TLS: Enable ECDHE on OpenSSL, just the NIST P-256 curve. Bug 1397
[exim.git] / src / src / tls-openssl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2014 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Portions Copyright (c) The OpenSSL Project 1999 */
9
10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11 library. It is #included into the tls.c file when that library is used. The
12 code herein is based on a patch that was originally contributed by Steve
13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15 No cryptographic code is included in Exim. All this module does is to call
16 functions from the OpenSSL library. */
17
18
19 /* Heading stuff */
20
21 #include <openssl/lhash.h>
22 #include <openssl/ssl.h>
23 #include <openssl/err.h>
24 #include <openssl/rand.h>
25 #ifndef DISABLE_OCSP
26 # include <openssl/ocsp.h>
27 #endif
28 #ifdef EXPERIMENTAL_DANE
29 # include <danessl.h>
30 #endif
31
32
33 #ifndef DISABLE_OCSP
34 # define EXIM_OCSP_SKEW_SECONDS (300L)
35 # define EXIM_OCSP_MAX_AGE (-1L)
36 #endif
37
38 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
39 # define EXIM_HAVE_OPENSSL_TLSEXT
40 #endif
41 #if OPENSSL_VERSION_NUMBER >= 0x010100000L
42 # define EXIM_HAVE_OPENSSL_CHECKHOST
43 #endif
44 #if OPENSSL_VERSION_NUMBER >= 0x010000000L \
45 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
46 # define EXIM_HAVE_OPENSSL_CHECKHOST
47 #endif
48
49 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
50 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
51 # define DISABLE_OCSP
52 #endif
53
54 /* Structure for collecting random data for seeding. */
55
56 typedef struct randstuff {
57 struct timeval tv;
58 pid_t p;
59 } randstuff;
60
61 /* Local static variables */
62
63 static BOOL client_verify_callback_called = FALSE;
64 static BOOL server_verify_callback_called = FALSE;
65 static const uschar *sid_ctx = US"exim";
66
67 /* We have three different contexts to care about.
68
69 Simple case: client, `client_ctx`
70 As a client, we can be doing a callout or cut-through delivery while receiving
71 a message. So we have a client context, which should have options initialised
72 from the SMTP Transport.
73
74 Server:
75 There are two cases: with and without ServerNameIndication from the client.
76 Given TLS SNI, we can be using different keys, certs and various other
77 configuration settings, because they're re-expanded with $tls_sni set. This
78 allows vhosting with TLS. This SNI is sent in the handshake.
79 A client might not send SNI, so we need a fallback, and an initial setup too.
80 So as a server, we start out using `server_ctx`.
81 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
82 `server_sni` from `server_ctx` and then initialise settings by re-expanding
83 configuration.
84 */
85
86 static SSL_CTX *client_ctx = NULL;
87 static SSL_CTX *server_ctx = NULL;
88 static SSL *client_ssl = NULL;
89 static SSL *server_ssl = NULL;
90
91 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
92 static SSL_CTX *server_sni = NULL;
93 #endif
94
95 static char ssl_errstring[256];
96
97 static int ssl_session_timeout = 200;
98 static BOOL client_verify_optional = FALSE;
99 static BOOL server_verify_optional = FALSE;
100
101 static BOOL reexpand_tls_files_for_sni = FALSE;
102
103
104 typedef struct tls_ext_ctx_cb {
105 uschar *certificate;
106 uschar *privatekey;
107 #ifndef DISABLE_OCSP
108 BOOL is_server;
109 union {
110 struct {
111 uschar *file;
112 uschar *file_expanded;
113 OCSP_RESPONSE *response;
114 } server;
115 struct {
116 X509_STORE *verify_store; /* non-null if status requested */
117 BOOL verify_required;
118 } client;
119 } u_ocsp;
120 #endif
121 uschar *dhparam;
122 /* these are cached from first expand */
123 uschar *server_cipher_list;
124 /* only passed down to tls_error: */
125 host_item *host;
126 const uschar * verify_cert_hostnames;
127 #ifdef EXPERIMENTAL_EVENT
128 uschar * event_action;
129 #endif
130 } tls_ext_ctx_cb;
131
132 /* should figure out a cleanup of API to handle state preserved per
133 implementation, for various reasons, which can be void * in the APIs.
134 For now, we hack around it. */
135 tls_ext_ctx_cb *client_static_cbinfo = NULL;
136 tls_ext_ctx_cb *server_static_cbinfo = NULL;
137
138 static int
139 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
140 int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
141
142 /* Callbacks */
143 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
144 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
145 #endif
146 #ifndef DISABLE_OCSP
147 static int tls_server_stapling_cb(SSL *s, void *arg);
148 #endif
149
150
151 /*************************************************
152 * Handle TLS error *
153 *************************************************/
154
155 /* Called from lots of places when errors occur before actually starting to do
156 the TLS handshake, that is, while the session is still in clear. Always returns
157 DEFER for a server and FAIL for a client so that most calls can use "return
158 tls_error(...)" to do this processing and then give an appropriate return. A
159 single function is used for both server and client, because it is called from
160 some shared functions.
161
162 Argument:
163 prefix text to include in the logged error
164 host NULL if setting up a server;
165 the connected host if setting up a client
166 msg error message or NULL if we should ask OpenSSL
167
168 Returns: OK/DEFER/FAIL
169 */
170
171 static int
172 tls_error(uschar * prefix, const host_item * host, uschar * msg)
173 {
174 if (!msg)
175 {
176 ERR_error_string(ERR_get_error(), ssl_errstring);
177 msg = (uschar *)ssl_errstring;
178 }
179
180 if (host)
181 {
182 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s): %s",
183 host->name, host->address, prefix, msg);
184 return FAIL;
185 }
186 else
187 {
188 uschar *conn_info = smtp_get_connection_info();
189 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
190 conn_info += 5;
191 /* I'd like to get separated H= here, but too hard for now */
192 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
193 conn_info, prefix, msg);
194 return DEFER;
195 }
196 }
197
198
199
200 /*************************************************
201 * Callback to generate RSA key *
202 *************************************************/
203
204 /*
205 Arguments:
206 s SSL connection
207 export not used
208 keylength keylength
209
210 Returns: pointer to generated key
211 */
212
213 static RSA *
214 rsa_callback(SSL *s, int export, int keylength)
215 {
216 RSA *rsa_key;
217 export = export; /* Shut picky compilers up */
218 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
219 rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
220 if (rsa_key == NULL)
221 {
222 ERR_error_string(ERR_get_error(), ssl_errstring);
223 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
224 ssl_errstring);
225 return NULL;
226 }
227 return rsa_key;
228 }
229
230
231
232 /* Extreme debug
233 #ifndef DISABLE_OCSP
234 void
235 x509_store_dump_cert_s_names(X509_STORE * store)
236 {
237 STACK_OF(X509_OBJECT) * roots= store->objs;
238 int i;
239 static uschar name[256];
240
241 for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
242 {
243 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
244 if(tmp_obj->type == X509_LU_X509)
245 {
246 X509 * current_cert= tmp_obj->data.x509;
247 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
248 name[sizeof(name)-1] = '\0';
249 debug_printf(" %s\n", name);
250 }
251 }
252 }
253 #endif
254 */
255
256
257 #ifdef EXPERIMENTAL_EVENT
258 static int
259 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
260 BOOL *calledp, const BOOL *optionalp, const uschar * what)
261 {
262 uschar * ev;
263 uschar * yield;
264 X509 * old_cert;
265
266 ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
267 if (ev)
268 {
269 old_cert = tlsp->peercert;
270 tlsp->peercert = X509_dup(cert);
271 /* NB we do not bother setting peerdn */
272 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
273 {
274 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
275 "depth=%d cert=%s: %s",
276 tlsp == &tls_out ? deliver_host_address : sender_host_address,
277 what, depth, dn, yield);
278 *calledp = TRUE;
279 if (!*optionalp)
280 {
281 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
282 return 1; /* reject (leaving peercert set) */
283 }
284 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
285 "(host in tls_try_verify_hosts)\n");
286 }
287 X509_free(tlsp->peercert);
288 tlsp->peercert = old_cert;
289 }
290 return 0;
291 }
292 #endif
293
294 /*************************************************
295 * Callback for verification *
296 *************************************************/
297
298 /* The SSL library does certificate verification if set up to do so. This
299 callback has the current yes/no state is in "state". If verification succeeded,
300 we set the certificate-verified flag. If verification failed, what happens
301 depends on whether the client is required to present a verifiable certificate
302 or not.
303
304 If verification is optional, we change the state to yes, but still log the
305 verification error. For some reason (it really would help to have proper
306 documentation of OpenSSL), this callback function then gets called again, this
307 time with state = 1. We must take care not to set the private verified flag on
308 the second time through.
309
310 Note: this function is not called if the client fails to present a certificate
311 when asked. We get here only if a certificate has been received. Handling of
312 optional verification for this case is done when requesting SSL to verify, by
313 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
314
315 May be called multiple times for different issues with a certificate, even
316 for a given "depth" in the certificate chain.
317
318 Arguments:
319 state current yes/no state as 1/0
320 x509ctx certificate information.
321 client TRUE for client startup, FALSE for server startup
322
323 Returns: 1 if verified, 0 if not
324 */
325
326 static int
327 verify_callback(int state, X509_STORE_CTX *x509ctx,
328 tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
329 {
330 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
331 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
332 uschar dn[256];
333
334 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
335 dn[sizeof(dn)-1] = '\0';
336
337 if (state == 0)
338 {
339 log_write(0, LOG_MAIN, "[%s] SSL verify error: depth=%d error=%s cert=%s",
340 tlsp == &tls_out ? deliver_host_address : sender_host_address,
341 depth,
342 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
343 dn);
344 *calledp = TRUE;
345 if (!*optionalp)
346 {
347 if (!tlsp->peercert)
348 tlsp->peercert = X509_dup(cert); /* record failing cert */
349 return 0; /* reject */
350 }
351 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
352 "tls_try_verify_hosts)\n");
353 }
354
355 else if (depth != 0)
356 {
357 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
358 #ifndef DISABLE_OCSP
359 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
360 { /* client, wanting stapling */
361 /* Add the server cert's signing chain as the one
362 for the verification of the OCSP stapled information. */
363
364 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
365 cert))
366 ERR_clear_error();
367 }
368 #endif
369 #ifdef EXPERIMENTAL_EVENT
370 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
371 return 0; /* reject, with peercert set */
372 #endif
373 }
374 else
375 {
376 const uschar * verify_cert_hostnames;
377
378 if ( tlsp == &tls_out
379 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
380 /* client, wanting hostname check */
381 {
382
383 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
384 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
385 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
386 # endif
387 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
388 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
389 # endif
390 int sep = 0;
391 const uschar * list = verify_cert_hostnames;
392 uschar * name;
393 int rc;
394 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
395 if ((rc = X509_check_host(cert, name, 0,
396 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
397 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
398 NULL)))
399 {
400 if (rc < 0)
401 {
402 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
403 tlsp == &tls_out ? deliver_host_address : sender_host_address);
404 name = NULL;
405 }
406 break;
407 }
408 if (!name)
409 #else
410 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
411 #endif
412 {
413 log_write(0, LOG_MAIN,
414 "[%s] SSL verify error: certificate name mismatch: \"%s\"",
415 tlsp == &tls_out ? deliver_host_address : sender_host_address,
416 dn);
417 *calledp = TRUE;
418 if (!*optionalp)
419 {
420 if (!tlsp->peercert)
421 tlsp->peercert = X509_dup(cert); /* record failing cert */
422 return 0; /* reject */
423 }
424 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
425 "tls_try_verify_hosts)\n");
426 }
427 }
428
429 #ifdef EXPERIMENTAL_EVENT
430 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
431 return 0; /* reject, with peercert set */
432 #endif
433
434 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
435 *calledp ? "" : " authenticated", dn);
436 if (!*calledp) tlsp->certificate_verified = TRUE;
437 *calledp = TRUE;
438 }
439
440 return 1; /* accept, at least for this level */
441 }
442
443 static int
444 verify_callback_client(int state, X509_STORE_CTX *x509ctx)
445 {
446 return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
447 }
448
449 static int
450 verify_callback_server(int state, X509_STORE_CTX *x509ctx)
451 {
452 return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
453 }
454
455
456 #ifdef EXPERIMENTAL_DANE
457
458 /* This gets called *by* the dane library verify callback, which interposes
459 itself.
460 */
461 static int
462 verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
463 {
464 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
465 uschar dn[256];
466 #ifdef EXPERIMENTAL_EVENT
467 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
468 BOOL dummy_called, optional = FALSE;
469 #endif
470
471 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
472 dn[sizeof(dn)-1] = '\0';
473
474 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", dn);
475
476 #ifdef EXPERIMENTAL_EVENT
477 if (verify_event(&tls_out, cert, depth, dn,
478 &dummy_called, &optional, US"DANE"))
479 return 0; /* reject, with peercert set */
480 #endif
481
482 if (state == 1)
483 tls_out.dane_verified =
484 tls_out.certificate_verified = TRUE;
485 return 1;
486 }
487
488 #endif /*EXPERIMENTAL_DANE*/
489
490
491 /*************************************************
492 * Information callback *
493 *************************************************/
494
495 /* The SSL library functions call this from time to time to indicate what they
496 are doing. We copy the string to the debugging output when TLS debugging has
497 been requested.
498
499 Arguments:
500 s the SSL connection
501 where
502 ret
503
504 Returns: nothing
505 */
506
507 static void
508 info_callback(SSL *s, int where, int ret)
509 {
510 where = where;
511 ret = ret;
512 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
513 }
514
515
516
517 /*************************************************
518 * Initialize for DH *
519 *************************************************/
520
521 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
522
523 Arguments:
524 sctx The current SSL CTX (inbound or outbound)
525 dhparam DH parameter file or fixed parameter identity string
526 host connected host, if client; NULL if server
527
528 Returns: TRUE if OK (nothing to set up, or setup worked)
529 */
530
531 static BOOL
532 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host)
533 {
534 BIO *bio;
535 DH *dh;
536 uschar *dhexpanded;
537 const char *pem;
538
539 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
540 return FALSE;
541
542 if (!dhexpanded || !*dhexpanded)
543 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
544 else if (dhexpanded[0] == '/')
545 {
546 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
547 {
548 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
549 host, US strerror(errno));
550 return FALSE;
551 }
552 }
553 else
554 {
555 if (Ustrcmp(dhexpanded, "none") == 0)
556 {
557 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
558 return TRUE;
559 }
560
561 if (!(pem = std_dh_prime_named(dhexpanded)))
562 {
563 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
564 host, US strerror(errno));
565 return FALSE;
566 }
567 bio = BIO_new_mem_buf(CS pem, -1);
568 }
569
570 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
571 {
572 BIO_free(bio);
573 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
574 host, NULL);
575 return FALSE;
576 }
577
578 /* Even if it is larger, we silently return success rather than cause things
579 * to fail out, so that a too-large DH will not knock out all TLS; it's a
580 * debatable choice. */
581 if ((8*DH_size(dh)) > tls_dh_max_bits)
582 {
583 DEBUG(D_tls)
584 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
585 8*DH_size(dh), tls_dh_max_bits);
586 }
587 else
588 {
589 SSL_CTX_set_tmp_dh(sctx, dh);
590 DEBUG(D_tls)
591 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
592 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
593 }
594
595 DH_free(dh);
596 BIO_free(bio);
597
598 return TRUE;
599 }
600
601
602
603
604 /*************************************************
605 * Initialize for ECDH *
606 *************************************************/
607
608 /* Load parameters for ECDH encryption.
609
610 For now, we stick to NIST P-256 because: it's simple and easy to configure;
611 it avoids any patent issues that might bite redistributors; despite events in
612 the news and concerns over curve choices, we're not cryptographers, we're not
613 pretending to be, and this is "good enough" to be better than no support,
614 protecting against most adversaries. Given another year or two, there might
615 be sufficient clarity about a "right" way forward to let us make an informed
616 decision, instead of a knee-jerk reaction.
617
618 Longer-term, we should look at supporting both various named curves and
619 external files generated with "openssl ecparam", much as we do for init_dh().
620 We should also support "none" as a value, to explicitly avoid initialisation.
621
622 Patches welcome.
623
624 Arguments:
625 sctx The current SSL CTX (inbound or outbound)
626 host connected host, if client; NULL if server
627
628 Returns: TRUE if OK (nothing to set up, or setup worked)
629 */
630
631 static BOOL
632 init_ecdh(SSL_CTX *sctx, host_item *host)
633 {
634 if (host) /* No ECDH setup for clients, only for servers */
635 return TRUE;
636
637 #ifndef SSL_CTX_set_tmp_ecdh
638 /* No elliptic curve API in OpenSSL, skip it */
639 DEBUG(D_tls)
640 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
641 return TRUE;
642 #else
643 # ifndef NID_X9_62_prime256v1
644 /* For now, stick to NIST P-256 to get "something" running.
645 If that's not available, bail */
646 DEBUG(D_tls)
647 debug_printf("NIST P-256 EC curve not available, skipping ECDH setup\n");
648 return TRUE;
649 # else
650 {
651 EC_KEY * ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
652 BOOL rv;
653
654 /* The "tmp" in the name here refers to setting a tempoary key
655 not to the stability of the interface. */
656
657 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) != 0))
658 {
659 DEBUG(D_tls) debug_printf("ECDH: enable NIST P-256 curve\n");
660 }
661 else
662 tls_error(US"Error enabling NIST P-256 curve", host, NULL);
663 EC_KEY_free(ecdh);
664 return rv;
665 }
666 # endif
667 #endif
668 }
669
670
671
672
673 #ifndef DISABLE_OCSP
674 /*************************************************
675 * Load OCSP information into state *
676 *************************************************/
677
678 /* Called to load the server OCSP response from the given file into memory, once
679 caller has determined this is needed. Checks validity. Debugs a message
680 if invalid.
681
682 ASSUMES: single response, for single cert.
683
684 Arguments:
685 sctx the SSL_CTX* to update
686 cbinfo various parts of session state
687 expanded the filename putatively holding an OCSP response
688
689 */
690
691 static void
692 ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
693 {
694 BIO *bio;
695 OCSP_RESPONSE *resp;
696 OCSP_BASICRESP *basic_response;
697 OCSP_SINGLERESP *single_response;
698 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
699 X509_STORE *store;
700 unsigned long verify_flags;
701 int status, reason, i;
702
703 cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
704 if (cbinfo->u_ocsp.server.response)
705 {
706 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
707 cbinfo->u_ocsp.server.response = NULL;
708 }
709
710 bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
711 if (!bio)
712 {
713 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
714 cbinfo->u_ocsp.server.file_expanded);
715 return;
716 }
717
718 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
719 BIO_free(bio);
720 if (!resp)
721 {
722 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
723 return;
724 }
725
726 status = OCSP_response_status(resp);
727 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
728 {
729 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
730 OCSP_response_status_str(status), status);
731 goto bad;
732 }
733
734 basic_response = OCSP_response_get1_basic(resp);
735 if (!basic_response)
736 {
737 DEBUG(D_tls)
738 debug_printf("OCSP response parse error: unable to extract basic response.\n");
739 goto bad;
740 }
741
742 store = SSL_CTX_get_cert_store(sctx);
743 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
744
745 /* May need to expose ability to adjust those flags?
746 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
747 OCSP_TRUSTOTHER OCSP_NOINTERN */
748
749 i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
750 if (i <= 0)
751 {
752 DEBUG(D_tls) {
753 ERR_error_string(ERR_get_error(), ssl_errstring);
754 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
755 }
756 goto bad;
757 }
758
759 /* Here's the simplifying assumption: there's only one response, for the
760 one certificate we use, and nothing for anything else in a chain. If this
761 proves false, we need to extract a cert id from our issued cert
762 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
763 right cert in the stack and then calls OCSP_single_get0_status()).
764
765 I'm hoping to avoid reworking a bunch more of how we handle state here. */
766 single_response = OCSP_resp_get0(basic_response, 0);
767 if (!single_response)
768 {
769 DEBUG(D_tls)
770 debug_printf("Unable to get first response from OCSP basic response.\n");
771 goto bad;
772 }
773
774 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
775 if (status != V_OCSP_CERTSTATUS_GOOD)
776 {
777 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
778 OCSP_cert_status_str(status), status,
779 OCSP_crl_reason_str(reason), reason);
780 goto bad;
781 }
782
783 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
784 {
785 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
786 goto bad;
787 }
788
789 supply_response:
790 cbinfo->u_ocsp.server.response = resp;
791 return;
792
793 bad:
794 if (running_in_test_harness)
795 {
796 extern char ** environ;
797 uschar ** p;
798 for (p = USS environ; *p != NULL; p++)
799 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
800 {
801 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
802 goto supply_response;
803 }
804 }
805 return;
806 }
807 #endif /*!DISABLE_OCSP*/
808
809
810
811
812 /*************************************************
813 * Expand key and cert file specs *
814 *************************************************/
815
816 /* Called once during tls_init and possibly again during TLS setup, for a
817 new context, if Server Name Indication was used and tls_sni was seen in
818 the certificate string.
819
820 Arguments:
821 sctx the SSL_CTX* to update
822 cbinfo various parts of session state
823
824 Returns: OK/DEFER/FAIL
825 */
826
827 static int
828 tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
829 {
830 uschar *expanded;
831
832 if (cbinfo->certificate == NULL)
833 return OK;
834
835 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
836 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
837 Ustrstr(cbinfo->certificate, US"tls_out_sni")
838 )
839 reexpand_tls_files_for_sni = TRUE;
840
841 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
842 return DEFER;
843
844 if (expanded != NULL)
845 {
846 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
847 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
848 return tls_error(string_sprintf(
849 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
850 cbinfo->host, NULL);
851 }
852
853 if (cbinfo->privatekey != NULL &&
854 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
855 return DEFER;
856
857 /* If expansion was forced to fail, key_expanded will be NULL. If the result
858 of the expansion is an empty string, ignore it also, and assume the private
859 key is in the same file as the certificate. */
860
861 if (expanded != NULL && *expanded != 0)
862 {
863 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
864 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
865 return tls_error(string_sprintf(
866 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
867 }
868
869 #ifndef DISABLE_OCSP
870 if (cbinfo->is_server && cbinfo->u_ocsp.server.file != NULL)
871 {
872 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
873 return DEFER;
874
875 if (expanded != NULL && *expanded != 0)
876 {
877 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
878 if (cbinfo->u_ocsp.server.file_expanded &&
879 (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
880 {
881 DEBUG(D_tls)
882 debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
883 } else {
884 ocsp_load_response(sctx, cbinfo, expanded);
885 }
886 }
887 }
888 #endif
889
890 return OK;
891 }
892
893
894
895
896 /*************************************************
897 * Callback to handle SNI *
898 *************************************************/
899
900 /* Called when acting as server during the TLS session setup if a Server Name
901 Indication extension was sent by the client.
902
903 API documentation is OpenSSL s_server.c implementation.
904
905 Arguments:
906 s SSL* of the current session
907 ad unknown (part of OpenSSL API) (unused)
908 arg Callback of "our" registered data
909
910 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
911 */
912
913 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
914 static int
915 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
916 {
917 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
918 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
919 int rc;
920 int old_pool = store_pool;
921
922 if (!servername)
923 return SSL_TLSEXT_ERR_OK;
924
925 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
926 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
927
928 /* Make the extension value available for expansion */
929 store_pool = POOL_PERM;
930 tls_in.sni = string_copy(US servername);
931 store_pool = old_pool;
932
933 if (!reexpand_tls_files_for_sni)
934 return SSL_TLSEXT_ERR_OK;
935
936 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
937 not confident that memcpy wouldn't break some internal reference counting.
938 Especially since there's a references struct member, which would be off. */
939
940 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
941 {
942 ERR_error_string(ERR_get_error(), ssl_errstring);
943 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
944 return SSL_TLSEXT_ERR_NOACK;
945 }
946
947 /* Not sure how many of these are actually needed, since SSL object
948 already exists. Might even need this selfsame callback, for reneg? */
949
950 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
951 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
952 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
953 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
954 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
955 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
956
957 if ( !init_dh(server_sni, cbinfo->dhparam, NULL)
958 || !init_ecdh(server_sni, NULL)
959 )
960 return SSL_TLSEXT_ERR_NOACK;
961
962 if (cbinfo->server_cipher_list)
963 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
964 #ifndef DISABLE_OCSP
965 if (cbinfo->u_ocsp.server.file)
966 {
967 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
968 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
969 }
970 #endif
971
972 rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
973 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
974
975 /* do this after setup_certs, because this can require the certs for verifying
976 OCSP information. */
977 if ((rc = tls_expand_session_files(server_sni, cbinfo)) != OK)
978 return SSL_TLSEXT_ERR_NOACK;
979
980 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
981 SSL_set_SSL_CTX(s, server_sni);
982
983 return SSL_TLSEXT_ERR_OK;
984 }
985 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
986
987
988
989
990 #ifndef DISABLE_OCSP
991
992 /*************************************************
993 * Callback to handle OCSP Stapling *
994 *************************************************/
995
996 /* Called when acting as server during the TLS session setup if the client
997 requests OCSP information with a Certificate Status Request.
998
999 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1000 project.
1001
1002 */
1003
1004 static int
1005 tls_server_stapling_cb(SSL *s, void *arg)
1006 {
1007 const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1008 uschar *response_der;
1009 int response_der_len;
1010
1011 DEBUG(D_tls)
1012 debug_printf("Received TLS status request (OCSP stapling); %s response.",
1013 cbinfo->u_ocsp.server.response ? "have" : "lack");
1014
1015 tls_in.ocsp = OCSP_NOT_RESP;
1016 if (!cbinfo->u_ocsp.server.response)
1017 return SSL_TLSEXT_ERR_NOACK;
1018
1019 response_der = NULL;
1020 response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
1021 &response_der);
1022 if (response_der_len <= 0)
1023 return SSL_TLSEXT_ERR_NOACK;
1024
1025 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
1026 tls_in.ocsp = OCSP_VFIED;
1027 return SSL_TLSEXT_ERR_OK;
1028 }
1029
1030
1031 static void
1032 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1033 {
1034 BIO_printf(bp, "\t%s: ", str);
1035 ASN1_GENERALIZEDTIME_print(bp, time);
1036 BIO_puts(bp, "\n");
1037 }
1038
1039 static int
1040 tls_client_stapling_cb(SSL *s, void *arg)
1041 {
1042 tls_ext_ctx_cb * cbinfo = arg;
1043 const unsigned char * p;
1044 int len;
1045 OCSP_RESPONSE * rsp;
1046 OCSP_BASICRESP * bs;
1047 int i;
1048
1049 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
1050 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1051 if(!p)
1052 {
1053 /* Expect this when we requested ocsp but got none */
1054 if ( cbinfo->u_ocsp.client.verify_required
1055 && log_extra_selector & LX_tls_cipher)
1056 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
1057 else
1058 DEBUG(D_tls) debug_printf(" null\n");
1059 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1060 }
1061
1062 if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1063 {
1064 tls_out.ocsp = OCSP_FAILED;
1065 if (log_extra_selector & LX_tls_cipher)
1066 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
1067 else
1068 DEBUG(D_tls) debug_printf(" parse error\n");
1069 return 0;
1070 }
1071
1072 if(!(bs = OCSP_response_get1_basic(rsp)))
1073 {
1074 tls_out.ocsp = OCSP_FAILED;
1075 if (log_extra_selector & LX_tls_cipher)
1076 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
1077 else
1078 DEBUG(D_tls) debug_printf(" error parsing response\n");
1079 OCSP_RESPONSE_free(rsp);
1080 return 0;
1081 }
1082
1083 /* We'd check the nonce here if we'd put one in the request. */
1084 /* However that would defeat cacheability on the server so we don't. */
1085
1086 /* This section of code reworked from OpenSSL apps source;
1087 The OpenSSL Project retains copyright:
1088 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1089 */
1090 {
1091 BIO * bp = NULL;
1092 int status, reason;
1093 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1094
1095 DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1096
1097 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1098
1099 /* Use the chain that verified the server cert to verify the stapled info */
1100 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1101
1102 if ((i = OCSP_basic_verify(bs, NULL,
1103 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
1104 {
1105 tls_out.ocsp = OCSP_FAILED;
1106 if (log_extra_selector & LX_tls_cipher)
1107 log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
1108 BIO_printf(bp, "OCSP response verify failure\n");
1109 ERR_print_errors(bp);
1110 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1111 goto out;
1112 }
1113
1114 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1115
1116 {
1117 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1118 OCSP_SINGLERESP * single;
1119
1120 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1121 {
1122 tls_out.ocsp = OCSP_FAILED;
1123 log_write(0, LOG_MAIN, "OCSP stapling "
1124 "with multiple responses not handled");
1125 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1126 goto out;
1127 }
1128 single = OCSP_resp_get0(bs, 0);
1129 status = OCSP_single_get0_status(single, &reason, &rev,
1130 &thisupd, &nextupd);
1131 }
1132
1133 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1134 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1135 if (!OCSP_check_validity(thisupd, nextupd,
1136 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1137 {
1138 tls_out.ocsp = OCSP_FAILED;
1139 DEBUG(D_tls) ERR_print_errors(bp);
1140 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1141 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1142 }
1143 else
1144 {
1145 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1146 OCSP_cert_status_str(status));
1147 switch(status)
1148 {
1149 case V_OCSP_CERTSTATUS_GOOD:
1150 tls_out.ocsp = OCSP_VFIED;
1151 i = 1;
1152 break;
1153 case V_OCSP_CERTSTATUS_REVOKED:
1154 tls_out.ocsp = OCSP_FAILED;
1155 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1156 reason != -1 ? "; reason: " : "",
1157 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1158 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1159 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1160 break;
1161 default:
1162 tls_out.ocsp = OCSP_FAILED;
1163 log_write(0, LOG_MAIN,
1164 "Server certificate status unknown, in OCSP stapling");
1165 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1166 break;
1167 }
1168 }
1169 out:
1170 BIO_free(bp);
1171 }
1172
1173 OCSP_RESPONSE_free(rsp);
1174 return i;
1175 }
1176 #endif /*!DISABLE_OCSP*/
1177
1178
1179 /*************************************************
1180 * Initialize for TLS *
1181 *************************************************/
1182
1183 /* Called from both server and client code, to do preliminary initialization
1184 of the library. We allocate and return a context structure.
1185
1186 Arguments:
1187 ctxp returned SSL context
1188 host connected host, if client; NULL if server
1189 dhparam DH parameter file
1190 certificate certificate file
1191 privatekey private key
1192 ocsp_file file of stapling info (server); flag for require ocsp (client)
1193 addr address if client; NULL if server (for some randomness)
1194 cbp place to put allocated callback context
1195
1196 Returns: OK/DEFER/FAIL
1197 */
1198
1199 static int
1200 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
1201 uschar *privatekey,
1202 #ifndef DISABLE_OCSP
1203 uschar *ocsp_file,
1204 #endif
1205 address_item *addr, tls_ext_ctx_cb ** cbp)
1206 {
1207 long init_options;
1208 int rc;
1209 BOOL okay;
1210 tls_ext_ctx_cb * cbinfo;
1211
1212 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1213 cbinfo->certificate = certificate;
1214 cbinfo->privatekey = privatekey;
1215 #ifndef DISABLE_OCSP
1216 if ((cbinfo->is_server = host==NULL))
1217 {
1218 cbinfo->u_ocsp.server.file = ocsp_file;
1219 cbinfo->u_ocsp.server.file_expanded = NULL;
1220 cbinfo->u_ocsp.server.response = NULL;
1221 }
1222 else
1223 cbinfo->u_ocsp.client.verify_store = NULL;
1224 #endif
1225 cbinfo->dhparam = dhparam;
1226 cbinfo->server_cipher_list = NULL;
1227 cbinfo->host = host;
1228 #ifdef EXPERIMENTAL_EVENT
1229 cbinfo->event_action = NULL;
1230 #endif
1231
1232 SSL_load_error_strings(); /* basic set up */
1233 OpenSSL_add_ssl_algorithms();
1234
1235 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
1236 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1237 list of available digests. */
1238 EVP_add_digest(EVP_sha256());
1239 #endif
1240
1241 /* Create a context.
1242 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1243 negotiation in the different methods; as far as I can tell, the only
1244 *_{server,client}_method which allows negotiation is SSLv23, which exists even
1245 when OpenSSL is built without SSLv2 support.
1246 By disabling with openssl_options, we can let admins re-enable with the
1247 existing knob. */
1248
1249 *ctxp = SSL_CTX_new((host == NULL)?
1250 SSLv23_server_method() : SSLv23_client_method());
1251
1252 if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
1253
1254 /* It turns out that we need to seed the random number generator this early in
1255 order to get the full complement of ciphers to work. It took me roughly a day
1256 of work to discover this by experiment.
1257
1258 On systems that have /dev/urandom, SSL may automatically seed itself from
1259 there. Otherwise, we have to make something up as best we can. Double check
1260 afterwards. */
1261
1262 if (!RAND_status())
1263 {
1264 randstuff r;
1265 gettimeofday(&r.tv, NULL);
1266 r.p = getpid();
1267
1268 RAND_seed((uschar *)(&r), sizeof(r));
1269 RAND_seed((uschar *)big_buffer, big_buffer_size);
1270 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1271
1272 if (!RAND_status())
1273 return tls_error(US"RAND_status", host,
1274 US"unable to seed random number generator");
1275 }
1276
1277 /* Set up the information callback, which outputs if debugging is at a suitable
1278 level. */
1279
1280 DEBUG(D_tls) SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
1281
1282 /* Automatically re-try reads/writes after renegotiation. */
1283 (void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
1284
1285 /* Apply administrator-supplied work-arounds.
1286 Historically we applied just one requested option,
1287 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1288 moved to an administrator-controlled list of options to specify and
1289 grandfathered in the first one as the default value for "openssl_options".
1290
1291 No OpenSSL version number checks: the options we accept depend upon the
1292 availability of the option value macros from OpenSSL. */
1293
1294 okay = tls_openssl_options_parse(openssl_options, &init_options);
1295 if (!okay)
1296 return tls_error(US"openssl_options parsing failed", host, NULL);
1297
1298 if (init_options)
1299 {
1300 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
1301 if (!(SSL_CTX_set_options(*ctxp, init_options)))
1302 return tls_error(string_sprintf(
1303 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1304 }
1305 else
1306 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
1307
1308 /* Initialize with DH parameters if supplied */
1309
1310 if ( !init_dh(*ctxp, dhparam, host)
1311 || !init_ecdh(*ctxp, host)
1312 )
1313 return DEFER;
1314
1315 /* Set up certificate and key (and perhaps OCSP info) */
1316
1317 rc = tls_expand_session_files(*ctxp, cbinfo);
1318 if (rc != OK) return rc;
1319
1320 /* If we need to handle SNI, do so */
1321 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1322 if (host == NULL) /* server */
1323 {
1324 # ifndef DISABLE_OCSP
1325 /* We check u_ocsp.server.file, not server.response, because we care about if
1326 the option exists, not what the current expansion might be, as SNI might
1327 change the certificate and OCSP file in use between now and the time the
1328 callback is invoked. */
1329 if (cbinfo->u_ocsp.server.file)
1330 {
1331 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
1332 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
1333 }
1334 # endif
1335 /* We always do this, so that $tls_sni is available even if not used in
1336 tls_certificate */
1337 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1338 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
1339 }
1340 # ifndef DISABLE_OCSP
1341 else /* client */
1342 if(ocsp_file) /* wanting stapling */
1343 {
1344 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1345 {
1346 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1347 return FAIL;
1348 }
1349 SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1350 SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1351 }
1352 # endif
1353 #endif
1354
1355 cbinfo->verify_cert_hostnames = NULL;
1356
1357 /* Set up the RSA callback */
1358
1359 SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
1360
1361 /* Finally, set the timeout, and we are done */
1362
1363 SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
1364 DEBUG(D_tls) debug_printf("Initialized TLS\n");
1365
1366 *cbp = cbinfo;
1367
1368 return OK;
1369 }
1370
1371
1372
1373
1374 /*************************************************
1375 * Get name of cipher in use *
1376 *************************************************/
1377
1378 /*
1379 Argument: pointer to an SSL structure for the connection
1380 buffer to use for answer
1381 size of buffer
1382 pointer to number of bits for cipher
1383 Returns: nothing
1384 */
1385
1386 static void
1387 construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
1388 {
1389 /* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1390 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1391 the accessor functions use const in the prototype. */
1392 const SSL_CIPHER *c;
1393 const uschar *ver;
1394
1395 ver = (const uschar *)SSL_get_version(ssl);
1396
1397 c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
1398 SSL_CIPHER_get_bits(c, bits);
1399
1400 string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1401 SSL_CIPHER_get_name(c), *bits);
1402
1403 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1404 }
1405
1406
1407 static void
1408 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned bsize)
1409 {
1410 /*XXX we might consider a list-of-certs variable for the cert chain.
1411 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
1412 in list-handling functions, also consider the difference between the entire
1413 chain and the elements sent by the peer. */
1414
1415 /* Will have already noted peercert on a verify fail; possibly not the leaf */
1416 if (!tlsp->peercert)
1417 tlsp->peercert = SSL_get_peer_certificate(ssl);
1418 /* Beware anonymous ciphers which lead to server_cert being NULL */
1419 if (tlsp->peercert)
1420 {
1421 X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, bsize);
1422 peerdn[bsize-1] = '\0';
1423 tlsp->peerdn = peerdn; /*XXX a static buffer... */
1424 }
1425 else
1426 tlsp->peerdn = NULL;
1427 }
1428
1429
1430
1431
1432
1433 /*************************************************
1434 * Set up for verifying certificates *
1435 *************************************************/
1436
1437 /* Called by both client and server startup
1438
1439 Arguments:
1440 sctx SSL_CTX* to initialise
1441 certs certs file or NULL
1442 crl CRL file or NULL
1443 host NULL in a server; the remote host in a client
1444 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1445 otherwise passed as FALSE
1446 cert_vfy_cb Callback function for certificate verification
1447
1448 Returns: OK/DEFER/FAIL
1449 */
1450
1451 static int
1452 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1453 int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
1454 {
1455 uschar *expcerts, *expcrl;
1456
1457 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1458 return DEFER;
1459
1460 if (expcerts != NULL && *expcerts != '\0')
1461 {
1462 if (Ustrcmp(expcerts, "system") == 0)
1463 {
1464 /* Tell the library to use its compiled-in location for the system default
1465 CA bundle, only */
1466
1467 if (!SSL_CTX_set_default_verify_paths(sctx))
1468 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1469 }
1470 else
1471 {
1472 struct stat statbuf;
1473
1474 /* Tell the library to use its compiled-in location for the system default
1475 CA bundle. Those given by the exim config are additional to these */
1476
1477 if (!SSL_CTX_set_default_verify_paths(sctx))
1478 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1479
1480 if (Ustat(expcerts, &statbuf) < 0)
1481 {
1482 log_write(0, LOG_MAIN|LOG_PANIC,
1483 "failed to stat %s for certificates", expcerts);
1484 return DEFER;
1485 }
1486 else
1487 {
1488 uschar *file, *dir;
1489 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1490 { file = NULL; dir = expcerts; }
1491 else
1492 { file = expcerts; dir = NULL; }
1493
1494 /* If a certificate file is empty, the next function fails with an
1495 unhelpful error message. If we skip it, we get the correct behaviour (no
1496 certificates are recognized, but the error message is still misleading (it
1497 says no certificate was supplied.) But this is better. */
1498
1499 if ((file == NULL || statbuf.st_size > 0) &&
1500 !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1501 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1502
1503 /* Load the list of CAs for which we will accept certs, for sending
1504 to the client. This is only for the one-file tls_verify_certificates
1505 variant.
1506 If a list isn't loaded into the server, but
1507 some verify locations are set, the server end appears to make
1508 a wildcard reqest for client certs.
1509 Meanwhile, the client library as deafult behaviour *ignores* the list
1510 we send over the wire - see man SSL_CTX_set_client_cert_cb.
1511 Because of this, and that the dir variant is likely only used for
1512 the public-CA bundle (not for a private CA), not worth fixing.
1513 */
1514 if (file != NULL)
1515 {
1516 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
1517 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
1518 sk_X509_NAME_num(names));
1519 SSL_CTX_set_client_CA_list(sctx, names);
1520 }
1521 }
1522 }
1523
1524 /* Handle a certificate revocation list. */
1525
1526 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1527
1528 /* This bit of code is now the version supplied by Lars Mainka. (I have
1529 * merely reformatted it into the Exim code style.)
1530
1531 * "From here I changed the code to add support for multiple crl's
1532 * in pem format in one file or to support hashed directory entries in
1533 * pem format instead of a file. This method now uses the library function
1534 * X509_STORE_load_locations to add the CRL location to the SSL context.
1535 * OpenSSL will then handle the verify against CA certs and CRLs by
1536 * itself in the verify callback." */
1537
1538 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1539 if (expcrl != NULL && *expcrl != 0)
1540 {
1541 struct stat statbufcrl;
1542 if (Ustat(expcrl, &statbufcrl) < 0)
1543 {
1544 log_write(0, LOG_MAIN|LOG_PANIC,
1545 "failed to stat %s for certificates revocation lists", expcrl);
1546 return DEFER;
1547 }
1548 else
1549 {
1550 /* is it a file or directory? */
1551 uschar *file, *dir;
1552 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
1553 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
1554 {
1555 file = NULL;
1556 dir = expcrl;
1557 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
1558 }
1559 else
1560 {
1561 file = expcrl;
1562 dir = NULL;
1563 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
1564 }
1565 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
1566 return tls_error(US"X509_STORE_load_locations", host, NULL);
1567
1568 /* setting the flags to check against the complete crl chain */
1569
1570 X509_STORE_set_flags(cvstore,
1571 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
1572 }
1573 }
1574
1575 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1576
1577 /* If verification is optional, don't fail if no certificate */
1578
1579 SSL_CTX_set_verify(sctx,
1580 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
1581 cert_vfy_cb);
1582 }
1583
1584 return OK;
1585 }
1586
1587
1588
1589 /*************************************************
1590 * Start a TLS session in a server *
1591 *************************************************/
1592
1593 /* This is called when Exim is running as a server, after having received
1594 the STARTTLS command. It must respond to that command, and then negotiate
1595 a TLS session.
1596
1597 Arguments:
1598 require_ciphers allowed ciphers
1599
1600 Returns: OK on success
1601 DEFER for errors before the start of the negotiation
1602 FAIL for errors during the negotation; the server can't
1603 continue running.
1604 */
1605
1606 int
1607 tls_server_start(const uschar *require_ciphers)
1608 {
1609 int rc;
1610 uschar *expciphers;
1611 tls_ext_ctx_cb *cbinfo;
1612 static uschar peerdn[256];
1613 static uschar cipherbuf[256];
1614
1615 /* Check for previous activation */
1616
1617 if (tls_in.active >= 0)
1618 {
1619 tls_error(US"STARTTLS received after TLS started", NULL, US"");
1620 smtp_printf("554 Already in TLS\r\n");
1621 return FAIL;
1622 }
1623
1624 /* Initialize the SSL library. If it fails, it will already have logged
1625 the error. */
1626
1627 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
1628 #ifndef DISABLE_OCSP
1629 tls_ocsp_file,
1630 #endif
1631 NULL, &server_static_cbinfo);
1632 if (rc != OK) return rc;
1633 cbinfo = server_static_cbinfo;
1634
1635 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1636 return FAIL;
1637
1638 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1639 were historically separated by underscores. So that I can use either form in my
1640 tests, and also for general convenience, we turn underscores into hyphens here.
1641 */
1642
1643 if (expciphers != NULL)
1644 {
1645 uschar *s = expciphers;
1646 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1647 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1648 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
1649 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
1650 cbinfo->server_cipher_list = expciphers;
1651 }
1652
1653 /* If this is a host for which certificate verification is mandatory or
1654 optional, set up appropriately. */
1655
1656 tls_in.certificate_verified = FALSE;
1657 #ifdef EXPERIMENTAL_DANE
1658 tls_in.dane_verified = FALSE;
1659 #endif
1660 server_verify_callback_called = FALSE;
1661
1662 if (verify_check_host(&tls_verify_hosts) == OK)
1663 {
1664 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1665 FALSE, verify_callback_server);
1666 if (rc != OK) return rc;
1667 server_verify_optional = FALSE;
1668 }
1669 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1670 {
1671 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1672 TRUE, verify_callback_server);
1673 if (rc != OK) return rc;
1674 server_verify_optional = TRUE;
1675 }
1676
1677 /* Prepare for new connection */
1678
1679 if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
1680
1681 /* Warning: we used to SSL_clear(ssl) here, it was removed.
1682 *
1683 * With the SSL_clear(), we get strange interoperability bugs with
1684 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1685 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1686 *
1687 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1688 * session shutdown. In this case, we have a brand new object and there's no
1689 * obvious reason to immediately clear it. I'm guessing that this was
1690 * originally added because of incomplete initialisation which the clear fixed,
1691 * in some historic release.
1692 */
1693
1694 /* Set context and tell client to go ahead, except in the case of TLS startup
1695 on connection, where outputting anything now upsets the clients and tends to
1696 make them disconnect. We need to have an explicit fflush() here, to force out
1697 the response. Other smtp_printf() calls do not need it, because in non-TLS
1698 mode, the fflush() happens when smtp_getc() is called. */
1699
1700 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1701 if (!tls_in.on_connect)
1702 {
1703 smtp_printf("220 TLS go ahead\r\n");
1704 fflush(smtp_out);
1705 }
1706
1707 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1708 that the OpenSSL library doesn't. */
1709
1710 SSL_set_wfd(server_ssl, fileno(smtp_out));
1711 SSL_set_rfd(server_ssl, fileno(smtp_in));
1712 SSL_set_accept_state(server_ssl);
1713
1714 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1715
1716 sigalrm_seen = FALSE;
1717 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1718 rc = SSL_accept(server_ssl);
1719 alarm(0);
1720
1721 if (rc <= 0)
1722 {
1723 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
1724 if (ERR_get_error() == 0)
1725 log_write(0, LOG_MAIN,
1726 "TLS client disconnected cleanly (rejected our certificate?)");
1727 return FAIL;
1728 }
1729
1730 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1731
1732 /* TLS has been set up. Adjust the input functions to read via TLS,
1733 and initialize things. */
1734
1735 peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
1736
1737 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1738 tls_in.cipher = cipherbuf;
1739
1740 DEBUG(D_tls)
1741 {
1742 uschar buf[2048];
1743 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
1744 debug_printf("Shared ciphers: %s\n", buf);
1745 }
1746
1747 /* Record the certificate we presented */
1748 {
1749 X509 * crt = SSL_get_certificate(server_ssl);
1750 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1751 }
1752
1753 /* Only used by the server-side tls (tls_in), including tls_getc.
1754 Client-side (tls_out) reads (seem to?) go via
1755 smtp_read_response()/ip_recv().
1756 Hence no need to duplicate for _in and _out.
1757 */
1758 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1759 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1760 ssl_xfer_eof = ssl_xfer_error = 0;
1761
1762 receive_getc = tls_getc;
1763 receive_ungetc = tls_ungetc;
1764 receive_feof = tls_feof;
1765 receive_ferror = tls_ferror;
1766 receive_smtp_buffered = tls_smtp_buffered;
1767
1768 tls_in.active = fileno(smtp_out);
1769 return OK;
1770 }
1771
1772
1773
1774
1775 static int
1776 tls_client_basic_ctx_init(SSL_CTX * ctx,
1777 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo
1778 )
1779 {
1780 int rc;
1781 /* stick to the old behaviour for compatibility if tls_verify_certificates is
1782 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1783 the specified host patterns if one of them is defined */
1784
1785 if ( ( !ob->tls_verify_hosts
1786 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
1787 )
1788 || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
1789 )
1790 client_verify_optional = FALSE;
1791 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
1792 client_verify_optional = TRUE;
1793 else
1794 return OK;
1795
1796 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1797 ob->tls_crl, host, client_verify_optional, verify_callback_client)) != OK)
1798 return rc;
1799
1800 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
1801 {
1802 cbinfo->verify_cert_hostnames =
1803 #ifdef EXPERIMENTAL_INTERNATIONAL
1804 string_domain_utf8_to_alabel(host->name, NULL);
1805 #else
1806 host->name;
1807 #endif
1808 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1809 cbinfo->verify_cert_hostnames);
1810 }
1811 return OK;
1812 }
1813
1814
1815 #ifdef EXPERIMENTAL_DANE
1816 static int
1817 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
1818 {
1819 dns_record * rr;
1820 dns_scan dnss;
1821 const char * hostnames[2] = { CS host->name, NULL };
1822 int found = 0;
1823
1824 if (DANESSL_init(ssl, NULL, hostnames) != 1)
1825 return tls_error(US"hostnames load", host, NULL);
1826
1827 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1828 rr;
1829 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1830 ) if (rr->type == T_TLSA)
1831 {
1832 uschar * p = rr->data;
1833 uint8_t usage, selector, mtype;
1834 const char * mdname;
1835
1836 usage = *p++;
1837
1838 /* Only DANE-TA(2) and DANE-EE(3) are supported */
1839 if (usage != 2 && usage != 3) continue;
1840
1841 selector = *p++;
1842 mtype = *p++;
1843
1844 switch (mtype)
1845 {
1846 default: continue; /* Only match-types 0, 1, 2 are supported */
1847 case 0: mdname = NULL; break;
1848 case 1: mdname = "sha256"; break;
1849 case 2: mdname = "sha512"; break;
1850 }
1851
1852 found++;
1853 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
1854 {
1855 default:
1856 case 0: /* action not taken */
1857 return tls_error(US"tlsa load", host, NULL);
1858 case 1: break;
1859 }
1860
1861 tls_out.tlsa_usage |= 1<<usage;
1862 }
1863
1864 if (found)
1865 return OK;
1866
1867 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
1868 return DEFER;
1869 }
1870 #endif /*EXPERIMENTAL_DANE*/
1871
1872
1873
1874 /*************************************************
1875 * Start a TLS session in a client *
1876 *************************************************/
1877
1878 /* Called from the smtp transport after STARTTLS has been accepted.
1879
1880 Argument:
1881 fd the fd of the connection
1882 host connected host (for messages)
1883 addr the first address
1884 tb transport (always smtp)
1885 tlsa_dnsa tlsa lookup, if DANE, else null
1886
1887 Returns: OK on success
1888 FAIL otherwise - note that tls_error() will not give DEFER
1889 because this is not a server
1890 */
1891
1892 int
1893 tls_client_start(int fd, host_item *host, address_item *addr,
1894 transport_instance *tb
1895 #ifdef EXPERIMENTAL_DANE
1896 , dns_answer * tlsa_dnsa
1897 #endif
1898 )
1899 {
1900 smtp_transport_options_block * ob =
1901 (smtp_transport_options_block *)tb->options_block;
1902 static uschar peerdn[256];
1903 uschar * expciphers;
1904 int rc;
1905 static uschar cipherbuf[256];
1906
1907 #ifndef DISABLE_OCSP
1908 BOOL request_ocsp = FALSE;
1909 BOOL require_ocsp = FALSE;
1910 #endif
1911
1912 #ifdef EXPERIMENTAL_DANE
1913 tls_out.tlsa_usage = 0;
1914 #endif
1915
1916 #ifndef DISABLE_OCSP
1917 {
1918 # ifdef EXPERIMENTAL_DANE
1919 if ( tlsa_dnsa
1920 && ob->hosts_request_ocsp[0] == '*'
1921 && ob->hosts_request_ocsp[1] == '\0'
1922 )
1923 {
1924 /* Unchanged from default. Use a safer one under DANE */
1925 request_ocsp = TRUE;
1926 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
1927 " {= {4}{$tls_out_tlsa_usage}} } "
1928 " {*}{}}";
1929 }
1930 # endif
1931
1932 if ((require_ocsp =
1933 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK))
1934 request_ocsp = TRUE;
1935 else
1936 # ifdef EXPERIMENTAL_DANE
1937 if (!request_ocsp)
1938 # endif
1939 request_ocsp =
1940 verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
1941 }
1942 #endif
1943
1944 rc = tls_init(&client_ctx, host, NULL,
1945 ob->tls_certificate, ob->tls_privatekey,
1946 #ifndef DISABLE_OCSP
1947 (void *)(long)request_ocsp,
1948 #endif
1949 addr, &client_static_cbinfo);
1950 if (rc != OK) return rc;
1951
1952 tls_out.certificate_verified = FALSE;
1953 client_verify_callback_called = FALSE;
1954
1955 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
1956 &expciphers))
1957 return FAIL;
1958
1959 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1960 are separated by underscores. So that I can use either form in my tests, and
1961 also for general convenience, we turn underscores into hyphens here. */
1962
1963 if (expciphers != NULL)
1964 {
1965 uschar *s = expciphers;
1966 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1967 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1968 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
1969 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
1970 }
1971
1972 #ifdef EXPERIMENTAL_DANE
1973 if (tlsa_dnsa)
1974 {
1975 SSL_CTX_set_verify(client_ctx,
1976 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
1977 verify_callback_client_dane);
1978
1979 if (!DANESSL_library_init())
1980 return tls_error(US"library init", host, NULL);
1981 if (DANESSL_CTX_init(client_ctx) <= 0)
1982 return tls_error(US"context init", host, NULL);
1983 }
1984 else
1985
1986 #endif
1987
1988 if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob, client_static_cbinfo))
1989 != OK)
1990 return rc;
1991
1992 if ((client_ssl = SSL_new(client_ctx)) == NULL)
1993 return tls_error(US"SSL_new", host, NULL);
1994 SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1995 SSL_set_fd(client_ssl, fd);
1996 SSL_set_connect_state(client_ssl);
1997
1998 if (ob->tls_sni)
1999 {
2000 if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
2001 return FAIL;
2002 if (tls_out.sni == NULL)
2003 {
2004 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
2005 }
2006 else if (!Ustrlen(tls_out.sni))
2007 tls_out.sni = NULL;
2008 else
2009 {
2010 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2011 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
2012 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
2013 #else
2014 DEBUG(D_tls)
2015 debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
2016 tls_out.sni);
2017 #endif
2018 }
2019 }
2020
2021 #ifdef EXPERIMENTAL_DANE
2022 if (tlsa_dnsa)
2023 if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa)) != OK)
2024 return rc;
2025 #endif
2026
2027 #ifndef DISABLE_OCSP
2028 /* Request certificate status at connection-time. If the server
2029 does OCSP stapling we will get the callback (set in tls_init()) */
2030 # ifdef EXPERIMENTAL_DANE
2031 if (request_ocsp)
2032 {
2033 const uschar * s;
2034 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2035 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2036 )
2037 { /* Re-eval now $tls_out_tlsa_usage is populated. If
2038 this means we avoid the OCSP request, we wasted the setup
2039 cost in tls_init(). */
2040 require_ocsp = verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
2041 request_ocsp = require_ocsp
2042 || verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2043 }
2044 }
2045 # endif
2046
2047 if (request_ocsp)
2048 {
2049 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
2050 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
2051 tls_out.ocsp = OCSP_NOT_RESP;
2052 }
2053 #endif
2054
2055 #ifdef EXPERIMENTAL_EVENT
2056 client_static_cbinfo->event_action = tb->event_action;
2057 #endif
2058
2059 /* There doesn't seem to be a built-in timeout on connection. */
2060
2061 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
2062 sigalrm_seen = FALSE;
2063 alarm(ob->command_timeout);
2064 rc = SSL_connect(client_ssl);
2065 alarm(0);
2066
2067 #ifdef EXPERIMENTAL_DANE
2068 if (tlsa_dnsa)
2069 DANESSL_cleanup(client_ssl);
2070 #endif
2071
2072 if (rc <= 0)
2073 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
2074
2075 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
2076
2077 peer_cert(client_ssl, &tls_out, peerdn, sizeof(peerdn));
2078
2079 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
2080 tls_out.cipher = cipherbuf;
2081
2082 /* Record the certificate we presented */
2083 {
2084 X509 * crt = SSL_get_certificate(client_ssl);
2085 tls_out.ourcert = crt ? X509_dup(crt) : NULL;
2086 }
2087
2088 tls_out.active = fd;
2089 return OK;
2090 }
2091
2092
2093
2094
2095
2096 /*************************************************
2097 * TLS version of getc *
2098 *************************************************/
2099
2100 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2101 it refills the buffer via the SSL reading function.
2102
2103 Arguments: none
2104 Returns: the next character or EOF
2105
2106 Only used by the server-side TLS.
2107 */
2108
2109 int
2110 tls_getc(void)
2111 {
2112 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2113 {
2114 int error;
2115 int inbytes;
2116
2117 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
2118 ssl_xfer_buffer, ssl_xfer_buffer_size);
2119
2120 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2121 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
2122 error = SSL_get_error(server_ssl, inbytes);
2123 alarm(0);
2124
2125 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2126 closed down, not that the socket itself has been closed down. Revert to
2127 non-SSL handling. */
2128
2129 if (error == SSL_ERROR_ZERO_RETURN)
2130 {
2131 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2132
2133 receive_getc = smtp_getc;
2134 receive_ungetc = smtp_ungetc;
2135 receive_feof = smtp_feof;
2136 receive_ferror = smtp_ferror;
2137 receive_smtp_buffered = smtp_buffered;
2138
2139 SSL_free(server_ssl);
2140 server_ssl = NULL;
2141 tls_in.active = -1;
2142 tls_in.bits = 0;
2143 tls_in.cipher = NULL;
2144 tls_in.peerdn = NULL;
2145 tls_in.sni = NULL;
2146
2147 return smtp_getc();
2148 }
2149
2150 /* Handle genuine errors */
2151
2152 else if (error == SSL_ERROR_SSL)
2153 {
2154 ERR_error_string(ERR_get_error(), ssl_errstring);
2155 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
2156 ssl_xfer_error = 1;
2157 return EOF;
2158 }
2159
2160 else if (error != SSL_ERROR_NONE)
2161 {
2162 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2163 ssl_xfer_error = 1;
2164 return EOF;
2165 }
2166
2167 #ifndef DISABLE_DKIM
2168 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2169 #endif
2170 ssl_xfer_buffer_hwm = inbytes;
2171 ssl_xfer_buffer_lwm = 0;
2172 }
2173
2174 /* Something in the buffer; return next uschar */
2175
2176 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2177 }
2178
2179
2180
2181 /*************************************************
2182 * Read bytes from TLS channel *
2183 *************************************************/
2184
2185 /*
2186 Arguments:
2187 buff buffer of data
2188 len size of buffer
2189
2190 Returns: the number of bytes read
2191 -1 after a failed read
2192
2193 Only used by the client-side TLS.
2194 */
2195
2196 int
2197 tls_read(BOOL is_server, uschar *buff, size_t len)
2198 {
2199 SSL *ssl = is_server ? server_ssl : client_ssl;
2200 int inbytes;
2201 int error;
2202
2203 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
2204 buff, (unsigned int)len);
2205
2206 inbytes = SSL_read(ssl, CS buff, len);
2207 error = SSL_get_error(ssl, inbytes);
2208
2209 if (error == SSL_ERROR_ZERO_RETURN)
2210 {
2211 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2212 return -1;
2213 }
2214 else if (error != SSL_ERROR_NONE)
2215 {
2216 return -1;
2217 }
2218
2219 return inbytes;
2220 }
2221
2222
2223
2224
2225
2226 /*************************************************
2227 * Write bytes down TLS channel *
2228 *************************************************/
2229
2230 /*
2231 Arguments:
2232 is_server channel specifier
2233 buff buffer of data
2234 len number of bytes
2235
2236 Returns: the number of bytes after a successful write,
2237 -1 after a failed write
2238
2239 Used by both server-side and client-side TLS.
2240 */
2241
2242 int
2243 tls_write(BOOL is_server, const uschar *buff, size_t len)
2244 {
2245 int outbytes;
2246 int error;
2247 int left = len;
2248 SSL *ssl = is_server ? server_ssl : client_ssl;
2249
2250 DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
2251 while (left > 0)
2252 {
2253 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
2254 outbytes = SSL_write(ssl, CS buff, left);
2255 error = SSL_get_error(ssl, outbytes);
2256 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2257 switch (error)
2258 {
2259 case SSL_ERROR_SSL:
2260 ERR_error_string(ERR_get_error(), ssl_errstring);
2261 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2262 return -1;
2263
2264 case SSL_ERROR_NONE:
2265 left -= outbytes;
2266 buff += outbytes;
2267 break;
2268
2269 case SSL_ERROR_ZERO_RETURN:
2270 log_write(0, LOG_MAIN, "SSL channel closed on write");
2271 return -1;
2272
2273 case SSL_ERROR_SYSCALL:
2274 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2275 sender_fullhost ? sender_fullhost : US"<unknown>",
2276 strerror(errno));
2277
2278 default:
2279 log_write(0, LOG_MAIN, "SSL_write error %d", error);
2280 return -1;
2281 }
2282 }
2283 return len;
2284 }
2285
2286
2287
2288 /*************************************************
2289 * Close down a TLS session *
2290 *************************************************/
2291
2292 /* This is also called from within a delivery subprocess forked from the
2293 daemon, to shut down the TLS library, without actually doing a shutdown (which
2294 would tamper with the SSL session in the parent process).
2295
2296 Arguments: TRUE if SSL_shutdown is to be called
2297 Returns: nothing
2298
2299 Used by both server-side and client-side TLS.
2300 */
2301
2302 void
2303 tls_close(BOOL is_server, BOOL shutdown)
2304 {
2305 SSL **sslp = is_server ? &server_ssl : &client_ssl;
2306 int *fdp = is_server ? &tls_in.active : &tls_out.active;
2307
2308 if (*fdp < 0) return; /* TLS was not active */
2309
2310 if (shutdown)
2311 {
2312 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
2313 SSL_shutdown(*sslp);
2314 }
2315
2316 SSL_free(*sslp);
2317 *sslp = NULL;
2318
2319 *fdp = -1;
2320 }
2321
2322
2323
2324
2325 /*************************************************
2326 * Let tls_require_ciphers be checked at startup *
2327 *************************************************/
2328
2329 /* The tls_require_ciphers option, if set, must be something which the
2330 library can parse.
2331
2332 Returns: NULL on success, or error message
2333 */
2334
2335 uschar *
2336 tls_validate_require_cipher(void)
2337 {
2338 SSL_CTX *ctx;
2339 uschar *s, *expciphers, *err;
2340
2341 /* this duplicates from tls_init(), we need a better "init just global
2342 state, for no specific purpose" singleton function of our own */
2343
2344 SSL_load_error_strings();
2345 OpenSSL_add_ssl_algorithms();
2346 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2347 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2348 list of available digests. */
2349 EVP_add_digest(EVP_sha256());
2350 #endif
2351
2352 if (!(tls_require_ciphers && *tls_require_ciphers))
2353 return NULL;
2354
2355 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2356 return US"failed to expand tls_require_ciphers";
2357
2358 if (!(expciphers && *expciphers))
2359 return NULL;
2360
2361 /* normalisation ripped from above */
2362 s = expciphers;
2363 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2364
2365 err = NULL;
2366
2367 ctx = SSL_CTX_new(SSLv23_server_method());
2368 if (!ctx)
2369 {
2370 ERR_error_string(ERR_get_error(), ssl_errstring);
2371 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2372 }
2373
2374 DEBUG(D_tls)
2375 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2376
2377 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2378 {
2379 ERR_error_string(ERR_get_error(), ssl_errstring);
2380 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2381 }
2382
2383 SSL_CTX_free(ctx);
2384
2385 return err;
2386 }
2387
2388
2389
2390
2391 /*************************************************
2392 * Report the library versions. *
2393 *************************************************/
2394
2395 /* There have historically been some issues with binary compatibility in
2396 OpenSSL libraries; if Exim (like many other applications) is built against
2397 one version of OpenSSL but the run-time linker picks up another version,
2398 it can result in serious failures, including crashing with a SIGSEGV. So
2399 report the version found by the compiler and the run-time version.
2400
2401 Note: some OS vendors backport security fixes without changing the version
2402 number/string, and the version date remains unchanged. The _build_ date
2403 will change, so we can more usefully assist with version diagnosis by also
2404 reporting the build date.
2405
2406 Arguments: a FILE* to print the results to
2407 Returns: nothing
2408 */
2409
2410 void
2411 tls_version_report(FILE *f)
2412 {
2413 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
2414 " Runtime: %s\n"
2415 " : %s\n",
2416 OPENSSL_VERSION_TEXT,
2417 SSLeay_version(SSLEAY_VERSION),
2418 SSLeay_version(SSLEAY_BUILT_ON));
2419 /* third line is 38 characters for the %s and the line is 73 chars long;
2420 the OpenSSL output includes a "built on: " prefix already. */
2421 }
2422
2423
2424
2425
2426 /*************************************************
2427 * Random number generation *
2428 *************************************************/
2429
2430 /* Pseudo-random number generation. The result is not expected to be
2431 cryptographically strong but not so weak that someone will shoot themselves
2432 in the foot using it as a nonce in input in some email header scheme or
2433 whatever weirdness they'll twist this into. The result should handle fork()
2434 and avoid repeating sequences. OpenSSL handles that for us.
2435
2436 Arguments:
2437 max range maximum
2438 Returns a random number in range [0, max-1]
2439 */
2440
2441 int
2442 vaguely_random_number(int max)
2443 {
2444 unsigned int r;
2445 int i, needed_len;
2446 static pid_t pidlast = 0;
2447 pid_t pidnow;
2448 uschar *p;
2449 uschar smallbuf[sizeof(r)];
2450
2451 if (max <= 1)
2452 return 0;
2453
2454 pidnow = getpid();
2455 if (pidnow != pidlast)
2456 {
2457 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2458 is unique for each thread", this doesn't apparently apply across processes,
2459 so our own warning from vaguely_random_number_fallback() applies here too.
2460 Fix per PostgreSQL. */
2461 if (pidlast != 0)
2462 RAND_cleanup();
2463 pidlast = pidnow;
2464 }
2465
2466 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2467 if (!RAND_status())
2468 {
2469 randstuff r;
2470 gettimeofday(&r.tv, NULL);
2471 r.p = getpid();
2472
2473 RAND_seed((uschar *)(&r), sizeof(r));
2474 }
2475 /* We're after pseudo-random, not random; if we still don't have enough data
2476 in the internal PRNG then our options are limited. We could sleep and hope
2477 for entropy to come along (prayer technique) but if the system is so depleted
2478 in the first place then something is likely to just keep taking it. Instead,
2479 we'll just take whatever little bit of pseudo-random we can still manage to
2480 get. */
2481
2482 needed_len = sizeof(r);
2483 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2484 asked for a number less than 10. */
2485 for (r = max, i = 0; r; ++i)
2486 r >>= 1;
2487 i = (i + 7) / 8;
2488 if (i < needed_len)
2489 needed_len = i;
2490
2491 /* We do not care if crypto-strong */
2492 i = RAND_pseudo_bytes(smallbuf, needed_len);
2493 if (i < 0)
2494 {
2495 DEBUG(D_all)
2496 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2497 return vaguely_random_number_fallback(max);
2498 }
2499
2500 r = 0;
2501 for (p = smallbuf; needed_len; --needed_len, ++p)
2502 {
2503 r *= 256;
2504 r += *p;
2505 }
2506
2507 /* We don't particularly care about weighted results; if someone wants
2508 smooth distribution and cares enough then they should submit a patch then. */
2509 return r % max;
2510 }
2511
2512
2513
2514
2515 /*************************************************
2516 * OpenSSL option parse *
2517 *************************************************/
2518
2519 /* Parse one option for tls_openssl_options_parse below
2520
2521 Arguments:
2522 name one option name
2523 value place to store a value for it
2524 Returns success or failure in parsing
2525 */
2526
2527 struct exim_openssl_option {
2528 uschar *name;
2529 long value;
2530 };
2531 /* We could use a macro to expand, but we need the ifdef and not all the
2532 options document which version they were introduced in. Policylet: include
2533 all options unless explicitly for DTLS, let the administrator choose which
2534 to apply.
2535
2536 This list is current as of:
2537 ==> 1.0.1b <==
2538 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2539 */
2540 static struct exim_openssl_option exim_openssl_options[] = {
2541 /* KEEP SORTED ALPHABETICALLY! */
2542 #ifdef SSL_OP_ALL
2543 { US"all", SSL_OP_ALL },
2544 #endif
2545 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
2546 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
2547 #endif
2548 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
2549 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
2550 #endif
2551 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
2552 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
2553 #endif
2554 #ifdef SSL_OP_EPHEMERAL_RSA
2555 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
2556 #endif
2557 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
2558 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
2559 #endif
2560 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
2561 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
2562 #endif
2563 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
2564 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
2565 #endif
2566 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
2567 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
2568 #endif
2569 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
2570 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
2571 #endif
2572 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
2573 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
2574 #endif
2575 #ifdef SSL_OP_NO_COMPRESSION
2576 { US"no_compression", SSL_OP_NO_COMPRESSION },
2577 #endif
2578 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2579 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
2580 #endif
2581 #ifdef SSL_OP_NO_SSLv2
2582 { US"no_sslv2", SSL_OP_NO_SSLv2 },
2583 #endif
2584 #ifdef SSL_OP_NO_SSLv3
2585 { US"no_sslv3", SSL_OP_NO_SSLv3 },
2586 #endif
2587 #ifdef SSL_OP_NO_TICKET
2588 { US"no_ticket", SSL_OP_NO_TICKET },
2589 #endif
2590 #ifdef SSL_OP_NO_TLSv1
2591 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2592 #endif
2593 #ifdef SSL_OP_NO_TLSv1_1
2594 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
2595 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2596 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2597 #else
2598 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2599 #endif
2600 #endif
2601 #ifdef SSL_OP_NO_TLSv1_2
2602 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2603 #endif
2604 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2605 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2606 #endif
2607 #ifdef SSL_OP_SINGLE_DH_USE
2608 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
2609 #endif
2610 #ifdef SSL_OP_SINGLE_ECDH_USE
2611 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
2612 #endif
2613 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
2614 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
2615 #endif
2616 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
2617 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
2618 #endif
2619 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
2620 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
2621 #endif
2622 #ifdef SSL_OP_TLS_D5_BUG
2623 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
2624 #endif
2625 #ifdef SSL_OP_TLS_ROLLBACK_BUG
2626 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
2627 #endif
2628 };
2629 static int exim_openssl_options_size =
2630 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2631
2632
2633 static BOOL
2634 tls_openssl_one_option_parse(uschar *name, long *value)
2635 {
2636 int first = 0;
2637 int last = exim_openssl_options_size;
2638 while (last > first)
2639 {
2640 int middle = (first + last)/2;
2641 int c = Ustrcmp(name, exim_openssl_options[middle].name);
2642 if (c == 0)
2643 {
2644 *value = exim_openssl_options[middle].value;
2645 return TRUE;
2646 }
2647 else if (c > 0)
2648 first = middle + 1;
2649 else
2650 last = middle;
2651 }
2652 return FALSE;
2653 }
2654
2655
2656
2657
2658 /*************************************************
2659 * OpenSSL option parsing logic *
2660 *************************************************/
2661
2662 /* OpenSSL has a number of compatibility options which an administrator might
2663 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
2664 we look like log_selector.
2665
2666 Arguments:
2667 option_spec the administrator-supplied string of options
2668 results ptr to long storage for the options bitmap
2669 Returns success or failure
2670 */
2671
2672 BOOL
2673 tls_openssl_options_parse(uschar *option_spec, long *results)
2674 {
2675 long result, item;
2676 uschar *s, *end;
2677 uschar keep_c;
2678 BOOL adding, item_parsed;
2679
2680 result = 0L;
2681 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
2682 * from default because it increases BEAST susceptibility. */
2683 #ifdef SSL_OP_NO_SSLv2
2684 result |= SSL_OP_NO_SSLv2;
2685 #endif
2686
2687 if (option_spec == NULL)
2688 {
2689 *results = result;
2690 return TRUE;
2691 }
2692
2693 for (s=option_spec; *s != '\0'; /**/)
2694 {
2695 while (isspace(*s)) ++s;
2696 if (*s == '\0')
2697 break;
2698 if (*s != '+' && *s != '-')
2699 {
2700 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
2701 "+ or - expected but found \"%s\"\n", s);
2702 return FALSE;
2703 }
2704 adding = *s++ == '+';
2705 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2706 keep_c = *end;
2707 *end = '\0';
2708 item_parsed = tls_openssl_one_option_parse(s, &item);
2709 if (!item_parsed)
2710 {
2711 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
2712 return FALSE;
2713 }
2714 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2715 adding ? "adding" : "removing", result, item, s);
2716 if (adding)
2717 result |= item;
2718 else
2719 result &= ~item;
2720 *end = keep_c;
2721 s = end;
2722 }
2723
2724 *results = result;
2725 return TRUE;
2726 }
2727
2728 /* vi: aw ai sw=2
2729 */
2730 /* End of tls-openssl.c */