tidying
[exim.git] / src / src / tls-openssl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2012 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Portions Copyright (c) The OpenSSL Project 1999 */
9
10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11 library. It is #included into the tls.c file when that library is used. The
12 code herein is based on a patch that was originally contributed by Steve
13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15 No cryptographic code is included in Exim. All this module does is to call
16 functions from the OpenSSL library. */
17
18
19 /* Heading stuff */
20
21 #include <openssl/lhash.h>
22 #include <openssl/ssl.h>
23 #include <openssl/err.h>
24 #include <openssl/rand.h>
25 #ifdef EXPERIMENTAL_OCSP
26 #include <openssl/ocsp.h>
27 #endif
28
29 #ifdef EXPERIMENTAL_OCSP
30 #define EXIM_OCSP_SKEW_SECONDS (300L)
31 #define EXIM_OCSP_MAX_AGE (-1L)
32 #endif
33
34 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
35 #define EXIM_HAVE_OPENSSL_TLSEXT
36 #endif
37
38 /* Structure for collecting random data for seeding. */
39
40 typedef struct randstuff {
41 struct timeval tv;
42 pid_t p;
43 } randstuff;
44
45 /* Local static variables */
46
47 static BOOL client_verify_callback_called = FALSE;
48 static BOOL server_verify_callback_called = FALSE;
49 static const uschar *sid_ctx = US"exim";
50
51 /* We have three different contexts to care about.
52
53 Simple case: client, `client_ctx`
54 As a client, we can be doing a callout or cut-through delivery while receiving
55 a message. So we have a client context, which should have options initialised
56 from the SMTP Transport.
57
58 Server:
59 There are two cases: with and without ServerNameIndication from the client.
60 Given TLS SNI, we can be using different keys, certs and various other
61 configuration settings, because they're re-expanded with $tls_sni set. This
62 allows vhosting with TLS. This SNI is sent in the handshake.
63 A client might not send SNI, so we need a fallback, and an initial setup too.
64 So as a server, we start out using `server_ctx`.
65 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
66 `server_sni` from `server_ctx` and then initialise settings by re-expanding
67 configuration.
68 */
69
70 static SSL_CTX *client_ctx = NULL;
71 static SSL_CTX *server_ctx = NULL;
72 static SSL *client_ssl = NULL;
73 static SSL *server_ssl = NULL;
74
75 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
76 static SSL_CTX *server_sni = NULL;
77 #endif
78
79 static char ssl_errstring[256];
80
81 static int ssl_session_timeout = 200;
82 static BOOL client_verify_optional = FALSE;
83 static BOOL server_verify_optional = FALSE;
84
85 static BOOL reexpand_tls_files_for_sni = FALSE;
86
87
88 typedef struct tls_ext_ctx_cb {
89 uschar *certificate;
90 uschar *privatekey;
91 #ifdef EXPERIMENTAL_OCSP
92 BOOL is_server;
93 union {
94 struct {
95 uschar *file;
96 uschar *file_expanded;
97 OCSP_RESPONSE *response;
98 } server;
99 struct {
100 X509_STORE *verify_store;
101 } client;
102 } u_ocsp;
103 #endif
104 uschar *dhparam;
105 /* these are cached from first expand */
106 uschar *server_cipher_list;
107 /* only passed down to tls_error: */
108 host_item *host;
109 } tls_ext_ctx_cb;
110
111 /* should figure out a cleanup of API to handle state preserved per
112 implementation, for various reasons, which can be void * in the APIs.
113 For now, we hack around it. */
114 tls_ext_ctx_cb *client_static_cbinfo = NULL;
115 tls_ext_ctx_cb *server_static_cbinfo = NULL;
116
117 static int
118 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
119 int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
120
121 /* Callbacks */
122 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
123 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
124 #endif
125 #ifdef EXPERIMENTAL_OCSP
126 static int tls_server_stapling_cb(SSL *s, void *arg);
127 #endif
128
129
130 /*************************************************
131 * Handle TLS error *
132 *************************************************/
133
134 /* Called from lots of places when errors occur before actually starting to do
135 the TLS handshake, that is, while the session is still in clear. Always returns
136 DEFER for a server and FAIL for a client so that most calls can use "return
137 tls_error(...)" to do this processing and then give an appropriate return. A
138 single function is used for both server and client, because it is called from
139 some shared functions.
140
141 Argument:
142 prefix text to include in the logged error
143 host NULL if setting up a server;
144 the connected host if setting up a client
145 msg error message or NULL if we should ask OpenSSL
146
147 Returns: OK/DEFER/FAIL
148 */
149
150 static int
151 tls_error(uschar *prefix, host_item *host, uschar *msg)
152 {
153 if (msg == NULL)
154 {
155 ERR_error_string(ERR_get_error(), ssl_errstring);
156 msg = (uschar *)ssl_errstring;
157 }
158
159 if (host == NULL)
160 {
161 uschar *conn_info = smtp_get_connection_info();
162 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
163 conn_info += 5;
164 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
165 conn_info, prefix, msg);
166 return DEFER;
167 }
168 else
169 {
170 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s): %s",
171 host->name, host->address, prefix, msg);
172 return FAIL;
173 }
174 }
175
176
177
178 /*************************************************
179 * Callback to generate RSA key *
180 *************************************************/
181
182 /*
183 Arguments:
184 s SSL connection
185 export not used
186 keylength keylength
187
188 Returns: pointer to generated key
189 */
190
191 static RSA *
192 rsa_callback(SSL *s, int export, int keylength)
193 {
194 RSA *rsa_key;
195 export = export; /* Shut picky compilers up */
196 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
197 rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
198 if (rsa_key == NULL)
199 {
200 ERR_error_string(ERR_get_error(), ssl_errstring);
201 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
202 ssl_errstring);
203 return NULL;
204 }
205 return rsa_key;
206 }
207
208
209
210 /* Extreme debug
211 #if defined(EXPERIMENTAL_OCSP)
212 void
213 x509_store_dump_cert_s_names(X509_STORE * store)
214 {
215 STACK_OF(X509_OBJECT) * roots= store->objs;
216 int i;
217 static uschar name[256];
218
219 for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
220 {
221 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
222 if(tmp_obj->type == X509_LU_X509)
223 {
224 X509 * current_cert= tmp_obj->data.x509;
225 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
226 debug_printf(" %s\n", name);
227 }
228 }
229 }
230 #endif
231 */
232
233
234 /*************************************************
235 * Callback for verification *
236 *************************************************/
237
238 /* The SSL library does certificate verification if set up to do so. This
239 callback has the current yes/no state is in "state". If verification succeeded,
240 we set up the tls_peerdn string. If verification failed, what happens depends
241 on whether the client is required to present a verifiable certificate or not.
242
243 If verification is optional, we change the state to yes, but still log the
244 verification error. For some reason (it really would help to have proper
245 documentation of OpenSSL), this callback function then gets called again, this
246 time with state = 1. In fact, that's useful, because we can set up the peerdn
247 value, but we must take care not to set the private verified flag on the second
248 time through.
249
250 Note: this function is not called if the client fails to present a certificate
251 when asked. We get here only if a certificate has been received. Handling of
252 optional verification for this case is done when requesting SSL to verify, by
253 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
254
255 Arguments:
256 state current yes/no state as 1/0
257 x509ctx certificate information.
258 client TRUE for client startup, FALSE for server startup
259
260 Returns: 1 if verified, 0 if not
261 */
262
263 static int
264 verify_callback(int state, X509_STORE_CTX *x509ctx, tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
265 {
266 static uschar txt[256];
267
268 X509_NAME_oneline(X509_get_subject_name(x509ctx->current_cert),
269 CS txt, sizeof(txt));
270
271 if (state == 0)
272 {
273 log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
274 x509ctx->error_depth,
275 X509_verify_cert_error_string(x509ctx->error),
276 txt);
277 tlsp->certificate_verified = FALSE;
278 *calledp = TRUE;
279 if (!*optionalp) return 0; /* reject */
280 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
281 "tls_try_verify_hosts)\n");
282 return 1; /* accept */
283 }
284
285 if (x509ctx->error_depth != 0)
286 {
287 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d cert=%s\n",
288 x509ctx->error_depth, txt);
289 #ifdef EXPERIMENTAL_OCSP
290 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
291 { /* client, wanting stapling */
292 /* Add the server cert's signing chain as the one
293 for the verification of the OCSP stapled information. */
294
295 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
296 x509ctx->current_cert))
297 ERR_clear_error();
298 }
299 #endif
300 }
301 else
302 {
303 DEBUG(D_tls) debug_printf("SSL%s peer: %s\n",
304 *calledp ? "" : " authenticated", txt);
305 tlsp->peerdn = txt;
306 }
307
308 /*XXX JGH: this looks bogus - we set "verified" first time through, which
309 will be for the root CS cert (calls work down the chain). Why should it
310 not be on the last call, where we're setting peerdn?
311
312 To test: set up a chain anchored by a good root-CA but with a bad server cert.
313 Does certificate_verified get set?
314 */
315 if (!*calledp) tlsp->certificate_verified = TRUE;
316 *calledp = TRUE;
317
318 return 1; /* accept */
319 }
320
321 static int
322 verify_callback_client(int state, X509_STORE_CTX *x509ctx)
323 {
324 return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
325 }
326
327 static int
328 verify_callback_server(int state, X509_STORE_CTX *x509ctx)
329 {
330 return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
331 }
332
333
334
335 /*************************************************
336 * Information callback *
337 *************************************************/
338
339 /* The SSL library functions call this from time to time to indicate what they
340 are doing. We copy the string to the debugging output when TLS debugging has
341 been requested.
342
343 Arguments:
344 s the SSL connection
345 where
346 ret
347
348 Returns: nothing
349 */
350
351 static void
352 info_callback(SSL *s, int where, int ret)
353 {
354 where = where;
355 ret = ret;
356 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
357 }
358
359
360
361 /*************************************************
362 * Initialize for DH *
363 *************************************************/
364
365 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
366
367 Arguments:
368 dhparam DH parameter file or fixed parameter identity string
369 host connected host, if client; NULL if server
370
371 Returns: TRUE if OK (nothing to set up, or setup worked)
372 */
373
374 static BOOL
375 init_dh(SSL_CTX *sctx, uschar *dhparam, host_item *host)
376 {
377 BIO *bio;
378 DH *dh;
379 uschar *dhexpanded;
380 const char *pem;
381
382 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
383 return FALSE;
384
385 if (dhexpanded == NULL || *dhexpanded == '\0')
386 {
387 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
388 }
389 else if (dhexpanded[0] == '/')
390 {
391 bio = BIO_new_file(CS dhexpanded, "r");
392 if (bio == NULL)
393 {
394 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
395 host, US strerror(errno));
396 return FALSE;
397 }
398 }
399 else
400 {
401 if (Ustrcmp(dhexpanded, "none") == 0)
402 {
403 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
404 return TRUE;
405 }
406
407 pem = std_dh_prime_named(dhexpanded);
408 if (!pem)
409 {
410 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
411 host, US strerror(errno));
412 return FALSE;
413 }
414 bio = BIO_new_mem_buf(CS pem, -1);
415 }
416
417 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
418 if (dh == NULL)
419 {
420 BIO_free(bio);
421 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
422 host, NULL);
423 return FALSE;
424 }
425
426 /* Even if it is larger, we silently return success rather than cause things
427 * to fail out, so that a too-large DH will not knock out all TLS; it's a
428 * debatable choice. */
429 if ((8*DH_size(dh)) > tls_dh_max_bits)
430 {
431 DEBUG(D_tls)
432 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
433 8*DH_size(dh), tls_dh_max_bits);
434 }
435 else
436 {
437 SSL_CTX_set_tmp_dh(sctx, dh);
438 DEBUG(D_tls)
439 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
440 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
441 }
442
443 DH_free(dh);
444 BIO_free(bio);
445
446 return TRUE;
447 }
448
449
450
451
452 #ifdef EXPERIMENTAL_OCSP
453 /*************************************************
454 * Load OCSP information into state *
455 *************************************************/
456
457 /* Called to load the server OCSP response from the given file into memory, once
458 caller has determined this is needed. Checks validity. Debugs a message
459 if invalid.
460
461 ASSUMES: single response, for single cert.
462
463 Arguments:
464 sctx the SSL_CTX* to update
465 cbinfo various parts of session state
466 expanded the filename putatively holding an OCSP response
467
468 */
469
470 static void
471 ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
472 {
473 BIO *bio;
474 OCSP_RESPONSE *resp;
475 OCSP_BASICRESP *basic_response;
476 OCSP_SINGLERESP *single_response;
477 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
478 X509_STORE *store;
479 unsigned long verify_flags;
480 int status, reason, i;
481
482 cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
483 if (cbinfo->u_ocsp.server.response)
484 {
485 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
486 cbinfo->u_ocsp.server.response = NULL;
487 }
488
489 bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
490 if (!bio)
491 {
492 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
493 cbinfo->u_ocsp.server.file_expanded);
494 return;
495 }
496
497 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
498 BIO_free(bio);
499 if (!resp)
500 {
501 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
502 return;
503 }
504
505 status = OCSP_response_status(resp);
506 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
507 {
508 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
509 OCSP_response_status_str(status), status);
510 goto bad;
511 }
512
513 basic_response = OCSP_response_get1_basic(resp);
514 if (!basic_response)
515 {
516 DEBUG(D_tls)
517 debug_printf("OCSP response parse error: unable to extract basic response.\n");
518 goto bad;
519 }
520
521 store = SSL_CTX_get_cert_store(sctx);
522 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
523
524 /* May need to expose ability to adjust those flags?
525 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
526 OCSP_TRUSTOTHER OCSP_NOINTERN */
527
528 i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
529 if (i <= 0)
530 {
531 DEBUG(D_tls) {
532 ERR_error_string(ERR_get_error(), ssl_errstring);
533 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
534 }
535 goto bad;
536 }
537
538 /* Here's the simplifying assumption: there's only one response, for the
539 one certificate we use, and nothing for anything else in a chain. If this
540 proves false, we need to extract a cert id from our issued cert
541 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
542 right cert in the stack and then calls OCSP_single_get0_status()).
543
544 I'm hoping to avoid reworking a bunch more of how we handle state here. */
545 single_response = OCSP_resp_get0(basic_response, 0);
546 if (!single_response)
547 {
548 DEBUG(D_tls)
549 debug_printf("Unable to get first response from OCSP basic response.\n");
550 goto bad;
551 }
552
553 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
554 if (status != V_OCSP_CERTSTATUS_GOOD)
555 {
556 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
557 OCSP_cert_status_str(status), status,
558 OCSP_crl_reason_str(reason), reason);
559 goto bad;
560 }
561
562 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
563 {
564 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
565 goto bad;
566 }
567
568 supply_response:
569 cbinfo->u_ocsp.server.response = resp;
570 return;
571
572 bad:
573 if (running_in_test_harness)
574 {
575 extern char ** environ;
576 uschar ** p;
577 for (p = USS environ; *p != NULL; p++)
578 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
579 {
580 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
581 goto supply_response;
582 }
583 }
584 return;
585 }
586 #endif /*EXPERIMENTAL_OCSP*/
587
588
589
590
591 /*************************************************
592 * Expand key and cert file specs *
593 *************************************************/
594
595 /* Called once during tls_init and possibly again during TLS setup, for a
596 new context, if Server Name Indication was used and tls_sni was seen in
597 the certificate string.
598
599 Arguments:
600 sctx the SSL_CTX* to update
601 cbinfo various parts of session state
602
603 Returns: OK/DEFER/FAIL
604 */
605
606 static int
607 tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
608 {
609 uschar *expanded;
610
611 if (cbinfo->certificate == NULL)
612 return OK;
613
614 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
615 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
616 Ustrstr(cbinfo->certificate, US"tls_out_sni")
617 )
618 reexpand_tls_files_for_sni = TRUE;
619
620 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
621 return DEFER;
622
623 if (expanded != NULL)
624 {
625 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
626 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
627 return tls_error(string_sprintf(
628 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
629 cbinfo->host, NULL);
630 }
631
632 if (cbinfo->privatekey != NULL &&
633 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
634 return DEFER;
635
636 /* If expansion was forced to fail, key_expanded will be NULL. If the result
637 of the expansion is an empty string, ignore it also, and assume the private
638 key is in the same file as the certificate. */
639
640 if (expanded != NULL && *expanded != 0)
641 {
642 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
643 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
644 return tls_error(string_sprintf(
645 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
646 }
647
648 #ifdef EXPERIMENTAL_OCSP
649 if (cbinfo->is_server && cbinfo->u_ocsp.server.file != NULL)
650 {
651 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
652 return DEFER;
653
654 if (expanded != NULL && *expanded != 0)
655 {
656 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
657 if (cbinfo->u_ocsp.server.file_expanded &&
658 (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
659 {
660 DEBUG(D_tls)
661 debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
662 } else {
663 ocsp_load_response(sctx, cbinfo, expanded);
664 }
665 }
666 }
667 #endif
668
669 return OK;
670 }
671
672
673
674
675 /*************************************************
676 * Callback to handle SNI *
677 *************************************************/
678
679 /* Called when acting as server during the TLS session setup if a Server Name
680 Indication extension was sent by the client.
681
682 API documentation is OpenSSL s_server.c implementation.
683
684 Arguments:
685 s SSL* of the current session
686 ad unknown (part of OpenSSL API) (unused)
687 arg Callback of "our" registered data
688
689 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
690 */
691
692 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
693 static int
694 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
695 {
696 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
697 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
698 int rc;
699 int old_pool = store_pool;
700
701 if (!servername)
702 return SSL_TLSEXT_ERR_OK;
703
704 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
705 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
706
707 /* Make the extension value available for expansion */
708 store_pool = POOL_PERM;
709 tls_in.sni = string_copy(US servername);
710 store_pool = old_pool;
711
712 if (!reexpand_tls_files_for_sni)
713 return SSL_TLSEXT_ERR_OK;
714
715 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
716 not confident that memcpy wouldn't break some internal reference counting.
717 Especially since there's a references struct member, which would be off. */
718
719 server_sni = SSL_CTX_new(SSLv23_server_method());
720 if (!server_sni)
721 {
722 ERR_error_string(ERR_get_error(), ssl_errstring);
723 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
724 return SSL_TLSEXT_ERR_NOACK;
725 }
726
727 /* Not sure how many of these are actually needed, since SSL object
728 already exists. Might even need this selfsame callback, for reneg? */
729
730 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
731 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
732 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
733 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
734 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
735 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
736 if (cbinfo->server_cipher_list)
737 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
738 #ifdef EXPERIMENTAL_OCSP
739 if (cbinfo->u_ocsp.server.file)
740 {
741 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
742 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
743 }
744 #endif
745
746 rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
747 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
748
749 /* do this after setup_certs, because this can require the certs for verifying
750 OCSP information. */
751 rc = tls_expand_session_files(server_sni, cbinfo);
752 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
753
754 rc = init_dh(server_sni, cbinfo->dhparam, NULL);
755 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
756
757 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
758 SSL_set_SSL_CTX(s, server_sni);
759
760 return SSL_TLSEXT_ERR_OK;
761 }
762 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
763
764
765
766
767 #ifdef EXPERIMENTAL_OCSP
768
769 /*************************************************
770 * Callback to handle OCSP Stapling *
771 *************************************************/
772
773 /* Called when acting as server during the TLS session setup if the client
774 requests OCSP information with a Certificate Status Request.
775
776 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
777 project.
778
779 */
780
781 static int
782 tls_server_stapling_cb(SSL *s, void *arg)
783 {
784 const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
785 uschar *response_der;
786 int response_der_len;
787
788 if (log_extra_selector & LX_tls_cipher)
789 log_write(0, LOG_MAIN, "[%s] Recieved OCSP stapling req;%s responding",
790 sender_host_address, cbinfo->u_ocsp.server.response ? "":" not");
791 else
792 DEBUG(D_tls) debug_printf("Received TLS status request (OCSP stapling); %s response.",
793 cbinfo->u_ocsp.server.response ? "have" : "lack");
794
795 if (!cbinfo->u_ocsp.server.response)
796 return SSL_TLSEXT_ERR_NOACK;
797
798 response_der = NULL;
799 response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response, &response_der);
800 if (response_der_len <= 0)
801 return SSL_TLSEXT_ERR_NOACK;
802
803 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
804 return SSL_TLSEXT_ERR_OK;
805 }
806
807
808 static void
809 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
810 {
811 BIO_printf(bp, "\t%s: ", str);
812 ASN1_GENERALIZEDTIME_print(bp, time);
813 BIO_puts(bp, "\n");
814 }
815
816 static int
817 tls_client_stapling_cb(SSL *s, void *arg)
818 {
819 tls_ext_ctx_cb * cbinfo = arg;
820 const unsigned char * p;
821 int len;
822 OCSP_RESPONSE * rsp;
823 OCSP_BASICRESP * bs;
824 int i;
825
826 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
827 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
828 if(!p)
829 {
830 if (log_extra_selector & LX_tls_cipher)
831 log_write(0, LOG_MAIN, "Received TLS status response, null content");
832 else
833 DEBUG(D_tls) debug_printf(" null\n");
834 return 0; /* This is the fail case for require-ocsp; none from server */
835 }
836 if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
837 {
838 if (log_extra_selector & LX_tls_cipher)
839 log_write(0, LOG_MAIN, "Received TLS status response, parse error");
840 else
841 DEBUG(D_tls) debug_printf(" parse error\n");
842 return 0;
843 }
844
845 if(!(bs = OCSP_response_get1_basic(rsp)))
846 {
847 if (log_extra_selector & LX_tls_cipher)
848 log_write(0, LOG_MAIN, "Received TLS status response, error parsing response");
849 else
850 DEBUG(D_tls) debug_printf(" error parsing response\n");
851 OCSP_RESPONSE_free(rsp);
852 return 0;
853 }
854
855 /* We'd check the nonce here if we'd put one in the request. */
856 /* However that would defeat cacheability on the server so we don't. */
857
858
859 /* This section of code reworked from OpenSSL apps source;
860 The OpenSSL Project retains copyright:
861 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
862 */
863 {
864 BIO * bp = NULL;
865 OCSP_CERTID *id;
866 int status, reason;
867 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
868
869 DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
870
871 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
872
873 /* Use the chain that verified the server cert to verify the stapled info */
874 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
875
876 if ((i = OCSP_basic_verify(bs, NULL, cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
877 {
878 BIO_printf(bp, "OCSP response verify failure\n");
879 ERR_print_errors(bp);
880 i = 0;
881 goto out;
882 }
883
884 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
885
886 {
887 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
888 OCSP_SINGLERESP * single;
889
890 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
891 {
892 log_write(0, LOG_MAIN, "OCSP stapling with multiple responses not handled");
893 goto out;
894 }
895 single = OCSP_resp_get0(bs, 0);
896 status = OCSP_single_get0_status(single, &reason, &rev, &thisupd, &nextupd);
897 }
898
899 i = 0;
900 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
901 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
902 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
903 {
904 DEBUG(D_tls) ERR_print_errors(bp);
905 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
906 goto out;
907 }
908
909 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n", OCSP_cert_status_str(status));
910 switch(status)
911 {
912 case V_OCSP_CERTSTATUS_GOOD:
913 i = 1;
914 break;
915 case V_OCSP_CERTSTATUS_REVOKED:
916 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
917 reason != -1 ? "; reason: " : "", reason != -1 ? OCSP_crl_reason_str(reason) : "");
918 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
919 i = 0;
920 break;
921 default:
922 log_write(0, LOG_MAIN, "Server certificate status unknown, in OCSP stapling");
923 i = 0;
924 break;
925 }
926 out:
927 BIO_free(bp);
928 }
929
930 OCSP_RESPONSE_free(rsp);
931 return i;
932 }
933 #endif /*EXPERIMENTAL_OCSP*/
934
935
936
937 /*************************************************
938 * Initialize for TLS *
939 *************************************************/
940
941 /* Called from both server and client code, to do preliminary initialization of
942 the library.
943
944 Arguments:
945 host connected host, if client; NULL if server
946 dhparam DH parameter file
947 certificate certificate file
948 privatekey private key
949 ocsp_file file of stapling info (server); flag for require ocsp (client)
950 addr address if client; NULL if server (for some randomness)
951
952 Returns: OK/DEFER/FAIL
953 */
954
955 static int
956 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
957 uschar *privatekey,
958 #ifdef EXPERIMENTAL_OCSP
959 uschar *ocsp_file,
960 #endif
961 address_item *addr, tls_ext_ctx_cb ** cbp)
962 {
963 long init_options;
964 int rc;
965 BOOL okay;
966 tls_ext_ctx_cb *cbinfo;
967
968 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
969 cbinfo->certificate = certificate;
970 cbinfo->privatekey = privatekey;
971 #ifdef EXPERIMENTAL_OCSP
972 if ((cbinfo->is_server = host==NULL))
973 {
974 cbinfo->u_ocsp.server.file = ocsp_file;
975 cbinfo->u_ocsp.server.file_expanded = NULL;
976 cbinfo->u_ocsp.server.response = NULL;
977 }
978 else
979 cbinfo->u_ocsp.client.verify_store = NULL;
980 #endif
981 cbinfo->dhparam = dhparam;
982 cbinfo->host = host;
983
984 SSL_load_error_strings(); /* basic set up */
985 OpenSSL_add_ssl_algorithms();
986
987 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
988 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
989 list of available digests. */
990 EVP_add_digest(EVP_sha256());
991 #endif
992
993 /* Create a context.
994 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
995 negotiation in the different methods; as far as I can tell, the only
996 *_{server,client}_method which allows negotiation is SSLv23, which exists even
997 when OpenSSL is built without SSLv2 support.
998 By disabling with openssl_options, we can let admins re-enable with the
999 existing knob. */
1000
1001 *ctxp = SSL_CTX_new((host == NULL)?
1002 SSLv23_server_method() : SSLv23_client_method());
1003
1004 if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
1005
1006 /* It turns out that we need to seed the random number generator this early in
1007 order to get the full complement of ciphers to work. It took me roughly a day
1008 of work to discover this by experiment.
1009
1010 On systems that have /dev/urandom, SSL may automatically seed itself from
1011 there. Otherwise, we have to make something up as best we can. Double check
1012 afterwards. */
1013
1014 if (!RAND_status())
1015 {
1016 randstuff r;
1017 gettimeofday(&r.tv, NULL);
1018 r.p = getpid();
1019
1020 RAND_seed((uschar *)(&r), sizeof(r));
1021 RAND_seed((uschar *)big_buffer, big_buffer_size);
1022 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1023
1024 if (!RAND_status())
1025 return tls_error(US"RAND_status", host,
1026 US"unable to seed random number generator");
1027 }
1028
1029 /* Set up the information callback, which outputs if debugging is at a suitable
1030 level. */
1031
1032 SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
1033
1034 /* Automatically re-try reads/writes after renegotiation. */
1035 (void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
1036
1037 /* Apply administrator-supplied work-arounds.
1038 Historically we applied just one requested option,
1039 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1040 moved to an administrator-controlled list of options to specify and
1041 grandfathered in the first one as the default value for "openssl_options".
1042
1043 No OpenSSL version number checks: the options we accept depend upon the
1044 availability of the option value macros from OpenSSL. */
1045
1046 okay = tls_openssl_options_parse(openssl_options, &init_options);
1047 if (!okay)
1048 return tls_error(US"openssl_options parsing failed", host, NULL);
1049
1050 if (init_options)
1051 {
1052 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
1053 if (!(SSL_CTX_set_options(*ctxp, init_options)))
1054 return tls_error(string_sprintf(
1055 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1056 }
1057 else
1058 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
1059
1060 /* Initialize with DH parameters if supplied */
1061
1062 if (!init_dh(*ctxp, dhparam, host)) return DEFER;
1063
1064 /* Set up certificate and key (and perhaps OCSP info) */
1065
1066 rc = tls_expand_session_files(*ctxp, cbinfo);
1067 if (rc != OK) return rc;
1068
1069 /* If we need to handle SNI, do so */
1070 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1071 if (host == NULL) /* server */
1072 {
1073 # ifdef EXPERIMENTAL_OCSP
1074 /* We check u_ocsp.server.file, not server.response, because we care about if
1075 the option exists, not what the current expansion might be, as SNI might
1076 change the certificate and OCSP file in use between now and the time the
1077 callback is invoked. */
1078 if (cbinfo->u_ocsp.server.file)
1079 {
1080 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
1081 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
1082 }
1083 # endif
1084 /* We always do this, so that $tls_sni is available even if not used in
1085 tls_certificate */
1086 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1087 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
1088 }
1089 # ifdef EXPERIMENTAL_OCSP
1090 else /* client */
1091 if(ocsp_file) /* wanting stapling */
1092 {
1093 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1094 {
1095 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1096 return FAIL;
1097 }
1098 SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1099 SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1100 }
1101 # endif
1102 #endif
1103
1104 /* Set up the RSA callback */
1105
1106 SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
1107
1108 /* Finally, set the timeout, and we are done */
1109
1110 SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
1111 DEBUG(D_tls) debug_printf("Initialized TLS\n");
1112
1113 *cbp = cbinfo;
1114
1115 return OK;
1116 }
1117
1118
1119
1120
1121 /*************************************************
1122 * Get name of cipher in use *
1123 *************************************************/
1124
1125 /*
1126 Argument: pointer to an SSL structure for the connection
1127 buffer to use for answer
1128 size of buffer
1129 pointer to number of bits for cipher
1130 Returns: nothing
1131 */
1132
1133 static void
1134 construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
1135 {
1136 /* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1137 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1138 the accessor functions use const in the prototype. */
1139 const SSL_CIPHER *c;
1140 uschar *ver;
1141
1142 switch (ssl->session->ssl_version)
1143 {
1144 case SSL2_VERSION:
1145 ver = US"SSLv2";
1146 break;
1147
1148 case SSL3_VERSION:
1149 ver = US"SSLv3";
1150 break;
1151
1152 case TLS1_VERSION:
1153 ver = US"TLSv1";
1154 break;
1155
1156 #ifdef TLS1_1_VERSION
1157 case TLS1_1_VERSION:
1158 ver = US"TLSv1.1";
1159 break;
1160 #endif
1161
1162 #ifdef TLS1_2_VERSION
1163 case TLS1_2_VERSION:
1164 ver = US"TLSv1.2";
1165 break;
1166 #endif
1167
1168 default:
1169 ver = US"UNKNOWN";
1170 }
1171
1172 c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
1173 SSL_CIPHER_get_bits(c, bits);
1174
1175 string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1176 SSL_CIPHER_get_name(c), *bits);
1177
1178 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1179 }
1180
1181
1182
1183
1184
1185 /*************************************************
1186 * Set up for verifying certificates *
1187 *************************************************/
1188
1189 /* Called by both client and server startup
1190
1191 Arguments:
1192 sctx SSL_CTX* to initialise
1193 certs certs file or NULL
1194 crl CRL file or NULL
1195 host NULL in a server; the remote host in a client
1196 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1197 otherwise passed as FALSE
1198 cert_vfy_cb Callback function for certificate verification
1199
1200 Returns: OK/DEFER/FAIL
1201 */
1202
1203 static int
1204 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1205 int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
1206 {
1207 uschar *expcerts, *expcrl;
1208
1209 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1210 return DEFER;
1211
1212 if (expcerts != NULL && *expcerts != '\0')
1213 {
1214 struct stat statbuf;
1215 if (!SSL_CTX_set_default_verify_paths(sctx))
1216 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1217
1218 if (Ustat(expcerts, &statbuf) < 0)
1219 {
1220 log_write(0, LOG_MAIN|LOG_PANIC,
1221 "failed to stat %s for certificates", expcerts);
1222 return DEFER;
1223 }
1224 else
1225 {
1226 uschar *file, *dir;
1227 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1228 { file = NULL; dir = expcerts; }
1229 else
1230 { file = expcerts; dir = NULL; }
1231
1232 /* If a certificate file is empty, the next function fails with an
1233 unhelpful error message. If we skip it, we get the correct behaviour (no
1234 certificates are recognized, but the error message is still misleading (it
1235 says no certificate was supplied.) But this is better. */
1236
1237 if ((file == NULL || statbuf.st_size > 0) &&
1238 !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1239 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1240
1241 if (file != NULL)
1242 {
1243 SSL_CTX_set_client_CA_list(sctx, SSL_load_client_CA_file(CS file));
1244 }
1245 }
1246
1247 /* Handle a certificate revocation list. */
1248
1249 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1250
1251 /* This bit of code is now the version supplied by Lars Mainka. (I have
1252 * merely reformatted it into the Exim code style.)
1253
1254 * "From here I changed the code to add support for multiple crl's
1255 * in pem format in one file or to support hashed directory entries in
1256 * pem format instead of a file. This method now uses the library function
1257 * X509_STORE_load_locations to add the CRL location to the SSL context.
1258 * OpenSSL will then handle the verify against CA certs and CRLs by
1259 * itself in the verify callback." */
1260
1261 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1262 if (expcrl != NULL && *expcrl != 0)
1263 {
1264 struct stat statbufcrl;
1265 if (Ustat(expcrl, &statbufcrl) < 0)
1266 {
1267 log_write(0, LOG_MAIN|LOG_PANIC,
1268 "failed to stat %s for certificates revocation lists", expcrl);
1269 return DEFER;
1270 }
1271 else
1272 {
1273 /* is it a file or directory? */
1274 uschar *file, *dir;
1275 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
1276 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
1277 {
1278 file = NULL;
1279 dir = expcrl;
1280 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
1281 }
1282 else
1283 {
1284 file = expcrl;
1285 dir = NULL;
1286 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
1287 }
1288 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
1289 return tls_error(US"X509_STORE_load_locations", host, NULL);
1290
1291 /* setting the flags to check against the complete crl chain */
1292
1293 X509_STORE_set_flags(cvstore,
1294 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
1295 }
1296 }
1297
1298 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1299
1300 /* If verification is optional, don't fail if no certificate */
1301
1302 SSL_CTX_set_verify(sctx,
1303 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
1304 cert_vfy_cb);
1305 }
1306
1307 return OK;
1308 }
1309
1310
1311
1312 /*************************************************
1313 * Start a TLS session in a server *
1314 *************************************************/
1315
1316 /* This is called when Exim is running as a server, after having received
1317 the STARTTLS command. It must respond to that command, and then negotiate
1318 a TLS session.
1319
1320 Arguments:
1321 require_ciphers allowed ciphers
1322
1323 Returns: OK on success
1324 DEFER for errors before the start of the negotiation
1325 FAIL for errors during the negotation; the server can't
1326 continue running.
1327 */
1328
1329 int
1330 tls_server_start(const uschar *require_ciphers)
1331 {
1332 int rc;
1333 uschar *expciphers;
1334 tls_ext_ctx_cb *cbinfo;
1335 static uschar cipherbuf[256];
1336
1337 /* Check for previous activation */
1338
1339 if (tls_in.active >= 0)
1340 {
1341 tls_error(US"STARTTLS received after TLS started", NULL, US"");
1342 smtp_printf("554 Already in TLS\r\n");
1343 return FAIL;
1344 }
1345
1346 /* Initialize the SSL library. If it fails, it will already have logged
1347 the error. */
1348
1349 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
1350 #ifdef EXPERIMENTAL_OCSP
1351 tls_ocsp_file,
1352 #endif
1353 NULL, &server_static_cbinfo);
1354 if (rc != OK) return rc;
1355 cbinfo = server_static_cbinfo;
1356
1357 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1358 return FAIL;
1359
1360 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1361 were historically separated by underscores. So that I can use either form in my
1362 tests, and also for general convenience, we turn underscores into hyphens here.
1363 */
1364
1365 if (expciphers != NULL)
1366 {
1367 uschar *s = expciphers;
1368 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1369 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1370 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
1371 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
1372 cbinfo->server_cipher_list = expciphers;
1373 }
1374
1375 /* If this is a host for which certificate verification is mandatory or
1376 optional, set up appropriately. */
1377
1378 tls_in.certificate_verified = FALSE;
1379 server_verify_callback_called = FALSE;
1380
1381 if (verify_check_host(&tls_verify_hosts) == OK)
1382 {
1383 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1384 FALSE, verify_callback_server);
1385 if (rc != OK) return rc;
1386 server_verify_optional = FALSE;
1387 }
1388 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1389 {
1390 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1391 TRUE, verify_callback_server);
1392 if (rc != OK) return rc;
1393 server_verify_optional = TRUE;
1394 }
1395
1396 /* Prepare for new connection */
1397
1398 if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
1399
1400 /* Warning: we used to SSL_clear(ssl) here, it was removed.
1401 *
1402 * With the SSL_clear(), we get strange interoperability bugs with
1403 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1404 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1405 *
1406 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1407 * session shutdown. In this case, we have a brand new object and there's no
1408 * obvious reason to immediately clear it. I'm guessing that this was
1409 * originally added because of incomplete initialisation which the clear fixed,
1410 * in some historic release.
1411 */
1412
1413 /* Set context and tell client to go ahead, except in the case of TLS startup
1414 on connection, where outputting anything now upsets the clients and tends to
1415 make them disconnect. We need to have an explicit fflush() here, to force out
1416 the response. Other smtp_printf() calls do not need it, because in non-TLS
1417 mode, the fflush() happens when smtp_getc() is called. */
1418
1419 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1420 if (!tls_in.on_connect)
1421 {
1422 smtp_printf("220 TLS go ahead\r\n");
1423 fflush(smtp_out);
1424 }
1425
1426 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1427 that the OpenSSL library doesn't. */
1428
1429 SSL_set_wfd(server_ssl, fileno(smtp_out));
1430 SSL_set_rfd(server_ssl, fileno(smtp_in));
1431 SSL_set_accept_state(server_ssl);
1432
1433 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1434
1435 sigalrm_seen = FALSE;
1436 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1437 rc = SSL_accept(server_ssl);
1438 alarm(0);
1439
1440 if (rc <= 0)
1441 {
1442 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
1443 if (ERR_get_error() == 0)
1444 log_write(0, LOG_MAIN,
1445 "TLS client disconnected cleanly (rejected our certificate?)");
1446 return FAIL;
1447 }
1448
1449 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1450
1451 /* TLS has been set up. Adjust the input functions to read via TLS,
1452 and initialize things. */
1453
1454 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1455 tls_in.cipher = cipherbuf;
1456
1457 DEBUG(D_tls)
1458 {
1459 uschar buf[2048];
1460 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
1461 debug_printf("Shared ciphers: %s\n", buf);
1462 }
1463
1464
1465 /* Only used by the server-side tls (tls_in), including tls_getc.
1466 Client-side (tls_out) reads (seem to?) go via
1467 smtp_read_response()/ip_recv().
1468 Hence no need to duplicate for _in and _out.
1469 */
1470 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1471 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1472 ssl_xfer_eof = ssl_xfer_error = 0;
1473
1474 receive_getc = tls_getc;
1475 receive_ungetc = tls_ungetc;
1476 receive_feof = tls_feof;
1477 receive_ferror = tls_ferror;
1478 receive_smtp_buffered = tls_smtp_buffered;
1479
1480 tls_in.active = fileno(smtp_out);
1481 return OK;
1482 }
1483
1484
1485
1486
1487
1488 /*************************************************
1489 * Start a TLS session in a client *
1490 *************************************************/
1491
1492 /* Called from the smtp transport after STARTTLS has been accepted.
1493
1494 Argument:
1495 fd the fd of the connection
1496 host connected host (for messages)
1497 addr the first address
1498 certificate certificate file
1499 privatekey private key file
1500 sni TLS SNI to send to remote host
1501 verify_certs file for certificate verify
1502 crl file containing CRL
1503 require_ciphers list of allowed ciphers
1504 dh_min_bits minimum number of bits acceptable in server's DH prime
1505 (unused in OpenSSL)
1506 timeout startup timeout
1507
1508 Returns: OK on success
1509 FAIL otherwise - note that tls_error() will not give DEFER
1510 because this is not a server
1511 */
1512
1513 int
1514 tls_client_start(int fd, host_item *host, address_item *addr,
1515 uschar *certificate, uschar *privatekey, uschar *sni,
1516 uschar *verify_certs, uschar *crl,
1517 uschar *require_ciphers,
1518 #ifdef EXPERIMENTAL_OCSP
1519 uschar *hosts_require_ocsp,
1520 #endif
1521 int dh_min_bits ARG_UNUSED, int timeout)
1522 {
1523 static uschar txt[256];
1524 uschar *expciphers;
1525 X509* server_cert;
1526 int rc;
1527 static uschar cipherbuf[256];
1528 #ifdef EXPERIMENTAL_OCSP
1529 BOOL require_ocsp = verify_check_this_host(&hosts_require_ocsp,
1530 NULL, host->name, host->address, NULL) == OK;
1531 #endif
1532
1533 rc = tls_init(&client_ctx, host, NULL, certificate, privatekey,
1534 #ifdef EXPERIMENTAL_OCSP
1535 require_ocsp ? US"" : NULL,
1536 #endif
1537 addr, &client_static_cbinfo);
1538 if (rc != OK) return rc;
1539
1540 tls_out.certificate_verified = FALSE;
1541 client_verify_callback_called = FALSE;
1542
1543 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1544 return FAIL;
1545
1546 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1547 are separated by underscores. So that I can use either form in my tests, and
1548 also for general convenience, we turn underscores into hyphens here. */
1549
1550 if (expciphers != NULL)
1551 {
1552 uschar *s = expciphers;
1553 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1554 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1555 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
1556 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
1557 }
1558
1559 rc = setup_certs(client_ctx, verify_certs, crl, host, FALSE, verify_callback_client);
1560 if (rc != OK) return rc;
1561
1562 if ((client_ssl = SSL_new(client_ctx)) == NULL) return tls_error(US"SSL_new", host, NULL);
1563 SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1564 SSL_set_fd(client_ssl, fd);
1565 SSL_set_connect_state(client_ssl);
1566
1567 if (sni)
1568 {
1569 if (!expand_check(sni, US"tls_sni", &tls_out.sni))
1570 return FAIL;
1571 if (tls_out.sni == NULL)
1572 {
1573 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1574 }
1575 else if (!Ustrlen(tls_out.sni))
1576 tls_out.sni = NULL;
1577 else
1578 {
1579 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1580 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1581 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
1582 #else
1583 DEBUG(D_tls)
1584 debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
1585 tls_out.sni);
1586 #endif
1587 }
1588 }
1589
1590 #ifdef EXPERIMENTAL_OCSP
1591 /* Request certificate status at connection-time. If the server
1592 does OCSP stapling we will get the callback (set in tls_init()) */
1593 if (require_ocsp)
1594 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
1595 #endif
1596
1597 /* There doesn't seem to be a built-in timeout on connection. */
1598
1599 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1600 sigalrm_seen = FALSE;
1601 alarm(timeout);
1602 rc = SSL_connect(client_ssl);
1603 alarm(0);
1604
1605 if (rc <= 0)
1606 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
1607
1608 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
1609
1610 /* Beware anonymous ciphers which lead to server_cert being NULL */
1611 server_cert = SSL_get_peer_certificate (client_ssl);
1612 if (server_cert)
1613 {
1614 tls_out.peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
1615 CS txt, sizeof(txt));
1616 tls_out.peerdn = txt;
1617 }
1618 else
1619 tls_out.peerdn = NULL;
1620
1621 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
1622 tls_out.cipher = cipherbuf;
1623
1624 tls_out.active = fd;
1625 return OK;
1626 }
1627
1628
1629
1630
1631
1632 /*************************************************
1633 * TLS version of getc *
1634 *************************************************/
1635
1636 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
1637 it refills the buffer via the SSL reading function.
1638
1639 Arguments: none
1640 Returns: the next character or EOF
1641
1642 Only used by the server-side TLS.
1643 */
1644
1645 int
1646 tls_getc(void)
1647 {
1648 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
1649 {
1650 int error;
1651 int inbytes;
1652
1653 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
1654 ssl_xfer_buffer, ssl_xfer_buffer_size);
1655
1656 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1657 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
1658 error = SSL_get_error(server_ssl, inbytes);
1659 alarm(0);
1660
1661 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
1662 closed down, not that the socket itself has been closed down. Revert to
1663 non-SSL handling. */
1664
1665 if (error == SSL_ERROR_ZERO_RETURN)
1666 {
1667 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
1668
1669 receive_getc = smtp_getc;
1670 receive_ungetc = smtp_ungetc;
1671 receive_feof = smtp_feof;
1672 receive_ferror = smtp_ferror;
1673 receive_smtp_buffered = smtp_buffered;
1674
1675 SSL_free(server_ssl);
1676 server_ssl = NULL;
1677 tls_in.active = -1;
1678 tls_in.bits = 0;
1679 tls_in.cipher = NULL;
1680 tls_in.peerdn = NULL;
1681 tls_in.sni = NULL;
1682
1683 return smtp_getc();
1684 }
1685
1686 /* Handle genuine errors */
1687
1688 else if (error == SSL_ERROR_SSL)
1689 {
1690 ERR_error_string(ERR_get_error(), ssl_errstring);
1691 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
1692 ssl_xfer_error = 1;
1693 return EOF;
1694 }
1695
1696 else if (error != SSL_ERROR_NONE)
1697 {
1698 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
1699 ssl_xfer_error = 1;
1700 return EOF;
1701 }
1702
1703 #ifndef DISABLE_DKIM
1704 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
1705 #endif
1706 ssl_xfer_buffer_hwm = inbytes;
1707 ssl_xfer_buffer_lwm = 0;
1708 }
1709
1710 /* Something in the buffer; return next uschar */
1711
1712 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
1713 }
1714
1715
1716
1717 /*************************************************
1718 * Read bytes from TLS channel *
1719 *************************************************/
1720
1721 /*
1722 Arguments:
1723 buff buffer of data
1724 len size of buffer
1725
1726 Returns: the number of bytes read
1727 -1 after a failed read
1728
1729 Only used by the client-side TLS.
1730 */
1731
1732 int
1733 tls_read(BOOL is_server, uschar *buff, size_t len)
1734 {
1735 SSL *ssl = is_server ? server_ssl : client_ssl;
1736 int inbytes;
1737 int error;
1738
1739 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
1740 buff, (unsigned int)len);
1741
1742 inbytes = SSL_read(ssl, CS buff, len);
1743 error = SSL_get_error(ssl, inbytes);
1744
1745 if (error == SSL_ERROR_ZERO_RETURN)
1746 {
1747 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
1748 return -1;
1749 }
1750 else if (error != SSL_ERROR_NONE)
1751 {
1752 return -1;
1753 }
1754
1755 return inbytes;
1756 }
1757
1758
1759
1760
1761
1762 /*************************************************
1763 * Write bytes down TLS channel *
1764 *************************************************/
1765
1766 /*
1767 Arguments:
1768 is_server channel specifier
1769 buff buffer of data
1770 len number of bytes
1771
1772 Returns: the number of bytes after a successful write,
1773 -1 after a failed write
1774
1775 Used by both server-side and client-side TLS.
1776 */
1777
1778 int
1779 tls_write(BOOL is_server, const uschar *buff, size_t len)
1780 {
1781 int outbytes;
1782 int error;
1783 int left = len;
1784 SSL *ssl = is_server ? server_ssl : client_ssl;
1785
1786 DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
1787 while (left > 0)
1788 {
1789 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
1790 outbytes = SSL_write(ssl, CS buff, left);
1791 error = SSL_get_error(ssl, outbytes);
1792 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
1793 switch (error)
1794 {
1795 case SSL_ERROR_SSL:
1796 ERR_error_string(ERR_get_error(), ssl_errstring);
1797 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
1798 return -1;
1799
1800 case SSL_ERROR_NONE:
1801 left -= outbytes;
1802 buff += outbytes;
1803 break;
1804
1805 case SSL_ERROR_ZERO_RETURN:
1806 log_write(0, LOG_MAIN, "SSL channel closed on write");
1807 return -1;
1808
1809 case SSL_ERROR_SYSCALL:
1810 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
1811 sender_fullhost ? sender_fullhost : US"<unknown>",
1812 strerror(errno));
1813
1814 default:
1815 log_write(0, LOG_MAIN, "SSL_write error %d", error);
1816 return -1;
1817 }
1818 }
1819 return len;
1820 }
1821
1822
1823
1824 /*************************************************
1825 * Close down a TLS session *
1826 *************************************************/
1827
1828 /* This is also called from within a delivery subprocess forked from the
1829 daemon, to shut down the TLS library, without actually doing a shutdown (which
1830 would tamper with the SSL session in the parent process).
1831
1832 Arguments: TRUE if SSL_shutdown is to be called
1833 Returns: nothing
1834
1835 Used by both server-side and client-side TLS.
1836 */
1837
1838 void
1839 tls_close(BOOL is_server, BOOL shutdown)
1840 {
1841 SSL **sslp = is_server ? &server_ssl : &client_ssl;
1842 int *fdp = is_server ? &tls_in.active : &tls_out.active;
1843
1844 if (*fdp < 0) return; /* TLS was not active */
1845
1846 if (shutdown)
1847 {
1848 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
1849 SSL_shutdown(*sslp);
1850 }
1851
1852 SSL_free(*sslp);
1853 *sslp = NULL;
1854
1855 *fdp = -1;
1856 }
1857
1858
1859
1860
1861 /*************************************************
1862 * Let tls_require_ciphers be checked at startup *
1863 *************************************************/
1864
1865 /* The tls_require_ciphers option, if set, must be something which the
1866 library can parse.
1867
1868 Returns: NULL on success, or error message
1869 */
1870
1871 uschar *
1872 tls_validate_require_cipher(void)
1873 {
1874 SSL_CTX *ctx;
1875 uschar *s, *expciphers, *err;
1876
1877 /* this duplicates from tls_init(), we need a better "init just global
1878 state, for no specific purpose" singleton function of our own */
1879
1880 SSL_load_error_strings();
1881 OpenSSL_add_ssl_algorithms();
1882 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
1883 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1884 list of available digests. */
1885 EVP_add_digest(EVP_sha256());
1886 #endif
1887
1888 if (!(tls_require_ciphers && *tls_require_ciphers))
1889 return NULL;
1890
1891 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
1892 return US"failed to expand tls_require_ciphers";
1893
1894 if (!(expciphers && *expciphers))
1895 return NULL;
1896
1897 /* normalisation ripped from above */
1898 s = expciphers;
1899 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1900
1901 err = NULL;
1902
1903 ctx = SSL_CTX_new(SSLv23_server_method());
1904 if (!ctx)
1905 {
1906 ERR_error_string(ERR_get_error(), ssl_errstring);
1907 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
1908 }
1909
1910 DEBUG(D_tls)
1911 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
1912
1913 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
1914 {
1915 ERR_error_string(ERR_get_error(), ssl_errstring);
1916 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
1917 }
1918
1919 SSL_CTX_free(ctx);
1920
1921 return err;
1922 }
1923
1924
1925
1926
1927 /*************************************************
1928 * Report the library versions. *
1929 *************************************************/
1930
1931 /* There have historically been some issues with binary compatibility in
1932 OpenSSL libraries; if Exim (like many other applications) is built against
1933 one version of OpenSSL but the run-time linker picks up another version,
1934 it can result in serious failures, including crashing with a SIGSEGV. So
1935 report the version found by the compiler and the run-time version.
1936
1937 Arguments: a FILE* to print the results to
1938 Returns: nothing
1939 */
1940
1941 void
1942 tls_version_report(FILE *f)
1943 {
1944 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
1945 " Runtime: %s\n",
1946 OPENSSL_VERSION_TEXT,
1947 SSLeay_version(SSLEAY_VERSION));
1948 }
1949
1950
1951
1952
1953 /*************************************************
1954 * Random number generation *
1955 *************************************************/
1956
1957 /* Pseudo-random number generation. The result is not expected to be
1958 cryptographically strong but not so weak that someone will shoot themselves
1959 in the foot using it as a nonce in input in some email header scheme or
1960 whatever weirdness they'll twist this into. The result should handle fork()
1961 and avoid repeating sequences. OpenSSL handles that for us.
1962
1963 Arguments:
1964 max range maximum
1965 Returns a random number in range [0, max-1]
1966 */
1967
1968 int
1969 vaguely_random_number(int max)
1970 {
1971 unsigned int r;
1972 int i, needed_len;
1973 uschar *p;
1974 uschar smallbuf[sizeof(r)];
1975
1976 if (max <= 1)
1977 return 0;
1978
1979 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
1980 if (!RAND_status())
1981 {
1982 randstuff r;
1983 gettimeofday(&r.tv, NULL);
1984 r.p = getpid();
1985
1986 RAND_seed((uschar *)(&r), sizeof(r));
1987 }
1988 /* We're after pseudo-random, not random; if we still don't have enough data
1989 in the internal PRNG then our options are limited. We could sleep and hope
1990 for entropy to come along (prayer technique) but if the system is so depleted
1991 in the first place then something is likely to just keep taking it. Instead,
1992 we'll just take whatever little bit of pseudo-random we can still manage to
1993 get. */
1994
1995 needed_len = sizeof(r);
1996 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
1997 asked for a number less than 10. */
1998 for (r = max, i = 0; r; ++i)
1999 r >>= 1;
2000 i = (i + 7) / 8;
2001 if (i < needed_len)
2002 needed_len = i;
2003
2004 /* We do not care if crypto-strong */
2005 i = RAND_pseudo_bytes(smallbuf, needed_len);
2006 if (i < 0)
2007 {
2008 DEBUG(D_all)
2009 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2010 return vaguely_random_number_fallback(max);
2011 }
2012
2013 r = 0;
2014 for (p = smallbuf; needed_len; --needed_len, ++p)
2015 {
2016 r *= 256;
2017 r += *p;
2018 }
2019
2020 /* We don't particularly care about weighted results; if someone wants
2021 smooth distribution and cares enough then they should submit a patch then. */
2022 return r % max;
2023 }
2024
2025
2026
2027
2028 /*************************************************
2029 * OpenSSL option parse *
2030 *************************************************/
2031
2032 /* Parse one option for tls_openssl_options_parse below
2033
2034 Arguments:
2035 name one option name
2036 value place to store a value for it
2037 Returns success or failure in parsing
2038 */
2039
2040 struct exim_openssl_option {
2041 uschar *name;
2042 long value;
2043 };
2044 /* We could use a macro to expand, but we need the ifdef and not all the
2045 options document which version they were introduced in. Policylet: include
2046 all options unless explicitly for DTLS, let the administrator choose which
2047 to apply.
2048
2049 This list is current as of:
2050 ==> 1.0.1b <== */
2051 static struct exim_openssl_option exim_openssl_options[] = {
2052 /* KEEP SORTED ALPHABETICALLY! */
2053 #ifdef SSL_OP_ALL
2054 { US"all", SSL_OP_ALL },
2055 #endif
2056 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
2057 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
2058 #endif
2059 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
2060 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
2061 #endif
2062 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
2063 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
2064 #endif
2065 #ifdef SSL_OP_EPHEMERAL_RSA
2066 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
2067 #endif
2068 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
2069 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
2070 #endif
2071 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
2072 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
2073 #endif
2074 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
2075 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
2076 #endif
2077 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
2078 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
2079 #endif
2080 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
2081 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
2082 #endif
2083 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
2084 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
2085 #endif
2086 #ifdef SSL_OP_NO_COMPRESSION
2087 { US"no_compression", SSL_OP_NO_COMPRESSION },
2088 #endif
2089 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2090 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
2091 #endif
2092 #ifdef SSL_OP_NO_SSLv2
2093 { US"no_sslv2", SSL_OP_NO_SSLv2 },
2094 #endif
2095 #ifdef SSL_OP_NO_SSLv3
2096 { US"no_sslv3", SSL_OP_NO_SSLv3 },
2097 #endif
2098 #ifdef SSL_OP_NO_TICKET
2099 { US"no_ticket", SSL_OP_NO_TICKET },
2100 #endif
2101 #ifdef SSL_OP_NO_TLSv1
2102 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2103 #endif
2104 #ifdef SSL_OP_NO_TLSv1_1
2105 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
2106 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2107 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2108 #else
2109 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2110 #endif
2111 #endif
2112 #ifdef SSL_OP_NO_TLSv1_2
2113 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2114 #endif
2115 #ifdef SSL_OP_SINGLE_DH_USE
2116 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
2117 #endif
2118 #ifdef SSL_OP_SINGLE_ECDH_USE
2119 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
2120 #endif
2121 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
2122 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
2123 #endif
2124 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
2125 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
2126 #endif
2127 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
2128 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
2129 #endif
2130 #ifdef SSL_OP_TLS_D5_BUG
2131 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
2132 #endif
2133 #ifdef SSL_OP_TLS_ROLLBACK_BUG
2134 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
2135 #endif
2136 };
2137 static int exim_openssl_options_size =
2138 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2139
2140
2141 static BOOL
2142 tls_openssl_one_option_parse(uschar *name, long *value)
2143 {
2144 int first = 0;
2145 int last = exim_openssl_options_size;
2146 while (last > first)
2147 {
2148 int middle = (first + last)/2;
2149 int c = Ustrcmp(name, exim_openssl_options[middle].name);
2150 if (c == 0)
2151 {
2152 *value = exim_openssl_options[middle].value;
2153 return TRUE;
2154 }
2155 else if (c > 0)
2156 first = middle + 1;
2157 else
2158 last = middle;
2159 }
2160 return FALSE;
2161 }
2162
2163
2164
2165
2166 /*************************************************
2167 * OpenSSL option parsing logic *
2168 *************************************************/
2169
2170 /* OpenSSL has a number of compatibility options which an administrator might
2171 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
2172 we look like log_selector.
2173
2174 Arguments:
2175 option_spec the administrator-supplied string of options
2176 results ptr to long storage for the options bitmap
2177 Returns success or failure
2178 */
2179
2180 BOOL
2181 tls_openssl_options_parse(uschar *option_spec, long *results)
2182 {
2183 long result, item;
2184 uschar *s, *end;
2185 uschar keep_c;
2186 BOOL adding, item_parsed;
2187
2188 result = 0L;
2189 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
2190 * from default because it increases BEAST susceptibility. */
2191 #ifdef SSL_OP_NO_SSLv2
2192 result |= SSL_OP_NO_SSLv2;
2193 #endif
2194
2195 if (option_spec == NULL)
2196 {
2197 *results = result;
2198 return TRUE;
2199 }
2200
2201 for (s=option_spec; *s != '\0'; /**/)
2202 {
2203 while (isspace(*s)) ++s;
2204 if (*s == '\0')
2205 break;
2206 if (*s != '+' && *s != '-')
2207 {
2208 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
2209 "+ or - expected but found \"%s\"\n", s);
2210 return FALSE;
2211 }
2212 adding = *s++ == '+';
2213 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2214 keep_c = *end;
2215 *end = '\0';
2216 item_parsed = tls_openssl_one_option_parse(s, &item);
2217 if (!item_parsed)
2218 {
2219 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
2220 return FALSE;
2221 }
2222 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2223 adding ? "adding" : "removing", result, item, s);
2224 if (adding)
2225 result |= item;
2226 else
2227 result &= ~item;
2228 *end = keep_c;
2229 s = end;
2230 }
2231
2232 *results = result;
2233 return TRUE;
2234 }
2235
2236 /* End of tls-openssl.c */