src/src/tls-openssl.c

   1 /*************************************************
   2 *     Exim - an Internet mail transport agent    *
   3 *************************************************/
   4
   5 /* Copyright (c) University of Cambridge 1995 - 2014 */
   6 /* See the file NOTICE for conditions of use and distribution. */
   7
   8 /* Portions Copyright (c) The OpenSSL Project 1999 */
   9
  10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
  11 library. It is #included into the tls.c file when that library is used. The
  12 code herein is based on a patch that was originally contributed by Steve
  13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
  14
  15 No cryptographic code is included in Exim. All this module does is to call
  16 functions from the OpenSSL library. */
  17
  18
  19 /* Heading stuff */
  20
  21 #include <openssl/lhash.h>
  22 #include <openssl/ssl.h>
  23 #include <openssl/err.h>
  24 #include <openssl/rand.h>
  25 #ifndef DISABLE_OCSP
  26 # include <openssl/ocsp.h>
  27 #endif
  28 #ifdef EXPERIMENTAL_DANE
  29 # include <danessl.h>
  30 #endif
  31
  32
  33 #ifndef DISABLE_OCSP
  34 # define EXIM_OCSP_SKEW_SECONDS (300L)
  35 # define EXIM_OCSP_MAX_AGE (-1L)
  36 #endif
  37
  38 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
  39 # define EXIM_HAVE_OPENSSL_TLSEXT
  40 #endif
  41
  42 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
  43 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
  44 # define DISABLE_OCSP
  45 #endif
  46
  47 /* Structure for collecting random data for seeding. */
  48
  49 typedef struct randstuff {
  50   struct timeval tv;
  51   pid_t          p;
  52 } randstuff;
  53
  54 /* Local static variables */
  55
  56 static BOOL client_verify_callback_called = FALSE;
  57 static BOOL server_verify_callback_called = FALSE;
  58 static const uschar *sid_ctx = US"exim";
  59
  60 /* We have three different contexts to care about.
  61
  62 Simple case: client, `client_ctx`
  63  As a client, we can be doing a callout or cut-through delivery while receiving
  64  a message.  So we have a client context, which should have options initialised
  65  from the SMTP Transport.
  66
  67 Server:
  68  There are two cases: with and without ServerNameIndication from the client.
  69  Given TLS SNI, we can be using different keys, certs and various other
  70  configuration settings, because they're re-expanded with $tls_sni set.  This
  71  allows vhosting with TLS.  This SNI is sent in the handshake.
  72  A client might not send SNI, so we need a fallback, and an initial setup too.
  73  So as a server, we start out using `server_ctx`.
  74  If SNI is sent by the client, then we as server, mid-negotiation, try to clone
  75  `server_sni` from `server_ctx` and then initialise settings by re-expanding
  76  configuration.
  77 */
  78
  79 static SSL_CTX *client_ctx = NULL;
  80 static SSL_CTX *server_ctx = NULL;
  81 static SSL     *client_ssl = NULL;
  82 static SSL     *server_ssl = NULL;
  83
  84 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
  85 static SSL_CTX *server_sni = NULL;
  86 #endif
  87
  88 static char ssl_errstring[256];
  89
  90 static int  ssl_session_timeout = 200;
  91 static BOOL client_verify_optional = FALSE;
  92 static BOOL server_verify_optional = FALSE;
  93
  94 static BOOL reexpand_tls_files_for_sni = FALSE;
  95
  96
  97 typedef struct tls_ext_ctx_cb {
  98   uschar *certificate;
  99   uschar *privatekey;
 100 #ifndef DISABLE_OCSP
 101   BOOL is_server;
 102   union {
 103     struct {
 104       uschar        *file;
 105       uschar        *file_expanded;
 106       OCSP_RESPONSE *response;
 107     } server;
 108     struct {
 109       X509_STORE    *verify_store;      /* non-null if status requested */
 110       BOOL          verify_required;
 111     } client;
 112   } u_ocsp;
 113 #endif
 114   uschar *dhparam;
 115   /* these are cached from first expand */
 116   uschar *server_cipher_list;
 117   /* only passed down to tls_error: */
 118   host_item *host;
 119
 120 #ifdef EXPERIMENTAL_CERTNAMES
 121   uschar * verify_cert_hostnames;
 122 #endif
 123 #ifdef EXPERIMENTAL_TPDA
 124   uschar * event_action;
 125 #endif
 126 } tls_ext_ctx_cb;
 127
 128 /* should figure out a cleanup of API to handle state preserved per
 129 implementation, for various reasons, which can be void * in the APIs.
 130 For now, we hack around it. */
 131 tls_ext_ctx_cb *client_static_cbinfo = NULL;
 132 tls_ext_ctx_cb *server_static_cbinfo = NULL;
 133
 134 static int
 135 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
 136     int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
 137
 138 /* Callbacks */
 139 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
 140 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
 141 #endif
 142 #ifndef DISABLE_OCSP
 143 static int tls_server_stapling_cb(SSL *s, void *arg);
 144 #endif
 145
 146
 147 /*************************************************
 148 *               Handle TLS error                 *
 149 *************************************************/
 150
 151 /* Called from lots of places when errors occur before actually starting to do
 152 the TLS handshake, that is, while the session is still in clear. Always returns
 153 DEFER for a server and FAIL for a client so that most calls can use "return
 154 tls_error(...)" to do this processing and then give an appropriate return. A
 155 single function is used for both server and client, because it is called from
 156 some shared functions.
 157
 158 Argument:
 159   prefix    text to include in the logged error
 160   host      NULL if setting up a server;
 161             the connected host if setting up a client
 162   msg       error message or NULL if we should ask OpenSSL
 163
 164 Returns:    OK/DEFER/FAIL
 165 */
 166
 167 static int
 168 tls_error(uschar *prefix, host_item *host, uschar *msg)
 169 {
 170 if (msg == NULL)
 171   {
 172   ERR_error_string(ERR_get_error(), ssl_errstring);
 173   msg = (uschar *)ssl_errstring;
 174   }
 175
 176 if (host == NULL)
 177   {
 178   uschar *conn_info = smtp_get_connection_info();
 179   if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
 180     conn_info += 5;
 181   log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
 182     conn_info, prefix, msg);
 183   return DEFER;
 184   }
 185 else
 186   {
 187   log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s): %s",
 188     host->name, host->address, prefix, msg);
 189   return FAIL;
 190   }
 191 }
 192
 193
 194
 195 /*************************************************
 196 *        Callback to generate RSA key            *
 197 *************************************************/
 198
 199 /*
 200 Arguments:
 201   s          SSL connection
 202   export     not used
 203   keylength  keylength
 204
 205 Returns:     pointer to generated key
 206 */
 207
 208 static RSA *
 209 rsa_callback(SSL *s, int export, int keylength)
 210 {
 211 RSA *rsa_key;
 212 export = export;     /* Shut picky compilers up */
 213 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
 214 rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
 215 if (rsa_key == NULL)
 216   {
 217   ERR_error_string(ERR_get_error(), ssl_errstring);
 218   log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
 219     ssl_errstring);
 220   return NULL;
 221   }
 222 return rsa_key;
 223 }
 224
 225
 226
 227 /* Extreme debug
 228 #ifndef DISABLE_OCSP
 229 void
 230 x509_store_dump_cert_s_names(X509_STORE * store)
 231 {
 232 STACK_OF(X509_OBJECT) * roots= store->objs;
 233 int i;
 234 static uschar name[256];
 235
 236 for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
 237   {
 238   X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
 239   if(tmp_obj->type == X509_LU_X509)
 240     {
 241     X509 * current_cert= tmp_obj->data.x509;
 242     X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
 243     debug_printf(" %s\n", name);
 244     }
 245   }
 246 }
 247 #endif
 248 */
 249
 250
 251 /*************************************************
 252 *        Callback for verification               *
 253 *************************************************/
 254
 255 /* The SSL library does certificate verification if set up to do so. This
 256 callback has the current yes/no state is in "state". If verification succeeded,
 257 we set up the tls_peerdn string. If verification failed, what happens depends
 258 on whether the client is required to present a verifiable certificate or not.
 259
 260 If verification is optional, we change the state to yes, but still log the
 261 verification error. For some reason (it really would help to have proper
 262 documentation of OpenSSL), this callback function then gets called again, this
 263 time with state = 1. In fact, that's useful, because we can set up the peerdn
 264 value, but we must take care not to set the private verified flag on the second
 265 time through.
 266
 267 Note: this function is not called if the client fails to present a certificate
 268 when asked. We get here only if a certificate has been received. Handling of
 269 optional verification for this case is done when requesting SSL to verify, by
 270 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
 271
 272 May be called multiple times for different issues with a certificate, even
 273 for a given "depth" in the certificate chain.
 274
 275 Arguments:
 276   state      current yes/no state as 1/0
 277   x509ctx    certificate information.
 278   client     TRUE for client startup, FALSE for server startup
 279
 280 Returns:     1 if verified, 0 if not
 281 */
 282
 283 static int
 284 verify_callback(int state, X509_STORE_CTX *x509ctx,
 285   tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
 286 {
 287 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 288 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 289 static uschar txt[256];
 290
 291 X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
 292
 293 if (state == 0)
 294   {
 295   log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
 296     depth,
 297     X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
 298     txt);
 299   tlsp->certificate_verified = FALSE;
 300   *calledp = TRUE;
 301   if (!*optionalp)
 302     {
 303     tlsp->peercert = X509_dup(cert);
 304     return 0;                       /* reject */
 305     }
 306   DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
 307     "tls_try_verify_hosts)\n");
 308   }
 309
 310 else if (depth != 0)
 311   {
 312   DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, txt);
 313 #ifndef DISABLE_OCSP
 314   if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
 315     {   /* client, wanting stapling  */
 316     /* Add the server cert's signing chain as the one
 317     for the verification of the OCSP stapled information. */
 318
 319     if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
 320                              cert))
 321       ERR_clear_error();
 322     }
 323 #endif
 324 #ifdef EXPERIMENTAL_TPDA
 325   if (tlsp == &tls_out && client_static_cbinfo->event_action)
 326     {
 327     tlsp->peercert = X509_dup(cert);
 328     if (tpda_raise_event(client_static_cbinfo->event_action,
 329                     US"tls:cert", string_sprintf("%d", depth)) == DEFER)
 330       {
 331       log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
 332                               "depth=%d cert=%s", depth, txt);
 333       tlsp->certificate_verified = FALSE;
 334       *calledp = TRUE;
 335       return 0;                     /* reject */
 336       }
 337     X509_free(tlsp->peercert);
 338     tlsp->peercert = NULL;
 339     }
 340 #endif
 341   }
 342 else
 343   {
 344 #ifdef EXPERIMENTAL_CERTNAMES
 345   uschar * verify_cert_hostnames;
 346 #endif
 347
 348   tlsp->peerdn = txt;
 349   tlsp->peercert = X509_dup(cert);
 350
 351 #ifdef EXPERIMENTAL_CERTNAMES
 352   if (  tlsp == &tls_out
 353      && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
 354         /* client, wanting hostname check */
 355
 356 # if OPENSSL_VERSION_NUMBER >= 0x010100000L || OPENSSL_VERSION_NUMBER >= 0x010002000L
 357 #  ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
 358 #   define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
 359 #  endif
 360     {
 361     int sep = 0;
 362     uschar * list = verify_cert_hostnames;
 363     uschar * name;
 364     int rc;
 365     while ((name = string_nextinlist(&list, &sep, NULL, 0)))
 366       if ((rc = X509_check_host(cert, name, 0,
 367                   X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS)))
 368         {
 369         if (rc < 0)
 370           {
 371           log_write(0, LOG_MAIN, "SSL verify error: internal error\n");
 372           name = NULL;
 373           }
 374         break;
 375         }
 376     if (!name)
 377       {
 378       log_write(0, LOG_MAIN,
 379         "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
 380       return 0;                         /* reject */
 381       }
 382     }
 383 # else
 384     if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
 385       {
 386       log_write(0, LOG_MAIN,
 387         "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
 388       return 0;                         /* reject */
 389       }
 390 # endif
 391 #endif  /*EXPERIMENTAL_CERTNAMES*/
 392
 393 #ifdef EXPERIMENTAL_TPDA
 394   if (tlsp == &tls_out)
 395     {
 396     if (tpda_raise_event(client_static_cbinfo->event_action,
 397                     US"tls:cert", US"0") == DEFER)
 398       {
 399       log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
 400                               "depth=0 cert=%s", txt);
 401       tlsp->certificate_verified = FALSE;
 402       *calledp = TRUE;
 403       return 0;                     /* reject */
 404       }
 405     }
 406 #endif
 407
 408   DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
 409     *calledp ? "" : " authenticated", txt);
 410   if (!*calledp) tlsp->certificate_verified = TRUE;
 411   *calledp = TRUE;
 412   }
 413
 414 return 1;   /* accept, at least for this level */
 415 }
 416
 417 static int
 418 verify_callback_client(int state, X509_STORE_CTX *x509ctx)
 419 {
 420 return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
 421 }
 422
 423 static int
 424 verify_callback_server(int state, X509_STORE_CTX *x509ctx)
 425 {
 426 return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
 427 }
 428
 429
 430 #ifdef EXPERIMENTAL_DANE
 431
 432 /* This gets called *by* the dane library verify callback, which interposes
 433 itself.
 434 */
 435 static int
 436 verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
 437 {
 438 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 439 static uschar txt[256];
 440
 441 X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
 442
 443 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", txt);
 444 tls_out.peerdn = txt;
 445 tls_out.peercert = X509_dup(cert);
 446
 447 if (state == 1)
 448   tls_out.dane_verified =
 449   tls_out.certificate_verified = TRUE;
 450 return 1;
 451 }
 452
 453 #endif  /*EXPERIMENTAL_DANE*/
 454
 455
 456 /*************************************************
 457 *           Information callback                 *
 458 *************************************************/
 459
 460 /* The SSL library functions call this from time to time to indicate what they
 461 are doing. We copy the string to the debugging output when TLS debugging has
 462 been requested.
 463
 464 Arguments:
 465   s         the SSL connection
 466   where
 467   ret
 468
 469 Returns:    nothing
 470 */
 471
 472 static void
 473 info_callback(SSL *s, int where, int ret)
 474 {
 475 where = where;
 476 ret = ret;
 477 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
 478 }
 479
 480
 481
 482 /*************************************************
 483 *                Initialize for DH               *
 484 *************************************************/
 485
 486 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
 487
 488 Arguments:
 489   dhparam   DH parameter file or fixed parameter identity string
 490   host      connected host, if client; NULL if server
 491
 492 Returns:    TRUE if OK (nothing to set up, or setup worked)
 493 */
 494
 495 static BOOL
 496 init_dh(SSL_CTX *sctx, uschar *dhparam, host_item *host)
 497 {
 498 BIO *bio;
 499 DH *dh;
 500 uschar *dhexpanded;
 501 const char *pem;
 502
 503 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
 504   return FALSE;
 505
 506 if (!dhexpanded || !*dhexpanded)
 507   bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
 508 else if (dhexpanded[0] == '/')
 509   {
 510   if (!(bio = BIO_new_file(CS dhexpanded, "r")))
 511     {
 512     tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
 513           host, US strerror(errno));
 514     return FALSE;
 515     }
 516   }
 517 else
 518   {
 519   if (Ustrcmp(dhexpanded, "none") == 0)
 520     {
 521     DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
 522     return TRUE;
 523     }
 524
 525   if (!(pem = std_dh_prime_named(dhexpanded)))
 526     {
 527     tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
 528         host, US strerror(errno));
 529     return FALSE;
 530     }
 531   bio = BIO_new_mem_buf(CS pem, -1);
 532   }
 533
 534 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
 535   {
 536   BIO_free(bio);
 537   tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
 538       host, NULL);
 539   return FALSE;
 540   }
 541
 542 /* Even if it is larger, we silently return success rather than cause things
 543  * to fail out, so that a too-large DH will not knock out all TLS; it's a
 544  * debatable choice. */
 545 if ((8*DH_size(dh)) > tls_dh_max_bits)
 546   {
 547   DEBUG(D_tls)
 548     debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
 549         8*DH_size(dh), tls_dh_max_bits);
 550   }
 551 else
 552   {
 553   SSL_CTX_set_tmp_dh(sctx, dh);
 554   DEBUG(D_tls)
 555     debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
 556       dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
 557   }
 558
 559 DH_free(dh);
 560 BIO_free(bio);
 561
 562 return TRUE;
 563 }
 564
 565
 566
 567
 568 #ifndef DISABLE_OCSP
 569 /*************************************************
 570 *       Load OCSP information into state         *
 571 *************************************************/
 572
 573 /* Called to load the server OCSP response from the given file into memory, once
 574 caller has determined this is needed.  Checks validity.  Debugs a message
 575 if invalid.
 576
 577 ASSUMES: single response, for single cert.
 578
 579 Arguments:
 580   sctx            the SSL_CTX* to update
 581   cbinfo          various parts of session state
 582   expanded        the filename putatively holding an OCSP response
 583
 584 */
 585
 586 static void
 587 ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
 588 {
 589 BIO *bio;
 590 OCSP_RESPONSE *resp;
 591 OCSP_BASICRESP *basic_response;
 592 OCSP_SINGLERESP *single_response;
 593 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
 594 X509_STORE *store;
 595 unsigned long verify_flags;
 596 int status, reason, i;
 597
 598 cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
 599 if (cbinfo->u_ocsp.server.response)
 600   {
 601   OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
 602   cbinfo->u_ocsp.server.response = NULL;
 603   }
 604
 605 bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
 606 if (!bio)
 607   {
 608   DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
 609       cbinfo->u_ocsp.server.file_expanded);
 610   return;
 611   }
 612
 613 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
 614 BIO_free(bio);
 615 if (!resp)
 616   {
 617   DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
 618   return;
 619   }
 620
 621 status = OCSP_response_status(resp);
 622 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
 623   {
 624   DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
 625       OCSP_response_status_str(status), status);
 626   goto bad;
 627   }
 628
 629 basic_response = OCSP_response_get1_basic(resp);
 630 if (!basic_response)
 631   {
 632   DEBUG(D_tls)
 633     debug_printf("OCSP response parse error: unable to extract basic response.\n");
 634   goto bad;
 635   }
 636
 637 store = SSL_CTX_get_cert_store(sctx);
 638 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
 639
 640 /* May need to expose ability to adjust those flags?
 641 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
 642 OCSP_TRUSTOTHER OCSP_NOINTERN */
 643
 644 i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
 645 if (i <= 0)
 646   {
 647   DEBUG(D_tls) {
 648     ERR_error_string(ERR_get_error(), ssl_errstring);
 649     debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
 650     }
 651   goto bad;
 652   }
 653
 654 /* Here's the simplifying assumption: there's only one response, for the
 655 one certificate we use, and nothing for anything else in a chain.  If this
 656 proves false, we need to extract a cert id from our issued cert
 657 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
 658 right cert in the stack and then calls OCSP_single_get0_status()).
 659
 660 I'm hoping to avoid reworking a bunch more of how we handle state here. */
 661 single_response = OCSP_resp_get0(basic_response, 0);
 662 if (!single_response)
 663   {
 664   DEBUG(D_tls)
 665     debug_printf("Unable to get first response from OCSP basic response.\n");
 666   goto bad;
 667   }
 668
 669 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
 670 if (status != V_OCSP_CERTSTATUS_GOOD)
 671   {
 672   DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
 673       OCSP_cert_status_str(status), status,
 674       OCSP_crl_reason_str(reason), reason);
 675   goto bad;
 676   }
 677
 678 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
 679   {
 680   DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
 681   goto bad;
 682   }
 683
 684 supply_response:
 685   cbinfo->u_ocsp.server.response = resp;
 686 return;
 687
 688 bad:
 689   if (running_in_test_harness)
 690     {
 691     extern char ** environ;
 692     uschar ** p;
 693     for (p = USS environ; *p != NULL; p++)
 694       if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
 695         {
 696         DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
 697         goto supply_response;
 698         }
 699     }
 700 return;
 701 }
 702 #endif  /*!DISABLE_OCSP*/
 703
 704
 705
 706
 707 /*************************************************
 708 *        Expand key and cert file specs          *
 709 *************************************************/
 710
 711 /* Called once during tls_init and possibly again during TLS setup, for a
 712 new context, if Server Name Indication was used and tls_sni was seen in
 713 the certificate string.
 714
 715 Arguments:
 716   sctx            the SSL_CTX* to update
 717   cbinfo          various parts of session state
 718
 719 Returns:          OK/DEFER/FAIL
 720 */
 721
 722 static int
 723 tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
 724 {
 725 uschar *expanded;
 726
 727 if (cbinfo->certificate == NULL)
 728   return OK;
 729
 730 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
 731     Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
 732     Ustrstr(cbinfo->certificate, US"tls_out_sni")
 733    )
 734   reexpand_tls_files_for_sni = TRUE;
 735
 736 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
 737   return DEFER;
 738
 739 if (expanded != NULL)
 740   {
 741   DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
 742   if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
 743     return tls_error(string_sprintf(
 744       "SSL_CTX_use_certificate_chain_file file=%s", expanded),
 745         cbinfo->host, NULL);
 746   }
 747
 748 if (cbinfo->privatekey != NULL &&
 749     !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
 750   return DEFER;
 751
 752 /* If expansion was forced to fail, key_expanded will be NULL. If the result
 753 of the expansion is an empty string, ignore it also, and assume the private
 754 key is in the same file as the certificate. */
 755
 756 if (expanded != NULL && *expanded != 0)
 757   {
 758   DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
 759   if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
 760     return tls_error(string_sprintf(
 761       "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
 762   }
 763
 764 #ifndef DISABLE_OCSP
 765 if (cbinfo->is_server &&  cbinfo->u_ocsp.server.file != NULL)
 766   {
 767   if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
 768     return DEFER;
 769
 770   if (expanded != NULL && *expanded != 0)
 771     {
 772     DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
 773     if (cbinfo->u_ocsp.server.file_expanded &&
 774         (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
 775       {
 776       DEBUG(D_tls)
 777         debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
 778       } else {
 779         ocsp_load_response(sctx, cbinfo, expanded);
 780       }
 781     }
 782   }
 783 #endif
 784
 785 return OK;
 786 }
 787
 788
 789
 790
 791 /*************************************************
 792 *            Callback to handle SNI              *
 793 *************************************************/
 794
 795 /* Called when acting as server during the TLS session setup if a Server Name
 796 Indication extension was sent by the client.
 797
 798 API documentation is OpenSSL s_server.c implementation.
 799
 800 Arguments:
 801   s               SSL* of the current session
 802   ad              unknown (part of OpenSSL API) (unused)
 803   arg             Callback of "our" registered data
 804
 805 Returns:          SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
 806 */
 807
 808 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
 809 static int
 810 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
 811 {
 812 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
 813 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
 814 int rc;
 815 int old_pool = store_pool;
 816
 817 if (!servername)
 818   return SSL_TLSEXT_ERR_OK;
 819
 820 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
 821     reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
 822
 823 /* Make the extension value available for expansion */
 824 store_pool = POOL_PERM;
 825 tls_in.sni = string_copy(US servername);
 826 store_pool = old_pool;
 827
 828 if (!reexpand_tls_files_for_sni)
 829   return SSL_TLSEXT_ERR_OK;
 830
 831 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
 832 not confident that memcpy wouldn't break some internal reference counting.
 833 Especially since there's a references struct member, which would be off. */
 834
 835 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
 836   {
 837   ERR_error_string(ERR_get_error(), ssl_errstring);
 838   DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
 839   return SSL_TLSEXT_ERR_NOACK;
 840   }
 841
 842 /* Not sure how many of these are actually needed, since SSL object
 843 already exists.  Might even need this selfsame callback, for reneg? */
 844
 845 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
 846 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
 847 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
 848 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
 849 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
 850 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
 851 if (cbinfo->server_cipher_list)
 852   SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
 853 #ifndef DISABLE_OCSP
 854 if (cbinfo->u_ocsp.server.file)
 855   {
 856   SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
 857   SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
 858   }
 859 #endif
 860
 861 rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
 862 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
 863
 864 /* do this after setup_certs, because this can require the certs for verifying
 865 OCSP information. */
 866 rc = tls_expand_session_files(server_sni, cbinfo);
 867 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
 868
 869 if (!init_dh(server_sni, cbinfo->dhparam, NULL))
 870   return SSL_TLSEXT_ERR_NOACK;
 871
 872 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
 873 SSL_set_SSL_CTX(s, server_sni);
 874
 875 return SSL_TLSEXT_ERR_OK;
 876 }
 877 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
 878
 879
 880
 881
 882 #ifndef DISABLE_OCSP
 883
 884 /*************************************************
 885 *        Callback to handle OCSP Stapling        *
 886 *************************************************/
 887
 888 /* Called when acting as server during the TLS session setup if the client
 889 requests OCSP information with a Certificate Status Request.
 890
 891 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
 892 project.
 893
 894 */
 895
 896 static int
 897 tls_server_stapling_cb(SSL *s, void *arg)
 898 {
 899 const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
 900 uschar *response_der;
 901 int response_der_len;
 902
 903 DEBUG(D_tls)
 904   debug_printf("Received TLS status request (OCSP stapling); %s response.",
 905     cbinfo->u_ocsp.server.response ? "have" : "lack");
 906
 907 tls_in.ocsp = OCSP_NOT_RESP;
 908 if (!cbinfo->u_ocsp.server.response)
 909   return SSL_TLSEXT_ERR_NOACK;
 910
 911 response_der = NULL;
 912 response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
 913                       &response_der);
 914 if (response_der_len <= 0)
 915   return SSL_TLSEXT_ERR_NOACK;
 916
 917 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
 918 tls_in.ocsp = OCSP_VFIED;
 919 return SSL_TLSEXT_ERR_OK;
 920 }
 921
 922
 923 static void
 924 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
 925 {
 926 BIO_printf(bp, "\t%s: ", str);
 927 ASN1_GENERALIZEDTIME_print(bp, time);
 928 BIO_puts(bp, "\n");
 929 }
 930
 931 static int
 932 tls_client_stapling_cb(SSL *s, void *arg)
 933 {
 934 tls_ext_ctx_cb * cbinfo = arg;
 935 const unsigned char * p;
 936 int len;
 937 OCSP_RESPONSE * rsp;
 938 OCSP_BASICRESP * bs;
 939 int i;
 940
 941 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
 942 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
 943 if(!p)
 944  {
 945   /* Expect this when we requested ocsp but got none */
 946   if (  cbinfo->u_ocsp.client.verify_required
 947      && log_extra_selector & LX_tls_cipher)
 948     log_write(0, LOG_MAIN, "Received TLS status callback, null content");
 949   else
 950     DEBUG(D_tls) debug_printf(" null\n");
 951   return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
 952  }
 953
 954 if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
 955  {
 956   tls_out.ocsp = OCSP_FAILED;
 957   if (log_extra_selector & LX_tls_cipher)
 958     log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
 959   else
 960     DEBUG(D_tls) debug_printf(" parse error\n");
 961   return 0;
 962  }
 963
 964 if(!(bs = OCSP_response_get1_basic(rsp)))
 965   {
 966   tls_out.ocsp = OCSP_FAILED;
 967   if (log_extra_selector & LX_tls_cipher)
 968     log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
 969   else
 970     DEBUG(D_tls) debug_printf(" error parsing response\n");
 971   OCSP_RESPONSE_free(rsp);
 972   return 0;
 973   }
 974
 975 /* We'd check the nonce here if we'd put one in the request. */
 976 /* However that would defeat cacheability on the server so we don't. */
 977
 978 /* This section of code reworked from OpenSSL apps source;
 979    The OpenSSL Project retains copyright:
 980    Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
 981 */
 982   {
 983     BIO * bp = NULL;
 984     int status, reason;
 985     ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
 986
 987     DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
 988
 989     /*OCSP_RESPONSE_print(bp, rsp, 0);   extreme debug: stapling content */
 990
 991     /* Use the chain that verified the server cert to verify the stapled info */
 992     /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
 993
 994     if ((i = OCSP_basic_verify(bs, NULL,
 995               cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
 996       {
 997       tls_out.ocsp = OCSP_FAILED;
 998       if (log_extra_selector & LX_tls_cipher)
 999         log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
1000       BIO_printf(bp, "OCSP response verify failure\n");
1001       ERR_print_errors(bp);
1002       i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1003       goto out;
1004       }
1005
1006     BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1007
1008       {
1009       STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1010       OCSP_SINGLERESP * single;
1011
1012       if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1013         {
1014         tls_out.ocsp = OCSP_FAILED;
1015         log_write(0, LOG_MAIN, "OCSP stapling "
1016             "with multiple responses not handled");
1017         i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1018         goto out;
1019         }
1020       single = OCSP_resp_get0(bs, 0);
1021       status = OCSP_single_get0_status(single, &reason, &rev,
1022                   &thisupd, &nextupd);
1023       }
1024
1025     DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1026     DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1027     if (!OCSP_check_validity(thisupd, nextupd,
1028           EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1029       {
1030       tls_out.ocsp = OCSP_FAILED;
1031       DEBUG(D_tls) ERR_print_errors(bp);
1032       log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1033       i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1034       }
1035     else
1036       {
1037       DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1038                     OCSP_cert_status_str(status));
1039       switch(status)
1040         {
1041         case V_OCSP_CERTSTATUS_GOOD:
1042           tls_out.ocsp = OCSP_VFIED;
1043           i = 1;
1044           break;
1045         case V_OCSP_CERTSTATUS_REVOKED:
1046           tls_out.ocsp = OCSP_FAILED;
1047           log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1048               reason != -1 ? "; reason: " : "",
1049               reason != -1 ? OCSP_crl_reason_str(reason) : "");
1050           DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1051           i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1052           break;
1053         default:
1054           tls_out.ocsp = OCSP_FAILED;
1055           log_write(0, LOG_MAIN,
1056               "Server certificate status unknown, in OCSP stapling");
1057           i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1058           break;
1059         }
1060       }
1061   out:
1062     BIO_free(bp);
1063   }
1064
1065 OCSP_RESPONSE_free(rsp);
1066 return i;
1067 }
1068 #endif  /*!DISABLE_OCSP*/
1069
1070
1071 /*************************************************
1072 *            Initialize for TLS                  *
1073 *************************************************/
1074
1075 /* Called from both server and client code, to do preliminary initialization
1076 of the library.  We allocate and return a context structure.
1077
1078 Arguments:
1079   ctxp            returned SSL context
1080   host            connected host, if client; NULL if server
1081   dhparam         DH parameter file
1082   certificate     certificate file
1083   privatekey      private key
1084   ocsp_file       file of stapling info (server); flag for require ocsp (client)
1085   addr            address if client; NULL if server (for some randomness)
1086   cbp             place to put allocated callback context
1087
1088 Returns:          OK/DEFER/FAIL
1089 */
1090
1091 static int
1092 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
1093   uschar *privatekey,
1094 #ifndef DISABLE_OCSP
1095   uschar *ocsp_file,
1096 #endif
1097   address_item *addr, tls_ext_ctx_cb ** cbp)
1098 {
1099 long init_options;
1100 int rc;
1101 BOOL okay;
1102 tls_ext_ctx_cb * cbinfo;
1103
1104 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1105 cbinfo->certificate = certificate;
1106 cbinfo->privatekey = privatekey;
1107 #ifndef DISABLE_OCSP
1108 if ((cbinfo->is_server = host==NULL))
1109   {
1110   cbinfo->u_ocsp.server.file = ocsp_file;
1111   cbinfo->u_ocsp.server.file_expanded = NULL;
1112   cbinfo->u_ocsp.server.response = NULL;
1113   }
1114 else
1115   cbinfo->u_ocsp.client.verify_store = NULL;
1116 #endif
1117 cbinfo->dhparam = dhparam;
1118 cbinfo->server_cipher_list = NULL;
1119 cbinfo->host = host;
1120 #ifdef EXPERIMENTAL_TPDA
1121 cbinfo->event_action = NULL;
1122 #endif
1123
1124 SSL_load_error_strings();          /* basic set up */
1125 OpenSSL_add_ssl_algorithms();
1126
1127 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
1128 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1129 list of available digests. */
1130 EVP_add_digest(EVP_sha256());
1131 #endif
1132
1133 /* Create a context.
1134 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1135 negotiation in the different methods; as far as I can tell, the only
1136 *_{server,client}_method which allows negotiation is SSLv23, which exists even
1137 when OpenSSL is built without SSLv2 support.
1138 By disabling with openssl_options, we can let admins re-enable with the
1139 existing knob. */
1140
1141 *ctxp = SSL_CTX_new((host == NULL)?
1142   SSLv23_server_method() : SSLv23_client_method());
1143
1144 if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
1145
1146 /* It turns out that we need to seed the random number generator this early in
1147 order to get the full complement of ciphers to work. It took me roughly a day
1148 of work to discover this by experiment.
1149
1150 On systems that have /dev/urandom, SSL may automatically seed itself from
1151 there. Otherwise, we have to make something up as best we can. Double check
1152 afterwards. */
1153
1154 if (!RAND_status())
1155   {
1156   randstuff r;
1157   gettimeofday(&r.tv, NULL);
1158   r.p = getpid();
1159
1160   RAND_seed((uschar *)(&r), sizeof(r));
1161   RAND_seed((uschar *)big_buffer, big_buffer_size);
1162   if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1163
1164   if (!RAND_status())
1165     return tls_error(US"RAND_status", host,
1166       US"unable to seed random number generator");
1167   }
1168
1169 /* Set up the information callback, which outputs if debugging is at a suitable
1170 level. */
1171
1172 SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
1173
1174 /* Automatically re-try reads/writes after renegotiation. */
1175 (void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
1176
1177 /* Apply administrator-supplied work-arounds.
1178 Historically we applied just one requested option,
1179 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1180 moved to an administrator-controlled list of options to specify and
1181 grandfathered in the first one as the default value for "openssl_options".
1182
1183 No OpenSSL version number checks: the options we accept depend upon the
1184 availability of the option value macros from OpenSSL.  */
1185
1186 okay = tls_openssl_options_parse(openssl_options, &init_options);
1187 if (!okay)
1188   return tls_error(US"openssl_options parsing failed", host, NULL);
1189
1190 if (init_options)
1191   {
1192   DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
1193   if (!(SSL_CTX_set_options(*ctxp, init_options)))
1194     return tls_error(string_sprintf(
1195           "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1196   }
1197 else
1198   DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
1199
1200 /* Initialize with DH parameters if supplied */
1201
1202 if (!init_dh(*ctxp, dhparam, host)) return DEFER;
1203
1204 /* Set up certificate and key (and perhaps OCSP info) */
1205
1206 rc = tls_expand_session_files(*ctxp, cbinfo);
1207 if (rc != OK) return rc;
1208
1209 /* If we need to handle SNI, do so */
1210 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1211 if (host == NULL)               /* server */
1212   {
1213 # ifndef DISABLE_OCSP
1214   /* We check u_ocsp.server.file, not server.response, because we care about if
1215   the option exists, not what the current expansion might be, as SNI might
1216   change the certificate and OCSP file in use between now and the time the
1217   callback is invoked. */
1218   if (cbinfo->u_ocsp.server.file)
1219     {
1220     SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
1221     SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
1222     }
1223 # endif
1224   /* We always do this, so that $tls_sni is available even if not used in
1225   tls_certificate */
1226   SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1227   SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
1228   }
1229 # ifndef DISABLE_OCSP
1230 else                    /* client */
1231   if(ocsp_file)         /* wanting stapling */
1232     {
1233     if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1234       {
1235       DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1236       return FAIL;
1237       }
1238     SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1239     SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1240     }
1241 # endif
1242 #endif
1243
1244 #ifdef EXPERIMENTAL_CERTNAMES
1245 cbinfo->verify_cert_hostnames = NULL;
1246 #endif
1247
1248 /* Set up the RSA callback */
1249
1250 SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
1251
1252 /* Finally, set the timeout, and we are done */
1253
1254 SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
1255 DEBUG(D_tls) debug_printf("Initialized TLS\n");
1256
1257 *cbp = cbinfo;
1258
1259 return OK;
1260 }
1261
1262
1263
1264
1265 /*************************************************
1266 *           Get name of cipher in use            *
1267 *************************************************/
1268
1269 /*
1270 Argument:   pointer to an SSL structure for the connection
1271             buffer to use for answer
1272             size of buffer
1273             pointer to number of bits for cipher
1274 Returns:    nothing
1275 */
1276
1277 static void
1278 construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
1279 {
1280 /* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1281 yet reflect that.  It should be a safe change anyway, even 0.9.8 versions have
1282 the accessor functions use const in the prototype. */
1283 const SSL_CIPHER *c;
1284 const uschar *ver;
1285
1286 ver = (const uschar *)SSL_get_version(ssl);
1287
1288 c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
1289 SSL_CIPHER_get_bits(c, bits);
1290
1291 string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1292   SSL_CIPHER_get_name(c), *bits);
1293
1294 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1295 }
1296
1297
1298
1299
1300
1301 /*************************************************
1302 *        Set up for verifying certificates       *
1303 *************************************************/
1304
1305 /* Called by both client and server startup
1306
1307 Arguments:
1308   sctx          SSL_CTX* to initialise
1309   certs         certs file or NULL
1310   crl           CRL file or NULL
1311   host          NULL in a server; the remote host in a client
1312   optional      TRUE if called from a server for a host in tls_try_verify_hosts;
1313                 otherwise passed as FALSE
1314   cert_vfy_cb   Callback function for certificate verification
1315
1316 Returns:        OK/DEFER/FAIL
1317 */
1318
1319 static int
1320 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1321     int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
1322 {
1323 uschar *expcerts, *expcrl;
1324
1325 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1326   return DEFER;
1327
1328 if (expcerts != NULL && *expcerts != '\0')
1329   {
1330   struct stat statbuf;
1331   if (!SSL_CTX_set_default_verify_paths(sctx))
1332     return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1333
1334   if (Ustat(expcerts, &statbuf) < 0)
1335     {
1336     log_write(0, LOG_MAIN|LOG_PANIC,
1337       "failed to stat %s for certificates", expcerts);
1338     return DEFER;
1339     }
1340   else
1341     {
1342     uschar *file, *dir;
1343     if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1344       { file = NULL; dir = expcerts; }
1345     else
1346       { file = expcerts; dir = NULL; }
1347
1348     /* If a certificate file is empty, the next function fails with an
1349     unhelpful error message. If we skip it, we get the correct behaviour (no
1350     certificates are recognized, but the error message is still misleading (it
1351     says no certificate was supplied.) But this is better. */
1352
1353     if ((file == NULL || statbuf.st_size > 0) &&
1354           !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1355       return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1356
1357     if (file != NULL)
1358       {
1359       SSL_CTX_set_client_CA_list(sctx, SSL_load_client_CA_file(CS file));
1360       }
1361     }
1362
1363   /* Handle a certificate revocation list. */
1364
1365   #if OPENSSL_VERSION_NUMBER > 0x00907000L
1366
1367   /* This bit of code is now the version supplied by Lars Mainka. (I have
1368    * merely reformatted it into the Exim code style.)
1369
1370    * "From here I changed the code to add support for multiple crl's
1371    * in pem format in one file or to support hashed directory entries in
1372    * pem format instead of a file. This method now uses the library function
1373    * X509_STORE_load_locations to add the CRL location to the SSL context.
1374    * OpenSSL will then handle the verify against CA certs and CRLs by
1375    * itself in the verify callback." */
1376
1377   if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1378   if (expcrl != NULL && *expcrl != 0)
1379     {
1380     struct stat statbufcrl;
1381     if (Ustat(expcrl, &statbufcrl) < 0)
1382       {
1383       log_write(0, LOG_MAIN|LOG_PANIC,
1384         "failed to stat %s for certificates revocation lists", expcrl);
1385       return DEFER;
1386       }
1387     else
1388       {
1389       /* is it a file or directory? */
1390       uschar *file, *dir;
1391       X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
1392       if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
1393         {
1394         file = NULL;
1395         dir = expcrl;
1396         DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
1397         }
1398       else
1399         {
1400         file = expcrl;
1401         dir = NULL;
1402         DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
1403         }
1404       if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
1405         return tls_error(US"X509_STORE_load_locations", host, NULL);
1406
1407       /* setting the flags to check against the complete crl chain */
1408
1409       X509_STORE_set_flags(cvstore,
1410         X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
1411       }
1412     }
1413
1414   #endif  /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1415
1416   /* If verification is optional, don't fail if no certificate */
1417
1418   SSL_CTX_set_verify(sctx,
1419     SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
1420     cert_vfy_cb);
1421   }
1422
1423 return OK;
1424 }
1425
1426
1427
1428 /*************************************************
1429 *       Start a TLS session in a server          *
1430 *************************************************/
1431
1432 /* This is called when Exim is running as a server, after having received
1433 the STARTTLS command. It must respond to that command, and then negotiate
1434 a TLS session.
1435
1436 Arguments:
1437   require_ciphers   allowed ciphers
1438
1439 Returns:            OK on success
1440                     DEFER for errors before the start of the negotiation
1441                     FAIL for errors during the negotation; the server can't
1442                       continue running.
1443 */
1444
1445 int
1446 tls_server_start(const uschar *require_ciphers)
1447 {
1448 int rc;
1449 uschar *expciphers;
1450 tls_ext_ctx_cb *cbinfo;
1451 static uschar cipherbuf[256];
1452
1453 /* Check for previous activation */
1454
1455 if (tls_in.active >= 0)
1456   {
1457   tls_error(US"STARTTLS received after TLS started", NULL, US"");
1458   smtp_printf("554 Already in TLS\r\n");
1459   return FAIL;
1460   }
1461
1462 /* Initialize the SSL library. If it fails, it will already have logged
1463 the error. */
1464
1465 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
1466 #ifndef DISABLE_OCSP
1467     tls_ocsp_file,
1468 #endif
1469     NULL, &server_static_cbinfo);
1470 if (rc != OK) return rc;
1471 cbinfo = server_static_cbinfo;
1472
1473 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1474   return FAIL;
1475
1476 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1477 were historically separated by underscores. So that I can use either form in my
1478 tests, and also for general convenience, we turn underscores into hyphens here.
1479 */
1480
1481 if (expciphers != NULL)
1482   {
1483   uschar *s = expciphers;
1484   while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1485   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1486   if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
1487     return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
1488   cbinfo->server_cipher_list = expciphers;
1489   }
1490
1491 /* If this is a host for which certificate verification is mandatory or
1492 optional, set up appropriately. */
1493
1494 tls_in.certificate_verified = FALSE;
1495 #ifdef EXPERIMENTAL_DANE
1496 tls_in.dane_verified = FALSE;
1497 #endif
1498 server_verify_callback_called = FALSE;
1499
1500 if (verify_check_host(&tls_verify_hosts) == OK)
1501   {
1502   rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1503                         FALSE, verify_callback_server);
1504   if (rc != OK) return rc;
1505   server_verify_optional = FALSE;
1506   }
1507 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1508   {
1509   rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1510                         TRUE, verify_callback_server);
1511   if (rc != OK) return rc;
1512   server_verify_optional = TRUE;
1513   }
1514
1515 /* Prepare for new connection */
1516
1517 if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
1518
1519 /* Warning: we used to SSL_clear(ssl) here, it was removed.
1520  *
1521  * With the SSL_clear(), we get strange interoperability bugs with
1522  * OpenSSL 1.0.1b and TLS1.1/1.2.  It looks as though this may be a bug in
1523  * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1524  *
1525  * The SSL_clear() call is to let an existing SSL* be reused, typically after
1526  * session shutdown.  In this case, we have a brand new object and there's no
1527  * obvious reason to immediately clear it.  I'm guessing that this was
1528  * originally added because of incomplete initialisation which the clear fixed,
1529  * in some historic release.
1530  */
1531
1532 /* Set context and tell client to go ahead, except in the case of TLS startup
1533 on connection, where outputting anything now upsets the clients and tends to
1534 make them disconnect. We need to have an explicit fflush() here, to force out
1535 the response. Other smtp_printf() calls do not need it, because in non-TLS
1536 mode, the fflush() happens when smtp_getc() is called. */
1537
1538 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1539 if (!tls_in.on_connect)
1540   {
1541   smtp_printf("220 TLS go ahead\r\n");
1542   fflush(smtp_out);
1543   }
1544
1545 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1546 that the OpenSSL library doesn't. */
1547
1548 SSL_set_wfd(server_ssl, fileno(smtp_out));
1549 SSL_set_rfd(server_ssl, fileno(smtp_in));
1550 SSL_set_accept_state(server_ssl);
1551
1552 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1553
1554 sigalrm_seen = FALSE;
1555 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1556 rc = SSL_accept(server_ssl);
1557 alarm(0);
1558
1559 if (rc <= 0)
1560   {
1561   tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
1562   if (ERR_get_error() == 0)
1563     log_write(0, LOG_MAIN,
1564         "TLS client disconnected cleanly (rejected our certificate?)");
1565   return FAIL;
1566   }
1567
1568 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1569
1570 /* TLS has been set up. Adjust the input functions to read via TLS,
1571 and initialize things. */
1572
1573 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1574 tls_in.cipher = cipherbuf;
1575
1576 DEBUG(D_tls)
1577   {
1578   uschar buf[2048];
1579   if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
1580     debug_printf("Shared ciphers: %s\n", buf);
1581   }
1582
1583 /* Record the certificate we presented */
1584   {
1585   X509 * crt = SSL_get_certificate(server_ssl);
1586   tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1587   }
1588
1589 /* Only used by the server-side tls (tls_in), including tls_getc.
1590    Client-side (tls_out) reads (seem to?) go via
1591    smtp_read_response()/ip_recv().
1592    Hence no need to duplicate for _in and _out.
1593  */
1594 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1595 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1596 ssl_xfer_eof = ssl_xfer_error = 0;
1597
1598 receive_getc = tls_getc;
1599 receive_ungetc = tls_ungetc;
1600 receive_feof = tls_feof;
1601 receive_ferror = tls_ferror;
1602 receive_smtp_buffered = tls_smtp_buffered;
1603
1604 tls_in.active = fileno(smtp_out);
1605 return OK;
1606 }
1607
1608
1609
1610
1611 static int
1612 tls_client_basic_ctx_init(SSL_CTX * ctx,
1613     host_item * host, smtp_transport_options_block * ob
1614 #ifdef EXPERIMENTAL_CERTNAMES
1615     , tls_ext_ctx_cb * cbinfo
1616 #endif
1617                           )
1618 {
1619 int rc;
1620 /* stick to the old behaviour for compatibility if tls_verify_certificates is
1621    set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1622    the specified host patterns if one of them is defined */
1623
1624 if ((!ob->tls_verify_hosts && !ob->tls_try_verify_hosts) ||
1625     (verify_check_host(&ob->tls_verify_hosts) == OK))
1626   {
1627   if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1628         ob->tls_crl, host, FALSE, verify_callback_client)) != OK)
1629     return rc;
1630   client_verify_optional = FALSE;
1631
1632 #ifdef EXPERIMENTAL_CERTNAMES
1633   if (ob->tls_verify_cert_hostnames)
1634     {
1635     if (!expand_check(ob->tls_verify_cert_hostnames,
1636                       US"tls_verify_cert_hostnames",
1637                       &cbinfo->verify_cert_hostnames))
1638       return FAIL;
1639     if (cbinfo->verify_cert_hostnames)
1640       DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1641                       cbinfo->verify_cert_hostnames);
1642     }
1643 #endif
1644   }
1645 else if (verify_check_host(&ob->tls_try_verify_hosts) == OK)
1646   {
1647   if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1648         ob->tls_crl, host, TRUE, verify_callback_client)) != OK)
1649     return rc;
1650   client_verify_optional = TRUE;
1651   }
1652
1653 return OK;
1654 }
1655
1656
1657 #ifdef EXPERIMENTAL_DANE
1658 static int
1659 tlsa_lookup(host_item * host, dns_answer * dnsa,
1660   BOOL dane_required, BOOL * dane)
1661 {
1662 /* move this out to host.c given the similarity to dns_lookup() ? */
1663 uschar buffer[300];
1664 uschar * fullname = buffer;
1665
1666 /* TLSA lookup string */
1667 (void)sprintf(CS buffer, "_%d._tcp.%.256s", host->port, host->name);
1668
1669 switch (dns_lookup(dnsa, buffer, T_TLSA, &fullname))
1670   {
1671   case DNS_AGAIN:
1672     return DEFER; /* just defer this TLS'd conn */
1673
1674   default:
1675   case DNS_FAIL:
1676     if (dane_required)
1677       {
1678       log_write(0, LOG_MAIN, "DANE error: TLSA lookup failed");
1679       return FAIL;
1680       }
1681     break;
1682
1683   case DNS_SUCCEED:
1684     if (!dns_is_secure(dnsa))
1685       {
1686       log_write(0, LOG_MAIN, "DANE error: TLSA lookup not DNSSEC");
1687       return DEFER;
1688       }
1689     *dane = TRUE;
1690     break;
1691   }
1692 return OK;
1693 }
1694
1695
1696 static int
1697 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
1698 {
1699 dns_record * rr;
1700 dns_scan dnss;
1701 const char * hostnames[2] = { CS host->name, NULL };
1702 int found = 0;
1703
1704 if (DANESSL_init(ssl, NULL, hostnames) != 1)
1705   return tls_error(US"hostnames load", host, NULL);
1706
1707 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1708      rr;
1709      rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1710     ) if (rr->type == T_TLSA)
1711   {
1712   uschar * p = rr->data;
1713   uint8_t usage, selector, mtype;
1714   const char * mdname;
1715
1716   found++;
1717   usage = *p++;
1718   selector = *p++;
1719   mtype = *p++;
1720
1721   switch (mtype)
1722     {
1723     default:
1724       log_write(0, LOG_MAIN,
1725                 "DANE error: TLSA record w/bad mtype 0x%x", mtype);
1726       return FAIL;
1727     case 0:     mdname = NULL; break;
1728     case 1:     mdname = "sha256"; break;
1729     case 2:     mdname = "sha512"; break;
1730     }
1731
1732   switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
1733     {
1734     default:
1735     case 0:     /* action not taken */
1736       return tls_error(US"tlsa load", host, NULL);
1737     case 1:     break;
1738     }
1739
1740   tls_out.tlsa_usage |= 1<<usage;
1741   }
1742
1743 if (found)
1744   return OK;
1745
1746 log_write(0, LOG_MAIN, "DANE error: No TLSA records");
1747 return FAIL;
1748 }
1749 #endif  /*EXPERIMENTAL_DANE*/
1750
1751
1752
1753 /*************************************************
1754 *    Start a TLS session in a client             *
1755 *************************************************/
1756
1757 /* Called from the smtp transport after STARTTLS has been accepted.
1758
1759 Argument:
1760   fd               the fd of the connection
1761   host             connected host (for messages)
1762   addr             the first address
1763   tb               transport (always smtp)
1764
1765 Returns:           OK on success
1766                    FAIL otherwise - note that tls_error() will not give DEFER
1767                      because this is not a server
1768 */
1769
1770 int
1771 tls_client_start(int fd, host_item *host, address_item *addr,
1772   transport_instance *tb)
1773 {
1774 smtp_transport_options_block * ob =
1775   (smtp_transport_options_block *)tb->options_block;
1776 static uschar txt[256];
1777 uschar * expciphers;
1778 X509 * server_cert;
1779 int rc;
1780 static uschar cipherbuf[256];
1781
1782 #ifndef DISABLE_OCSP
1783 BOOL request_ocsp = FALSE;
1784 BOOL require_ocsp = FALSE;
1785 #endif
1786 #ifdef EXPERIMENTAL_DANE
1787 dns_answer tlsa_dnsa;
1788 BOOL dane = FALSE;
1789 BOOL dane_required;
1790 #endif
1791
1792 #ifdef EXPERIMENTAL_DANE
1793 tls_out.dane_verified = FALSE;
1794 tls_out.tlsa_usage = 0;
1795 dane_required = verify_check_this_host(&ob->hosts_require_dane, NULL,
1796                           host->name, host->address, NULL) == OK;
1797
1798 if (host->dnssec == DS_YES)
1799   {
1800   if(  dane_required
1801     || verify_check_this_host(&ob->hosts_try_dane, NULL,
1802                           host->name, host->address, NULL) == OK
1803     )
1804     if ((rc = tlsa_lookup(host, &tlsa_dnsa, dane_required, &dane)) != OK)
1805       return rc;
1806   }
1807 else if (dane_required)
1808   {
1809   /*XXX a shame we only find this after making tcp & smtp connection */
1810   /* move the test earlier? */
1811   log_write(0, LOG_MAIN, "DANE error: previous lookup not DNSSEC");
1812   return FAIL;
1813   }
1814 #endif
1815
1816 #ifndef DISABLE_OCSP
1817   {
1818   if ((require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1819     NULL, host->name, host->address, NULL) == OK))
1820     request_ocsp = TRUE;
1821   else
1822     {
1823 # ifdef EXPERIMENTAL_DANE
1824     if (  dane
1825        && ob->hosts_request_ocsp[0] == '*'
1826        && ob->hosts_request_ocsp[1] == '\0'
1827        )
1828       {
1829       /* Unchanged from default.  Use a safer one under DANE */
1830       request_ocsp = TRUE;
1831       ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
1832                                         "   {= {4}{$tls_out_tlsa_usage}} } "
1833                                    " {*}{}}";
1834       }
1835     else
1836 # endif
1837       request_ocsp = verify_check_this_host(&ob->hosts_request_ocsp,
1838           NULL, host->name, host->address, NULL) == OK;
1839     }
1840   }
1841 #endif
1842
1843 rc = tls_init(&client_ctx, host, NULL,
1844     ob->tls_certificate, ob->tls_privatekey,
1845 #ifndef DISABLE_OCSP
1846     (void *)(long)request_ocsp,
1847 #endif
1848     addr, &client_static_cbinfo);
1849 if (rc != OK) return rc;
1850
1851 tls_out.certificate_verified = FALSE;
1852 client_verify_callback_called = FALSE;
1853
1854 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
1855     &expciphers))
1856   return FAIL;
1857
1858 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1859 are separated by underscores. So that I can use either form in my tests, and
1860 also for general convenience, we turn underscores into hyphens here. */
1861
1862 if (expciphers != NULL)
1863   {
1864   uschar *s = expciphers;
1865   while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1866   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1867   if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
1868     return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
1869   }
1870
1871 #ifdef EXPERIMENTAL_DANE
1872 if (dane)
1873   {
1874   SSL_CTX_set_verify(client_ctx, SSL_VERIFY_PEER, verify_callback_client_dane);
1875
1876   if (!DANESSL_library_init())
1877     return tls_error(US"library init", host, NULL);
1878   if (DANESSL_CTX_init(client_ctx) <= 0)
1879     return tls_error(US"context init", host, NULL);
1880   }
1881 else
1882
1883 #endif
1884
1885   if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob
1886 #ifdef EXPERIMENTAL_CERTNAMES
1887                                 , client_static_cbinfo
1888 #endif
1889                                 )) != OK)
1890     return rc;
1891
1892 if ((client_ssl = SSL_new(client_ctx)) == NULL)
1893   return tls_error(US"SSL_new", host, NULL);
1894 SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1895 SSL_set_fd(client_ssl, fd);
1896 SSL_set_connect_state(client_ssl);
1897
1898 if (ob->tls_sni)
1899   {
1900   if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
1901     return FAIL;
1902   if (tls_out.sni == NULL)
1903     {
1904     DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1905     }
1906   else if (!Ustrlen(tls_out.sni))
1907     tls_out.sni = NULL;
1908   else
1909     {
1910 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1911     DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1912     SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
1913 #else
1914     DEBUG(D_tls)
1915       debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
1916           tls_out.sni);
1917 #endif
1918     }
1919   }
1920
1921 #ifdef EXPERIMENTAL_DANE
1922 if (dane)
1923   if ((rc = dane_tlsa_load(client_ssl, host, &tlsa_dnsa)) != OK)
1924     return rc;
1925 #endif
1926
1927 #ifndef DISABLE_OCSP
1928 /* Request certificate status at connection-time.  If the server
1929 does OCSP stapling we will get the callback (set in tls_init()) */
1930 # ifdef EXPERIMENTAL_DANE
1931 if (request_ocsp)
1932   {
1933   const uschar * s;
1934   if (  (s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage")
1935      || (s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage")
1936      )
1937     {   /* Re-eval now $tls_out_tlsa_usage is populated.  If
1938         this means we avoid the OCSP request, we wasted the setup
1939         cost in tls_init(). */
1940     require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1941       NULL, host->name, host->address, NULL) == OK;
1942     request_ocsp = require_ocsp ? TRUE
1943       : verify_check_this_host(&ob->hosts_request_ocsp,
1944           NULL, host->name, host->address, NULL) == OK;
1945     }
1946   }
1947 # endif
1948
1949 if (request_ocsp)
1950   {
1951   SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
1952   client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
1953   tls_out.ocsp = OCSP_NOT_RESP;
1954   }
1955 #endif
1956
1957 #ifdef EXPERIMENTAL_TPDA
1958 client_static_cbinfo->event_action = tb->tpda_event_action;
1959 #endif
1960
1961 /* There doesn't seem to be a built-in timeout on connection. */
1962
1963 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1964 sigalrm_seen = FALSE;
1965 alarm(ob->command_timeout);
1966 rc = SSL_connect(client_ssl);
1967 alarm(0);
1968
1969 #ifdef EXPERIMENTAL_DANE
1970 if (dane)
1971   DANESSL_cleanup(client_ssl);
1972 #endif
1973
1974 if (rc <= 0)
1975   return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
1976
1977 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
1978
1979 /* Beware anonymous ciphers which lead to server_cert being NULL */
1980 /*XXX server_cert is never freed... use X509_free() */
1981 server_cert = SSL_get_peer_certificate (client_ssl);
1982 if (server_cert)
1983   {
1984   tls_out.peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
1985     CS txt, sizeof(txt));
1986   tls_out.peerdn = txt;         /*XXX a static buffer... */
1987   }
1988 else
1989   tls_out.peerdn = NULL;
1990
1991 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
1992 tls_out.cipher = cipherbuf;
1993
1994 /* Record the certificate we presented */
1995   {
1996   X509 * crt = SSL_get_certificate(client_ssl);
1997   tls_out.ourcert = crt ? X509_dup(crt) : NULL;
1998   }
1999
2000 tls_out.active = fd;
2001 return OK;
2002 }
2003
2004
2005
2006
2007
2008 /*************************************************
2009 *            TLS version of getc                 *
2010 *************************************************/
2011
2012 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2013 it refills the buffer via the SSL reading function.
2014
2015 Arguments:  none
2016 Returns:    the next character or EOF
2017
2018 Only used by the server-side TLS.
2019 */
2020
2021 int
2022 tls_getc(void)
2023 {
2024 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2025   {
2026   int error;
2027   int inbytes;
2028
2029   DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
2030     ssl_xfer_buffer, ssl_xfer_buffer_size);
2031
2032   if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2033   inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
2034   error = SSL_get_error(server_ssl, inbytes);
2035   alarm(0);
2036
2037   /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2038   closed down, not that the socket itself has been closed down. Revert to
2039   non-SSL handling. */
2040
2041   if (error == SSL_ERROR_ZERO_RETURN)
2042     {
2043     DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2044
2045     receive_getc = smtp_getc;
2046     receive_ungetc = smtp_ungetc;
2047     receive_feof = smtp_feof;
2048     receive_ferror = smtp_ferror;
2049     receive_smtp_buffered = smtp_buffered;
2050
2051     SSL_free(server_ssl);
2052     server_ssl = NULL;
2053     tls_in.active = -1;
2054     tls_in.bits = 0;
2055     tls_in.cipher = NULL;
2056     tls_in.peerdn = NULL;
2057     tls_in.sni = NULL;
2058
2059     return smtp_getc();
2060     }
2061
2062   /* Handle genuine errors */
2063
2064   else if (error == SSL_ERROR_SSL)
2065     {
2066     ERR_error_string(ERR_get_error(), ssl_errstring);
2067     log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
2068     ssl_xfer_error = 1;
2069     return EOF;
2070     }
2071
2072   else if (error != SSL_ERROR_NONE)
2073     {
2074     DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2075     ssl_xfer_error = 1;
2076     return EOF;
2077     }
2078
2079 #ifndef DISABLE_DKIM
2080   dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2081 #endif
2082   ssl_xfer_buffer_hwm = inbytes;
2083   ssl_xfer_buffer_lwm = 0;
2084   }
2085
2086 /* Something in the buffer; return next uschar */
2087
2088 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2089 }
2090
2091
2092
2093 /*************************************************
2094 *          Read bytes from TLS channel           *
2095 *************************************************/
2096
2097 /*
2098 Arguments:
2099   buff      buffer of data
2100   len       size of buffer
2101
2102 Returns:    the number of bytes read
2103             -1 after a failed read
2104
2105 Only used by the client-side TLS.
2106 */
2107
2108 int
2109 tls_read(BOOL is_server, uschar *buff, size_t len)
2110 {
2111 SSL *ssl = is_server ? server_ssl : client_ssl;
2112 int inbytes;
2113 int error;
2114
2115 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
2116   buff, (unsigned int)len);
2117
2118 inbytes = SSL_read(ssl, CS buff, len);
2119 error = SSL_get_error(ssl, inbytes);
2120
2121 if (error == SSL_ERROR_ZERO_RETURN)
2122   {
2123   DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2124   return -1;
2125   }
2126 else if (error != SSL_ERROR_NONE)
2127   {
2128   return -1;
2129   }
2130
2131 return inbytes;
2132 }
2133
2134
2135
2136
2137
2138 /*************************************************
2139 *         Write bytes down TLS channel           *
2140 *************************************************/
2141
2142 /*
2143 Arguments:
2144   is_server channel specifier
2145   buff      buffer of data
2146   len       number of bytes
2147
2148 Returns:    the number of bytes after a successful write,
2149             -1 after a failed write
2150
2151 Used by both server-side and client-side TLS.
2152 */
2153
2154 int
2155 tls_write(BOOL is_server, const uschar *buff, size_t len)
2156 {
2157 int outbytes;
2158 int error;
2159 int left = len;
2160 SSL *ssl = is_server ? server_ssl : client_ssl;
2161
2162 DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
2163 while (left > 0)
2164   {
2165   DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
2166   outbytes = SSL_write(ssl, CS buff, left);
2167   error = SSL_get_error(ssl, outbytes);
2168   DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2169   switch (error)
2170     {
2171     case SSL_ERROR_SSL:
2172     ERR_error_string(ERR_get_error(), ssl_errstring);
2173     log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2174     return -1;
2175
2176     case SSL_ERROR_NONE:
2177     left -= outbytes;
2178     buff += outbytes;
2179     break;
2180
2181     case SSL_ERROR_ZERO_RETURN:
2182     log_write(0, LOG_MAIN, "SSL channel closed on write");
2183     return -1;
2184
2185     case SSL_ERROR_SYSCALL:
2186     log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2187       sender_fullhost ? sender_fullhost : US"<unknown>",
2188       strerror(errno));
2189
2190     default:
2191     log_write(0, LOG_MAIN, "SSL_write error %d", error);
2192     return -1;
2193     }
2194   }
2195 return len;
2196 }
2197
2198
2199
2200 /*************************************************
2201 *         Close down a TLS session               *
2202 *************************************************/
2203
2204 /* This is also called from within a delivery subprocess forked from the
2205 daemon, to shut down the TLS library, without actually doing a shutdown (which
2206 would tamper with the SSL session in the parent process).
2207
2208 Arguments:   TRUE if SSL_shutdown is to be called
2209 Returns:     nothing
2210
2211 Used by both server-side and client-side TLS.
2212 */
2213
2214 void
2215 tls_close(BOOL is_server, BOOL shutdown)
2216 {
2217 SSL **sslp = is_server ? &server_ssl : &client_ssl;
2218 int *fdp = is_server ? &tls_in.active : &tls_out.active;
2219
2220 if (*fdp < 0) return;  /* TLS was not active */
2221
2222 if (shutdown)
2223   {
2224   DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
2225   SSL_shutdown(*sslp);
2226   }
2227
2228 SSL_free(*sslp);
2229 *sslp = NULL;
2230
2231 *fdp = -1;
2232 }
2233
2234
2235
2236
2237 /*************************************************
2238 *  Let tls_require_ciphers be checked at startup *
2239 *************************************************/
2240
2241 /* The tls_require_ciphers option, if set, must be something which the
2242 library can parse.
2243
2244 Returns:     NULL on success, or error message
2245 */
2246
2247 uschar *
2248 tls_validate_require_cipher(void)
2249 {
2250 SSL_CTX *ctx;
2251 uschar *s, *expciphers, *err;
2252
2253 /* this duplicates from tls_init(), we need a better "init just global
2254 state, for no specific purpose" singleton function of our own */
2255
2256 SSL_load_error_strings();
2257 OpenSSL_add_ssl_algorithms();
2258 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2259 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2260 list of available digests. */
2261 EVP_add_digest(EVP_sha256());
2262 #endif
2263
2264 if (!(tls_require_ciphers && *tls_require_ciphers))
2265   return NULL;
2266
2267 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2268   return US"failed to expand tls_require_ciphers";
2269
2270 if (!(expciphers && *expciphers))
2271   return NULL;
2272
2273 /* normalisation ripped from above */
2274 s = expciphers;
2275 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2276
2277 err = NULL;
2278
2279 ctx = SSL_CTX_new(SSLv23_server_method());
2280 if (!ctx)
2281   {
2282   ERR_error_string(ERR_get_error(), ssl_errstring);
2283   return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2284   }
2285
2286 DEBUG(D_tls)
2287   debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2288
2289 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2290   {
2291   ERR_error_string(ERR_get_error(), ssl_errstring);
2292   err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2293   }
2294
2295 SSL_CTX_free(ctx);
2296
2297 return err;
2298 }
2299
2300
2301
2302
2303 /*************************************************
2304 *         Report the library versions.           *
2305 *************************************************/
2306
2307 /* There have historically been some issues with binary compatibility in
2308 OpenSSL libraries; if Exim (like many other applications) is built against
2309 one version of OpenSSL but the run-time linker picks up another version,
2310 it can result in serious failures, including crashing with a SIGSEGV.  So
2311 report the version found by the compiler and the run-time version.
2312
2313 Note: some OS vendors backport security fixes without changing the version
2314 number/string, and the version date remains unchanged.  The _build_ date
2315 will change, so we can more usefully assist with version diagnosis by also
2316 reporting the build date.
2317
2318 Arguments:   a FILE* to print the results to
2319 Returns:     nothing
2320 */
2321
2322 void
2323 tls_version_report(FILE *f)
2324 {
2325 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
2326            "                          Runtime: %s\n"
2327            "                                 : %s\n",
2328            OPENSSL_VERSION_TEXT,
2329            SSLeay_version(SSLEAY_VERSION),
2330            SSLeay_version(SSLEAY_BUILT_ON));
2331 /* third line is 38 characters for the %s and the line is 73 chars long;
2332 the OpenSSL output includes a "built on: " prefix already. */
2333 }
2334
2335
2336
2337
2338 /*************************************************
2339 *            Random number generation            *
2340 *************************************************/
2341
2342 /* Pseudo-random number generation.  The result is not expected to be
2343 cryptographically strong but not so weak that someone will shoot themselves
2344 in the foot using it as a nonce in input in some email header scheme or
2345 whatever weirdness they'll twist this into.  The result should handle fork()
2346 and avoid repeating sequences.  OpenSSL handles that for us.
2347
2348 Arguments:
2349   max       range maximum
2350 Returns     a random number in range [0, max-1]
2351 */
2352
2353 int
2354 vaguely_random_number(int max)
2355 {
2356 unsigned int r;
2357 int i, needed_len;
2358 static pid_t pidlast = 0;
2359 pid_t pidnow;
2360 uschar *p;
2361 uschar smallbuf[sizeof(r)];
2362
2363 if (max <= 1)
2364   return 0;
2365
2366 pidnow = getpid();
2367 if (pidnow != pidlast)
2368   {
2369   /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2370   is unique for each thread", this doesn't apparently apply across processes,
2371   so our own warning from vaguely_random_number_fallback() applies here too.
2372   Fix per PostgreSQL. */
2373   if (pidlast != 0)
2374     RAND_cleanup();
2375   pidlast = pidnow;
2376   }
2377
2378 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2379 if (!RAND_status())
2380   {
2381   randstuff r;
2382   gettimeofday(&r.tv, NULL);
2383   r.p = getpid();
2384
2385   RAND_seed((uschar *)(&r), sizeof(r));
2386   }
2387 /* We're after pseudo-random, not random; if we still don't have enough data
2388 in the internal PRNG then our options are limited.  We could sleep and hope
2389 for entropy to come along (prayer technique) but if the system is so depleted
2390 in the first place then something is likely to just keep taking it.  Instead,
2391 we'll just take whatever little bit of pseudo-random we can still manage to
2392 get. */
2393
2394 needed_len = sizeof(r);
2395 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2396 asked for a number less than 10. */
2397 for (r = max, i = 0; r; ++i)
2398   r >>= 1;
2399 i = (i + 7) / 8;
2400 if (i < needed_len)
2401   needed_len = i;
2402
2403 /* We do not care if crypto-strong */
2404 i = RAND_pseudo_bytes(smallbuf, needed_len);
2405 if (i < 0)
2406   {
2407   DEBUG(D_all)
2408     debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2409   return vaguely_random_number_fallback(max);
2410   }
2411
2412 r = 0;
2413 for (p = smallbuf; needed_len; --needed_len, ++p)
2414   {
2415   r *= 256;
2416   r += *p;
2417   }
2418
2419 /* We don't particularly care about weighted results; if someone wants
2420 smooth distribution and cares enough then they should submit a patch then. */
2421 return r % max;
2422 }
2423
2424
2425
2426
2427 /*************************************************
2428 *        OpenSSL option parse                    *
2429 *************************************************/
2430
2431 /* Parse one option for tls_openssl_options_parse below
2432
2433 Arguments:
2434   name    one option name
2435   value   place to store a value for it
2436 Returns   success or failure in parsing
2437 */
2438
2439 struct exim_openssl_option {
2440   uschar *name;
2441   long    value;
2442 };
2443 /* We could use a macro to expand, but we need the ifdef and not all the
2444 options document which version they were introduced in.  Policylet: include
2445 all options unless explicitly for DTLS, let the administrator choose which
2446 to apply.
2447
2448 This list is current as of:
2449   ==>  1.0.1b  <==
2450 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2451 */
2452 static struct exim_openssl_option exim_openssl_options[] = {
2453 /* KEEP SORTED ALPHABETICALLY! */
2454 #ifdef SSL_OP_ALL
2455   { US"all", SSL_OP_ALL },
2456 #endif
2457 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
2458   { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
2459 #endif
2460 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
2461   { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
2462 #endif
2463 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
2464   { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
2465 #endif
2466 #ifdef SSL_OP_EPHEMERAL_RSA
2467   { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
2468 #endif
2469 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
2470   { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
2471 #endif
2472 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
2473   { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
2474 #endif
2475 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
2476   { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
2477 #endif
2478 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
2479   { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
2480 #endif
2481 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
2482   { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
2483 #endif
2484 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
2485   { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
2486 #endif
2487 #ifdef SSL_OP_NO_COMPRESSION
2488   { US"no_compression", SSL_OP_NO_COMPRESSION },
2489 #endif
2490 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2491   { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
2492 #endif
2493 #ifdef SSL_OP_NO_SSLv2
2494   { US"no_sslv2", SSL_OP_NO_SSLv2 },
2495 #endif
2496 #ifdef SSL_OP_NO_SSLv3
2497   { US"no_sslv3", SSL_OP_NO_SSLv3 },
2498 #endif
2499 #ifdef SSL_OP_NO_TICKET
2500   { US"no_ticket", SSL_OP_NO_TICKET },
2501 #endif
2502 #ifdef SSL_OP_NO_TLSv1
2503   { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2504 #endif
2505 #ifdef SSL_OP_NO_TLSv1_1
2506 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
2507   /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2508 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2509 #else
2510   { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2511 #endif
2512 #endif
2513 #ifdef SSL_OP_NO_TLSv1_2
2514   { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2515 #endif
2516 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2517   { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2518 #endif
2519 #ifdef SSL_OP_SINGLE_DH_USE
2520   { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
2521 #endif
2522 #ifdef SSL_OP_SINGLE_ECDH_USE
2523   { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
2524 #endif
2525 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
2526   { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
2527 #endif
2528 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
2529   { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
2530 #endif
2531 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
2532   { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
2533 #endif
2534 #ifdef SSL_OP_TLS_D5_BUG
2535   { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
2536 #endif
2537 #ifdef SSL_OP_TLS_ROLLBACK_BUG
2538   { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
2539 #endif
2540 };
2541 static int exim_openssl_options_size =
2542   sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2543
2544
2545 static BOOL
2546 tls_openssl_one_option_parse(uschar *name, long *value)
2547 {
2548 int first = 0;
2549 int last = exim_openssl_options_size;
2550 while (last > first)
2551   {
2552   int middle = (first + last)/2;
2553   int c = Ustrcmp(name, exim_openssl_options[middle].name);
2554   if (c == 0)
2555     {
2556     *value = exim_openssl_options[middle].value;
2557     return TRUE;
2558     }
2559   else if (c > 0)
2560     first = middle + 1;
2561   else
2562     last = middle;
2563   }
2564 return FALSE;
2565 }
2566
2567
2568
2569
2570 /*************************************************
2571 *        OpenSSL option parsing logic            *
2572 *************************************************/
2573
2574 /* OpenSSL has a number of compatibility options which an administrator might
2575 reasonably wish to set.  Interpret a list similarly to decode_bits(), so that
2576 we look like log_selector.
2577
2578 Arguments:
2579   option_spec  the administrator-supplied string of options
2580   results      ptr to long storage for the options bitmap
2581 Returns        success or failure
2582 */
2583
2584 BOOL
2585 tls_openssl_options_parse(uschar *option_spec, long *results)
2586 {
2587 long result, item;
2588 uschar *s, *end;
2589 uschar keep_c;
2590 BOOL adding, item_parsed;
2591
2592 result = 0L;
2593 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
2594  * from default because it increases BEAST susceptibility. */
2595 #ifdef SSL_OP_NO_SSLv2
2596 result |= SSL_OP_NO_SSLv2;
2597 #endif
2598
2599 if (option_spec == NULL)
2600   {
2601   *results = result;
2602   return TRUE;
2603   }
2604
2605 for (s=option_spec; *s != '\0'; /**/)
2606   {
2607   while (isspace(*s)) ++s;
2608   if (*s == '\0')
2609     break;
2610   if (*s != '+' && *s != '-')
2611     {
2612     DEBUG(D_tls) debug_printf("malformed openssl option setting: "
2613         "+ or - expected but found \"%s\"\n", s);
2614     return FALSE;
2615     }
2616   adding = *s++ == '+';
2617   for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2618   keep_c = *end;
2619   *end = '\0';
2620   item_parsed = tls_openssl_one_option_parse(s, &item);
2621   if (!item_parsed)
2622     {
2623     DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
2624     return FALSE;
2625     }
2626   DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2627       adding ? "adding" : "removing", result, item, s);
2628   if (adding)
2629     result |= item;
2630   else
2631     result &= ~item;
2632   *end = keep_c;
2633   s = end;
2634   }
2635
2636 *results = result;
2637 return TRUE;
2638 }
2639
2640 /* vi: aw ai sw=2
2641 */
2642 /* End of tls-openssl.c */