diff options
Diffstat (limited to 'imap/src/osdep/nt/ssl_nt.c')
| -rw-r--r-- | imap/src/osdep/nt/ssl_nt.c | 1764 |
1 files changed, 5 insertions, 1759 deletions
diff --git a/imap/src/osdep/nt/ssl_nt.c b/imap/src/osdep/nt/ssl_nt.c index d39fdf08..5bc04ab8 100644 --- a/imap/src/osdep/nt/ssl_nt.c +++ b/imap/src/osdep/nt/ssl_nt.c @@ -23,1762 +23,8 @@ * http://www.apache.org/licenses/LICENSE-2.0 * */ -#ifdef ENABLE_WINDOWS_LIBRESSL -#define crypt ssl_private_crypt -#define STRING OPENSSL_STRING -#include <x509v3.h> -#include <ssl.h> -#include <err.h> -#include <pem.h> -#include <buffer.h> -#include <bio.h> -#include <crypto.h> -#include <rand.h> -#ifdef OPENSSL_1_1_0 -#include <rsa.h> -#include <bn.h> -#endif /* OPENSSL_1_1_0 */ -#undef STRING -#undef crypt - -#define SSLBUFLEN 8192 - -/* - * PCI auditing compliance, disable: - * SSLv2 - * anonymous D-H (no certificate - * export encryption ciphers (40 and 56 bits) - * low encryption cipher suites (40 and 56 bits, excluding export) - * null encryption (disabling implied by "ALL") - * - * UW imapd just disables low-grade and null ("ALL:!LOW"). This setting - * will break clients that attempt to use the newly-prohibited mechanisms. - * - * I question the value of disabling SSLv2, as opposed to disabling the SSL - * ports (e.g., 993 for IMAP, 995 for POP3) and using TLS exclusively. - */ - -#define SSLCIPHERLIST "ALL:!SSLv2:!ADH:!EXP:!LOW" - -/* SSL I/O stream */ - -typedef struct ssl_stream { - TCPSTREAM *tcpstream; /* TCP stream */ - SSL_CTX *context; /* SSL context */ - SSL *con; /* SSL connection */ - int ictr; /* input counter */ - char *iptr; /* input pointer */ - char ibuf[SSLBUFLEN]; /* input buffer */ -} SSLSTREAM; - -#include "sslio.h" - -/* Function prototypes */ -const SSL_METHOD *ssl_connect_mthd(int flag); -static SSLSTREAM *ssl_start(TCPSTREAM *tstream,char *host,unsigned long flags); -static char *ssl_start_work (SSLSTREAM *stream,char *host,unsigned long flags); -static int ssl_open_verify (int ok,X509_STORE_CTX *ctx); -static char *ssl_validate_cert (X509 *cert,char *host); -static long ssl_compare_hostnames (unsigned char *s,unsigned char *pat); -static char *ssl_getline_work (SSLSTREAM *stream,unsigned long *size, - long *contd); -static long ssl_abort (SSLSTREAM *stream); - -#ifdef OPENSSL_1_1_0 -#define SSL_CTX_TYPE SSL_CTX -#else -#define SSL_CTX_TYPE SSL -#endif /* OPENSSL_1_1_0 */ - -static RSA *ssl_genkey (SSL_CTX_TYPE *con,int export,int keylength); - -typedef struct ssl_versions_s { - char *name; - int version; -} SSL_VERSIONS_S; - -int -pith_ssl_encryption_version(char *s) -{ - SSL_VERSIONS_S ssl_versions[] = { - { "no_min", 0 }, - { "ssl3", SSL3_VERSION }, - { "tls1", TLS1_VERSION }, - { "tls1_1", TLS1_1_VERSION }, - { "tls1_2", TLS1_2_VERSION }, -#ifdef TLS1_3_VERSION - { "tls1_3", TLS1_3_VERSION }, -#endif /* TLS1_3_VERSION */ - { "no_max", 0 }, /* set this last in the list */ - { NULL, 0 }, - }; - int i; - - if (s == NULL || *s == '\0') - return -1; - - for (i = 0; ssl_versions[i].name != NULL; i++) - if (strcmp(ssl_versions[i].name, s) == 0) - break; - - if (strcmp(s, "no_max") == 0) i--; - - return ssl_versions[i].name != NULL ? ssl_versions[i].version : -1; -} - -/* Secure Sockets Layer network driver dispatch */ - -static struct ssl_driver ssldriver = { - ssl_open, /* open connection */ - ssl_aopen, /* open preauthenticated connection */ - ssl_getline, /* get a line */ - ssl_getbuffer, /* get a buffer */ - ssl_soutr, /* output pushed data */ - ssl_sout, /* output string */ - ssl_close, /* close connection */ - ssl_host, /* return host name */ - ssl_remotehost, /* return remote host name */ - ssl_port, /* return port number */ - ssl_localhost /* return local host name */ -}; - /* non-NIL if doing SSL primary I/O */ -static SSLSTDIOSTREAM *sslstdio = NIL; -static char *start_tls = NIL; /* non-NIL if start TLS requested */ - -/* One-time SSL initialization */ - -static int sslonceonly = 0; - -void ssl_onceonlyinit (void) -{ - if (!sslonceonly++) { /* only need to call it once */ - int fd; - char tmp[MAILTMPLEN]; - struct stat sbuf; - /* if system doesn't have /dev/urandom */ - if (stat ("/dev/urandom",&sbuf)) { - strcpy(tmp, "SSLXXXXXX"); - fd = fopen(tmp,"a"); - unlink (tmp); /* don't need the file */ - fstat (fd,&sbuf); /* get information about the file */ - close (fd); /* flush descriptor */ - /* not great but it'll have to do */ - sprintf (tmp + strlen (tmp),"%.80s%lx%.80s%lx%lx%lx%lx%lx", - tcp_serveraddr (),(unsigned long) tcp_serverport (), - tcp_clientaddr (),(unsigned long) tcp_clientport (), - (unsigned long) sbuf.st_ino,(unsigned long) time (0), - (unsigned long) gethostid (),(unsigned long) getpid ()); - RAND_seed (tmp,strlen (tmp)); - } - /* apply runtime linkage */ - mail_parameters (NIL,SET_SSLDRIVER,(void *) &ssldriver); - mail_parameters (NIL,SET_SSLSTART,(void *) ssl_start); -#ifdef OPENSSL_1_1_0 - OPENSSL_init_ssl(0, NULL); -#else - SSL_library_init (); /* add all algorithms */ -#endif /* OPENSSL_1_1_0 */ - } -} - -/* SSL open - * Accepts: host name - * contact service name - * contact port number - * Returns: SSL stream if success else NIL - */ - -SSLSTREAM *ssl_open (char *host,char *service,unsigned long port) -{ - TCPSTREAM *stream = tcp_open (host,service,port); - return stream ? ssl_start (stream,host,port) : NIL; -} - - -/* SSL authenticated open - * Accepts: host name - * service name - * returned user name buffer - * Returns: SSL stream if success else NIL - */ - -SSLSTREAM *ssl_aopen (NETMBX *mb,char *service,char *usrbuf) -{ - return NIL; /* don't use this mechanism with SSL */ -} - -typedef struct ssl_disable_s { - int version; - int disable_code; -} SSL_DISABLE_S; - -SSL_DISABLE_S ssl_disable[] = { - { SSL2_VERSION, SSL_OP_NO_SSLv2 }, -{ SSL3_VERSION, SSL_OP_NO_SSLv3 }, -{ TLS1_VERSION, SSL_OP_NO_TLSv1 }, -{ TLS1_1_VERSION, SSL_OP_NO_TLSv1_1 }, -{ TLS1_2_VERSION, SSL_OP_NO_TLSv1_2 }, -#ifdef TLS1_3_VERSION -{ TLS1_3_VERSION, SSL_OP_NO_TLSv1_3 }, -#endif /* TLS1_3_VERSION */ -{ 0, 0 } -}; - -#define NUMBER_SSL_VERSIONS (sizeof(ssl_disable)/sizeof(ssl_disable[0]) - 1) - -/* returns the mask to disable a specific version. -* If version not found, returns 0. -* -* Arguments: version, and direction. -* If direction is -1, returns mask to disable versions less than given version. -* If direction is +1, returns mask to disable versions bigger than given version. -*/ -int ssl_disable_mask(int ssl_version, int direction) -{ - int rv = 0; - int i; - for (i = 0; ssl_disable[i].version != 0 - && ssl_disable[i].version != ssl_version; i++); - if (i == 0 - || i == NUMBER_SSL_VERSIONS - 1 - || ssl_disable[i].version == 0) - return rv; - i += direction; /* move in the direction */ - for (; i >= 0 && i <= NUMBER_SSL_VERSIONS - 1; i += direction) - rv |= ssl_disable[i].disable_code; - return rv; -} - - -/* ssl_connect_mthd: returns a context pointer to the connection to - * a ssl server - */ -const SSL_METHOD *ssl_connect_mthd(int flag, int *min, int *max) -{ - int client_request; - client_request = (flag & NET_TRYTLS1) ? TLS1_VERSION - : (flag & NET_TRYTLS1_1) ? TLS1_1_VERSION - : (flag & NET_TRYTLS1_2) ? TLS1_2_VERSION -#ifdef TLS1_3_VERSION - : (flag & NET_TRYTLS1_3) ? TLS1_3_VERSION -#else - : (flag & NET_TRYTLS1_3) ? -2 -#endif - : 0; - - *min = *(int *)mail_parameters(NULL, GET_ENCRYPTION_RANGE_MIN, NULL); - *max = *(int *)mail_parameters(NULL, GET_ENCRYPTION_RANGE_MAX, NULL); - - /* - * if no special request, negotiate the maximum the client is configured - * to negotiate - */ - if (client_request == 0) - client_request = *max; - - if (client_request < *min || client_request > *max) - return NIL; /* out of range? bail out */ - - /* Some Linux distributors seem to believe that it is ok to disable some of - * these methods for their users, so we have to test that every requested - * method has actually been compiled in into their openssl/libressl library. - * Oh well... - */ -#ifndef OPENSSL_1_1_0 - if (client_request == SSL3_VERSION) -#ifndef OPENSSL_NO_SSL3_METHOD - return SSLv3_client_method(); -#else - return NIL; -#endif /* OPENSSL_NO_SSL3_METHOD */ - else if (client_request == TLS1_VERSION) -#ifndef OPENSSL_NO_TLS1_METHOD - return TLSv1_client_method(); -#else - return NIL; -#endif /* OPENSSL_NO_TLS1_METHOD */ - else if (client_request == TLS1_1_VERSION) -#ifndef OPENSSL_NO_TLS1_1_METHOD - return TLSv1_1_client_method(); -#else - return NIL; -#endif /* OPENSSL_NO_TLS1_1_METHOD */ - else if (client_request == TLS1_2_VERSION) -#ifndef OPENSSL_NO_TLS1_2_METHOD - return TLSv1_2_client_method(); -#else - return NIL; -#endif /* OPENSSL_NO_TLS1_2_METHOD */ -#ifdef TLS1_3_VERSION /* this is only reachable if TLS1_3 support exists */ - else if (client_request == TLS1_3_VERSION) -#ifndef OPENSSL_NO_TLS1_3_METHOD - return TLS_client_method(); -#else - return NIL; -#endif /* #ifndef OPENSSL_NO_TLS1_2_METHOD */ -#endif /* TLS1_3_VERSION */ -#endif /* ifndef OPENSSL_1_1_0 */ - - return SSLv23_client_method(); -} - -/* Start SSL/TLS negotiations - * Accepts: open TCP stream of session - * user's host name - * flags - * Returns: SSL stream if success else NIL - */ - -static SSLSTREAM *ssl_start (TCPSTREAM *tstream,char *host,unsigned long flags) -{ - char *reason,tmp[MAILTMPLEN]; - sslfailure_t sf = (sslfailure_t) mail_parameters (NIL,GET_SSLFAILURE,NIL); - blocknotify_t bn = (blocknotify_t) mail_parameters (NIL,GET_BLOCKNOTIFY,NIL); - void *data = (*bn) (BLOCK_SENSITIVE,NIL); - SSLSTREAM *stream = (SSLSTREAM *) memset (fs_get (sizeof (SSLSTREAM)),0, - sizeof (SSLSTREAM)); - stream->tcpstream = tstream; /* bind TCP stream */ - /* do the work */ - reason = ssl_start_work (stream,host,flags); - (*bn) (BLOCK_NONSENSITIVE,data); - if (reason) { /* failed? */ - ssl_close (stream); /* failed to do SSL */ - stream = NIL; /* no stream returned */ - switch (*reason) { /* analyze reason */ - case '*': /* certificate failure */ - ++reason; /* skip over certificate failure indication */ - /* pass to error callback */ - if (sf) (*sf) (host,reason,flags); - else { /* no error callback, build error message */ - sprintf (tmp,"Certificate failure for %.80s: %.512s",host,reason); - mm_log (tmp,ERROR); - } - case '\0': /* user answered no to certificate callback */ - if (flags & NET_TRYSSL) /* return dummy stream to stop tryssl */ - stream = (SSLSTREAM *) memset (fs_get (sizeof (SSLSTREAM)),0, - sizeof (SSLSTREAM)); - break; - default: /* non-certificate failure */ - if (flags & NET_TRYSSL); /* no error output if tryssl */ - /* pass to error callback */ - else if (sf) (*sf) (host,reason,flags); - else { /* no error callback, build error message */ - sprintf (tmp,"TLS/SSL failure for %.80s: %.512s",host,reason); - mm_log (tmp,ERROR); - } - break; - } - } - return stream; -} - -/* Start SSL/TLS negotiations worker routine - * Accepts: SSL stream - * user's host name - * flags - * Returns: NIL if success, else error reason - */ - - /* evil but I had no choice */ -static char *ssl_last_error = NIL; -static char *ssl_last_host = NIL; - - -static char *ssl_start_work(SSLSTREAM *stream, char *host, unsigned long flags) -{ - BIO *bio; - X509 *cert; - unsigned long sl, tl; - int min, max; - int masklow, maskhigh; - char *s, *t, *err, tmp[MAILTMPLEN], buf[256]; - sslcertificatequery_t scq = - (sslcertificatequery_t)mail_parameters(NIL, GET_SSLCERTIFICATEQUERY, NIL); - sslclientcert_t scc = - (sslclientcert_t)mail_parameters(NIL, GET_SSLCLIENTCERT, NIL); - sslclientkey_t sck = - (sslclientkey_t)mail_parameters(NIL, GET_SSLCLIENTKEY, NIL); - if (ssl_last_error) fs_give((void **)&ssl_last_error); - ssl_last_host = host; - if (!(stream->context = SSL_CTX_new(ssl_connect_mthd(flags, &min, &max)))) - return "SSL context failed"; - SSL_CTX_set_options(stream->context, 0); - masklow = ssl_disable_mask(min, -1); - maskhigh = ssl_disable_mask(max, 1); - SSL_CTX_set_options(stream->context, masklow | maskhigh); - /* disable certificate validation? */ - if (flags & NET_NOVALIDATECERT) - SSL_CTX_set_verify(stream->context, SSL_VERIFY_NONE, NIL); - else SSL_CTX_set_verify(stream->context, SSL_VERIFY_PEER, ssl_open_verify); - /* set default paths to CAs... */ - SSL_CTX_set_default_verify_paths(stream->context); - /* ...unless a non-standard path desired */ - if ((s = (char *)mail_parameters(NIL, GET_SSLCAPATH, NIL)) != NULL) - SSL_CTX_load_verify_locations(stream->context, NIL, s); - /* want to send client certificate? */ - if (scc && (s = (*scc) ()) && (sl = strlen(s))) { - if ((cert = PEM_read_bio_X509(bio = BIO_new_mem_buf(s, sl), NIL, NIL, NIL)) != NULL) { - SSL_CTX_use_certificate(stream->context, cert); - X509_free(cert); - } - BIO_free(bio); - if (!cert) return "SSL client certificate failed"; - /* want to supply private key? */ - if ((t = (sck ? (*sck) () : s)) && (tl = strlen(t))) { - EVP_PKEY *key; - if ((key = PEM_read_bio_PrivateKey(bio = BIO_new_mem_buf(t, tl), - NIL, NIL, "")) != NULL) { - SSL_CTX_use_PrivateKey(stream->context, key); - EVP_PKEY_free(key); - } - BIO_free(bio); - memset(t, 0, tl); /* erase key */ - } - if (s != t) memset(s, 0, sl);/* erase certificate if different from key */ - } - - /* create connection */ - if (!(stream->con = (SSL *)SSL_new(stream->context))) - return "SSL connection failed"; - if (host && !SSL_set_tlsext_host_name(stream->con, host)) { - return "Server Name Identification (SNI) failed"; - } - bio = BIO_new_socket(stream->tcpstream->tcpsi, BIO_NOCLOSE); - SSL_set_bio(stream->con, bio, bio); - SSL_set_connect_state(stream->con); - if (SSL_in_init(stream->con)) SSL_total_renegotiations(stream->con); - /* now negotiate SSL */ - if (SSL_write(stream->con, "", 0) < 0) - return ssl_last_error ? ssl_last_error : "SSL negotiation failed"; - /* need to validate host names? */ - if (!(flags & NET_NOVALIDATECERT) && - (err = ssl_validate_cert(cert = SSL_get_peer_certificate(stream->con), - host))) { - /* application callback */ - X509_NAME_oneline(X509_get_subject_name(cert), buf, sizeof(buf)); - if (scq) return (*scq) (err, host, cert ? buf : "???") ? NIL : ""; - /* error message to return via mm_log() */ - sprintf(tmp, "*%.128s: %.255s", err, cert ? buf : "???"); - return ssl_last_error = cpystr(tmp); - } - return NIL; -} - -/* SSL certificate verification callback - * Accepts: error flag - * X509 context - * Returns: error flag - */ - -static int ssl_open_verify (int ok,X509_STORE_CTX *ctx) -{ - char *err,cert[256],tmp[MAILTMPLEN]; - sslcertificatequery_t scq = - (sslcertificatequery_t) mail_parameters (NIL,GET_SSLCERTIFICATEQUERY,NIL); - if (!ok) { /* in case failure */ - err = (char *) X509_verify_cert_error_string - (X509_STORE_CTX_get_error (ctx)); - X509_NAME_oneline (X509_get_subject_name - (X509_STORE_CTX_get_current_cert (ctx)),cert,255); - if (!scq) { /* mm_log() error message if no callback */ - sprintf (tmp,"*%.128s: %.255s",err,cert); - ssl_last_error = cpystr (tmp); - } - /* ignore error if application says to */ - else if ((*scq) (err,ssl_last_host,cert)) ok = T; - /* application wants punt */ - else ssl_last_error = cpystr (""); - } - return ok; -} - - -/* SSL validate certificate - * Accepts: certificate - * host to validate against - * Returns: NIL if validated, else string of error message - */ - -static char *ssl_validate_cert (X509 *cert,char *host) -{ - int i,j,n, m = 0;; - char *s=NULL,*t,*ret = NIL; - void *ext; - GENERAL_NAME *name; - X509_NAME *cname; - X509_NAME_ENTRY *e; - char buf[256]; - /* make sure have a certificate */ - if (!cert) return "No certificate from server"; - /* Method 1: locate CN */ -#ifndef OPENSSL_1_1_0 - if (cert->name == NIL) - ret = "No name in certificate"; - else if ((s = strstr (cert->name,"/CN=")) != NIL) { - m++; /* count that we tried this method */ - if (t = strchr (s += 4,'/')) *t = '\0'; - /* host name matches pattern? */ - ret = ssl_compare_hostnames (host,s) ? NIL : - "Server name does not match certificate"; - if (t) *t = '/'; /* restore smashed delimiter */ - /* if mismatch, see if in extensions */ - if (ret && (ext = X509_get_ext_d2i (cert,NID_subject_alt_name,NIL,NIL)) && - (n = sk_GENERAL_NAME_num (ext))) - /* older versions of OpenSSL use "ia5" instead of dNSName */ - for (i = 0; ret && (i < n); i++) - if ((name = sk_GENERAL_NAME_value (ext,i)) && - (name->type = GEN_DNS) && (s = name->d.ia5->data) && - ssl_compare_hostnames (host,s)) ret = NIL; - } -#endif /* OPENSSL_1_1_0 */ - /* Method 2, use Cname */ - if(m == 0 || ret != NIL){ - cname = X509_get_subject_name(cert); - for(j = 0, ret = NIL; j < X509_NAME_entry_count(cname) && ret == NIL; j++){ - if((e = X509_NAME_get_entry(cname, j)) != NULL){ - X509_NAME_get_text_by_OBJ(cname, X509_NAME_ENTRY_get_object(e), buf, sizeof(buf)); - s = (char *) buf; - } - else s = NIL; - if (s != NIL) { - /* host name matches pattern? */ - ret = ssl_compare_hostnames (host,s) ? NIL : - "Server name does not match certificate"; - /* if mismatch, see if in extensions */ - if (ret && (ext = X509_get_ext_d2i (cert,NID_subject_alt_name,NIL,NIL)) && - (n = sk_GENERAL_NAME_num (ext))) - /* older versions of OpenSSL use "ia5" instead of dNSName */ - for (i = 0; ret && (i < n); i++) - if ((name = sk_GENERAL_NAME_value (ext,i)) && - (name->type = GEN_DNS) && (s = name->d.ia5->data) && - ssl_compare_hostnames (host,s)) ret = NIL; - } - } - } - - if (ret == NIL -#ifndef OPENSSL_1_1_0 - && !cert->name -#endif /* OPENSSL_1_1_9 */ - && !X509_get_subject_name(cert)) - ret = "No name in certificate"; - - if (ret == NIL && s == NIL) - ret = "Unable to locate common name in certificate"; - - return ret; -} - -/* Case-independent wildcard pattern match - * Accepts: base string - * pattern string - * Returns: T if pattern matches base, else NIL - */ - -static long ssl_compare_hostnames (unsigned char *s,unsigned char *pat) -{ - long ret = NIL; - switch (*pat) { - case '*': /* wildcard */ - if (pat[1]) { /* there must be a pattern suffix */ - /* there is, scan base against it */ - do if (ssl_compare_hostnames (s,pat+1)) ret = LONGT; - while (!ret && (*s != '.') && *s++); - } - break; - case '\0': /* end of pattern */ - if (!*s) ret = LONGT; /* success if base is also at end */ - break; - default: /* non-wildcard, recurse if match */ - if (!compare_uchar (*pat,*s)) ret = ssl_compare_hostnames (s+1,pat+1); - break; - } - return ret; -} - -/* SSL receive line - * Accepts: SSL stream - * Returns: text line string or NIL if failure - */ - -char *ssl_getline (SSLSTREAM *stream) -{ - unsigned long n,contd; - char *ret = ssl_getline_work (stream,&n,&contd); - if (ret && contd) { /* got a line needing continuation? */ - STRINGLIST *stl = mail_newstringlist (); - STRINGLIST *stc = stl; - do { /* collect additional lines */ - stc->text.data = (unsigned char *) ret; - stc->text.size = n; - stc = stc->next = mail_newstringlist (); - ret = ssl_getline_work (stream,&n,&contd); - } while (ret && contd); - if (ret) { /* stash final part of line on list */ - stc->text.data = (unsigned char *) ret; - stc->text.size = n; - /* determine how large a buffer we need */ - for (n = 0, stc = stl; stc; stc = stc->next) n += stc->text.size; - ret = fs_get (n + 1); /* copy parts into buffer */ - for (n = 0, stc = stl; stc; n += stc->text.size, stc = stc->next) - memcpy (ret + n,stc->text.data,stc->text.size); - ret[n] = '\0'; - } - mail_free_stringlist (&stl);/* either way, done with list */ - } - return ret; -} - -/* SSL receive line or partial line - * Accepts: SSL stream - * pointer to return size - * pointer to return continuation flag - * Returns: text line string, size and continuation flag, or NIL if failure - */ - -static char *ssl_getline_work (SSLSTREAM *stream,unsigned long *size, - long *contd) -{ - unsigned long n; - char *s,*ret,c,d; - *contd = NIL; /* assume no continuation */ - /* make sure have data */ - if (!ssl_getdata (stream)) return NIL; - for (s = stream->iptr, n = 0, c = '\0'; stream->ictr--; n++, c = d) { - d = *stream->iptr++; /* slurp another character */ - if ((c == '\015') && (d == '\012')) { - ret = (char *) fs_get (n--); - memcpy (ret,s,*size = n); /* copy into a free storage string */ - ret[n] = '\0'; /* tie off string with null */ - return ret; - } - } - /* copy partial string from buffer */ - memcpy ((ret = (char *) fs_get (n)),s,*size = n); - /* get more data from the net */ - if (!ssl_getdata (stream)) fs_give ((void **) &ret); - /* special case of newline broken by buffer */ - else if ((c == '\015') && (*stream->iptr == '\012')) { - stream->iptr++; /* eat the line feed */ - stream->ictr--; - ret[*size = --n] = '\0'; /* tie off string with null */ - } - else *contd = LONGT; /* continuation needed */ - return ret; -} - -/* SSL receive buffer - * Accepts: SSL stream - * size in bytes - * buffer to read into - * Returns: T if success, NIL otherwise - */ - -long ssl_getbuffer (SSLSTREAM *stream,unsigned long size,char *buffer) -{ - unsigned long n; - while (size > 0) { /* until request satisfied */ - if (!ssl_getdata (stream)) return NIL; - n = min (size,stream->ictr);/* number of bytes to transfer */ - /* do the copy */ - memcpy (buffer,stream->iptr,n); - buffer += n; /* update pointer */ - stream->iptr += n; - size -= n; /* update # of bytes to do */ - stream->ictr -= n; - } - buffer[0] = '\0'; /* tie off string */ - return T; -} - -/* SSL receive data - * Accepts: TCP/IP stream - * Returns: T if success, NIL otherwise - */ - -#ifdef FD_SETSIZE -#undef FD_SETSIZE -#endif /* FD_SETSIZE */ -#define FD_SETSIZE 16384 - -long ssl_getdata (SSLSTREAM *stream) -{ - int i,sock; - fd_set fds,efds; - struct timeval tmo; - tcptimeout_t tmoh = (tcptimeout_t) mail_parameters (NIL,GET_TIMEOUT,NIL); - long ttmo_read = (long) mail_parameters (NIL,GET_READTIMEOUT,NIL); - time_t t = time (0); - blocknotify_t bn = (blocknotify_t) mail_parameters (NIL,GET_BLOCKNOTIFY,NIL); - if (!stream->con || ((sock = SSL_get_fd (stream->con)) < 0)) return NIL; - /* tcp_unix should have prevented this */ - if (sock >= FD_SETSIZE) fatal ("unselectable socket in ssl_getdata()"); - (*bn) (BLOCK_TCPREAD,NIL); - while (stream->ictr < 1) { /* if nothing in the buffer */ - time_t tl = time (0); /* start of request */ - time_t now = tl; - int ti = ttmo_read ? now + ttmo_read : 0; - if (SSL_pending (stream->con)) i = 1; - else { - if (tcpdebug) mm_log ("Reading SSL data",TCPDEBUG); - tmo.tv_usec = 0; - FD_ZERO (&fds); /* initialize selection vector */ - FD_ZERO (&efds); /* handle errors too */ - FD_SET (sock,&fds); /* set bit in selection vector */ - FD_SET (sock,&efds); /* set bit in error selection vector */ - errno = NIL; /* block and read */ - do { /* block under timeout */ - tmo.tv_sec = ti ? ti - now : 0; - i = select (sock+1,&fds,0,&efds,ti ? &tmo : 0); - now = time (0); /* fake timeout if interrupt & time expired */ - if ((i < 0) && (errno == EINTR) && ti && (ti <= now)) i = 0; - } while ((i < 0) && (errno == EINTR)); - } - if (i) { /* non-timeout result from select? */ - errno = 0; /* just in case */ - if (i > 0) /* read what we can */ - while (((i = SSL_read (stream->con,stream->ibuf,SSLBUFLEN)) < 0) && - ((errno == EINTR) || - (SSL_get_error (stream->con,i) == SSL_ERROR_WANT_READ))); - if (i <= 0) { /* error seen? */ - if (tcpdebug) { - char *s,tmp[MAILTMPLEN]; - if (i) sprintf (s = tmp,"SSL data read I/O error %d SSL error %d", - errno,SSL_get_error (stream->con,i)); - else s = "SSL data read end of file"; - mm_log (s,TCPDEBUG); - } - return ssl_abort (stream); - } - stream->iptr = stream->ibuf;/* point at TCP buffer */ - stream->ictr = i; /* set new byte count */ - if (tcpdebug) mm_log ("Successfully read SSL data",TCPDEBUG); - } - /* timeout, punt unless told not to */ - else if (!tmoh || !(*tmoh) (now - t,now - tl, stream->tcpstream->host)) { - if (tcpdebug) mm_log ("SSL data read timeout",TCPDEBUG); - return ssl_abort (stream); - } - } - (*bn) (BLOCK_NONE,NIL); - return T; -} - -/* SSL send string as record - * Accepts: SSL stream - * string pointer - * Returns: T if success else NIL - */ - -long ssl_soutr (SSLSTREAM *stream,char *string) -{ - return ssl_sout (stream,string,(unsigned long) strlen (string)); -} - - -/* SSL send string - * Accepts: SSL stream - * string pointer - * byte count - * Returns: T if success else NIL - */ - -long ssl_sout (SSLSTREAM *stream,char *string,unsigned long size) -{ - long i; - blocknotify_t bn = (blocknotify_t) mail_parameters (NIL,GET_BLOCKNOTIFY,NIL); - if (!stream->con) return NIL; - (*bn) (BLOCK_TCPWRITE,NIL); - if (tcpdebug) mm_log ("Writing to SSL",TCPDEBUG); - /* until request satisfied */ - for (i = 0; size > 0; string += i,size -= i) - /* write as much as we can */ - if ((i = SSL_write (stream->con,string,(int) min (SSLBUFLEN,size))) < 0) { - if (tcpdebug) { - char tmp[MAILTMPLEN]; - sprintf (tmp,"SSL data write I/O error %d SSL error %d", - errno,SSL_get_error (stream->con,i)); - mm_log (tmp,TCPDEBUG); - } - return ssl_abort (stream);/* write failed */ - } - if (tcpdebug) mm_log ("successfully wrote to TCP",TCPDEBUG); - (*bn) (BLOCK_NONE,NIL); - return LONGT; /* all done */ -} - -/* SSL close - * Accepts: SSL stream - */ - -void ssl_close (SSLSTREAM *stream) -{ - ssl_abort (stream); /* nuke the stream */ - fs_give ((void **) &stream); /* flush the stream */ -} - - -/* SSL abort stream - * Accepts: SSL stream - * Returns: NIL always - */ - -static long ssl_abort (SSLSTREAM *stream) -{ - blocknotify_t bn = (blocknotify_t) mail_parameters (NIL,GET_BLOCKNOTIFY,NIL); - if (stream->con) { /* close SSL connection */ - SSL_shutdown (stream->con); - SSL_free (stream->con); - stream->con = NIL; - } - if (stream->context) { /* clean up context */ - SSL_CTX_free (stream->context); - stream->context = NIL; - } - if (stream->tcpstream) { /* close TCP stream */ - tcp_close (stream->tcpstream); - stream->tcpstream = NIL; - } - (*bn) (BLOCK_NONE,NIL); - return NIL; -} - -/* SSL get host name - * Accepts: SSL stream - * Returns: host name for this stream - */ - -char *ssl_host (SSLSTREAM *stream) -{ - return stream ? tcp_host (stream->tcpstream) : "UNKNOWN"; -} - - -/* SSL get remote host name - * Accepts: SSL stream - * Returns: host name for this stream - */ - -char *ssl_remotehost (SSLSTREAM *stream) -{ - return tcp_remotehost (stream->tcpstream); -} - - -/* SSL return port for this stream - * Accepts: SSL stream - * Returns: port number for this stream - */ - -unsigned long ssl_port (SSLSTREAM *stream) -{ - return tcp_port (stream->tcpstream); -} - - -/* SSL get local host name - * Accepts: SSL stream - * Returns: local host name - */ - -char *ssl_localhost (SSLSTREAM *stream) -{ - return tcp_localhost (stream->tcpstream); -} - -#ifdef SSL_CERT_DIRECTORY -#undef SSL_CERT_DIRECTORY -#endif /* SSL_CERT_DIRECTORY */ -#define SSL_CERT_DIRECTORY "C:\\\\libressl\\ssl\\certs" - -#ifdef SSL_KEY_DIRECTORY -#undef SSL_KEY_DIRECTORY -#endif /* SSL_KEY_DIRECTORY */ -#define SSL_KEY_DIRECTORY "C:\\\\libressl\\ssl\\private" - - -/* Start TLS - * Accepts: /etc/services service name - * Returns: cpystr'd error string if TLS failed, else NIL for success - */ -char *ssl_start_tls (char *server) -{ - char tmp[MAILTMPLEN]; - struct stat sbuf; - if (sslstdio) return cpystr ("Already in an SSL session"); - if (start_tls) return cpystr ("TLS already started"); - if (server) { /* build specific certificate/key file name */ - sprintf (tmp,"%s\\%s-%s.pem",SSL_CERT_DIRECTORY,server,tcp_serveraddr ()); - if (stat (tmp,&sbuf)) { /* use non-specific name if no specific file */ - sprintf (tmp,"%s\\%s.pem",SSL_CERT_DIRECTORY,server); - if (stat (tmp,&sbuf)) return cpystr ("Server certificate not installed"); - } - start_tls = server; /* switch to STARTTLS mode */ - } - return NIL; -} - -/* Init server for SSL - * Accepts: server name - */ - -void ssl_server_init (char *server) -{ - char cert[MAILTMPLEN],key[MAILTMPLEN]; - unsigned long i; - struct stat sbuf; - SSLSTREAM *stream = (SSLSTREAM *) memset (fs_get (sizeof (SSLSTREAM)),0, - sizeof (SSLSTREAM)); - ssl_onceonlyinit (); /* make sure algorithms added */ -#ifdef OPENSSL_1_1_0 - OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL); - OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS|OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL); -#else - ERR_load_crypto_strings (); - SSL_load_error_strings (); -#endif /* OPENSSL_1_1_0 */ - /* build specific certificate/key file names */ - sprintf (cert,"%s\\%s-%s.pem",SSL_CERT_DIRECTORY,server,tcp_serveraddr ()); - sprintf (key,"%s\\%s-%s.pem",SSL_KEY_DIRECTORY,server,tcp_serveraddr ()); - /* use non-specific name if no specific cert */ - if (stat (cert,&sbuf)) sprintf (cert,"%s\\%s.pem",SSL_CERT_DIRECTORY,server); - if (stat (key,&sbuf)) { /* use non-specific name if no specific key */ - sprintf (key,"%s\\%s.pem",SSL_KEY_DIRECTORY,server); - /* use cert file as fallback for key */ - if (stat (key,&sbuf)) strcpy (key,cert); - } - /* create context */ -#ifdef OPENSSL_1_1_0 - if (!(stream->context = SSL_CTX_new (start_tls ? - TLS_server_method () : - SSLv23_server_method ()))) -#else - if (!(stream->context = SSL_CTX_new (start_tls ? - TLSv1_server_method () : - SSLv23_server_method ()))) -#endif /* OPENSSL_1_1_0 */ - syslog (LOG_ALERT,"Unable to create SSL context, host=%.80s", - tcp_clienthost ()); - else { /* set context options */ - SSL_CTX_set_options (stream->context,SSL_OP_ALL); - /* set cipher list */ - if (!SSL_CTX_set_cipher_list (stream->context,SSLCIPHERLIST)) - syslog (LOG_ALERT,"Unable to set cipher list %.80s, host=%.80s", - SSLCIPHERLIST,tcp_clienthost ()); - /* load certificate */ - else if (!SSL_CTX_use_certificate_chain_file (stream->context,cert)) - syslog (LOG_ALERT,"Unable to load certificate from %.80s, host=%.80s", - cert,tcp_clienthost ()); - /* load key */ - else if (!(SSL_CTX_use_RSAPrivateKey_file (stream->context,key, - SSL_FILETYPE_PEM))) - syslog (LOG_ALERT,"Unable to load private key from %.80s, host=%.80s", - key,tcp_clienthost ()); - - else { /* generate key if needed */ -#ifdef OPENSSL_1_1_0 - if (0) - ssl_genkey(stream->context, 0, 0); -#else - if (SSL_CTX_need_tmp_RSA (stream->context)) - SSL_CTX_set_tmp_rsa_callback (stream->context,ssl_genkey); -#endif /* OPENSSL_1_1_0 */ - /* create new SSL connection */ - if (!(stream->con = SSL_new (stream->context))) - syslog (LOG_ALERT,"Unable to create SSL connection, host=%.80s", - tcp_clienthost ()); - else { /* set file descriptor */ - SSL_set_fd (stream->con,0); - /* all OK if accepted */ - if (SSL_accept (stream->con) < 0) - syslog (LOG_INFO,"Unable to accept SSL connection, host=%.80s", - tcp_clienthost ()); - else { /* server set up */ - sslstdio = (SSLSTDIOSTREAM *) - memset (fs_get (sizeof(SSLSTDIOSTREAM)),0,sizeof (SSLSTDIOSTREAM)); - sslstdio->sslstream = stream; - /* available space in output buffer */ - sslstdio->octr = SSLBUFLEN; - /* current output buffer pointer */ - sslstdio->optr = sslstdio->obuf; - /* allow plaintext if disable value was 2 */ - if ((long) mail_parameters (NIL,GET_DISABLEPLAINTEXT,NIL) > 1) - mail_parameters (NIL,SET_DISABLEPLAINTEXT,NIL); - /* unhide PLAIN SASL authenticator */ - mail_parameters (NIL,UNHIDE_AUTHENTICATOR,"PLAIN"); - mail_parameters (NIL,UNHIDE_AUTHENTICATOR,"LOGIN"); - return; - } - } - } - } - while ((i = ERR_get_error ()) != 0L) /* SSL failure */ - syslog (LOG_ERR,"SSL error status: %.80s",ERR_error_string (i,NIL)); - ssl_close (stream); /* punt stream */ - exit (1); /* punt this program too */ -} - -/* Generate one-time key for server - * Accepts: SSL connection - * export flag - * keylength - * Returns: generated key, always - */ - -static RSA *ssl_genkey (SSL_CTX_TYPE *con,int export,int keylength) -{ - unsigned long i; - static RSA *key = NIL; - if (!key) { /* if don't have a key already */ - /* generate key */ -#ifdef OPENSSL_1_1_0 - BIGNUM *e = BN_new(); - if (!RSA_generate_key_ex (key, export ? keylength : 1024, e,NIL)) { -#else - if (!(key = RSA_generate_key (export ? keylength : 1024,RSA_F4,NIL,NIL))) { -#endif /* OPENSSL_1_1_0 */ - syslog (LOG_ALERT,"Unable to generate temp key, host=%.80s", - tcp_clienthost ()); - while ((i = ERR_get_error ()) != 0L) - syslog (LOG_ALERT,"SSL error status: %s",ERR_error_string (i,NIL)); - exit (1); - } -#ifdef OPENSSL_1_1_0 - BN_free(e); - e = NULL; -#endif /* OPENSSL_1_1_0 */ - } - return key; -} - -/* Wait for stdin input - * Accepts: timeout in seconds - * Returns: T if have input on stdin, else NIL - */ - -long ssl_server_input_wait (long seconds) -{ - int i,sock; - fd_set fds,efd; - struct timeval tmo; - SSLSTREAM *stream; - if (!sslstdio) return server_input_wait (seconds); - /* input available in buffer */ - if (((stream = sslstdio->sslstream)->ictr > 0) || - !stream->con || ((sock = SSL_get_fd (stream->con)) < 0)) return LONGT; - /* sock ought to be 0 always */ - if (sock >= FD_SETSIZE) fatal ("unselectable socket in ssl_getdata()"); - /* input available from SSL */ - if (SSL_pending (stream->con) && - ((i = SSL_read (stream->con,stream->ibuf,SSLBUFLEN)) > 0)) { - stream->iptr = stream->ibuf;/* point at TCP buffer */ - stream->ictr = i; /* set new byte count */ - return LONGT; - } - FD_ZERO (&fds); /* initialize selection vector */ - FD_ZERO (&efd); /* initialize selection vector */ - FD_SET (sock,&fds); /* set bit in selection vector */ - FD_SET (sock,&efd); /* set bit in selection vector */ - tmo.tv_sec = seconds; tmo.tv_usec = 0; - /* see if input available from the socket */ - return select (sock+1,&fds,0,&efd,&tmo) ? LONGT : NIL; -} - -#include "sslstdio.c" -#else /* ENABLE_WINDOWS_LIBRESSL */ -#define SECURITY_WIN32 -#include <sspi.h> -#include <schannel.h> - - -#define SSLBUFLEN 8192 - - -/* SSL I/O stream */ - -typedef struct ssl_stream { - TCPSTREAM *tcpstream; /* TCP stream */ - CredHandle cred; /* SSL credentials */ - CtxtHandle context; /* SSL context */ - /* stream encryption sizes */ - SecPkgContext_StreamSizes sizes; - size_t bufsize; - int ictr; /* input counter */ - char *iptr; /* input pointer */ - int iextractr; /* extra input counter */ - char *iextraptr; /* extra input pointer */ - char *ibuf; /* input buffer */ - char *obuf; /* output buffer */ -} SSLSTREAM; - -#include "sslio.h" - - -/* Function prototypes */ - -static SSLSTREAM *ssl_start(TCPSTREAM *tstream,char *host,unsigned long flags); -static char *ssl_analyze_status (SECURITY_STATUS err,char *buf); -static char *ssl_getline_work (SSLSTREAM *stream,unsigned long *size, - long *contd); -static long ssl_abort (SSLSTREAM *stream); - -/* Secure Sockets Layer network driver dispatch */ - -static struct ssl_driver ssldriver = { - ssl_open, /* open connection */ - ssl_aopen, /* open preauthenticated connection */ - ssl_getline, /* get a line */ - ssl_getbuffer, /* get a buffer */ - ssl_soutr, /* output pushed data */ - ssl_sout, /* output string */ - ssl_close, /* close connection */ - ssl_host, /* return host name */ - ssl_remotehost, /* return remote host name */ - ssl_port, /* return port number */ - ssl_localhost /* return local host name */ -}; - - /* security function table */ -static SecurityFunctionTable *sft = NIL; -static unsigned long ssltsz = 0;/* SSL maximum token length */ - - -/* Define crypt32.dll stuff here in case a pre-IE5 Win9x system */ - -typedef DWORD (CALLBACK *CNTS) (DWORD,PCERT_NAME_BLOB,DWORD,LPSTR,DWORD); -typedef BOOL (CALLBACK *CGCC) (HCERTCHAINENGINE,PCCERT_CONTEXT,LPFILETIME, - HCERTSTORE,PCERT_CHAIN_PARA,DWORD,LPVOID, - PCCERT_CHAIN_CONTEXT *); -typedef BOOL (CALLBACK *CVCCP) (LPCSTR,PCCERT_CHAIN_CONTEXT, - PCERT_CHAIN_POLICY_PARA, - PCERT_CHAIN_POLICY_STATUS); -typedef VOID (CALLBACK *CFCC) (PCCERT_CHAIN_CONTEXT); -typedef BOOL (CALLBACK *CFCCX) (PCCERT_CONTEXT); - -static CNTS certNameToStr = NIL; -static CGCC certGetCertificateChain = NIL; -static CVCCP certVerifyCertificateChainPolicy = NIL; -static CFCC certFreeCertificateChain = NIL; -static CFCCX certFreeCertificateContext = NIL; - -/* One-time SSL initialization */ - -static int sslonceonly = 0; - -void ssl_onceonlyinit (void) -{ - if (!sslonceonly++) { /* only need to call it once */ - HINSTANCE lib; - FARPROC pi; - ULONG np; - SecPkgInfo *pp; - int i; - /* get security library */ - if (((lib = LoadLibrary ("schannel.dll")) || - (lib = LoadLibrary ("security.dll"))) && - (pi = GetProcAddress (lib,SECURITY_ENTRYPOINT)) && - (sft = (SecurityFunctionTable *) pi ()) && - !(sft->EnumerateSecurityPackages (&np,&pp))) { - /* look for an SSL package */ - for (i = 0; (i < (int) np); i++) if (!strcmp (pp[i].Name,UNISP_NAME)) { - /* note maximum token size and name */ - ssltsz = pp[i].cbMaxToken; - /* apply runtime linkage */ - mail_parameters (NIL,SET_SSLDRIVER,(void *) &ssldriver); - mail_parameters (NIL,SET_SSLSTART,(void *) ssl_start); - if ((lib = LoadLibrary ("crypt32.dll")) && - (certGetCertificateChain = (CGCC) - GetProcAddress (lib,"CertGetCertificateChain")) && - (certVerifyCertificateChainPolicy = (CVCCP) - GetProcAddress (lib,"CertVerifyCertificateChainPolicy")) && - (certFreeCertificateChain = (CFCC) - GetProcAddress (lib,"CertFreeCertificateChain")) && - (certFreeCertificateContext = (CFCCX) - GetProcAddress (lib,"CertFreeCertificateContext"))) - certNameToStr = (CNTS) GetProcAddress (lib,"CertNameToStrA"); - return; /* all done */ - } - } - } -} - -/* SSL open - * Accepts: host name - * contact service name - * contact port number - * Returns: SSL stream if success else NIL - */ - -SSLSTREAM *ssl_open (char *host,char *service,unsigned long port) -{ - TCPSTREAM *stream = tcp_open (host,service,port); - return stream ? ssl_start (stream,host,port) : NIL; -} - - -/* SSL authenticated open - * Accepts: host name - * service name - * returned user name buffer - * Returns: SSL stream if success else NIL - */ - -SSLSTREAM *ssl_aopen (NETMBX *mb,char *service,char *usrbuf) -{ - return NIL; /* don't use this mechanism with SSL */ -} - -/* Start SSL/TLS negotiations - * Accepts: open TCP stream of session - * user's host name - * flags - * Returns: SSL stream if success else NIL - */ - -static SSLSTREAM *ssl_start (TCPSTREAM *tstream,char *host,unsigned long flags) -{ - SECURITY_STATUS e; - ULONG a; - TimeStamp t; - SecBuffer ibuf[2],obuf[1]; - SecBufferDesc ibufs,obufs; - SCHANNEL_CRED tlscred; - CERT_CONTEXT *cert = NIL; - CERT_CHAIN_PARA chparam; - CERT_CHAIN_CONTEXT *chain; - SSL_EXTRA_CERT_CHAIN_POLICY_PARA policy; - CERT_CHAIN_POLICY_PARA polparam; - CERT_CHAIN_POLICY_STATUS status; - char tmp[MAILTMPLEN],certname[256]; - char *reason = NIL; - ULONG req = ISC_REQ_REPLAY_DETECT | ISC_REQ_SEQUENCE_DETECT | - ISC_REQ_CONFIDENTIALITY | ISC_REQ_USE_SESSION_KEY | - ISC_REQ_ALLOCATE_MEMORY | ISC_REQ_STREAM | ISC_REQ_EXTENDED_ERROR | - ISC_REQ_MANUAL_CRED_VALIDATION; - LPSTR usage[] = { - szOID_PKIX_KP_SERVER_AUTH, - szOID_SERVER_GATED_CRYPTO, - szOID_SGC_NETSCAPE - }; - PWSTR whost = NIL; - char *buf = (char *) fs_get (ssltsz); - unsigned long size = 0; - sslcertificatequery_t scq = - (sslcertificatequery_t) mail_parameters (NIL,GET_SSLCERTIFICATEQUERY,NIL); - sslfailure_t sf = (sslfailure_t) mail_parameters (NIL,GET_SSLFAILURE,NIL); - SSLSTREAM *stream = (SSLSTREAM *) memset (fs_get (sizeof (SSLSTREAM)),0, - sizeof (SSLSTREAM)); - stream->tcpstream = tstream; /* bind TCP stream */ - /* initialize TLS credential */ - memset (&tlscred,0,sizeof (SCHANNEL_CRED)); - tlscred.dwVersion = SCHANNEL_CRED_VERSION; - tlscred.grbitEnabledProtocols = SP_PROT_TLS1; - - /* acquire credentials */ - if (sft->AcquireCredentialsHandle - (NIL,UNISP_NAME,SECPKG_CRED_OUTBOUND,NIL,(flags & NET_TLSCLIENT) ? - &tlscred : NIL,NIL,NIL,&stream->cred,&t) - != SEC_E_OK) reason = "Acquire credentials handle failed"; - else while (!reason) { /* negotiate security context */ - /* initialize buffers */ - ibuf[0].cbBuffer = size; ibuf[0].pvBuffer = buf; - ibuf[1].cbBuffer = 0; ibuf[1].pvBuffer = NIL; - obuf[0].cbBuffer = 0; obuf[0].pvBuffer = NIL; - ibuf[0].BufferType = obuf[0].BufferType = SECBUFFER_TOKEN; - ibuf[1].BufferType = SECBUFFER_EMPTY; - /* initialize buffer descriptors */ - ibufs.ulVersion = obufs.ulVersion = SECBUFFER_VERSION; - ibufs.cBuffers = 2; obufs.cBuffers = 1; - ibufs.pBuffers = ibuf; obufs.pBuffers = obuf; - /* negotiate security */ - e = sft->InitializeSecurityContext - (&stream->cred,size ? &stream->context : NIL,host,req,0, - SECURITY_NETWORK_DREP,size? &ibufs:NIL,0,&stream->context,&obufs,&a,&t); - /* have an output buffer we need to send? */ - if (obuf[0].pvBuffer && obuf[0].cbBuffer) { - if (!tcp_sout (stream->tcpstream,obuf[0].pvBuffer,obuf[0].cbBuffer)) - reason = "Unexpected TCP output disconnect"; - /* free the buffer */ - sft->FreeContextBuffer (obuf[0].pvBuffer); - } - if (!reason) switch (e) { /* negotiation state */ - case SEC_I_INCOMPLETE_CREDENTIALS: - break; /* server wants client auth */ - case SEC_I_CONTINUE_NEEDED: - if (size) { /* continue, read any data? */ - /* yes, anything regurgiated back to us? */ - if (ibuf[1].BufferType == SECBUFFER_EXTRA) { - /* yes, set this as the new data */ - memmove (buf,buf + size - ibuf[1].cbBuffer,ibuf[1].cbBuffer); - size = ibuf[1].cbBuffer; - break; - } - size = 0; /* otherwise, read more stuff from server */ - } - case SEC_E_INCOMPLETE_MESSAGE: - /* need to read more data from server */ - if (!tcp_getdata (stream->tcpstream)) - reason = "Unexpected TCP input disconnect"; - else { - memcpy (buf+size,stream->tcpstream->iptr,stream->tcpstream->ictr); - size += stream->tcpstream->ictr; - /* empty it from TCP's buffers */ - stream->tcpstream->iptr += stream->tcpstream->ictr; - stream->tcpstream->ictr = 0; - } - break; - - case SEC_E_OK: /* success, any data to be regurgitated? */ - if (ibuf[1].BufferType == SECBUFFER_EXTRA) { - /* yes, set this as the new data */ - memmove (stream->tcpstream->iptr = stream->tcpstream->ibuf, - buf + size - ibuf[1].cbBuffer,ibuf[1].cbBuffer); - stream->tcpstream->ictr = ibuf[1].cbBuffer; - } - if (certNameToStr && !(flags & NET_NOVALIDATECERT)) { - /* need validation, make wchar of host */ - if (!((size = MultiByteToWideChar (CP_ACP,0,host,-1,NIL,0)) && - (whost = (PWSTR) fs_get (size*sizeof (WCHAR))) && - MultiByteToWideChar (CP_ACP,0,host,-1,whost,size))) - fatal ("Can't make wchar of host name!"); - /* get certificate */ - if ((sft->QueryContextAttributes - (&stream->context,SECPKG_ATTR_REMOTE_CERT_CONTEXT,&cert) != - SEC_E_OK) || !cert) { - reason = "*Unable to get certificate"; - strcpy (certname,"<no certificate>"); - } - else { /* get certificate subject name */ - (*certNameToStr) (X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, - &cert->pCertInfo->Subject,CERT_X500_NAME_STR, - certname,255); - /* build certificate chain */ - memset (&chparam,0,sizeof (chparam)); - chparam.cbSize = sizeof (chparam); - chparam.RequestedUsage.dwType = USAGE_MATCH_TYPE_OR; - chparam.RequestedUsage.Usage.rgpszUsageIdentifier = usage; - chparam.RequestedUsage.Usage.cUsageIdentifier = - sizeof (usage) / sizeof (LPSTR); - if (!(*certGetCertificateChain) - (NIL,cert,NIL,cert->hCertStore,&chparam,NIL,NIL,&chain)) - reason = ssl_analyze_status (GetLastError (),tmp); - else { /* validate certificate chain */ - memset (&policy,0,sizeof (SSL_EXTRA_CERT_CHAIN_POLICY_PARA)); - policy.cbStruct = sizeof (SSL_EXTRA_CERT_CHAIN_POLICY_PARA); - policy.dwAuthType = AUTHTYPE_SERVER; - policy.fdwChecks = NIL; - policy.pwszServerName = whost; - memset (&polparam,0,sizeof (polparam)); - polparam.cbSize = sizeof (polparam); - polparam.pvExtraPolicyPara = &policy; - memset (&status,0,sizeof (status)); - status.cbSize = sizeof (status); - if (!(*certVerifyCertificateChainPolicy) - (CERT_CHAIN_POLICY_SSL,chain,&polparam,&status)) - reason = ssl_analyze_status (GetLastError (),tmp); - else if (status.dwError) - reason = ssl_analyze_status (status.dwError,tmp); - (*certFreeCertificateChain) (chain); - } - (*certFreeCertificateContext) (cert); - } - if (whost) fs_give ((void **) &whost); - - if (reason) { /* got an error? */ - /* application callback */ - if (scq) reason = (*scq) ((*reason == '*') ? reason + 1 : reason, - host,certname) ? NIL : ""; - else if (*certname) { /* error message to return via mm_log() */ - sprintf (buf,"*%.128s: %.255s", - (*reason == '*') ? reason + 1 : reason,certname); - reason = buf; - } - } - } - if (reason || - (reason = ssl_analyze_status - (sft->QueryContextAttributes - (&stream->context,SECPKG_ATTR_STREAM_SIZES,&stream->sizes),buf))) - break; /* error in certificate or getting sizes */ - fs_give ((void **) &buf); /* flush temporary buffer */ - /* make maximum-sized buffers */ - stream->bufsize = stream->sizes.cbHeader + - stream->sizes.cbMaximumMessage + stream->sizes.cbTrailer; - if (stream->sizes.cbMaximumMessage < SSLBUFLEN) - fatal ("cbMaximumMessage is less than SSLBUFLEN!"); - else if (stream->sizes.cbMaximumMessage < 16384) { - sprintf (tmp,"WINDOWS BUG: cbMaximumMessage = %ld, should be 16384", - (long) stream->sizes.cbMaximumMessage); - mm_log (tmp,NIL); - } - stream->ibuf = (char *) fs_get (stream->bufsize); - stream->obuf = (char *) fs_get (stream->bufsize); - return stream; - default: - reason = ssl_analyze_status (e,buf); - } - } - ssl_close (stream); /* failed to do SSL */ - stream = NIL; /* no stream returned */ - switch (*reason) { /* analyze reason */ - case '*': /* certificate failure */ - ++reason; /* skip over certificate failure indication */ - /* pass to error callback */ - if (sf) (*sf) (host,reason,flags); - else { /* no error callback, build error message */ - sprintf (tmp,"Certificate failure for %.80s: %.512s",host,reason); - mm_log (tmp,ERROR); - } - case '\0': /* user answered no to certificate callback */ - if (flags & NET_TRYSSL) /* return dummy stream to stop tryssl */ - stream = (SSLSTREAM *) memset (fs_get (sizeof (SSLSTREAM)),0, - sizeof (SSLSTREAM)); - break; - default: /* non-certificate failure */ - if (flags & NET_TRYSSL); /* no error output if tryssl */ - /* pass to error callback */ - else if (sf) (*sf) (host,reason,flags); - else { /* no error callback, build error message */ - sprintf (tmp,"TLS/SSL failure for %.80s: %.512s",host,reason); - mm_log (tmp,ERROR); - } - break; - } - fs_give ((void **) &buf); /* flush temporary buffer */ - return stream; -} - -/* Generate error text from SSL error code - * Accepts: SSL status - * scratch buffer - * Returns: text if error status, else NIL - */ - -static char *ssl_analyze_status (SECURITY_STATUS err,char *buf) -{ - switch (err) { - case SEC_E_OK: /* no error */ - case SEC_I_CONTINUE_NEEDED: - case SEC_I_INCOMPLETE_CREDENTIALS: - case SEC_E_INCOMPLETE_MESSAGE: - return NIL; - case SEC_E_NO_AUTHENTICATING_AUTHORITY: - mm_log ("unexpected SEC_E_NO_AUTHENTICATING_AUTHORITY",NIL); - return "*No authority could be contacted for authentication"; - case SEC_E_WRONG_PRINCIPAL: - mm_log ("unexpected SEC_E_WRONG_PRINCIPAL",NIL); - case CERT_E_CN_NO_MATCH: - return "*Server name does not match certificate"; - case SEC_E_UNTRUSTED_ROOT: - mm_log ("unexpected SEC_E_UNTRUSTED_ROOT",NIL); - case CERT_E_UNTRUSTEDROOT: - return "*Self-signed certificate or untrusted authority"; - case SEC_E_CERT_EXPIRED: - mm_log ("unexpected SEC_E_CERT_EXPIRED",NIL); - case CERT_E_EXPIRED: - return "*Certificate has expired"; - case CERT_E_REVOKED: - return "*Certificate revoked"; - case SEC_E_INVALID_TOKEN: - return "Invalid token, probably not an SSL server"; - case SEC_E_UNSUPPORTED_FUNCTION: - return "SSL not supported on this machine - upgrade your system software"; - } - sprintf (buf,"Unexpected SSPI or certificate error %lx - report this",err); - return buf; -} - -/* SSL receive line - * Accepts: SSL stream - * Returns: text line string or NIL if failure - */ - -char *ssl_getline (SSLSTREAM *stream) -{ - unsigned long n,contd; - char *ret = ssl_getline_work (stream,&n,&contd); - if (ret && contd) { /* got a line needing continuation? */ - STRINGLIST *stl = mail_newstringlist (); - STRINGLIST *stc = stl; - do { /* collect additional lines */ - stc->text.data = (unsigned char *) ret; - stc->text.size = n; - stc = stc->next = mail_newstringlist (); - ret = ssl_getline_work (stream,&n,&contd); - } while (ret && contd); - if (ret) { /* stash final part of line on list */ - stc->text.data = (unsigned char *) ret; - stc->text.size = n; - /* determine how large a buffer we need */ - for (n = 0, stc = stl; stc; stc = stc->next) n += stc->text.size; - ret = fs_get (n + 1); /* copy parts into buffer */ - for (n = 0, stc = stl; stc; n += stc->text.size, stc = stc->next) - memcpy (ret + n,stc->text.data,stc->text.size); - ret[n] = '\0'; - } - mail_free_stringlist (&stl);/* either way, done with list */ - } - return ret; -} - -/* SSL receive line or partial line - * Accepts: SSL stream - * pointer to return size - * pointer to return continuation flag - * Returns: text line string, size and continuation flag, or NIL if failure - */ - -static char *ssl_getline_work (SSLSTREAM *stream,unsigned long *size, - long *contd) -{ - unsigned long n; - char *s,*ret,c,d; - *contd = NIL; /* assume no continuation */ - /* make sure have data */ - if (!ssl_getdata (stream)) return NIL; - for (s = stream->iptr, n = 0, c = '\0'; stream->ictr--; n++, c = d) { - d = *stream->iptr++; /* slurp another character */ - if ((c == '\015') && (d == '\012')) { - ret = (char *) fs_get (n--); - memcpy (ret,s,*size = n); /* copy into a free storage string */ - ret[n] = '\0'; /* tie off string with null */ - return ret; - } - } - /* copy partial string from buffer */ - memcpy ((ret = (char *) fs_get (n)),s,*size = n); - /* get more data from the net */ - if (!ssl_getdata (stream)) fs_give ((void **) &ret); - /* special case of newline broken by buffer */ - else if ((c == '\015') && (*stream->iptr == '\012')) { - stream->iptr++; /* eat the line feed */ - stream->ictr--; - ret[*size = --n] = '\0'; /* tie off string with null */ - } - else *contd = LONGT; /* continuation needed */ - return ret; -} - -/* SSL receive buffer - * Accepts: SSL stream - * size in bytes - * buffer to read into - * Returns: T if success, NIL otherwise - */ - -long ssl_getbuffer (SSLSTREAM *stream,unsigned long size,char *buffer) -{ - unsigned long n; - while (size > 0) { /* until request satisfied */ - if (!ssl_getdata (stream)) return NIL; - n = min (size,stream->ictr);/* number of bytes to transfer */ - /* do the copy */ - memcpy (buffer,stream->iptr,n); - buffer += n; /* update pointer */ - stream->iptr += n; - size -= n; /* update # of bytes to do */ - stream->ictr -= n; - } - buffer[0] = '\0'; /* tie off string */ - return T; -} - -/* SSL receive data - * Accepts: TCP/IP stream - * Returns: T if success, NIL otherwise - */ - -long ssl_getdata (SSLSTREAM *stream) -{ - while (stream->ictr < 1) { /* decrypted buffer empty? */ - SECURITY_STATUS status; - SecBuffer buf[4]; - SecBufferDesc msg; - size_t i; - size_t n = 0; /* initially no bytes to decrypt */ - if (!stream->tcpstream) return NIL; - do { /* yes, make sure have data from TCP */ - if (stream->iextractr) { /* have previous unread data? */ - memcpy (stream->ibuf + n,stream->iextraptr,stream->iextractr); - n += stream->iextractr; /* update number of bytes read */ - stream->iextractr = 0; /* no more extra data */ - } - else { /* read from TCP */ - if (!tcp_getdata (stream->tcpstream)) return ssl_abort (stream); - /* maximum amount of data to copy */ - if (!(i = min (stream->bufsize - n,stream->tcpstream->ictr))) - fatal ("incomplete SecBuffer exceeds maximum buffer size"); - /* do the copy */ - memcpy (stream->ibuf + n,stream->tcpstream->iptr,i); - stream->tcpstream->iptr += i; - stream->tcpstream->ictr -= i; - n += i; /* update number of bytes to decrypt */ - } - buf[0].cbBuffer = n; /* first SecBuffer gets data */ - buf[0].pvBuffer = stream->ibuf; - buf[0].BufferType = SECBUFFER_DATA; - /* subsequent ones are for spares */ - buf[1].BufferType = buf[2].BufferType = buf[3].BufferType = - SECBUFFER_EMPTY; - msg.ulVersion = SECBUFFER_VERSION; - msg.cBuffers = 4; /* number of SecBuffers */ - msg.pBuffers = buf; /* first SecBuffer */ - - } while ((status = ((DECRYPT_MESSAGE_FN) sft->Reserved4) - (&stream->context,&msg,0,NIL)) == SEC_E_INCOMPLETE_MESSAGE); - switch (status) { - case SEC_E_OK: /* won */ - case SEC_I_RENEGOTIATE: /* won but lost it after this buffer */ - /* hunt for a buffer */ - for (i = 0; (i < 4) && (buf[i].BufferType != SECBUFFER_DATA) ; i++); - if (i < 4) { /* found a buffer? */ - /* yes, set up pointer and counter */ - stream->iptr = buf[i].pvBuffer; - stream->ictr = buf[i].cbBuffer; - /* any unprocessed data? */ - while (++i < 4) if (buf[i].BufferType == SECBUFFER_EXTRA) { - /* yes, note for next time around */ - stream->iextraptr = buf[i].pvBuffer; - stream->iextractr = buf[i].cbBuffer; - } - } - break; - default: /* anything else means we've lost */ - return ssl_abort (stream); - } - } - return LONGT; -} - -/* SSL send string as record - * Accepts: SSL stream - * string pointer - * Returns: T if success else NIL - */ - -long ssl_soutr (SSLSTREAM *stream,char *string) -{ - return ssl_sout (stream,string,(unsigned long) strlen (string)); -} - - -/* SSL send string - * Accepts: SSL stream - * string pointer - * byte count - * Returns: T if success else NIL - */ - -long ssl_sout (SSLSTREAM *stream,char *string,unsigned long size) -{ - SecBuffer buf[4]; - SecBufferDesc msg; - char *s; - size_t n; - if (!stream->tcpstream) return NIL; - /* until request satisfied */ - for (s = stream->ibuf,n = 0; size;) { - /* header */ - buf[0].BufferType = SECBUFFER_STREAM_HEADER; - memset (buf[0].pvBuffer = stream->obuf,0, - buf[0].cbBuffer = stream->sizes.cbHeader); - /* message (up to maximum size) */ - buf[1].BufferType = SECBUFFER_DATA; - memcpy (buf[1].pvBuffer = stream->obuf + stream->sizes.cbHeader,string, - buf[1].cbBuffer = min (size,SSLBUFLEN)); - /* trailer */ - buf[2].BufferType = SECBUFFER_STREAM_TRAILER; - memset (buf[2].pvBuffer = ((char *) buf[1].pvBuffer) + buf[1].cbBuffer,0, - buf[2].cbBuffer = stream->sizes.cbTrailer); - /* spare */ - buf[3].BufferType = SECBUFFER_EMPTY; - msg.ulVersion = SECBUFFER_VERSION; - msg.cBuffers = 4; /* number of SecBuffers */ - msg.pBuffers = buf; /* first SecBuffer */ - string += buf[1].cbBuffer; - size -= buf[1].cbBuffer; /* this many bytes processed */ - /* encrypt and send message */ - if ((((ENCRYPT_MESSAGE_FN) sft->Reserved3) - (&stream->context,0,&msg,NIL) != SEC_E_OK) || - !tcp_sout (stream->tcpstream,stream->obuf, - buf[0].cbBuffer + buf[1].cbBuffer + buf[2].cbBuffer)) - return ssl_abort (stream);/* encryption or sending failed */ - } - return LONGT; -} - -/* SSL close - * Accepts: SSL stream - */ - -void ssl_close (SSLSTREAM *stream) -{ - ssl_abort (stream); /* nuke the stream */ - fs_give ((void **) &stream); /* flush the stream */ -} - - -/* SSL abort stream - * Accepts: SSL stream - * Returns: NIL always - */ - -static long ssl_abort (SSLSTREAM *stream) -{ - if (stream->tcpstream) { /* close TCP stream */ - sft->DeleteSecurityContext (&stream->context); - sft->FreeCredentialHandle (&stream->cred); - tcp_close (stream->tcpstream); - stream->tcpstream = NIL; - } - if (stream->ibuf) fs_give ((void **) &stream->ibuf); - if (stream->obuf) fs_give ((void **) &stream->obuf); - return NIL; -} - -/* SSL get host name - * Accepts: SSL stream - * Returns: host name for this stream - */ - -char *ssl_host (SSLSTREAM *stream) -{ - return stream ? tcp_host (stream->tcpstream) : "UNKNOWN"; -} - - -/* SSL get remote host name - * Accepts: SSL stream - * Returns: host name for this stream - */ - -char *ssl_remotehost (SSLSTREAM *stream) -{ - return tcp_remotehost (stream->tcpstream); -} - - -/* SSL return port for this stream - * Accepts: SSL stream - * Returns: port number for this stream - */ - -unsigned long ssl_port (SSLSTREAM *stream) -{ - return tcp_port (stream->tcpstream); -} - - -/* SSL get local host name - * Accepts: SSL stream - * Returns: local host name - */ - -char *ssl_localhost (SSLSTREAM *stream) -{ - return tcp_localhost (stream->tcpstream); -} - -#include "ssl_none.c" /* currently no server support */ - -#endif /* ENABLE_WINDOWS_LIBRESSL */ +//#ifdef ENABLE_WINDOWS_LIBRESSL +//#include "ssl_libressl.c" +//#else +#include "ssl_win.c" +//#endif /* ENABLE_WINDOWS_LIBRESSL */ |