
2180 Used by both server-side and client-side TLS.
2181 */
2182
2183 void
2184 tls_close(BOOL is_server, BOOL shutdown)
2185 {
2186 SSL **sslp = is_server ? &server_ssl : &client_ssl;
2187 int *fdp = is_server ? &tls_in.active : &tls_out.active;
2188
2189 if (*fdp < 0) return;  /* TLS was not active */
2190
2191 if (shutdown)
2192   {
2193   DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
2194   SSL_shutdown(*sslp);
2195   }
2196
2197 SSL_free(*sslp);
2198 *sslp = NULL;
2199
2200 *fdp = -1;
2201 }
2202
2203
2204
2205
2206 /*************************************************
2207 *  Let tls_require_ciphers be checked at startup *
2208 *************************************************/
2209
2210 /* The tls_require_ciphers option, if set, must be something which the
2211 library can parse.
2212
2213 Returns:     NULL on success, or error message
2214 */
2215
2216 uschar *
2217 tls_validate_require_cipher(void)
2218 {
2219 SSL_CTX *ctx;
2220 uschar *s, *expciphers, *err;
2221
2222 /* this duplicates from tls_init(), we need a better "init just global
2223 state, for no specific purpose" singleton function of our own */
2224
2225 SSL_load_error_strings();
2226 OpenSSL_add_ssl_algorithms();
2227 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2228 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2229 list of available digests. */
2230 EVP_add_digest(EVP_sha256());
2231 #endif
2232
2233 if (!(tls_require_ciphers && *tls_require_ciphers))
2234   return NULL;
2235
2236 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2237   return US"failed to expand tls_require_ciphers";
2238
2239 if (!(expciphers && *expciphers))
2240   return NULL;
2241
2242 /* normalisation ripped from above */
2243 s = expciphers;
2244 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2245
2246 err = NULL;
2247
2248 ctx = SSL_CTX_new(SSLv23_server_method());
2249 if (!ctx)
2250   {
2251   ERR_error_string(ERR_get_error(), ssl_errstring);
2252   return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2253   }
2254
2255 DEBUG(D_tls)
2256   debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2257
2258 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2259   {
2260   ERR_error_string(ERR_get_error(), ssl_errstring);
2261   err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2262   }
2263
2264 SSL_CTX_free(ctx);
2265
2266 return err;
2267 }
2268
2269
2270
2271
2272 /*************************************************
2273 *         Report the library versions.           *
2274 *************************************************/
2275
2276 /* There have historically been some issues with binary compatibility in
2277 OpenSSL libraries; if Exim (like many other applications) is built against
2278 one version of OpenSSL but the run-time linker picks up another version,
2279 it can result in serious failures, including crashing with a SIGSEGV.  So
2280 report the version found by the compiler and the run-time version.
2281
2282 Note: some OS vendors backport security fixes without changing the version
2283 number/string, and the version date remains unchanged.  The _build_ date
2284 will change, so we can more usefully assist with version diagnosis by also
2285 reporting the build date.
2286
2287 Arguments:   a FILE* to print the results to
2288 Returns:     nothing
2289 */
2290
2291 void
2292 tls_version_report(FILE *f)
2293 {
2294 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
2295            "                          Runtime: %s\n"
2296            "                                 : %s\n",
2297            OPENSSL_VERSION_TEXT,
2298            SSLeay_version(SSLEAY_VERSION),
2299            SSLeay_version(SSLEAY_BUILT_ON));
2300 /* third line is 38 characters for the %s and the line is 73 chars long;
2301 the OpenSSL output includes a "built on: " prefix already. */
2302 }
2303
2304
2305
2306
2307 /*************************************************
2308 *            Random number generation            *
2309 *************************************************/
2310
2311 /* Pseudo-random number generation.  The result is not expected to be
2312 cryptographically strong but not so weak that someone will shoot themselves
2313 in the foot using it as a nonce in input in some email header scheme or
2314 whatever weirdness they'll twist this into.  The result should handle fork()
2315 and avoid repeating sequences.  OpenSSL handles that for us.
2316
2317 Arguments:
2318   max       range maximum
2319 Returns     a random number in range [0, max-1]
2320 */
2321
2322 int
2323 vaguely_random_number(int max)
2324 {
2325 unsigned int r;
2326 int i, needed_len;
2327 static pid_t pidlast = 0;
2328 pid_t pidnow;
2329 uschar *p;
2330 uschar smallbuf[sizeof(r)];
2331
2332 if (max <= 1)
2333   return 0;
2334
2335 pidnow = getpid();
2336 if (pidnow != pidlast)
2337   {
2338   /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2339   is unique for each thread", this doesn't apparently apply across processes,
2340   so our own warning from vaguely_random_number_fallback() applies here too.
2341   Fix per PostgreSQL. */
2342   if (pidlast != 0)
2343     RAND_cleanup();
2344   pidlast = pidnow;
2345   }
2346
2347 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2348 if (!RAND_status())
2349   {
2350   randstuff r;
2351   gettimeofday(&r.tv, NULL);
2352   r.p = getpid();
2353
2354   RAND_seed((uschar *)(&r), sizeof(r));
2355   }
2356 /* We're after pseudo-random, not random; if we still don't have enough data
2357 in the internal PRNG then our options are limited.  We could sleep and hope
2358 for entropy to come along (prayer technique) but if the system is so depleted
2359 in the first place then something is likely to just keep taking it.  Instead,
2360 we'll just take whatever little bit of pseudo-random we can still manage to
2361 get. */
2362
2363 needed_len = sizeof(r);
2364 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2365 asked for a number less than 10. */
2366 for (r = max, i = 0; r; ++i)
2367   r >>= 1;
2368 i = (i + 7) / 8;
2369 if (i < needed_len)
2370   needed_len = i;
2371
2372 /* We do not care if crypto-strong */
2373 i = RAND_pseudo_bytes(smallbuf, needed_len);
2374 if (i < 0)
2375   {
2376   DEBUG(D_all)
2377     debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2378   return vaguely_random_number_fallback(max);
2379   }
2380
2381 r = 0;
2382 for (p = smallbuf; needed_len; --needed_len, ++p)
2383   {
2384   r *= 256;
2385   r += *p;
2386   }
2387
2388 /* We don't particularly care about weighted results; if someone wants
2389 smooth distribution and cares enough then they should submit a patch then. */
2390 return r % max;
2391 }
2392
2393
2394
2395
2396 /*************************************************
2397 *        OpenSSL option parse                    *
2398 *************************************************/
2399
2400 /* Parse one option for tls_openssl_options_parse below
2401
2402 Arguments:
2403   name    one option name
2404   value   place to store a value for it
2405 Returns   success or failure in parsing
2406 */
2407
2408 struct exim_openssl_option {
2409   uschar *name;
2410   long    value;
2411 };
2412 /* We could use a macro to expand, but we need the ifdef and not all the
2413 options document which version they were introduced in.  Policylet: include
2414 all options unless explicitly for DTLS, let the administrator choose which
2415 to apply.
2416
2417 This list is current as of:
2418   ==>  1.0.1b  <==
2419 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2420 */
2421 static struct exim_openssl_option exim_openssl_options[] = {
2422 /* KEEP SORTED ALPHABETICALLY! */
2423 #ifdef SSL_OP_ALL
2424   { US"all", SSL_OP_ALL },
2425 #endif
2426 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
2427   { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
2428 #endif
2429 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
2430   { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
2431 #endif
2432 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
2433   { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
2434 #endif
2435 #ifdef SSL_OP_EPHEMERAL_RSA
2436   { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
2437 #endif
2438 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
2439   { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
2440 #endif
2441 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
2442   { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
2443 #endif
2444 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
2445   { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
2446 #endif
2447 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
2448   { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
2449 #endif
2450 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
2451   { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
2452 #endif
2453 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
2454   { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
2455 #endif
2456 #ifdef SSL_OP_NO_COMPRESSION
2457   { US"no_compression", SSL_OP_NO_COMPRESSION },
2458 #endif
2459 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2460   { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
2461 #endif
2462 #ifdef SSL_OP_NO_SSLv2
2463   { US"no_sslv2", SSL_OP_NO_SSLv2 },
2464 #endif
2465 #ifdef SSL_OP_NO_SSLv3
2466   { US"no_sslv3", SSL_OP_NO_SSLv3 },
2467 #endif
2468 #ifdef SSL_OP_NO_TICKET
2469   { US"no_ticket", SSL_OP_NO_TICKET },
2470 #endif
2471 #ifdef SSL_OP_NO_TLSv1
2472   { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2473 #endif
2474 #ifdef SSL_OP_NO_TLSv1_1
2475 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
2476   /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2477 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2478 #else
2479   { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2480 #endif
2481 #endif
2482 #ifdef SSL_OP_NO_TLSv1_2
2483   { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2484 #endif
2485 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2486   { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2487 #endif
2488 #ifdef SSL_OP_SINGLE_DH_USE
2489   { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
2490 #endif
2491 #ifdef SSL_OP_SINGLE_ECDH_USE
2492   { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
2493 #endif
2494 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
2495   { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
2496 #endif
2497 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
2498   { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
2499 #endif
2500 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
2501   { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
2502 #endif
2503 #ifdef SSL_OP_TLS_D5_BUG
2504   { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
2505 #endif
2506 #ifdef SSL_OP_TLS_ROLLBACK_BUG
2507   { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
2508 #endif
2509 };
2510 static int exim_openssl_options_size =
2511   sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2512
2513
2514 static BOOL
2515 tls_openssl_one_option_parse(uschar *name, long *value)
2516 {
2517 int first = 0;
2518 int last = exim_openssl_options_size;
2519 while (last > first)
2520   {
2521   int middle = (first + last)/2;
2522   int c = Ustrcmp(name, exim_openssl_options[middle].name);
2523   if (c == 0)
2524     {
2525     *value = exim_openssl_options[middle].value;
2526     return TRUE;
2527     }
2528   else if (c > 0)
2529     first = middle + 1;
2530   else
2531     last = middle;
2532   }
2533 return FALSE;
2534 }
2535
2536
2537
2538
2539 /*************************************************
2540 *        OpenSSL option parsing logic            *
2541 *************************************************/
2542
2543 /* OpenSSL has a number of compatibility options which an administrator might
2544 reasonably wish to set.  Interpret a list similarly to decode_bits(), so that
2545 we look like log_selector.
2546
2547 Arguments:
2548   option_spec  the administrator-supplied string of options
2549   results      ptr to long storage for the options bitmap
2550 Returns        success or failure
2551 */
2552
2553 BOOL
2554 tls_openssl_options_parse(uschar *option_spec, long *results)
2555 {
2556 long result, item;
2557 uschar *s, *end;
2558 uschar keep_c;
2559 BOOL adding, item_parsed;
2560
2561 result = 0L;
2562 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
2563  * from default because it increases BEAST susceptibility. */
2564 #ifdef SSL_OP_NO_SSLv2
2565 result |= SSL_OP_NO_SSLv2;
2566 #endif
2567
2568 if (option_spec == NULL)
2569   {
2570   *results = result;
2571   return TRUE;
2572   }
2573
2574 for (s=option_spec; *s != '\0'; /**/)
2575   {
2576   while (isspace(*s)) ++s;
2577   if (*s == '\0')
2578     break;
2579   if (*s != '+' && *s != '-')
2580     {
2581     DEBUG(D_tls) debug_printf("malformed openssl option setting: "
2582         "+ or - expected but found \"%s\"\n", s);
2583     return FALSE;
2584     }
2585   adding = *s++ == '+';
2586   for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2587   keep_c = *end;
2588   *end = '\0';
2589   item_parsed = tls_openssl_one_option_parse(s, &item);
2590   if (!item_parsed)
2591     {
2592     DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
2593     return FALSE;
2594     }
2595   DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2596       adding ? "adding" : "removing", result, item, s);
2597   if (adding)
2598     result |= item;
2599   else
2600     result &= ~item;
2601   *end = keep_c;
2602   s = end;
2603   }
2604
2605 *results = result;
2606 return TRUE;
2607 }
2608
2609 /* vi: aw ai sw=2
2610 */
2611 /* End of tls-openssl.c */