Increase limit on SMTP confirmation message copy size. Bug 1572

[users/jgh/exim.git] / src / src / tls-openssl.c

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index ce6b47832843b06b17c4b804f11029b3f954be8e..96ac72c3c16cabdea5a1b4b5764835164a89b222 100644 (file)
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -123,7 +123,7 @@ typedef struct tls_ext_ctx_cb {
   uschar *server_cipher_list;
   /* only passed down to tls_error: */
   host_item *host;
   uschar *server_cipher_list;
   /* only passed down to tls_error: */
   host_item *host;

-  uschar * verify_cert_hostnames;
+  const uschar * verify_cert_hostnames;

 #ifdef EXPERIMENTAL_EVENT
   uschar * event_action;
 #endif
 #ifdef EXPERIMENTAL_EVENT
   uschar * event_action;
 #endif


@@ -245,6 +245,7 @@ for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
     {
     X509 * current_cert= tmp_obj->data.x509;
     X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
     {
     X509 * current_cert= tmp_obj->data.x509;
     X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));

+       name[sizeof(name)-1] = '\0';

     debug_printf(" %s\n", name);
     }
   }
     debug_printf(" %s\n", name);
     }
   }


@@ -253,21 +254,58 @@ for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
 */
 
 
 */
 
 

+#ifdef EXPERIMENTAL_EVENT
+static int
+verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
+  BOOL *calledp, const BOOL *optionalp, const uschar * what)
+{
+uschar * ev;
+uschar * yield;
+X509 * old_cert;
+
+ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
+if (ev)
+  {
+  old_cert = tlsp->peercert;
+  tlsp->peercert = X509_dup(cert);
+  /* NB we do not bother setting peerdn */
+  if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
+    {
+    log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
+               "depth=%d cert=%s: %s",
+             tlsp == &tls_out ? deliver_host_address : sender_host_address,
+             what, depth, dn, yield);
+    *calledp = TRUE;
+    if (!*optionalp)
+      {
+      if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
+      return 1;                            /* reject (leaving peercert set) */
+      }
+    DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
+      "(host in tls_try_verify_hosts)\n");
+    }
+  X509_free(tlsp->peercert);
+  tlsp->peercert = old_cert;
+  }
+return 0;
+}
+#endif
+

 /*************************************************
 *        Callback for verification               *
 *************************************************/
 
 /* The SSL library does certificate verification if set up to do so. This
 callback has the current yes/no state is in "state". If verification succeeded,
 /*************************************************
 *        Callback for verification               *
 *************************************************/
 
 /* The SSL library does certificate verification if set up to do so. This
 callback has the current yes/no state is in "state". If verification succeeded,

-we set up the tls_peerdn string. If verification failed, what happens depends
-on whether the client is required to present a verifiable certificate or not.
+we set the certificate-verified flag. If verification failed, what happens
+depends on whether the client is required to present a verifiable certificate
+or not.

 
 If verification is optional, we change the state to yes, but still log the
 verification error. For some reason (it really would help to have proper
 documentation of OpenSSL), this callback function then gets called again, this
 
 If verification is optional, we change the state to yes, but still log the
 verification error. For some reason (it really would help to have proper
 documentation of OpenSSL), this callback function then gets called again, this

-time with state = 1. In fact, that's useful, because we can set up the peerdn
-value, but we must take care not to set the private verified flag on the second
-time through.
+time with state = 1.  We must take care not to set the private verified flag on
+the second time through.

 
 Note: this function is not called if the client fails to present a certificate
 when asked. We get here only if a certificate has been received. Handling of
 
 Note: this function is not called if the client fails to present a certificate
 when asked. We get here only if a certificate has been received. Handling of


@@ -291,25 +329,24 @@ verify_callback(int state, X509_STORE_CTX *x509ctx,
 {
 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 {
 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 int depth = X509_STORE_CTX_get_error_depth(x509ctx);

-static uschar txt[256];
-#ifdef EXPERIMENTAL_EVENT
-uschar * ev;
-uschar * yield;
-#endif
+uschar dn[256];

 
 

-X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
+X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
+dn[sizeof(dn)-1] = '\0';

 
 if (state == 0)
   {
 
 if (state == 0)
   {

-  log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
+  log_write(0, LOG_MAIN, "[%s] SSL verify error: depth=%d error=%s cert=%s",
+       tlsp == &tls_out ? deliver_host_address : sender_host_address,

     depth,
     X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
     depth,
     X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),

-    txt);
+    dn);

   *calledp = TRUE;
   if (!*optionalp)
     {
   *calledp = TRUE;
   if (!*optionalp)
     {

-    tlsp->peercert = X509_dup(cert);
-    return 0;                      /* reject */
+    if (!tlsp->peercert)
+      tlsp->peercert = X509_dup(cert); /* record failing cert */
+    return 0;                          /* reject */

     }
   DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
     "tls_try_verify_hosts)\n");
     }
   DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
     "tls_try_verify_hosts)\n");


@@ -317,7 +354,7 @@ if (state == 0)
 
 else if (depth != 0)
   {
 
 else if (depth != 0)
   {

-  DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, txt);
+  DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);

 #ifndef DISABLE_OCSP
   if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
     {  /* client, wanting stapling  */
 #ifndef DISABLE_OCSP
   if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
     {  /* client, wanting stapling  */


@@ -330,46 +367,28 @@ else if (depth != 0)
     }
 #endif
 #ifdef EXPERIMENTAL_EVENT
     }
 #endif
 #ifdef EXPERIMENTAL_EVENT

-  ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
-  if (ev)
-    {
-    tlsp->peercert = X509_dup(cert);
-    if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
-      {
-      log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
-                             "depth=%d cert=%s: %s", depth, txt, yield);
-      *calledp = TRUE;
-      if (!*optionalp)
-       return 0;                           /* reject */
-      DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
-       "(host in tls_try_verify_hosts)\n");
-      }
-    X509_free(tlsp->peercert);
-    tlsp->peercert = NULL;
-    }
+    if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
+      return 0;                                /* reject, with peercert set */

 #endif
   }
 else
   {
 #endif
   }
 else
   {

-  uschar * verify_cert_hostnames;
-
-  tlsp->peerdn = txt;
-  tlsp->peercert = X509_dup(cert);
+  const uschar * verify_cert_hostnames;

 
   if (  tlsp == &tls_out
      && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
        /* client, wanting hostname check */
 
   if (  tlsp == &tls_out
      && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
        /* client, wanting hostname check */

-
-# if EXIM_HAVE_OPENSSL_CHECKHOST
-#  ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
-#   define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
-#  endif
-#  ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
-#   define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
-#  endif

     {
     {

+
+#if EXIM_HAVE_OPENSSL_CHECKHOST
+# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
+#  define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
+# endif
+# ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
+#  define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
+# endif

     int sep = 0;
     int sep = 0;

-    uschar * list = verify_cert_hostnames;
+    const uschar * list = verify_cert_hostnames;

     uschar * name;
     int rc;
     while ((name = string_nextinlist(&list, &sep, NULL, 0)))
     uschar * name;
     int rc;
     while ((name = string_nextinlist(&list, &sep, NULL, 0)))


@@ -379,52 +398,40 @@ else
        {
        if (rc < 0)
          {
        {
        if (rc < 0)
          {

-         log_write(0, LOG_MAIN, "SSL verify error: internal error\n");
+         log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
+               tlsp == &tls_out ? deliver_host_address : sender_host_address);

          name = NULL;
          }
        break;
        }
     if (!name)
          name = NULL;
          }
        break;
        }
     if (!name)

-      {
-      log_write(0, LOG_MAIN,
-       "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
-      *calledp = TRUE;
-      if (!*optionalp)
-       return 0;                           /* reject */
-      DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
-       "tls_try_verify_hosts)\n");
-      }
-    }
-# else
+#else

     if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
     if (!tls_is_name_for_cert(verify_cert_hostnames, cert))

+#endif

       {
       log_write(0, LOG_MAIN,
       {
       log_write(0, LOG_MAIN,

-       "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
+               "[%s] SSL verify error: certificate name mismatch: \"%s\"",
+               tlsp == &tls_out ? deliver_host_address : sender_host_address,
+               dn);

       *calledp = TRUE;
       if (!*optionalp)
       *calledp = TRUE;
       if (!*optionalp)

-       return 0;                           /* reject */
+       {
+       if (!tlsp->peercert)
+         tlsp->peercert = X509_dup(cert);      /* record failing cert */
+       return 0;                               /* reject */
+       }

       DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
        "tls_try_verify_hosts)\n");
       }
       DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
        "tls_try_verify_hosts)\n");
       }

-# endif
+    }

 
 #ifdef EXPERIMENTAL_EVENT
 
 #ifdef EXPERIMENTAL_EVENT

-  ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
-  if (ev)
-    if ((yield = event_raise(ev, US"tls:cert", US"0")))
-      {
-      log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
-                             "depth=0 cert=%s: %s", txt, yield);
-      *calledp = TRUE;
-      if (!*optionalp)
-       return 0;                           /* reject */
-      DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
-       "(host in tls_try_verify_hosts)\n");
-      }
+  if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
+    return 0;                          /* reject, with peercert set */

 #endif
 
   DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
 #endif
 
   DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",

-    *calledp ? "" : " authenticated", txt);
+    *calledp ? "" : " authenticated", dn);

   if (!*calledp) tlsp->certificate_verified = TRUE;
   *calledp = TRUE;
   }
   if (!*calledp) tlsp->certificate_verified = TRUE;
   *calledp = TRUE;
   }


@@ -454,35 +461,22 @@ static int
 verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
 {
 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
 {
 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);

-static uschar txt[256];
+uschar dn[256];

 #ifdef EXPERIMENTAL_EVENT
 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 uschar * yield;
 #ifdef EXPERIMENTAL_EVENT
 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 uschar * yield;

+BOOL dummy_called, optional = FALSE;

 #endif
 
 #endif
 

-X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
+X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
+dn[sizeof(dn)-1] = '\0';

 
 

-DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", txt);
-tls_out.peerdn = txt;
-tls_out.peercert = X509_dup(cert);
+DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", dn);

 
 #ifdef EXPERIMENTAL_EVENT
 
 #ifdef EXPERIMENTAL_EVENT

-  if (client_static_cbinfo->event_action)
-    {
-    if ((yield = event_raise(client_static_cbinfo->event_action,
-                   US"tls:cert", string_sprintf("%d", depth))))
-      {
-      log_write(0, LOG_MAIN, "DANE verify denied by event-action: "
-                             "depth=%d cert=%s: %s", depth, txt, yield);
-      tls_out.certificate_verified = FALSE;
-      return 0;                            /* reject */
-      }
-    if (depth != 0)
-      {
-      X509_free(tls_out.peercert);
-      tls_out.peercert = NULL;
-      }
-    }
+  if (verify_event(&tls_out, cert, depth, dn,
+         &dummy_called, &optional, US"DANE"))
+    return 0;                          /* reject, with peercert set */

 #endif
 
 if (state == 1)
 #endif
 
 if (state == 1)


@@ -1210,7 +1204,7 @@ if (!RAND_status())
 /* Set up the information callback, which outputs if debugging is at a suitable
 level. */
 
 /* Set up the information callback, which outputs if debugging is at a suitable
 level. */
 

-SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
+DEBUG(D_tls) SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);

 
 /* Automatically re-try reads/writes after renegotiation. */
 (void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
 
 /* Automatically re-try reads/writes after renegotiation. */
 (void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);


@@ -1334,6 +1328,29 @@ DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
 }
 
 
 }
 
 

+static void
+peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned bsize)
+{
+/*XXX we might consider a list-of-certs variable for the cert chain.
+SSL_get_peer_cert_chain(SSL*).  We'd need a new variable type and support
+in list-handling functions, also consider the difference between the entire
+chain and the elements sent by the peer. */
+
+/* Will have already noted peercert on a verify fail; possibly not the leaf */
+if (!tlsp->peercert)
+  tlsp->peercert = SSL_get_peer_certificate(ssl);
+/* Beware anonymous ciphers which lead to server_cert being NULL */
+if (tlsp->peercert)
+  {
+  X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, bsize);
+  peerdn[bsize-1] = '\0';
+  tlsp->peerdn = peerdn;               /*XXX a static buffer... */
+  }
+else
+  tlsp->peerdn = NULL;
+}
+
+

 
 
 
 
 
 


@@ -1516,6 +1533,8 @@ tls_server_start(const uschar *require_ciphers)
 int rc;
 uschar *expciphers;
 tls_ext_ctx_cb *cbinfo;
 int rc;
 uschar *expciphers;
 tls_ext_ctx_cb *cbinfo;

+X509 * peercert;
+static uschar peerdn[256];

 static uschar cipherbuf[256];
 
 /* Check for previous activation */
 static uschar cipherbuf[256];
 
 /* Check for previous activation */


@@ -1638,6 +1657,8 @@ DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
 /* TLS has been set up. Adjust the input functions to read via TLS,
 and initialize things. */
 
 /* TLS has been set up. Adjust the input functions to read via TLS,
 and initialize things. */
 

+peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
+

 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
 tls_in.cipher = cipherbuf;
 
 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
 tls_in.cipher = cipherbuf;
 


@@ -1764,7 +1785,7 @@ if (found)
   return OK;
 
 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
   return OK;
 
 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");

-return FAIL;
+return DEFER;

 }
 #endif /*EXPERIMENTAL_DANE*/
 
 }
 #endif /*EXPERIMENTAL_DANE*/
 


@@ -1798,9 +1819,8 @@ tls_client_start(int fd, host_item *host, address_item *addr,
 {
 smtp_transport_options_block * ob =
   (smtp_transport_options_block *)tb->options_block;
 {
 smtp_transport_options_block * ob =
   (smtp_transport_options_block *)tb->options_block;

-static uschar txt[256];
+static uschar peerdn[256];

 uschar * expciphers;
 uschar * expciphers;

-X509 * server_cert;

 int rc;
 static uschar cipherbuf[256];
 
 int rc;
 static uschar cipherbuf[256];
 


@@ -1974,17 +1994,7 @@ if (rc <= 0)
 
 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
 
 
 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
 

-/* Beware anonymous ciphers which lead to server_cert being NULL */
-/*XXX server_cert is never freed... use X509_free() */
-server_cert = SSL_get_peer_certificate (client_ssl);
-if (server_cert)
-  {
-  tls_out.peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
-    CS txt, sizeof(txt));
-  tls_out.peerdn = txt;                /*XXX a static buffer... */
-  }
-else
-  tls_out.peerdn = NULL;
+peer_cert(client_ssl, &tls_out, peerdn, sizeof(peerdn));

 
 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
 tls_out.cipher = cipherbuf;
 
 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
 tls_out.cipher = cipherbuf;