f7ff459b03ff0b235979b7e3eb2bfeb9306dfd0c
[exim.git] / src / src / tls-openssl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2019 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Portions Copyright (c) The OpenSSL Project 1999 */
9
10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11 library. It is #included into the tls.c file when that library is used. The
12 code herein is based on a patch that was originally contributed by Steve
13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15 No cryptographic code is included in Exim. All this module does is to call
16 functions from the OpenSSL library. */
17
18
19 /* Heading stuff */
20
21 #include <openssl/lhash.h>
22 #include <openssl/ssl.h>
23 #include <openssl/err.h>
24 #include <openssl/rand.h>
25 #ifndef OPENSSL_NO_ECDH
26 # include <openssl/ec.h>
27 #endif
28 #ifndef DISABLE_OCSP
29 # include <openssl/ocsp.h>
30 #endif
31 #ifdef SUPPORT_DANE
32 # include "danessl.h"
33 #endif
34
35
36 #ifndef DISABLE_OCSP
37 # define EXIM_OCSP_SKEW_SECONDS (300L)
38 # define EXIM_OCSP_MAX_AGE (-1L)
39 #endif
40
41 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
42 # define EXIM_HAVE_OPENSSL_TLSEXT
43 #endif
44 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
45 # define EXIM_HAVE_RSA_GENKEY_EX
46 #endif
47 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
48 # define EXIM_HAVE_OCSP_RESP_COUNT
49 # define OPENSSL_AUTO_SHA256
50 #else
51 # define EXIM_HAVE_EPHEM_RSA_KEX
52 # define EXIM_HAVE_RAND_PSEUDO
53 #endif
54 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
55 # define EXIM_HAVE_SHA256
56 #endif
57
58 /* X509_check_host provides sane certificate hostname checking, but was added
59 to OpenSSL late, after other projects forked off the code-base. So in
60 addition to guarding against the base version number, beware that LibreSSL
61 does not (at this time) support this function.
62
63 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
64 opt to disentangle and ask a LibreSSL user to provide glue for a third
65 crypto provider for libtls instead of continuing to tie the OpenSSL glue
66 into even twistier knots. If LibreSSL gains the same API, we can just
67 change this guard and punt the issue for a while longer. */
68
69 #ifndef LIBRESSL_VERSION_NUMBER
70 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
71 # define EXIM_HAVE_OPENSSL_CHECKHOST
72 # define EXIM_HAVE_OPENSSL_DH_BITS
73 # define EXIM_HAVE_OPENSSL_TLS_METHOD
74 # define EXIM_HAVE_OPENSSL_KEYLOG
75 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
76 # define EXIM_HAVE_SESSION_TICKET
77 # define EXIM_HAVE_OPESSL_TRACE
78 # define EXIM_HAVE_OPESSL_GET0_SERIAL
79 # ifndef DISABLE_OCSP
80 # define EXIM_HAVE_OCSP
81 # endif
82 # else
83 # define EXIM_NEED_OPENSSL_INIT
84 # endif
85 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
86 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
87 # define EXIM_HAVE_OPENSSL_CHECKHOST
88 # endif
89 #endif
90
91 #if !defined(LIBRESSL_VERSION_NUMBER) \
92 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
93 # if !defined(OPENSSL_NO_ECDH)
94 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
95 # define EXIM_HAVE_ECDH
96 # endif
97 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
98 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
99 # endif
100 # endif
101 #endif
102
103 #ifndef LIBRESSL_VERSION_NUMBER
104 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
105 # define OPENSSL_HAVE_KEYLOG_CB
106 # define OPENSSL_HAVE_NUM_TICKETS
107 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
108 # else
109 # define OPENSSL_BAD_SRVR_OURCERT
110 # endif
111 #endif
112
113 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
114 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
115 # define DISABLE_OCSP
116 #endif
117
118 #ifdef EXPERIMENTAL_TLS_RESUME
119 # if OPENSSL_VERSION_NUMBER < 0x0101010L
120 # error OpenSSL version too old for session-resumption
121 # endif
122 #endif
123
124 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
125 # include <openssl/x509v3.h>
126 #endif
127
128 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
129 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
130 # define SSL_CIPHER_get_id(c) (c->id)
131 # endif
132 # ifndef MACRO_PREDEF
133 # include "tls-cipher-stdname.c"
134 # endif
135 #endif
136
137 /*************************************************
138 * OpenSSL option parse *
139 *************************************************/
140
141 typedef struct exim_openssl_option {
142 uschar *name;
143 long value;
144 } exim_openssl_option;
145 /* We could use a macro to expand, but we need the ifdef and not all the
146 options document which version they were introduced in. Policylet: include
147 all options unless explicitly for DTLS, let the administrator choose which
148 to apply.
149
150 This list is current as of:
151 ==> 1.1.1c <==
152
153 XXX could we autobuild this list, as with predefined-macros?
154 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
155 Also allow a numeric literal?
156 */
157 static exim_openssl_option exim_openssl_options[] = {
158 /* KEEP SORTED ALPHABETICALLY! */
159 #ifdef SSL_OP_ALL
160 { US"all", (long) SSL_OP_ALL },
161 #endif
162 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
163 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
164 #endif
165 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
166 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
167 #endif
168 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
169 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
170 #endif
171 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
172 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
173 #endif
174 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
175 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
176 #endif
177 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
178 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
179 #endif
180 #ifdef SSL_OP_EPHEMERAL_RSA
181 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
182 #endif
183 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
184 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
185 #endif
186 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
187 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
188 #endif
189 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
190 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
191 #endif
192 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
193 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
194 #endif
195 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
196 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
197 #endif
198 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
199 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
200 #endif
201 #ifdef SSL_OP_NO_ANTI_REPLAY
202 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
203 #endif
204 #ifdef SSL_OP_NO_COMPRESSION
205 { US"no_compression", SSL_OP_NO_COMPRESSION },
206 #endif
207 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
208 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
209 #endif
210 #ifdef SSL_OP_NO_RENEGOTIATION
211 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
212 #endif
213 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
214 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
215 #endif
216 #ifdef SSL_OP_NO_SSLv2
217 { US"no_sslv2", SSL_OP_NO_SSLv2 },
218 #endif
219 #ifdef SSL_OP_NO_SSLv3
220 { US"no_sslv3", SSL_OP_NO_SSLv3 },
221 #endif
222 #ifdef SSL_OP_NO_TICKET
223 { US"no_ticket", SSL_OP_NO_TICKET },
224 #endif
225 #ifdef SSL_OP_NO_TLSv1
226 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
227 #endif
228 #ifdef SSL_OP_NO_TLSv1_1
229 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
230 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
231 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
232 #else
233 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
234 #endif
235 #endif
236 #ifdef SSL_OP_NO_TLSv1_2
237 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
238 #endif
239 #ifdef SSL_OP_NO_TLSv1_3
240 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
241 #endif
242 #ifdef SSL_OP_PRIORITIZE_CHACHA
243 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
244 #endif
245 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
246 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
247 #endif
248 #ifdef SSL_OP_SINGLE_DH_USE
249 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
250 #endif
251 #ifdef SSL_OP_SINGLE_ECDH_USE
252 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
253 #endif
254 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
255 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
256 #endif
257 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
258 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
259 #endif
260 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
261 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
262 #endif
263 #ifdef SSL_OP_TLS_D5_BUG
264 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
265 #endif
266 #ifdef SSL_OP_TLS_ROLLBACK_BUG
267 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
268 #endif
269 #ifdef SSL_OP_TLSEXT_PADDING
270 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
271 #endif
272 };
273
274 #ifndef MACRO_PREDEF
275 static int exim_openssl_options_size = nelem(exim_openssl_options);
276 #endif
277
278 #ifdef MACRO_PREDEF
279 void
280 options_tls(void)
281 {
282 uschar buf[64];
283
284 for (struct exim_openssl_option * o = exim_openssl_options;
285 o < exim_openssl_options + nelem(exim_openssl_options); o++)
286 {
287 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
288 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
289
290 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
291 builtin_macro_create(buf);
292 }
293
294 # ifdef EXPERIMENTAL_TLS_RESUME
295 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
296 # endif
297 # ifdef SSL_OP_NO_TLSv1_3
298 builtin_macro_create(US"_HAVE_TLS1_3");
299 # endif
300 # ifdef OPENSSL_BAD_SRVR_OURCERT
301 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
302 # endif
303 # ifdef EXIM_HAVE_OCSP
304 builtin_macro_create(US"_HAVE_TLS_OCSP");
305 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
306 # endif
307 }
308 #else
309
310 /******************************************************************************/
311
312 /* Structure for collecting random data for seeding. */
313
314 typedef struct randstuff {
315 struct timeval tv;
316 pid_t p;
317 } randstuff;
318
319 /* Local static variables */
320
321 static BOOL client_verify_callback_called = FALSE;
322 static BOOL server_verify_callback_called = FALSE;
323 static const uschar *sid_ctx = US"exim";
324
325 /* We have three different contexts to care about.
326
327 Simple case: client, `client_ctx`
328 As a client, we can be doing a callout or cut-through delivery while receiving
329 a message. So we have a client context, which should have options initialised
330 from the SMTP Transport. We may also concurrently want to make TLS connections
331 to utility daemons, so client-contexts are allocated and passed around in call
332 args rather than using a gobal.
333
334 Server:
335 There are two cases: with and without ServerNameIndication from the client.
336 Given TLS SNI, we can be using different keys, certs and various other
337 configuration settings, because they're re-expanded with $tls_sni set. This
338 allows vhosting with TLS. This SNI is sent in the handshake.
339 A client might not send SNI, so we need a fallback, and an initial setup too.
340 So as a server, we start out using `server_ctx`.
341 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
342 `server_sni` from `server_ctx` and then initialise settings by re-expanding
343 configuration.
344 */
345
346 typedef struct {
347 SSL_CTX * ctx;
348 SSL * ssl;
349 gstring * corked;
350 } exim_openssl_client_tls_ctx;
351
352 static SSL_CTX *server_ctx = NULL;
353 static SSL *server_ssl = NULL;
354
355 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
356 static SSL_CTX *server_sni = NULL;
357 #endif
358
359 static char ssl_errstring[256];
360
361 static int ssl_session_timeout = 7200; /* Two hours */
362 static BOOL client_verify_optional = FALSE;
363 static BOOL server_verify_optional = FALSE;
364
365 static BOOL reexpand_tls_files_for_sni = FALSE;
366
367
368 typedef struct ocsp_resp {
369 struct ocsp_resp * next;
370 OCSP_RESPONSE * resp;
371 } ocsp_resplist;
372
373 typedef struct tls_ext_ctx_cb {
374 tls_support * tlsp;
375 uschar *certificate;
376 uschar *privatekey;
377 BOOL is_server;
378 #ifndef DISABLE_OCSP
379 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
380 union {
381 struct {
382 uschar *file;
383 const uschar *file_expanded;
384 ocsp_resplist *olist;
385 } server;
386 struct {
387 X509_STORE *verify_store; /* non-null if status requested */
388 BOOL verify_required;
389 } client;
390 } u_ocsp;
391 #endif
392 uschar *dhparam;
393 /* these are cached from first expand */
394 uschar *server_cipher_list;
395 /* only passed down to tls_error: */
396 host_item *host;
397 const uschar * verify_cert_hostnames;
398 #ifndef DISABLE_EVENT
399 uschar * event_action;
400 #endif
401 } tls_ext_ctx_cb;
402
403 /* should figure out a cleanup of API to handle state preserved per
404 implementation, for various reasons, which can be void * in the APIs.
405 For now, we hack around it. */
406 tls_ext_ctx_cb *client_static_cbinfo = NULL; /*XXX should not use static; multiple concurrent clients! */
407 tls_ext_ctx_cb *server_static_cbinfo = NULL;
408
409 static int
410 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
411 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr );
412
413 /* Callbacks */
414 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
415 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
416 #endif
417 #ifndef DISABLE_OCSP
418 static int tls_server_stapling_cb(SSL *s, void *arg);
419 #endif
420
421
422
423 /* Daemon-called, before every connection, key create/rotate */
424 #ifdef EXPERIMENTAL_TLS_RESUME
425 static void tk_init(void);
426 static int tls_exdata_idx = -1;
427 #endif
428
429 void
430 tls_daemon_init(void)
431 {
432 #ifdef EXPERIMENTAL_TLS_RESUME
433 tk_init();
434 #endif
435 return;
436 }
437
438
439 /*************************************************
440 * Handle TLS error *
441 *************************************************/
442
443 /* Called from lots of places when errors occur before actually starting to do
444 the TLS handshake, that is, while the session is still in clear. Always returns
445 DEFER for a server and FAIL for a client so that most calls can use "return
446 tls_error(...)" to do this processing and then give an appropriate return. A
447 single function is used for both server and client, because it is called from
448 some shared functions.
449
450 Argument:
451 prefix text to include in the logged error
452 host NULL if setting up a server;
453 the connected host if setting up a client
454 msg error message or NULL if we should ask OpenSSL
455 errstr pointer to output error message
456
457 Returns: OK/DEFER/FAIL
458 */
459
460 static int
461 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
462 {
463 if (!msg)
464 {
465 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
466 msg = US ssl_errstring;
467 }
468
469 msg = string_sprintf("(%s): %s", prefix, msg);
470 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
471 if (errstr) *errstr = msg;
472 return host ? FAIL : DEFER;
473 }
474
475
476
477 /*************************************************
478 * Callback to generate RSA key *
479 *************************************************/
480
481 /*
482 Arguments:
483 s SSL connection (not used)
484 export not used
485 keylength keylength
486
487 Returns: pointer to generated key
488 */
489
490 static RSA *
491 rsa_callback(SSL *s, int export, int keylength)
492 {
493 RSA *rsa_key;
494 #ifdef EXIM_HAVE_RSA_GENKEY_EX
495 BIGNUM *bn = BN_new();
496 #endif
497
498 export = export; /* Shut picky compilers up */
499 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
500
501 #ifdef EXIM_HAVE_RSA_GENKEY_EX
502 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
503 || !(rsa_key = RSA_new())
504 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
505 )
506 #else
507 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
508 #endif
509
510 {
511 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
512 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
513 ssl_errstring);
514 return NULL;
515 }
516 return rsa_key;
517 }
518
519
520
521 /* Extreme debug
522 #ifndef DISABLE_OCSP
523 void
524 x509_store_dump_cert_s_names(X509_STORE * store)
525 {
526 STACK_OF(X509_OBJECT) * roots= store->objs;
527 static uschar name[256];
528
529 for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
530 {
531 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
532 if(tmp_obj->type == X509_LU_X509)
533 {
534 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
535 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
536 {
537 name[sizeof(name)-1] = '\0';
538 debug_printf(" %s\n", name);
539 }
540 }
541 }
542 }
543 #endif
544 */
545
546
547 #ifndef DISABLE_EVENT
548 static int
549 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
550 BOOL *calledp, const BOOL *optionalp, const uschar * what)
551 {
552 uschar * ev;
553 uschar * yield;
554 X509 * old_cert;
555
556 ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
557 if (ev)
558 {
559 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
560 old_cert = tlsp->peercert;
561 tlsp->peercert = X509_dup(cert);
562 /* NB we do not bother setting peerdn */
563 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
564 {
565 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
566 "depth=%d cert=%s: %s",
567 tlsp == &tls_out ? deliver_host_address : sender_host_address,
568 what, depth, dn, yield);
569 *calledp = TRUE;
570 if (!*optionalp)
571 {
572 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
573 return 1; /* reject (leaving peercert set) */
574 }
575 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
576 "(host in tls_try_verify_hosts)\n");
577 tlsp->verify_override = TRUE;
578 }
579 X509_free(tlsp->peercert);
580 tlsp->peercert = old_cert;
581 }
582 return 0;
583 }
584 #endif
585
586 /*************************************************
587 * Callback for verification *
588 *************************************************/
589
590 /* The SSL library does certificate verification if set up to do so. This
591 callback has the current yes/no state is in "state". If verification succeeded,
592 we set the certificate-verified flag. If verification failed, what happens
593 depends on whether the client is required to present a verifiable certificate
594 or not.
595
596 If verification is optional, we change the state to yes, but still log the
597 verification error. For some reason (it really would help to have proper
598 documentation of OpenSSL), this callback function then gets called again, this
599 time with state = 1. We must take care not to set the private verified flag on
600 the second time through.
601
602 Note: this function is not called if the client fails to present a certificate
603 when asked. We get here only if a certificate has been received. Handling of
604 optional verification for this case is done when requesting SSL to verify, by
605 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
606
607 May be called multiple times for different issues with a certificate, even
608 for a given "depth" in the certificate chain.
609
610 Arguments:
611 preverify_ok current yes/no state as 1/0
612 x509ctx certificate information.
613 tlsp per-direction (client vs. server) support data
614 calledp has-been-called flag
615 optionalp verification-is-optional flag
616
617 Returns: 0 if verification should fail, otherwise 1
618 */
619
620 static int
621 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
622 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
623 {
624 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
625 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
626 uschar dn[256];
627
628 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
629 {
630 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
631 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
632 tlsp == &tls_out ? deliver_host_address : sender_host_address);
633 return 0;
634 }
635 dn[sizeof(dn)-1] = '\0';
636
637 tlsp->verify_override = FALSE;
638 if (preverify_ok == 0)
639 {
640 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
641 *verify_mode, sender_host_address)
642 : US"";
643 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
644 tlsp == &tls_out ? deliver_host_address : sender_host_address,
645 extra, depth,
646 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
647 *calledp = TRUE;
648 if (!*optionalp)
649 {
650 if (!tlsp->peercert)
651 tlsp->peercert = X509_dup(cert); /* record failing cert */
652 return 0; /* reject */
653 }
654 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
655 "tls_try_verify_hosts)\n");
656 tlsp->verify_override = TRUE;
657 }
658
659 else if (depth != 0)
660 {
661 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
662 #ifndef DISABLE_OCSP
663 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
664 { /* client, wanting stapling */
665 /* Add the server cert's signing chain as the one
666 for the verification of the OCSP stapled information. */
667
668 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
669 cert))
670 ERR_clear_error();
671 sk_X509_push(client_static_cbinfo->verify_stack, cert);
672 }
673 #endif
674 #ifndef DISABLE_EVENT
675 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
676 return 0; /* reject, with peercert set */
677 #endif
678 }
679 else
680 {
681 const uschar * verify_cert_hostnames;
682
683 if ( tlsp == &tls_out
684 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
685 /* client, wanting hostname check */
686 {
687
688 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
689 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
690 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
691 # endif
692 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
693 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
694 # endif
695 int sep = 0;
696 const uschar * list = verify_cert_hostnames;
697 uschar * name;
698 int rc;
699 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
700 if ((rc = X509_check_host(cert, CCS name, 0,
701 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
702 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
703 NULL)))
704 {
705 if (rc < 0)
706 {
707 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
708 tlsp == &tls_out ? deliver_host_address : sender_host_address);
709 name = NULL;
710 }
711 break;
712 }
713 if (!name)
714 #else
715 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
716 #endif
717 {
718 uschar * extra = verify_mode
719 ? string_sprintf(" (during %c-verify for [%s])",
720 *verify_mode, sender_host_address)
721 : US"";
722 log_write(0, LOG_MAIN,
723 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
724 tlsp == &tls_out ? deliver_host_address : sender_host_address,
725 extra, dn, verify_cert_hostnames);
726 *calledp = TRUE;
727 if (!*optionalp)
728 {
729 if (!tlsp->peercert)
730 tlsp->peercert = X509_dup(cert); /* record failing cert */
731 return 0; /* reject */
732 }
733 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
734 "tls_try_verify_hosts)\n");
735 tlsp->verify_override = TRUE;
736 }
737 }
738
739 #ifndef DISABLE_EVENT
740 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
741 return 0; /* reject, with peercert set */
742 #endif
743
744 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
745 *calledp ? "" : " authenticated", dn);
746 *calledp = TRUE;
747 }
748
749 return 1; /* accept, at least for this level */
750 }
751
752 static int
753 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
754 {
755 return verify_callback(preverify_ok, x509ctx, &tls_out,
756 &client_verify_callback_called, &client_verify_optional);
757 }
758
759 static int
760 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
761 {
762 return verify_callback(preverify_ok, x509ctx, &tls_in,
763 &server_verify_callback_called, &server_verify_optional);
764 }
765
766
767 #ifdef SUPPORT_DANE
768
769 /* This gets called *by* the dane library verify callback, which interposes
770 itself.
771 */
772 static int
773 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
774 {
775 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
776 uschar dn[256];
777 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
778 #ifndef DISABLE_EVENT
779 BOOL dummy_called, optional = FALSE;
780 #endif
781
782 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
783 {
784 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
785 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
786 deliver_host_address);
787 return 0;
788 }
789 dn[sizeof(dn)-1] = '\0';
790
791 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
792 preverify_ok ? "ok":"BAD", depth, dn);
793
794 #ifndef DISABLE_EVENT
795 if (verify_event(&tls_out, cert, depth, dn,
796 &dummy_called, &optional, US"DANE"))
797 return 0; /* reject, with peercert set */
798 #endif
799
800 if (preverify_ok == 1)
801 {
802 tls_out.dane_verified = TRUE;
803 #ifndef DISABLE_OCSP
804 if (client_static_cbinfo->u_ocsp.client.verify_store)
805 { /* client, wanting stapling */
806 /* Add the server cert's signing chain as the one
807 for the verification of the OCSP stapled information. */
808
809 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
810 cert))
811 ERR_clear_error();
812 sk_X509_push(client_static_cbinfo->verify_stack, cert);
813 }
814 #endif
815 }
816 else
817 {
818 int err = X509_STORE_CTX_get_error(x509ctx);
819 DEBUG(D_tls)
820 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
821 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
822 preverify_ok = 1;
823 }
824 return preverify_ok;
825 }
826
827 #endif /*SUPPORT_DANE*/
828
829
830 /*************************************************
831 * Information callback *
832 *************************************************/
833
834 /* The SSL library functions call this from time to time to indicate what they
835 are doing. We copy the string to the debugging output when TLS debugging has
836 been requested.
837
838 Arguments:
839 s the SSL connection
840 where
841 ret
842
843 Returns: nothing
844 */
845
846 static void
847 info_callback(SSL *s, int where, int ret)
848 {
849 DEBUG(D_tls)
850 {
851 const uschar * str;
852
853 if (where & SSL_ST_CONNECT)
854 str = US"SSL_connect";
855 else if (where & SSL_ST_ACCEPT)
856 str = US"SSL_accept";
857 else
858 str = US"SSL info (undefined)";
859
860 if (where & SSL_CB_LOOP)
861 debug_printf("%s: %s\n", str, SSL_state_string_long(s));
862 else if (where & SSL_CB_ALERT)
863 debug_printf("SSL3 alert %s:%s:%s\n",
864 str = where & SSL_CB_READ ? US"read" : US"write",
865 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
866 else if (where & SSL_CB_EXIT)
867 if (ret == 0)
868 debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
869 else if (ret < 0)
870 debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
871 else if (where & SSL_CB_HANDSHAKE_START)
872 debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
873 else if (where & SSL_CB_HANDSHAKE_DONE)
874 debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s));
875 }
876 }
877
878 #ifdef OPENSSL_HAVE_KEYLOG_CB
879 static void
880 keylog_callback(const SSL *ssl, const char *line)
881 {
882 char * filename;
883 FILE * fp;
884 DEBUG(D_tls) debug_printf("%.200s\n", line);
885 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
886 if (!(fp = fopen(filename, "a"))) return;
887 fprintf(fp, "%s\n", line);
888 fclose(fp);
889 }
890 #endif
891
892
893 #ifdef EXPERIMENTAL_TLS_RESUME
894 /* Manage the keysets used for encrypting the session tickets, on the server. */
895
896 typedef struct { /* Session ticket encryption key */
897 uschar name[16];
898
899 const EVP_CIPHER * aes_cipher;
900 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
901 const EVP_MD * hmac_hash;
902 uschar hmac_key[16];
903 time_t renew;
904 time_t expire;
905 } exim_stek;
906
907 static exim_stek exim_tk; /* current key */
908 static exim_stek exim_tk_old; /* previous key */
909
910 static void
911 tk_init(void)
912 {
913 time_t t = time(NULL);
914
915 if (exim_tk.name[0])
916 {
917 if (exim_tk.renew >= t) return;
918 exim_tk_old = exim_tk;
919 }
920
921 if (f.running_in_test_harness) ssl_session_timeout = 6;
922
923 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
924 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
925 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
926 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
927
928 exim_tk.name[0] = 'E';
929 exim_tk.aes_cipher = EVP_aes_256_cbc();
930 exim_tk.hmac_hash = EVP_sha256();
931 exim_tk.expire = t + ssl_session_timeout;
932 exim_tk.renew = t + ssl_session_timeout/2;
933 }
934
935 static exim_stek *
936 tk_current(void)
937 {
938 if (!exim_tk.name[0]) return NULL;
939 return &exim_tk;
940 }
941
942 static exim_stek *
943 tk_find(const uschar * name)
944 {
945 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
946 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
947 : NULL;
948 }
949
950 /* Callback for session tickets, on server */
951 static int
952 ticket_key_callback(SSL * ssl, uschar key_name[16],
953 uschar * iv, EVP_CIPHER_CTX * ctx, HMAC_CTX * hctx, int enc)
954 {
955 tls_support * tlsp = server_static_cbinfo->tlsp;
956 exim_stek * key;
957
958 if (enc)
959 {
960 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
961 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
962
963 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
964 return -1; /* insufficient random */
965
966 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
967 return 0; /* key couldn't be created */
968 memcpy(key_name, key->name, 16);
969 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
970
971 /*XXX will want these dependent on the ssl session strength */
972 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
973 key->hmac_hash, NULL);
974 EVP_EncryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv);
975
976 DEBUG(D_tls) debug_printf("ticket created\n");
977 return 1;
978 }
979 else
980 {
981 time_t now = time(NULL);
982
983 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
984 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
985
986 if (!(key = tk_find(key_name)) || key->expire < now)
987 {
988 DEBUG(D_tls)
989 {
990 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
991 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
992 }
993 return 0;
994 }
995
996 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
997 key->hmac_hash, NULL);
998 EVP_DecryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv);
999
1000 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
1001
1002 /* The ticket lifetime and renewal are the same as the STEK lifetime and
1003 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
1004 be better. To do that we'd have to encode ticket lifetime in the name as
1005 we don't yet see the restored session. Could check posthandshake for TLS1.3
1006 and trigger a new ticket then, but cannot do that for TLS1.2 */
1007 return key->renew < now ? 2 : 1;
1008 }
1009 }
1010 #endif
1011
1012
1013
1014 /*************************************************
1015 * Initialize for DH *
1016 *************************************************/
1017
1018 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
1019
1020 Arguments:
1021 sctx The current SSL CTX (inbound or outbound)
1022 dhparam DH parameter file or fixed parameter identity string
1023 host connected host, if client; NULL if server
1024 errstr error string pointer
1025
1026 Returns: TRUE if OK (nothing to set up, or setup worked)
1027 */
1028
1029 static BOOL
1030 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host, uschar ** errstr)
1031 {
1032 BIO *bio;
1033 DH *dh;
1034 uschar *dhexpanded;
1035 const char *pem;
1036 int dh_bitsize;
1037
1038 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
1039 return FALSE;
1040
1041 if (!dhexpanded || !*dhexpanded)
1042 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
1043 else if (dhexpanded[0] == '/')
1044 {
1045 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
1046 {
1047 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
1048 host, US strerror(errno), errstr);
1049 return FALSE;
1050 }
1051 }
1052 else
1053 {
1054 if (Ustrcmp(dhexpanded, "none") == 0)
1055 {
1056 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
1057 return TRUE;
1058 }
1059
1060 if (!(pem = std_dh_prime_named(dhexpanded)))
1061 {
1062 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
1063 host, US strerror(errno), errstr);
1064 return FALSE;
1065 }
1066 bio = BIO_new_mem_buf(CS pem, -1);
1067 }
1068
1069 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
1070 {
1071 BIO_free(bio);
1072 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
1073 host, NULL, errstr);
1074 return FALSE;
1075 }
1076
1077 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
1078 * an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with
1079 * 2236. But older OpenSSL can only report in bytes (octets), not bits.
1080 * If someone wants to dance at the edge, then they can raise the limit or use
1081 * current libraries. */
1082 #ifdef EXIM_HAVE_OPENSSL_DH_BITS
1083 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
1084 * This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
1085 dh_bitsize = DH_bits(dh);
1086 #else
1087 dh_bitsize = 8 * DH_size(dh);
1088 #endif
1089
1090 /* Even if it is larger, we silently return success rather than cause things
1091 * to fail out, so that a too-large DH will not knock out all TLS; it's a
1092 * debatable choice. */
1093 if (dh_bitsize > tls_dh_max_bits)
1094 {
1095 DEBUG(D_tls)
1096 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d\n",
1097 dh_bitsize, tls_dh_max_bits);
1098 }
1099 else
1100 {
1101 SSL_CTX_set_tmp_dh(sctx, dh);
1102 DEBUG(D_tls)
1103 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
1104 dhexpanded ? dhexpanded : US"default", dh_bitsize);
1105 }
1106
1107 DH_free(dh);
1108 BIO_free(bio);
1109
1110 return TRUE;
1111 }
1112
1113
1114
1115
1116 /*************************************************
1117 * Initialize for ECDH *
1118 *************************************************/
1119
1120 /* Load parameters for ECDH encryption.
1121
1122 For now, we stick to NIST P-256 because: it's simple and easy to configure;
1123 it avoids any patent issues that might bite redistributors; despite events in
1124 the news and concerns over curve choices, we're not cryptographers, we're not
1125 pretending to be, and this is "good enough" to be better than no support,
1126 protecting against most adversaries. Given another year or two, there might
1127 be sufficient clarity about a "right" way forward to let us make an informed
1128 decision, instead of a knee-jerk reaction.
1129
1130 Longer-term, we should look at supporting both various named curves and
1131 external files generated with "openssl ecparam", much as we do for init_dh().
1132 We should also support "none" as a value, to explicitly avoid initialisation.
1133
1134 Patches welcome.
1135
1136 Arguments:
1137 sctx The current SSL CTX (inbound or outbound)
1138 host connected host, if client; NULL if server
1139 errstr error string pointer
1140
1141 Returns: TRUE if OK (nothing to set up, or setup worked)
1142 */
1143
1144 static BOOL
1145 init_ecdh(SSL_CTX * sctx, host_item * host, uschar ** errstr)
1146 {
1147 #ifdef OPENSSL_NO_ECDH
1148 return TRUE;
1149 #else
1150
1151 EC_KEY * ecdh;
1152 uschar * exp_curve;
1153 int nid;
1154 BOOL rv;
1155
1156 if (host) /* No ECDH setup for clients, only for servers */
1157 return TRUE;
1158
1159 # ifndef EXIM_HAVE_ECDH
1160 DEBUG(D_tls)
1161 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
1162 return TRUE;
1163 # else
1164
1165 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
1166 return FALSE;
1167 if (!exp_curve || !*exp_curve)
1168 return TRUE;
1169
1170 /* "auto" needs to be handled carefully.
1171 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
1172 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
1173 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
1174 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
1175 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
1176 */
1177 if (Ustrcmp(exp_curve, "auto") == 0)
1178 {
1179 #if OPENSSL_VERSION_NUMBER < 0x10002000L
1180 DEBUG(D_tls) debug_printf(
1181 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
1182 exp_curve = US"prime256v1";
1183 #else
1184 # if defined SSL_CTRL_SET_ECDH_AUTO
1185 DEBUG(D_tls) debug_printf(
1186 "ECDH OpenSSL 1.0.2+ temp key parameter settings: autoselection\n");
1187 SSL_CTX_set_ecdh_auto(sctx, 1);
1188 return TRUE;
1189 # else
1190 DEBUG(D_tls) debug_printf(
1191 "ECDH OpenSSL 1.1.0+ temp key parameter settings: default selection\n");
1192 return TRUE;
1193 # endif
1194 #endif
1195 }
1196
1197 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
1198 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
1199 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
1200 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
1201 # endif
1202 )
1203 {
1204 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
1205 host, NULL, errstr);
1206 return FALSE;
1207 }
1208
1209 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
1210 {
1211 tls_error(US"Unable to create ec curve", host, NULL, errstr);
1212 return FALSE;
1213 }
1214
1215 /* The "tmp" in the name here refers to setting a temporary key
1216 not to the stability of the interface. */
1217
1218 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
1219 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL, errstr);
1220 else
1221 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
1222
1223 EC_KEY_free(ecdh);
1224 return !rv;
1225
1226 # endif /*EXIM_HAVE_ECDH*/
1227 #endif /*OPENSSL_NO_ECDH*/
1228 }
1229
1230
1231
1232
1233 #ifndef DISABLE_OCSP
1234 /*************************************************
1235 * Load OCSP information into state *
1236 *************************************************/
1237 /* Called to load the server OCSP response from the given file into memory, once
1238 caller has determined this is needed. Checks validity. Debugs a message
1239 if invalid.
1240
1241 ASSUMES: single response, for single cert.
1242
1243 Arguments:
1244 sctx the SSL_CTX* to update
1245 cbinfo various parts of session state
1246 filename the filename putatively holding an OCSP response
1247 is_pem file is PEM format; otherwise is DER
1248
1249 */
1250
1251 static void
1252 ocsp_load_response(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo,
1253 const uschar * filename, BOOL is_pem)
1254 {
1255 BIO * bio;
1256 OCSP_RESPONSE * resp;
1257 OCSP_BASICRESP * basic_response;
1258 OCSP_SINGLERESP * single_response;
1259 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1260 STACK_OF(X509) * sk;
1261 unsigned long verify_flags;
1262 int status, reason, i;
1263
1264 DEBUG(D_tls)
1265 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1266
1267 if (!(bio = BIO_new_file(CS filename, "rb")))
1268 {
1269 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
1270 filename);
1271 return;
1272 }
1273
1274 if (is_pem)
1275 {
1276 uschar * data, * freep;
1277 char * dummy;
1278 long len;
1279 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1280 {
1281 DEBUG(D_tls) debug_printf("Failed to read PEM file \"%s\"\n",
1282 filename);
1283 return;
1284 }
1285 debug_printf("read pem file\n");
1286 freep = data;
1287 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1288 OPENSSL_free(freep);
1289 }
1290 else
1291 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1292 BIO_free(bio);
1293
1294 if (!resp)
1295 {
1296 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
1297 return;
1298 }
1299
1300 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1301 {
1302 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1303 OCSP_response_status_str(status), status);
1304 goto bad;
1305 }
1306
1307 #ifdef notdef
1308 {
1309 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1310 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1311 BIO_free(bp);
1312 }
1313 #endif
1314
1315 if (!(basic_response = OCSP_response_get1_basic(resp)))
1316 {
1317 DEBUG(D_tls)
1318 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1319 goto bad;
1320 }
1321
1322 sk = cbinfo->verify_stack;
1323 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1324
1325 /* May need to expose ability to adjust those flags?
1326 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1327 OCSP_TRUSTOTHER OCSP_NOINTERN */
1328
1329 /* This does a full verify on the OCSP proof before we load it for serving
1330 up; possibly overkill - just date-checks might be nice enough.
1331
1332 OCSP_basic_verify takes a "store" arg, but does not
1333 use it for the chain verification, which is all we do
1334 when OCSP_NOVERIFY is set. The content from the wire
1335 "basic_response" and a cert-stack "sk" are all that is used.
1336
1337 We have a stack, loaded in setup_certs() if tls_verify_certificates
1338 was a file (not a directory, or "system"). It is unfortunate we
1339 cannot used the connection context store, as that would neatly
1340 handle the "system" case too, but there seems to be no library
1341 function for getting a stack from a store.
1342 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1343 We do not free the stack since it could be needed a second time for
1344 SNI handling.
1345
1346 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1347 be a public interface into the OpenSSL library (there's no manual entry) -
1348 But what with? We also use OCSP_basic_verify in the client stapling callback.
1349 And there we NEED it; we must verify that status... unless the
1350 library does it for us anyway? */
1351
1352 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
1353 {
1354 DEBUG(D_tls)
1355 {
1356 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1357 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
1358 }
1359 goto bad;
1360 }
1361
1362 /* Here's the simplifying assumption: there's only one response, for the
1363 one certificate we use, and nothing for anything else in a chain. If this
1364 proves false, we need to extract a cert id from our issued cert
1365 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1366 right cert in the stack and then calls OCSP_single_get0_status()).
1367
1368 I'm hoping to avoid reworking a bunch more of how we handle state here.
1369
1370 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1371 */
1372
1373 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1374 {
1375 DEBUG(D_tls)
1376 debug_printf("Unable to get first response from OCSP basic response.\n");
1377 goto bad;
1378 }
1379
1380 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1381 if (status != V_OCSP_CERTSTATUS_GOOD)
1382 {
1383 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1384 OCSP_cert_status_str(status), status,
1385 OCSP_crl_reason_str(reason), reason);
1386 goto bad;
1387 }
1388
1389 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1390 {
1391 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
1392 goto bad;
1393 }
1394
1395 supply_response:
1396 /* Add the resp to the list used by tls_server_stapling_cb() */
1397 {
1398 ocsp_resplist ** op = &cbinfo->u_ocsp.server.olist, * oentry;
1399 while (oentry = *op)
1400 op = &oentry->next;
1401 *op = oentry = store_get(sizeof(ocsp_resplist), FALSE);
1402 oentry->next = NULL;
1403 oentry->resp = resp;
1404 }
1405 return;
1406
1407 bad:
1408 if (f.running_in_test_harness)
1409 {
1410 extern char ** environ;
1411 if (environ) for (uschar ** p = USS environ; *p; p++)
1412 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1413 {
1414 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1415 goto supply_response;
1416 }
1417 }
1418 return;
1419 }
1420
1421
1422 static void
1423 ocsp_free_response_list(tls_ext_ctx_cb * cbinfo)
1424 {
1425 for (ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; olist;
1426 olist = olist->next)
1427 OCSP_RESPONSE_free(olist->resp);
1428 cbinfo->u_ocsp.server.olist = NULL;
1429 }
1430 #endif /*!DISABLE_OCSP*/
1431
1432
1433
1434
1435 /* Create and install a selfsigned certificate, for use in server mode */
1436
1437 static int
1438 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
1439 {
1440 X509 * x509 = NULL;
1441 EVP_PKEY * pkey;
1442 RSA * rsa;
1443 X509_NAME * name;
1444 uschar * where;
1445
1446 where = US"allocating pkey";
1447 if (!(pkey = EVP_PKEY_new()))
1448 goto err;
1449
1450 where = US"allocating cert";
1451 if (!(x509 = X509_new()))
1452 goto err;
1453
1454 where = US"generating pkey";
1455 if (!(rsa = rsa_callback(NULL, 0, 2048)))
1456 goto err;
1457
1458 where = US"assigning pkey";
1459 if (!EVP_PKEY_assign_RSA(pkey, rsa))
1460 goto err;
1461
1462 X509_set_version(x509, 2); /* N+1 - version 3 */
1463 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
1464 X509_gmtime_adj(X509_get_notBefore(x509), 0);
1465 X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60); /* 1 hour */
1466 X509_set_pubkey(x509, pkey);
1467
1468 name = X509_get_subject_name(x509);
1469 X509_NAME_add_entry_by_txt(name, "C",
1470 MBSTRING_ASC, CUS "UK", -1, -1, 0);
1471 X509_NAME_add_entry_by_txt(name, "O",
1472 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
1473 X509_NAME_add_entry_by_txt(name, "CN",
1474 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
1475 X509_set_issuer_name(x509, name);
1476
1477 where = US"signing cert";
1478 if (!X509_sign(x509, pkey, EVP_md5()))
1479 goto err;
1480
1481 where = US"installing selfsign cert";
1482 if (!SSL_CTX_use_certificate(sctx, x509))
1483 goto err;
1484
1485 where = US"installing selfsign key";
1486 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
1487 goto err;
1488
1489 return OK;
1490
1491 err:
1492 (void) tls_error(where, NULL, NULL, errstr);
1493 if (x509) X509_free(x509);
1494 if (pkey) EVP_PKEY_free(pkey);
1495 return DEFER;
1496 }
1497
1498
1499
1500
1501 static int
1502 tls_add_certfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1503 uschar ** errstr)
1504 {
1505 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1506 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1507 return tls_error(string_sprintf(
1508 "SSL_CTX_use_certificate_chain_file file=%s", file),
1509 cbinfo->host, NULL, errstr);
1510 return 0;
1511 }
1512
1513 static int
1514 tls_add_pkeyfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1515 uschar ** errstr)
1516 {
1517 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1518 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1519 return tls_error(string_sprintf(
1520 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1521 return 0;
1522 }
1523
1524
1525 /*************************************************
1526 * Expand key and cert file specs *
1527 *************************************************/
1528
1529 /* Called once during tls_init and possibly again during TLS setup, for a
1530 new context, if Server Name Indication was used and tls_sni was seen in
1531 the certificate string.
1532
1533 Arguments:
1534 sctx the SSL_CTX* to update
1535 cbinfo various parts of session state
1536 errstr error string pointer
1537
1538 Returns: OK/DEFER/FAIL
1539 */
1540
1541 static int
1542 tls_expand_session_files(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo,
1543 uschar ** errstr)
1544 {
1545 uschar * expanded;
1546
1547 if (!cbinfo->certificate)
1548 {
1549 if (!cbinfo->is_server) /* client */
1550 return OK;
1551 /* server */
1552 if (tls_install_selfsign(sctx, errstr) != OK)
1553 return DEFER;
1554 }
1555 else
1556 {
1557 int err;
1558
1559 if ( !reexpand_tls_files_for_sni
1560 && ( Ustrstr(cbinfo->certificate, US"tls_sni")
1561 || Ustrstr(cbinfo->certificate, US"tls_in_sni")
1562 || Ustrstr(cbinfo->certificate, US"tls_out_sni")
1563 ) )
1564 reexpand_tls_files_for_sni = TRUE;
1565
1566 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded, errstr))
1567 return DEFER;
1568
1569 if (expanded)
1570 if (cbinfo->is_server)
1571 {
1572 const uschar * file_list = expanded;
1573 int sep = 0;
1574 uschar * file;
1575 #ifndef DISABLE_OCSP
1576 const uschar * olist = cbinfo->u_ocsp.server.file;
1577 int osep = 0;
1578 uschar * ofile;
1579 BOOL fmt_pem = FALSE;
1580
1581 if (olist)
1582 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1583 return DEFER;
1584 if (olist && !*olist)
1585 olist = NULL;
1586
1587 if ( cbinfo->u_ocsp.server.file_expanded && olist
1588 && (Ustrcmp(olist, cbinfo->u_ocsp.server.file_expanded) == 0))
1589 {
1590 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1591 olist = NULL;
1592 }
1593 else
1594 {
1595 ocsp_free_response_list(cbinfo);
1596 cbinfo->u_ocsp.server.file_expanded = olist;
1597 }
1598 #endif
1599
1600 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1601 {
1602 if ((err = tls_add_certfile(sctx, cbinfo, file, errstr)))
1603 return err;
1604
1605 #ifndef DISABLE_OCSP
1606 if (olist)
1607 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1608 {
1609 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1610 {
1611 fmt_pem = TRUE;
1612 ofile += 4;
1613 }
1614 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1615 {
1616 fmt_pem = FALSE;
1617 ofile += 4;
1618 }
1619 ocsp_load_response(sctx, cbinfo, ofile, fmt_pem);
1620 }
1621 else
1622 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1623 #endif
1624 }
1625 }
1626 else /* would there ever be a need for multiple client certs? */
1627 if ((err = tls_add_certfile(sctx, cbinfo, expanded, errstr)))
1628 return err;
1629
1630 if ( cbinfo->privatekey
1631 && !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded, errstr))
1632 return DEFER;
1633
1634 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1635 of the expansion is an empty string, ignore it also, and assume the private
1636 key is in the same file as the certificate. */
1637
1638 if (expanded && *expanded)
1639 if (cbinfo->is_server)
1640 {
1641 const uschar * file_list = expanded;
1642 int sep = 0;
1643 uschar * file;
1644
1645 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1646 if ((err = tls_add_pkeyfile(sctx, cbinfo, file, errstr)))
1647 return err;
1648 }
1649 else /* would there ever be a need for multiple client certs? */
1650 if ((err = tls_add_pkeyfile(sctx, cbinfo, expanded, errstr)))
1651 return err;
1652 }
1653
1654 return OK;
1655 }
1656
1657
1658
1659
1660 /*************************************************
1661 * Callback to handle SNI *
1662 *************************************************/
1663
1664 /* Called when acting as server during the TLS session setup if a Server Name
1665 Indication extension was sent by the client.
1666
1667 API documentation is OpenSSL s_server.c implementation.
1668
1669 Arguments:
1670 s SSL* of the current session
1671 ad unknown (part of OpenSSL API) (unused)
1672 arg Callback of "our" registered data
1673
1674 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
1675
1676 XXX might need to change to using ClientHello callback,
1677 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
1678 */
1679
1680 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1681 static int
1682 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
1683 {
1684 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
1685 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1686 int rc;
1687 int old_pool = store_pool;
1688 uschar * dummy_errstr;
1689
1690 if (!servername)
1691 return SSL_TLSEXT_ERR_OK;
1692
1693 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
1694 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
1695
1696 /* Make the extension value available for expansion */
1697 store_pool = POOL_PERM;
1698 tls_in.sni = string_copy_taint(US servername, TRUE);
1699 store_pool = old_pool;
1700
1701 if (!reexpand_tls_files_for_sni)
1702 return SSL_TLSEXT_ERR_OK;
1703
1704 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1705 not confident that memcpy wouldn't break some internal reference counting.
1706 Especially since there's a references struct member, which would be off. */
1707
1708 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1709 if (!(server_sni = SSL_CTX_new(TLS_server_method())))
1710 #else
1711 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
1712 #endif
1713 {
1714 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1715 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
1716 goto bad;
1717 }
1718
1719 /* Not sure how many of these are actually needed, since SSL object
1720 already exists. Might even need this selfsame callback, for reneg? */
1721
1722 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1723 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1724 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1725 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1726 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1727 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
1728
1729 if ( !init_dh(server_sni, cbinfo->dhparam, NULL, &dummy_errstr)
1730 || !init_ecdh(server_sni, NULL, &dummy_errstr)
1731 )
1732 goto bad;
1733
1734 if ( cbinfo->server_cipher_list
1735 && !SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list))
1736 goto bad;
1737
1738 #ifndef DISABLE_OCSP
1739 if (cbinfo->u_ocsp.server.file)
1740 {
1741 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
1742 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
1743 }
1744 #endif
1745
1746 if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
1747 verify_callback_server, &dummy_errstr)) != OK)
1748 goto bad;
1749
1750 /* do this after setup_certs, because this can require the certs for verifying
1751 OCSP information. */
1752 if ((rc = tls_expand_session_files(server_sni, cbinfo, &dummy_errstr)) != OK)
1753 goto bad;
1754
1755 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
1756 SSL_set_SSL_CTX(s, server_sni);
1757 return SSL_TLSEXT_ERR_OK;
1758
1759 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
1760 }
1761 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
1762
1763
1764
1765
1766 #ifndef DISABLE_OCSP
1767
1768 /*************************************************
1769 * Callback to handle OCSP Stapling *
1770 *************************************************/
1771
1772 /* Called when acting as server during the TLS session setup if the client
1773 requests OCSP information with a Certificate Status Request.
1774
1775 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1776 project.
1777
1778 */
1779
1780 static int
1781 tls_server_stapling_cb(SSL *s, void *arg)
1782 {
1783 const tls_ext_ctx_cb * cbinfo = (tls_ext_ctx_cb *) arg;
1784 ocsp_resplist * olist = cbinfo->u_ocsp.server.olist;
1785 uschar * response_der; /*XXX blob */
1786 int response_der_len;
1787
1788 DEBUG(D_tls)
1789 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
1790 olist ? "have" : "lack");
1791
1792 tls_in.ocsp = OCSP_NOT_RESP;
1793 if (!olist)
1794 return SSL_TLSEXT_ERR_NOACK;
1795
1796 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
1797 {
1798 const X509 * cert_sent = SSL_get_certificate(s);
1799 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
1800 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
1801 const X509_NAME * cert_issuer = X509_get_issuer_name(cert_sent);
1802 uschar * chash;
1803 uint chash_len;
1804
1805 for (; olist; olist = olist->next)
1806 {
1807 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
1808 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
1809 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
1810 ASN1_INTEGER * res_cert_serial;
1811 const BIGNUM * resp_bn;
1812 ASN1_OCTET_STRING * res_cert_iNameHash;
1813
1814
1815 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
1816 (OCSP_CERTID *) cid);
1817 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
1818
1819 DEBUG(D_tls)
1820 {
1821 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
1822 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
1823 }
1824
1825 if (BN_cmp(cert_bn, resp_bn) == 0)
1826 {
1827 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
1828
1829 /*XXX TODO: check the rest of the list for duplicate matches.
1830 If any, need to also check the Issuer Name hash.
1831 Without this, we will provide the wrong status in the case of
1832 duplicate id. */
1833
1834 break;
1835 }
1836 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
1837 }
1838 if (!olist)
1839 {
1840 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
1841 return SSL_TLSEXT_ERR_NOACK;
1842 }
1843 }
1844 #else
1845 if (olist->next)
1846 {
1847 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
1848 return SSL_TLSEXT_ERR_NOACK;
1849 }
1850 #endif
1851
1852 /*XXX could we do the i2d earlier, rather than during the callback? */
1853 response_der = NULL;
1854 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
1855 if (response_der_len <= 0)
1856 return SSL_TLSEXT_ERR_NOACK;
1857
1858 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
1859 tls_in.ocsp = OCSP_VFIED;
1860 return SSL_TLSEXT_ERR_OK;
1861 }
1862
1863
1864 static void
1865 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1866 {
1867 BIO_printf(bp, "\t%s: ", str);
1868 ASN1_GENERALIZEDTIME_print(bp, time);
1869 BIO_puts(bp, "\n");
1870 }
1871
1872 static int
1873 tls_client_stapling_cb(SSL *s, void *arg)
1874 {
1875 tls_ext_ctx_cb * cbinfo = arg;
1876 const unsigned char * p;
1877 int len;
1878 OCSP_RESPONSE * rsp;
1879 OCSP_BASICRESP * bs;
1880 int i;
1881
1882 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
1883 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1884 if(!p)
1885 {
1886 /* Expect this when we requested ocsp but got none */
1887 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
1888 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
1889 else
1890 DEBUG(D_tls) debug_printf(" null\n");
1891 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1892 }
1893
1894 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1895 {
1896 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
1897 if (LOGGING(tls_cipher))
1898 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
1899 else
1900 DEBUG(D_tls) debug_printf(" parse error\n");
1901 return 0;
1902 }
1903
1904 if (!(bs = OCSP_response_get1_basic(rsp)))
1905 {
1906 tls_out.ocsp = OCSP_FAILED;
1907 if (LOGGING(tls_cipher))
1908 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
1909 else
1910 DEBUG(D_tls) debug_printf(" error parsing response\n");
1911 OCSP_RESPONSE_free(rsp);
1912 return 0;
1913 }
1914
1915 /* We'd check the nonce here if we'd put one in the request. */
1916 /* However that would defeat cacheability on the server so we don't. */
1917
1918 /* This section of code reworked from OpenSSL apps source;
1919 The OpenSSL Project retains copyright:
1920 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1921 */
1922 {
1923 BIO * bp = NULL;
1924 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
1925 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1926 #endif
1927
1928 DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1929
1930 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1931
1932 /* Use the chain that verified the server cert to verify the stapled info */
1933 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1934
1935 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
1936 cbinfo->u_ocsp.client.verify_store, OCSP_NOEXPLICIT)) <= 0)
1937 if (ERR_peek_error())
1938 {
1939 tls_out.ocsp = OCSP_FAILED;
1940 if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
1941 "Received TLS cert status response, itself unverifiable: %s",
1942 ERR_reason_error_string(ERR_peek_error()));
1943 BIO_printf(bp, "OCSP response verify failure\n");
1944 ERR_print_errors(bp);
1945 OCSP_RESPONSE_print(bp, rsp, 0);
1946 goto failed;
1947 }
1948 else
1949 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
1950 " in the root CA certificate; ignoring\n");
1951
1952 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
1953
1954 /*XXX So we have a good stapled OCSP status. How do we know
1955 it is for the cert of interest? OpenSSL 1.1.0 has a routine
1956 OCSP_resp_find_status() which matches on a cert id, which presumably
1957 we should use. Making an id needs OCSP_cert_id_new(), which takes
1958 issuerName, issuerKey, serialNumber. Are they all in the cert?
1959
1960 For now, carry on blindly accepting the resp. */
1961
1962 for (int idx =
1963 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
1964 OCSP_resp_count(bs) - 1;
1965 #else
1966 sk_OCSP_SINGLERESP_num(sresp) - 1;
1967 #endif
1968 idx >= 0; idx--)
1969 {
1970 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
1971 int status, reason;
1972 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1973
1974 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
1975 - but what happens with a GnuTLS-style input?
1976
1977 we could do with a debug label for each singleresp
1978 - it has a certID with a serialNumber, but I see no API to get that
1979 */
1980 status = OCSP_single_get0_status(single, &reason, &rev,
1981 &thisupd, &nextupd);
1982
1983 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1984 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1985 if (!OCSP_check_validity(thisupd, nextupd,
1986 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1987 {
1988 tls_out.ocsp = OCSP_FAILED;
1989 DEBUG(D_tls) ERR_print_errors(bp);
1990 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1991 goto failed;
1992 }
1993
1994 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1995 OCSP_cert_status_str(status));
1996 switch(status)
1997 {
1998 case V_OCSP_CERTSTATUS_GOOD:
1999 continue; /* the idx loop */
2000 case V_OCSP_CERTSTATUS_REVOKED:
2001 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2002 reason != -1 ? "; reason: " : "",
2003 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2004 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2005 break;
2006 default:
2007 log_write(0, LOG_MAIN,
2008 "Server certificate status unknown, in OCSP stapling");
2009 break;
2010 }
2011
2012 goto failed;
2013 }
2014
2015 i = 1;
2016 tls_out.ocsp = OCSP_VFIED;
2017 goto good;
2018
2019 failed:
2020 tls_out.ocsp = OCSP_FAILED;
2021 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2022 good:
2023 BIO_free(bp);
2024 }
2025
2026 OCSP_RESPONSE_free(rsp);
2027 return i;
2028 }
2029 #endif /*!DISABLE_OCSP*/
2030
2031
2032 /*************************************************
2033 * Initialize for TLS *
2034 *************************************************/
2035
2036 static void
2037 tls_openssl_init(void)
2038 {
2039 #ifdef EXIM_NEED_OPENSSL_INIT
2040 SSL_load_error_strings(); /* basic set up */
2041 OpenSSL_add_ssl_algorithms();
2042 #endif
2043
2044 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
2045 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2046 list of available digests. */
2047 EVP_add_digest(EVP_sha256());
2048 #endif
2049 }
2050
2051
2052
2053 /* Called from both server and client code, to do preliminary initialization
2054 of the library. We allocate and return a context structure.
2055
2056 Arguments:
2057 ctxp returned SSL context
2058 host connected host, if client; NULL if server
2059 dhparam DH parameter file
2060 certificate certificate file
2061 privatekey private key
2062 ocsp_file file of stapling info (server); flag for require ocsp (client)
2063 addr address if client; NULL if server (for some randomness)
2064 cbp place to put allocated callback context
2065 errstr error string pointer
2066
2067 Returns: OK/DEFER/FAIL
2068 */
2069
2070 static int
2071 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
2072 uschar *privatekey,
2073 #ifndef DISABLE_OCSP
2074 uschar *ocsp_file,
2075 #endif
2076 address_item *addr, tls_ext_ctx_cb ** cbp,
2077 tls_support * tlsp,
2078 uschar ** errstr)
2079 {
2080 SSL_CTX * ctx;
2081 long init_options;
2082 int rc;
2083 tls_ext_ctx_cb * cbinfo;
2084
2085 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
2086 cbinfo->tlsp = tlsp;
2087 cbinfo->certificate = certificate;
2088 cbinfo->privatekey = privatekey;
2089 cbinfo->is_server = host==NULL;
2090 #ifndef DISABLE_OCSP
2091 cbinfo->verify_stack = NULL;
2092 if (!host)
2093 {
2094 cbinfo->u_ocsp.server.file = ocsp_file;
2095 cbinfo->u_ocsp.server.file_expanded = NULL;
2096 cbinfo->u_ocsp.server.olist = NULL;
2097 }
2098 else
2099 cbinfo->u_ocsp.client.verify_store = NULL;
2100 #endif
2101 cbinfo->dhparam = dhparam;
2102 cbinfo->server_cipher_list = NULL;
2103 cbinfo->host = host;
2104 #ifndef DISABLE_EVENT
2105 cbinfo->event_action = NULL;
2106 #endif
2107
2108 tls_openssl_init();
2109
2110 /* Create a context.
2111 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2112 negotiation in the different methods; as far as I can tell, the only
2113 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2114 when OpenSSL is built without SSLv2 support.
2115 By disabling with openssl_options, we can let admins re-enable with the
2116 existing knob. */
2117
2118 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
2119 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
2120 #else
2121 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
2122 #endif
2123 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
2124
2125 /* It turns out that we need to seed the random number generator this early in
2126 order to get the full complement of ciphers to work. It took me roughly a day
2127 of work to discover this by experiment.
2128
2129 On systems that have /dev/urandom, SSL may automatically seed itself from
2130 there. Otherwise, we have to make something up as best we can. Double check
2131 afterwards. */
2132
2133 if (!RAND_status())
2134 {
2135 randstuff r;
2136 gettimeofday(&r.tv, NULL);
2137 r.p = getpid();
2138
2139 RAND_seed(US (&r), sizeof(r));
2140 RAND_seed(US big_buffer, big_buffer_size);
2141 if (addr != NULL) RAND_seed(US addr, sizeof(addr));
2142
2143 if (!RAND_status())
2144 return tls_error(US"RAND_status", host,
2145 US"unable to seed random number generator", errstr);
2146 }
2147
2148 /* Set up the information callback, which outputs if debugging is at a suitable
2149 level. */
2150
2151 DEBUG(D_tls)
2152 {
2153 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
2154 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
2155 /* this needs a debug build of OpenSSL */
2156 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
2157 #endif
2158 #ifdef OPENSSL_HAVE_KEYLOG_CB
2159 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
2160 #endif
2161 }
2162
2163 /* Automatically re-try reads/writes after renegotiation. */
2164 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
2165
2166 /* Apply administrator-supplied work-arounds.
2167 Historically we applied just one requested option,
2168 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2169 moved to an administrator-controlled list of options to specify and
2170 grandfathered in the first one as the default value for "openssl_options".
2171
2172 No OpenSSL version number checks: the options we accept depend upon the
2173 availability of the option value macros from OpenSSL. */
2174
2175 if (!tls_openssl_options_parse(openssl_options, &init_options))
2176 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2177
2178 #ifdef EXPERIMENTAL_TLS_RESUME
2179 tlsp->resumption = RESUME_SUPPORTED;
2180 #endif
2181 if (init_options)
2182 {
2183 #ifdef EXPERIMENTAL_TLS_RESUME
2184 /* Should the server offer session resumption? */
2185 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2186 {
2187 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2188 init_options &= ~SSL_OP_NO_TICKET;
2189 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2190 tlsp->host_resumable = TRUE;
2191 }
2192 #endif
2193
2194 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
2195 if (!(SSL_CTX_set_options(ctx, init_options)))
2196 return tls_error(string_sprintf(
2197 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2198 }
2199 else
2200 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2201
2202 /* We'd like to disable session cache unconditionally, but foolish Outlook
2203 Express clients then give up the first TLS connection and make a second one
2204 (which works). Only when there is an IMAP service on the same machine.
2205 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2206 now, until we work out a decent way of presenting control to the config. It
2207 will never be used because we use a new context every time. */
2208 #ifdef notdef
2209 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2210 #endif
2211
2212 /* Initialize with DH parameters if supplied */
2213 /* Initialize ECDH temp key parameter selection */
2214
2215 if ( !init_dh(ctx, dhparam, host, errstr)
2216 || !init_ecdh(ctx, host, errstr)
2217 )
2218 return DEFER;
2219
2220 /* Set up certificate and key (and perhaps OCSP info) */
2221
2222 if ((rc = tls_expand_session_files(ctx, cbinfo, errstr)) != OK)
2223 return rc;
2224
2225 /* If we need to handle SNI or OCSP, do so */
2226
2227 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2228 # ifndef DISABLE_OCSP
2229 if (!(cbinfo->verify_stack = sk_X509_new_null()))
2230 {
2231 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2232 return FAIL;
2233 }
2234 # endif
2235
2236 if (!host) /* server */
2237 {
2238 # ifndef DISABLE_OCSP
2239 /* We check u_ocsp.server.file, not server.olist, because we care about if
2240 the option exists, not what the current expansion might be, as SNI might
2241 change the certificate and OCSP file in use between now and the time the
2242 callback is invoked. */
2243 if (cbinfo->u_ocsp.server.file)
2244 {
2245 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2246 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
2247 }
2248 # endif
2249 /* We always do this, so that $tls_sni is available even if not used in
2250 tls_certificate */
2251 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2252 SSL_CTX_set_tlsext_servername_arg(ctx, cbinfo);
2253 }
2254 # ifndef DISABLE_OCSP
2255 else /* client */
2256 if(ocsp_file) /* wanting stapling */
2257 {
2258 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
2259 {
2260 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2261 return FAIL;
2262 }
2263 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2264 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
2265 }
2266 # endif
2267 #endif
2268
2269 cbinfo->verify_cert_hostnames = NULL;
2270
2271 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
2272 /* Set up the RSA callback */
2273 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
2274 #endif
2275
2276 /* Finally, set the session cache timeout, and we are done.
2277 The period appears to be also used for (server-generated) session tickets */
2278
2279 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
2280 DEBUG(D_tls) debug_printf("Initialized TLS\n");
2281
2282 *cbp = cbinfo;
2283 *ctxp = ctx;
2284
2285 return OK;
2286 }
2287
2288
2289
2290
2291 /*************************************************
2292 * Get name of cipher in use *
2293 *************************************************/
2294
2295 /*
2296 Argument: pointer to an SSL structure for the connection
2297 pointer to number of bits for cipher
2298 Returns: pointer to allocated string in perm-pool
2299 */
2300
2301 static uschar *
2302 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
2303 {
2304 int pool = store_pool;
2305 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
2306 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2307 the accessor functions use const in the prototype. */
2308
2309 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
2310 uschar * s;
2311
2312 SSL_CIPHER_get_bits(c, bits);
2313
2314 store_pool = POOL_PERM;
2315 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2316 store_pool = pool;
2317 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2318 return s;
2319 }
2320
2321
2322 /* Get IETF-standard name for ciphersuite.
2323 Argument: pointer to an SSL structure for the connection
2324 Returns: pointer to string
2325 */
2326
2327 static const uschar *
2328 cipher_stdname_ssl(SSL * ssl)
2329 {
2330 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2331 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2332 #else
2333 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2334 return cipher_stdname(id >> 8, id & 0xff);
2335 #endif
2336 }
2337
2338
2339 static const uschar *
2340 tlsver_name(SSL * ssl)
2341 {
2342 uschar * s, * p;
2343 int pool = store_pool;
2344
2345 store_pool = POOL_PERM;
2346 s = string_copy(US SSL_get_version(ssl));
2347 store_pool = pool;
2348 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
2349 for (;; p++) if (!(*p = p[1])) break;
2350 return CUS s;
2351 }
2352
2353
2354 static void
2355 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
2356 {
2357 /*XXX we might consider a list-of-certs variable for the cert chain.
2358 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2359 in list-handling functions, also consider the difference between the entire
2360 chain and the elements sent by the peer. */
2361
2362 tlsp->peerdn = NULL;
2363
2364 /* Will have already noted peercert on a verify fail; possibly not the leaf */
2365 if (!tlsp->peercert)
2366 tlsp->peercert = SSL_get_peer_certificate(ssl);
2367 /* Beware anonymous ciphers which lead to server_cert being NULL */
2368 if (tlsp->peercert)
2369 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2370 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2371 else
2372 {
2373 int oldpool = store_pool;
2374
2375 peerdn[siz-1] = '\0'; /* paranoia */
2376 store_pool = POOL_PERM;
2377 tlsp->peerdn = string_copy(peerdn);
2378 store_pool = oldpool;
2379
2380 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2381 but they don't get called on session-resumption. So use the official
2382 interface, which uses the resumed value. Unfortunately this claims verified
2383 when it actually failed but we're in try-verify mode, due to us wanting the
2384 knowlege that it failed so needing to have the callback and forcing a
2385 permissive return. If we don't force it, the TLS startup is failed.
2386 The extra bit of information is set in verify_override in the cb, stashed
2387 for resumption next to the TLS session, and used here. */
2388
2389 if (!tlsp->verify_override)
2390 tlsp->certificate_verified =
2391 #ifdef SUPPORT_DANE
2392 tlsp->dane_verified ||
2393 #endif
2394 SSL_get_verify_result(ssl) == X509_V_OK;
2395 }
2396 }
2397
2398
2399
2400
2401
2402 /*************************************************
2403 * Set up for verifying certificates *
2404 *************************************************/
2405
2406 #ifndef DISABLE_OCSP
2407 /* Load certs from file, return TRUE on success */
2408
2409 static BOOL
2410 chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
2411 {
2412 BIO * bp;
2413 X509 * x;
2414
2415 while (sk_X509_num(verify_stack) > 0)
2416 X509_free(sk_X509_pop(verify_stack));
2417
2418 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
2419 while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
2420 sk_X509_push(verify_stack, x);
2421 BIO_free(bp);
2422 return TRUE;
2423 }
2424 #endif
2425
2426
2427
2428 /* Called by both client and server startup; on the server possibly
2429 repeated after a Server Name Indication.
2430
2431 Arguments:
2432 sctx SSL_CTX* to initialise
2433 certs certs file or NULL
2434 crl CRL file or NULL
2435 host NULL in a server; the remote host in a client
2436 optional TRUE if called from a server for a host in tls_try_verify_hosts;
2437 otherwise passed as FALSE
2438 cert_vfy_cb Callback function for certificate verification
2439 errstr error string pointer
2440
2441 Returns: OK/DEFER/FAIL
2442 */
2443
2444 static int
2445 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
2446 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr)
2447 {
2448 uschar *expcerts, *expcrl;
2449
2450 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
2451 return DEFER;
2452 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
2453
2454 if (expcerts && *expcerts)
2455 {
2456 /* Tell the library to use its compiled-in location for the system default
2457 CA bundle. Then add the ones specified in the config, if any. */
2458
2459 if (!SSL_CTX_set_default_verify_paths(sctx))
2460 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
2461
2462 if (Ustrcmp(expcerts, "system") != 0)
2463 {
2464 struct stat statbuf;
2465
2466 if (Ustat(expcerts, &statbuf) < 0)
2467 {
2468 log_write(0, LOG_MAIN|LOG_PANIC,
2469 "failed to stat %s for certificates", expcerts);
2470 return DEFER;
2471 }
2472 else
2473 {
2474 uschar *file, *dir;
2475 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
2476 { file = NULL; dir = expcerts; }
2477 else
2478 {
2479 file = expcerts; dir = NULL;
2480 #ifndef DISABLE_OCSP
2481 /* In the server if we will be offering an OCSP proof, load chain from
2482 file for verifying the OCSP proof at load time. */
2483
2484 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
2485 This is inconsistent with the need to verify the OCSP proof of the server cert.
2486 */
2487
2488 if ( !host
2489 && statbuf.st_size > 0
2490 && server_static_cbinfo->u_ocsp.server.file
2491 && !chain_from_pem_file(file, server_static_cbinfo->verify_stack)
2492 )
2493 {
2494 log_write(0, LOG_MAIN|LOG_PANIC,
2495 "failed to load cert chain from %s", file);
2496 return DEFER;
2497 }
2498 #endif
2499 }
2500
2501 /* If a certificate file is empty, the load function fails with an
2502 unhelpful error message. If we skip it, we get the correct behaviour (no
2503 certificates are recognized, but the error message is still misleading (it
2504 says no certificate was supplied). But this is better. */
2505
2506 if ( (!file || statbuf.st_size > 0)
2507 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
2508 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL, errstr);
2509
2510 /* On the server load the list of CAs for which we will accept certs, for
2511 sending to the client. This is only for the one-file
2512 tls_verify_certificates variant.
2513 If a list isn't loaded into the server, but some verify locations are set,
2514 the server end appears to make a wildcard request for client certs.
2515 Meanwhile, the client library as default behaviour *ignores* the list
2516 we send over the wire - see man SSL_CTX_set_client_cert_cb.
2517 Because of this, and that the dir variant is likely only used for
2518 the public-CA bundle (not for a private CA), not worth fixing. */
2519
2520 if (file)
2521 {
2522 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
2523
2524 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
2525 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
2526 sk_X509_NAME_num(names));
2527 }
2528 }
2529 }
2530
2531 /* Handle a certificate revocation list. */
2532
2533 #if OPENSSL_VERSION_NUMBER > 0x00907000L
2534
2535 /* This bit of code is now the version supplied by Lars Mainka. (I have
2536 merely reformatted it into the Exim code style.)
2537
2538 "From here I changed the code to add support for multiple crl's
2539 in pem format in one file or to support hashed directory entries in
2540 pem format instead of a file. This method now uses the library function
2541 X509_STORE_load_locations to add the CRL location to the SSL context.
2542 OpenSSL will then handle the verify against CA certs and CRLs by
2543 itself in the verify callback." */
2544
2545 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
2546 if (expcrl && *expcrl)
2547 {
2548 struct stat statbufcrl;
2549 if (Ustat(expcrl, &statbufcrl) < 0)
2550 {
2551 log_write(0, LOG_MAIN|LOG_PANIC,
2552 "failed to stat %s for certificates revocation lists", expcrl);
2553 return DEFER;
2554 }
2555 else
2556 {
2557 /* is it a file or directory? */
2558 uschar *file, *dir;
2559 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
2560 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
2561 {
2562 file = NULL;
2563 dir = expcrl;
2564 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
2565 }
2566 else
2567 {
2568 file = expcrl;
2569 dir = NULL;
2570 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
2571 }
2572 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
2573 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
2574
2575 /* setting the flags to check against the complete crl chain */
2576
2577 X509_STORE_set_flags(cvstore,
2578 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
2579 }
2580 }
2581
2582 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
2583
2584 /* If verification is optional, don't fail if no certificate */
2585
2586 SSL_CTX_set_verify(sctx,
2587 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2588 cert_vfy_cb);
2589 }
2590
2591 return OK;
2592 }
2593
2594
2595
2596 /*************************************************
2597 * Start a TLS session in a server *
2598 *************************************************/
2599
2600 /* This is called when Exim is running as a server, after having received
2601 the STARTTLS command. It must respond to that command, and then negotiate
2602 a TLS session.
2603
2604 Arguments:
2605 require_ciphers allowed ciphers
2606 errstr pointer to error message
2607
2608 Returns: OK on success
2609 DEFER for errors before the start of the negotiation
2610 FAIL for errors during the negotiation; the server can't
2611 continue running.
2612 */
2613
2614 int
2615 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
2616 {
2617 int rc;
2618 uschar * expciphers;
2619 tls_ext_ctx_cb * cbinfo;
2620 static uschar peerdn[256];
2621
2622 /* Check for previous activation */
2623
2624 if (tls_in.active.sock >= 0)
2625 {
2626 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
2627 smtp_printf("554 Already in TLS\r\n", FALSE);
2628 return FAIL;
2629 }
2630
2631 /* Initialize the SSL library. If it fails, it will already have logged
2632 the error. */
2633
2634 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
2635 #ifndef DISABLE_OCSP
2636 tls_ocsp_file,
2637 #endif
2638 NULL, &server_static_cbinfo, &tls_in, errstr);
2639 if (rc != OK) return rc;
2640 cbinfo = server_static_cbinfo;
2641
2642 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
2643 return FAIL;
2644
2645 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
2646 were historically separated by underscores. So that I can use either form in my
2647 tests, and also for general convenience, we turn underscores into hyphens here.
2648
2649 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
2650 for TLS 1.3 . Since we do not call it at present we get the default list:
2651 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
2652 */
2653
2654 if (expciphers)
2655 {
2656 for (uschar * s = expciphers; *s; s++ ) if (*s == '_') *s = '-';
2657 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
2658 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
2659 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
2660 cbinfo->server_cipher_list = expciphers;
2661 }
2662
2663 /* If this is a host for which certificate verification is mandatory or
2664 optional, set up appropriately. */
2665
2666 tls_in.certificate_verified = FALSE;
2667 #ifdef SUPPORT_DANE
2668 tls_in.dane_verified = FALSE;
2669 #endif
2670 server_verify_callback_called = FALSE;
2671
2672 if (verify_check_host(&tls_verify_hosts) == OK)
2673 {
2674 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
2675 FALSE, verify_callback_server, errstr);
2676 if (rc != OK) return rc;
2677 server_verify_optional = FALSE;
2678 }
2679 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2680 {
2681 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
2682 TRUE, verify_callback_server, errstr);
2683 if (rc != OK) return rc;
2684 server_verify_optional = TRUE;
2685 }
2686
2687 #ifdef EXPERIMENTAL_TLS_RESUME
2688 SSL_CTX_set_tlsext_ticket_key_cb(server_ctx, ticket_key_callback);
2689 /* despite working, appears to always return failure, so ignoring */
2690 #endif
2691 #ifdef OPENSSL_HAVE_NUM_TICKETS
2692 # ifdef EXPERIMENTAL_TLS_RESUME
2693 SSL_CTX_set_num_tickets(server_ctx, tls_in.host_resumable ? 1 : 0);
2694 # else
2695 SSL_CTX_set_num_tickets(server_ctx, 0); /* send no TLS1.3 stateful-tickets */
2696 # endif
2697 #endif
2698
2699
2700 /* Prepare for new connection */
2701
2702 if (!(server_ssl = SSL_new(server_ctx)))
2703 return tls_error(US"SSL_new", NULL, NULL, errstr);
2704
2705 /* Warning: we used to SSL_clear(ssl) here, it was removed.
2706 *
2707 * With the SSL_clear(), we get strange interoperability bugs with
2708 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
2709 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
2710 *
2711 * The SSL_clear() call is to let an existing SSL* be reused, typically after
2712 * session shutdown. In this case, we have a brand new object and there's no
2713 * obvious reason to immediately clear it. I'm guessing that this was
2714 * originally added because of incomplete initialisation which the clear fixed,
2715 * in some historic release.
2716 */
2717
2718 /* Set context and tell client to go ahead, except in the case of TLS startup
2719 on connection, where outputting anything now upsets the clients and tends to
2720 make them disconnect. We need to have an explicit fflush() here, to force out
2721 the response. Other smtp_printf() calls do not need it, because in non-TLS
2722 mode, the fflush() happens when smtp_getc() is called. */
2723
2724 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
2725 if (!tls_in.on_connect)
2726 {
2727 smtp_printf("220 TLS go ahead\r\n", FALSE);
2728 fflush(smtp_out);
2729 }
2730
2731 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2732 that the OpenSSL library doesn't. */
2733
2734 SSL_set_wfd(server_ssl, fileno(smtp_out));
2735 SSL_set_rfd(server_ssl, fileno(smtp_in));
2736 SSL_set_accept_state(server_ssl);
2737
2738 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
2739
2740 sigalrm_seen = FALSE;
2741 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2742 rc = SSL_accept(server_ssl);
2743 ALARM_CLR(0);
2744
2745 if (rc <= 0)
2746 {
2747 int error = SSL_get_error(server_ssl, rc);
2748 switch(error)
2749 {
2750 case SSL_ERROR_NONE:
2751 break;
2752
2753 case SSL_ERROR_ZERO_RETURN:
2754 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2755 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2756
2757 if (SSL_get_shutdown(server_ssl) == SSL_RECEIVED_SHUTDOWN)
2758 SSL_shutdown(server_ssl);
2759
2760 tls_close(NULL, TLS_NO_SHUTDOWN);
2761 return FAIL;
2762
2763 /* Handle genuine errors */
2764 case SSL_ERROR_SSL:
2765 {
2766 uschar * s = US"SSL_accept";
2767 int r = ERR_GET_REASON(ERR_peek_error());
2768 if ( r == SSL_R_WRONG_VERSION_NUMBER
2769 #ifdef SSL_R_VERSION_TOO_LOW
2770 || r == SSL_R_VERSION_TOO_LOW
2771 #endif
2772 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
2773 s = string_sprintf("%s (%s)", s, SSL_get_version(server_ssl));
2774 (void) tls_error(s, NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2775 return FAIL;
2776 }
2777
2778 default:
2779 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2780 if (error == SSL_ERROR_SYSCALL)
2781 {
2782 if (!errno)
2783 {
2784 *errstr = US"SSL_accept: TCP connection closed by peer";
2785 return FAIL;
2786 }
2787 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
2788 }
2789 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2790 return FAIL;
2791 }
2792 }
2793
2794 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
2795 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
2796 anon-authentication ciphersuite negotiated. */
2797
2798 #ifdef EXPERIMENTAL_TLS_RESUME
2799 if (SSL_session_reused(server_ssl))
2800 {
2801 tls_in.resumption |= RESUME_USED;
2802 DEBUG(D_tls) debug_printf("Session reused\n");
2803 }
2804 #endif
2805
2806 /* TLS has been set up. Record data for the connection,
2807 adjust the input functions to read via TLS, and initialize things. */
2808
2809 #ifdef SSL_get_extms_support
2810 tls_in.ext_master_secret = SSL_get_extms_support(server_ssl) == 1;
2811 #endif
2812 peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
2813
2814 tls_in.ver = tlsver_name(server_ssl);
2815 tls_in.cipher = construct_cipher_name(server_ssl, tls_in.ver, &tls_in.bits);
2816 tls_in.cipher_stdname = cipher_stdname_ssl(server_ssl);
2817
2818 DEBUG(D_tls)
2819 {
2820 uschar buf[2048];
2821 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)))
2822 debug_printf("Shared ciphers: %s\n", buf);
2823
2824 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
2825 {
2826 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
2827 SSL_SESSION_print_keylog(bp, SSL_get_session(server_ssl));
2828 BIO_free(bp);
2829 }
2830 #endif
2831
2832 #ifdef EXIM_HAVE_SESSION_TICKET
2833 {
2834 SSL_SESSION * ss = SSL_get_session(server_ssl);
2835 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
2836 debug_printf("The session has a ticket, life %lu seconds\n",
2837 SSL_SESSION_get_ticket_lifetime_hint(ss));
2838 }
2839 #endif
2840 }
2841
2842 /* Record the certificate we presented */
2843 {
2844 X509 * crt = SSL_get_certificate(server_ssl);
2845 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
2846 }
2847
2848 /* Channel-binding info for authenticators
2849 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/ */
2850 {
2851 uschar c, * s;
2852 size_t len = SSL_get_peer_finished(server_ssl, &c, 0);
2853 int old_pool = store_pool;
2854
2855 SSL_get_peer_finished(server_ssl, s = store_get((int)len, FALSE), len);
2856 store_pool = POOL_PERM;
2857 tls_in.channelbinding = b64encode_taint(CUS s, (int)len, FALSE);
2858 store_pool = old_pool;
2859 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p\n", tls_in.channelbinding);
2860 }
2861
2862 /* Only used by the server-side tls (tls_in), including tls_getc.
2863 Client-side (tls_out) reads (seem to?) go via
2864 smtp_read_response()/ip_recv().
2865 Hence no need to duplicate for _in and _out.
2866 */
2867 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2868 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
2869 ssl_xfer_eof = ssl_xfer_error = FALSE;
2870
2871 receive_getc = tls_getc;
2872 receive_getbuf = tls_getbuf;
2873 receive_get_cache = tls_get_cache;
2874 receive_ungetc = tls_ungetc;
2875 receive_feof = tls_feof;
2876 receive_ferror = tls_ferror;
2877 receive_smtp_buffered = tls_smtp_buffered;
2878
2879 tls_in.active.sock = fileno(smtp_out);
2880 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
2881 return OK;
2882 }
2883
2884
2885
2886
2887 static int
2888 tls_client_basic_ctx_init(SSL_CTX * ctx,
2889 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo,
2890 uschar ** errstr)
2891 {
2892 int rc;
2893 /* stick to the old behaviour for compatibility if tls_verify_certificates is
2894 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2895 the specified host patterns if one of them is defined */
2896
2897 if ( ( !ob->tls_verify_hosts
2898 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2899 )
2900 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
2901 )
2902 client_verify_optional = FALSE;
2903 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
2904 client_verify_optional = TRUE;
2905 else
2906 return OK;
2907
2908 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
2909 ob->tls_crl, host, client_verify_optional, verify_callback_client,
2910 errstr)) != OK)
2911 return rc;
2912
2913 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2914 {
2915 cbinfo->verify_cert_hostnames =
2916 #ifdef SUPPORT_I18N
2917 string_domain_utf8_to_alabel(host->name, NULL);
2918 #else
2919 host->name;
2920 #endif
2921 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
2922 cbinfo->verify_cert_hostnames);
2923 }
2924 return OK;
2925 }
2926
2927
2928 #ifdef SUPPORT_DANE
2929 static int
2930 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
2931 {
2932 dns_scan dnss;
2933 const char * hostnames[2] = { CS host->name, NULL };
2934 int found = 0;
2935
2936 if (DANESSL_init(ssl, NULL, hostnames) != 1)
2937 return tls_error(US"hostnames load", host, NULL, errstr);
2938
2939 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2940 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2941 ) if (rr->type == T_TLSA && rr->size > 3)
2942 {
2943 const uschar * p = rr->data;
2944 uint8_t usage, selector, mtype;
2945 const char * mdname;
2946
2947 usage = *p++;
2948
2949 /* Only DANE-TA(2) and DANE-EE(3) are supported */
2950 if (usage != 2 && usage != 3) continue;
2951
2952 selector = *p++;
2953 mtype = *p++;
2954
2955 switch (mtype)
2956 {
2957 default: continue; /* Only match-types 0, 1, 2 are supported */
2958 case 0: mdname = NULL; break;
2959 case 1: mdname = "sha256"; break;
2960 case 2: mdname = "sha512"; break;
2961 }
2962
2963 found++;
2964 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
2965 {
2966 default:
2967 return tls_error(US"tlsa load", host, NULL, errstr);
2968 case 0: /* action not taken */
2969 case 1: break;
2970 }
2971
2972 tls_out.tlsa_usage |= 1<<usage;
2973 }
2974
2975 if (found)
2976 return OK;
2977
2978 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
2979 return DEFER;
2980 }
2981 #endif /*SUPPORT_DANE*/
2982
2983
2984
2985 #ifdef EXPERIMENTAL_TLS_RESUME
2986 /* On the client, get any stashed session for the given IP from hints db
2987 and apply it to the ssl-connection for attempted resumption. */
2988
2989 static void
2990 tls_retrieve_session(tls_support * tlsp, SSL * ssl, const uschar * key)
2991 {
2992 tlsp->resumption |= RESUME_SUPPORTED;
2993 if (tlsp->host_resumable)
2994 {
2995 dbdata_tls_session * dt;
2996 int len;
2997 open_db dbblock, * dbm_file;
2998
2999 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3000 DEBUG(D_tls) debug_printf("checking for resumable session for %s\n", key);
3001 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3002 {
3003 /* key for the db is the IP */
3004 if ((dt = dbfn_read_with_length(dbm_file, key, &len)))
3005 {
3006 SSL_SESSION * ss = NULL;
3007 const uschar * sess_asn1 = dt->session;
3008
3009 len -= sizeof(dbdata_tls_session);
3010 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3011 {
3012 DEBUG(D_tls)
3013 {
3014 ERR_error_string_n(ERR_get_error(),
3015 ssl_errstring, sizeof(ssl_errstring));
3016 debug_printf("decoding session: %s\n", ssl_errstring);
3017 }
3018 }
3019 #ifdef EXIM_HAVE_SESSION_TICKET
3020 else if ( SSL_SESSION_get_ticket_lifetime_hint(ss) + dt->time_stamp
3021 < time(NULL))
3022 {
3023 DEBUG(D_tls) debug_printf("session expired\n");
3024 dbfn_delete(dbm_file, key);
3025 }
3026 #endif
3027 else if (!SSL_set_session(ssl, ss))
3028 {
3029 DEBUG(D_tls)
3030 {
3031 ERR_error_string_n(ERR_get_error(),
3032 ssl_errstring, sizeof(ssl_errstring));
3033 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3034 }
3035 }
3036 else
3037 {
3038 DEBUG(D_tls) debug_printf("good session\n");
3039 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3040 tlsp->verify_override = dt->verify_override;
3041 tlsp->ocsp = dt->ocsp;
3042 }
3043 }
3044 else
3045 DEBUG(D_tls) debug_printf("no session record\n");
3046 dbfn_close(dbm_file);
3047 }
3048 }
3049 }
3050
3051
3052 /* On the client, save the session for later resumption */
3053
3054 static int
3055 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3056 {
3057 tls_ext_ctx_cb * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3058 tls_support * tlsp;
3059
3060 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3061
3062 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3063
3064 # ifdef OPENSSL_HAVE_NUM_TICKETS
3065 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3066 # endif
3067 {
3068 int len = i2d_SSL_SESSION(ss, NULL);
3069 int dlen = sizeof(dbdata_tls_session) + len;
3070 dbdata_tls_session * dt = store_get(dlen, TRUE);
3071 uschar * s = dt->session;
3072 open_db dbblock, * dbm_file;
3073
3074 DEBUG(D_tls) debug_printf("session is resumable\n");
3075 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3076
3077 dt->verify_override = tlsp->verify_override;
3078 dt->ocsp = tlsp->ocsp;
3079 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3080
3081 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3082 {
3083 const uschar * key = cbinfo->host->address;
3084 dbfn_delete(dbm_file, key);
3085 dbfn_write(dbm_file, key, dt, dlen);
3086 dbfn_close(dbm_file);
3087 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3088 (unsigned)dlen);
3089 }
3090 }
3091 return 1;
3092 }
3093
3094
3095 static void
3096 tls_client_ctx_resume_prehandshake(
3097 exim_openssl_client_tls_ctx * exim_client_ctx, tls_support * tlsp,
3098 smtp_transport_options_block * ob, host_item * host)
3099 {
3100 /* Should the client request a session resumption ticket? */
3101 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3102 {
3103 tlsp->host_resumable = TRUE;
3104
3105 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3106 SSL_SESS_CACHE_CLIENT
3107 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3108 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3109 }
3110 }
3111
3112 static BOOL
3113 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3114 host_item * host, uschar ** errstr)
3115 {
3116 if (tlsp->host_resumable)
3117 {
3118 DEBUG(D_tls)
3119 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3120 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3121
3122 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3123 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_cbinfo))
3124 {
3125 tls_error(US"set ex_data", host, NULL, errstr);
3126 return FALSE;
3127 }
3128 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_cbinfo);
3129 }
3130
3131 tlsp->resumption = RESUME_SUPPORTED;
3132 /* Pick up a previous session, saved on an old ticket */
3133 tls_retrieve_session(tlsp, ssl, host->address);
3134 return TRUE;
3135 }
3136
3137 static void
3138 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
3139 tls_support * tlsp)
3140 {
3141 if (SSL_session_reused(exim_client_ctx->ssl))
3142 {
3143 DEBUG(D_tls) debug_printf("The session was reused\n");
3144 tlsp->resumption |= RESUME_USED;
3145 }
3146 }
3147 #endif /* EXPERIMENTAL_TLS_RESUME */
3148
3149
3150 /*************************************************
3151 * Start a TLS session in a client *
3152 *************************************************/
3153
3154 /* Called from the smtp transport after STARTTLS has been accepted.
3155
3156 Arguments:
3157 cctx connection context
3158 conn_args connection details
3159 cookie datum for randomness; can be NULL
3160 tlsp record details of TLS channel configuration here; must be non-NULL
3161 errstr error string pointer
3162
3163 Returns: TRUE for success with TLS session context set in connection context,
3164 FALSE on error
3165 */
3166
3167 BOOL
3168 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3169 void * cookie, tls_support * tlsp, uschar ** errstr)
3170 {
3171 host_item * host = conn_args->host; /* for msgs and option-tests */
3172 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3173 smtp_transport_options_block * ob = tb
3174 ? (smtp_transport_options_block *)tb->options_block
3175 : &smtp_transport_option_defaults;
3176 exim_openssl_client_tls_ctx * exim_client_ctx;
3177 uschar * expciphers;
3178 int rc;
3179 static uschar peerdn[256];
3180
3181 #ifndef DISABLE_OCSP
3182 BOOL request_ocsp = FALSE;
3183 BOOL require_ocsp = FALSE;
3184 #endif
3185
3186 rc = store_pool;
3187 store_pool = POOL_PERM;
3188 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), FALSE);
3189 exim_client_ctx->corked = NULL;
3190 store_pool = rc;
3191
3192 #ifdef SUPPORT_DANE
3193 tlsp->tlsa_usage = 0;
3194 #endif
3195
3196 #ifndef DISABLE_OCSP
3197 {
3198 # ifdef SUPPORT_DANE
3199 if ( conn_args->dane
3200 && ob->hosts_request_ocsp[0] == '*'
3201 && ob->hosts_request_ocsp[1] == '\0'
3202 )
3203 {
3204 /* Unchanged from default. Use a safer one under DANE */
3205 request_ocsp = TRUE;
3206 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3207 " {= {4}{$tls_out_tlsa_usage}} } "
3208 " {*}{}}";
3209 }
3210 # endif
3211
3212 if ((require_ocsp =
3213 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
3214 request_ocsp = TRUE;
3215 else
3216 # ifdef SUPPORT_DANE
3217 if (!request_ocsp)
3218 # endif
3219 request_ocsp =
3220 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3221 }
3222 #endif
3223
3224 rc = tls_init(&exim_client_ctx->ctx, host, NULL,
3225 ob->tls_certificate, ob->tls_privatekey,
3226 #ifndef DISABLE_OCSP
3227 (void *)(long)request_ocsp,
3228 #endif
3229 cookie, &client_static_cbinfo, tlsp, errstr);
3230 if (rc != OK) return FALSE;
3231
3232 tlsp->certificate_verified = FALSE;
3233 client_verify_callback_called = FALSE;
3234
3235 expciphers = NULL;
3236 #ifdef SUPPORT_DANE
3237 if (conn_args->dane)
3238 {
3239 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3240 other failures should be treated as problems. */
3241 if (ob->dane_require_tls_ciphers &&
3242 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3243 &expciphers, errstr))
3244 return FALSE;
3245 if (expciphers && *expciphers == '\0')
3246 expciphers = NULL;
3247 }
3248 #endif
3249 if (!expciphers &&
3250 !expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
3251 &expciphers, errstr))
3252 return FALSE;
3253
3254 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3255 are separated by underscores. So that I can use either form in my tests, and
3256 also for general convenience, we turn underscores into hyphens here. */
3257
3258 if (expciphers)
3259 {
3260 uschar *s = expciphers;
3261 while (*s) { if (*s == '_') *s = '-'; s++; }
3262 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
3263 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
3264 {
3265 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
3266 return FALSE;
3267 }
3268 }
3269
3270 #ifdef SUPPORT_DANE
3271 if (conn_args->dane)
3272 {
3273 SSL_CTX_set_verify(exim_client_ctx->ctx,
3274 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
3275 verify_callback_client_dane);
3276
3277 if (!DANESSL_library_init())
3278 {
3279 tls_error(US"library init", host, NULL, errstr);
3280 return FALSE;
3281 }
3282 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
3283 {
3284 tls_error(US"context init", host, NULL, errstr);
3285 return FALSE;
3286 }
3287 }
3288 else
3289
3290 #endif
3291
3292 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
3293 client_static_cbinfo, errstr) != OK)
3294 return FALSE;
3295
3296 #ifdef EXPERIMENTAL_TLS_RESUME
3297 tls_client_ctx_resume_prehandshake(exim_client_ctx, tlsp, ob, host);
3298 #endif
3299
3300
3301 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
3302 {
3303 tls_error(US"SSL_new", host, NULL, errstr);
3304 return FALSE;
3305 }
3306 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
3307
3308 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
3309 SSL_set_connect_state(exim_client_ctx->ssl);
3310
3311 if (ob->tls_sni)
3312 {
3313 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
3314 return FALSE;
3315 if (!tlsp->sni)
3316 {
3317 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
3318 }
3319 else if (!Ustrlen(tlsp->sni))
3320 tlsp->sni = NULL;
3321 else
3322 {
3323 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
3324 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
3325 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
3326 #else
3327 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
3328 tlsp->sni);
3329 #endif
3330 }
3331 }
3332
3333 #ifdef SUPPORT_DANE
3334 if (conn_args->dane)
3335 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
3336 return FALSE;
3337 #endif
3338
3339 #ifndef DISABLE_OCSP
3340 /* Request certificate status at connection-time. If the server
3341 does OCSP stapling we will get the callback (set in tls_init()) */
3342 # ifdef SUPPORT_DANE
3343 if (request_ocsp)
3344 {
3345 const uschar * s;
3346 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3347 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3348 )
3349 { /* Re-eval now $tls_out_tlsa_usage is populated. If
3350 this means we avoid the OCSP request, we wasted the setup
3351 cost in tls_init(). */
3352 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3353 request_ocsp = require_ocsp
3354 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3355 }
3356 }
3357 # endif
3358
3359 if (request_ocsp)
3360 {
3361 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
3362 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
3363 tlsp->ocsp = OCSP_NOT_RESP;
3364 }
3365 #endif
3366
3367 #ifdef EXPERIMENTAL_TLS_RESUME
3368 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
3369 errstr))
3370 return FALSE;
3371 #endif
3372
3373 #ifndef DISABLE_EVENT
3374 client_static_cbinfo->event_action = tb ? tb->event_action : NULL;
3375 #endif
3376
3377 /* There doesn't seem to be a built-in timeout on connection. */
3378
3379 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
3380 sigalrm_seen = FALSE;
3381 ALARM(ob->command_timeout);
3382 rc = SSL_connect(exim_client_ctx->ssl);
3383 ALARM_CLR(0);
3384
3385 #ifdef SUPPORT_DANE
3386 if (conn_args->dane)
3387 DANESSL_cleanup(exim_client_ctx->ssl);
3388 #endif
3389
3390 if (rc <= 0)
3391 {
3392 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
3393 return FALSE;
3394 }
3395
3396 DEBUG(D_tls)
3397 {
3398 debug_printf("SSL_connect succeeded\n");
3399 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3400 {
3401 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
3402 SSL_SESSION_print_keylog(bp, SSL_get_session(exim_client_ctx->ssl));
3403 BIO_free(bp);
3404 }
3405 #endif
3406 }
3407
3408 #ifdef EXPERIMENTAL_TLS_RESUME
3409 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
3410 #endif
3411
3412 #ifdef SSL_get_extms_support
3413 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
3414 #endif
3415 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
3416
3417 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
3418 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
3419 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
3420
3421 /* Record the certificate we presented */
3422 {
3423 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
3424 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
3425 }
3426
3427 /*XXX will this work with continued-TLS? */
3428 /* Channel-binding info for authenticators */
3429 {
3430 uschar c, * s;
3431 size_t len = SSL_get_finished(exim_client_ctx->ssl, &c, 0);
3432 int old_pool = store_pool;
3433
3434 SSL_get_finished(exim_client_ctx->ssl, s = store_get((int)len, TRUE), len);
3435 store_pool = POOL_PERM;
3436 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, TRUE);
3437 store_pool = old_pool;
3438 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
3439 }
3440
3441 tlsp->active.sock = cctx->sock;
3442 tlsp->active.tls_ctx = exim_client_ctx;
3443 cctx->tls_ctx = exim_client_ctx;
3444 return TRUE;
3445 }
3446
3447
3448
3449
3450
3451 static BOOL
3452 tls_refill(unsigned lim)
3453 {
3454 int error;
3455 int inbytes;
3456
3457 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
3458 ssl_xfer_buffer, ssl_xfer_buffer_size);
3459
3460 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3461 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer,
3462 MIN(ssl_xfer_buffer_size, lim));
3463 error = SSL_get_error(server_ssl, inbytes);
3464 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3465
3466 if (had_command_timeout) /* set by signal handler */
3467 smtp_command_timeout_exit(); /* does not return */
3468 if (had_command_sigterm)
3469 smtp_command_sigterm_exit();
3470 if (had_data_timeout)
3471 smtp_data_timeout_exit();
3472 if (had_data_sigint)
3473 smtp_data_sigint_exit();
3474
3475 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
3476 closed down, not that the socket itself has been closed down. Revert to
3477 non-SSL handling. */
3478
3479 switch(error)
3480 {
3481 case SSL_ERROR_NONE:
3482 break;
3483
3484 case SSL_ERROR_ZERO_RETURN:
3485 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3486
3487 if (SSL_get_shutdown(server_ssl) == SSL_RECEIVED_SHUTDOWN)
3488 SSL_shutdown(server_ssl);
3489
3490 tls_close(NULL, TLS_NO_SHUTDOWN);
3491 return FALSE;
3492
3493 /* Handle genuine errors */
3494 case SSL_ERROR_SSL:
3495 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3496 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
3497 ssl_xfer_error = TRUE;
3498 return FALSE;
3499
3500 default:
3501 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3502 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
3503 debug_printf(" - syscall %s\n", strerror(errno));
3504 ssl_xfer_error = TRUE;
3505 return FALSE;
3506 }
3507
3508 #ifndef DISABLE_DKIM
3509 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
3510 #endif
3511 ssl_xfer_buffer_hwm = inbytes;
3512 ssl_xfer_buffer_lwm = 0;
3513 return TRUE;
3514 }
3515
3516
3517 /*************************************************
3518 * TLS version of getc *
3519 *************************************************/
3520
3521 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3522 it refills the buffer via the SSL reading function.
3523
3524 Arguments: lim Maximum amount to read/buffer
3525 Returns: the next character or EOF
3526
3527 Only used by the server-side TLS.
3528 */
3529
3530 int
3531 tls_getc(unsigned lim)
3532 {
3533 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
3534 if (!tls_refill(lim))
3535 return ssl_xfer_error ? EOF : smtp_getc(lim);
3536
3537 /* Something in the buffer; return next uschar */
3538
3539 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
3540 }
3541
3542 uschar *
3543 tls_getbuf(unsigned * len)
3544 {
3545 unsigned size;
3546 uschar * buf;
3547
3548 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
3549 if (!tls_refill(*len))
3550 {
3551 if (!ssl_xfer_error) return smtp_getbuf(len);
3552 *len = 0;
3553 return NULL;
3554 }
3555
3556 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
3557 size = *len;
3558 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
3559 ssl_xfer_buffer_lwm += size;
3560 *len = size;
3561 return buf;
3562 }
3563
3564
3565 void
3566 tls_get_cache()
3567 {
3568 #ifndef DISABLE_DKIM
3569 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
3570 if (n > 0)
3571 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
3572 #endif
3573 }
3574
3575
3576 BOOL
3577 tls_could_read(void)
3578 {
3579 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm || SSL_pending(server_ssl) > 0;
3580 }
3581
3582
3583 /*************************************************
3584 * Read bytes from TLS channel *
3585 *************************************************/
3586
3587 /*
3588 Arguments:
3589 ct_ctx client context pointer, or NULL for the one global server context
3590 buff buffer of data
3591 len size of buffer
3592
3593 Returns: the number of bytes read
3594 -1 after a failed read, including EOF
3595
3596 Only used by the client-side TLS.
3597 */
3598
3599 int
3600 tls_read(void * ct_ctx, uschar *buff, size_t len)
3601 {
3602 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl : server_ssl;
3603 int inbytes;
3604 int error;
3605
3606 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
3607 buff, (unsigned int)len);
3608
3609 inbytes = SSL_read(ssl, CS buff, len);
3610 error = SSL_get_error(ssl, inbytes);
3611
3612 if (error == SSL_ERROR_ZERO_RETURN)
3613 {
3614 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3615 return -1;
3616 }
3617 else if (error != SSL_ERROR_NONE)
3618 return -1;
3619
3620 return inbytes;
3621 }
3622
3623
3624
3625
3626
3627 /*************************************************
3628 * Write bytes down TLS channel *
3629 *************************************************/
3630
3631 /*
3632 Arguments:
3633 ct_ctx client context pointer, or NULL for the one global server context
3634 buff buffer of data
3635 len number of bytes
3636 more further data expected soon
3637
3638 Returns: the number of bytes after a successful write,
3639 -1 after a failed write
3640
3641 Used by both server-side and client-side TLS. Calling with len zero and more unset
3642 will flush buffered writes; buff can be null for this case.
3643 */
3644
3645 int
3646 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
3647 {
3648 size_t olen = len;
3649 int outbytes, error;
3650 SSL * ssl = ct_ctx
3651 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl : server_ssl;
3652 static gstring * server_corked = NULL;
3653 gstring ** corkedp = ct_ctx
3654 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
3655 gstring * corked = *corkedp;
3656
3657 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
3658 buff, (unsigned long)len, more ? ", more" : "");
3659
3660 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
3661 "more" is notified. This hack is only ok if small amounts are involved AND only
3662 one stream does it, in one context (i.e. no store reset). Currently it is used
3663 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
3664 We support callouts done by the server process by using a separate client
3665 context for the stashed information. */
3666 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
3667 a store reset there, so use POOL_PERM. */
3668 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
3669
3670 if ((more || corked))
3671 {
3672 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
3673
3674 #ifndef DISABLE_PIPE_CONNECT
3675 int save_pool = store_pool;
3676 store_pool = POOL_PERM;
3677 #endif
3678
3679 corked = string_catn(corked, buff, len);
3680
3681 #ifndef DISABLE_PIPE_CONNECT
3682 store_pool = save_pool;
3683 #endif
3684
3685 if (more)
3686 {
3687 *corkedp = corked;
3688 return len;
3689 }
3690 buff = CUS corked->s;
3691 len = corked->ptr;
3692 *corkedp = NULL;
3693 }
3694
3695 for (int left = len; left > 0;)
3696 {
3697 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
3698 outbytes = SSL_write(ssl, CS buff, left);
3699 error = SSL_get_error(ssl, outbytes);
3700 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
3701 switch (error)
3702 {
3703 case SSL_ERROR_NONE: /* the usual case */
3704 left -= outbytes;
3705 buff += outbytes;
3706 break;
3707
3708 case SSL_ERROR_SSL:
3709 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3710 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
3711 return -1;
3712
3713 case SSL_ERROR_ZERO_RETURN:
3714 log_write(0, LOG_MAIN, "SSL channel closed on write");
3715 return -1;
3716
3717 case SSL_ERROR_SYSCALL:
3718 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
3719 sender_fullhost ? sender_fullhost : US"<unknown>",
3720 strerror(errno));
3721 return -1;
3722
3723 default:
3724 log_write(0, LOG_MAIN, "SSL_write error %d", error);
3725 return -1;
3726 }
3727 }
3728 return olen;
3729 }
3730
3731
3732
3733 /*************************************************
3734 * Close down a TLS session *
3735 *************************************************/
3736
3737 /* This is also called from within a delivery subprocess forked from the
3738 daemon, to shut down the TLS library, without actually doing a shutdown (which
3739 would tamper with the SSL session in the parent process).
3740
3741 Arguments:
3742 ct_ctx client TLS context pointer, or NULL for the one global server context
3743 shutdown 1 if TLS close-alert is to be sent,
3744 2 if also response to be waited for
3745
3746 Returns: nothing
3747
3748 Used by both server-side and client-side TLS.
3749 */
3750
3751 void
3752 tls_close(void * ct_ctx, int shutdown)
3753 {
3754 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
3755 SSL_CTX **ctxp = o_ctx ? &o_ctx->ctx : &server_ctx;
3756 SSL **sslp = o_ctx ? &o_ctx->ssl : &server_ssl;
3757 int *fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
3758
3759 if (*fdp < 0) return; /* TLS was not active */
3760
3761 if (shutdown)
3762 {
3763 int rc;
3764 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3765 shutdown > 1 ? " (with response-wait)" : "");
3766
3767 if ( (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
3768 && shutdown > 1)
3769 {
3770 ALARM(2);
3771 rc = SSL_shutdown(*sslp); /* wait for response */
3772 ALARM_CLR(0);
3773 }
3774
3775 if (rc < 0) DEBUG(D_tls)
3776 {
3777 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3778 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
3779 }
3780 }
3781
3782 if (!o_ctx) /* server side */
3783 {
3784 #ifndef DISABLE_OCSP
3785 sk_X509_pop_free(server_static_cbinfo->verify_stack, X509_free);
3786 server_static_cbinfo->verify_stack = NULL;
3787 #endif
3788
3789 receive_getc = smtp_getc;
3790 receive_getbuf = smtp_getbuf;
3791 receive_get_cache = smtp_get_cache;
3792 receive_ungetc = smtp_ungetc;
3793 receive_feof = smtp_feof;
3794 receive_ferror = smtp_ferror;
3795 receive_smtp_buffered = smtp_buffered;
3796 tls_in.active.tls_ctx = NULL;
3797 tls_in.sni = NULL;
3798 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3799 }
3800
3801 SSL_CTX_free(*ctxp);
3802 SSL_free(*sslp);
3803 *ctxp = NULL;
3804 *sslp = NULL;
3805 *fdp = -1;
3806 }
3807
3808
3809
3810
3811 /*************************************************
3812 * Let tls_require_ciphers be checked at startup *
3813 *************************************************/
3814
3815 /* The tls_require_ciphers option, if set, must be something which the
3816 library can parse.
3817
3818 Returns: NULL on success, or error message
3819 */
3820
3821 uschar *
3822 tls_validate_require_cipher(void)
3823 {
3824 SSL_CTX *ctx;
3825 uschar *s, *expciphers, *err;
3826
3827 tls_openssl_init();
3828
3829 if (!(tls_require_ciphers && *tls_require_ciphers))
3830 return NULL;
3831
3832 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
3833 &err))
3834 return US"failed to expand tls_require_ciphers";
3835
3836 if (!(expciphers && *expciphers))
3837 return NULL;
3838
3839 /* normalisation ripped from above */
3840 s = expciphers;
3841 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
3842
3843 err = NULL;
3844
3845 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
3846 if (!(ctx = SSL_CTX_new(TLS_server_method())))
3847 #else
3848 if (!(ctx = SSL_CTX_new(SSLv23_server_method())))
3849 #endif
3850 {
3851 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3852 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
3853 }
3854
3855 DEBUG(D_tls)
3856 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
3857
3858 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
3859 {
3860 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3861 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
3862 expciphers, ssl_errstring);
3863 }
3864
3865 SSL_CTX_free(ctx);
3866
3867 return err;
3868 }
3869
3870
3871
3872
3873 /*************************************************
3874 * Report the library versions. *
3875 *************************************************/
3876
3877 /* There have historically been some issues with binary compatibility in
3878 OpenSSL libraries; if Exim (like many other applications) is built against
3879 one version of OpenSSL but the run-time linker picks up another version,
3880 it can result in serious failures, including crashing with a SIGSEGV. So
3881 report the version found by the compiler and the run-time version.
3882
3883 Note: some OS vendors backport security fixes without changing the version
3884 number/string, and the version date remains unchanged. The _build_ date
3885 will change, so we can more usefully assist with version diagnosis by also
3886 reporting the build date.
3887
3888 Arguments: a FILE* to print the results to
3889 Returns: nothing
3890 */
3891
3892 void
3893 tls_version_report(FILE *f)
3894 {
3895 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
3896 " Runtime: %s\n"
3897 " : %s\n",
3898 OPENSSL_VERSION_TEXT,
3899 SSLeay_version(SSLEAY_VERSION),
3900 SSLeay_version(SSLEAY_BUILT_ON));
3901 /* third line is 38 characters for the %s and the line is 73 chars long;
3902 the OpenSSL output includes a "built on: " prefix already. */
3903 }
3904
3905
3906
3907
3908 /*************************************************
3909 * Random number generation *
3910 *************************************************/
3911
3912 /* Pseudo-random number generation. The result is not expected to be
3913 cryptographically strong but not so weak that someone will shoot themselves
3914 in the foot using it as a nonce in input in some email header scheme or
3915 whatever weirdness they'll twist this into. The result should handle fork()
3916 and avoid repeating sequences. OpenSSL handles that for us.
3917
3918 Arguments:
3919 max range maximum
3920 Returns a random number in range [0, max-1]
3921 */
3922
3923 int
3924 vaguely_random_number(int max)
3925 {
3926 unsigned int r;
3927 int i, needed_len;
3928 static pid_t pidlast = 0;
3929 pid_t pidnow;
3930 uschar smallbuf[sizeof(r)];
3931
3932 if (max <= 1)
3933 return 0;
3934
3935 pidnow = getpid();
3936 if (pidnow != pidlast)
3937 {
3938 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
3939 is unique for each thread", this doesn't apparently apply across processes,
3940 so our own warning from vaguely_random_number_fallback() applies here too.
3941 Fix per PostgreSQL. */
3942 if (pidlast != 0)
3943 RAND_cleanup();
3944 pidlast = pidnow;
3945 }
3946
3947 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
3948 if (!RAND_status())
3949 {
3950 randstuff r;
3951 gettimeofday(&r.tv, NULL);
3952 r.p = getpid();
3953
3954 RAND_seed(US (&r), sizeof(r));
3955 }
3956 /* We're after pseudo-random, not random; if we still don't have enough data
3957 in the internal PRNG then our options are limited. We could sleep and hope
3958 for entropy to come along (prayer technique) but if the system is so depleted
3959 in the first place then something is likely to just keep taking it. Instead,
3960 we'll just take whatever little bit of pseudo-random we can still manage to
3961 get. */
3962
3963 needed_len = sizeof(r);
3964 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
3965 asked for a number less than 10. */
3966 for (r = max, i = 0; r; ++i)
3967 r >>= 1;
3968 i = (i + 7) / 8;
3969 if (i < needed_len)
3970 needed_len = i;
3971
3972 #ifdef EXIM_HAVE_RAND_PSEUDO
3973 /* We do not care if crypto-strong */
3974 i = RAND_pseudo_bytes(smallbuf, needed_len);
3975 #else
3976 i = RAND_bytes(smallbuf, needed_len);
3977 #endif
3978
3979 if (i < 0)
3980 {
3981 DEBUG(D_all)
3982 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
3983 return vaguely_random_number_fallback(max);
3984 }
3985
3986 r = 0;
3987 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
3988 r = 256 * r + *p;
3989
3990 /* We don't particularly care about weighted results; if someone wants
3991 smooth distribution and cares enough then they should submit a patch then. */
3992 return r % max;
3993 }
3994
3995
3996
3997
3998 /*************************************************
3999 * OpenSSL option parse *
4000 *************************************************/
4001
4002 /* Parse one option for tls_openssl_options_parse below
4003
4004 Arguments:
4005 name one option name
4006 value place to store a value for it
4007 Returns success or failure in parsing
4008 */
4009
4010
4011
4012 static BOOL
4013 tls_openssl_one_option_parse(uschar *name, long *value)
4014 {
4015 int first = 0;
4016 int last = exim_openssl_options_size;
4017 while (last