tls_client.c revision 1.8
1/* $NetBSD: tls_client.c,v 1.8 2013/09/25 19:12:35 tron Exp $ */ 2 3/*++ 4/* NAME 5/* tls_client 6/* SUMMARY 7/* client-side TLS engine 8/* SYNOPSIS 9/* #include <tls.h> 10/* 11/* TLS_APPL_STATE *tls_client_init(init_props) 12/* const TLS_CLIENT_INIT_PROPS *init_props; 13/* 14/* TLS_SESS_STATE *tls_client_start(start_props) 15/* const TLS_CLIENT_START_PROPS *start_props; 16/* 17/* void tls_client_stop(app_ctx, stream, failure, TLScontext) 18/* TLS_APPL_STATE *app_ctx; 19/* VSTREAM *stream; 20/* int failure; 21/* TLS_SESS_STATE *TLScontext; 22/* DESCRIPTION 23/* This module is the interface between Postfix TLS clients, 24/* the OpenSSL library and the TLS entropy and cache manager. 25/* 26/* The SMTP client will attempt to verify the server hostname 27/* against the names listed in the server certificate. When 28/* a hostname match is required, the verification fails 29/* on certificate verification or hostname mis-match errors. 30/* When no hostname match is required, hostname verification 31/* failures are logged but they do not affect the TLS handshake 32/* or the SMTP session. 33/* 34/* The rules for peer name wild-card matching differ between 35/* RFC 2818 (HTTP over TLS) and RFC 2830 (LDAP over TLS), while 36/* RFC RFC3207 (SMTP over TLS) does not specify a rule at all. 37/* Postfix uses a restrictive match algorithm. One asterisk 38/* ('*') is allowed as the left-most component of a wild-card 39/* certificate name; it matches the left-most component of 40/* the peer hostname. 41/* 42/* Another area where RFCs aren't always explicit is the 43/* handling of dNSNames in peer certificates. RFC 3207 (SMTP 44/* over TLS) does not mention dNSNames. Postfix follows the 45/* strict rules in RFC 2818 (HTTP over TLS), section 3.1: The 46/* Subject Alternative Name/dNSName has precedence over 47/* CommonName. If at least one dNSName is provided, Postfix 48/* verifies those against the peer hostname and ignores the 49/* CommonName, otherwise Postfix verifies the CommonName 50/* against the peer hostname. 51/* 52/* tls_client_init() is called once when the SMTP client 53/* initializes. 54/* Certificate details are also decided during this phase, 55/* so peer-specific certificate selection is not possible. 56/* 57/* tls_client_start() activates the TLS session over an established 58/* stream. We expect that network buffers are flushed and 59/* the TLS handshake can begin immediately. 60/* 61/* tls_client_stop() sends the "close notify" alert via 62/* SSL_shutdown() to the peer and resets all connection specific 63/* TLS data. As RFC2487 does not specify a separate shutdown, it 64/* is assumed that the underlying TCP connection is shut down 65/* immediately afterwards. Any further writes to the channel will 66/* be discarded, and any further reads will report end-of-file. 67/* If the failure flag is set, no SSL_shutdown() handshake is performed. 68/* 69/* Once the TLS connection is initiated, information about the TLS 70/* state is available via the TLScontext structure: 71/* .IP TLScontext->protocol 72/* the protocol name (SSLv2, SSLv3, TLSv1), 73/* .IP TLScontext->cipher_name 74/* the cipher name (e.g. RC4/MD5), 75/* .IP TLScontext->cipher_usebits 76/* the number of bits actually used (e.g. 40), 77/* .IP TLScontext->cipher_algbits 78/* the number of bits the algorithm is based on (e.g. 128). 79/* .PP 80/* The last two values may differ from each other when export-strength 81/* encryption is used. 82/* 83/* If the peer offered a certificate, part of the certificate data are 84/* available as: 85/* .IP TLScontext->peer_status 86/* A bitmask field that records the status of the peer certificate 87/* verification. This consists of one or more of 88/* TLS_CERT_FLAG_PRESENT, TLS_CERT_FLAG_ALTNAME, TLS_CERT_FLAG_TRUSTED 89/* and TLS_CERT_FLAG_MATCHED. 90/* .IP TLScontext->peer_CN 91/* Extracted CommonName of the peer, or zero-length string if the 92/* information could not be extracted. 93/* .IP TLScontext->issuer_CN 94/* Extracted CommonName of the issuer, or zero-length string if the 95/* information could not be extracted. 96/* .IP TLScontext->peer_fingerprint 97/* At the fingerprint security level, if the peer presented a certificate 98/* the fingerprint of the certificate. 99/* .PP 100/* If no peer certificate is presented the peer_status is set to 0. 101/* LICENSE 102/* .ad 103/* .fi 104/* This software is free. You can do with it whatever you want. 105/* The original author kindly requests that you acknowledge 106/* the use of his software. 107/* AUTHOR(S) 108/* Originally written by: 109/* Lutz Jaenicke 110/* BTU Cottbus 111/* Allgemeine Elektrotechnik 112/* Universitaetsplatz 3-4 113/* D-03044 Cottbus, Germany 114/* 115/* Updated by: 116/* Wietse Venema 117/* IBM T.J. Watson Research 118/* P.O. Box 704 119/* Yorktown Heights, NY 10598, USA 120/* 121/* Victor Duchovni 122/* Morgan Stanley 123/*--*/ 124 125/* System library. */ 126 127#include <sys_defs.h> 128 129#ifdef USE_TLS 130#include <string.h> 131 132#ifdef STRCASECMP_IN_STRINGS_H 133#include <strings.h> 134#endif 135 136/* Utility library. */ 137 138#include <argv.h> 139#include <mymalloc.h> 140#include <vstring.h> 141#include <vstream.h> 142#include <stringops.h> 143#include <msg.h> 144#include <iostuff.h> /* non-blocking */ 145 146/* Global library. */ 147 148#include <mail_params.h> 149 150/* TLS library. */ 151 152#include <tls_mgr.h> 153#define TLS_INTERNAL 154#include <tls.h> 155 156/* Application-specific. */ 157 158#define STR vstring_str 159#define LEN VSTRING_LEN 160 161/* load_clnt_session - load session from client cache (non-callback) */ 162 163static SSL_SESSION *load_clnt_session(TLS_SESS_STATE *TLScontext) 164{ 165 const char *myname = "load_clnt_session"; 166 SSL_SESSION *session = 0; 167 VSTRING *session_data = vstring_alloc(2048); 168 169 /* 170 * Prepare the query. 171 */ 172 if (TLScontext->log_mask & TLS_LOG_CACHE) 173 /* serverid already contains namaddrport information */ 174 msg_info("looking for session %s in %s cache", 175 TLScontext->serverid, TLScontext->cache_type); 176 177 /* 178 * We only get here if the cache_type is not empty. This code is not 179 * called unless caching is enabled and the cache_type is stored in the 180 * server SSL context. 181 */ 182 if (TLScontext->cache_type == 0) 183 msg_panic("%s: null client session cache type in session lookup", 184 myname); 185 186 /* 187 * Look up and activate the SSL_SESSION object. Errors are non-fatal, 188 * since caching is only an optimization. 189 */ 190 if (tls_mgr_lookup(TLScontext->cache_type, TLScontext->serverid, 191 session_data) == TLS_MGR_STAT_OK) { 192 session = tls_session_activate(STR(session_data), LEN(session_data)); 193 if (session) { 194 if (TLScontext->log_mask & TLS_LOG_CACHE) 195 /* serverid already contains namaddrport information */ 196 msg_info("reloaded session %s from %s cache", 197 TLScontext->serverid, TLScontext->cache_type); 198 } 199 } 200 201 /* 202 * Clean up. 203 */ 204 vstring_free(session_data); 205 206 return (session); 207} 208 209/* new_client_session_cb - name new session and save it to client cache */ 210 211static int new_client_session_cb(SSL *ssl, SSL_SESSION *session) 212{ 213 const char *myname = "new_client_session_cb"; 214 TLS_SESS_STATE *TLScontext; 215 VSTRING *session_data; 216 217 /* 218 * The cache name (if caching is enabled in tlsmgr(8)) and the cache ID 219 * string for this session are stored in the TLScontext. It cannot be 220 * null at this point. 221 */ 222 if ((TLScontext = SSL_get_ex_data(ssl, TLScontext_index)) == 0) 223 msg_panic("%s: null TLScontext in new session callback", myname); 224 225 /* 226 * We only get here if the cache_type is not empty. This callback is not 227 * set unless caching is enabled and the cache_type is stored in the 228 * server SSL context. 229 */ 230 if (TLScontext->cache_type == 0) 231 msg_panic("%s: null session cache type in new session callback", 232 myname); 233 234 if (TLScontext->log_mask & TLS_LOG_CACHE) 235 /* serverid already contains namaddrport information */ 236 msg_info("save session %s to %s cache", 237 TLScontext->serverid, TLScontext->cache_type); 238 239#if (OPENSSL_VERSION_NUMBER < 0x00906011L) || (OPENSSL_VERSION_NUMBER == 0x00907000L) 240 241 /* 242 * Ugly Hack: OpenSSL before 0.9.6a does not store the verify result in 243 * sessions for the client side. We modify the session directly which is 244 * version specific, but this bug is version specific, too. 245 * 246 * READ: 0-09-06-01-1 = 0-9-6-a-beta1: all versions before beta1 have this 247 * bug, it has been fixed during development of 0.9.6a. The development 248 * version of 0.9.7 can have this bug, too. It has been fixed on 249 * 2000/11/29. 250 */ 251 session->verify_result = SSL_get_verify_result(TLScontext->con); 252#endif 253 254 /* 255 * Passivate and save the session object. Errors are non-fatal, since 256 * caching is only an optimization. 257 */ 258 if ((session_data = tls_session_passivate(session)) != 0) { 259 tls_mgr_update(TLScontext->cache_type, TLScontext->serverid, 260 STR(session_data), LEN(session_data)); 261 vstring_free(session_data); 262 } 263 264 /* 265 * Clean up. 266 */ 267 SSL_SESSION_free(session); /* 200502 */ 268 269 return (1); 270} 271 272/* uncache_session - remove session from the external cache */ 273 274static void uncache_session(SSL_CTX *ctx, TLS_SESS_STATE *TLScontext) 275{ 276 SSL_SESSION *session = SSL_get_session(TLScontext->con); 277 278 SSL_CTX_remove_session(ctx, session); 279 if (TLScontext->cache_type == 0 || TLScontext->serverid == 0) 280 return; 281 282 if (TLScontext->log_mask & TLS_LOG_CACHE) 283 /* serverid already contains namaddrport information */ 284 msg_info("remove session %s from client cache", TLScontext->serverid); 285 286 tls_mgr_delete(TLScontext->cache_type, TLScontext->serverid); 287} 288 289/* tls_client_init - initialize client-side TLS engine */ 290 291TLS_APPL_STATE *tls_client_init(const TLS_CLIENT_INIT_PROPS *props) 292{ 293 long off = 0; 294 int cachable; 295 SSL_CTX *client_ctx; 296 TLS_APPL_STATE *app_ctx; 297 const EVP_MD *md_alg; 298 unsigned int md_len; 299 int log_mask; 300 301 /* 302 * Convert user loglevel to internal logmask. 303 */ 304 log_mask = tls_log_mask(props->log_param, props->log_level); 305 306 if (log_mask & TLS_LOG_VERBOSE) 307 msg_info("initializing the client-side TLS engine"); 308 309 /* 310 * Load (mostly cipher related) TLS-library internal main.cf parameters. 311 */ 312 tls_param_init(); 313 314 /* 315 * Detect mismatch between compile-time headers and run-time library. 316 */ 317 tls_check_version(); 318 319 /* 320 * Initialize the OpenSSL library by the book! To start with, we must 321 * initialize the algorithms. We want cleartext error messages instead of 322 * just error codes, so we load the error_strings. 323 */ 324 SSL_load_error_strings(); 325 OpenSSL_add_ssl_algorithms(); 326 327 /* 328 * Create an application data index for SSL objects, so that we can 329 * attach TLScontext information; this information is needed inside 330 * tls_verify_certificate_callback(). 331 */ 332 if (TLScontext_index < 0) { 333 if ((TLScontext_index = SSL_get_ex_new_index(0, 0, 0, 0, 0)) < 0) { 334 msg_warn("Cannot allocate SSL application data index: " 335 "disabling TLS support"); 336 return (0); 337 } 338 } 339 340 /* 341 * Register SHA-2 digests, if implemented and not already registered. 342 * Improves interoperability with clients and servers that prematurely 343 * deploy SHA-2 certificates. 344 */ 345#if defined(LN_sha256) && defined(NID_sha256) && !defined(OPENSSL_NO_SHA256) 346 if (!EVP_get_digestbyname(LN_sha224)) 347 EVP_add_digest(EVP_sha224()); 348 if (!EVP_get_digestbyname(LN_sha256)) 349 EVP_add_digest(EVP_sha256()); 350#endif 351#if defined(LN_sha512) && defined(NID_sha512) && !defined(OPENSSL_NO_SHA512) 352 if (!EVP_get_digestbyname(LN_sha384)) 353 EVP_add_digest(EVP_sha384()); 354 if (!EVP_get_digestbyname(LN_sha512)) 355 EVP_add_digest(EVP_sha512()); 356#endif 357 358 /* 359 * If the administrator specifies an unsupported digest algorithm, fail 360 * now, rather than in the middle of a TLS handshake. 361 */ 362 if ((md_alg = EVP_get_digestbyname(props->fpt_dgst)) == 0) { 363 msg_warn("Digest algorithm \"%s\" not found: disabling TLS support", 364 props->fpt_dgst); 365 return (0); 366 } 367 368 /* 369 * Sanity check: Newer shared libraries may use larger digests. 370 */ 371 if ((md_len = EVP_MD_size(md_alg)) > EVP_MAX_MD_SIZE) { 372 msg_warn("Digest algorithm \"%s\" output size %u too large:" 373 " disabling TLS support", props->fpt_dgst, md_len); 374 return (0); 375 } 376 377 /* 378 * Initialize the PRNG (Pseudo Random Number Generator) with some seed 379 * from external and internal sources. Don't enable TLS without some real 380 * entropy. 381 */ 382 if (tls_ext_seed(var_tls_daemon_rand_bytes) < 0) { 383 msg_warn("no entropy for TLS key generation: disabling TLS support"); 384 return (0); 385 } 386 tls_int_seed(); 387 388 /* 389 * The SSL/TLS specifications require the client to send a message in the 390 * oldest specification it understands with the highest level it 391 * understands in the message. RFC2487 is only specified for TLSv1, but 392 * we want to be as compatible as possible, so we will start off with a 393 * SSLv2 greeting allowing the best we can offer: TLSv1. We can restrict 394 * this with the options setting later, anyhow. 395 */ 396 ERR_clear_error(); 397 if ((client_ctx = SSL_CTX_new(SSLv23_client_method())) == 0) { 398 msg_warn("cannot allocate client SSL_CTX: disabling TLS support"); 399 tls_print_errors(); 400 return (0); 401 } 402 403 /* 404 * See the verify callback in tls_verify.c 405 */ 406 SSL_CTX_set_verify_depth(client_ctx, props->verifydepth + 1); 407 408 /* 409 * Protocol selection is destination dependent, so we delay the protocol 410 * selection options to the per-session SSL object. 411 */ 412 off |= tls_bug_bits(); 413 SSL_CTX_set_options(client_ctx, off); 414 415 /* 416 * Set the call-back routine for verbose logging. 417 */ 418 if (log_mask & TLS_LOG_DEBUG) 419 SSL_CTX_set_info_callback(client_ctx, tls_info_callback); 420 421 /* 422 * Load the CA public key certificates for both the client cert and for 423 * the verification of server certificates. As provided by OpenSSL we 424 * support two types of CA certificate handling: One possibility is to 425 * add all CA certificates to one large CAfile, the other possibility is 426 * a directory pointed to by CApath, containing separate files for each 427 * CA with softlinks named after the hash values of the certificate. The 428 * first alternative has the advantage that the file is opened and read 429 * at startup time, so that you don't have the hassle to maintain another 430 * copy of the CApath directory for chroot-jail. 431 */ 432 if (tls_set_ca_certificate_info(client_ctx, 433 props->CAfile, props->CApath) < 0) { 434 /* tls_set_ca_certificate_info() already logs a warning. */ 435 SSL_CTX_free(client_ctx); /* 200411 */ 436 return (0); 437 } 438 439 /* 440 * We do not need a client certificate, so the certificates are only 441 * loaded (and checked) if supplied. A clever client would handle 442 * multiple client certificates and decide based on the list of 443 * acceptable CAs, sent by the server, which certificate to submit. 444 * OpenSSL does however not do this and also has no call-back hooks to 445 * easily implement it. 446 * 447 * Load the client public key certificate and private key from file and 448 * check whether the cert matches the key. We can use RSA certificates 449 * ("cert") DSA certificates ("dcert") or ECDSA certificates ("eccert"). 450 * All three can be made available at the same time. The CA certificates 451 * for all three are handled in the same setup already finished. Which 452 * one is used depends on the cipher negotiated (that is: the first 453 * cipher listed by the client which does match the server). The client 454 * certificate is presented after the server chooses the session cipher, 455 * so we will just present the right cert for the chosen cipher (if it 456 * uses certificates). 457 */ 458 if (tls_set_my_certificate_key_info(client_ctx, 459 props->cert_file, 460 props->key_file, 461 props->dcert_file, 462 props->dkey_file, 463 props->eccert_file, 464 props->eckey_file) < 0) { 465 /* tls_set_my_certificate_key_info() already logs a warning. */ 466 SSL_CTX_free(client_ctx); /* 200411 */ 467 return (0); 468 } 469 470 /* 471 * According to the OpenSSL documentation, temporary RSA key is needed 472 * export ciphers are in use. We have to provide one, so well, we just do 473 * it. 474 */ 475 SSL_CTX_set_tmp_rsa_callback(client_ctx, tls_tmp_rsa_cb); 476 477 /* 478 * Finally, the setup for the server certificate checking, done "by the 479 * book". 480 */ 481 SSL_CTX_set_verify(client_ctx, SSL_VERIFY_NONE, 482 tls_verify_certificate_callback); 483 484 /* 485 * Initialize the session cache. 486 * 487 * Since the client does not search an internal cache, we simply disable it. 488 * It is only useful for expiring old sessions, but we do that in the 489 * tlsmgr(8). 490 * 491 * This makes SSL_CTX_remove_session() not useful for flushing broken 492 * sessions from the external cache, so we must delete them directly (not 493 * via a callback). 494 */ 495 if (tls_mgr_policy(props->cache_type, &cachable) != TLS_MGR_STAT_OK) 496 cachable = 0; 497 498 /* 499 * Allocate an application context, and populate with mandatory protocol 500 * and cipher data. 501 */ 502 app_ctx = tls_alloc_app_context(client_ctx, log_mask); 503 504 /* 505 * The external session cache is implemented by the tlsmgr(8) process. 506 */ 507 if (cachable) { 508 509 app_ctx->cache_type = mystrdup(props->cache_type); 510 511 /* 512 * OpenSSL does not use callbacks to load sessions from a client 513 * cache, so we must invoke that function directly. Apparently, 514 * OpenSSL does not provide a way to pass session names from here to 515 * call-back routines that do session lookup. 516 * 517 * OpenSSL can, however, automatically save newly created sessions for 518 * us by callback (we create the session name in the call-back 519 * function). 520 * 521 * XXX gcc 2.95 can't compile #ifdef .. #endif in the expansion of 522 * SSL_SESS_CACHE_CLIENT | SSL_SESS_CACHE_NO_INTERNAL_STORE | 523 * SSL_SESS_CACHE_NO_AUTO_CLEAR. 524 */ 525#ifndef SSL_SESS_CACHE_NO_INTERNAL_STORE 526#define SSL_SESS_CACHE_NO_INTERNAL_STORE 0 527#endif 528 529 SSL_CTX_set_session_cache_mode(client_ctx, 530 SSL_SESS_CACHE_CLIENT | 531 SSL_SESS_CACHE_NO_INTERNAL_STORE | 532 SSL_SESS_CACHE_NO_AUTO_CLEAR); 533 SSL_CTX_sess_set_new_cb(client_ctx, new_client_session_cb); 534 } 535 return (app_ctx); 536} 537 538/* match_hostname - match hostname against pattern */ 539 540static int match_hostname(const char *peerid, 541 const TLS_CLIENT_START_PROPS *props) 542{ 543 const ARGV *cmatch_argv; 544 const char *nexthop = props->nexthop; 545 const char *hname = props->host; 546 const char *pattern; 547 const char *pattern_left; 548 int sub; 549 int i; 550 int idlen; 551 int patlen; 552 553 if ((cmatch_argv = props->matchargv) == 0) 554 return 0; 555 556 /* 557 * Match the peerid against each pattern until we find a match. 558 */ 559 for (i = 0; i < cmatch_argv->argc; ++i) { 560 sub = 0; 561 if (!strcasecmp(cmatch_argv->argv[i], "nexthop")) 562 pattern = nexthop; 563 else if (!strcasecmp(cmatch_argv->argv[i], "hostname")) 564 pattern = hname; 565 else if (!strcasecmp(cmatch_argv->argv[i], "dot-nexthop")) { 566 pattern = nexthop; 567 sub = 1; 568 } else { 569 pattern = cmatch_argv->argv[i]; 570 if (*pattern == '.' && pattern[1] != '\0') { 571 ++pattern; 572 sub = 1; 573 } 574 } 575 576 /* 577 * Sub-domain match: peerid is any sub-domain of pattern. 578 */ 579 if (sub) { 580 if ((idlen = strlen(peerid)) > (patlen = strlen(pattern)) + 1 581 && peerid[idlen - patlen - 1] == '.' 582 && !strcasecmp(peerid + (idlen - patlen), pattern)) 583 return (1); 584 else 585 continue; 586 } 587 588 /* 589 * Exact match and initial "*" match. The initial "*" in a peerid 590 * matches exactly one hostname component, under the condition that 591 * the peerid contains multiple hostname components. 592 */ 593 if (!strcasecmp(peerid, pattern) 594 || (peerid[0] == '*' && peerid[1] == '.' && peerid[2] != 0 595 && (pattern_left = strchr(pattern, '.')) != 0 596 && strcasecmp(pattern_left + 1, peerid + 2) == 0)) 597 return (1); 598 } 599 return (0); 600} 601 602/* verify_extract_name - verify peer name and extract peer information */ 603 604static void verify_extract_name(TLS_SESS_STATE *TLScontext, X509 *peercert, 605 const TLS_CLIENT_START_PROPS *props) 606{ 607 int i; 608 int r; 609 int matched = 0; 610 int dnsname_match; 611 int verify_peername = 0; 612 int log_certmatch; 613 int verbose; 614 const char *dnsname; 615 const GENERAL_NAME *gn; 616 617 STACK_OF(GENERAL_NAME) * gens; 618 619 /* 620 * On exit both peer_CN and issuer_CN should be set. 621 */ 622 TLScontext->issuer_CN = tls_issuer_CN(peercert, TLScontext); 623 624 /* 625 * Is the certificate trust chain valid and trusted? 626 */ 627 if (SSL_get_verify_result(TLScontext->con) == X509_V_OK) 628 TLScontext->peer_status |= TLS_CERT_FLAG_TRUSTED; 629 630 if (TLS_CERT_IS_TRUSTED(TLScontext) && props->tls_level >= TLS_LEV_VERIFY) 631 verify_peername = 1; 632 633 /* Force cert processing so we can log the data? */ 634 log_certmatch = TLScontext->log_mask & TLS_LOG_CERTMATCH; 635 636 /* Log cert details when processing? */ 637 verbose = log_certmatch || (TLScontext->log_mask & TLS_LOG_VERBOSE); 638 639 if (verify_peername || log_certmatch) { 640 641 /* 642 * Verify the dNSName(s) in the peer certificate against the nexthop 643 * and hostname. 644 * 645 * If DNS names are present, we use the first matching (or else simply 646 * the first) DNS name as the subject CN. The CommonName in the 647 * issuer DN is obsolete when SubjectAltName is available. This 648 * yields much less surprising logs, because we log the name we 649 * verified or a name we checked and failed to match. 650 * 651 * XXX: The nexthop and host name may both be the same network address 652 * rather than a DNS name. In this case we really should be looking 653 * for GEN_IPADD entries, not GEN_DNS entries. 654 * 655 * XXX: In ideal world the caller who used the address to build the 656 * connection would tell us that the nexthop is the connection 657 * address, but if that is not practical, we can parse the nexthop 658 * again here. 659 */ 660 gens = X509_get_ext_d2i(peercert, NID_subject_alt_name, 0, 0); 661 if (gens) { 662 r = sk_GENERAL_NAME_num(gens); 663 for (i = 0; i < r; ++i) { 664 gn = sk_GENERAL_NAME_value(gens, i); 665 if (gn->type != GEN_DNS) 666 continue; 667 668 /* 669 * Even if we have an invalid DNS name, we still ultimately 670 * ignore the CommonName, because subjectAltName:DNS is 671 * present (though malformed). Replace any previous peer_CN 672 * if empty or we get a match. 673 * 674 * We always set at least an empty peer_CN if the ALTNAME cert 675 * flag is set. If not, we set peer_CN from the cert 676 * CommonName below, so peer_CN is always non-null on return. 677 */ 678 TLScontext->peer_status |= TLS_CERT_FLAG_ALTNAME; 679 dnsname = tls_dns_name(gn, TLScontext); 680 if (dnsname && *dnsname) { 681 if ((dnsname_match = match_hostname(dnsname, props)) != 0) 682 matched++; 683 /* Keep the first matched name. */ 684 if (TLScontext->peer_CN 685 && ((dnsname_match && matched == 1) 686 || *TLScontext->peer_CN == 0)) { 687 myfree(TLScontext->peer_CN); 688 TLScontext->peer_CN = 0; 689 } 690 if (verbose) 691 msg_info("%s: %ssubjectAltName: %s", props->namaddr, 692 dnsname_match ? "Matched " : "", dnsname); 693 } 694 if (TLScontext->peer_CN == 0) 695 TLScontext->peer_CN = mystrdup(dnsname ? dnsname : ""); 696 if (matched && !log_certmatch) 697 break; 698 } 699 if (verify_peername && matched) 700 TLScontext->peer_status |= TLS_CERT_FLAG_MATCHED; 701 702 /* 703 * (Sam Rushing, Ironport) Free stack *and* member GENERAL_NAME 704 * objects 705 */ 706 sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free); 707 } 708 709 /* 710 * No subjectAltNames, peer_CN is taken from CommonName. 711 */ 712 if (TLScontext->peer_CN == 0) { 713 TLScontext->peer_CN = tls_peer_CN(peercert, TLScontext); 714 if (*TLScontext->peer_CN) 715 matched = match_hostname(TLScontext->peer_CN, props); 716 if (verify_peername && matched) 717 TLScontext->peer_status |= TLS_CERT_FLAG_MATCHED; 718 if (verbose) 719 msg_info("%s %sCommonName %s", props->namaddr, 720 matched ? "Matched " : "", TLScontext->peer_CN); 721 } else if (verbose) { 722 char *tmpcn = tls_peer_CN(peercert, TLScontext); 723 724 /* 725 * Though the CommonName was superceded by a subjectAltName, log 726 * it when certificate match debugging was requested. 727 */ 728 msg_info("%s CommonName %s", TLScontext->namaddr, tmpcn); 729 myfree(tmpcn); 730 } 731 } else 732 TLScontext->peer_CN = tls_peer_CN(peercert, TLScontext); 733 734 /* 735 * Give them a clue. Problems with trust chain verification were logged 736 * when the session was first negotiated, before the session was stored 737 * into the cache. We don't want mystery failures, so log the fact the 738 * real problem is to be found in the past. 739 */ 740 if (TLScontext->session_reused 741 && !TLS_CERT_IS_TRUSTED(TLScontext) 742 && (TLScontext->log_mask & TLS_LOG_UNTRUSTED)) 743 msg_info("%s: re-using session with untrusted certificate, " 744 "look for details earlier in the log", props->namaddr); 745} 746 747/* verify_extract_print - extract and verify peer fingerprint */ 748 749static void verify_extract_print(TLS_SESS_STATE *TLScontext, X509 *peercert, 750 const TLS_CLIENT_START_PROPS *props) 751{ 752 char **cpp; 753 754 /* Non-null by contract */ 755 TLScontext->peer_fingerprint = tls_fingerprint(peercert, props->fpt_dgst); 756 TLScontext->peer_pkey_fprint = tls_pkey_fprint(peercert, props->fpt_dgst); 757 758 /* 759 * Compare the fingerprint against each acceptable value, ignoring 760 * upper/lower case differences. 761 */ 762 if (props->tls_level == TLS_LEV_FPRINT) { 763 for (cpp = props->matchargv->argv; *cpp; ++cpp) { 764 if (strcasecmp(TLScontext->peer_fingerprint, *cpp) == 0 765 || strcasecmp(TLScontext->peer_pkey_fprint, *cpp) == 0) { 766 TLScontext->peer_status |= TLS_CERT_FLAG_MATCHED; 767 break; 768 } 769 } 770 } 771} 772 773 /* 774 * This is the actual startup routine for the connection. We expect that the 775 * buffers are flushed and the "220 Ready to start TLS" was received by us, 776 * so that we can immediately start the TLS handshake process. 777 */ 778TLS_SESS_STATE *tls_client_start(const TLS_CLIENT_START_PROPS *props) 779{ 780 int sts; 781 int protomask; 782 const char *cipher_list; 783 SSL_SESSION *session; 784 const SSL_CIPHER *cipher; 785 X509 *peercert; 786 TLS_SESS_STATE *TLScontext; 787 TLS_APPL_STATE *app_ctx = props->ctx; 788 VSTRING *myserverid; 789 int log_mask = app_ctx->log_mask; 790 791 /* 792 * When certificate verification is required, log trust chain validation 793 * errors even when disabled by default for opportunistic sessions. 794 */ 795 if (props->tls_level >= TLS_LEV_VERIFY) 796 log_mask |= TLS_LOG_UNTRUSTED; 797 798 if (log_mask & TLS_LOG_VERBOSE) 799 msg_info("setting up TLS connection to %s", props->namaddr); 800 801 /* 802 * First make sure we have valid protocol and cipher parameters 803 * 804 * The cipherlist will be applied to the global SSL context, where it can be 805 * repeatedly reset if necessary, but the protocol restrictions will be 806 * is applied to the SSL connection, because protocol restrictions in the 807 * global context cannot be cleared. 808 */ 809 810 /* 811 * OpenSSL will ignore cached sessions that use the wrong protocol. So we 812 * do not need to filter out cached sessions with the "wrong" protocol, 813 * rather OpenSSL will simply negotiate a new session. 814 * 815 * Still, we salt the session lookup key with the protocol list, so that 816 * sessions found in the cache are always acceptable. 817 */ 818 protomask = tls_protocol_mask(props->protocols); 819 if (protomask == TLS_PROTOCOL_INVALID) { 820 /* tls_protocol_mask() logs no warning. */ 821 msg_warn("%s: Invalid TLS protocol list \"%s\": aborting TLS session", 822 props->namaddr, props->protocols); 823 return (0); 824 } 825 myserverid = vstring_alloc(100); 826 vstring_sprintf_append(myserverid, "%s&p=%d", props->serverid, protomask); 827 828 /* 829 * Per session cipher selection for sessions with mandatory encryption 830 * 831 * By the time a TLS client is negotiating ciphers it has already offered to 832 * re-use a session, it is too late to renege on the offer. So we must 833 * not attempt to re-use sessions whose ciphers are too weak. We salt the 834 * session lookup key with the cipher list, so that sessions found in the 835 * cache are always acceptable. 836 */ 837 cipher_list = tls_set_ciphers(app_ctx, "TLS", props->cipher_grade, 838 props->cipher_exclusions); 839 if (cipher_list == 0) { 840 msg_warn("%s: %s: aborting TLS session", 841 props->namaddr, vstring_str(app_ctx->why)); 842 vstring_free(myserverid); 843 return (0); 844 } 845 if (log_mask & TLS_LOG_VERBOSE) 846 msg_info("%s: TLS cipher list \"%s\"", props->namaddr, cipher_list); 847 vstring_sprintf_append(myserverid, "&c=%s", cipher_list); 848 849 /* 850 * Finally, salt the session key with the OpenSSL library version, 851 * (run-time, rather than compile-time, just in case that matters). 852 */ 853 vstring_sprintf_append(myserverid, "&l=%ld", (long) SSLeay()); 854 855 /* 856 * Allocate a new TLScontext for the new connection and get an SSL 857 * structure. Add the location of TLScontext to the SSL to later retrieve 858 * the information inside the tls_verify_certificate_callback(). 859 * 860 * If session caching was enabled when TLS was initialized, the cache type 861 * is stored in the client SSL context. 862 */ 863 TLScontext = tls_alloc_sess_context(log_mask, props->namaddr); 864 TLScontext->cache_type = app_ctx->cache_type; 865 866 TLScontext->serverid = vstring_export(myserverid); 867 TLScontext->stream = props->stream; 868 869 if ((TLScontext->con = SSL_new(app_ctx->ssl_ctx)) == NULL) { 870 msg_warn("Could not allocate 'TLScontext->con' with SSL_new()"); 871 tls_print_errors(); 872 tls_free_context(TLScontext); 873 return (0); 874 } 875 if (!SSL_set_ex_data(TLScontext->con, TLScontext_index, TLScontext)) { 876 msg_warn("Could not set application data for 'TLScontext->con'"); 877 tls_print_errors(); 878 tls_free_context(TLScontext); 879 return (0); 880 } 881 882 /* 883 * Apply session protocol restrictions. 884 */ 885 if (protomask != 0) 886 SSL_set_options(TLScontext->con, 887 ((protomask & TLS_PROTOCOL_TLSv1) ? SSL_OP_NO_TLSv1 : 0L) 888 | ((protomask & TLS_PROTOCOL_TLSv1_1) ? SSL_OP_NO_TLSv1_1 : 0L) 889 | ((protomask & TLS_PROTOCOL_TLSv1_2) ? SSL_OP_NO_TLSv1_2 : 0L) 890 | ((protomask & TLS_PROTOCOL_SSLv3) ? SSL_OP_NO_SSLv3 : 0L) 891 | ((protomask & TLS_PROTOCOL_SSLv2) ? SSL_OP_NO_SSLv2 : 0L)); 892 893 /* 894 * XXX To avoid memory leaks we must always call SSL_SESSION_free() after 895 * calling SSL_set_session(), regardless of whether or not the session 896 * will be reused. 897 */ 898 if (TLScontext->cache_type) { 899 session = load_clnt_session(TLScontext); 900 if (session) { 901 SSL_set_session(TLScontext->con, session); 902 SSL_SESSION_free(session); /* 200411 */ 903#if (OPENSSL_VERSION_NUMBER < 0x00906011L) || (OPENSSL_VERSION_NUMBER == 0x00907000L) 904 905 /* 906 * Ugly Hack: OpenSSL before 0.9.6a does not store the verify 907 * result in sessions for the client side. We modify the session 908 * directly which is version specific, but this bug is version 909 * specific, too. 910 * 911 * READ: 0-09-06-01-1 = 0-9-6-a-beta1: all versions before beta1 912 * have this bug, it has been fixed during development of 0.9.6a. 913 * The development version of 0.9.7 can have this bug, too. It 914 * has been fixed on 2000/11/29. 915 */ 916 SSL_set_verify_result(TLScontext->con, session->verify_result); 917#endif 918 919 } 920 } 921 922 /* 923 * Before really starting anything, try to seed the PRNG a little bit 924 * more. 925 */ 926 tls_int_seed(); 927 (void) tls_ext_seed(var_tls_daemon_rand_bytes); 928 929 /* 930 * Initialize the SSL connection to connect state. This should not be 931 * necessary anymore since 0.9.3, but the call is still in the library 932 * and maintaining compatibility never hurts. 933 */ 934 SSL_set_connect_state(TLScontext->con); 935 936 /* 937 * Connect the SSL connection with the network socket. 938 */ 939 if (SSL_set_fd(TLScontext->con, vstream_fileno(props->stream)) != 1) { 940 msg_info("SSL_set_fd error to %s", props->namaddr); 941 tls_print_errors(); 942 uncache_session(app_ctx->ssl_ctx, TLScontext); 943 tls_free_context(TLScontext); 944 return (0); 945 } 946 947 /* 948 * Turn on non-blocking I/O so that we can enforce timeouts on network 949 * I/O. 950 */ 951 non_blocking(vstream_fileno(props->stream), NON_BLOCKING); 952 953 /* 954 * If the debug level selected is high enough, all of the data is dumped: 955 * TLS_LOG_TLSPKTS will dump the SSL negotiation, TLS_LOG_ALLPKTS will 956 * dump everything. 957 * 958 * We do have an SSL_set_fd() and now suddenly a BIO_ routine is called? 959 * Well there is a BIO below the SSL routines that is automatically 960 * created for us, so we can use it for debugging purposes. 961 */ 962 if (log_mask & TLS_LOG_TLSPKTS) 963 BIO_set_callback(SSL_get_rbio(TLScontext->con), tls_bio_dump_cb); 964 965 /* 966 * Start TLS negotiations. This process is a black box that invokes our 967 * call-backs for certificate verification. 968 * 969 * Error handling: If the SSL handhake fails, we print out an error message 970 * and remove all TLS state concerning this session. 971 */ 972 sts = tls_bio_connect(vstream_fileno(props->stream), props->timeout, 973 TLScontext); 974 if (sts <= 0) { 975 if (ERR_peek_error() != 0) { 976 msg_info("SSL_connect error to %s: %d", props->namaddr, sts); 977 tls_print_errors(); 978 } else if (errno != 0) { 979 msg_info("SSL_connect error to %s: %m", props->namaddr); 980 } else { 981 msg_info("SSL_connect error to %s: lost connection", 982 props->namaddr); 983 } 984 uncache_session(app_ctx->ssl_ctx, TLScontext); 985 tls_free_context(TLScontext); 986 return (0); 987 } 988 /* Turn off packet dump if only dumping the handshake */ 989 if ((log_mask & TLS_LOG_ALLPKTS) == 0) 990 BIO_set_callback(SSL_get_rbio(TLScontext->con), 0); 991 992 /* 993 * The caller may want to know if this session was reused or if a new 994 * session was negotiated. 995 */ 996 TLScontext->session_reused = SSL_session_reused(TLScontext->con); 997 if ((log_mask & TLS_LOG_CACHE) && TLScontext->session_reused) 998 msg_info("%s: Reusing old session", TLScontext->namaddr); 999 1000 /* 1001 * Do peername verification if requested and extract useful information 1002 * from the certificate for later use. 1003 */ 1004 if ((peercert = SSL_get_peer_certificate(TLScontext->con)) != 0) { 1005 TLScontext->peer_status |= TLS_CERT_FLAG_PRESENT; 1006 1007 /* 1008 * Peer name or fingerprint verification as requested. 1009 * Unconditionally set peer_CN, issuer_CN and peer_fingerprint. 1010 */ 1011 verify_extract_name(TLScontext, peercert, props); 1012 verify_extract_print(TLScontext, peercert, props); 1013 1014 if (TLScontext->log_mask & 1015 (TLS_LOG_CERTMATCH | TLS_LOG_VERBOSE | TLS_LOG_PEERCERT)) 1016 msg_info("%s: subject_CN=%s, issuer_CN=%s, " 1017 "fingerprint=%s, pkey_fingerprint=%s", props->namaddr, 1018 TLScontext->peer_CN, TLScontext->issuer_CN, 1019 TLScontext->peer_fingerprint, 1020 TLScontext->peer_pkey_fprint); 1021 X509_free(peercert); 1022 } else { 1023 TLScontext->issuer_CN = mystrdup(""); 1024 TLScontext->peer_CN = mystrdup(""); 1025 TLScontext->peer_fingerprint = mystrdup(""); 1026 TLScontext->peer_pkey_fprint = mystrdup(""); 1027 } 1028 1029 /* 1030 * Finally, collect information about protocol and cipher for logging 1031 */ 1032 TLScontext->protocol = SSL_get_version(TLScontext->con); 1033 cipher = SSL_get_current_cipher(TLScontext->con); 1034 TLScontext->cipher_name = SSL_CIPHER_get_name(cipher); 1035 TLScontext->cipher_usebits = SSL_CIPHER_get_bits(cipher, 1036 &(TLScontext->cipher_algbits)); 1037 1038 /* 1039 * The TLS engine is active. Switch to the tls_timed_read/write() 1040 * functions and make the TLScontext available to those functions. 1041 */ 1042 tls_stream_start(props->stream, TLScontext); 1043 1044 /* 1045 * All the key facts in a single log entry. 1046 */ 1047 if (log_mask & TLS_LOG_SUMMARY) 1048 msg_info("%s TLS connection established to %s: %s with cipher %s " 1049 "(%d/%d bits)", TLS_CERT_IS_MATCHED(TLScontext) ? "Verified" : 1050 TLS_CERT_IS_TRUSTED(TLScontext) ? "Trusted" : "Untrusted", 1051 props->namaddr, TLScontext->protocol, TLScontext->cipher_name, 1052 TLScontext->cipher_usebits, TLScontext->cipher_algbits); 1053 1054 tls_int_seed(); 1055 1056 return (TLScontext); 1057} 1058 1059#endif /* USE_TLS */ 1060