X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/4f1d23a1aa7aafc5a47988d80dde87c67ec8e1fc..7f83b348ccf4cd815e9758ab9ca1012e66324e9d:/src/src/tls-openssl.c diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c index df884355e..64f60b7e4 100644 --- a/src/src/tls-openssl.c +++ b/src/src/tls-openssl.c @@ -3,6 +3,7 @@ *************************************************/ /* Copyright (c) University of Cambridge 1995 - 2019 */ +/* Copyright (c) The Exim Maintainers 2020 */ /* See the file NOTICE for conditions of use and distribution. */ /* Portions Copyright (c) The OpenSSL Project 1999 */ @@ -46,6 +47,7 @@ functions from the OpenSSL library. */ #endif #if OPENSSL_VERSION_NUMBER >= 0x10100000L # define EXIM_HAVE_OCSP_RESP_COUNT +# define OPENSSL_AUTO_SHA256 #else # define EXIM_HAVE_EPHEM_RSA_KEX # define EXIM_HAVE_RAND_PSEUDO @@ -74,6 +76,10 @@ change this guard and punt the issue for a while longer. */ # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID # define EXIM_HAVE_SESSION_TICKET # define EXIM_HAVE_OPESSL_TRACE +# define EXIM_HAVE_OPESSL_GET0_SERIAL +# ifndef DISABLE_OCSP +# define EXIM_HAVE_OCSP +# endif # else # define EXIM_NEED_OPENSSL_INIT # endif @@ -100,6 +106,8 @@ change this guard and punt the issue for a while longer. */ # define OPENSSL_HAVE_KEYLOG_CB # define OPENSSL_HAVE_NUM_TICKETS # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME +# else +# define OPENSSL_BAD_SRVR_OURCERT # endif #endif @@ -108,7 +116,7 @@ change this guard and punt the issue for a while longer. */ # define DISABLE_OCSP #endif -#ifdef EXPERIMENTAL_TLS_RESUME +#ifndef DISABLE_TLS_RESUME # if OPENSSL_VERSION_NUMBER < 0x0101010L # error OpenSSL version too old for session-resumption # endif @@ -141,14 +149,19 @@ all options unless explicitly for DTLS, let the administrator choose which to apply. This list is current as of: - ==> 1.0.1b <== -Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev -Plus SSL_OP_NO_TLSv1_3 for 1.1.2-dev + ==> 1.1.1c <== + +XXX could we autobuild this list, as with predefined-macros? +Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS). +Also allow a numeric literal? */ static exim_openssl_option exim_openssl_options[] = { /* KEEP SORTED ALPHABETICALLY! */ #ifdef SSL_OP_ALL - { US"all", SSL_OP_ALL }, + { US"all", (long) SSL_OP_ALL }, +#endif +#ifdef SSL_OP_ALLOW_NO_DHE_KEX + { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX }, #endif #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION }, @@ -156,9 +169,15 @@ static exim_openssl_option exim_openssl_options[] = { #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE }, #endif +#ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG + { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG }, +#endif #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS }, #endif +#ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT + { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT }, +#endif #ifdef SSL_OP_EPHEMERAL_RSA { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA }, #endif @@ -180,9 +199,18 @@ static exim_openssl_option exim_openssl_options[] = { #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG }, #endif +#ifdef SSL_OP_NO_ANTI_REPLAY + { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY }, +#endif #ifdef SSL_OP_NO_COMPRESSION { US"no_compression", SSL_OP_NO_COMPRESSION }, #endif +#ifdef SSL_OP_NO_ENCRYPT_THEN_MAC + { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC }, +#endif +#ifdef SSL_OP_NO_RENEGOTIATION + { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION }, +#endif #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION }, #endif @@ -212,6 +240,9 @@ static exim_openssl_option exim_openssl_options[] = { #ifdef SSL_OP_NO_TLSv1_3 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 }, #endif +#ifdef SSL_OP_PRIORITIZE_CHACHA + { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA }, +#endif #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG }, #endif @@ -236,6 +267,9 @@ static exim_openssl_option exim_openssl_options[] = { #ifdef SSL_OP_TLS_ROLLBACK_BUG { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG }, #endif +#ifdef SSL_OP_TLSEXT_PADDING + { US"tlsext_padding", SSL_OP_TLSEXT_PADDING }, +#endif }; #ifndef MACRO_PREDEF @@ -258,9 +292,19 @@ for (struct exim_openssl_option * o = exim_openssl_options; builtin_macro_create(buf); } -# ifdef EXPERIMENTAL_TLS_RESUME +# ifndef DISABLE_TLS_RESUME builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING ); # endif +# ifdef SSL_OP_NO_TLSv1_3 +builtin_macro_create(US"_HAVE_TLS1_3"); +# endif +# ifdef OPENSSL_BAD_SRVR_OURCERT +builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT"); +# endif +# ifdef EXIM_HAVE_OCSP +builtin_macro_create(US"_HAVE_TLS_OCSP"); +builtin_macro_create(US"_HAVE_TLS_OCSP_LIST"); +# endif } #else @@ -315,25 +359,30 @@ static SSL_CTX *server_sni = NULL; static char ssl_errstring[256]; -static int ssl_session_timeout = 3600; +static int ssl_session_timeout = 7200; /* Two hours */ static BOOL client_verify_optional = FALSE; static BOOL server_verify_optional = FALSE; static BOOL reexpand_tls_files_for_sni = FALSE; +typedef struct ocsp_resp { + struct ocsp_resp * next; + OCSP_RESPONSE * resp; +} ocsp_resplist; + typedef struct tls_ext_ctx_cb { - tls_support * tlsp; - uschar *certificate; - uschar *privatekey; - BOOL is_server; + tls_support * tlsp; + uschar * certificate; + uschar * privatekey; + BOOL is_server; #ifndef DISABLE_OCSP STACK_OF(X509) *verify_stack; /* chain for verifying the proof */ union { struct { uschar *file; - uschar *file_expanded; - OCSP_RESPONSE *response; + const uschar *file_expanded; + ocsp_resplist *olist; } server; struct { X509_STORE *verify_store; /* non-null if status requested */ @@ -341,14 +390,14 @@ typedef struct tls_ext_ctx_cb { } client; } u_ocsp; #endif - uschar *dhparam; + uschar * dhparam; /* these are cached from first expand */ - uschar *server_cipher_list; + uschar * server_cipher_list; /* only passed down to tls_error: */ - host_item *host; + host_item * host; const uschar * verify_cert_hostnames; #ifndef DISABLE_EVENT - uschar * event_action; + uschar * event_action; #endif } tls_ext_ctx_cb; @@ -373,7 +422,7 @@ static int tls_server_stapling_cb(SSL *s, void *arg); /* Daemon-called, before every connection, key create/rotate */ -#ifdef EXPERIMENTAL_TLS_RESUME +#ifndef DISABLE_TLS_RESUME static void tk_init(void); static int tls_exdata_idx = -1; #endif @@ -381,7 +430,7 @@ static int tls_exdata_idx = -1; void tls_daemon_init(void) { -#ifdef EXPERIMENTAL_TLS_RESUME +#ifndef DISABLE_TLS_RESUME tk_init(); #endif return; @@ -447,7 +496,6 @@ RSA *rsa_key; BIGNUM *bn = BN_new(); #endif -export = export; /* Shut picky compilers up */ DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength); #ifdef EXIM_HAVE_RSA_GENKEY_EX @@ -586,6 +634,7 @@ if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn))) } dn[sizeof(dn)-1] = '\0'; +tlsp->verify_override = FALSE; if (preverify_ok == 0) { uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])", @@ -830,12 +879,18 @@ DEBUG(D_tls) static void keylog_callback(const SSL *ssl, const char *line) { +char * filename; +FILE * fp; DEBUG(D_tls) debug_printf("%.200s\n", line); +if (!(filename = getenv("SSLKEYLOGFILE"))) return; +if (!(fp = fopen(filename, "a"))) return; +fprintf(fp, "%s\n", line); +fclose(fp); } #endif -#ifdef EXPERIMENTAL_TLS_RESUME +#ifndef DISABLE_TLS_RESUME /* Manage the keysets used for encrypting the session tickets, on the server. */ typedef struct { /* Session ticket encryption key */ @@ -911,7 +966,7 @@ if (enc) if (!(key = tk_current())) /* current key doesn't exist or isn't valid */ return 0; /* key couldn't be created */ memcpy(key_name, key->name, 16); - DEBUG(D_tls) debug_printf("STEK expire %ld\n", key->expire - time(NULL)); + DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL)); /*XXX will want these dependent on the ssl session strength */ HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key), @@ -933,7 +988,7 @@ else DEBUG(D_tls) { debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found"); - if (key) debug_printf("STEK expire %ld\n", key->expire - now); + if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now); } return 0; } @@ -942,7 +997,13 @@ else key->hmac_hash, NULL); EVP_DecryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv); - DEBUG(D_tls) debug_printf("ticket usable, STEK expire %ld\n", key->expire - now); + DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now); + + /* The ticket lifetime and renewal are the same as the STEK lifetime and + renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would + be better. To do that we'd have to encode ticket lifetime in the name as + we don't yet see the restored session. Could check posthandshake for TLS1.3 + and trigger a new ticket then, but cannot do that for TLS1.2 */ return key->renew < now ? 2 : 1; } } @@ -1182,12 +1243,14 @@ ASSUMES: single response, for single cert. Arguments: sctx the SSL_CTX* to update cbinfo various parts of session state - expanded the filename putatively holding an OCSP response + filename the filename putatively holding an OCSP response + is_pem file is PEM format; otherwise is DER */ static void -ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded) +ocsp_load_response(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, + const uschar * filename, BOOL is_pem) { BIO * bio; OCSP_RESPONSE * resp; @@ -1198,22 +1261,36 @@ STACK_OF(X509) * sk; unsigned long verify_flags; int status, reason, i; -cbinfo->u_ocsp.server.file_expanded = string_copy(expanded); -if (cbinfo->u_ocsp.server.response) - { - OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response); - cbinfo->u_ocsp.server.response = NULL; - } +DEBUG(D_tls) + debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename); -if (!(bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb"))) +if (!(bio = BIO_new_file(CS filename, "rb"))) { DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n", - cbinfo->u_ocsp.server.file_expanded); + filename); return; } -resp = d2i_OCSP_RESPONSE_bio(bio, NULL); +if (is_pem) + { + uschar * data, * freep; + char * dummy; + long len; + if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len)) + { + DEBUG(D_tls) debug_printf("Failed to read PEM file \"%s\"\n", + filename); + return; + } +debug_printf("read pem file\n"); + freep = data; + resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len); + OPENSSL_free(freep); + } +else + resp = d2i_OCSP_RESPONSE_bio(bio, NULL); BIO_free(bio); + if (!resp) { DEBUG(D_tls) debug_printf("Error reading OCSP response.\n"); @@ -1227,6 +1304,14 @@ if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL) goto bad; } +#ifdef notdef + { + BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE); + OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */ + BIO_free(bp); + } +#endif + if (!(basic_response = OCSP_response_get1_basic(resp))) { DEBUG(D_tls) @@ -1280,7 +1365,10 @@ proves false, we need to extract a cert id from our issued cert (tls_certificate) and use that for OCSP_resp_find_status() (which finds the right cert in the stack and then calls OCSP_single_get0_status()). -I'm hoping to avoid reworking a bunch more of how we handle state here. */ +I'm hoping to avoid reworking a bunch more of how we handle state here. + +XXX that will change when we add support for (TLS1.3) whole-chain stapling +*/ if (!(single_response = OCSP_resp_get0(basic_response, 0))) { @@ -1305,7 +1393,15 @@ if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX } supply_response: - cbinfo->u_ocsp.server.response = resp; /*XXX stack?*/ + /* Add the resp to the list used by tls_server_stapling_cb() */ + { + ocsp_resplist ** op = &cbinfo->u_ocsp.server.olist, * oentry; + while (oentry = *op) + op = &oentry->next; + *op = oentry = store_get(sizeof(ocsp_resplist), FALSE); + oentry->next = NULL; + oentry->resp = resp; + } return; bad: @@ -1321,6 +1417,16 @@ bad: } return; } + + +static void +ocsp_free_response_list(tls_ext_ctx_cb * cbinfo) +{ +for (ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; olist; + olist = olist->next) + OCSP_RESPONSE_free(olist->resp); +cbinfo->u_ocsp.server.olist = NULL; +} #endif /*!DISABLE_OCSP*/ @@ -1396,7 +1502,7 @@ static int tls_add_certfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file, uschar ** errstr) { -DEBUG(D_tls) debug_printf("tls_certificate file %s\n", file); +DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file); if (!SSL_CTX_use_certificate_chain_file(sctx, CS file)) return tls_error(string_sprintf( "SSL_CTX_use_certificate_chain_file file=%s", file), @@ -1408,7 +1514,7 @@ static int tls_add_pkeyfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file, uschar ** errstr) { -DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", file); +DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file); if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM)) return tls_error(string_sprintf( "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr); @@ -1433,10 +1539,10 @@ Returns: OK/DEFER/FAIL */ static int -tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, +tls_expand_session_files(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar ** errstr) { -uschar *expanded; +uschar * expanded; if (!cbinfo->certificate) { @@ -1450,10 +1556,11 @@ else { int err; - if (Ustrstr(cbinfo->certificate, US"tls_sni") || - Ustrstr(cbinfo->certificate, US"tls_in_sni") || - Ustrstr(cbinfo->certificate, US"tls_out_sni") - ) + if ( !reexpand_tls_files_for_sni + && ( Ustrstr(cbinfo->certificate, US"tls_sni") + || Ustrstr(cbinfo->certificate, US"tls_in_sni") + || Ustrstr(cbinfo->certificate, US"tls_out_sni") + ) ) reexpand_tls_files_for_sni = TRUE; if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded, errstr)) @@ -1465,10 +1572,56 @@ else const uschar * file_list = expanded; int sep = 0; uschar * file; +#ifndef DISABLE_OCSP + const uschar * olist = cbinfo->u_ocsp.server.file; + int osep = 0; + uschar * ofile; + BOOL fmt_pem = FALSE; + + if (olist) + if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr)) + return DEFER; + if (olist && !*olist) + olist = NULL; + + if ( cbinfo->u_ocsp.server.file_expanded && olist + && (Ustrcmp(olist, cbinfo->u_ocsp.server.file_expanded) == 0)) + { + DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n"); + olist = NULL; + } + else + { + ocsp_free_response_list(cbinfo); + cbinfo->u_ocsp.server.file_expanded = olist; + } +#endif while (file = string_nextinlist(&file_list, &sep, NULL, 0)) + { if ((err = tls_add_certfile(sctx, cbinfo, file, errstr))) return err; + +#ifndef DISABLE_OCSP + if (olist) + if ((ofile = string_nextinlist(&olist, &osep, NULL, 0))) + { + if (Ustrncmp(ofile, US"PEM ", 4) == 0) + { + fmt_pem = TRUE; + ofile += 4; + } + else if (Ustrncmp(ofile, US"DER ", 4) == 0) + { + fmt_pem = FALSE; + ofile += 4; + } + ocsp_load_response(sctx, cbinfo, ofile, fmt_pem); + } + else + DEBUG(D_tls) debug_printf("ran out of ocsp file list\n"); +#endif + } } else /* would there ever be a need for multiple client certs? */ if ((err = tls_add_certfile(sctx, cbinfo, expanded, errstr))) @@ -1498,27 +1651,6 @@ else return err; } -#ifndef DISABLE_OCSP -if (cbinfo->is_server && cbinfo->u_ocsp.server.file) - { - /*XXX stack*/ - if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded, errstr)) - return DEFER; - - if (expanded && *expanded) - { - DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded); - if ( cbinfo->u_ocsp.server.file_expanded - && (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0)) - { - DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n"); - } - else - ocsp_load_response(sctx, cbinfo, expanded); - } - } -#endif - return OK; } @@ -1563,7 +1695,7 @@ DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername, /* Make the extension value available for expansion */ store_pool = POOL_PERM; -tls_in.sni = string_copy(US servername); +tls_in.sni = string_copy_taint(US servername, TRUE); store_pool = old_pool; if (!reexpand_tls_files_for_sni) @@ -1648,27 +1780,78 @@ project. static int tls_server_stapling_cb(SSL *s, void *arg) { -const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg; -uschar *response_der; /*XXX blob */ +const tls_ext_ctx_cb * cbinfo = (tls_ext_ctx_cb *) arg; +ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; +uschar * response_der; /*XXX blob */ int response_der_len; -/*XXX stack: use SSL_get_certificate() to see which cert; from that work -out which ocsp blob to send. Unfortunately, SSL_get_certificate is known -buggy in current OpenSSL; it returns the last cert loaded always rather than -the one actually presented. So we can't support a stack of OCSP proofs at -this time. */ - DEBUG(D_tls) - debug_printf("Received TLS status request (OCSP stapling); %s response\n", - cbinfo->u_ocsp.server.response ? "have" : "lack"); + debug_printf("Received TLS status request (OCSP stapling); %s response list\n", + olist ? "have" : "lack"); tls_in.ocsp = OCSP_NOT_RESP; -if (!cbinfo->u_ocsp.server.response) +if (!olist) return SSL_TLSEXT_ERR_NOACK; +#ifdef EXIM_HAVE_OPESSL_GET0_SERIAL + { + const X509 * cert_sent = SSL_get_certificate(s); + const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent); + const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL); + const X509_NAME * cert_issuer = X509_get_issuer_name(cert_sent); + uschar * chash; + uint chash_len; + + for (; olist; olist = olist->next) + { + OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp); + const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0); + const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single); + ASN1_INTEGER * res_cert_serial; + const BIGNUM * resp_bn; + ASN1_OCTET_STRING * res_cert_iNameHash; + + + (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial, + (OCSP_CERTID *) cid); + resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL); + + DEBUG(D_tls) + { + debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn)); + debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn)); + } + + if (BN_cmp(cert_bn, resp_bn) == 0) + { + DEBUG(D_tls) debug_printf("matched serial for ocsp\n"); + + /*XXX TODO: check the rest of the list for duplicate matches. + If any, need to also check the Issuer Name hash. + Without this, we will provide the wrong status in the case of + duplicate id. */ + + break; + } + DEBUG(D_tls) debug_printf("not match serial for ocsp\n"); + } + if (!olist) + { + DEBUG(D_tls) debug_printf("failed to find match for ocsp\n"); + return SSL_TLSEXT_ERR_NOACK; + } + } +#else +if (olist->next) + { + DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n"); + return SSL_TLSEXT_ERR_NOACK; + } +#endif + +/*XXX could we do the i2d earlier, rather than during the callback? */ response_der = NULL; -response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response, /*XXX stack*/ - &response_der); +response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der); if (response_der_len <= 0) return SSL_TLSEXT_ERR_NOACK; @@ -1696,29 +1879,29 @@ OCSP_RESPONSE * rsp; OCSP_BASICRESP * bs; int i; -DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):"); +DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n"); len = SSL_get_tlsext_status_ocsp_resp(s, &p); if(!p) { /* Expect this when we requested ocsp but got none */ if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher)) - log_write(0, LOG_MAIN, "Received TLS status callback, null content"); + log_write(0, LOG_MAIN, "Required TLS certificate status not received"); else DEBUG(D_tls) debug_printf(" null\n"); return cbinfo->u_ocsp.client.verify_required ? 0 : 1; } -if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len))) - { - tls_out.ocsp = OCSP_FAILED; +if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len))) + { + tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */ if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN, "Received TLS cert status response, parse error"); else DEBUG(D_tls) debug_printf(" parse error\n"); return 0; - } + } -if(!(bs = OCSP_response_get1_basic(rsp))) +if (!(bs = OCSP_response_get1_basic(rsp))) { tls_out.ocsp = OCSP_FAILED; if (LOGGING(tls_cipher)) @@ -1738,8 +1921,9 @@ if(!(bs = OCSP_response_get1_basic(rsp))) */ { BIO * bp = NULL; - int status, reason; - ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd; +#ifndef EXIM_HAVE_OCSP_RESP_COUNT + STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses; +#endif DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE); @@ -1749,19 +1933,23 @@ if(!(bs = OCSP_response_get1_basic(rsp))) /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */ if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack, - cbinfo->u_ocsp.client.verify_store, 0)) <= 0) - { - tls_out.ocsp = OCSP_FAILED; - if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN, - "Received TLS cert status response, itself unverifiable: %s", - ERR_reason_error_string(ERR_peek_error())); - BIO_printf(bp, "OCSP response verify failure\n"); - ERR_print_errors(bp); - OCSP_RESPONSE_print(bp, rsp, 0); - goto failed; - } + cbinfo->u_ocsp.client.verify_store, OCSP_NOEXPLICIT)) <= 0) + if (ERR_peek_error()) + { + tls_out.ocsp = OCSP_FAILED; + if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN, + "Received TLS cert status response, itself unverifiable: %s", + ERR_reason_error_string(ERR_peek_error())); + BIO_printf(bp, "OCSP response verify failure\n"); + ERR_print_errors(bp); + OCSP_RESPONSE_print(bp, rsp, 0); + goto failed; + } + else + DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing" + " in the root CA certificate; ignoring\n"); - BIO_printf(bp, "OCSP response well-formed and signed OK\n"); + DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n"); /*XXX So we have a good stapled OCSP status. How do we know it is for the cert of interest? OpenSSL 1.1.0 has a routine @@ -1771,60 +1959,65 @@ if(!(bs = OCSP_response_get1_basic(rsp))) For now, carry on blindly accepting the resp. */ - { - OCSP_SINGLERESP * single; - + for (int idx = #ifdef EXIM_HAVE_OCSP_RESP_COUNT - if (OCSP_resp_count(bs) != 1) + OCSP_resp_count(bs) - 1; #else - STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses; - if (sk_OCSP_SINGLERESP_num(sresp) != 1) + sk_OCSP_SINGLERESP_num(sresp) - 1; #endif - { - tls_out.ocsp = OCSP_FAILED; - log_write(0, LOG_MAIN, "OCSP stapling " - "with multiple responses not handled"); - goto failed; - } - single = OCSP_resp_get0(bs, 0); + idx >= 0; idx--) + { + OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx); + int status, reason; + ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd; + + /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp + - but what happens with a GnuTLS-style input? + + we could do with a debug label for each singleresp + - it has a certID with a serialNumber, but I see no API to get that + */ status = OCSP_single_get0_status(single, &reason, &rev, &thisupd, &nextupd); - } - DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd); - DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd); - if (!OCSP_check_validity(thisupd, nextupd, - EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE)) - { - tls_out.ocsp = OCSP_FAILED; - DEBUG(D_tls) ERR_print_errors(bp); - log_write(0, LOG_MAIN, "Server OSCP dates invalid"); - } - else - { + DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd); + DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd); + if (!OCSP_check_validity(thisupd, nextupd, + EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE)) + { + tls_out.ocsp = OCSP_FAILED; + DEBUG(D_tls) ERR_print_errors(bp); + log_write(0, LOG_MAIN, "Server OSCP dates invalid"); + goto failed; + } + DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n", OCSP_cert_status_str(status)); switch(status) { case V_OCSP_CERTSTATUS_GOOD: - tls_out.ocsp = OCSP_VFIED; - i = 1; - goto good; + continue; /* the idx loop */ case V_OCSP_CERTSTATUS_REVOKED: - tls_out.ocsp = OCSP_FAILED; log_write(0, LOG_MAIN, "Server certificate revoked%s%s", reason != -1 ? "; reason: " : "", reason != -1 ? OCSP_crl_reason_str(reason) : ""); DEBUG(D_tls) time_print(bp, "Revocation Time", rev); break; default: - tls_out.ocsp = OCSP_FAILED; log_write(0, LOG_MAIN, "Server certificate status unknown, in OCSP stapling"); break; } + + goto failed; } + + i = 1; + tls_out.ocsp = OCSP_VFIED; + goto good; + failed: + tls_out.ocsp = OCSP_FAILED; i = cbinfo->u_ocsp.client.verify_required ? 0 : 1; good: BIO_free(bp); @@ -1840,6 +2033,23 @@ return i; * Initialize for TLS * *************************************************/ +static void +tls_openssl_init(void) +{ +#ifdef EXIM_NEED_OPENSSL_INIT +SSL_load_error_strings(); /* basic set up */ +OpenSSL_add_ssl_algorithms(); +#endif + +#if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256) +/* SHA256 is becoming ever more popular. This makes sure it gets added to the +list of available digests. */ +EVP_add_digest(EVP_sha256()); +#endif +} + + + /* Called from both server and client code, to do preliminary initialization of the library. We allocate and return a context structure. @@ -1861,7 +2071,7 @@ static int tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate, uschar *privatekey, #ifndef DISABLE_OCSP - uschar *ocsp_file, /*XXX stack, in server*/ + uschar *ocsp_file, #endif address_item *addr, tls_ext_ctx_cb ** cbp, tls_support * tlsp, @@ -1883,7 +2093,7 @@ if (!host) { cbinfo->u_ocsp.server.file = ocsp_file; cbinfo->u_ocsp.server.file_expanded = NULL; - cbinfo->u_ocsp.server.response = NULL; + cbinfo->u_ocsp.server.olist = NULL; } else cbinfo->u_ocsp.client.verify_store = NULL; @@ -1895,16 +2105,7 @@ cbinfo->host = host; cbinfo->event_action = NULL; #endif -#ifdef EXIM_NEED_OPENSSL_INIT -SSL_load_error_strings(); /* basic set up */ -OpenSSL_add_ssl_algorithms(); -#endif - -#ifdef EXIM_HAVE_SHA256 -/* SHA256 is becoming ever more popular. This makes sure it gets added to the -list of available digests. */ -EVP_add_digest(EVP_sha256()); -#endif +tls_openssl_init(); /* Create a context. The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant @@ -1974,12 +2175,12 @@ availability of the option value macros from OpenSSL. */ if (!tls_openssl_options_parse(openssl_options, &init_options)) return tls_error(US"openssl_options parsing failed", host, NULL, errstr); -#ifdef EXPERIMENTAL_TLS_RESUME +#ifndef DISABLE_TLS_RESUME tlsp->resumption = RESUME_SUPPORTED; #endif if (init_options) { -#ifdef EXPERIMENTAL_TLS_RESUME +#ifndef DISABLE_TLS_RESUME /* Should the server offer session resumption? */ if (!host && verify_check_host(&tls_resumption_hosts) == OK) { @@ -2035,7 +2236,7 @@ if ((rc = tls_expand_session_files(ctx, cbinfo, errstr)) != OK) if (!host) /* server */ { # ifndef DISABLE_OCSP - /* We check u_ocsp.server.file, not server.response, because we care about if + /* We check u_ocsp.server.file, not server.olist, because we care about if the option exists, not what the current expansion might be, as SNI might change the certificate and OCSP file in use between now and the time the callback is invoked. */ @@ -2098,14 +2299,13 @@ Returns: pointer to allocated string in perm-pool */ static uschar * -construct_cipher_name(SSL * ssl, int * bits) +construct_cipher_name(SSL * ssl, const uschar * ver, int * bits) { int pool = store_pool; /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't yet reflect that. It should be a safe change anyway, even 0.9.8 versions have the accessor functions use const in the prototype. */ -const uschar * ver = CUS SSL_get_version(ssl); const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl); uschar * s; @@ -2136,6 +2336,21 @@ return cipher_stdname(id >> 8, id & 0xff); } +static const uschar * +tlsver_name(SSL * ssl) +{ +uschar * s, * p; +int pool = store_pool; + +store_pool = POOL_PERM; +s = string_copy(US SSL_get_version(ssl)); +store_pool = pool; +if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */ + for (;; p++) if (!(*p = p[1])) break; +return CUS s; +} + + static void peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz) { @@ -2168,10 +2383,15 @@ if (tlsp->peercert) when it actually failed but we're in try-verify mode, due to us wanting the knowlege that it failed so needing to have the callback and forcing a permissive return. If we don't force it, the TLS startup is failed. - Hence the verify_override bodge - though still a problem for resumption. */ + The extra bit of information is set in verify_override in the cb, stashed + for resumption next to the TLS session, and used here. */ if (!tlsp->verify_override) - tlsp->certificate_verified = SSL_get_verify_result(ssl) == X509_V_OK; + tlsp->certificate_verified = +#ifdef SUPPORT_DANE + tlsp->dane_verified || +#endif + SSL_get_verify_result(ssl) == X509_V_OK; } } @@ -2261,6 +2481,10 @@ if (expcerts && *expcerts) /* In the server if we will be offering an OCSP proof, load chain from file for verifying the OCSP proof at load time. */ +/*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert. +This is inconsistent with the need to verify the OCSP proof of the server cert. +*/ + if ( !host && statbuf.st_size > 0 && server_static_cbinfo->u_ocsp.server.file @@ -2274,7 +2498,7 @@ if (expcerts && *expcerts) #endif } - /* If a certificate file is empty, the next function fails with an + /* If a certificate file is empty, the load function fails with an unhelpful error message. If we skip it, we get the correct behaviour (no certificates are recognized, but the error message is still misleading (it says no certificate was supplied). But this is better. */ @@ -2283,9 +2507,9 @@ if (expcerts && *expcerts) && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir)) return tls_error(US"SSL_CTX_load_verify_locations", host, NULL, errstr); - /* Load the list of CAs for which we will accept certs, for sending - to the client. This is only for the one-file tls_verify_certificates - variant. + /* On the server load the list of CAs for which we will accept certs, for + sending to the client. This is only for the one-file + tls_verify_certificates variant. If a list isn't loaded into the server, but some verify locations are set, the server end appears to make a wildcard request for client certs. Meanwhile, the client library as default behaviour *ignores* the list @@ -2297,7 +2521,7 @@ if (expcerts && *expcerts) { STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file); - SSL_CTX_set_client_CA_list(sctx, names); + if (!host) SSL_CTX_set_client_CA_list(sctx, names); DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", sk_X509_NAME_num(names)); } @@ -2409,7 +2633,7 @@ the error. */ rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey, #ifndef DISABLE_OCSP - tls_ocsp_file, /*XXX stack*/ + tls_ocsp_file, #endif NULL, &server_static_cbinfo, &tls_in, errstr); if (rc != OK) return rc; @@ -2460,12 +2684,12 @@ else if (verify_check_host(&tls_try_verify_hosts) == OK) server_verify_optional = TRUE; } -#ifdef EXPERIMENTAL_TLS_RESUME +#ifndef DISABLE_TLS_RESUME SSL_CTX_set_tlsext_ticket_key_cb(server_ctx, ticket_key_callback); /* despite working, appears to always return failure, so ignoring */ #endif #ifdef OPENSSL_HAVE_NUM_TICKETS -# ifdef EXPERIMENTAL_TLS_RESUME +# ifndef DISABLE_TLS_RESUME SSL_CTX_set_num_tickets(server_ctx, tls_in.host_resumable ? 1 : 0); # else SSL_CTX_set_num_tickets(server_ctx, 0); /* send no TLS1.3 stateful-tickets */ @@ -2513,6 +2737,7 @@ SSL_set_accept_state(server_ssl); DEBUG(D_tls) debug_printf("Calling SSL_accept\n"); +ERR_clear_error(); sigalrm_seen = FALSE; if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout); rc = SSL_accept(server_ssl); @@ -2520,15 +2745,61 @@ ALARM_CLR(0); if (rc <= 0) { - (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr); - return FAIL; + int error = SSL_get_error(server_ssl, rc); + switch(error) + { + case SSL_ERROR_NONE: + break; + + case SSL_ERROR_ZERO_RETURN: + DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n"); + (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr); + + if (SSL_get_shutdown(server_ssl) == SSL_RECEIVED_SHUTDOWN) + SSL_shutdown(server_ssl); + + tls_close(NULL, TLS_NO_SHUTDOWN); + return FAIL; + + /* Handle genuine errors */ + case SSL_ERROR_SSL: + { + uschar * s = US"SSL_accept"; + int r = ERR_GET_REASON(ERR_peek_error()); + if ( r == SSL_R_WRONG_VERSION_NUMBER +#ifdef SSL_R_VERSION_TOO_LOW + || r == SSL_R_VERSION_TOO_LOW +#endif + || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL) + s = string_sprintf("%s (%s)", s, SSL_get_version(server_ssl)); + (void) tls_error(s, NULL, sigalrm_seen ? US"timed out" : NULL, errstr); + return FAIL; + } + + default: + DEBUG(D_tls) debug_printf("Got SSL error %d\n", error); + if (error == SSL_ERROR_SYSCALL) + { + if (!errno) + { + *errstr = US"SSL_accept: TCP connection closed by peer"; + return FAIL; + } + DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno)); + } + (void) tls_error(US"SSL_accept", NULL, + sigalrm_seen ? US"timed out" + : ERR_peek_error() ? NULL : string_sprintf("ret %d", error), + errstr); + return FAIL; + } } DEBUG(D_tls) debug_printf("SSL_accept was successful\n"); ERR_clear_error(); /* Even success can leave errors in the stack. Seen with anon-authentication ciphersuite negotiated. */ -#ifdef EXPERIMENTAL_TLS_RESUME +#ifndef DISABLE_TLS_RESUME if (SSL_session_reused(server_ssl)) { tls_in.resumption |= RESUME_USED; @@ -2536,12 +2807,16 @@ if (SSL_session_reused(server_ssl)) } #endif -/* TLS has been set up. Adjust the input functions to read via TLS, -and initialize things. */ +/* TLS has been set up. Record data for the connection, +adjust the input functions to read via TLS, and initialize things. */ +#ifdef SSL_get_extms_support +tls_in.ext_master_secret = SSL_get_extms_support(server_ssl) == 1; +#endif peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn)); -tls_in.cipher = construct_cipher_name(server_ssl, &tls_in.bits); +tls_in.ver = tlsver_name(server_ssl); +tls_in.cipher = construct_cipher_name(server_ssl, tls_in.ver, &tls_in.bits); tls_in.cipher_stdname = cipher_stdname_ssl(server_ssl); DEBUG(D_tls) @@ -2574,6 +2849,20 @@ DEBUG(D_tls) tls_in.ourcert = crt ? X509_dup(crt) : NULL; } +/* Channel-binding info for authenticators +See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/ */ + { + uschar c, * s; + size_t len = SSL_get_peer_finished(server_ssl, &c, 0); + int old_pool = store_pool; + + SSL_get_peer_finished(server_ssl, s = store_get((int)len, FALSE), len); + store_pool = POOL_PERM; + tls_in.channelbinding = b64encode_taint(CUS s, (int)len, FALSE); + store_pool = old_pool; + DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p\n", tls_in.channelbinding); + } + /* Only used by the server-side tls (tls_in), including tls_getc. Client-side (tls_out) reads (seem to?) go via smtp_read_response()/ip_recv(). @@ -2629,9 +2918,9 @@ if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK) { cbinfo->verify_cert_hostnames = #ifdef SUPPORT_I18N - string_domain_utf8_to_alabel(host->name, NULL); + string_domain_utf8_to_alabel(host->certname, NULL); #else - host->name; + host->certname; #endif DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n", cbinfo->verify_cert_hostnames); @@ -2697,7 +2986,7 @@ return DEFER; -#ifdef EXPERIMENTAL_TLS_RESUME +#ifndef DISABLE_TLS_RESUME /* On the client, get any stashed session for the given IP from hints db and apply it to the ssl-connection for attempted resumption. */ @@ -2713,7 +3002,7 @@ if (tlsp->host_resumable) tlsp->resumption |= RESUME_CLIENT_REQUESTED; DEBUG(D_tls) debug_printf("checking for resumable session for %s\n", key); - if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE))) + if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE))) { /* key for the db is the IP */ if ((dt = dbfn_read_with_length(dbm_file, key, &len))) @@ -2731,12 +3020,14 @@ if (tlsp->host_resumable) debug_printf("decoding session: %s\n", ssl_errstring); } } +#ifdef EXIM_HAVE_SESSION_TICKET else if ( SSL_SESSION_get_ticket_lifetime_hint(ss) + dt->time_stamp < time(NULL)) { DEBUG(D_tls) debug_printf("session expired\n"); dbfn_delete(dbm_file, key); } +#endif else if (!SSL_set_session(ssl, ss)) { DEBUG(D_tls) @@ -2750,6 +3041,8 @@ if (tlsp->host_resumable) { DEBUG(D_tls) debug_printf("good session\n"); tlsp->resumption |= RESUME_CLIENT_SUGGESTED; + tlsp->verify_override = dt->verify_override; + tlsp->ocsp = dt->ocsp; } } else @@ -2778,14 +3071,16 @@ if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */ { int len = i2d_SSL_SESSION(ss, NULL); int dlen = sizeof(dbdata_tls_session) + len; - dbdata_tls_session * dt = store_get(dlen); + dbdata_tls_session * dt = store_get(dlen, TRUE); uschar * s = dt->session; open_db dbblock, * dbm_file; DEBUG(D_tls) debug_printf("session is resumable\n"); tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */ - len = i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */ + dt->verify_override = tlsp->verify_override; + dt->ocsp = tlsp->ocsp; + (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */ if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE))) { @@ -2853,7 +3148,7 @@ if (SSL_session_reused(exim_client_ctx->ssl)) tlsp->resumption |= RESUME_USED; } } -#endif /* EXPERIMENTAL_TLS_RESUME */ +#endif /* !DISABLE_TLS_RESUME */ /************************************************* @@ -2894,7 +3189,7 @@ BOOL require_ocsp = FALSE; rc = store_pool; store_pool = POOL_PERM; -exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx)); +exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), FALSE); exim_client_ctx->corked = NULL; store_pool = rc; @@ -3002,7 +3297,7 @@ else client_static_cbinfo, errstr) != OK) return FALSE; -#ifdef EXPERIMENTAL_TLS_RESUME +#ifndef DISABLE_TLS_RESUME tls_client_ctx_resume_prehandshake(exim_client_ctx, tlsp, ob, host); #endif @@ -3014,12 +3309,6 @@ if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx))) } SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx)); -#ifdef EXPERIMENTAL_TLS_RESUME -if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host, - errstr)) - return FALSE; -#endif - SSL_set_fd(exim_client_ctx->ssl, cctx->sock); SSL_set_connect_state(exim_client_ctx->ssl); @@ -3079,6 +3368,12 @@ if (request_ocsp) } #endif +#ifndef DISABLE_TLS_RESUME +if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host, + errstr)) + return FALSE; +#endif + #ifndef DISABLE_EVENT client_static_cbinfo->event_action = tb ? tb->event_action : NULL; #endif @@ -3114,13 +3409,17 @@ DEBUG(D_tls) #endif } -#ifdef EXPERIMENTAL_TLS_RESUME +#ifndef DISABLE_TLS_RESUME tls_client_resume_posthandshake(exim_client_ctx, tlsp); #endif +#ifdef SSL_get_extms_support +tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1; +#endif peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn)); -tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, &tlsp->bits); +tlsp->ver = tlsver_name(exim_client_ctx->ssl); +tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits); tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl); /* Record the certificate we presented */ @@ -3129,6 +3428,20 @@ tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl); tlsp->ourcert = crt ? X509_dup(crt) : NULL; } +/*XXX will this work with continued-TLS? */ +/* Channel-binding info for authenticators */ + { + uschar c, * s; + size_t len = SSL_get_finished(exim_client_ctx->ssl, &c, 0); + int old_pool = store_pool; + + SSL_get_finished(exim_client_ctx->ssl, s = store_get((int)len, TRUE), len); + store_pool = POOL_PERM; + tlsp->channelbinding = b64encode_taint(CUS s, (int)len, TRUE); + store_pool = old_pool; + DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp); + } + tlsp->active.sock = cctx->sock; tlsp->active.tls_ctx = exim_client_ctx; cctx->tls_ctx = exim_client_ctx; @@ -3148,6 +3461,7 @@ int inbytes; DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl, ssl_xfer_buffer, ssl_xfer_buffer_size); +ERR_clear_error(); if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout); inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, MIN(ssl_xfer_buffer_size, lim)); @@ -3175,32 +3489,10 @@ switch(error) case SSL_ERROR_ZERO_RETURN: DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n"); - receive_getc = smtp_getc; - receive_getbuf = smtp_getbuf; - receive_get_cache = smtp_get_cache; - receive_ungetc = smtp_ungetc; - receive_feof = smtp_feof; - receive_ferror = smtp_ferror; - receive_smtp_buffered = smtp_buffered; - if (SSL_get_shutdown(server_ssl) == SSL_RECEIVED_SHUTDOWN) SSL_shutdown(server_ssl); -#ifndef DISABLE_OCSP - sk_X509_pop_free(server_static_cbinfo->verify_stack, X509_free); - server_static_cbinfo->verify_stack = NULL; -#endif - SSL_free(server_ssl); - SSL_CTX_free(server_ctx); - server_ctx = NULL; - server_ssl = NULL; - tls_in.active.sock = -1; - tls_in.active.tls_ctx = NULL; - tls_in.bits = 0; - tls_in.cipher = NULL; - tls_in.peerdn = NULL; - tls_in.sni = NULL; - + tls_close(NULL, TLS_NO_SHUTDOWN); return FALSE; /* Handle genuine errors */ @@ -3319,6 +3611,7 @@ int error; DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl, buff, (unsigned int)len); +ERR_clear_error(); inbytes = SSL_read(ssl, CS buff, len); error = SSL_get_error(ssl, inbytes); @@ -3351,11 +3644,12 @@ Arguments: Returns: the number of bytes after a successful write, -1 after a failed write -Used by both server-side and client-side TLS. +Used by both server-side and client-side TLS. Calling with len zero and more unset +will flush buffered writes; buff can be null for this case. */ int -tls_write(void * ct_ctx, const uschar *buff, size_t len, BOOL more) +tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more) { size_t olen = len; int outbytes, error; @@ -3379,16 +3673,18 @@ context for the stashed information. */ a store reset there, so use POOL_PERM. */ /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */ -if ((more || corked)) +if (more || corked) { -#ifdef EXPERIMENTAL_PIPE_CONNECT + if (!len) buff = US &error; /* dummy just so that string_catn is ok */ + +#ifndef DISABLE_PIPE_CONNECT int save_pool = store_pool; store_pool = POOL_PERM; #endif corked = string_catn(corked, buff, len); -#ifdef EXPERIMENTAL_PIPE_CONNECT +#ifndef DISABLE_PIPE_CONNECT store_pool = save_pool; #endif @@ -3405,29 +3701,37 @@ if ((more || corked)) for (int left = len; left > 0;) { DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left); + ERR_clear_error(); outbytes = SSL_write(ssl, CS buff, left); error = SSL_get_error(ssl, outbytes); DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error); switch (error) { + case SSL_ERROR_NONE: /* the usual case */ + left -= outbytes; + buff += outbytes; + break; + case SSL_ERROR_SSL: ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring)); log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring); return -1; - case SSL_ERROR_NONE: - left -= outbytes; - buff += outbytes; - break; - case SSL_ERROR_ZERO_RETURN: log_write(0, LOG_MAIN, "SSL channel closed on write"); return -1; case SSL_ERROR_SYSCALL: - log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s", - sender_fullhost ? sender_fullhost : US"", - strerror(errno)); + if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit) + log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s", + sender_fullhost ? sender_fullhost : US"", + strerror(errno)); + else if (LOGGING(protocol_detail)) + log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before" + " SMTP response and TLS close\n", sender_host_address); + else + DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT," + " client reset TCP before TLS close\n", sender_host_address); return -1; default: @@ -3489,14 +3793,25 @@ if (shutdown) } } -#ifndef DISABLE_OCSP if (!o_ctx) /* server side */ { +#ifndef DISABLE_OCSP sk_X509_pop_free(server_static_cbinfo->verify_stack, X509_free); server_static_cbinfo->verify_stack = NULL; - } #endif + receive_getc = smtp_getc; + receive_getbuf = smtp_getbuf; + receive_get_cache = smtp_get_cache; + receive_ungetc = smtp_ungetc; + receive_feof = smtp_feof; + receive_ferror = smtp_ferror; + receive_smtp_buffered = smtp_buffered; + tls_in.active.tls_ctx = NULL; + tls_in.sni = NULL; + /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */ + } + SSL_CTX_free(*ctxp); SSL_free(*sslp); *ctxp = NULL; @@ -3523,18 +3838,7 @@ tls_validate_require_cipher(void) SSL_CTX *ctx; uschar *s, *expciphers, *err; -/* this duplicates from tls_init(), we need a better "init just global -state, for no specific purpose" singleton function of our own */ - -#ifdef EXIM_NEED_OPENSSL_INIT -SSL_load_error_strings(); -OpenSSL_add_ssl_algorithms(); -#endif -#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256) -/* SHA256 is becoming ever more popular. This makes sure it gets added to the -list of available digests. */ -EVP_add_digest(EVP_sha256()); -#endif +tls_openssl_init(); if (!(tls_require_ciphers && *tls_require_ciphers)) return NULL; @@ -3762,7 +4066,7 @@ BOOL tls_openssl_options_parse(uschar *option_spec, long *results) { long result, item; -uschar *end; +uschar * exp, * end; uschar keep_c; BOOL adding, item_parsed; @@ -3770,7 +4074,7 @@ BOOL adding, item_parsed; result = SSL_OP_NO_TICKET; /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed - * from default because it increases BEAST susceptibility. */ +from default because it increases BEAST susceptibility. */ #ifdef SSL_OP_NO_SSLv2 result |= SSL_OP_NO_SSLv2; #endif @@ -3780,6 +4084,9 @@ result |= SSL_OP_NO_SSLv3; #ifdef SSL_OP_SINGLE_DH_USE result |= SSL_OP_SINGLE_DH_USE; #endif +#ifdef SSL_OP_NO_RENEGOTIATION +result |= SSL_OP_NO_RENEGOTIATION; +#endif if (!option_spec) { @@ -3787,7 +4094,10 @@ if (!option_spec) return TRUE; } -for (uschar * s = option_spec; *s; /**/) +if (!expand_check(option_spec, US"openssl_options", &exp, &end)) + return FALSE; + +for (uschar * s = exp; *s; /**/) { while (isspace(*s)) ++s; if (*s == '\0') @@ -3809,7 +4119,7 @@ for (uschar * s = option_spec; *s; /**/) DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s); return FALSE; } - DEBUG(D_tls) debug_printf("openssl option, %s %8lx: %lx (%s)\n", + DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n", adding ? "adding to " : "removing from", result, item, s); if (adding) result |= item;