src/src/tls-openssl.c

   1 /*************************************************
   2 *     Exim - an Internet mail transport agent    *
   3 *************************************************/
   4
   5 /* Copyright (c) University of Cambridge 1995 - 2017 */
   6 /* See the file NOTICE for conditions of use and distribution. */
   7
   8 /* Portions Copyright (c) The OpenSSL Project 1999 */
   9
  10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
  11 library. It is #included into the tls.c file when that library is used. The
  12 code herein is based on a patch that was originally contributed by Steve
  13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
  14
  15 No cryptographic code is included in Exim. All this module does is to call
  16 functions from the OpenSSL library. */
  17
  18
  19 /* Heading stuff */
  20
  21 #include <openssl/lhash.h>
  22 #include <openssl/ssl.h>
  23 #include <openssl/err.h>
  24 #include <openssl/rand.h>
  25 #ifndef OPENSSL_NO_ECDH
  26 # include <openssl/ec.h>
  27 #endif
  28 #ifndef DISABLE_OCSP
  29 # include <openssl/ocsp.h>
  30 #endif
  31 #ifdef EXPERIMENTAL_DANE
  32 # include "danessl.h"
  33 #endif
  34
  35
  36 #ifndef DISABLE_OCSP
  37 # define EXIM_OCSP_SKEW_SECONDS (300L)
  38 # define EXIM_OCSP_MAX_AGE (-1L)
  39 #endif
  40
  41 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
  42 # define EXIM_HAVE_OPENSSL_TLSEXT
  43 #endif
  44 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
  45 # define EXIM_HAVE_RSA_GENKEY_EX
  46 #endif
  47 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
  48 # define EXIM_HAVE_OCSP_RESP_COUNT
  49 #else
  50 # define EXIM_HAVE_EPHEM_RSA_KEX
  51 # define EXIM_HAVE_RAND_PSEUDO
  52 #endif
  53 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
  54 # define EXIM_HAVE_SHA256
  55 #endif
  56
  57 /*
  58  * X509_check_host provides sane certificate hostname checking, but was added
  59  * to OpenSSL late, after other projects forked off the code-base.  So in
  60  * addition to guarding against the base version number, beware that LibreSSL
  61  * does not (at this time) support this function.
  62  *
  63  * If LibreSSL gains a different API, perhaps via libtls, then we'll probably
  64  * opt to disentangle and ask a LibreSSL user to provide glue for a third
  65  * crypto provider for libtls instead of continuing to tie the OpenSSL glue
  66  * into even twistier knots.  If LibreSSL gains the same API, we can just
  67  * change this guard and punt the issue for a while longer.
  68  */
  69 #ifndef LIBRESSL_VERSION_NUMBER
  70 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
  71 #  define EXIM_HAVE_OPENSSL_CHECKHOST
  72 #  define EXIM_HAVE_OPENSSL_DH_BITS
  73 # endif
  74 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
  75     && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
  76 #  define EXIM_HAVE_OPENSSL_CHECKHOST
  77 # endif
  78 #endif
  79
  80 #if !defined(LIBRESSL_VERSION_NUMBER) \
  81     || LIBRESSL_VERSION_NUMBER >= 0x20010000L
  82 # if !defined(OPENSSL_NO_ECDH)
  83 #  if OPENSSL_VERSION_NUMBER >= 0x0090800fL
  84 #   define EXIM_HAVE_ECDH
  85 #  endif
  86 #  if OPENSSL_VERSION_NUMBER >= 0x10002000L
  87 #   define EXIM_HAVE_OPENSSL_EC_NIST2NID
  88 #  endif
  89 # endif
  90 #endif
  91
  92 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
  93 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
  94 # define DISABLE_OCSP
  95 #endif
  96
  97 /* Structure for collecting random data for seeding. */
  98
  99 typedef struct randstuff {
 100   struct timeval tv;
 101   pid_t          p;
 102 } randstuff;
 103
 104 /* Local static variables */
 105
 106 static BOOL client_verify_callback_called = FALSE;
 107 static BOOL server_verify_callback_called = FALSE;
 108 static const uschar *sid_ctx = US"exim";
 109
 110 /* We have three different contexts to care about.
 111
 112 Simple case: client, `client_ctx`
 113  As a client, we can be doing a callout or cut-through delivery while receiving
 114  a message.  So we have a client context, which should have options initialised
 115  from the SMTP Transport.
 116
 117 Server:
 118  There are two cases: with and without ServerNameIndication from the client.
 119  Given TLS SNI, we can be using different keys, certs and various other
 120  configuration settings, because they're re-expanded with $tls_sni set.  This
 121  allows vhosting with TLS.  This SNI is sent in the handshake.
 122  A client might not send SNI, so we need a fallback, and an initial setup too.
 123  So as a server, we start out using `server_ctx`.
 124  If SNI is sent by the client, then we as server, mid-negotiation, try to clone
 125  `server_sni` from `server_ctx` and then initialise settings by re-expanding
 126  configuration.
 127 */
 128
 129 static SSL_CTX *client_ctx = NULL;
 130 static SSL_CTX *server_ctx = NULL;
 131 static SSL     *client_ssl = NULL;
 132 static SSL     *server_ssl = NULL;
 133
 134 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
 135 static SSL_CTX *server_sni = NULL;
 136 #endif
 137
 138 static char ssl_errstring[256];
 139
 140 static int  ssl_session_timeout = 200;
 141 static BOOL client_verify_optional = FALSE;
 142 static BOOL server_verify_optional = FALSE;
 143
 144 static BOOL reexpand_tls_files_for_sni = FALSE;
 145
 146
 147 typedef struct tls_ext_ctx_cb {
 148   uschar *certificate;
 149   uschar *privatekey;
 150 #ifndef DISABLE_OCSP
 151   BOOL is_server;
 152   STACK_OF(X509) *verify_stack;         /* chain for verifying the proof */
 153   union {
 154     struct {
 155       uschar        *file;
 156       uschar        *file_expanded;
 157       OCSP_RESPONSE *response;
 158     } server;
 159     struct {
 160       X509_STORE    *verify_store;      /* non-null if status requested */
 161       BOOL          verify_required;
 162     } client;
 163   } u_ocsp;
 164 #endif
 165   uschar *dhparam;
 166   /* these are cached from first expand */
 167   uschar *server_cipher_list;
 168   /* only passed down to tls_error: */
 169   host_item *host;
 170   const uschar * verify_cert_hostnames;
 171 #ifndef DISABLE_EVENT
 172   uschar * event_action;
 173 #endif
 174 } tls_ext_ctx_cb;
 175
 176 /* should figure out a cleanup of API to handle state preserved per
 177 implementation, for various reasons, which can be void * in the APIs.
 178 For now, we hack around it. */
 179 tls_ext_ctx_cb *client_static_cbinfo = NULL;
 180 tls_ext_ctx_cb *server_static_cbinfo = NULL;
 181
 182 static int
 183 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
 184     int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr );
 185
 186 /* Callbacks */
 187 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
 188 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
 189 #endif
 190 #ifndef DISABLE_OCSP
 191 static int tls_server_stapling_cb(SSL *s, void *arg);
 192 #endif
 193
 194
 195 /*************************************************
 196 *               Handle TLS error                 *
 197 *************************************************/
 198
 199 /* Called from lots of places when errors occur before actually starting to do
 200 the TLS handshake, that is, while the session is still in clear. Always returns
 201 DEFER for a server and FAIL for a client so that most calls can use "return
 202 tls_error(...)" to do this processing and then give an appropriate return. A
 203 single function is used for both server and client, because it is called from
 204 some shared functions.
 205
 206 Argument:
 207   prefix    text to include in the logged error
 208   host      NULL if setting up a server;
 209             the connected host if setting up a client
 210   msg       error message or NULL if we should ask OpenSSL
 211   errstr    pointer to output error message
 212
 213 Returns:    OK/DEFER/FAIL
 214 */
 215
 216 static int
 217 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
 218 {
 219 if (!msg)
 220   {
 221   ERR_error_string(ERR_get_error(), ssl_errstring);
 222   msg = US ssl_errstring;
 223   }
 224
 225 if (errstr) *errstr = string_sprintf("(%s): %s", prefix, msg);
 226 return host ? FAIL : DEFER;
 227 }
 228
 229
 230
 231 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
 232 /*************************************************
 233 *        Callback to generate RSA key            *
 234 *************************************************/
 235
 236 /*
 237 Arguments:
 238   s          SSL connection
 239   export     not used
 240   keylength  keylength
 241
 242 Returns:     pointer to generated key
 243 */
 244
 245 static RSA *
 246 rsa_callback(SSL *s, int export, int keylength)
 247 {
 248 RSA *rsa_key;
 249 #ifdef EXIM_HAVE_RSA_GENKEY_EX
 250 BIGNUM *bn = BN_new();
 251 #endif
 252
 253 export = export;     /* Shut picky compilers up */
 254 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
 255
 256 #ifdef EXIM_HAVE_RSA_GENKEY_EX
 257 if (  !BN_set_word(bn, (unsigned long)RSA_F4)
 258    || !(rsa_key = RSA_new())
 259    || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
 260    )
 261 #else
 262 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
 263 #endif
 264
 265   {
 266   ERR_error_string(ERR_get_error(), ssl_errstring);
 267   log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
 268     ssl_errstring);
 269   return NULL;
 270   }
 271 return rsa_key;
 272 }
 273 #endif
 274
 275
 276
 277 /* Extreme debug
 278 #ifndef DISABLE_OCSP
 279 void
 280 x509_store_dump_cert_s_names(X509_STORE * store)
 281 {
 282 STACK_OF(X509_OBJECT) * roots= store->objs;
 283 int i;
 284 static uschar name[256];
 285
 286 for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
 287   {
 288   X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
 289   if(tmp_obj->type == X509_LU_X509)
 290     {
 291     X509 * current_cert= tmp_obj->data.x509;
 292     X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
 293         name[sizeof(name)-1] = '\0';
 294     debug_printf(" %s\n", name);
 295     }
 296   }
 297 }
 298 #endif
 299 */
 300
 301
 302 #ifndef DISABLE_EVENT
 303 static int
 304 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
 305   BOOL *calledp, const BOOL *optionalp, const uschar * what)
 306 {
 307 uschar * ev;
 308 uschar * yield;
 309 X509 * old_cert;
 310
 311 ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
 312 if (ev)
 313   {
 314   DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
 315   old_cert = tlsp->peercert;
 316   tlsp->peercert = X509_dup(cert);
 317   /* NB we do not bother setting peerdn */
 318   if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
 319     {
 320     log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
 321                 "depth=%d cert=%s: %s",
 322               tlsp == &tls_out ? deliver_host_address : sender_host_address,
 323               what, depth, dn, yield);
 324     *calledp = TRUE;
 325     if (!*optionalp)
 326       {
 327       if (old_cert) tlsp->peercert = old_cert;  /* restore 1st failing cert */
 328       return 1;                     /* reject (leaving peercert set) */
 329       }
 330     DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
 331       "(host in tls_try_verify_hosts)\n");
 332     }
 333   X509_free(tlsp->peercert);
 334   tlsp->peercert = old_cert;
 335   }
 336 return 0;
 337 }
 338 #endif
 339
 340 /*************************************************
 341 *        Callback for verification               *
 342 *************************************************/
 343
 344 /* The SSL library does certificate verification if set up to do so. This
 345 callback has the current yes/no state is in "state". If verification succeeded,
 346 we set the certificate-verified flag. If verification failed, what happens
 347 depends on whether the client is required to present a verifiable certificate
 348 or not.
 349
 350 If verification is optional, we change the state to yes, but still log the
 351 verification error. For some reason (it really would help to have proper
 352 documentation of OpenSSL), this callback function then gets called again, this
 353 time with state = 1.  We must take care not to set the private verified flag on
 354 the second time through.
 355
 356 Note: this function is not called if the client fails to present a certificate
 357 when asked. We get here only if a certificate has been received. Handling of
 358 optional verification for this case is done when requesting SSL to verify, by
 359 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
 360
 361 May be called multiple times for different issues with a certificate, even
 362 for a given "depth" in the certificate chain.
 363
 364 Arguments:
 365   preverify_ok current yes/no state as 1/0
 366   x509ctx      certificate information.
 367   tlsp         per-direction (client vs. server) support data
 368   calledp      has-been-called flag
 369   optionalp    verification-is-optional flag
 370
 371 Returns:     0 if verification should fail, otherwise 1
 372 */
 373
 374 static int
 375 verify_callback(int preverify_ok, X509_STORE_CTX *x509ctx,
 376   tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
 377 {
 378 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 379 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 380 uschar dn[256];
 381
 382 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
 383 dn[sizeof(dn)-1] = '\0';
 384
 385 if (preverify_ok == 0)
 386   {
 387   uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
 388       *verify_mode, sender_host_address)
 389     : US"";
 390   log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
 391     tlsp == &tls_out ? deliver_host_address : sender_host_address,
 392     extra, depth,
 393     X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
 394   *calledp = TRUE;
 395   if (!*optionalp)
 396     {
 397     if (!tlsp->peercert)
 398       tlsp->peercert = X509_dup(cert);  /* record failing cert */
 399     return 0;                           /* reject */
 400     }
 401   DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
 402     "tls_try_verify_hosts)\n");
 403   }
 404
 405 else if (depth != 0)
 406   {
 407   DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
 408 #ifndef DISABLE_OCSP
 409   if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
 410     {   /* client, wanting stapling  */
 411     /* Add the server cert's signing chain as the one
 412     for the verification of the OCSP stapled information. */
 413
 414     if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
 415                              cert))
 416       ERR_clear_error();
 417     sk_X509_push(client_static_cbinfo->verify_stack, cert);
 418     }
 419 #endif
 420 #ifndef DISABLE_EVENT
 421     if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
 422       return 0;                         /* reject, with peercert set */
 423 #endif
 424   }
 425 else
 426   {
 427   const uschar * verify_cert_hostnames;
 428
 429   if (  tlsp == &tls_out
 430      && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
 431         /* client, wanting hostname check */
 432     {
 433
 434 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
 435 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
 436 #  define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
 437 # endif
 438 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
 439 #  define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
 440 # endif
 441     int sep = 0;
 442     const uschar * list = verify_cert_hostnames;
 443     uschar * name;
 444     int rc;
 445     while ((name = string_nextinlist(&list, &sep, NULL, 0)))
 446       if ((rc = X509_check_host(cert, CCS name, 0,
 447                   X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
 448                   | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
 449                   NULL)))
 450         {
 451         if (rc < 0)
 452           {
 453           log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
 454             tlsp == &tls_out ? deliver_host_address : sender_host_address);
 455           name = NULL;
 456           }
 457         break;
 458         }
 459     if (!name)
 460 #else
 461     if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
 462 #endif
 463       {
 464       uschar * extra = verify_mode
 465         ? string_sprintf(" (during %c-verify for [%s])",
 466           *verify_mode, sender_host_address)
 467         : US"";
 468       log_write(0, LOG_MAIN,
 469         "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
 470         tlsp == &tls_out ? deliver_host_address : sender_host_address,
 471         extra, dn, verify_cert_hostnames);
 472       *calledp = TRUE;
 473       if (!*optionalp)
 474         {
 475         if (!tlsp->peercert)
 476           tlsp->peercert = X509_dup(cert);      /* record failing cert */
 477         return 0;                               /* reject */
 478         }
 479       DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
 480         "tls_try_verify_hosts)\n");
 481       }
 482     }
 483
 484 #ifndef DISABLE_EVENT
 485   if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
 486     return 0;                           /* reject, with peercert set */
 487 #endif
 488
 489   DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
 490     *calledp ? "" : " authenticated", dn);
 491   if (!*calledp) tlsp->certificate_verified = TRUE;
 492   *calledp = TRUE;
 493   }
 494
 495 return 1;   /* accept, at least for this level */
 496 }
 497
 498 static int
 499 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
 500 {
 501 return verify_callback(preverify_ok, x509ctx, &tls_out,
 502   &client_verify_callback_called, &client_verify_optional);
 503 }
 504
 505 static int
 506 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
 507 {
 508 return verify_callback(preverify_ok, x509ctx, &tls_in,
 509   &server_verify_callback_called, &server_verify_optional);
 510 }
 511
 512
 513 #ifdef EXPERIMENTAL_DANE
 514
 515 /* This gets called *by* the dane library verify callback, which interposes
 516 itself.
 517 */
 518 static int
 519 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
 520 {
 521 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 522 uschar dn[256];
 523 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 524 #ifndef DISABLE_EVENT
 525 BOOL dummy_called, optional = FALSE;
 526 #endif
 527
 528 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
 529 dn[sizeof(dn)-1] = '\0';
 530
 531 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
 532   preverify_ok ? "ok":"BAD", depth, dn);
 533
 534 #ifndef DISABLE_EVENT
 535   if (verify_event(&tls_out, cert, depth, dn,
 536           &dummy_called, &optional, US"DANE"))
 537     return 0;                           /* reject, with peercert set */
 538 #endif
 539
 540 if (preverify_ok == 1)
 541   tls_out.dane_verified =
 542   tls_out.certificate_verified = TRUE;
 543 else
 544   {
 545   int err = X509_STORE_CTX_get_error(x509ctx);
 546   DEBUG(D_tls)
 547     debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
 548   if (err == X509_V_ERR_APPLICATION_VERIFICATION)
 549     preverify_ok = 1;
 550   }
 551 return preverify_ok;
 552 }
 553
 554 #endif  /*EXPERIMENTAL_DANE*/
 555
 556
 557 /*************************************************
 558 *           Information callback                 *
 559 *************************************************/
 560
 561 /* The SSL library functions call this from time to time to indicate what they
 562 are doing. We copy the string to the debugging output when TLS debugging has
 563 been requested.
 564
 565 Arguments:
 566   s         the SSL connection
 567   where
 568   ret
 569
 570 Returns:    nothing
 571 */
 572
 573 static void
 574 info_callback(SSL *s, int where, int ret)
 575 {
 576 where = where;
 577 ret = ret;
 578 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
 579 }
 580
 581
 582
 583 /*************************************************
 584 *                Initialize for DH               *
 585 *************************************************/
 586
 587 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
 588
 589 Arguments:
 590   sctx      The current SSL CTX (inbound or outbound)
 591   dhparam   DH parameter file or fixed parameter identity string
 592   host      connected host, if client; NULL if server
 593   errstr    error string pointer
 594
 595 Returns:    TRUE if OK (nothing to set up, or setup worked)
 596 */
 597
 598 static BOOL
 599 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host, uschar ** errstr)
 600 {
 601 BIO *bio;
 602 DH *dh;
 603 uschar *dhexpanded;
 604 const char *pem;
 605 int dh_bitsize;
 606
 607 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
 608   return FALSE;
 609
 610 if (!dhexpanded || !*dhexpanded)
 611   bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
 612 else if (dhexpanded[0] == '/')
 613   {
 614   if (!(bio = BIO_new_file(CS dhexpanded, "r")))
 615     {
 616     tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
 617           host, US strerror(errno), errstr);
 618     return FALSE;
 619     }
 620   }
 621 else
 622   {
 623   if (Ustrcmp(dhexpanded, "none") == 0)
 624     {
 625     DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
 626     return TRUE;
 627     }
 628
 629   if (!(pem = std_dh_prime_named(dhexpanded)))
 630     {
 631     tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
 632         host, US strerror(errno), errstr);
 633     return FALSE;
 634     }
 635   bio = BIO_new_mem_buf(CS pem, -1);
 636   }
 637
 638 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
 639   {
 640   BIO_free(bio);
 641   tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
 642       host, NULL, errstr);
 643   return FALSE;
 644   }
 645
 646 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
 647  * an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with
 648  * 2236.  But older OpenSSL can only report in bytes (octets), not bits.
 649  * If someone wants to dance at the edge, then they can raise the limit or use
 650  * current libraries. */
 651 #ifdef EXIM_HAVE_OPENSSL_DH_BITS
 652 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
 653  * This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
 654 dh_bitsize = DH_bits(dh);
 655 #else
 656 dh_bitsize = 8 * DH_size(dh);
 657 #endif
 658
 659 /* Even if it is larger, we silently return success rather than cause things
 660  * to fail out, so that a too-large DH will not knock out all TLS; it's a
 661  * debatable choice. */
 662 if (dh_bitsize > tls_dh_max_bits)
 663   {
 664   DEBUG(D_tls)
 665     debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d\n",
 666         dh_bitsize, tls_dh_max_bits);
 667   }
 668 else
 669   {
 670   SSL_CTX_set_tmp_dh(sctx, dh);
 671   DEBUG(D_tls)
 672     debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
 673       dhexpanded ? dhexpanded : US"default", dh_bitsize);
 674   }
 675
 676 DH_free(dh);
 677 BIO_free(bio);
 678
 679 return TRUE;
 680 }
 681
 682
 683
 684
 685 /*************************************************
 686 *               Initialize for ECDH              *
 687 *************************************************/
 688
 689 /* Load parameters for ECDH encryption.
 690
 691 For now, we stick to NIST P-256 because: it's simple and easy to configure;
 692 it avoids any patent issues that might bite redistributors; despite events in
 693 the news and concerns over curve choices, we're not cryptographers, we're not
 694 pretending to be, and this is "good enough" to be better than no support,
 695 protecting against most adversaries.  Given another year or two, there might
 696 be sufficient clarity about a "right" way forward to let us make an informed
 697 decision, instead of a knee-jerk reaction.
 698
 699 Longer-term, we should look at supporting both various named curves and
 700 external files generated with "openssl ecparam", much as we do for init_dh().
 701 We should also support "none" as a value, to explicitly avoid initialisation.
 702
 703 Patches welcome.
 704
 705 Arguments:
 706   sctx      The current SSL CTX (inbound or outbound)
 707   host      connected host, if client; NULL if server
 708   errstr    error string pointer
 709
 710 Returns:    TRUE if OK (nothing to set up, or setup worked)
 711 */
 712
 713 static BOOL
 714 init_ecdh(SSL_CTX * sctx, host_item * host, uschar ** errstr)
 715 {
 716 #ifdef OPENSSL_NO_ECDH
 717 return TRUE;
 718 #else
 719
 720 EC_KEY * ecdh;
 721 uschar * exp_curve;
 722 int nid;
 723 BOOL rv;
 724
 725 if (host)       /* No ECDH setup for clients, only for servers */
 726   return TRUE;
 727
 728 # ifndef EXIM_HAVE_ECDH
 729 DEBUG(D_tls)
 730   debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
 731 return TRUE;
 732 # else
 733
 734 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
 735   return FALSE;
 736 if (!exp_curve || !*exp_curve)
 737   return TRUE;
 738
 739 /* "auto" needs to be handled carefully.
 740  * OpenSSL <  1.0.2: we do not select anything, but fallback to prime256v1
 741  * OpenSSL <  1.1.0: we have to call SSL_CTX_set_ecdh_auto
 742  *                   (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
 743  * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
 744  *                   https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
 745  */
 746 if (Ustrcmp(exp_curve, "auto") == 0)
 747   {
 748 #if OPENSSL_VERSION_NUMBER < 0x10002000L
 749   DEBUG(D_tls) debug_printf(
 750     "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
 751   exp_curve = US"prime256v1";
 752 #else
 753 # if defined SSL_CTRL_SET_ECDH_AUTO
 754   DEBUG(D_tls) debug_printf(
 755     "ECDH OpenSSL 1.0.2+ temp key parameter settings: autoselection\n");
 756   SSL_CTX_set_ecdh_auto(sctx, 1);
 757   return TRUE;
 758 # else
 759   DEBUG(D_tls) debug_printf(
 760     "ECDH OpenSSL 1.1.0+ temp key parameter settings: default selection\n");
 761   return TRUE;
 762 # endif
 763 #endif
 764   }
 765
 766 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
 767 if (  (nid = OBJ_sn2nid       (CCS exp_curve)) == NID_undef
 768 #   ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
 769    && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
 770 #   endif
 771    )
 772   {
 773   tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
 774     host, NULL, errstr);
 775   return FALSE;
 776   }
 777
 778 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
 779   {
 780   tls_error(US"Unable to create ec curve", host, NULL, errstr);
 781   return FALSE;
 782   }
 783
 784 /* The "tmp" in the name here refers to setting a temporary key
 785 not to the stability of the interface. */
 786
 787 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
 788   tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL, errstr);
 789 else
 790   DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
 791
 792 EC_KEY_free(ecdh);
 793 return !rv;
 794
 795 # endif /*EXIM_HAVE_ECDH*/
 796 #endif /*OPENSSL_NO_ECDH*/
 797 }
 798
 799
 800
 801
 802 #ifndef DISABLE_OCSP
 803 /*************************************************
 804 *       Load OCSP information into state         *
 805 *************************************************/
 806 /* Called to load the server OCSP response from the given file into memory, once
 807 caller has determined this is needed.  Checks validity.  Debugs a message
 808 if invalid.
 809
 810 ASSUMES: single response, for single cert.
 811
 812 Arguments:
 813   sctx            the SSL_CTX* to update
 814   cbinfo          various parts of session state
 815   expanded        the filename putatively holding an OCSP response
 816
 817 */
 818
 819 static void
 820 ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
 821 {
 822 BIO * bio;
 823 OCSP_RESPONSE * resp;
 824 OCSP_BASICRESP * basic_response;
 825 OCSP_SINGLERESP * single_response;
 826 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
 827 STACK_OF(X509) * sk;
 828 unsigned long verify_flags;
 829 int status, reason, i;
 830
 831 cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
 832 if (cbinfo->u_ocsp.server.response)
 833   {
 834   OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
 835   cbinfo->u_ocsp.server.response = NULL;
 836   }
 837
 838 if (!(bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb")))
 839   {
 840   DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
 841       cbinfo->u_ocsp.server.file_expanded);
 842   return;
 843   }
 844
 845 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
 846 BIO_free(bio);
 847 if (!resp)
 848   {
 849   DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
 850   return;
 851   }
 852
 853 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
 854   {
 855   DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
 856       OCSP_response_status_str(status), status);
 857   goto bad;
 858   }
 859
 860 if (!(basic_response = OCSP_response_get1_basic(resp)))
 861   {
 862   DEBUG(D_tls)
 863     debug_printf("OCSP response parse error: unable to extract basic response.\n");
 864   goto bad;
 865   }
 866
 867 sk = cbinfo->verify_stack;
 868 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
 869
 870 /* May need to expose ability to adjust those flags?
 871 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
 872 OCSP_TRUSTOTHER OCSP_NOINTERN */
 873
 874 /* This does a full verify on the OCSP proof before we load it for serving
 875 up; possibly overkill - just date-checks might be nice enough.
 876
 877 OCSP_basic_verify takes a "store" arg, but does not
 878 use it for the chain verification, which is all we do
 879 when OCSP_NOVERIFY is set.  The content from the wire
 880 "basic_response" and a cert-stack "sk" are all that is used.
 881
 882 We have a stack, loaded in setup_certs() if tls_verify_certificates
 883 was a file (not a directory, or "system").  It is unfortunate we
 884 cannot used the connection context store, as that would neatly
 885 handle the "system" case too, but there seems to be no library
 886 function for getting a stack from a store.
 887 [ In OpenSSL 1.1 - ?  X509_STORE_CTX_get0_chain(ctx) ? ]
 888 We do not free the stack since it could be needed a second time for
 889 SNI handling.
 890
 891 Separately we might try to replace using OCSP_basic_verify() - which seems to not
 892 be a public interface into the OpenSSL library (there's no manual entry) -
 893 But what with?  We also use OCSP_basic_verify in the client stapling callback.
 894 And there we NEED it; we must verify that status... unless the
 895 library does it for us anyway?  */
 896
 897 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
 898   {
 899   DEBUG(D_tls)
 900     {
 901     ERR_error_string(ERR_get_error(), ssl_errstring);
 902     debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
 903     }
 904   goto bad;
 905   }
 906
 907 /* Here's the simplifying assumption: there's only one response, for the
 908 one certificate we use, and nothing for anything else in a chain.  If this
 909 proves false, we need to extract a cert id from our issued cert
 910 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
 911 right cert in the stack and then calls OCSP_single_get0_status()).
 912
 913 I'm hoping to avoid reworking a bunch more of how we handle state here. */
 914
 915 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
 916   {
 917   DEBUG(D_tls)
 918     debug_printf("Unable to get first response from OCSP basic response.\n");
 919   goto bad;
 920   }
 921
 922 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
 923 if (status != V_OCSP_CERTSTATUS_GOOD)
 924   {
 925   DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
 926       OCSP_cert_status_str(status), status,
 927       OCSP_crl_reason_str(reason), reason);
 928   goto bad;
 929   }
 930
 931 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
 932   {
 933   DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
 934   goto bad;
 935   }
 936
 937 supply_response:
 938   cbinfo->u_ocsp.server.response = resp;
 939 return;
 940
 941 bad:
 942   if (running_in_test_harness)
 943     {
 944     extern char ** environ;
 945     uschar ** p;
 946     if (environ) for (p = USS environ; *p != NULL; p++)
 947       if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
 948         {
 949         DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
 950         goto supply_response;
 951         }
 952     }
 953 return;
 954 }
 955 #endif  /*!DISABLE_OCSP*/
 956
 957
 958
 959
 960 /* Create and install a selfsigned certificate, for use in server mode */
 961
 962 static int
 963 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
 964 {
 965 X509 * x509 = NULL;
 966 EVP_PKEY * pkey;
 967 RSA * rsa;
 968 X509_NAME * name;
 969 uschar * where;
 970
 971 where = US"allocating pkey";
 972 if (!(pkey = EVP_PKEY_new()))
 973   goto err;
 974
 975 where = US"allocating cert";
 976 if (!(x509 = X509_new()))
 977   goto err;
 978
 979 where = US"generating pkey";
 980                 /* deprecated, use RSA_generate_key_ex() */
 981 if (!(rsa = RSA_generate_key(1024, RSA_F4, NULL, NULL)))
 982   goto err;
 983
 984 where = US"assigning pkey";
 985 if (!EVP_PKEY_assign_RSA(pkey, rsa))
 986   goto err;
 987
 988 X509_set_version(x509, 2);                              /* N+1 - version 3 */
 989 ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
 990 X509_gmtime_adj(X509_get_notBefore(x509), 0);
 991 X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60);        /* 1 hour */
 992 X509_set_pubkey(x509, pkey);
 993
 994 name = X509_get_subject_name(x509);
 995 X509_NAME_add_entry_by_txt(name, "C",
 996                           MBSTRING_ASC, CUS "UK", -1, -1, 0);
 997 X509_NAME_add_entry_by_txt(name, "O",
 998                           MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
 999 X509_NAME_add_entry_by_txt(name, "CN",
1000                           MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
1001 X509_set_issuer_name(x509, name);
1002
1003 where = US"signing cert";
1004 if (!X509_sign(x509, pkey, EVP_md5()))
1005   goto err;
1006
1007 where = US"installing selfsign cert";
1008 if (!SSL_CTX_use_certificate(sctx, x509))
1009   goto err;
1010
1011 where = US"installing selfsign key";
1012 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
1013   goto err;
1014
1015 return OK;
1016
1017 err:
1018   (void) tls_error(where, NULL, NULL, errstr);
1019   if (x509) X509_free(x509);
1020   if (pkey) EVP_PKEY_free(pkey);
1021   return DEFER;
1022 }
1023
1024
1025
1026
1027 static int
1028 tls_add_certfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1029   uschar ** errstr)
1030 {
1031 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", file);
1032 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1033   return tls_error(string_sprintf(
1034     "SSL_CTX_use_certificate_chain_file file=%s", file),
1035       cbinfo->host, NULL, errstr);
1036 return 0;
1037 }
1038
1039 static int
1040 tls_add_pkeyfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1041   uschar ** errstr)
1042 {
1043 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", file);
1044 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1045   return tls_error(string_sprintf(
1046     "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1047 return 0;
1048 }
1049
1050
1051 /*************************************************
1052 *        Expand key and cert file specs          *
1053 *************************************************/
1054
1055 /* Called once during tls_init and possibly again during TLS setup, for a
1056 new context, if Server Name Indication was used and tls_sni was seen in
1057 the certificate string.
1058
1059 Arguments:
1060   sctx            the SSL_CTX* to update
1061   cbinfo          various parts of session state
1062   errstr          error string pointer
1063
1064 Returns:          OK/DEFER/FAIL
1065 */
1066
1067 static int
1068 tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo,
1069   uschar ** errstr)
1070 {
1071 uschar *expanded;
1072
1073 if (!cbinfo->certificate)
1074   {
1075   if (!cbinfo->is_server)               /* client */
1076     return OK;
1077                                         /* server */
1078   if (tls_install_selfsign(sctx, errstr) != OK)
1079     return DEFER;
1080   }
1081 else
1082   {
1083   int err;
1084
1085   if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
1086       Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
1087       Ustrstr(cbinfo->certificate, US"tls_out_sni")
1088      )
1089     reexpand_tls_files_for_sni = TRUE;
1090
1091   if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded, errstr))
1092     return DEFER;
1093
1094   if (expanded)
1095     if (cbinfo->is_server)
1096       {
1097       const uschar * file_list = expanded;
1098       int sep = 0;
1099       uschar * file;
1100
1101       while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1102         if ((err = tls_add_certfile(sctx, cbinfo, file, errstr)))
1103           return err;
1104       }
1105     else        /* would there ever be a need for multiple client certs? */
1106       if ((err = tls_add_certfile(sctx, cbinfo, expanded, errstr)))
1107         return err;
1108
1109   if (cbinfo->privatekey != NULL &&
1110       !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded, errstr))
1111     return DEFER;
1112
1113   /* If expansion was forced to fail, key_expanded will be NULL. If the result
1114   of the expansion is an empty string, ignore it also, and assume the private
1115   key is in the same file as the certificate. */
1116
1117   if (expanded && *expanded)
1118     if (cbinfo->is_server)
1119       {
1120       const uschar * file_list = expanded;
1121       int sep = 0;
1122       uschar * file;
1123
1124       while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1125         if ((err = tls_add_pkeyfile(sctx, cbinfo, file, errstr)))
1126           return err;
1127       }
1128     else        /* would there ever be a need for multiple client certs? */
1129       if ((err = tls_add_pkeyfile(sctx, cbinfo, expanded, errstr)))
1130         return err;
1131   }
1132
1133 #ifndef DISABLE_OCSP
1134 if (cbinfo->is_server && cbinfo->u_ocsp.server.file)
1135   {
1136   if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded, errstr))
1137     return DEFER;
1138
1139   if (expanded && *expanded)
1140     {
1141     DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
1142     if (  cbinfo->u_ocsp.server.file_expanded
1143        && (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
1144       {
1145       DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1146       }
1147     else
1148       ocsp_load_response(sctx, cbinfo, expanded);
1149     }
1150   }
1151 #endif
1152
1153 return OK;
1154 }
1155
1156
1157
1158
1159 /*************************************************
1160 *            Callback to handle SNI              *
1161 *************************************************/
1162
1163 /* Called when acting as server during the TLS session setup if a Server Name
1164 Indication extension was sent by the client.
1165
1166 API documentation is OpenSSL s_server.c implementation.
1167
1168 Arguments:
1169   s               SSL* of the current session
1170   ad              unknown (part of OpenSSL API) (unused)
1171   arg             Callback of "our" registered data
1172
1173 Returns:          SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
1174 */
1175
1176 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1177 static int
1178 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
1179 {
1180 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
1181 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1182 int rc;
1183 int old_pool = store_pool;
1184 uschar * dummy_errstr;
1185
1186 if (!servername)
1187   return SSL_TLSEXT_ERR_OK;
1188
1189 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
1190     reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
1191
1192 /* Make the extension value available for expansion */
1193 store_pool = POOL_PERM;
1194 tls_in.sni = string_copy(US servername);
1195 store_pool = old_pool;
1196
1197 if (!reexpand_tls_files_for_sni)
1198   return SSL_TLSEXT_ERR_OK;
1199
1200 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1201 not confident that memcpy wouldn't break some internal reference counting.
1202 Especially since there's a references struct member, which would be off. */
1203
1204 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
1205   {
1206   ERR_error_string(ERR_get_error(), ssl_errstring);
1207   DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
1208   return SSL_TLSEXT_ERR_NOACK;
1209   }
1210
1211 /* Not sure how many of these are actually needed, since SSL object
1212 already exists.  Might even need this selfsame callback, for reneg? */
1213
1214 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1215 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1216 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1217 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1218 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1219 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
1220
1221 if (  !init_dh(server_sni, cbinfo->dhparam, NULL, &dummy_errstr)
1222    || !init_ecdh(server_sni, NULL, &dummy_errstr)
1223    )
1224   return SSL_TLSEXT_ERR_NOACK;
1225
1226 if (cbinfo->server_cipher_list)
1227   SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
1228 #ifndef DISABLE_OCSP
1229 if (cbinfo->u_ocsp.server.file)
1230   {
1231   SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
1232   SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
1233   }
1234 #endif
1235
1236 if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
1237                       verify_callback_server, &dummy_errstr)) != OK)
1238   return SSL_TLSEXT_ERR_NOACK;
1239
1240 /* do this after setup_certs, because this can require the certs for verifying
1241 OCSP information. */
1242 if ((rc = tls_expand_session_files(server_sni, cbinfo, &dummy_errstr)) != OK)
1243   return SSL_TLSEXT_ERR_NOACK;
1244
1245 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
1246 SSL_set_SSL_CTX(s, server_sni);
1247
1248 return SSL_TLSEXT_ERR_OK;
1249 }
1250 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
1251
1252
1253
1254
1255 #ifndef DISABLE_OCSP
1256
1257 /*************************************************
1258 *        Callback to handle OCSP Stapling        *
1259 *************************************************/
1260
1261 /* Called when acting as server during the TLS session setup if the client
1262 requests OCSP information with a Certificate Status Request.
1263
1264 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1265 project.
1266
1267 */
1268
1269 static int
1270 tls_server_stapling_cb(SSL *s, void *arg)
1271 {
1272 const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1273 uschar *response_der;
1274 int response_der_len;
1275
1276 DEBUG(D_tls)
1277   debug_printf("Received TLS status request (OCSP stapling); %s response\n",
1278     cbinfo->u_ocsp.server.response ? "have" : "lack");
1279
1280 tls_in.ocsp = OCSP_NOT_RESP;
1281 if (!cbinfo->u_ocsp.server.response)
1282   return SSL_TLSEXT_ERR_NOACK;
1283
1284 response_der = NULL;
1285 response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
1286                       &response_der);
1287 if (response_der_len <= 0)
1288   return SSL_TLSEXT_ERR_NOACK;
1289
1290 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
1291 tls_in.ocsp = OCSP_VFIED;
1292 return SSL_TLSEXT_ERR_OK;
1293 }
1294
1295
1296 static void
1297 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1298 {
1299 BIO_printf(bp, "\t%s: ", str);
1300 ASN1_GENERALIZEDTIME_print(bp, time);
1301 BIO_puts(bp, "\n");
1302 }
1303
1304 static int
1305 tls_client_stapling_cb(SSL *s, void *arg)
1306 {
1307 tls_ext_ctx_cb * cbinfo = arg;
1308 const unsigned char * p;
1309 int len;
1310 OCSP_RESPONSE * rsp;
1311 OCSP_BASICRESP * bs;
1312 int i;
1313
1314 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
1315 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1316 if(!p)
1317  {
1318   /* Expect this when we requested ocsp but got none */
1319   if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
1320     log_write(0, LOG_MAIN, "Received TLS status callback, null content");
1321   else
1322     DEBUG(D_tls) debug_printf(" null\n");
1323   return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1324  }
1325
1326 if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1327  {
1328   tls_out.ocsp = OCSP_FAILED;
1329   if (LOGGING(tls_cipher))
1330     log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
1331   else
1332     DEBUG(D_tls) debug_printf(" parse error\n");
1333   return 0;
1334  }
1335
1336 if(!(bs = OCSP_response_get1_basic(rsp)))
1337   {
1338   tls_out.ocsp = OCSP_FAILED;
1339   if (LOGGING(tls_cipher))
1340     log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
1341   else
1342     DEBUG(D_tls) debug_printf(" error parsing response\n");
1343   OCSP_RESPONSE_free(rsp);
1344   return 0;
1345   }
1346
1347 /* We'd check the nonce here if we'd put one in the request. */
1348 /* However that would defeat cacheability on the server so we don't. */
1349
1350 /* This section of code reworked from OpenSSL apps source;
1351    The OpenSSL Project retains copyright:
1352    Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
1353 */
1354   {
1355     BIO * bp = NULL;
1356     int status, reason;
1357     ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1358
1359     DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1360
1361     /*OCSP_RESPONSE_print(bp, rsp, 0);   extreme debug: stapling content */
1362
1363     /* Use the chain that verified the server cert to verify the stapled info */
1364     /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1365
1366     if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
1367               cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
1368       {
1369       tls_out.ocsp = OCSP_FAILED;
1370       if (LOGGING(tls_cipher))
1371         log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
1372       BIO_printf(bp, "OCSP response verify failure\n");
1373       ERR_print_errors(bp);
1374       goto failed;
1375       }
1376
1377     BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1378
1379     /*XXX So we have a good stapled OCSP status.  How do we know
1380     it is for the cert of interest?  OpenSSL 1.1.0 has a routine
1381     OCSP_resp_find_status() which matches on a cert id, which presumably
1382     we should use. Making an id needs OCSP_cert_id_new(), which takes
1383     issuerName, issuerKey, serialNumber.  Are they all in the cert?
1384
1385     For now, carry on blindly accepting the resp. */
1386
1387       {
1388       OCSP_SINGLERESP * single;
1389
1390 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
1391       if (OCSP_resp_count(bs) != 1)
1392 #else
1393       STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1394       if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1395 #endif
1396         {
1397         tls_out.ocsp = OCSP_FAILED;
1398         log_write(0, LOG_MAIN, "OCSP stapling "
1399             "with multiple responses not handled");
1400         goto failed;
1401         }
1402       single = OCSP_resp_get0(bs, 0);
1403       status = OCSP_single_get0_status(single, &reason, &rev,
1404                   &thisupd, &nextupd);
1405       }
1406
1407     DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1408     DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1409     if (!OCSP_check_validity(thisupd, nextupd,
1410           EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1411       {
1412       tls_out.ocsp = OCSP_FAILED;
1413       DEBUG(D_tls) ERR_print_errors(bp);
1414       log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1415       }
1416     else
1417       {
1418       DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1419                     OCSP_cert_status_str(status));
1420       switch(status)
1421         {
1422         case V_OCSP_CERTSTATUS_GOOD:
1423           tls_out.ocsp = OCSP_VFIED;
1424           i = 1;
1425           goto good;
1426         case V_OCSP_CERTSTATUS_REVOKED:
1427           tls_out.ocsp = OCSP_FAILED;
1428           log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1429               reason != -1 ? "; reason: " : "",
1430               reason != -1 ? OCSP_crl_reason_str(reason) : "");
1431           DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1432           break;
1433         default:
1434           tls_out.ocsp = OCSP_FAILED;
1435           log_write(0, LOG_MAIN,
1436               "Server certificate status unknown, in OCSP stapling");
1437           break;
1438         }
1439       }
1440   failed:
1441     i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1442   good:
1443     BIO_free(bp);
1444   }
1445
1446 OCSP_RESPONSE_free(rsp);
1447 return i;
1448 }
1449 #endif  /*!DISABLE_OCSP*/
1450
1451
1452 /*************************************************
1453 *            Initialize for TLS                  *
1454 *************************************************/
1455
1456 /* Called from both server and client code, to do preliminary initialization
1457 of the library.  We allocate and return a context structure.
1458
1459 Arguments:
1460   ctxp            returned SSL context
1461   host            connected host, if client; NULL if server
1462   dhparam         DH parameter file
1463   certificate     certificate file
1464   privatekey      private key
1465   ocsp_file       file of stapling info (server); flag for require ocsp (client)
1466   addr            address if client; NULL if server (for some randomness)
1467   cbp             place to put allocated callback context
1468   errstr          error string pointer
1469
1470 Returns:          OK/DEFER/FAIL
1471 */
1472
1473 static int
1474 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
1475   uschar *privatekey,
1476 #ifndef DISABLE_OCSP
1477   uschar *ocsp_file,
1478 #endif
1479   address_item *addr, tls_ext_ctx_cb ** cbp, uschar ** errstr)
1480 {
1481 SSL_CTX * ctx;
1482 long init_options;
1483 int rc;
1484 tls_ext_ctx_cb * cbinfo;
1485
1486 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1487 cbinfo->certificate = certificate;
1488 cbinfo->privatekey = privatekey;
1489 #ifndef DISABLE_OCSP
1490 cbinfo->verify_stack = NULL;
1491 if ((cbinfo->is_server = host==NULL))
1492   {
1493   cbinfo->u_ocsp.server.file = ocsp_file;
1494   cbinfo->u_ocsp.server.file_expanded = NULL;
1495   cbinfo->u_ocsp.server.response = NULL;
1496   }
1497 else
1498   cbinfo->u_ocsp.client.verify_store = NULL;
1499 #endif
1500 cbinfo->dhparam = dhparam;
1501 cbinfo->server_cipher_list = NULL;
1502 cbinfo->host = host;
1503 #ifndef DISABLE_EVENT
1504 cbinfo->event_action = NULL;
1505 #endif
1506
1507 SSL_load_error_strings();          /* basic set up */
1508 OpenSSL_add_ssl_algorithms();
1509
1510 #ifdef EXIM_HAVE_SHA256
1511 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1512 list of available digests. */
1513 EVP_add_digest(EVP_sha256());
1514 #endif
1515
1516 /* Create a context.
1517 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1518 negotiation in the different methods; as far as I can tell, the only
1519 *_{server,client}_method which allows negotiation is SSLv23, which exists even
1520 when OpenSSL is built without SSLv2 support.
1521 By disabling with openssl_options, we can let admins re-enable with the
1522 existing knob. */
1523
1524 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1525   return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1526
1527 /* It turns out that we need to seed the random number generator this early in
1528 order to get the full complement of ciphers to work. It took me roughly a day
1529 of work to discover this by experiment.
1530
1531 On systems that have /dev/urandom, SSL may automatically seed itself from
1532 there. Otherwise, we have to make something up as best we can. Double check
1533 afterwards. */
1534
1535 if (!RAND_status())
1536   {
1537   randstuff r;
1538   gettimeofday(&r.tv, NULL);
1539   r.p = getpid();
1540
1541   RAND_seed(US (&r), sizeof(r));
1542   RAND_seed(US big_buffer, big_buffer_size);
1543   if (addr != NULL) RAND_seed(US addr, sizeof(addr));
1544
1545   if (!RAND_status())
1546     return tls_error(US"RAND_status", host,
1547       US"unable to seed random number generator", errstr);
1548   }
1549
1550 /* Set up the information callback, which outputs if debugging is at a suitable
1551 level. */
1552
1553 DEBUG(D_tls) SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1554
1555 /* Automatically re-try reads/writes after renegotiation. */
1556 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1557
1558 /* Apply administrator-supplied work-arounds.
1559 Historically we applied just one requested option,
1560 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1561 moved to an administrator-controlled list of options to specify and
1562 grandfathered in the first one as the default value for "openssl_options".
1563
1564 No OpenSSL version number checks: the options we accept depend upon the
1565 availability of the option value macros from OpenSSL.  */
1566
1567 if (!tls_openssl_options_parse(openssl_options, &init_options))
1568   return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
1569
1570 if (init_options)
1571   {
1572   DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
1573   if (!(SSL_CTX_set_options(ctx, init_options)))
1574     return tls_error(string_sprintf(
1575           "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
1576   }
1577 else
1578   DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
1579
1580 /* Disable session cache unconditionally */
1581
1582 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
1583
1584 /* Initialize with DH parameters if supplied */
1585 /* Initialize ECDH temp key parameter selection */
1586
1587 if (  !init_dh(ctx, dhparam, host, errstr)
1588    || !init_ecdh(ctx, host, errstr)
1589    )
1590   return DEFER;
1591
1592 /* Set up certificate and key (and perhaps OCSP info) */
1593
1594 if ((rc = tls_expand_session_files(ctx, cbinfo, errstr)) != OK)
1595   return rc;
1596
1597 /* If we need to handle SNI or OCSP, do so */
1598
1599 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1600 # ifndef DISABLE_OCSP
1601   if (!(cbinfo->verify_stack = sk_X509_new_null()))
1602     {
1603     DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
1604     return FAIL;
1605     }
1606 # endif
1607
1608 if (host == NULL)               /* server */
1609   {
1610 # ifndef DISABLE_OCSP
1611   /* We check u_ocsp.server.file, not server.response, because we care about if
1612   the option exists, not what the current expansion might be, as SNI might
1613   change the certificate and OCSP file in use between now and the time the
1614   callback is invoked. */
1615   if (cbinfo->u_ocsp.server.file)
1616     {
1617     SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
1618     SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
1619     }
1620 # endif
1621   /* We always do this, so that $tls_sni is available even if not used in
1622   tls_certificate */
1623   SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
1624   SSL_CTX_set_tlsext_servername_arg(ctx, cbinfo);
1625   }
1626 # ifndef DISABLE_OCSP
1627 else                    /* client */
1628   if(ocsp_file)         /* wanting stapling */
1629     {
1630     if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1631       {
1632       DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1633       return FAIL;
1634       }
1635     SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
1636     SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
1637     }
1638 # endif
1639 #endif
1640
1641 cbinfo->verify_cert_hostnames = NULL;
1642
1643 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
1644 /* Set up the RSA callback */
1645 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
1646 #endif
1647
1648 /* Finally, set the timeout, and we are done */
1649
1650 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
1651 DEBUG(D_tls) debug_printf("Initialized TLS\n");
1652
1653 *cbp = cbinfo;
1654 *ctxp = ctx;
1655
1656 return OK;
1657 }
1658
1659
1660
1661
1662 /*************************************************
1663 *           Get name of cipher in use            *
1664 *************************************************/
1665
1666 /*
1667 Argument:   pointer to an SSL structure for the connection
1668             buffer to use for answer
1669             size of buffer
1670             pointer to number of bits for cipher
1671 Returns:    nothing
1672 */
1673
1674 static void
1675 construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
1676 {
1677 /* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1678 yet reflect that.  It should be a safe change anyway, even 0.9.8 versions have
1679 the accessor functions use const in the prototype. */
1680 const SSL_CIPHER *c;
1681 const uschar *ver;
1682
1683 ver = (const uschar *)SSL_get_version(ssl);
1684
1685 c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
1686 SSL_CIPHER_get_bits(c, bits);
1687
1688 string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1689   SSL_CIPHER_get_name(c), *bits);
1690
1691 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1692 }
1693
1694
1695 static void
1696 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned bsize)
1697 {
1698 /*XXX we might consider a list-of-certs variable for the cert chain.
1699 SSL_get_peer_cert_chain(SSL*).  We'd need a new variable type and support
1700 in list-handling functions, also consider the difference between the entire
1701 chain and the elements sent by the peer. */
1702
1703 /* Will have already noted peercert on a verify fail; possibly not the leaf */
1704 if (!tlsp->peercert)
1705   tlsp->peercert = SSL_get_peer_certificate(ssl);
1706 /* Beware anonymous ciphers which lead to server_cert being NULL */
1707 if (tlsp->peercert)
1708   {
1709   X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, bsize);
1710   peerdn[bsize-1] = '\0';
1711   tlsp->peerdn = peerdn;                /*XXX a static buffer... */
1712   }
1713 else
1714   tlsp->peerdn = NULL;
1715 }
1716
1717
1718
1719
1720
1721 /*************************************************
1722 *        Set up for verifying certificates       *
1723 *************************************************/
1724
1725 /* Load certs from file, return TRUE on success */
1726
1727 static BOOL
1728 chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
1729 {
1730 BIO * bp;
1731 X509 * x;
1732
1733 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
1734 while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
1735   sk_X509_push(verify_stack, x);
1736 BIO_free(bp);
1737 return TRUE;
1738 }
1739
1740
1741
1742 /* Called by both client and server startup
1743
1744 Arguments:
1745   sctx          SSL_CTX* to initialise
1746   certs         certs file or NULL
1747   crl           CRL file or NULL
1748   host          NULL in a server; the remote host in a client
1749   optional      TRUE if called from a server for a host in tls_try_verify_hosts;
1750                 otherwise passed as FALSE
1751   cert_vfy_cb   Callback function for certificate verification
1752   errstr        error string pointer
1753
1754 Returns:        OK/DEFER/FAIL
1755 */
1756
1757 static int
1758 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1759     int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr)
1760 {
1761 uschar *expcerts, *expcrl;
1762
1763 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
1764   return DEFER;
1765 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
1766
1767 if (expcerts && *expcerts)
1768   {
1769   /* Tell the library to use its compiled-in location for the system default
1770   CA bundle. Then add the ones specified in the config, if any. */
1771
1772   if (!SSL_CTX_set_default_verify_paths(sctx))
1773     return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
1774
1775   if (Ustrcmp(expcerts, "system") != 0)
1776     {
1777     struct stat statbuf;
1778
1779     if (Ustat(expcerts, &statbuf) < 0)
1780       {
1781       log_write(0, LOG_MAIN|LOG_PANIC,
1782         "failed to stat %s for certificates", expcerts);
1783       return DEFER;
1784       }
1785     else
1786       {
1787       uschar *file, *dir;
1788       if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1789         { file = NULL; dir = expcerts; }
1790       else
1791         {
1792         file = expcerts; dir = NULL;
1793 #ifndef DISABLE_OCSP
1794         /* In the server if we will be offering an OCSP proof, load chain from
1795         file for verifying the OCSP proof at load time. */
1796
1797         if (  !host
1798            && statbuf.st_size > 0
1799            && server_static_cbinfo->u_ocsp.server.file
1800            && !chain_from_pem_file(file, server_static_cbinfo->verify_stack)
1801            )
1802           {
1803           log_write(0, LOG_MAIN|LOG_PANIC,
1804             "failed to load cert hain from %s", file);
1805           return DEFER;
1806           }
1807 #endif
1808         }
1809
1810       /* If a certificate file is empty, the next function fails with an
1811       unhelpful error message. If we skip it, we get the correct behaviour (no
1812       certificates are recognized, but the error message is still misleading (it
1813       says no certificate was supplied).  But this is better. */
1814
1815       if (  (!file || statbuf.st_size > 0)
1816          && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1817         return tls_error(US"SSL_CTX_load_verify_locations", host, NULL, errstr);
1818
1819       /* Load the list of CAs for which we will accept certs, for sending
1820       to the client.  This is only for the one-file tls_verify_certificates
1821       variant.
1822       If a list isn't loaded into the server, but
1823       some verify locations are set, the server end appears to make
1824       a wildcard request for client certs.
1825       Meanwhile, the client library as default behaviour *ignores* the list
1826       we send over the wire - see man SSL_CTX_set_client_cert_cb.
1827       Because of this, and that the dir variant is likely only used for
1828       the public-CA bundle (not for a private CA), not worth fixing.
1829       */
1830       if (file)
1831         {
1832         STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
1833
1834         DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
1835                                     sk_X509_NAME_num(names));
1836         SSL_CTX_set_client_CA_list(sctx, names);
1837         }
1838       }
1839     }
1840
1841   /* Handle a certificate revocation list. */
1842
1843 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1844
1845   /* This bit of code is now the version supplied by Lars Mainka. (I have
1846   merely reformatted it into the Exim code style.)
1847
1848   "From here I changed the code to add support for multiple crl's
1849   in pem format in one file or to support hashed directory entries in
1850   pem format instead of a file. This method now uses the library function
1851   X509_STORE_load_locations to add the CRL location to the SSL context.
1852   OpenSSL will then handle the verify against CA certs and CRLs by
1853   itself in the verify callback." */
1854
1855   if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
1856   if (expcrl && *expcrl)
1857     {
1858     struct stat statbufcrl;
1859     if (Ustat(expcrl, &statbufcrl) < 0)
1860       {
1861       log_write(0, LOG_MAIN|LOG_PANIC,
1862         "failed to stat %s for certificates revocation lists", expcrl);
1863       return DEFER;
1864       }
1865     else
1866       {
1867       /* is it a file or directory? */
1868       uschar *file, *dir;
1869       X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
1870       if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
1871         {
1872         file = NULL;
1873         dir = expcrl;
1874         DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
1875         }
1876       else
1877         {
1878         file = expcrl;
1879         dir = NULL;
1880         DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
1881         }
1882       if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
1883         return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
1884
1885       /* setting the flags to check against the complete crl chain */
1886
1887       X509_STORE_set_flags(cvstore,
1888         X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
1889       }
1890     }
1891
1892 #endif  /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1893
1894   /* If verification is optional, don't fail if no certificate */
1895
1896   SSL_CTX_set_verify(sctx,
1897     SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
1898     cert_vfy_cb);
1899   }
1900
1901 return OK;
1902 }
1903
1904
1905
1906 /*************************************************
1907 *       Start a TLS session in a server          *
1908 *************************************************/
1909
1910 /* This is called when Exim is running as a server, after having received
1911 the STARTTLS command. It must respond to that command, and then negotiate
1912 a TLS session.
1913
1914 Arguments:
1915   require_ciphers   allowed ciphers
1916   errstr            pointer to error message
1917
1918 Returns:            OK on success
1919                     DEFER for errors before the start of the negotiation
1920                     FAIL for errors during the negotiation; the server can't
1921                       continue running.
1922 */
1923
1924 int
1925 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
1926 {
1927 int rc;
1928 uschar * expciphers;
1929 tls_ext_ctx_cb * cbinfo;
1930 static uschar peerdn[256];
1931 static uschar cipherbuf[256];
1932
1933 /* Check for previous activation */
1934
1935 if (tls_in.active >= 0)
1936   {
1937   tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
1938   smtp_printf("554 Already in TLS\r\n", FALSE);
1939   return FAIL;
1940   }
1941
1942 /* Initialize the SSL library. If it fails, it will already have logged
1943 the error. */
1944
1945 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
1946 #ifndef DISABLE_OCSP
1947     tls_ocsp_file,
1948 #endif
1949     NULL, &server_static_cbinfo, errstr);
1950 if (rc != OK) return rc;
1951 cbinfo = server_static_cbinfo;
1952
1953 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
1954   return FAIL;
1955
1956 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1957 were historically separated by underscores. So that I can use either form in my
1958 tests, and also for general convenience, we turn underscores into hyphens here.
1959 */
1960
1961 if (expciphers)
1962   {
1963   uschar * s = expciphers;
1964   while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1965   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1966   if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
1967     return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1968   cbinfo->server_cipher_list = expciphers;
1969   }
1970
1971 /* If this is a host for which certificate verification is mandatory or
1972 optional, set up appropriately. */
1973
1974 tls_in.certificate_verified = FALSE;
1975 #ifdef EXPERIMENTAL_DANE
1976 tls_in.dane_verified = FALSE;
1977 #endif
1978 server_verify_callback_called = FALSE;
1979
1980 if (verify_check_host(&tls_verify_hosts) == OK)
1981   {
1982   rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1983                         FALSE, verify_callback_server, errstr);
1984   if (rc != OK) return rc;
1985   server_verify_optional = FALSE;
1986   }
1987 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1988   {
1989   rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1990                         TRUE, verify_callback_server, errstr);
1991   if (rc != OK) return rc;
1992   server_verify_optional = TRUE;
1993   }
1994
1995 /* Prepare for new connection */
1996
1997 if (!(server_ssl = SSL_new(server_ctx)))
1998   return tls_error(US"SSL_new", NULL, NULL, errstr);
1999
2000 /* Warning: we used to SSL_clear(ssl) here, it was removed.
2001  *
2002  * With the SSL_clear(), we get strange interoperability bugs with
2003  * OpenSSL 1.0.1b and TLS1.1/1.2.  It looks as though this may be a bug in
2004  * OpenSSL itself, as a clear should not lead to inability to follow protocols.
2005  *
2006  * The SSL_clear() call is to let an existing SSL* be reused, typically after
2007  * session shutdown.  In this case, we have a brand new object and there's no
2008  * obvious reason to immediately clear it.  I'm guessing that this was
2009  * originally added because of incomplete initialisation which the clear fixed,
2010  * in some historic release.
2011  */
2012
2013 /* Set context and tell client to go ahead, except in the case of TLS startup
2014 on connection, where outputting anything now upsets the clients and tends to
2015 make them disconnect. We need to have an explicit fflush() here, to force out
2016 the response. Other smtp_printf() calls do not need it, because in non-TLS
2017 mode, the fflush() happens when smtp_getc() is called. */
2018
2019 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
2020 if (!tls_in.on_connect)
2021   {
2022   smtp_printf("220 TLS go ahead\r\n", FALSE);
2023   fflush(smtp_out);
2024   }
2025
2026 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2027 that the OpenSSL library doesn't. */
2028
2029 SSL_set_wfd(server_ssl, fileno(smtp_out));
2030 SSL_set_rfd(server_ssl, fileno(smtp_in));
2031 SSL_set_accept_state(server_ssl);
2032
2033 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
2034
2035 sigalrm_seen = FALSE;
2036 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2037 rc = SSL_accept(server_ssl);
2038 alarm(0);
2039
2040 if (rc <= 0)
2041   {
2042   (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2043   return FAIL;
2044   }
2045
2046 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
2047
2048 /* TLS has been set up. Adjust the input functions to read via TLS,
2049 and initialize things. */
2050
2051 peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
2052
2053 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
2054 tls_in.cipher = cipherbuf;
2055
2056 DEBUG(D_tls)
2057   {
2058   uschar buf[2048];
2059   if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
2060     debug_printf("Shared ciphers: %s\n", buf);
2061   }
2062
2063 /* Record the certificate we presented */
2064   {
2065   X509 * crt = SSL_get_certificate(server_ssl);
2066   tls_in.ourcert = crt ? X509_dup(crt) : NULL;
2067   }
2068
2069 /* Only used by the server-side tls (tls_in), including tls_getc.
2070    Client-side (tls_out) reads (seem to?) go via
2071    smtp_read_response()/ip_recv().
2072    Hence no need to duplicate for _in and _out.
2073  */
2074 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2075 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
2076 ssl_xfer_eof = ssl_xfer_error = 0;
2077
2078 receive_getc = tls_getc;
2079 receive_getbuf = tls_getbuf;
2080 receive_get_cache = tls_get_cache;
2081 receive_ungetc = tls_ungetc;
2082 receive_feof = tls_feof;
2083 receive_ferror = tls_ferror;
2084 receive_smtp_buffered = tls_smtp_buffered;
2085
2086 tls_in.active = fileno(smtp_out);
2087 return OK;
2088 }
2089
2090
2091
2092
2093 static int
2094 tls_client_basic_ctx_init(SSL_CTX * ctx,
2095     host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo,
2096     uschar ** errstr)
2097 {
2098 int rc;
2099 /* stick to the old behaviour for compatibility if tls_verify_certificates is
2100    set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2101    the specified host patterns if one of them is defined */
2102
2103 if (  (  !ob->tls_verify_hosts
2104       && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2105       )
2106    || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
2107    )
2108   client_verify_optional = FALSE;
2109 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
2110   client_verify_optional = TRUE;
2111 else
2112   return OK;
2113
2114 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
2115       ob->tls_crl, host, client_verify_optional, verify_callback_client,
2116       errstr)) != OK)
2117   return rc;
2118
2119 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
2120   {
2121   cbinfo->verify_cert_hostnames =
2122 #ifdef SUPPORT_I18N
2123     string_domain_utf8_to_alabel(host->name, NULL);
2124 #else
2125     host->name;
2126 #endif
2127   DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
2128                     cbinfo->verify_cert_hostnames);
2129   }
2130 return OK;
2131 }
2132
2133
2134 #ifdef EXPERIMENTAL_DANE
2135 static int
2136 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
2137 {
2138 dns_record * rr;
2139 dns_scan dnss;
2140 const char * hostnames[2] = { CS host->name, NULL };
2141 int found = 0;
2142
2143 if (DANESSL_init(ssl, NULL, hostnames) != 1)
2144   return tls_error(US"hostnames load", host, NULL, errstr);
2145
2146 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
2147      rr;
2148      rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2149     ) if (rr->type == T_TLSA)
2150   {
2151   const uschar * p = rr->data;
2152   uint8_t usage, selector, mtype;
2153   const char * mdname;
2154
2155   usage = *p++;
2156
2157   /* Only DANE-TA(2) and DANE-EE(3) are supported */
2158   if (usage != 2 && usage != 3) continue;
2159
2160   selector = *p++;
2161   mtype = *p++;
2162
2163   switch (mtype)
2164     {
2165     default: continue;  /* Only match-types 0, 1, 2 are supported */
2166     case 0:  mdname = NULL; break;
2167     case 1:  mdname = "sha256"; break;
2168     case 2:  mdname = "sha512"; break;
2169     }
2170
2171   found++;
2172   switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
2173     {
2174     default:
2175       return tls_error(US"tlsa load", host, NULL, errstr);
2176     case 0:     /* action not taken */
2177     case 1:     break;
2178     }
2179
2180   tls_out.tlsa_usage |= 1<<usage;
2181   }
2182
2183 if (found)
2184   return OK;
2185
2186 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
2187 return DEFER;
2188 }
2189 #endif  /*EXPERIMENTAL_DANE*/
2190
2191
2192
2193 /*************************************************
2194 *    Start a TLS session in a client             *
2195 *************************************************/
2196
2197 /* Called from the smtp transport after STARTTLS has been accepted.
2198
2199 Argument:
2200   fd               the fd of the connection
2201   host             connected host (for messages)
2202   addr             the first address
2203   tb               transport (always smtp)
2204   tlsa_dnsa        tlsa lookup, if DANE, else null
2205   errstr           error string pointer
2206
2207 Returns:           OK on success
2208                    FAIL otherwise - note that tls_error() will not give DEFER
2209                      because this is not a server
2210 */
2211
2212 int
2213 tls_client_start(int fd, host_item *host, address_item *addr,
2214   transport_instance * tb,
2215 #ifdef EXPERIMENTAL_DANE
2216   dns_answer * tlsa_dnsa,
2217 #endif
2218   uschar ** errstr)
2219 {
2220 smtp_transport_options_block * ob =
2221   (smtp_transport_options_block *)tb->options_block;
2222 static uschar peerdn[256];
2223 uschar * expciphers;
2224 int rc;
2225 static uschar cipherbuf[256];
2226
2227 #ifndef DISABLE_OCSP
2228 BOOL request_ocsp = FALSE;
2229 BOOL require_ocsp = FALSE;
2230 #endif
2231
2232 #ifdef EXPERIMENTAL_DANE
2233 tls_out.tlsa_usage = 0;
2234 #endif
2235
2236 #ifndef DISABLE_OCSP
2237   {
2238 # ifdef EXPERIMENTAL_DANE
2239   if (  tlsa_dnsa
2240      && ob->hosts_request_ocsp[0] == '*'
2241      && ob->hosts_request_ocsp[1] == '\0'
2242      )
2243     {
2244     /* Unchanged from default.  Use a safer one under DANE */
2245     request_ocsp = TRUE;
2246     ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
2247                                       "   {= {4}{$tls_out_tlsa_usage}} } "
2248                                  " {*}{}}";
2249     }
2250 # endif
2251
2252   if ((require_ocsp =
2253         verify_check_given_host(&ob->hosts_require_ocsp, host) == OK))
2254     request_ocsp = TRUE;
2255   else
2256 # ifdef EXPERIMENTAL_DANE
2257     if (!request_ocsp)
2258 # endif
2259       request_ocsp =
2260         verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2261   }
2262 #endif
2263
2264 rc = tls_init(&client_ctx, host, NULL,
2265     ob->tls_certificate, ob->tls_privatekey,
2266 #ifndef DISABLE_OCSP
2267     (void *)(long)request_ocsp,
2268 #endif
2269     addr, &client_static_cbinfo, errstr);
2270 if (rc != OK) return rc;
2271
2272 tls_out.certificate_verified = FALSE;
2273 client_verify_callback_called = FALSE;
2274
2275 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
2276     &expciphers, errstr))
2277   return FAIL;
2278
2279 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
2280 are separated by underscores. So that I can use either form in my tests, and
2281 also for general convenience, we turn underscores into hyphens here. */
2282
2283 if (expciphers)
2284   {
2285   uschar *s = expciphers;
2286   while (*s) { if (*s == '_') *s = '-'; s++; }
2287   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
2288   if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
2289     return tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
2290   }
2291
2292 #ifdef EXPERIMENTAL_DANE
2293 if (tlsa_dnsa)
2294   {
2295   SSL_CTX_set_verify(client_ctx,
2296     SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
2297     verify_callback_client_dane);
2298
2299   if (!DANESSL_library_init())
2300     return tls_error(US"library init", host, NULL, errstr);
2301   if (DANESSL_CTX_init(client_ctx) <= 0)
2302     return tls_error(US"context init", host, NULL, errstr);
2303   }
2304 else
2305
2306 #endif
2307
2308   if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob,
2309       client_static_cbinfo, errstr)) != OK)
2310     return rc;
2311
2312 if ((client_ssl = SSL_new(client_ctx)) == NULL)
2313   return tls_error(US"SSL_new", host, NULL, errstr);
2314 SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
2315 SSL_set_fd(client_ssl, fd);
2316 SSL_set_connect_state(client_ssl);
2317
2318 if (ob->tls_sni)
2319   {
2320   if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni, errstr))
2321     return FAIL;
2322   if (!tls_out.sni)
2323     {
2324     DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
2325     }
2326   else if (!Ustrlen(tls_out.sni))
2327     tls_out.sni = NULL;
2328   else
2329     {
2330 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2331     DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
2332     SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
2333 #else
2334     log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
2335           tls_out.sni);
2336 #endif
2337     }
2338   }
2339
2340 #ifdef EXPERIMENTAL_DANE
2341 if (tlsa_dnsa)
2342   if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa, errstr)) != OK)
2343     return rc;
2344 #endif
2345
2346 #ifndef DISABLE_OCSP
2347 /* Request certificate status at connection-time.  If the server
2348 does OCSP stapling we will get the callback (set in tls_init()) */
2349 # ifdef EXPERIMENTAL_DANE
2350 if (request_ocsp)
2351   {
2352   const uschar * s;
2353   if (  ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2354      || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2355      )
2356     {   /* Re-eval now $tls_out_tlsa_usage is populated.  If
2357         this means we avoid the OCSP request, we wasted the setup
2358         cost in tls_init(). */
2359     require_ocsp = verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
2360     request_ocsp = require_ocsp
2361       || verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2362     }
2363   }
2364 # endif
2365
2366 if (request_ocsp)
2367   {
2368   SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
2369   client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
2370   tls_out.ocsp = OCSP_NOT_RESP;
2371   }
2372 #endif
2373
2374 #ifndef DISABLE_EVENT
2375 client_static_cbinfo->event_action = tb->event_action;
2376 #endif
2377
2378 /* There doesn't seem to be a built-in timeout on connection. */
2379
2380 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
2381 sigalrm_seen = FALSE;
2382 alarm(ob->command_timeout);
2383 rc = SSL_connect(client_ssl);
2384 alarm(0);
2385
2386 #ifdef EXPERIMENTAL_DANE
2387 if (tlsa_dnsa)
2388   DANESSL_cleanup(client_ssl);
2389 #endif
2390
2391 if (rc <= 0)
2392   return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL,
2393     errstr);
2394
2395 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
2396
2397 peer_cert(client_ssl, &tls_out, peerdn, sizeof(peerdn));
2398
2399 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
2400 tls_out.cipher = cipherbuf;
2401
2402 /* Record the certificate we presented */
2403   {
2404   X509 * crt = SSL_get_certificate(client_ssl);
2405   tls_out.ourcert = crt ? X509_dup(crt) : NULL;
2406   }
2407
2408 tls_out.active = fd;
2409 return OK;
2410 }
2411
2412
2413
2414
2415
2416 static BOOL
2417 tls_refill(unsigned lim)
2418 {
2419 int error;
2420 int inbytes;
2421
2422 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
2423   ssl_xfer_buffer, ssl_xfer_buffer_size);
2424
2425 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2426 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer,
2427                   MIN(ssl_xfer_buffer_size, lim));
2428 error = SSL_get_error(server_ssl, inbytes);
2429 alarm(0);
2430
2431 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2432 closed down, not that the socket itself has been closed down. Revert to
2433 non-SSL handling. */
2434
2435 if (error == SSL_ERROR_ZERO_RETURN)
2436   {
2437   DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2438
2439   receive_getc = smtp_getc;
2440   receive_getbuf = smtp_getbuf;
2441   receive_get_cache = smtp_get_cache;
2442   receive_ungetc = smtp_ungetc;
2443   receive_feof = smtp_feof;
2444   receive_ferror = smtp_ferror;
2445   receive_smtp_buffered = smtp_buffered;
2446
2447   SSL_free(server_ssl);
2448   server_ssl = NULL;
2449   tls_in.active = -1;
2450   tls_in.bits = 0;
2451   tls_in.cipher = NULL;
2452   tls_in.peerdn = NULL;
2453   tls_in.sni = NULL;
2454
2455   return FALSE;
2456   }
2457
2458 /* Handle genuine errors */
2459
2460 else if (error == SSL_ERROR_SSL)
2461   {
2462   ERR_error_string(ERR_get_error(), ssl_errstring);
2463   log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
2464   ssl_xfer_error = 1;
2465   return FALSE;
2466   }
2467
2468 else if (error != SSL_ERROR_NONE)
2469   {
2470   DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2471   ssl_xfer_error = 1;
2472   return FALSE;
2473   }
2474
2475 #ifndef DISABLE_DKIM
2476 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2477 #endif
2478 ssl_xfer_buffer_hwm = inbytes;
2479 ssl_xfer_buffer_lwm = 0;
2480 return TRUE;
2481 }
2482
2483
2484 /*************************************************
2485 *            TLS version of getc                 *
2486 *************************************************/
2487
2488 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2489 it refills the buffer via the SSL reading function.
2490
2491 Arguments:  lim         Maximum amount to read/buffer
2492 Returns:    the next character or EOF
2493
2494 Only used by the server-side TLS.
2495 */
2496
2497 int
2498 tls_getc(unsigned lim)
2499 {
2500 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2501   if (!tls_refill(lim))
2502     return ssl_xfer_error ? EOF : smtp_getc(lim);
2503
2504 /* Something in the buffer; return next uschar */
2505
2506 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2507 }
2508
2509 uschar *
2510 tls_getbuf(unsigned * len)
2511 {
2512 unsigned size;
2513 uschar * buf;
2514
2515 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2516   if (!tls_refill(*len))
2517     {
2518     if (!ssl_xfer_error) return smtp_getbuf(len);
2519     *len = 0;
2520     return NULL;
2521     }
2522
2523 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
2524   size = *len;
2525 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
2526 ssl_xfer_buffer_lwm += size;
2527 *len = size;
2528 return buf;
2529 }
2530
2531
2532 void
2533 tls_get_cache()
2534 {
2535 #ifndef DISABLE_DKIM
2536 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
2537 if (n > 0)
2538   dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
2539 #endif
2540 }
2541
2542
2543 BOOL
2544 tls_could_read(void)
2545 {
2546 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm || SSL_pending(server_ssl) > 0;
2547 }
2548
2549
2550 /*************************************************
2551 *          Read bytes from TLS channel           *
2552 *************************************************/
2553
2554 /*
2555 Arguments:
2556   buff      buffer of data
2557   len       size of buffer
2558
2559 Returns:    the number of bytes read
2560             -1 after a failed read
2561
2562 Only used by the client-side TLS.
2563 */
2564
2565 int
2566 tls_read(BOOL is_server, uschar *buff, size_t len)
2567 {
2568 SSL *ssl = is_server ? server_ssl : client_ssl;
2569 int inbytes;
2570 int error;
2571
2572 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
2573   buff, (unsigned int)len);
2574
2575 inbytes = SSL_read(ssl, CS buff, len);
2576 error = SSL_get_error(ssl, inbytes);
2577
2578 if (error == SSL_ERROR_ZERO_RETURN)
2579   {
2580   DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2581   return -1;
2582   }
2583 else if (error != SSL_ERROR_NONE)
2584   return -1;
2585
2586 return inbytes;
2587 }
2588
2589
2590
2591
2592
2593 /*************************************************
2594 *         Write bytes down TLS channel           *
2595 *************************************************/
2596
2597 /*
2598 Arguments:
2599   is_server channel specifier
2600   buff      buffer of data
2601   len       number of bytes
2602   more      further data expected soon
2603
2604 Returns:    the number of bytes after a successful write,
2605             -1 after a failed write
2606
2607 Used by both server-side and client-side TLS.
2608 */
2609
2610 int
2611 tls_write(BOOL is_server, const uschar *buff, size_t len, BOOL more)
2612 {
2613 int outbytes, error, left;
2614 SSL *ssl = is_server ? server_ssl : client_ssl;
2615 static gstring * corked = NULL;
2616
2617 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
2618   buff, (unsigned long)len, more ? ", more" : "");
2619
2620 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
2621 "more" is notified.  This hack is only ok if small amounts are involved AND only
2622 one stream does it, in one context (i.e. no store reset).  Currently it is used
2623 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only. */
2624
2625 if (is_server && (more || corked))
2626   {
2627   corked = string_catn(corked, buff, len);
2628   if (more)
2629     return len;
2630   buff = CUS corked->s;
2631   len = corked->ptr;
2632   corked = NULL;
2633   }
2634
2635 for (left = len; left > 0;)
2636   {
2637   DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
2638   outbytes = SSL_write(ssl, CS buff, left);
2639   error = SSL_get_error(ssl, outbytes);
2640   DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2641   switch (error)
2642     {
2643     case SSL_ERROR_SSL:
2644       ERR_error_string(ERR_get_error(), ssl_errstring);
2645       log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2646       return -1;
2647
2648     case SSL_ERROR_NONE:
2649       left -= outbytes;
2650       buff += outbytes;
2651       break;
2652
2653     case SSL_ERROR_ZERO_RETURN:
2654       log_write(0, LOG_MAIN, "SSL channel closed on write");
2655       return -1;
2656
2657     case SSL_ERROR_SYSCALL:
2658       log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2659         sender_fullhost ? sender_fullhost : US"<unknown>",
2660         strerror(errno));
2661       return -1;
2662
2663     default:
2664       log_write(0, LOG_MAIN, "SSL_write error %d", error);
2665       return -1;
2666     }
2667   }
2668 return len;
2669 }
2670
2671
2672
2673 /*************************************************
2674 *         Close down a TLS session               *
2675 *************************************************/
2676
2677 /* This is also called from within a delivery subprocess forked from the
2678 daemon, to shut down the TLS library, without actually doing a shutdown (which
2679 would tamper with the SSL session in the parent process).
2680
2681 Arguments:   TRUE if SSL_shutdown is to be called
2682 Returns:     nothing
2683
2684 Used by both server-side and client-side TLS.
2685 */
2686
2687 void
2688 tls_close(BOOL is_server, BOOL shutdown)
2689 {
2690 SSL **sslp = is_server ? &server_ssl : &client_ssl;
2691 int *fdp = is_server ? &tls_in.active : &tls_out.active;
2692
2693 if (*fdp < 0) return;  /* TLS was not active */
2694
2695 if (shutdown)
2696   {
2697   DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
2698   SSL_shutdown(*sslp);
2699   }
2700
2701 SSL_free(*sslp);
2702 *sslp = NULL;
2703
2704 *fdp = -1;
2705 }
2706
2707
2708
2709
2710 /*************************************************
2711 *  Let tls_require_ciphers be checked at startup *
2712 *************************************************/
2713
2714 /* The tls_require_ciphers option, if set, must be something which the
2715 library can parse.
2716
2717 Returns:     NULL on success, or error message
2718 */
2719
2720 uschar *
2721 tls_validate_require_cipher(void)
2722 {
2723 SSL_CTX *ctx;
2724 uschar *s, *expciphers, *err;
2725
2726 /* this duplicates from tls_init(), we need a better "init just global
2727 state, for no specific purpose" singleton function of our own */
2728
2729 SSL_load_error_strings();
2730 OpenSSL_add_ssl_algorithms();
2731 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2732 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2733 list of available digests. */
2734 EVP_add_digest(EVP_sha256());
2735 #endif
2736
2737 if (!(tls_require_ciphers && *tls_require_ciphers))
2738   return NULL;
2739
2740 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
2741                   &err))
2742   return US"failed to expand tls_require_ciphers";
2743
2744 if (!(expciphers && *expciphers))
2745   return NULL;
2746
2747 /* normalisation ripped from above */
2748 s = expciphers;
2749 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2750
2751 err = NULL;
2752
2753 ctx = SSL_CTX_new(SSLv23_server_method());
2754 if (!ctx)
2755   {
2756   ERR_error_string(ERR_get_error(), ssl_errstring);
2757   return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2758   }
2759
2760 DEBUG(D_tls)
2761   debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2762
2763 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2764   {
2765   ERR_error_string(ERR_get_error(), ssl_errstring);
2766   err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
2767                       expciphers, ssl_errstring);
2768   }
2769
2770 SSL_CTX_free(ctx);
2771
2772 return err;
2773 }
2774
2775
2776
2777
2778 /*************************************************
2779 *         Report the library versions.           *
2780 *************************************************/
2781
2782 /* There have historically been some issues with binary compatibility in
2783 OpenSSL libraries; if Exim (like many other applications) is built against
2784 one version of OpenSSL but the run-time linker picks up another version,
2785 it can result in serious failures, including crashing with a SIGSEGV.  So
2786 report the version found by the compiler and the run-time version.
2787
2788 Note: some OS vendors backport security fixes without changing the version
2789 number/string, and the version date remains unchanged.  The _build_ date
2790 will change, so we can more usefully assist with version diagnosis by also
2791 reporting the build date.
2792
2793 Arguments:   a FILE* to print the results to
2794 Returns:     nothing
2795 */
2796
2797 void
2798 tls_version_report(FILE *f)
2799 {
2800 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
2801            "                          Runtime: %s\n"
2802            "                                 : %s\n",
2803            OPENSSL_VERSION_TEXT,
2804            SSLeay_version(SSLEAY_VERSION),
2805            SSLeay_version(SSLEAY_BUILT_ON));
2806 /* third line is 38 characters for the %s and the line is 73 chars long;
2807 the OpenSSL output includes a "built on: " prefix already. */
2808 }
2809
2810
2811
2812
2813 /*************************************************
2814 *            Random number generation            *
2815 *************************************************/
2816
2817 /* Pseudo-random number generation.  The result is not expected to be
2818 cryptographically strong but not so weak that someone will shoot themselves
2819 in the foot using it as a nonce in input in some email header scheme or
2820 whatever weirdness they'll twist this into.  The result should handle fork()
2821 and avoid repeating sequences.  OpenSSL handles that for us.
2822
2823 Arguments:
2824   max       range maximum
2825 Returns     a random number in range [0, max-1]
2826 */
2827
2828 int
2829 vaguely_random_number(int max)
2830 {
2831 unsigned int r;
2832 int i, needed_len;
2833 static pid_t pidlast = 0;
2834 pid_t pidnow;
2835 uschar *p;
2836 uschar smallbuf[sizeof(r)];
2837
2838 if (max <= 1)
2839   return 0;
2840
2841 pidnow = getpid();
2842 if (pidnow != pidlast)
2843   {
2844   /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2845   is unique for each thread", this doesn't apparently apply across processes,
2846   so our own warning from vaguely_random_number_fallback() applies here too.
2847   Fix per PostgreSQL. */
2848   if (pidlast != 0)
2849     RAND_cleanup();
2850   pidlast = pidnow;
2851   }
2852
2853 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2854 if (!RAND_status())
2855   {
2856   randstuff r;
2857   gettimeofday(&r.tv, NULL);
2858   r.p = getpid();
2859
2860   RAND_seed(US (&r), sizeof(r));
2861   }
2862 /* We're after pseudo-random, not random; if we still don't have enough data
2863 in the internal PRNG then our options are limited.  We could sleep and hope
2864 for entropy to come along (prayer technique) but if the system is so depleted
2865 in the first place then something is likely to just keep taking it.  Instead,
2866 we'll just take whatever little bit of pseudo-random we can still manage to
2867 get. */
2868
2869 needed_len = sizeof(r);
2870 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2871 asked for a number less than 10. */
2872 for (r = max, i = 0; r; ++i)
2873   r >>= 1;
2874 i = (i + 7) / 8;
2875 if (i < needed_len)
2876   needed_len = i;
2877
2878 #ifdef EXIM_HAVE_RAND_PSEUDO
2879 /* We do not care if crypto-strong */
2880 i = RAND_pseudo_bytes(smallbuf, needed_len);
2881 #else
2882 i = RAND_bytes(smallbuf, needed_len);
2883 #endif
2884
2885 if (i < 0)
2886   {
2887   DEBUG(D_all)
2888     debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2889   return vaguely_random_number_fallback(max);
2890   }
2891
2892 r = 0;
2893 for (p = smallbuf; needed_len; --needed_len, ++p)
2894   {
2895   r *= 256;
2896   r += *p;
2897   }
2898
2899 /* We don't particularly care about weighted results; if someone wants
2900 smooth distribution and cares enough then they should submit a patch then. */
2901 return r % max;
2902 }
2903
2904
2905
2906
2907 /*************************************************
2908 *        OpenSSL option parse                    *
2909 *************************************************/
2910
2911 /* Parse one option for tls_openssl_options_parse below
2912
2913 Arguments:
2914   name    one option name
2915   value   place to store a value for it
2916 Returns   success or failure in parsing
2917 */
2918
2919 struct exim_openssl_option {
2920   uschar *name;
2921   long    value;
2922 };
2923 /* We could use a macro to expand, but we need the ifdef and not all the
2924 options document which version they were introduced in.  Policylet: include
2925 all options unless explicitly for DTLS, let the administrator choose which
2926 to apply.
2927
2928 This list is current as of:
2929   ==>  1.0.1b  <==
2930 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2931 */
2932 static struct exim_openssl_option exim_openssl_options[] = {
2933 /* KEEP SORTED ALPHABETICALLY! */
2934 #ifdef SSL_OP_ALL
2935   { US"all", SSL_OP_ALL },
2936 #endif
2937 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
2938   { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
2939 #endif
2940 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
2941   { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
2942 #endif
2943 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
2944   { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
2945 #endif
2946 #ifdef SSL_OP_EPHEMERAL_RSA
2947   { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
2948 #endif
2949 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
2950   { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
2951 #endif
2952 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
2953   { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
2954 #endif
2955 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
2956   { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
2957 #endif
2958 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
2959   { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
2960 #endif
2961 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
2962   { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
2963 #endif
2964 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
2965   { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
2966 #endif
2967 #ifdef SSL_OP_NO_COMPRESSION
2968   { US"no_compression", SSL_OP_NO_COMPRESSION },
2969 #endif
2970 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2971   { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
2972 #endif
2973 #ifdef SSL_OP_NO_SSLv2
2974   { US"no_sslv2", SSL_OP_NO_SSLv2 },
2975 #endif
2976 #ifdef SSL_OP_NO_SSLv3
2977   { US"no_sslv3", SSL_OP_NO_SSLv3 },
2978 #endif
2979 #ifdef SSL_OP_NO_TICKET
2980   { US"no_ticket", SSL_OP_NO_TICKET },
2981 #endif
2982 #ifdef SSL_OP_NO_TLSv1
2983   { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2984 #endif
2985 #ifdef SSL_OP_NO_TLSv1_1
2986 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
2987   /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2988 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2989 #else
2990   { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2991 #endif
2992 #endif
2993 #ifdef SSL_OP_NO_TLSv1_2
2994   { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2995 #endif
2996 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2997   { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2998 #endif
2999 #ifdef SSL_OP_SINGLE_DH_USE
3000   { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
3001 #endif
3002 #ifdef SSL_OP_SINGLE_ECDH_USE
3003   { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
3004 #endif
3005 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
3006   { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
3007 #endif
3008 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
3009   { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
3010 #endif
3011 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
3012   { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
3013 #endif
3014 #ifdef SSL_OP_TLS_D5_BUG
3015   { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
3016 #endif
3017 #ifdef SSL_OP_TLS_ROLLBACK_BUG
3018   { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
3019 #endif
3020 };
3021 static int exim_openssl_options_size =
3022   sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
3023
3024
3025 static BOOL
3026 tls_openssl_one_option_parse(uschar *name, long *value)
3027 {
3028 int first = 0;
3029 int last = exim_openssl_options_size;
3030 while (last > first)
3031   {
3032   int middle = (first + last)/2;
3033   int c = Ustrcmp(name, exim_openssl_options[middle].name);
3034   if (c == 0)
3035     {
3036     *value = exim_openssl_options[middle].value;
3037     return TRUE;
3038     }
3039   else if (c > 0)
3040     first = middle + 1;
3041   else
3042     last = middle;
3043   }
3044 return FALSE;
3045 }
3046
3047
3048
3049
3050 /*************************************************
3051 *        OpenSSL option parsing logic            *
3052 *************************************************/
3053
3054 /* OpenSSL has a number of compatibility options which an administrator might
3055 reasonably wish to set.  Interpret a list similarly to decode_bits(), so that
3056 we look like log_selector.
3057
3058 Arguments:
3059   option_spec  the administrator-supplied string of options
3060   results      ptr to long storage for the options bitmap
3061 Returns        success or failure
3062 */
3063
3064 BOOL
3065 tls_openssl_options_parse(uschar *option_spec, long *results)
3066 {
3067 long result, item;
3068 uschar *s, *end;
3069 uschar keep_c;
3070 BOOL adding, item_parsed;
3071
3072 result = SSL_OP_NO_TICKET;
3073 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
3074  * from default because it increases BEAST susceptibility. */
3075 #ifdef SSL_OP_NO_SSLv2
3076 result |= SSL_OP_NO_SSLv2;
3077 #endif
3078 #ifdef SSL_OP_SINGLE_DH_USE
3079 result |= SSL_OP_SINGLE_DH_USE;
3080 #endif
3081
3082 if (!option_spec)
3083   {
3084   *results = result;
3085   return TRUE;
3086   }
3087
3088 for (s=option_spec; *s != '\0'; /**/)
3089   {
3090   while (isspace(*s)) ++s;
3091   if (*s == '\0')
3092     break;
3093   if (*s != '+' && *s != '-')
3094     {
3095     DEBUG(D_tls) debug_printf("malformed openssl option setting: "
3096         "+ or - expected but found \"%s\"\n", s);
3097     return FALSE;
3098     }
3099   adding = *s++ == '+';
3100   for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
3101   keep_c = *end;
3102   *end = '\0';
3103   item_parsed = tls_openssl_one_option_parse(s, &item);
3104   *end = keep_c;
3105   if (!item_parsed)
3106     {
3107     DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
3108     return FALSE;
3109     }
3110   DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
3111       adding ? "adding" : "removing", result, item, s);
3112   if (adding)
3113     result |= item;
3114   else
3115     result &= ~item;
3116   s = end;
3117   }
3118
3119 *results = result;
3120 return TRUE;
3121 }
3122
3123 /* vi: aw ai sw=2
3124 */
3125 /* End of tls-openssl.c */