1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Portions Copyright (c) The OpenSSL Project 1999 */
10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11 library. It is #included into the tls.c file when that library is used. The
12 code herein is based on a patch that was originally contributed by Steve
13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
15 No cryptographic code is included in Exim. All this module does is to call
16 functions from the OpenSSL library. */
21 #include <openssl/lhash.h>
22 #include <openssl/ssl.h>
23 #include <openssl/err.h>
24 #include <openssl/rand.h>
25 #ifndef OPENSSL_NO_ECDH
26 # include <openssl/ec.h>
29 # include <openssl/ocsp.h>
37 # define EXIM_OCSP_SKEW_SECONDS (300L)
38 # define EXIM_OCSP_MAX_AGE (-1L)
41 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
42 # define EXIM_HAVE_OPENSSL_TLSEXT
44 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
45 # define EXIM_HAVE_RSA_GENKEY_EX
47 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
48 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define EXIM_HAVE_EPHEM_RSA_KEX
51 # define EXIM_HAVE_RAND_PSEUDO
53 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
54 # define EXIM_HAVE_SHA256 /*MMMM*/
58 * X509_check_host provides sane certificate hostname checking, but was added
59 * to OpenSSL late, after other projects forked off the code-base. So in
60 * addition to guarding against the base version number, beware that LibreSSL
61 * does not (at this time) support this function.
63 * If LibreSSL gains a different API, perhaps via libtls, then we'll probably
64 * opt to disentangle and ask a LibreSSL user to provide glue for a third
65 * crypto provider for libtls instead of continuing to tie the OpenSSL glue
66 * into even twistier knots. If LibreSSL gains the same API, we can just
67 * change this guard and punt the issue for a while longer.
69 #ifndef LIBRESSL_VERSION_NUMBER
70 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
71 # define EXIM_HAVE_OPENSSL_CHECKHOST
72 # define EXIM_HAVE_OPENSSL_DH_BITS
74 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
75 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
76 # define EXIM_HAVE_OPENSSL_CHECKHOST
80 #if !defined(LIBRESSL_VERSION_NUMBER) \
81 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
82 # if !defined(OPENSSL_NO_ECDH)
83 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
84 # define EXIM_HAVE_ECDH /*MMMM*/
86 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
87 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
92 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
93 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
97 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
98 # include <openssl/x509v3.h>
101 /* Structure for collecting random data for seeding. */
103 typedef struct randstuff {
108 /* Local static variables */
110 static BOOL client_verify_callback_called = FALSE;
111 static BOOL server_verify_callback_called = FALSE;
112 static const uschar *sid_ctx = US"exim";
114 /* We have three different contexts to care about.
116 Simple case: client, `client_ctx`
117 As a client, we can be doing a callout or cut-through delivery while receiving
118 a message. So we have a client context, which should have options initialised
119 from the SMTP Transport.
122 There are two cases: with and without ServerNameIndication from the client.
123 Given TLS SNI, we can be using different keys, certs and various other
124 configuration settings, because they're re-expanded with $tls_sni set. This
125 allows vhosting with TLS. This SNI is sent in the handshake.
126 A client might not send SNI, so we need a fallback, and an initial setup too.
127 So as a server, we start out using `server_ctx`.
128 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
129 `server_sni` from `server_ctx` and then initialise settings by re-expanding
133 static SSL_CTX *client_ctx = NULL;
134 static SSL_CTX *server_ctx = NULL;
135 static SSL *client_ssl = NULL;
136 static SSL *server_ssl = NULL;
138 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
139 static SSL_CTX *server_sni = NULL;
142 static char ssl_errstring[256];
144 static int ssl_session_timeout = 200;
145 static BOOL client_verify_optional = FALSE;
146 static BOOL server_verify_optional = FALSE;
148 static BOOL reexpand_tls_files_for_sni = FALSE;
151 typedef struct tls_ext_ctx_cb {
156 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
160 uschar *file_expanded;
161 OCSP_RESPONSE *response;
164 X509_STORE *verify_store; /* non-null if status requested */
165 BOOL verify_required;
170 /* these are cached from first expand */
171 uschar *server_cipher_list;
172 /* only passed down to tls_error: */
174 const uschar * verify_cert_hostnames;
175 #ifndef DISABLE_EVENT
176 uschar * event_action;
180 /* should figure out a cleanup of API to handle state preserved per
181 implementation, for various reasons, which can be void * in the APIs.
182 For now, we hack around it. */
183 tls_ext_ctx_cb *client_static_cbinfo = NULL;
184 tls_ext_ctx_cb *server_static_cbinfo = NULL;
187 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
188 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr );
191 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
192 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
195 static int tls_server_stapling_cb(SSL *s, void *arg);
199 /*************************************************
201 *************************************************/
203 /* Called from lots of places when errors occur before actually starting to do
204 the TLS handshake, that is, while the session is still in clear. Always returns
205 DEFER for a server and FAIL for a client so that most calls can use "return
206 tls_error(...)" to do this processing and then give an appropriate return. A
207 single function is used for both server and client, because it is called from
208 some shared functions.
211 prefix text to include in the logged error
212 host NULL if setting up a server;
213 the connected host if setting up a client
214 msg error message or NULL if we should ask OpenSSL
215 errstr pointer to output error message
217 Returns: OK/DEFER/FAIL
221 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
225 ERR_error_string(ERR_get_error(), ssl_errstring);
226 msg = US ssl_errstring;
229 if (errstr) *errstr = string_sprintf("(%s): %s", prefix, msg);
230 return host ? FAIL : DEFER;
235 /*************************************************
236 * Callback to generate RSA key *
237 *************************************************/
241 s SSL connection (not used)
245 Returns: pointer to generated key
249 rsa_callback(SSL *s, int export, int keylength)
252 #ifdef EXIM_HAVE_RSA_GENKEY_EX
253 BIGNUM *bn = BN_new();
256 export = export; /* Shut picky compilers up */
257 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
259 #ifdef EXIM_HAVE_RSA_GENKEY_EX
260 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
261 || !(rsa_key = RSA_new())
262 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
265 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
269 ERR_error_string(ERR_get_error(), ssl_errstring);
270 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
282 x509_store_dump_cert_s_names(X509_STORE * store)
284 STACK_OF(X509_OBJECT) * roots= store->objs;
286 static uschar name[256];
288 for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
290 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
291 if(tmp_obj->type == X509_LU_X509)
293 X509 * current_cert= tmp_obj->data.x509;
294 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
295 name[sizeof(name)-1] = '\0';
296 debug_printf(" %s\n", name);
304 #ifndef DISABLE_EVENT
306 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
307 BOOL *calledp, const BOOL *optionalp, const uschar * what)
313 ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
316 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
317 old_cert = tlsp->peercert;
318 tlsp->peercert = X509_dup(cert);
319 /* NB we do not bother setting peerdn */
320 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
322 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
323 "depth=%d cert=%s: %s",
324 tlsp == &tls_out ? deliver_host_address : sender_host_address,
325 what, depth, dn, yield);
329 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
330 return 1; /* reject (leaving peercert set) */
332 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
333 "(host in tls_try_verify_hosts)\n");
335 X509_free(tlsp->peercert);
336 tlsp->peercert = old_cert;
342 /*************************************************
343 * Callback for verification *
344 *************************************************/
346 /* The SSL library does certificate verification if set up to do so. This
347 callback has the current yes/no state is in "state". If verification succeeded,
348 we set the certificate-verified flag. If verification failed, what happens
349 depends on whether the client is required to present a verifiable certificate
352 If verification is optional, we change the state to yes, but still log the
353 verification error. For some reason (it really would help to have proper
354 documentation of OpenSSL), this callback function then gets called again, this
355 time with state = 1. We must take care not to set the private verified flag on
356 the second time through.
358 Note: this function is not called if the client fails to present a certificate
359 when asked. We get here only if a certificate has been received. Handling of
360 optional verification for this case is done when requesting SSL to verify, by
361 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
363 May be called multiple times for different issues with a certificate, even
364 for a given "depth" in the certificate chain.
367 preverify_ok current yes/no state as 1/0
368 x509ctx certificate information.
369 tlsp per-direction (client vs. server) support data
370 calledp has-been-called flag
371 optionalp verification-is-optional flag
373 Returns: 0 if verification should fail, otherwise 1
377 verify_callback(int preverify_ok, X509_STORE_CTX *x509ctx,
378 tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
380 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
381 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
384 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
385 dn[sizeof(dn)-1] = '\0';
387 if (preverify_ok == 0)
389 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
390 *verify_mode, sender_host_address)
392 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
393 tlsp == &tls_out ? deliver_host_address : sender_host_address,
395 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
400 tlsp->peercert = X509_dup(cert); /* record failing cert */
401 return 0; /* reject */
403 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
404 "tls_try_verify_hosts)\n");
409 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
411 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
412 { /* client, wanting stapling */
413 /* Add the server cert's signing chain as the one
414 for the verification of the OCSP stapled information. */
416 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
419 sk_X509_push(client_static_cbinfo->verify_stack, cert);
422 #ifndef DISABLE_EVENT
423 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
424 return 0; /* reject, with peercert set */
429 const uschar * verify_cert_hostnames;
431 if ( tlsp == &tls_out
432 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
433 /* client, wanting hostname check */
436 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
437 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
438 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
440 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
441 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
444 const uschar * list = verify_cert_hostnames;
447 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
448 if ((rc = X509_check_host(cert, CCS name, 0,
449 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
450 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
455 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
456 tlsp == &tls_out ? deliver_host_address : sender_host_address);
463 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
466 uschar * extra = verify_mode
467 ? string_sprintf(" (during %c-verify for [%s])",
468 *verify_mode, sender_host_address)
470 log_write(0, LOG_MAIN,
471 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
472 tlsp == &tls_out ? deliver_host_address : sender_host_address,
473 extra, dn, verify_cert_hostnames);
478 tlsp->peercert = X509_dup(cert); /* record failing cert */
479 return 0; /* reject */
481 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
482 "tls_try_verify_hosts)\n");
486 #ifndef DISABLE_EVENT
487 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
488 return 0; /* reject, with peercert set */
491 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
492 *calledp ? "" : " authenticated", dn);
493 if (!*calledp) tlsp->certificate_verified = TRUE;
497 return 1; /* accept, at least for this level */
501 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
503 return verify_callback(preverify_ok, x509ctx, &tls_out,
504 &client_verify_callback_called, &client_verify_optional);
508 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
510 return verify_callback(preverify_ok, x509ctx, &tls_in,
511 &server_verify_callback_called, &server_verify_optional);
517 /* This gets called *by* the dane library verify callback, which interposes
521 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
523 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
525 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
526 #ifndef DISABLE_EVENT
527 BOOL dummy_called, optional = FALSE;
530 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
531 dn[sizeof(dn)-1] = '\0';
533 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
534 preverify_ok ? "ok":"BAD", depth, dn);
536 #ifndef DISABLE_EVENT
537 if (verify_event(&tls_out, cert, depth, dn,
538 &dummy_called, &optional, US"DANE"))
539 return 0; /* reject, with peercert set */
542 if (preverify_ok == 1)
544 tls_out.dane_verified = tls_out.certificate_verified = TRUE;
546 if (client_static_cbinfo->u_ocsp.client.verify_store)
547 { /* client, wanting stapling */
548 /* Add the server cert's signing chain as the one
549 for the verification of the OCSP stapled information. */
551 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
554 sk_X509_push(client_static_cbinfo->verify_stack, cert);
560 int err = X509_STORE_CTX_get_error(x509ctx);
562 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
563 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
569 #endif /*SUPPORT_DANE*/
572 /*************************************************
573 * Information callback *
574 *************************************************/
576 /* The SSL library functions call this from time to time to indicate what they
577 are doing. We copy the string to the debugging output when TLS debugging has
589 info_callback(SSL *s, int where, int ret)
593 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
598 /*************************************************
599 * Initialize for DH *
600 *************************************************/
602 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
605 sctx The current SSL CTX (inbound or outbound)
606 dhparam DH parameter file or fixed parameter identity string
607 host connected host, if client; NULL if server
608 errstr error string pointer
610 Returns: TRUE if OK (nothing to set up, or setup worked)
614 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host, uschar ** errstr)
622 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
625 if (!dhexpanded || !*dhexpanded)
626 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
627 else if (dhexpanded[0] == '/')
629 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
631 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
632 host, US strerror(errno), errstr);
638 if (Ustrcmp(dhexpanded, "none") == 0)
640 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
644 if (!(pem = std_dh_prime_named(dhexpanded)))
646 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
647 host, US strerror(errno), errstr);
650 bio = BIO_new_mem_buf(CS pem, -1);
653 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
656 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
661 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
662 * an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with
663 * 2236. But older OpenSSL can only report in bytes (octets), not bits.
664 * If someone wants to dance at the edge, then they can raise the limit or use
665 * current libraries. */
666 #ifdef EXIM_HAVE_OPENSSL_DH_BITS
667 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
668 * This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
669 dh_bitsize = DH_bits(dh);
671 dh_bitsize = 8 * DH_size(dh);
674 /* Even if it is larger, we silently return success rather than cause things
675 * to fail out, so that a too-large DH will not knock out all TLS; it's a
676 * debatable choice. */
677 if (dh_bitsize > tls_dh_max_bits)
680 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d\n",
681 dh_bitsize, tls_dh_max_bits);
685 SSL_CTX_set_tmp_dh(sctx, dh);
687 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
688 dhexpanded ? dhexpanded : US"default", dh_bitsize);
700 /*************************************************
701 * Initialize for ECDH *
702 *************************************************/
704 /* Load parameters for ECDH encryption.
706 For now, we stick to NIST P-256 because: it's simple and easy to configure;
707 it avoids any patent issues that might bite redistributors; despite events in
708 the news and concerns over curve choices, we're not cryptographers, we're not
709 pretending to be, and this is "good enough" to be better than no support,
710 protecting against most adversaries. Given another year or two, there might
711 be sufficient clarity about a "right" way forward to let us make an informed
712 decision, instead of a knee-jerk reaction.
714 Longer-term, we should look at supporting both various named curves and
715 external files generated with "openssl ecparam", much as we do for init_dh().
716 We should also support "none" as a value, to explicitly avoid initialisation.
721 sctx The current SSL CTX (inbound or outbound)
722 host connected host, if client; NULL if server
723 errstr error string pointer
725 Returns: TRUE if OK (nothing to set up, or setup worked)
729 init_ecdh(SSL_CTX * sctx, host_item * host, uschar ** errstr)
731 #ifdef OPENSSL_NO_ECDH
740 if (host) /* No ECDH setup for clients, only for servers */
743 # ifndef EXIM_HAVE_ECDH
745 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
749 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
751 if (!exp_curve || !*exp_curve)
754 /* "auto" needs to be handled carefully.
755 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
756 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
757 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
758 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
759 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
761 if (Ustrcmp(exp_curve, "auto") == 0)
763 #if OPENSSL_VERSION_NUMBER < 0x10002000L
764 DEBUG(D_tls) debug_printf(
765 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
766 exp_curve = US"prime256v1";
768 # if defined SSL_CTRL_SET_ECDH_AUTO
769 DEBUG(D_tls) debug_printf(
770 "ECDH OpenSSL 1.0.2+ temp key parameter settings: autoselection\n");
771 SSL_CTX_set_ecdh_auto(sctx, 1);
774 DEBUG(D_tls) debug_printf(
775 "ECDH OpenSSL 1.1.0+ temp key parameter settings: default selection\n");
781 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
782 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
783 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
784 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
788 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
793 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
795 tls_error(US"Unable to create ec curve", host, NULL, errstr);
799 /* The "tmp" in the name here refers to setting a temporary key
800 not to the stability of the interface. */
802 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
803 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL, errstr);
805 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
810 # endif /*EXIM_HAVE_ECDH*/
811 #endif /*OPENSSL_NO_ECDH*/
818 /*************************************************
819 * Load OCSP information into state *
820 *************************************************/
821 /* Called to load the server OCSP response from the given file into memory, once
822 caller has determined this is needed. Checks validity. Debugs a message
825 ASSUMES: single response, for single cert.
828 sctx the SSL_CTX* to update
829 cbinfo various parts of session state
830 expanded the filename putatively holding an OCSP response
835 ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
838 OCSP_RESPONSE * resp;
839 OCSP_BASICRESP * basic_response;
840 OCSP_SINGLERESP * single_response;
841 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
843 unsigned long verify_flags;
844 int status, reason, i;
846 cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
847 if (cbinfo->u_ocsp.server.response)
849 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
850 cbinfo->u_ocsp.server.response = NULL;
853 if (!(bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb")))
855 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
856 cbinfo->u_ocsp.server.file_expanded);
860 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
864 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
868 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
870 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
871 OCSP_response_status_str(status), status);
875 if (!(basic_response = OCSP_response_get1_basic(resp)))
878 debug_printf("OCSP response parse error: unable to extract basic response.\n");
882 sk = cbinfo->verify_stack;
883 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
885 /* May need to expose ability to adjust those flags?
886 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
887 OCSP_TRUSTOTHER OCSP_NOINTERN */
889 /* This does a full verify on the OCSP proof before we load it for serving
890 up; possibly overkill - just date-checks might be nice enough.
892 OCSP_basic_verify takes a "store" arg, but does not
893 use it for the chain verification, which is all we do
894 when OCSP_NOVERIFY is set. The content from the wire
895 "basic_response" and a cert-stack "sk" are all that is used.
897 We have a stack, loaded in setup_certs() if tls_verify_certificates
898 was a file (not a directory, or "system"). It is unfortunate we
899 cannot used the connection context store, as that would neatly
900 handle the "system" case too, but there seems to be no library
901 function for getting a stack from a store.
902 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
903 We do not free the stack since it could be needed a second time for
906 Separately we might try to replace using OCSP_basic_verify() - which seems to not
907 be a public interface into the OpenSSL library (there's no manual entry) -
908 But what with? We also use OCSP_basic_verify in the client stapling callback.
909 And there we NEED it; we must verify that status... unless the
910 library does it for us anyway? */
912 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
916 ERR_error_string(ERR_get_error(), ssl_errstring);
917 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
922 /* Here's the simplifying assumption: there's only one response, for the
923 one certificate we use, and nothing for anything else in a chain. If this
924 proves false, we need to extract a cert id from our issued cert
925 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
926 right cert in the stack and then calls OCSP_single_get0_status()).
928 I'm hoping to avoid reworking a bunch more of how we handle state here. */
930 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
933 debug_printf("Unable to get first response from OCSP basic response.\n");
937 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
938 if (status != V_OCSP_CERTSTATUS_GOOD)
940 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
941 OCSP_cert_status_str(status), status,
942 OCSP_crl_reason_str(reason), reason);
946 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
948 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
953 cbinfo->u_ocsp.server.response = resp; /*XXX stack?*/
957 if (running_in_test_harness)
959 extern char ** environ;
961 if (environ) for (p = USS environ; *p; p++)
962 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
964 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
965 goto supply_response;
970 #endif /*!DISABLE_OCSP*/
975 /* Create and install a selfsigned certificate, for use in server mode */
978 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
986 where = US"allocating pkey";
987 if (!(pkey = EVP_PKEY_new()))
990 where = US"allocating cert";
991 if (!(x509 = X509_new()))
994 where = US"generating pkey";
995 if (!(rsa = rsa_callback(NULL, 0, 1024)))
998 where = US"assigning pkey";
999 if (!EVP_PKEY_assign_RSA(pkey, rsa))
1002 X509_set_version(x509, 2); /* N+1 - version 3 */
1003 ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
1004 X509_gmtime_adj(X509_get_notBefore(x509), 0);
1005 X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60); /* 1 hour */
1006 X509_set_pubkey(x509, pkey);
1008 name = X509_get_subject_name(x509);
1009 X509_NAME_add_entry_by_txt(name, "C",
1010 MBSTRING_ASC, CUS "UK", -1, -1, 0);
1011 X509_NAME_add_entry_by_txt(name, "O",
1012 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
1013 X509_NAME_add_entry_by_txt(name, "CN",
1014 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
1015 X509_set_issuer_name(x509, name);
1017 where = US"signing cert";
1018 if (!X509_sign(x509, pkey, EVP_md5()))
1021 where = US"installing selfsign cert";
1022 if (!SSL_CTX_use_certificate(sctx, x509))
1025 where = US"installing selfsign key";
1026 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
1032 (void) tls_error(where, NULL, NULL, errstr);
1033 if (x509) X509_free(x509);
1034 if (pkey) EVP_PKEY_free(pkey);
1042 tls_add_certfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1045 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", file);
1046 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1047 return tls_error(string_sprintf(
1048 "SSL_CTX_use_certificate_chain_file file=%s", file),
1049 cbinfo->host, NULL, errstr);
1054 tls_add_pkeyfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1057 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", file);
1058 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1059 return tls_error(string_sprintf(
1060 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1065 /*************************************************
1066 * Expand key and cert file specs *
1067 *************************************************/
1069 /* Called once during tls_init and possibly again during TLS setup, for a
1070 new context, if Server Name Indication was used and tls_sni was seen in
1071 the certificate string.
1074 sctx the SSL_CTX* to update
1075 cbinfo various parts of session state
1076 errstr error string pointer
1078 Returns: OK/DEFER/FAIL
1082 tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo,
1087 if (!cbinfo->certificate)
1089 if (!cbinfo->is_server) /* client */
1092 if (tls_install_selfsign(sctx, errstr) != OK)
1099 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
1100 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
1101 Ustrstr(cbinfo->certificate, US"tls_out_sni")
1103 reexpand_tls_files_for_sni = TRUE;
1105 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded, errstr))
1109 if (cbinfo->is_server)
1111 const uschar * file_list = expanded;
1115 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1116 if ((err = tls_add_certfile(sctx, cbinfo, file, errstr)))
1119 else /* would there ever be a need for multiple client certs? */
1120 if ((err = tls_add_certfile(sctx, cbinfo, expanded, errstr)))
1123 if (cbinfo->privatekey != NULL &&
1124 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded, errstr))
1127 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1128 of the expansion is an empty string, ignore it also, and assume the private
1129 key is in the same file as the certificate. */
1131 if (expanded && *expanded)
1132 if (cbinfo->is_server)
1134 const uschar * file_list = expanded;
1138 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1139 if ((err = tls_add_pkeyfile(sctx, cbinfo, file, errstr)))
1142 else /* would there ever be a need for multiple client certs? */
1143 if ((err = tls_add_pkeyfile(sctx, cbinfo, expanded, errstr)))
1147 #ifndef DISABLE_OCSP
1148 if (cbinfo->is_server && cbinfo->u_ocsp.server.file)
1151 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded, errstr))
1154 if (expanded && *expanded)
1156 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
1157 if ( cbinfo->u_ocsp.server.file_expanded
1158 && (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
1160 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1163 ocsp_load_response(sctx, cbinfo, expanded);
1174 /*************************************************
1175 * Callback to handle SNI *
1176 *************************************************/
1178 /* Called when acting as server during the TLS session setup if a Server Name
1179 Indication extension was sent by the client.
1181 API documentation is OpenSSL s_server.c implementation.
1184 s SSL* of the current session
1185 ad unknown (part of OpenSSL API) (unused)
1186 arg Callback of "our" registered data
1188 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
1191 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1193 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
1195 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
1196 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1198 int old_pool = store_pool;
1199 uschar * dummy_errstr;
1202 return SSL_TLSEXT_ERR_OK;
1204 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
1205 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
1207 /* Make the extension value available for expansion */
1208 store_pool = POOL_PERM;
1209 tls_in.sni = string_copy(US servername);
1210 store_pool = old_pool;
1212 if (!reexpand_tls_files_for_sni)
1213 return SSL_TLSEXT_ERR_OK;
1215 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1216 not confident that memcpy wouldn't break some internal reference counting.
1217 Especially since there's a references struct member, which would be off. */
1219 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
1221 ERR_error_string(ERR_get_error(), ssl_errstring);
1222 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
1223 return SSL_TLSEXT_ERR_NOACK;
1226 /* Not sure how many of these are actually needed, since SSL object
1227 already exists. Might even need this selfsame callback, for reneg? */
1229 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1230 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1231 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1232 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1233 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1234 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
1236 if ( !init_dh(server_sni, cbinfo->dhparam, NULL, &dummy_errstr)
1237 || !init_ecdh(server_sni, NULL, &dummy_errstr)
1239 return SSL_TLSEXT_ERR_NOACK;
1241 if (cbinfo->server_cipher_list)
1242 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
1243 #ifndef DISABLE_OCSP
1244 if (cbinfo->u_ocsp.server.file)
1246 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
1247 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
1251 if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
1252 verify_callback_server, &dummy_errstr)) != OK)
1253 return SSL_TLSEXT_ERR_NOACK;
1255 /* do this after setup_certs, because this can require the certs for verifying
1256 OCSP information. */
1257 if ((rc = tls_expand_session_files(server_sni, cbinfo, &dummy_errstr)) != OK)
1258 return SSL_TLSEXT_ERR_NOACK;
1260 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
1261 SSL_set_SSL_CTX(s, server_sni);
1263 return SSL_TLSEXT_ERR_OK;
1265 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
1270 #ifndef DISABLE_OCSP
1272 /*************************************************
1273 * Callback to handle OCSP Stapling *
1274 *************************************************/
1276 /* Called when acting as server during the TLS session setup if the client
1277 requests OCSP information with a Certificate Status Request.
1279 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1285 tls_server_stapling_cb(SSL *s, void *arg)
1287 const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1288 uschar *response_der; /*XXX blob */
1289 int response_der_len;
1291 /*XXX stack: use SSL_get_certificate() to see which cert; from that work
1292 out which ocsp blob to send. Unfortunately, SSL_get_certificate is known
1293 buggy in current OpenSSL; it returns the last cert loaded always rather than
1294 the one actually presented. So we can't support a stack of OCSP proofs at
1298 debug_printf("Received TLS status request (OCSP stapling); %s response\n",
1299 cbinfo->u_ocsp.server.response ? "have" : "lack");
1301 tls_in.ocsp = OCSP_NOT_RESP;
1302 if (!cbinfo->u_ocsp.server.response)
1303 return SSL_TLSEXT_ERR_NOACK;
1305 response_der = NULL;
1306 response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response, /*XXX stack*/
1308 if (response_der_len <= 0)
1309 return SSL_TLSEXT_ERR_NOACK;
1311 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
1312 tls_in.ocsp = OCSP_VFIED;
1313 return SSL_TLSEXT_ERR_OK;
1318 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1320 BIO_printf(bp, "\t%s: ", str);
1321 ASN1_GENERALIZEDTIME_print(bp, time);
1326 tls_client_stapling_cb(SSL *s, void *arg)
1328 tls_ext_ctx_cb * cbinfo = arg;
1329 const unsigned char * p;
1331 OCSP_RESPONSE * rsp;
1332 OCSP_BASICRESP * bs;
1335 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
1336 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1339 /* Expect this when we requested ocsp but got none */
1340 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
1341 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
1343 DEBUG(D_tls) debug_printf(" null\n");
1344 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1347 if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1349 tls_out.ocsp = OCSP_FAILED;
1350 if (LOGGING(tls_cipher))
1351 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
1353 DEBUG(D_tls) debug_printf(" parse error\n");
1357 if(!(bs = OCSP_response_get1_basic(rsp)))
1359 tls_out.ocsp = OCSP_FAILED;
1360 if (LOGGING(tls_cipher))
1361 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
1363 DEBUG(D_tls) debug_printf(" error parsing response\n");
1364 OCSP_RESPONSE_free(rsp);
1368 /* We'd check the nonce here if we'd put one in the request. */
1369 /* However that would defeat cacheability on the server so we don't. */
1371 /* This section of code reworked from OpenSSL apps source;
1372 The OpenSSL Project retains copyright:
1373 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1378 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1380 DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1382 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1384 /* Use the chain that verified the server cert to verify the stapled info */
1385 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1387 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
1388 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
1390 tls_out.ocsp = OCSP_FAILED;
1391 if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
1392 "Received TLS cert status response, itself unverifiable: %s",
1393 ERR_reason_error_string(ERR_peek_error()));
1394 BIO_printf(bp, "OCSP response verify failure\n");
1395 ERR_print_errors(bp);
1396 OCSP_RESPONSE_print(bp, rsp, 0);
1400 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1402 /*XXX So we have a good stapled OCSP status. How do we know
1403 it is for the cert of interest? OpenSSL 1.1.0 has a routine
1404 OCSP_resp_find_status() which matches on a cert id, which presumably
1405 we should use. Making an id needs OCSP_cert_id_new(), which takes
1406 issuerName, issuerKey, serialNumber. Are they all in the cert?
1408 For now, carry on blindly accepting the resp. */
1411 OCSP_SINGLERESP * single;
1413 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
1414 if (OCSP_resp_count(bs) != 1)
1416 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1417 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1420 tls_out.ocsp = OCSP_FAILED;
1421 log_write(0, LOG_MAIN, "OCSP stapling "
1422 "with multiple responses not handled");
1425 single = OCSP_resp_get0(bs, 0);
1426 status = OCSP_single_get0_status(single, &reason, &rev,
1427 &thisupd, &nextupd);
1430 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1431 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1432 if (!OCSP_check_validity(thisupd, nextupd,
1433 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1435 tls_out.ocsp = OCSP_FAILED;
1436 DEBUG(D_tls) ERR_print_errors(bp);
1437 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1441 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1442 OCSP_cert_status_str(status));
1445 case V_OCSP_CERTSTATUS_GOOD:
1446 tls_out.ocsp = OCSP_VFIED;
1449 case V_OCSP_CERTSTATUS_REVOKED:
1450 tls_out.ocsp = OCSP_FAILED;
1451 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1452 reason != -1 ? "; reason: " : "",
1453 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1454 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1457 tls_out.ocsp = OCSP_FAILED;
1458 log_write(0, LOG_MAIN,
1459 "Server certificate status unknown, in OCSP stapling");
1464 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1469 OCSP_RESPONSE_free(rsp);
1472 #endif /*!DISABLE_OCSP*/
1475 /*************************************************
1476 * Initialize for TLS *
1477 *************************************************/
1479 /* Called from both server and client code, to do preliminary initialization
1480 of the library. We allocate and return a context structure.
1483 ctxp returned SSL context
1484 host connected host, if client; NULL if server
1485 dhparam DH parameter file
1486 certificate certificate file
1487 privatekey private key
1488 ocsp_file file of stapling info (server); flag for require ocsp (client)
1489 addr address if client; NULL if server (for some randomness)
1490 cbp place to put allocated callback context
1491 errstr error string pointer
1493 Returns: OK/DEFER/FAIL
1497 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
1499 #ifndef DISABLE_OCSP
1500 uschar *ocsp_file, /*XXX stack, in server*/
1502 address_item *addr, tls_ext_ctx_cb ** cbp, uschar ** errstr)
1507 tls_ext_ctx_cb * cbinfo;
1509 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1510 cbinfo->certificate = certificate;
1511 cbinfo->privatekey = privatekey;
1512 cbinfo->is_server = host==NULL;
1513 #ifndef DISABLE_OCSP
1514 cbinfo->verify_stack = NULL;
1517 cbinfo->u_ocsp.server.file = ocsp_file;
1518 cbinfo->u_ocsp.server.file_expanded = NULL;
1519 cbinfo->u_ocsp.server.response = NULL;
1522 cbinfo->u_ocsp.client.verify_store = NULL;
1524 cbinfo->dhparam = dhparam;
1525 cbinfo->server_cipher_list = NULL;
1526 cbinfo->host = host;
1527 #ifndef DISABLE_EVENT
1528 cbinfo->event_action = NULL;
1531 SSL_load_error_strings(); /* basic set up */
1532 OpenSSL_add_ssl_algorithms();
1534 #ifdef EXIM_HAVE_SHA256
1535 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1536 list of available digests. */
1537 EVP_add_digest(EVP_sha256());
1540 /* Create a context.
1541 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1542 negotiation in the different methods; as far as I can tell, the only
1543 *_{server,client}_method which allows negotiation is SSLv23, which exists even
1544 when OpenSSL is built without SSLv2 support.
1545 By disabling with openssl_options, we can let admins re-enable with the
1548 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1549 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1551 /* It turns out that we need to seed the random number generator this early in
1552 order to get the full complement of ciphers to work. It took me roughly a day
1553 of work to discover this by experiment.
1555 On systems that have /dev/urandom, SSL may automatically seed itself from
1556 there. Otherwise, we have to make something up as best we can. Double check
1562 gettimeofday(&r.tv, NULL);
1565 RAND_seed(US (&r), sizeof(r));
1566 RAND_seed(US big_buffer, big_buffer_size);
1567 if (addr != NULL) RAND_seed(US addr, sizeof(addr));
1570 return tls_error(US"RAND_status", host,
1571 US"unable to seed random number generator", errstr);
1574 /* Set up the information callback, which outputs if debugging is at a suitable
1577 DEBUG(D_tls) SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1579 /* Automatically re-try reads/writes after renegotiation. */
1580 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1582 /* Apply administrator-supplied work-arounds.
1583 Historically we applied just one requested option,
1584 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1585 moved to an administrator-controlled list of options to specify and
1586 grandfathered in the first one as the default value for "openssl_options".
1588 No OpenSSL version number checks: the options we accept depend upon the
1589 availability of the option value macros from OpenSSL. */
1591 if (!tls_openssl_options_parse(openssl_options, &init_options))
1592 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
1596 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
1597 if (!(SSL_CTX_set_options(ctx, init_options)))
1598 return tls_error(string_sprintf(
1599 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
1602 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
1604 /* Disable session cache unconditionally */
1606 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
1608 /* Initialize with DH parameters if supplied */
1609 /* Initialize ECDH temp key parameter selection */
1611 if ( !init_dh(ctx, dhparam, host, errstr)
1612 || !init_ecdh(ctx, host, errstr)
1616 /* Set up certificate and key (and perhaps OCSP info) */
1618 if ((rc = tls_expand_session_files(ctx, cbinfo, errstr)) != OK)
1621 /* If we need to handle SNI or OCSP, do so */
1623 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1624 # ifndef DISABLE_OCSP
1625 if (!(cbinfo->verify_stack = sk_X509_new_null()))
1627 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
1632 if (host == NULL) /* server */
1634 # ifndef DISABLE_OCSP
1635 /* We check u_ocsp.server.file, not server.response, because we care about if
1636 the option exists, not what the current expansion might be, as SNI might
1637 change the certificate and OCSP file in use between now and the time the
1638 callback is invoked. */
1639 if (cbinfo->u_ocsp.server.file)
1641 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
1642 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
1645 /* We always do this, so that $tls_sni is available even if not used in
1647 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
1648 SSL_CTX_set_tlsext_servername_arg(ctx, cbinfo);
1650 # ifndef DISABLE_OCSP
1652 if(ocsp_file) /* wanting stapling */
1654 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1656 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1659 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
1660 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
1665 cbinfo->verify_cert_hostnames = NULL;
1667 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
1668 /* Set up the RSA callback */
1669 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
1672 /* Finally, set the timeout, and we are done */
1674 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
1675 DEBUG(D_tls) debug_printf("Initialized TLS\n");
1686 /*************************************************
1687 * Get name of cipher in use *
1688 *************************************************/
1691 Argument: pointer to an SSL structure for the connection
1692 buffer to use for answer
1694 pointer to number of bits for cipher
1699 construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
1701 /* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1702 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1703 the accessor functions use const in the prototype. */
1704 const SSL_CIPHER *c;
1707 ver = (const uschar *)SSL_get_version(ssl);
1709 c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
1710 SSL_CIPHER_get_bits(c, bits);
1712 string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1713 SSL_CIPHER_get_name(c), *bits);
1715 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1720 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned bsize)
1722 /*XXX we might consider a list-of-certs variable for the cert chain.
1723 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
1724 in list-handling functions, also consider the difference between the entire
1725 chain and the elements sent by the peer. */
1727 /* Will have already noted peercert on a verify fail; possibly not the leaf */
1728 if (!tlsp->peercert)
1729 tlsp->peercert = SSL_get_peer_certificate(ssl);
1730 /* Beware anonymous ciphers which lead to server_cert being NULL */
1733 X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, bsize);
1734 peerdn[bsize-1] = '\0';
1735 tlsp->peerdn = peerdn; /*XXX a static buffer... */
1738 tlsp->peerdn = NULL;
1745 /*************************************************
1746 * Set up for verifying certificates *
1747 *************************************************/
1749 /* Load certs from file, return TRUE on success */
1752 chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
1757 while (sk_X509_num(verify_stack) > 0)
1758 X509_free(sk_X509_pop(verify_stack));
1760 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
1761 while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
1762 sk_X509_push(verify_stack, x);
1769 /* Called by both client and server startup; on the server possibly
1770 repeated after a Server Name Indication.
1773 sctx SSL_CTX* to initialise
1774 certs certs file or NULL
1775 crl CRL file or NULL
1776 host NULL in a server; the remote host in a client
1777 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1778 otherwise passed as FALSE
1779 cert_vfy_cb Callback function for certificate verification
1780 errstr error string pointer
1782 Returns: OK/DEFER/FAIL
1786 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1787 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr)
1789 uschar *expcerts, *expcrl;
1791 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
1793 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
1795 if (expcerts && *expcerts)
1797 /* Tell the library to use its compiled-in location for the system default
1798 CA bundle. Then add the ones specified in the config, if any. */
1800 if (!SSL_CTX_set_default_verify_paths(sctx))
1801 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
1803 if (Ustrcmp(expcerts, "system") != 0)
1805 struct stat statbuf;
1807 if (Ustat(expcerts, &statbuf) < 0)
1809 log_write(0, LOG_MAIN|LOG_PANIC,
1810 "failed to stat %s for certificates", expcerts);
1816 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1817 { file = NULL; dir = expcerts; }
1820 file = expcerts; dir = NULL;
1821 #ifndef DISABLE_OCSP
1822 /* In the server if we will be offering an OCSP proof, load chain from
1823 file for verifying the OCSP proof at load time. */
1826 && statbuf.st_size > 0
1827 && server_static_cbinfo->u_ocsp.server.file
1828 && !chain_from_pem_file(file, server_static_cbinfo->verify_stack)
1831 log_write(0, LOG_MAIN|LOG_PANIC,
1832 "failed to load cert chain from %s", file);
1838 /* If a certificate file is empty, the next function fails with an
1839 unhelpful error message. If we skip it, we get the correct behaviour (no
1840 certificates are recognized, but the error message is still misleading (it
1841 says no certificate was supplied). But this is better. */
1843 if ( (!file || statbuf.st_size > 0)
1844 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1845 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL, errstr);
1847 /* Load the list of CAs for which we will accept certs, for sending
1848 to the client. This is only for the one-file tls_verify_certificates
1850 If a list isn't loaded into the server, but
1851 some verify locations are set, the server end appears to make
1852 a wildcard request for client certs.
1853 Meanwhile, the client library as default behaviour *ignores* the list
1854 we send over the wire - see man SSL_CTX_set_client_cert_cb.
1855 Because of this, and that the dir variant is likely only used for
1856 the public-CA bundle (not for a private CA), not worth fixing.
1860 tls_ext_ctx_cb * cbinfo = host
1861 ? client_static_cbinfo : server_static_cbinfo;
1862 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
1864 SSL_CTX_set_client_CA_list(sctx, names);
1865 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
1866 sk_X509_NAME_num(names));
1871 /* Handle a certificate revocation list. */
1873 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1875 /* This bit of code is now the version supplied by Lars Mainka. (I have
1876 merely reformatted it into the Exim code style.)
1878 "From here I changed the code to add support for multiple crl's
1879 in pem format in one file or to support hashed directory entries in
1880 pem format instead of a file. This method now uses the library function
1881 X509_STORE_load_locations to add the CRL location to the SSL context.
1882 OpenSSL will then handle the verify against CA certs and CRLs by
1883 itself in the verify callback." */
1885 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
1886 if (expcrl && *expcrl)
1888 struct stat statbufcrl;
1889 if (Ustat(expcrl, &statbufcrl) < 0)
1891 log_write(0, LOG_MAIN|LOG_PANIC,
1892 "failed to stat %s for certificates revocation lists", expcrl);
1897 /* is it a file or directory? */
1899 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
1900 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
1904 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
1910 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
1912 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
1913 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
1915 /* setting the flags to check against the complete crl chain */
1917 X509_STORE_set_flags(cvstore,
1918 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
1922 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1924 /* If verification is optional, don't fail if no certificate */
1926 SSL_CTX_set_verify(sctx,
1927 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
1936 /*************************************************
1937 * Start a TLS session in a server *
1938 *************************************************/
1940 /* This is called when Exim is running as a server, after having received
1941 the STARTTLS command. It must respond to that command, and then negotiate
1945 require_ciphers allowed ciphers
1946 errstr pointer to error message
1948 Returns: OK on success
1949 DEFER for errors before the start of the negotiation
1950 FAIL for errors during the negotiation; the server can't
1955 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
1958 uschar * expciphers;
1959 tls_ext_ctx_cb * cbinfo;
1960 static uschar peerdn[256];
1961 static uschar cipherbuf[256];
1963 /* Check for previous activation */
1965 if (tls_in.active >= 0)
1967 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
1968 smtp_printf("554 Already in TLS\r\n", FALSE);
1972 /* Initialize the SSL library. If it fails, it will already have logged
1975 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
1976 #ifndef DISABLE_OCSP
1977 tls_ocsp_file, /*XXX stack*/
1979 NULL, &server_static_cbinfo, errstr);
1980 if (rc != OK) return rc;
1981 cbinfo = server_static_cbinfo;
1983 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
1986 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1987 were historically separated by underscores. So that I can use either form in my
1988 tests, and also for general convenience, we turn underscores into hyphens here.
1993 uschar * s = expciphers;
1994 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1995 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1996 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
1997 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1998 cbinfo->server_cipher_list = expciphers;
2001 /* If this is a host for which certificate verification is mandatory or
2002 optional, set up appropriately. */
2004 tls_in.certificate_verified = FALSE;
2006 tls_in.dane_verified = FALSE;
2008 server_verify_callback_called = FALSE;
2010 if (verify_check_host(&tls_verify_hosts) == OK)
2012 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
2013 FALSE, verify_callback_server, errstr);
2014 if (rc != OK) return rc;
2015 server_verify_optional = FALSE;
2017 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2019 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
2020 TRUE, verify_callback_server, errstr);
2021 if (rc != OK) return rc;
2022 server_verify_optional = TRUE;
2025 /* Prepare for new connection */
2027 if (!(server_ssl = SSL_new(server_ctx)))
2028 return tls_error(US"SSL_new", NULL, NULL, errstr);
2030 /* Warning: we used to SSL_clear(ssl) here, it was removed.
2032 * With the SSL_clear(), we get strange interoperability bugs with
2033 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
2034 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
2036 * The SSL_clear() call is to let an existing SSL* be reused, typically after
2037 * session shutdown. In this case, we have a brand new object and there's no
2038 * obvious reason to immediately clear it. I'm guessing that this was
2039 * originally added because of incomplete initialisation which the clear fixed,
2040 * in some historic release.
2043 /* Set context and tell client to go ahead, except in the case of TLS startup
2044 on connection, where outputting anything now upsets the clients and tends to
2045 make them disconnect. We need to have an explicit fflush() here, to force out
2046 the response. Other smtp_printf() calls do not need it, because in non-TLS
2047 mode, the fflush() happens when smtp_getc() is called. */
2049 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
2050 if (!tls_in.on_connect)
2052 smtp_printf("220 TLS go ahead\r\n", FALSE);
2056 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2057 that the OpenSSL library doesn't. */
2059 SSL_set_wfd(server_ssl, fileno(smtp_out));
2060 SSL_set_rfd(server_ssl, fileno(smtp_in));
2061 SSL_set_accept_state(server_ssl);
2063 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
2065 sigalrm_seen = FALSE;
2066 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2067 rc = SSL_accept(server_ssl);
2072 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2076 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
2078 /* TLS has been set up. Adjust the input functions to read via TLS,
2079 and initialize things. */
2081 peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
2083 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
2084 tls_in.cipher = cipherbuf;
2089 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
2090 debug_printf("Shared ciphers: %s\n", buf);
2093 /* Record the certificate we presented */
2095 X509 * crt = SSL_get_certificate(server_ssl);
2096 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
2099 /* Only used by the server-side tls (tls_in), including tls_getc.
2100 Client-side (tls_out) reads (seem to?) go via
2101 smtp_read_response()/ip_recv().
2102 Hence no need to duplicate for _in and _out.
2104 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2105 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
2106 ssl_xfer_eof = ssl_xfer_error = FALSE;
2108 receive_getc = tls_getc;
2109 receive_getbuf = tls_getbuf;
2110 receive_get_cache = tls_get_cache;
2111 receive_ungetc = tls_ungetc;
2112 receive_feof = tls_feof;
2113 receive_ferror = tls_ferror;
2114 receive_smtp_buffered = tls_smtp_buffered;
2116 tls_in.active = fileno(smtp_out);
2124 tls_client_basic_ctx_init(SSL_CTX * ctx,
2125 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo,
2129 /* stick to the old behaviour for compatibility if tls_verify_certificates is
2130 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2131 the specified host patterns if one of them is defined */
2133 if ( ( !ob->tls_verify_hosts
2134 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2136 || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
2138 client_verify_optional = FALSE;
2139 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
2140 client_verify_optional = TRUE;
2144 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
2145 ob->tls_crl, host, client_verify_optional, verify_callback_client,
2149 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
2151 cbinfo->verify_cert_hostnames =
2153 string_domain_utf8_to_alabel(host->name, NULL);
2157 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
2158 cbinfo->verify_cert_hostnames);
2166 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
2170 const char * hostnames[2] = { CS host->name, NULL };
2173 if (DANESSL_init(ssl, NULL, hostnames) != 1)
2174 return tls_error(US"hostnames load", host, NULL, errstr);
2176 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
2178 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2179 ) if (rr->type == T_TLSA)
2181 const uschar * p = rr->data;
2182 uint8_t usage, selector, mtype;
2183 const char * mdname;
2187 /* Only DANE-TA(2) and DANE-EE(3) are supported */
2188 if (usage != 2 && usage != 3) continue;
2195 default: continue; /* Only match-types 0, 1, 2 are supported */
2196 case 0: mdname = NULL; break;
2197 case 1: mdname = "sha256"; break;
2198 case 2: mdname = "sha512"; break;
2202 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
2205 return tls_error(US"tlsa load", host, NULL, errstr);
2206 case 0: /* action not taken */
2210 tls_out.tlsa_usage |= 1<<usage;
2216 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
2219 #endif /*SUPPORT_DANE*/
2223 /*************************************************
2224 * Start a TLS session in a client *
2225 *************************************************/
2227 /* Called from the smtp transport after STARTTLS has been accepted.
2230 fd the fd of the connection
2231 host connected host (for messages)
2232 addr the first address
2233 tb transport (always smtp)
2234 tlsa_dnsa tlsa lookup, if DANE, else null
2235 errstr error string pointer
2237 Returns: OK on success
2238 FAIL otherwise - note that tls_error() will not give DEFER
2239 because this is not a server
2243 tls_client_start(int fd, host_item *host, address_item *addr,
2244 transport_instance * tb,
2246 dns_answer * tlsa_dnsa,
2250 smtp_transport_options_block * ob =
2251 (smtp_transport_options_block *)tb->options_block;
2252 static uschar peerdn[256];
2253 uschar * expciphers;
2255 static uschar cipherbuf[256];
2257 #ifndef DISABLE_OCSP
2258 BOOL request_ocsp = FALSE;
2259 BOOL require_ocsp = FALSE;
2263 tls_out.tlsa_usage = 0;
2266 #ifndef DISABLE_OCSP
2268 # ifdef SUPPORT_DANE
2270 && ob->hosts_request_ocsp[0] == '*'
2271 && ob->hosts_request_ocsp[1] == '\0'
2274 /* Unchanged from default. Use a safer one under DANE */
2275 request_ocsp = TRUE;
2276 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
2277 " {= {4}{$tls_out_tlsa_usage}} } "
2283 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK))
2284 request_ocsp = TRUE;
2286 # ifdef SUPPORT_DANE
2290 verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2294 rc = tls_init(&client_ctx, host, NULL,
2295 ob->tls_certificate, ob->tls_privatekey,
2296 #ifndef DISABLE_OCSP
2297 (void *)(long)request_ocsp,
2299 addr, &client_static_cbinfo, errstr);
2300 if (rc != OK) return rc;
2302 tls_out.certificate_verified = FALSE;
2303 client_verify_callback_called = FALSE;
2305 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
2306 &expciphers, errstr))
2309 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
2310 are separated by underscores. So that I can use either form in my tests, and
2311 also for general convenience, we turn underscores into hyphens here. */
2315 uschar *s = expciphers;
2316 while (*s) { if (*s == '_') *s = '-'; s++; }
2317 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
2318 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
2319 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
2325 SSL_CTX_set_verify(client_ctx,
2326 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
2327 verify_callback_client_dane);
2329 if (!DANESSL_library_init())
2330 return tls_error(US"library init", host, NULL, errstr);
2331 if (DANESSL_CTX_init(client_ctx) <= 0)
2332 return tls_error(US"context init", host, NULL, errstr);
2338 if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob,
2339 client_static_cbinfo, errstr)) != OK)
2342 if ((client_ssl = SSL_new(client_ctx)) == NULL)
2343 return tls_error(US"SSL_new", host, NULL, errstr);
2344 SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
2345 SSL_set_fd(client_ssl, fd);
2346 SSL_set_connect_state(client_ssl);
2350 if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni, errstr))
2354 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
2356 else if (!Ustrlen(tls_out.sni))
2360 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2361 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
2362 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
2364 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
2372 if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa, errstr)) != OK)
2376 #ifndef DISABLE_OCSP
2377 /* Request certificate status at connection-time. If the server
2378 does OCSP stapling we will get the callback (set in tls_init()) */
2379 # ifdef SUPPORT_DANE
2383 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2384 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2386 { /* Re-eval now $tls_out_tlsa_usage is populated. If
2387 this means we avoid the OCSP request, we wasted the setup
2388 cost in tls_init(). */
2389 require_ocsp = verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
2390 request_ocsp = require_ocsp
2391 || verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2398 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
2399 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
2400 tls_out.ocsp = OCSP_NOT_RESP;
2404 #ifndef DISABLE_EVENT
2405 client_static_cbinfo->event_action = tb->event_action;
2408 /* There doesn't seem to be a built-in timeout on connection. */
2410 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
2411 sigalrm_seen = FALSE;
2412 alarm(ob->command_timeout);
2413 rc = SSL_connect(client_ssl);
2418 DANESSL_cleanup(client_ssl);
2422 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL,
2425 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
2427 peer_cert(client_ssl, &tls_out, peerdn, sizeof(peerdn));
2429 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
2430 tls_out.cipher = cipherbuf;
2432 /* Record the certificate we presented */
2434 X509 * crt = SSL_get_certificate(client_ssl);
2435 tls_out.ourcert = crt ? X509_dup(crt) : NULL;
2438 tls_out.active = fd;
2447 tls_refill(unsigned lim)
2452 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
2453 ssl_xfer_buffer, ssl_xfer_buffer_size);
2455 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2456 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer,
2457 MIN(ssl_xfer_buffer_size, lim));
2458 error = SSL_get_error(server_ssl, inbytes);
2461 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2462 closed down, not that the socket itself has been closed down. Revert to
2463 non-SSL handling. */
2465 if (error == SSL_ERROR_ZERO_RETURN)
2467 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2469 receive_getc = smtp_getc;
2470 receive_getbuf = smtp_getbuf;
2471 receive_get_cache = smtp_get_cache;
2472 receive_ungetc = smtp_ungetc;
2473 receive_feof = smtp_feof;
2474 receive_ferror = smtp_ferror;
2475 receive_smtp_buffered = smtp_buffered;
2477 if (SSL_get_shutdown(server_ssl) == SSL_RECEIVED_SHUTDOWN)
2478 SSL_shutdown(server_ssl);
2480 sk_X509_pop_free(server_static_cbinfo->verify_stack, X509_free);
2481 SSL_free(server_ssl);
2482 SSL_CTX_free(server_ctx);
2483 server_static_cbinfo->verify_stack = NULL;
2488 tls_in.cipher = NULL;
2489 tls_in.peerdn = NULL;
2495 /* Handle genuine errors */
2497 else if (error == SSL_ERROR_SSL)
2499 ERR_error_string(ERR_get_error(), ssl_errstring);
2500 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
2501 ssl_xfer_error = TRUE;
2505 else if (error != SSL_ERROR_NONE)
2507 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2508 ssl_xfer_error = TRUE;
2512 #ifndef DISABLE_DKIM
2513 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2515 ssl_xfer_buffer_hwm = inbytes;
2516 ssl_xfer_buffer_lwm = 0;
2521 /*************************************************
2522 * TLS version of getc *
2523 *************************************************/
2525 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2526 it refills the buffer via the SSL reading function.
2528 Arguments: lim Maximum amount to read/buffer
2529 Returns: the next character or EOF
2531 Only used by the server-side TLS.
2535 tls_getc(unsigned lim)
2537 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2538 if (!tls_refill(lim))
2539 return ssl_xfer_error ? EOF : smtp_getc(lim);
2541 /* Something in the buffer; return next uschar */
2543 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2547 tls_getbuf(unsigned * len)
2552 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2553 if (!tls_refill(*len))
2555 if (!ssl_xfer_error) return smtp_getbuf(len);
2560 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
2562 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
2563 ssl_xfer_buffer_lwm += size;
2572 #ifndef DISABLE_DKIM
2573 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
2575 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
2581 tls_could_read(void)
2583 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm || SSL_pending(server_ssl) > 0;
2587 /*************************************************
2588 * Read bytes from TLS channel *
2589 *************************************************/
2596 Returns: the number of bytes read
2597 -1 after a failed read
2599 Only used by the client-side TLS.
2603 tls_read(BOOL is_server, uschar *buff, size_t len)
2605 SSL *ssl = is_server ? server_ssl : client_ssl;
2609 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
2610 buff, (unsigned int)len);
2612 inbytes = SSL_read(ssl, CS buff, len);
2613 error = SSL_get_error(ssl, inbytes);
2615 if (error == SSL_ERROR_ZERO_RETURN)
2617 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2620 else if (error != SSL_ERROR_NONE)
2630 /*************************************************
2631 * Write bytes down TLS channel *
2632 *************************************************/
2636 is_server channel specifier
2639 more further data expected soon
2641 Returns: the number of bytes after a successful write,
2642 -1 after a failed write
2644 Used by both server-side and client-side TLS.
2648 tls_write(BOOL is_server, const uschar *buff, size_t len, BOOL more)
2650 int outbytes, error, left;
2651 SSL *ssl = is_server ? server_ssl : client_ssl;
2652 static gstring * corked = NULL;
2654 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
2655 buff, (unsigned long)len, more ? ", more" : "");
2657 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
2658 "more" is notified. This hack is only ok if small amounts are involved AND only
2659 one stream does it, in one context (i.e. no store reset). Currently it is used
2660 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only. */
2662 if (is_server && (more || corked))
2664 corked = string_catn(corked, buff, len);
2667 buff = CUS corked->s;
2672 for (left = len; left > 0;)
2674 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
2675 outbytes = SSL_write(ssl, CS buff, left);
2676 error = SSL_get_error(ssl, outbytes);
2677 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2681 ERR_error_string(ERR_get_error(), ssl_errstring);
2682 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2685 case SSL_ERROR_NONE:
2690 case SSL_ERROR_ZERO_RETURN:
2691 log_write(0, LOG_MAIN, "SSL channel closed on write");
2694 case SSL_ERROR_SYSCALL:
2695 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2696 sender_fullhost ? sender_fullhost : US"<unknown>",
2701 log_write(0, LOG_MAIN, "SSL_write error %d", error);
2710 /*************************************************
2711 * Close down a TLS session *
2712 *************************************************/
2714 /* This is also called from within a delivery subprocess forked from the
2715 daemon, to shut down the TLS library, without actually doing a shutdown (which
2716 would tamper with the SSL session in the parent process).
2719 shutdown 1 if TLS close-alert is to be sent,
2720 2 if also response to be waited for
2724 Used by both server-side and client-side TLS.
2728 tls_close(BOOL is_server, int shutdown)
2730 SSL_CTX **ctxp = is_server ? &server_ctx : &client_ctx;
2731 SSL **sslp = is_server ? &server_ssl : &client_ssl;
2732 int *fdp = is_server ? &tls_in.active : &tls_out.active;
2734 if (*fdp < 0) return; /* TLS was not active */
2739 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
2740 shutdown > 1 ? " (with response-wait)" : "");
2742 if ( (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
2746 rc = SSL_shutdown(*sslp); /* wait for response */
2750 if (rc < 0) DEBUG(D_tls)
2752 ERR_error_string(ERR_get_error(), ssl_errstring);
2753 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
2759 sk_X509_pop_free(server_static_cbinfo->verify_stack, X509_free);
2760 server_static_cbinfo->verify_stack = NULL;
2763 SSL_CTX_free(*ctxp);
2773 /*************************************************
2774 * Let tls_require_ciphers be checked at startup *
2775 *************************************************/
2777 /* The tls_require_ciphers option, if set, must be something which the
2780 Returns: NULL on success, or error message
2784 tls_validate_require_cipher(void)
2787 uschar *s, *expciphers, *err;
2789 /* this duplicates from tls_init(), we need a better "init just global
2790 state, for no specific purpose" singleton function of our own */
2792 SSL_load_error_strings();
2793 OpenSSL_add_ssl_algorithms();
2794 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2795 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2796 list of available digests. */
2797 EVP_add_digest(EVP_sha256());
2800 if (!(tls_require_ciphers && *tls_require_ciphers))
2803 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
2805 return US"failed to expand tls_require_ciphers";
2807 if (!(expciphers && *expciphers))
2810 /* normalisation ripped from above */
2812 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2816 ctx = SSL_CTX_new(SSLv23_server_method());
2819 ERR_error_string(ERR_get_error(), ssl_errstring);
2820 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2824 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2826 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2828 ERR_error_string(ERR_get_error(), ssl_errstring);
2829 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
2830 expciphers, ssl_errstring);
2841 /*************************************************
2842 * Report the library versions. *
2843 *************************************************/
2845 /* There have historically been some issues with binary compatibility in
2846 OpenSSL libraries; if Exim (like many other applications) is built against
2847 one version of OpenSSL but the run-time linker picks up another version,
2848 it can result in serious failures, including crashing with a SIGSEGV. So
2849 report the version found by the compiler and the run-time version.
2851 Note: some OS vendors backport security fixes without changing the version
2852 number/string, and the version date remains unchanged. The _build_ date
2853 will change, so we can more usefully assist with version diagnosis by also
2854 reporting the build date.
2856 Arguments: a FILE* to print the results to
2861 tls_version_report(FILE *f)
2863 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
2866 OPENSSL_VERSION_TEXT,
2867 SSLeay_version(SSLEAY_VERSION),
2868 SSLeay_version(SSLEAY_BUILT_ON));
2869 /* third line is 38 characters for the %s and the line is 73 chars long;
2870 the OpenSSL output includes a "built on: " prefix already. */
2876 /*************************************************
2877 * Random number generation *
2878 *************************************************/
2880 /* Pseudo-random number generation. The result is not expected to be
2881 cryptographically strong but not so weak that someone will shoot themselves
2882 in the foot using it as a nonce in input in some email header scheme or
2883 whatever weirdness they'll twist this into. The result should handle fork()
2884 and avoid repeating sequences. OpenSSL handles that for us.
2888 Returns a random number in range [0, max-1]
2892 vaguely_random_number(int max)
2896 static pid_t pidlast = 0;
2899 uschar smallbuf[sizeof(r)];
2905 if (pidnow != pidlast)
2907 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2908 is unique for each thread", this doesn't apparently apply across processes,
2909 so our own warning from vaguely_random_number_fallback() applies here too.
2910 Fix per PostgreSQL. */
2916 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2920 gettimeofday(&r.tv, NULL);
2923 RAND_seed(US (&r), sizeof(r));
2925 /* We're after pseudo-random, not random; if we still don't have enough data
2926 in the internal PRNG then our options are limited. We could sleep and hope
2927 for entropy to come along (prayer technique) but if the system is so depleted
2928 in the first place then something is likely to just keep taking it. Instead,
2929 we'll just take whatever little bit of pseudo-random we can still manage to
2932 needed_len = sizeof(r);
2933 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2934 asked for a number less than 10. */
2935 for (r = max, i = 0; r; ++i)
2941 #ifdef EXIM_HAVE_RAND_PSEUDO
2942 /* We do not care if crypto-strong */
2943 i = RAND_pseudo_bytes(smallbuf, needed_len);
2945 i = RAND_bytes(smallbuf, needed_len);
2951 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2952 return vaguely_random_number_fallback(max);
2956 for (p = smallbuf; needed_len; --needed_len, ++p)
2962 /* We don't particularly care about weighted results; if someone wants
2963 smooth distribution and cares enough then they should submit a patch then. */
2970 /*************************************************
2971 * OpenSSL option parse *
2972 *************************************************/
2974 /* Parse one option for tls_openssl_options_parse below
2977 name one option name
2978 value place to store a value for it
2979 Returns success or failure in parsing
2982 struct exim_openssl_option {
2986 /* We could use a macro to expand, but we need the ifdef and not all the
2987 options document which version they were introduced in. Policylet: include
2988 all options unless explicitly for DTLS, let the administrator choose which
2991 This list is current as of:
2993 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2995 static struct exim_openssl_option exim_openssl_options[] = {
2996 /* KEEP SORTED ALPHABETICALLY! */
2998 { US"all", SSL_OP_ALL },
3000 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
3001 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
3003 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
3004 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
3006 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
3007 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
3009 #ifdef SSL_OP_EPHEMERAL_RSA
3010 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
3012 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
3013 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
3015 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
3016 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
3018 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
3019 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
3021 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
3022 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
3024 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
3025 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
3027 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
3028 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
3030 #ifdef SSL_OP_NO_COMPRESSION
3031 { US"no_compression", SSL_OP_NO_COMPRESSION },
3033 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
3034 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
3036 #ifdef SSL_OP_NO_SSLv2
3037 { US"no_sslv2", SSL_OP_NO_SSLv2 },
3039 #ifdef SSL_OP_NO_SSLv3
3040 { US"no_sslv3", SSL_OP_NO_SSLv3 },
3042 #ifdef SSL_OP_NO_TICKET
3043 { US"no_ticket", SSL_OP_NO_TICKET },
3045 #ifdef SSL_OP_NO_TLSv1
3046 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
3048 #ifdef SSL_OP_NO_TLSv1_1
3049 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
3050 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
3051 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
3053 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
3056 #ifdef SSL_OP_NO_TLSv1_2
3057 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
3059 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
3060 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
3062 #ifdef SSL_OP_SINGLE_DH_USE
3063 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
3065 #ifdef SSL_OP_SINGLE_ECDH_USE
3066 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
3068 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
3069 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
3071 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
3072 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
3074 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
3075 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
3077 #ifdef SSL_OP_TLS_D5_BUG
3078 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
3080 #ifdef SSL_OP_TLS_ROLLBACK_BUG
3081 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
3084 static int exim_openssl_options_size =
3085 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
3089 tls_openssl_one_option_parse(uschar *name, long *value)
3092 int last = exim_openssl_options_size;
3093 while (last > first)
3095 int middle = (first + last)/2;
3096 int c = Ustrcmp(name, exim_openssl_options[middle].name);
3099 *value = exim_openssl_options[middle].value;
3113 /*************************************************
3114 * OpenSSL option parsing logic *
3115 *************************************************/
3117 /* OpenSSL has a number of compatibility options which an administrator might
3118 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
3119 we look like log_selector.
3122 option_spec the administrator-supplied string of options
3123 results ptr to long storage for the options bitmap
3124 Returns success or failure
3128 tls_openssl_options_parse(uschar *option_spec, long *results)
3133 BOOL adding, item_parsed;
3135 result = SSL_OP_NO_TICKET;
3136 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
3137 * from default because it increases BEAST susceptibility. */
3138 #ifdef SSL_OP_NO_SSLv2
3139 result |= SSL_OP_NO_SSLv2;
3141 #ifdef SSL_OP_SINGLE_DH_USE
3142 result |= SSL_OP_SINGLE_DH_USE;
3151 for (s=option_spec; *s != '\0'; /**/)
3153 while (isspace(*s)) ++s;
3156 if (*s != '+' && *s != '-')
3158 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
3159 "+ or - expected but found \"%s\"\n", s);
3162 adding = *s++ == '+';
3163 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
3166 item_parsed = tls_openssl_one_option_parse(s, &item);
3170 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
3173 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
3174 adding ? "adding" : "removing", result, item, s);
3188 /* End of tls-openssl.c */