1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2019 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Portions Copyright (c) The OpenSSL Project 1999 */
11 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
12 library. It is #included into the tls.c file when that library is used. The
13 code herein is based on a patch that was originally contributed by Steve
14 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
16 No cryptographic code is included in Exim. All this module does is to call
17 functions from the OpenSSL library. */
22 #include <openssl/lhash.h>
23 #include <openssl/ssl.h>
24 #include <openssl/err.h>
25 #include <openssl/rand.h>
26 #ifndef OPENSSL_NO_ECDH
27 # include <openssl/ec.h>
30 # include <openssl/ocsp.h>
38 # define EXIM_OCSP_SKEW_SECONDS (300L)
39 # define EXIM_OCSP_MAX_AGE (-1L)
42 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
43 # define EXIM_HAVE_OPENSSL_TLSEXT
45 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
46 # define EXIM_HAVE_RSA_GENKEY_EX
48 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
49 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define OPENSSL_AUTO_SHA256
51 # define OPENSSL_MIN_PROTO_VERSION
53 # define EXIM_HAVE_EPHEM_RSA_KEX
54 # define EXIM_HAVE_RAND_PSEUDO
56 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
57 # define EXIM_HAVE_SHA256
60 /* X509_check_host provides sane certificate hostname checking, but was added
61 to OpenSSL late, after other projects forked off the code-base. So in
62 addition to guarding against the base version number, beware that LibreSSL
63 does not (at this time) support this function.
65 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
66 opt to disentangle and ask a LibreSSL user to provide glue for a third
67 crypto provider for libtls instead of continuing to tie the OpenSSL glue
68 into even twistier knots. If LibreSSL gains the same API, we can just
69 change this guard and punt the issue for a while longer. */
71 #ifndef LIBRESSL_VERSION_NUMBER
72 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
73 # define EXIM_HAVE_OPENSSL_CHECKHOST
74 # define EXIM_HAVE_OPENSSL_DH_BITS
75 # define EXIM_HAVE_OPENSSL_TLS_METHOD
76 # define EXIM_HAVE_OPENSSL_KEYLOG
77 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
78 # define EXIM_HAVE_SESSION_TICKET
79 # define EXIM_HAVE_OPESSL_TRACE
80 # define EXIM_HAVE_OPESSL_GET0_SERIAL
82 # define EXIM_HAVE_OCSP
84 # define EXIM_HAVE_ALPN /* fail ret from hshake-cb is ignored by LibreSSL */
86 # define EXIM_NEED_OPENSSL_INIT
88 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
89 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
90 # define EXIM_HAVE_OPENSSL_CHECKHOST
94 #if LIBRESSL_VERSION_NUMBER >= 0x3040000fL
95 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
98 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x030000000L)
99 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
100 # define EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
103 #if !defined(LIBRESSL_VERSION_NUMBER) \
104 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
105 # if !defined(OPENSSL_NO_ECDH)
106 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
107 # define EXIM_HAVE_ECDH
109 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
110 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
115 #ifndef LIBRESSL_VERSION_NUMBER
116 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
117 # define OPENSSL_HAVE_KEYLOG_CB
118 # define OPENSSL_HAVE_NUM_TICKETS
119 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
120 # define EXIM_HAVE_EXP_CHNL_BNGNG
121 # define EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER
123 # define OPENSSL_BAD_SRVR_OURCERT
127 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x010002000L)
128 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
131 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
132 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
133 # define DISABLE_OCSP
136 #ifndef DISABLE_TLS_RESUME
137 # if OPENSSL_VERSION_NUMBER < 0x0101010L
138 # error OpenSSL version too old for session-resumption
142 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
143 # include <openssl/x509v3.h>
146 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
147 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
148 # define SSL_CIPHER_get_id(c) (c->id)
150 # ifndef MACRO_PREDEF
151 # include "tls-cipher-stdname.c"
155 /*************************************************
156 * OpenSSL option parse *
157 *************************************************/
159 typedef struct exim_openssl_option {
162 } exim_openssl_option;
163 /* We could use a macro to expand, but we need the ifdef and not all the
164 options document which version they were introduced in. Policylet: include
165 all options unless explicitly for DTLS, let the administrator choose which
168 This list is current as of:
171 XXX could we autobuild this list, as with predefined-macros?
172 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
173 Also allow a numeric literal?
175 static exim_openssl_option exim_openssl_options[] = {
176 /* KEEP SORTED ALPHABETICALLY! */
178 { US"all", (long) SSL_OP_ALL },
180 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
181 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
183 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
184 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
186 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
187 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
189 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
190 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
192 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
193 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
195 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
196 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
198 #ifdef SSL_OP_EPHEMERAL_RSA
199 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
201 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
202 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
204 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
205 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
207 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
208 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
210 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
211 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
213 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
214 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
216 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
217 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
219 #ifdef SSL_OP_NO_ANTI_REPLAY
220 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
222 #ifdef SSL_OP_NO_COMPRESSION
223 { US"no_compression", SSL_OP_NO_COMPRESSION },
225 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
226 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
228 #ifdef SSL_OP_NO_RENEGOTIATION
229 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
231 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
232 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
234 #ifdef SSL_OP_NO_SSLv2
235 { US"no_sslv2", SSL_OP_NO_SSLv2 },
237 #ifdef SSL_OP_NO_SSLv3
238 { US"no_sslv3", SSL_OP_NO_SSLv3 },
240 #ifdef SSL_OP_NO_TICKET
241 { US"no_ticket", SSL_OP_NO_TICKET },
243 #ifdef SSL_OP_NO_TLSv1
244 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
246 #ifdef SSL_OP_NO_TLSv1_1
247 # if OPENSSL_VERSION_NUMBER < 0x30000000L
248 # if SSL_OP_NO_TLSv1_1 == 0x00000400L
249 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
250 # warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
251 # define NO_SSL_OP_NO_TLSv1_1
254 # ifndef NO_SSL_OP_NO_TLSv1_1
255 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
258 #ifdef SSL_OP_NO_TLSv1_2
259 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
261 #ifdef SSL_OP_NO_TLSv1_3
262 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
264 #ifdef SSL_OP_PRIORITIZE_CHACHA
265 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
267 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
268 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
270 #ifdef SSL_OP_SINGLE_DH_USE
271 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
273 #ifdef SSL_OP_SINGLE_ECDH_USE
274 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
276 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
277 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
279 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
280 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
282 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
283 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
285 #ifdef SSL_OP_TLS_D5_BUG
286 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
288 #ifdef SSL_OP_TLS_ROLLBACK_BUG
289 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
291 #ifdef SSL_OP_TLSEXT_PADDING
292 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
297 static int exim_openssl_options_size = nelem(exim_openssl_options);
298 static long init_options = 0;
307 for (struct exim_openssl_option * o = exim_openssl_options;
308 o < exim_openssl_options + nelem(exim_openssl_options); o++)
310 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
311 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
313 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
314 builtin_macro_create(buf);
317 # ifndef DISABLE_TLS_RESUME
318 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
320 # ifdef SSL_OP_NO_TLSv1_3
321 builtin_macro_create(US"_HAVE_TLS1_3");
323 # ifdef OPENSSL_BAD_SRVR_OURCERT
324 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
326 # ifdef EXIM_HAVE_OCSP
327 builtin_macro_create(US"_HAVE_TLS_OCSP");
328 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
330 # ifdef EXIM_HAVE_ALPN
331 builtin_macro_create(US"_HAVE_TLS_ALPN");
336 /******************************************************************************/
338 /* Structure for collecting random data for seeding. */
340 typedef struct randstuff {
345 /* Local static variables */
347 static BOOL client_verify_callback_called = FALSE;
348 static BOOL server_verify_callback_called = FALSE;
349 static const uschar *sid_ctx = US"exim";
351 /* We have three different contexts to care about.
353 Simple case: client, `client_ctx`
354 As a client, we can be doing a callout or cut-through delivery while receiving
355 a message. So we have a client context, which should have options initialised
356 from the SMTP Transport. We may also concurrently want to make TLS connections
357 to utility daemons, so client-contexts are allocated and passed around in call
358 args rather than using a gobal.
361 There are two cases: with and without ServerNameIndication from the client.
362 Given TLS SNI, we can be using different keys, certs and various other
363 configuration settings, because they're re-expanded with $tls_sni set. This
364 allows vhosting with TLS. This SNI is sent in the handshake.
365 A client might not send SNI, so we need a fallback, and an initial setup too.
366 So as a server, we start out using `server_ctx`.
367 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
368 `server_sni` from `server_ctx` and then initialise settings by re-expanding
376 } exim_openssl_client_tls_ctx;
379 /* static SSL_CTX *server_ctx = NULL; */
380 /* static SSL *server_ssl = NULL; */
382 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
383 static SSL_CTX *server_sni = NULL;
385 #ifdef EXIM_HAVE_ALPN
386 static BOOL server_seen_alpn = FALSE;
389 static char ssl_errstring[256];
391 static int ssl_session_timeout = 7200; /* Two hours */
392 static BOOL client_verify_optional = FALSE;
393 static BOOL server_verify_optional = FALSE;
395 static BOOL reexpand_tls_files_for_sni = FALSE;
398 typedef struct ocsp_resp {
399 struct ocsp_resp * next;
400 OCSP_RESPONSE * resp;
403 typedef struct exim_openssl_state {
404 exim_tlslib_state lib_state;
405 #define lib_ctx libdata0
406 #define lib_ssl libdata1
409 uschar * certificate;
416 const uschar *file_expanded;
417 ocsp_resplist *olist;
418 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
421 X509_STORE *verify_store; /* non-null if status requested */
422 uschar *verify_errstr; /* only if _required */
423 BOOL verify_required;
428 /* these are cached from first expand */
429 uschar * server_cipher_list;
430 /* only passed down to tls_error: */
432 const uschar * verify_cert_hostnames;
433 #ifndef DISABLE_EVENT
434 uschar * event_action;
436 } exim_openssl_state_st;
438 /* should figure out a cleanup of API to handle state preserved per
439 implementation, for various reasons, which can be void * in the APIs.
440 For now, we hack around it. */
441 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
442 exim_openssl_state_st state_server = {.is_server = TRUE};
445 setup_certs(SSL_CTX * sctx, uschar ** certs, uschar * crl, host_item * host,
450 static int tls_server_stapling_cb(SSL *s, void *arg);
451 static void x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk);
452 static void x509_store_dump_cert_s_names(X509_STORE * store);
457 /* Daemon-called, before every connection, key create/rotate */
458 #ifndef DISABLE_TLS_RESUME
459 static void tk_init(void);
460 static int tls_exdata_idx = -1;
464 tls_per_lib_daemon_tick(void)
466 #ifndef DISABLE_TLS_RESUME
471 /* Called once at daemon startup */
474 tls_per_lib_daemon_init(void)
476 tls_daemon_creds_reload();
480 /*************************************************
482 *************************************************/
484 /* Called from lots of places when errors occur before actually starting to do
485 the TLS handshake, that is, while the session is still in clear. Always returns
486 DEFER for a server and FAIL for a client so that most calls can use "return
487 tls_error(...)" to do this processing and then give an appropriate return. A
488 single function is used for both server and client, because it is called from
489 some shared functions.
492 prefix text to include in the logged error
493 host NULL if setting up a server;
494 the connected host if setting up a client
495 msg error message or NULL if we should ask OpenSSL
496 errstr pointer to output error message
498 Returns: OK/DEFER/FAIL
502 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
506 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
507 msg = US ssl_errstring;
510 msg = string_sprintf("(%s): %s", prefix, msg);
511 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
512 if (errstr) *errstr = msg;
513 return host ? FAIL : DEFER;
518 /**************************************************
519 * General library initalisation *
520 **************************************************/
523 lib_rand_init(void * addr)
526 if (!RAND_status()) return TRUE;
528 gettimeofday(&r.tv, NULL);
530 RAND_seed(US (&r), sizeof(r));
531 RAND_seed(US big_buffer, big_buffer_size);
532 if (addr) RAND_seed(US addr, sizeof(addr));
534 return RAND_status();
539 tls_openssl_init(void)
541 static BOOL once = FALSE;
545 #ifdef EXIM_NEED_OPENSSL_INIT
546 SSL_load_error_strings(); /* basic set up */
547 OpenSSL_add_ssl_algorithms();
550 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
551 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
552 list of available digests. */
553 EVP_add_digest(EVP_sha256());
556 (void) lib_rand_init(NULL);
557 (void) tls_openssl_options_parse(openssl_options, &init_options);
562 /*************************************************
563 * Initialize for DH *
564 *************************************************/
566 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
570 sctx The current SSL CTX (inbound or outbound)
571 dhparam DH parameter file or fixed parameter identity string
572 errstr error string pointer
574 Returns: TRUE if OK (nothing to set up, or setup worked)
578 init_dh(SSL_CTX * sctx, uschar * dhparam, uschar ** errstr)
581 #if OPENSSL_VERSION_NUMBER < 0x30000000L
590 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
593 if (!dhexpanded || !*dhexpanded)
594 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
595 else if (dhexpanded[0] == '/')
597 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
599 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
600 NULL, US strerror(errno), errstr);
606 if (Ustrcmp(dhexpanded, "none") == 0)
608 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
612 if (!(pem = std_dh_prime_named(dhexpanded)))
614 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
615 NULL, US strerror(errno), errstr);
618 bio = BIO_new_mem_buf(CS pem, -1);
622 #if OPENSSL_VERSION_NUMBER < 0x30000000L
623 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)
625 pkey = PEM_read_bio_Parameters_ex(bio, NULL, NULL, NULL)
630 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
635 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
636 an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with 2236.
637 But older OpenSSL can only report in bytes (octets), not bits. If someone wants
638 to dance at the edge, then they can raise the limit or use current libraries. */
640 #if OPENSSL_VERSION_NUMBER < 0x30000000L
641 # ifdef EXIM_HAVE_OPENSSL_DH_BITS
642 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
643 This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
644 dh_bitsize = DH_bits(dh);
646 dh_bitsize = 8 * DH_size(dh);
649 dh_bitsize = EVP_PKEY_get_bits(pkey);
652 /* Even if it is larger, we silently return success rather than cause things to
653 fail out, so that a too-large DH will not knock out all TLS; it's a debatable
654 choice. Likewise for a failing attempt to set one. */
656 if (dh_bitsize <= tls_dh_max_bits)
659 #if OPENSSL_VERSION_NUMBER < 0x30000000L
660 SSL_CTX_set_tmp_dh(sctx, dh)
662 SSL_CTX_set0_tmp_dh_pkey(sctx, pkey)
666 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
667 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (D-H param setting '%s'): %s",
668 dhexpanded ? dhexpanded : US"default", ssl_errstring);
669 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
670 /* EVP_PKEY_free(pkey); crashes */
675 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
676 dhexpanded ? dhexpanded : US"default", dh_bitsize);
680 debug_printf("dhparams '%s' %d bits, is > tls_dh_max_bits limit of %d\n",
681 dhexpanded ? dhexpanded : US"default", dh_bitsize, tls_dh_max_bits);
683 #if OPENSSL_VERSION_NUMBER < 0x30000000L
686 /* The EVP_PKEY ownership stays with the ctx; do not free it */
695 /*************************************************
696 * Initialize for ECDH *
697 *************************************************/
699 /* Load parameters for ECDH encryption. Server only.
701 For now, we stick to NIST P-256 because: it's simple and easy to configure;
702 it avoids any patent issues that might bite redistributors; despite events in
703 the news and concerns over curve choices, we're not cryptographers, we're not
704 pretending to be, and this is "good enough" to be better than no support,
705 protecting against most adversaries. Given another year or two, there might
706 be sufficient clarity about a "right" way forward to let us make an informed
707 decision, instead of a knee-jerk reaction.
709 Longer-term, we should look at supporting both various named curves and
710 external files generated with "openssl ecparam", much as we do for init_dh().
711 We should also support "none" as a value, to explicitly avoid initialisation.
716 sctx The current SSL CTX (inbound or outbound)
717 errstr error string pointer
719 Returns: TRUE if OK (nothing to set up, or setup worked)
723 init_ecdh(SSL_CTX * sctx, uschar ** errstr)
725 #ifdef OPENSSL_NO_ECDH
733 # ifndef EXIM_HAVE_ECDH
735 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
739 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
741 if (!exp_curve || !*exp_curve)
744 /* "auto" needs to be handled carefully.
745 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
746 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
747 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
748 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
749 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
751 if (Ustrcmp(exp_curve, "auto") == 0)
753 #if OPENSSL_VERSION_NUMBER < 0x10002000L
754 DEBUG(D_tls) debug_printf(
755 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
756 exp_curve = US"prime256v1";
758 # if defined SSL_CTRL_SET_ECDH_AUTO
759 DEBUG(D_tls) debug_printf(
760 "ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n");
761 SSL_CTX_set_ecdh_auto(sctx, 1);
764 DEBUG(D_tls) debug_printf(
765 "ECDH OpenSSL 1.1.0+: temp key parameter settings: default selection\n");
771 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
772 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
773 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
774 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
778 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
783 # if OPENSSL_VERSION_NUMBER < 0x30000000L
786 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
788 tls_error(US"Unable to create ec curve", NULL, NULL, errstr);
792 /* The "tmp" in the name here refers to setting a temporary key
793 not to the stability of the interface. */
795 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
796 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), NULL, NULL, errstr);
798 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
802 #else /* v 3.0.0 + */
804 if ((rv = SSL_CTX_set1_groups(sctx, &nid, 1)) == 0)
805 tls_error(string_sprintf("Error enabling '%s' group", exp_curve), NULL, NULL, errstr);
807 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' group\n", exp_curve);
813 # endif /*EXIM_HAVE_ECDH*/
814 #endif /*OPENSSL_NO_ECDH*/
819 /*************************************************
820 * Expand key and cert file specs *
821 *************************************************/
823 #if OPENSSL_VERSION_NUMBER < 0x30000000L
826 s SSL connection (not used)
830 Returns: pointer to generated key
834 rsa_callback(SSL *s, int export, int keylength)
837 #ifdef EXIM_HAVE_RSA_GENKEY_EX
838 BIGNUM *bn = BN_new();
841 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
843 # ifdef EXIM_HAVE_RSA_GENKEY_EX
844 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
845 || !(rsa_key = RSA_new())
846 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
849 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
853 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
854 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
860 #endif /* pre-3.0.0 */
864 /* Create and install a selfsigned certificate, for use in server mode */
865 /*XXX we could arrange to call this during prelo for a null tls_certificate option.
866 The normal cache inval + relo will suffice.
867 Just need a timer for inval. */
870 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
877 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
878 where = US"allocating pkey";
879 if (!(pkey = EVP_PKEY_new()))
882 where = US"allocating cert";
883 if (!(x509 = X509_new()))
886 where = US"generating pkey";
887 #if OPENSSL_VERSION_NUMBER < 0x30000000L
890 if (!(rsa = rsa_callback(NULL, 0, 2048)))
893 where = US"assigning pkey";
894 if (!EVP_PKEY_assign_RSA(pkey, rsa))
898 pkey = EVP_RSA_gen(2048);
901 X509_set_version(x509, 2); /* N+1 - version 3 */
902 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
903 X509_gmtime_adj(X509_get_notBefore(x509), 0);
904 X509_gmtime_adj(X509_get_notAfter(x509), (long)2 * 60 * 60); /* 2 hour */
905 X509_set_pubkey(x509, pkey);
907 name = X509_get_subject_name(x509);
908 X509_NAME_add_entry_by_txt(name, "C",
909 MBSTRING_ASC, CUS "UK", -1, -1, 0);
910 X509_NAME_add_entry_by_txt(name, "O",
911 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
912 X509_NAME_add_entry_by_txt(name, "CN",
913 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
914 X509_set_issuer_name(x509, name);
916 where = US"signing cert";
917 if (!X509_sign(x509, pkey, EVP_md5()))
920 where = US"installing selfsign cert";
921 if (!SSL_CTX_use_certificate(sctx, x509))
924 where = US"installing selfsign key";
925 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
931 (void) tls_error(where, NULL, NULL, errstr);
932 if (x509) X509_free(x509);
933 if (pkey) EVP_PKEY_free(pkey);
943 /*************************************************
944 * Information callback *
945 *************************************************/
947 /* The SSL library functions call this from time to time to indicate what they
948 are doing. We copy the string to the debugging output when TLS debugging has
960 info_callback(SSL * s, int where, int ret)
966 if (where & SSL_ST_CONNECT) g = string_append_listele(g, ',', US"SSL_connect");
967 if (where & SSL_ST_ACCEPT) g = string_append_listele(g, ',', US"SSL_accept");
968 if (where & SSL_CB_LOOP) g = string_append_listele(g, ',', US"state_chg");
969 if (where & SSL_CB_EXIT) g = string_append_listele(g, ',', US"hshake_exit");
970 if (where & SSL_CB_READ) g = string_append_listele(g, ',', US"read");
971 if (where & SSL_CB_WRITE) g = string_append_listele(g, ',', US"write");
972 if (where & SSL_CB_ALERT) g = string_append_listele(g, ',', US"alert");
973 if (where & SSL_CB_HANDSHAKE_START) g = string_append_listele(g, ',', US"hshake_start");
974 if (where & SSL_CB_HANDSHAKE_DONE) g = string_append_listele(g, ',', US"hshake_done");
976 if (where & SSL_CB_LOOP)
977 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
978 else if (where & SSL_CB_ALERT)
979 debug_printf("SSL %s %s:%s\n", g->s,
980 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
981 else if (where & SSL_CB_EXIT)
984 debug_printf("SSL %s: %s in %s\n", g->s,
985 ret == 0 ? "failed" : "error", SSL_state_string_long(s));
987 else if (where & (SSL_CB_HANDSHAKE_START | SSL_CB_HANDSHAKE_DONE))
988 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
992 #ifdef OPENSSL_HAVE_KEYLOG_CB
994 keylog_callback(const SSL *ssl, const char *line)
998 DEBUG(D_tls) debug_printf("%.200s\n", line);
999 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
1000 if (!(fp = fopen(filename, "a"))) return;
1001 fprintf(fp, "%s\n", line);
1010 #ifndef DISABLE_EVENT
1012 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
1013 BOOL *calledp, const BOOL *optionalp, const uschar * what)
1019 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
1022 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
1023 old_cert = tlsp->peercert;
1024 tlsp->peercert = X509_dup(cert);
1025 /* NB we do not bother setting peerdn */
1026 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth), &errno)))
1028 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
1029 "depth=%d cert=%s: %s",
1030 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1031 what, depth, dn, yield);
1035 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
1036 return 1; /* reject (leaving peercert set) */
1038 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
1039 "(host in tls_try_verify_hosts)\n");
1040 tlsp->verify_override = TRUE;
1042 X509_free(tlsp->peercert);
1043 tlsp->peercert = old_cert;
1049 /*************************************************
1050 * Callback for verification *
1051 *************************************************/
1053 /* The SSL library does certificate verification if set up to do so. This
1054 callback has the current yes/no state is in "state". If verification succeeded,
1055 we set the certificate-verified flag. If verification failed, what happens
1056 depends on whether the client is required to present a verifiable certificate
1059 If verification is optional, we change the state to yes, but still log the
1060 verification error. For some reason (it really would help to have proper
1061 documentation of OpenSSL), this callback function then gets called again, this
1062 time with state = 1. We must take care not to set the private verified flag on
1063 the second time through.
1065 Note: this function is not called if the client fails to present a certificate
1066 when asked. We get here only if a certificate has been received. Handling of
1067 optional verification for this case is done when requesting SSL to verify, by
1068 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
1070 May be called multiple times for different issues with a certificate, even
1071 for a given "depth" in the certificate chain.
1074 preverify_ok current yes/no state as 1/0
1075 x509ctx certificate information.
1076 tlsp per-direction (client vs. server) support data
1077 calledp has-been-called flag
1078 optionalp verification-is-optional flag
1080 Returns: 0 if verification should fail, otherwise 1
1084 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1085 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1087 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1088 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1091 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1093 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1094 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1095 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1098 dn[sizeof(dn)-1] = '\0';
1100 tlsp->verify_override = FALSE;
1101 if (preverify_ok == 0)
1103 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1104 *verify_mode, sender_host_address)
1106 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1107 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1109 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1113 if (!tlsp->peercert)
1114 tlsp->peercert = X509_dup(cert); /* record failing cert */
1115 return 0; /* reject */
1117 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1118 "tls_try_verify_hosts)\n");
1119 tlsp->verify_override = TRUE;
1122 else if (depth != 0)
1124 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1125 #ifndef DISABLE_EVENT
1126 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1127 return 0; /* reject, with peercert set */
1132 const uschar * verify_cert_hostnames;
1134 if ( tlsp == &tls_out
1135 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1136 /* client, wanting hostname check */
1139 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1140 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1141 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1143 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1144 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1147 const uschar * list = verify_cert_hostnames;
1150 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1151 if ((rc = X509_check_host(cert, CCS name, 0,
1152 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1153 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1158 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1159 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1166 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1169 uschar * extra = verify_mode
1170 ? string_sprintf(" (during %c-verify for [%s])",
1171 *verify_mode, sender_host_address)
1173 log_write(0, LOG_MAIN,
1174 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1175 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1176 extra, dn, verify_cert_hostnames);
1180 if (!tlsp->peercert)
1181 tlsp->peercert = X509_dup(cert); /* record failing cert */
1182 return 0; /* reject */
1184 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1185 "tls_try_verify_hosts)\n");
1186 tlsp->verify_override = TRUE;
1190 #ifndef DISABLE_EVENT
1191 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1192 return 0; /* reject, with peercert set */
1195 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1196 *calledp ? "" : " authenticated", dn);
1200 return 1; /* accept, at least for this level */
1204 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1206 return verify_callback(preverify_ok, x509ctx, &tls_out,
1207 &client_verify_callback_called, &client_verify_optional);
1211 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1213 return verify_callback(preverify_ok, x509ctx, &tls_in,
1214 &server_verify_callback_called, &server_verify_optional);
1220 /* This gets called *by* the dane library verify callback, which interposes
1224 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1226 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1228 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1229 #ifndef DISABLE_EVENT
1230 BOOL dummy_called, optional = FALSE;
1233 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1235 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1236 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1237 deliver_host_address);
1240 dn[sizeof(dn)-1] = '\0';
1242 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1243 preverify_ok ? "ok":"BAD", depth, dn);
1245 #ifndef DISABLE_EVENT
1246 if (verify_event(&tls_out, cert, depth, dn,
1247 &dummy_called, &optional, US"DANE"))
1248 return 0; /* reject, with peercert set */
1251 if (preverify_ok == 1)
1252 tls_out.dane_verified = TRUE;
1255 int err = X509_STORE_CTX_get_error(x509ctx);
1257 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1258 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1261 return preverify_ok;
1264 #endif /*SUPPORT_DANE*/
1267 #ifndef DISABLE_OCSP
1269 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1271 BIO_printf(bp, "\t%s: ", str);
1272 ASN1_GENERALIZEDTIME_print(bp, time);
1276 /*************************************************
1277 * Load OCSP information into state *
1278 *************************************************/
1279 /* Called to load the server OCSP response from the given file into memory, once
1280 caller has determined this is needed. Checks validity. Debugs a message
1283 ASSUMES: single response, for single cert.
1286 state various parts of session state
1287 filename the filename putatively holding an OCSP response
1288 is_pem file is PEM format; otherwise is DER
1292 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1296 OCSP_RESPONSE * resp;
1297 OCSP_BASICRESP * basic_response;
1298 OCSP_SINGLERESP * single_response;
1299 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1300 STACK_OF(X509) * sk;
1301 int status, reason, i;
1304 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1306 if (!filename || !*filename) return;
1309 if (!(bio = BIO_new_file(CS filename, "rb")))
1311 log_write(0, LOG_MAIN|LOG_PANIC,
1312 "Failed to open OCSP response file \"%s\": %.100s",
1313 filename, ERR_reason_error_string(ERR_get_error()));
1319 uschar * data, * freep;
1322 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1324 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
1325 filename, ERR_reason_error_string(ERR_get_error()));
1329 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1330 OPENSSL_free(freep);
1333 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1338 log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
1339 filename, ERR_reason_error_string(ERR_get_error()));
1343 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1345 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1346 OCSP_response_status_str(status), status);
1352 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1353 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1358 if (!(basic_response = OCSP_response_get1_basic(resp)))
1361 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1365 sk = state->u_ocsp.server.verify_stack; /* set by setup_certs() / chain_from_pem_file() */
1367 /* May need to expose ability to adjust those flags?
1368 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1369 OCSP_TRUSTOTHER OCSP_NOINTERN */
1371 /* This does a partial verify (only the signer link, not the whole chain-to-CA)
1372 on the OCSP proof before we load it for serving up; possibly overkill -
1373 just date-checks might be nice enough.
1375 OCSP_basic_verify takes a "store" arg, but does not
1376 use it for the chain verification, when OCSP_NOVERIFY is set.
1377 The content from the wire "basic_response" and a cert-stack "sk" are all
1380 We have a stack, loaded in setup_certs() if tls_verify_certificates
1381 was a file (not a directory, or "system"). It is unfortunate we
1382 cannot used the connection context store, as that would neatly
1383 handle the "system" case too, but there seems to be no library
1384 function for getting a stack from a store.
1385 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1386 [ 3.0.0 - sk = X509_STORE_get1_all_certs(store) ]
1387 We do not free the stack since it could be needed a second time for
1390 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1391 be a public interface into the OpenSSL library (there's no manual entry) -
1392 (in 3.0.0 + is is public)
1393 But what with? We also use OCSP_basic_verify in the client stapling callback.
1394 And there we NEED it; we must verify that status... unless the
1395 library does it for us anyway? */
1397 if ((i = OCSP_basic_verify(basic_response, sk, NULL, OCSP_NOVERIFY)) < 0)
1401 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1402 debug_printf("OCSP response has bad signature: %s\n", US ssl_errstring);
1407 /* Here's the simplifying assumption: there's only one response, for the
1408 one certificate we use, and nothing for anything else in a chain. If this
1409 proves false, we need to extract a cert id from our issued cert
1410 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1411 right cert in the stack and then calls OCSP_single_get0_status()).
1413 I'm hoping to avoid reworking a bunch more of how we handle state here.
1415 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1418 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1421 debug_printf("Unable to get first response from OCSP basic response.\n");
1425 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1426 if (status != V_OCSP_CERTSTATUS_GOOD)
1428 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1429 OCSP_cert_status_str(status), status,
1430 OCSP_crl_reason_str(reason), reason);
1434 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1438 BIO * bp = BIO_new(BIO_s_mem());
1441 time_print(bp, "This OCSP Update", thisupd);
1442 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
1443 if ((len = (int) BIO_get_mem_data(bp, CSS &s)) > 0) debug_printf("%.*s", len, s);
1444 debug_printf("OCSP status invalid times.\n");
1450 /* Add the resp to the list used by tls_server_stapling_cb() */
1452 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1453 while (oentry = *op)
1455 *op = oentry = store_get(sizeof(ocsp_resplist), GET_UNTAINTED);
1456 oentry->next = NULL;
1457 oentry->resp = resp;
1462 if (f.running_in_test_harness)
1464 extern char ** environ;
1465 if (environ) for (uschar ** p = USS environ; *p; p++)
1466 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1468 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1469 goto supply_response;
1477 ocsp_free_response_list(exim_openssl_state_st * state)
1479 for (ocsp_resplist * olist = state->u_ocsp.server.olist; olist;
1480 olist = olist->next)
1481 OCSP_RESPONSE_free(olist->resp);
1482 state->u_ocsp.server.olist = NULL;
1484 #endif /*!DISABLE_OCSP*/
1491 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1494 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1495 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1496 return tls_error(string_sprintf(
1497 "SSL_CTX_use_certificate_chain_file file=%s", file),
1498 cbinfo->host, NULL, errstr);
1503 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1506 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1507 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1508 return tls_error(string_sprintf(
1509 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1516 /* Called once during tls_init and possibly again during TLS setup, for a
1517 new context, if Server Name Indication was used and tls_sni was seen in
1518 the certificate string.
1521 sctx the SSL_CTX* to update
1522 state various parts of session state
1523 errstr error string pointer
1525 Returns: OK/DEFER/FAIL
1529 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1534 if (!state->certificate)
1536 if (!state->is_server) /* client */
1539 if (tls_install_selfsign(sctx, errstr) != OK)
1546 if ( !reexpand_tls_files_for_sni
1547 && ( Ustrstr(state->certificate, US"tls_sni")
1548 || Ustrstr(state->certificate, US"tls_in_sni")
1549 || Ustrstr(state->certificate, US"tls_out_sni")
1551 reexpand_tls_files_for_sni = TRUE;
1553 if (!expand_check(state->certificate, US"tls_certificate", &expanded, errstr))
1557 if (state->is_server)
1559 const uschar * file_list = expanded;
1562 #ifndef DISABLE_OCSP
1563 const uschar * olist = state->u_ocsp.server.file;
1566 BOOL fmt_pem = FALSE;
1569 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1571 if (olist && !*olist)
1574 /* If doing a re-expand after SNI, avoid reloading the OCSP
1575 responses when the list of filenames has not changed.
1576 The creds-invali on content change wipes file_expanded, so that
1577 always reloads here. */
1579 if ( state->u_ocsp.server.file_expanded && olist
1580 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1582 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1587 ocsp_free_response_list(state);
1588 state->u_ocsp.server.file_expanded = olist;
1592 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1594 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1597 #ifndef DISABLE_OCSP
1599 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1601 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1606 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1611 ocsp_load_response(state, ofile, fmt_pem);
1614 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1618 else /* would there ever be a need for multiple client certs? */
1619 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1622 if ( state->privatekey
1623 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr))
1626 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1627 of the expansion is an empty string, ignore it also, and assume the private
1628 key is in the same file as the certificate. */
1630 if (expanded && *expanded)
1631 if (state->is_server)
1633 const uschar * file_list = expanded;
1637 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1638 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1641 else /* would there ever be a need for multiple client certs? */
1642 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1652 /**************************************************
1653 * One-time init credentials for server and client *
1654 **************************************************/
1657 normalise_ciphers(uschar ** ciphers, const uschar * pre_expansion_ciphers)
1659 uschar * s = *ciphers;
1661 if (!s || !Ustrchr(s, '_')) return; /* no change needed */
1663 if (s == pre_expansion_ciphers)
1664 s = string_copy(s); /* get writable copy */
1666 for (uschar * t = s; *t; t++) if (*t == '_') *t = '-';
1671 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1672 uschar * ciphers, uschar ** errstr)
1674 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1675 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1676 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1677 state->server_cipher_list = ciphers;
1684 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1687 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1688 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1690 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1692 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1694 /* Set up the information callback, which outputs if debugging is at a suitable
1699 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1700 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1701 /* this needs a debug build of OpenSSL */
1702 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
1704 #ifdef OPENSSL_HAVE_KEYLOG_CB
1705 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
1709 /* Automatically re-try reads/writes after renegotiation. */
1710 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1717 tls_server_creds_init(void)
1720 uschar * dummy_errstr;
1721 unsigned lifetime = 0;
1725 state_server.lib_state = null_tls_preload;
1727 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1729 state_server.lib_state.lib_ctx = ctx;
1731 /* Preload DH params and EC curve */
1733 if (opt_unset_or_noexpand(tls_dhparam))
1735 DEBUG(D_tls) debug_printf("TLS: preloading DH params for server\n");
1736 if (init_dh(ctx, tls_dhparam, &dummy_errstr))
1737 state_server.lib_state.dh = TRUE;
1740 DEBUG(D_tls) debug_printf("TLS: not preloading DH params for server\n");
1741 if (opt_unset_or_noexpand(tls_eccurve))
1743 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for server\n");
1744 if (init_ecdh(ctx, &dummy_errstr))
1745 state_server.lib_state.ecdh = TRUE;
1748 DEBUG(D_tls) debug_printf("TLS: not preloading ECDH curve for server\n");
1750 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1751 /* If we can, preload the Authorities for checking client certs against.
1752 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1753 at TLS conn startup.
1754 Do this before the server ocsp so that its info can verify the ocsp. */
1756 if ( opt_set_and_noexpand(tls_verify_certificates)
1757 && opt_unset_or_noexpand(tls_crl))
1759 /* Watch the default dir also as they are always included */
1761 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1762 && tls_set_watch(tls_verify_certificates, FALSE)
1763 && tls_set_watch(tls_crl, FALSE))
1765 uschar * v_certs = tls_verify_certificates;
1766 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1768 if (setup_certs(ctx, &v_certs, tls_crl, NULL, &dummy_errstr) == OK)
1769 state_server.lib_state.cabundle = TRUE;
1771 /* If we can, preload the server-side cert, key and ocsp */
1773 if ( opt_set_and_noexpand(tls_certificate)
1774 # ifndef DISABLE_OCSP
1775 && opt_unset_or_noexpand(tls_ocsp_file)
1777 && opt_unset_or_noexpand(tls_privatekey))
1779 /* Set watches on the filenames. The implementation does de-duplication
1780 so we can just blindly do them all. */
1782 if ( tls_set_watch(tls_certificate, TRUE)
1783 # ifndef DISABLE_OCSP
1784 && tls_set_watch(tls_ocsp_file, TRUE)
1786 && tls_set_watch(tls_privatekey, TRUE))
1788 state_server.certificate = tls_certificate;
1789 state_server.privatekey = tls_privatekey;
1790 #ifndef DISABLE_OCSP
1791 state_server.u_ocsp.server.file = tls_ocsp_file;
1794 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1795 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1796 state_server.lib_state.conn_certs = TRUE;
1799 else if ( !tls_certificate && !tls_privatekey
1800 # ifndef DISABLE_OCSP
1804 { /* Generate & preload a selfsigned cert. No files to watch. */
1805 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1807 state_server.lib_state.conn_certs = TRUE;
1808 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1812 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1816 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1819 #endif /* EXIM_HAVE_INOTIFY */
1822 /* If we can, preload the ciphers control string */
1824 if (opt_set_and_noexpand(tls_require_ciphers))
1826 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1827 normalise_ciphers(&tls_require_ciphers, tls_require_ciphers);
1828 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1829 &dummy_errstr) == OK)
1830 state_server.lib_state.pri_string = TRUE;
1833 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1840 /* Preload whatever creds are static, onto a transport. The client can then
1841 just copy the pointer as it starts up.
1842 Called from the daemon after a cache-invalidate with watch set; called from
1843 a queue-run startup with watch clear. */
1846 tls_client_creds_init(transport_instance * t, BOOL watch)
1848 smtp_transport_options_block * ob = t->options_block;
1849 exim_openssl_state_st tpt_dummy_state;
1850 host_item * dummy_host = (host_item *)1;
1851 uschar * dummy_errstr;
1856 ob->tls_preload = null_tls_preload;
1857 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1859 ob->tls_preload.lib_ctx = ctx;
1861 tpt_dummy_state.lib_state = ob->tls_preload;
1863 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1864 if ( opt_set_and_noexpand(ob->tls_certificate)
1865 && opt_unset_or_noexpand(ob->tls_privatekey))
1868 || ( tls_set_watch(ob->tls_certificate, FALSE)
1869 && tls_set_watch(ob->tls_privatekey, FALSE)
1872 uschar * pkey = ob->tls_privatekey;
1875 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1877 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1879 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1880 pkey ? pkey : ob->tls_certificate,
1883 ob->tls_preload.conn_certs = TRUE;
1888 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1891 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1892 && opt_unset_or_noexpand(ob->tls_crl))
1895 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1896 && tls_set_watch(ob->tls_verify_certificates, FALSE)
1897 && tls_set_watch(ob->tls_crl, FALSE)
1900 uschar * v_certs = ob->tls_verify_certificates;
1902 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1904 if (setup_certs(ctx, &v_certs,
1905 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
1906 ob->tls_preload.cabundle = TRUE;
1911 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1913 #endif /*EXIM_HAVE_INOTIFY*/
1917 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1918 /* Invalidate the creds cached, by dropping the current ones.
1919 Call when we notice one of the source files has changed. */
1922 tls_server_creds_invalidate(void)
1924 SSL_CTX_free(state_server.lib_state.lib_ctx);
1925 state_server.lib_state = null_tls_preload;
1926 #ifndef DISABLE_OCSP
1927 state_server.u_ocsp.server.file_expanded = NULL;
1933 tls_client_creds_invalidate(transport_instance * t)
1935 smtp_transport_options_block * ob = t->options_block;
1936 SSL_CTX_free(ob->tls_preload.lib_ctx);
1937 ob->tls_preload = null_tls_preload;
1943 tls_server_creds_invalidate(void)
1947 tls_client_creds_invalidate(transport_instance * t)
1950 #endif /*EXIM_HAVE_INOTIFY*/
1955 #ifndef DISABLE_OCSP
1957 debug_print_sn(const X509 * cert)
1959 X509_NAME * sn = X509_get_subject_name(cert);
1960 static uschar name[256];
1961 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
1963 name[sizeof(name)-1] = '\0';
1964 debug_printf(" %s\n", name);
1969 x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk)
1972 debug_printf(" (null)\n");
1975 int idx = sk_X509_num(sk);
1977 debug_printf(" (empty)\n");
1979 while (--idx >= 0) debug_print_sn(sk_X509_value(sk, idx));
1984 x509_store_dump_cert_s_names(X509_STORE * store)
1986 # ifdef EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
1987 STACK_OF(X509) * sk = X509_STORE_get1_all_certs(store);
1988 x509_stack_dump_cert_s_names(sk);
1989 sk_X509_pop_free(sk, X509_free);
1993 debug_printf(" (no store)\n");
1996 STACK_OF(X509_OBJECT) * objs = X509_STORE_get0_objects(store);
1998 debug_printf(" (null objectlist)\n");
1999 else for (int i = 0; i < sk_X509_OBJECT_num(objs); i++)
2001 X509 * cert = X509_OBJECT_get0_X509(sk_X509_OBJECT_value(objs, i));
2002 if (cert) debug_print_sn(cert);
2007 #endif /*!DISABLE_OCSP*/
2012 #ifndef DISABLE_TLS_RESUME
2013 /* Manage the keysets used for encrypting the session tickets, on the server. */
2015 typedef struct { /* Session ticket encryption key */
2018 const EVP_CIPHER * aes_cipher;
2019 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
2020 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2021 const EVP_MD * hmac_hash;
2023 const uschar * hmac_hashname;
2025 uschar hmac_key[16];
2030 static exim_stek exim_tk; /* current key */
2031 static exim_stek exim_tk_old; /* previous key */
2036 time_t t = time(NULL);
2038 if (exim_tk.name[0])
2040 if (exim_tk.renew >= t) return;
2041 exim_tk_old = exim_tk;
2044 if (f.running_in_test_harness) ssl_session_timeout = 6;
2046 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
2047 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
2048 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
2049 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
2051 exim_tk.name[0] = 'E';
2052 exim_tk.aes_cipher = EVP_aes_256_cbc();
2053 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2054 exim_tk.hmac_hash = EVP_sha256();
2056 exim_tk.hmac_hashname = US "sha256";
2058 exim_tk.expire = t + ssl_session_timeout;
2059 exim_tk.renew = t + ssl_session_timeout/2;
2065 if (!exim_tk.name[0]) return NULL;
2070 tk_find(const uschar * name)
2072 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
2073 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
2080 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2088 /*XXX will want these dependent on the ssl session strength */
2089 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2090 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2091 key->hmac_hash, NULL);
2094 OSSL_PARAM params[3];
2095 uschar * hk = string_copy(key->hmac_hashname); /* need nonconst */
2096 params[0] = OSSL_PARAM_construct_octet_string("key", key->hmac_key, sizeof(key->hmac_key));
2097 params[1] = OSSL_PARAM_construct_utf8_string("digest", CS hk, 0);
2098 params[2] = OSSL_PARAM_construct_end();
2099 if (EVP_MAC_CTX_set_params(hctx, params) == 0)
2101 DEBUG(D_tls) debug_printf("EVP_MAC_CTX_set_params: %s\n",
2102 ERR_reason_error_string(ERR_get_error()));
2103 return 0; /* error in mac initialisation */
2110 /* Callback for session tickets, on server */
2112 ticket_key_callback(SSL * ssl, uschar key_name[16],
2113 uschar * iv, EVP_CIPHER_CTX * c_ctx,
2114 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2121 tls_support * tlsp = state_server.tlsp;
2126 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
2127 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2129 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
2130 return -1; /* insufficient random */
2132 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
2133 return 0; /* key couldn't be created */
2134 memcpy(key_name, key->name, 16);
2135 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
2137 if (tk_hmac_init(hctx, key) == 0) return 0;
2138 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2140 DEBUG(D_tls) debug_printf("ticket created\n");
2145 time_t now = time(NULL);
2147 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
2148 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2150 if (!(key = tk_find(key_name)) || key->expire < now)
2154 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
2155 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
2160 if (tk_hmac_init(hctx, key) == 0) return 0;
2161 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2163 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2165 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2166 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2167 be better. To do that we'd have to encode ticket lifetime in the name as
2168 we don't yet see the restored session. Could check posthandshake for TLS1.3
2169 and trigger a new ticket then, but cannot do that for TLS1.2 */
2170 return key->renew < now ? 2 : 1;
2173 #endif /* !DISABLE_TLS_RESUME */
2178 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2179 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2181 /* If verification is optional, don't fail if no certificate */
2183 SSL_CTX_set_verify(ctx,
2184 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2189 /*************************************************
2190 * Callback to handle SNI *
2191 *************************************************/
2193 /* Called when acting as server during the TLS session setup if a Server Name
2194 Indication extension was sent by the client.
2196 API documentation is OpenSSL s_server.c implementation.
2199 s SSL* of the current session
2200 ad unknown (part of OpenSSL API) (unused)
2201 arg Callback of "our" registered data
2203 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2205 XXX might need to change to using ClientHello callback,
2206 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2209 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2211 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
2213 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2214 exim_openssl_state_st *state = (exim_openssl_state_st *) arg;
2216 int old_pool = store_pool;
2217 uschar * dummy_errstr;
2220 return SSL_TLSEXT_ERR_OK;
2222 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2223 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2225 /* Make the extension value available for expansion */
2226 store_pool = POOL_PERM;
2227 tls_in.sni = string_copy_taint(US servername, GET_TAINTED);
2228 store_pool = old_pool;
2230 if (!reexpand_tls_files_for_sni)
2231 return SSL_TLSEXT_ERR_OK;
2233 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2234 not confident that memcpy wouldn't break some internal reference counting.
2235 Especially since there's a references struct member, which would be off. */
2237 if (lib_ctx_new(&server_sni, NULL, &dummy_errstr) != OK)
2240 /* Not sure how many of these are actually needed, since SSL object
2241 already exists. Might even need this selfsame callback, for reneg? */
2244 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2245 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2246 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2247 #ifdef OPENSSL_MIN_PROTO_VERSION
2248 SSL_CTX_set_min_proto_version(server_sni, SSL3_VERSION);
2250 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2251 SSL_CTX_clear_options(server_sni, ~SSL_CTX_get_options(ctx));
2252 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2253 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2254 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2257 if ( !init_dh(server_sni, state->dhparam, &dummy_errstr)
2258 || !init_ecdh(server_sni, &dummy_errstr)
2262 if ( state->server_cipher_list
2263 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2266 #ifndef DISABLE_OCSP
2267 if (state->u_ocsp.server.file)
2269 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2270 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2275 uschar * v_certs = tls_verify_certificates;
2276 if ((rc = setup_certs(server_sni, &v_certs, tls_crl, NULL,
2277 &dummy_errstr)) != OK)
2280 if (v_certs && *v_certs)
2281 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2284 /* do this after setup_certs, because this can require the certs for verifying
2285 OCSP information. */
2286 if ((rc = tls_expand_session_files(server_sni, state, &dummy_errstr)) != OK)
2289 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2290 SSL_set_SSL_CTX(s, server_sni);
2291 return SSL_TLSEXT_ERR_OK;
2293 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
2295 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2300 #ifdef EXIM_HAVE_ALPN
2301 /*************************************************
2302 * Callback to handle ALPN *
2303 *************************************************/
2305 /* Called on server if tls_alpn nonblank after expansion,
2306 when client offers ALPN, after the SNI callback.
2307 If set and not matching the list then we dump the connection */
2310 tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen,
2311 const uschar * in, unsigned int inlen, void * arg)
2313 server_seen_alpn = TRUE;
2316 debug_printf("Received TLS ALPN offer:");
2317 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2320 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2321 debug_printf(" '%.*s'", siz, in + pos + 1);
2323 debug_printf(". Our list: '%s'\n", tls_alpn);
2326 /* Look for an acceptable ALPN */
2328 if ( inlen > 1 /* at least one name */
2329 && in[0]+1 == inlen /* filling the vector, so exactly one name */
2332 const uschar * list = tls_alpn;
2334 for (uschar * name; name = string_nextinlist(&list, &sep, NULL, 0); )
2335 if (Ustrncmp(in+1, name, in[0]) == 0)
2337 *out = in+1; /* we checked for exactly one, so can just point to it */
2339 return SSL_TLSEXT_ERR_OK; /* use ALPN */
2343 /* More than one name from clilent, or name did not match our list. */
2345 /* This will be fatal to the TLS conn; would be nice to kill TCP also.
2346 Maybe as an option in future; for now leave control to the config (must-tls). */
2348 DEBUG(D_tls) debug_printf("TLS ALPN rejected\n");
2349 return SSL_TLSEXT_ERR_ALERT_FATAL;
2351 #endif /* EXIM_HAVE_ALPN */
2355 #ifndef DISABLE_OCSP
2357 /*************************************************
2358 * Callback to handle OCSP Stapling *
2359 *************************************************/
2361 /* Called when acting as server during the TLS session setup if the client
2362 requests OCSP information with a Certificate Status Request.
2364 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2370 tls_server_stapling_cb(SSL *s, void *arg)
2372 const exim_openssl_state_st * state = arg;
2373 ocsp_resplist * olist = state->u_ocsp.server.olist;
2374 uschar * response_der; /*XXX blob */
2375 int response_der_len;
2378 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2379 olist ? "have" : "lack");
2381 tls_in.ocsp = OCSP_NOT_RESP;
2383 return SSL_TLSEXT_ERR_NOACK;
2385 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
2387 const X509 * cert_sent = SSL_get_certificate(s);
2388 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2389 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2391 for (; olist; olist = olist->next)
2393 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2394 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2395 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2396 ASN1_INTEGER * res_cert_serial;
2397 const BIGNUM * resp_bn;
2398 ASN1_OCTET_STRING * res_cert_iNameHash;
2401 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2402 (OCSP_CERTID *) cid);
2403 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2407 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2408 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2411 if (BN_cmp(cert_bn, resp_bn) == 0)
2413 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2415 /*XXX TODO: check the rest of the list for duplicate matches.
2416 If any, need to also check the Issuer Name hash.
2417 Without this, we will provide the wrong status in the case of
2422 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2426 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2427 return SSL_TLSEXT_ERR_NOACK;
2433 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2434 return SSL_TLSEXT_ERR_NOACK;
2438 /*XXX could we do the i2d earlier, rather than during the callback? */
2439 response_der = NULL;
2440 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2441 if (response_der_len <= 0)
2442 return SSL_TLSEXT_ERR_NOACK;
2444 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2445 response_der, response_der_len);
2446 tls_in.ocsp = OCSP_VFIED;
2447 return SSL_TLSEXT_ERR_OK;
2452 add_chain_to_store(X509_STORE * store, STACK_OF(X509) * sk,
2453 const char * debug_text)
2459 debug_printf("chain for %s:\n", debug_text);
2460 x509_stack_dump_cert_s_names(sk);
2463 if ((idx = sk_X509_num(sk)) > 0)
2465 X509_STORE_add_cert(store, sk_X509_value(sk, idx));
2470 tls_client_stapling_cb(SSL * ssl, void * arg)
2472 exim_openssl_state_st * cbinfo = arg;
2473 const unsigned char * p;
2475 OCSP_RESPONSE * rsp;
2476 OCSP_BASICRESP * bs;
2479 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2480 len = SSL_get_tlsext_status_ocsp_resp(ssl, &p);
2482 { /* Expect this when we requested ocsp but got none */
2483 if (SSL_session_reused(ssl) && tls_out.ocsp == OCSP_VFIED)
2485 DEBUG(D_tls) debug_printf(" null, but resumed; ocsp vfy stored with session is good\n");
2489 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2490 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2492 DEBUG(D_tls) debug_printf(" null\n");
2494 if (!cbinfo->u_ocsp.client.verify_required)
2496 cbinfo->u_ocsp.client.verify_errstr =
2497 US"(SSL_connect) Required TLS certificate status not received";
2501 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2503 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2504 if (LOGGING(tls_cipher))
2505 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2507 DEBUG(D_tls) debug_printf(" parse error\n");
2511 if (!(bs = OCSP_response_get1_basic(rsp)))
2513 tls_out.ocsp = OCSP_FAILED;
2514 if (LOGGING(tls_cipher))
2515 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2517 DEBUG(D_tls) debug_printf(" error parsing response\n");
2518 OCSP_RESPONSE_free(rsp);
2522 /* We'd check the nonce here if we'd put one in the request. */
2523 /* However that would defeat cacheability on the server so we don't. */
2525 /* This section of code reworked from OpenSSL apps source;
2526 The OpenSSL Project retains copyright:
2527 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2531 X509_STORE * verify_store = NULL;
2532 BOOL have_verified_OCSP_signer = FALSE;
2533 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2534 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2537 DEBUG(D_tls) bp = BIO_new(BIO_s_mem());
2539 /* Use the CA & chain that verified the server cert to verify the stapled info */
2542 /* If this routine is not available, we've avoided [in tls_client_start()]
2543 asking for certificate-status under DANE, so this callback won't run for
2544 that combination. It still will for non-DANE. */
2546 #ifdef EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER
2549 if ( tls_out.dane_verified
2550 && (have_verified_OCSP_signer =
2551 OCSP_resp_get0_signer(bs, &signer, SSL_get0_verified_chain(ssl)) == 1))
2554 debug_printf("signer for OCSP basicres is in the verified chain;"
2555 " shortcut its verification\n");
2560 STACK_OF(X509) * verified_chain;
2562 verify_store = X509_STORE_new();
2564 SSL_get0_chain_certs(ssl, &verified_chain);
2565 add_chain_to_store(verify_store, verified_chain,
2566 "'current cert' per SSL_get0_chain_certs()");
2568 verified_chain = SSL_get0_verified_chain(ssl);
2569 add_chain_to_store(verify_store, verified_chain,
2570 "SSL_get0_verified_chain()");
2576 debug_printf("Untrusted intermediate cert stack (from SSL_get_peer_cert_chain()):\n");
2577 x509_stack_dump_cert_s_names(SSL_get_peer_cert_chain(ssl));
2579 debug_printf("will use this CA store for verifying basicresp:\n");
2580 x509_store_dump_cert_s_names(verify_store);
2582 /* OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2584 debug_printf("certs contained in basicresp:\n");
2585 x509_stack_dump_cert_s_names((STACK_OF(X509 *))OCSP_resp_get0_certs(bs));
2587 #ifdef EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS /* else, could bodge via X509_STORE_get0_objects()
2588 - but is OCSP_resp_get0_signer) avail? from 1.1.1 */
2591 if (OCSP_resp_get0_signer(bs, &signer, X509_STORE_get1_all_certs(verify_store)) == 1)
2593 debug_printf("found signer for basicres:\n");
2594 debug_print_sn(signer);
2598 debug_printf("failed to find signer for basicres:\n");
2599 ERR_print_errors(bp);
2608 /* Under DANE the trust-anchor (at least in TA mode) is indicated by the TLSA
2609 record in DNS, and probably is not the root of the chain of certificates. So
2610 accept a partial chain for that case (and hope that anchor is visible for
2611 verifying the OCSP stapling).
2612 XXX for EE mode it won't even be that. Does that make OCSP useless for EE?
2614 Worse, for LetsEncrypt-mode (ocsp signer is leaf-signer) under DANE, the
2615 data used within OpenSSL for the signer has nil pointers for signing
2616 algorithms - and a crash results. Avoid this by shortcutting verification,
2617 having determined that the OCSP signer is in the (DANE-)validated set.
2620 #ifndef OCSP_PARTIAL_CHAIN /* defined for 3.0.0 onwards */
2621 # define OCSP_PARTIAL_CHAIN 0
2624 if ((i = OCSP_basic_verify(bs, SSL_get_peer_cert_chain(ssl),
2626 tls_out.dane_verified
2627 ? have_verified_OCSP_signer
2628 ? OCSP_NOVERIFY | OCSP_NOEXPLICIT
2629 : OCSP_PARTIAL_CHAIN | OCSP_NOEXPLICIT
2630 : OCSP_NOEXPLICIT)) <= 0)
2632 DEBUG(D_tls) debug_printf("OCSP_basic_verify() fail: returned %d\n", i);
2633 if (ERR_peek_error())
2635 tls_out.ocsp = OCSP_FAILED;
2636 if (LOGGING(tls_cipher))
2638 static uschar peerdn[256];
2639 const uschar * errstr;;
2641 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
2642 ERR_peek_error_all(NULL, NULL, NULL, CCSS &errstr, NULL);
2645 errstr = CUS ERR_reason_error_string(ERR_peek_error());
2647 X509_NAME_oneline(X509_get_subject_name(SSL_get_peer_certificate(ssl)),
2648 CS peerdn, sizeof(peerdn));
2649 log_write(0, LOG_MAIN,
2650 "[%s] %s Received TLS cert (DN: '%.*s') status response, "
2651 "itself unverifiable: %s",
2652 deliver_host_address, deliver_host,
2653 (int)sizeof(peerdn), peerdn, errstr);
2657 BIO_printf(bp, "OCSP response verify failure\n");
2658 ERR_print_errors(bp);
2661 int len = (int) BIO_get_mem_data(bp, CSS &s);
2662 if (len > 0) debug_printf("%.*s", len, s);
2665 OCSP_RESPONSE_print(bp, rsp, 0);
2670 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2671 " in the root CA certificate; ignoring\n");
2674 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2676 /*XXX So we have a good stapled OCSP status. How do we know
2677 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2678 OCSP_resp_find_status() which matches on a cert id, which presumably
2679 we should use. Making an id needs OCSP_cert_id_new(), which takes
2680 issuerName, issuerKey, serialNumber. Are they all in the cert?
2682 For now, carry on blindly accepting the resp. */
2685 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2686 OCSP_resp_count(bs) - 1;
2688 sk_OCSP_SINGLERESP_num(sresp) - 1;
2692 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2694 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2696 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2697 - but what happens with a GnuTLS-style input?
2699 we could do with a debug label for each singleresp
2700 - it has a certID with a serialNumber, but I see no API to get that
2702 status = OCSP_single_get0_status(single, &reason, &rev,
2703 &thisupd, &nextupd);
2707 time_print(bp, "This OCSP Update", thisupd);
2708 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
2710 if (!OCSP_check_validity(thisupd, nextupd,
2711 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2713 tls_out.ocsp = OCSP_FAILED;
2714 DEBUG(D_tls) ERR_print_errors(bp);
2715 cbinfo->u_ocsp.client.verify_errstr =
2716 US"(SSL_connect) Server certificate status is out-of-date";
2717 log_write(0, LOG_MAIN, "OCSP dates invalid");
2721 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2722 OCSP_cert_status_str(status));
2725 case V_OCSP_CERTSTATUS_GOOD:
2726 continue; /* the idx loop */
2727 case V_OCSP_CERTSTATUS_REVOKED:
2728 cbinfo->u_ocsp.client.verify_errstr =
2729 US"(SSL_connect) Server certificate revoked";
2730 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2731 reason != -1 ? "; reason: " : "",
2732 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2733 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2736 cbinfo->u_ocsp.client.verify_errstr =
2737 US"(SSL_connect) Server certificate has unknown status";
2738 log_write(0, LOG_MAIN,
2739 "Server certificate status unknown, in OCSP stapling");
2747 tls_out.ocsp = OCSP_VFIED;
2751 tls_out.ocsp = OCSP_FAILED;
2752 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2756 int len = (int) BIO_get_mem_data(bp, CSS &s);
2757 if (len > 0) debug_printf("%.*s", len, s);
2762 OCSP_RESPONSE_free(rsp);
2765 #endif /*!DISABLE_OCSP*/
2768 /*************************************************
2769 * Initialize for TLS *
2770 *************************************************/
2771 /* Called from both server and client code, to do preliminary initialization
2772 of the library. We allocate and return a context structure.
2775 host connected host, if client; NULL if server
2776 ob transport options block, if client; NULL if server
2777 ocsp_file file of stapling info (server); flag for require ocsp (client)
2778 addr address if client; NULL if server (for some randomness)
2779 caller_state place to put pointer to allocated state-struct
2780 errstr error string pointer
2782 Returns: OK/DEFER/FAIL
2786 tls_init(host_item * host, smtp_transport_options_block * ob,
2787 #ifndef DISABLE_OCSP
2790 address_item *addr, exim_openssl_state_st ** caller_state,
2791 tls_support * tlsp, uschar ** errstr)
2794 exim_openssl_state_st * state;
2797 if (host) /* client */
2799 state = store_malloc(sizeof(exim_openssl_state_st));
2800 memset(state, 0, sizeof(*state));
2801 state->certificate = ob->tls_certificate;
2802 state->privatekey = ob->tls_privatekey;
2803 state->is_server = FALSE;
2804 state->dhparam = NULL;
2805 state->lib_state = ob->tls_preload;
2809 state = &state_server;
2810 state->certificate = tls_certificate;
2811 state->privatekey = tls_privatekey;
2812 state->is_server = TRUE;
2813 state->dhparam = tls_dhparam;
2814 state->lib_state = state_server.lib_state;
2820 if (!state->lib_state.pri_string)
2821 state->server_cipher_list = NULL;
2823 #ifndef DISABLE_EVENT
2824 state->event_action = NULL;
2829 /* It turns out that we need to seed the random number generator this early in
2830 order to get the full complement of ciphers to work. It took me roughly a day
2831 of work to discover this by experiment.
2833 On systems that have /dev/urandom, SSL may automatically seed itself from
2834 there. Otherwise, we have to make something up as best we can. Double check
2837 Although we likely called this before, at daemon startup, this is a chance
2838 to mix in further variable info (time, pid) if needed. */
2840 if (!lib_rand_init(addr))
2841 return tls_error(US"RAND_status", host,
2842 US"unable to seed random number generator", errstr);
2844 /* Apply administrator-supplied work-arounds.
2845 Historically we applied just one requested option,
2846 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2847 moved to an administrator-controlled list of options to specify and
2848 grandfathered in the first one as the default value for "openssl_options".
2850 No OpenSSL version number checks: the options we accept depend upon the
2851 availability of the option value macros from OpenSSL. */
2854 if (!tls_openssl_options_parse(openssl_options, &init_options))
2855 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2857 /* Create a context.
2858 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2859 negotiation in the different methods; as far as I can tell, the only
2860 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2861 when OpenSSL is built without SSLv2 support.
2862 By disabling with openssl_options, we can let admins re-enable with the
2865 if (!(ctx = state->lib_state.lib_ctx))
2867 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2869 state->lib_state.lib_ctx = ctx;
2872 #ifndef DISABLE_TLS_RESUME
2873 tlsp->resumption = RESUME_SUPPORTED;
2877 #ifndef DISABLE_TLS_RESUME
2878 /* Should the server offer session resumption? */
2879 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2881 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2882 init_options &= ~SSL_OP_NO_TICKET;
2883 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2884 tlsp->host_resumable = TRUE;
2888 #ifdef OPENSSL_MIN_PROTO_VERSION
2889 SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
2891 DEBUG(D_tls) debug_printf("setting SSL CTX options: %016lx\n", init_options);
2892 SSL_CTX_set_options(ctx, init_options);
2894 uint64_t readback = SSL_CTX_clear_options(ctx, ~init_options);
2895 if (readback != init_options)
2896 return tls_error(string_sprintf(
2897 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2901 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2903 /* We'd like to disable session cache unconditionally, but foolish Outlook
2904 Express clients then give up the first TLS connection and make a second one
2905 (which works). Only when there is an IMAP service on the same machine.
2906 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2907 now, until we work out a decent way of presenting control to the config. It
2908 will never be used because we use a new context every time. */
2910 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2913 /* Initialize with DH parameters if supplied */
2914 /* Initialize ECDH temp key parameter selection */
2918 if (state->lib_state.dh)
2919 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2921 if (!init_dh(ctx, state->dhparam, errstr)) return DEFER;
2923 if (state->lib_state.ecdh)
2924 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
2926 if (!init_ecdh(ctx, errstr)) return DEFER;
2929 /* Set up certificate and key (and perhaps OCSP info) */
2931 if (state->lib_state.conn_certs)
2934 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
2938 #ifndef DISABLE_OCSP
2939 if (!host) /* server */
2941 state->u_ocsp.server.file = ocsp_file;
2942 state->u_ocsp.server.file_expanded = NULL;
2943 state->u_ocsp.server.olist = NULL;
2946 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
2949 /* If we need to handle SNI or OCSP, do so */
2951 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2952 # ifndef DISABLE_OCSP
2953 if (!host && !(state->u_ocsp.server.verify_stack = sk_X509_new_null()))
2955 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2960 if (!host) /* server */
2962 # ifndef DISABLE_OCSP
2963 /* We check u_ocsp.server.file, not server.olist, because we care about if
2964 the option exists, not what the current expansion might be, as SNI might
2965 change the certificate and OCSP file in use between now and the time the
2966 callback is invoked. */
2967 if (state->u_ocsp.server.file)
2969 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2970 SSL_CTX_set_tlsext_status_arg(ctx, state);
2973 /* We always do this, so that $tls_sni is available even if not used in
2975 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2976 SSL_CTX_set_tlsext_servername_arg(ctx, state);
2978 # ifdef EXIM_HAVE_ALPN
2979 if (tls_alpn && *tls_alpn)
2982 if ( expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr)
2983 && *exp_alpn && !isblank(*exp_alpn))
2985 tls_alpn = exp_alpn; /* subprocess so ok to overwrite */
2986 SSL_CTX_set_alpn_select_cb(ctx, tls_server_alpn_cb, state);
2993 # ifndef DISABLE_OCSP
2995 if(ocsp_file) /* wanting stapling */
2997 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
2999 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
3003 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
3004 SSL_CTX_set_tlsext_status_arg(ctx, state);
3007 #endif /*EXIM_HAVE_OPENSSL_TLSEXT*/
3009 state->verify_cert_hostnames = NULL;
3011 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
3012 /* Set up the RSA callback */
3013 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
3016 /* Finally, set the session cache timeout, and we are done.
3017 The period appears to be also used for (server-generated) session tickets */
3019 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
3020 DEBUG(D_tls) debug_printf("Initialized TLS\n");
3022 *caller_state = state;
3030 /*************************************************
3031 * Get name of cipher in use *
3032 *************************************************/
3035 Argument: pointer to an SSL structure for the connection
3036 pointer to number of bits for cipher
3037 Returns: pointer to allocated string in perm-pool
3041 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
3043 int pool = store_pool;
3044 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
3045 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
3046 the accessor functions use const in the prototype. */
3048 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
3051 SSL_CIPHER_get_bits(c, bits);
3053 store_pool = POOL_PERM;
3054 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
3056 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
3061 /* Get IETF-standard name for ciphersuite.
3062 Argument: pointer to an SSL structure for the connection
3063 Returns: pointer to string
3066 static const uschar *
3067 cipher_stdname_ssl(SSL * ssl)
3069 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
3070 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
3072 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
3073 return cipher_stdname(id >> 8, id & 0xff);
3078 static const uschar *
3079 tlsver_name(SSL * ssl)
3082 int pool = store_pool;
3084 store_pool = POOL_PERM;
3085 s = string_copy(US SSL_get_version(ssl));
3087 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
3088 for (;; p++) if (!(*p = p[1])) break;
3094 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
3096 /*XXX we might consider a list-of-certs variable for the cert chain.
3097 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
3098 in list-handling functions, also consider the difference between the entire
3099 chain and the elements sent by the peer. */
3101 tlsp->peerdn = NULL;
3103 /* Will have already noted peercert on a verify fail; possibly not the leaf */
3104 if (!tlsp->peercert)
3105 tlsp->peercert = SSL_get_peer_certificate(ssl);
3106 /* Beware anonymous ciphers which lead to server_cert being NULL */
3108 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
3109 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
3112 int oldpool = store_pool;
3114 peerdn[siz-1] = '\0'; /* paranoia */
3115 store_pool = POOL_PERM;
3116 tlsp->peerdn = string_copy(peerdn);
3117 store_pool = oldpool;
3119 /* We used to set CV in the cert-verify callbacks (either plain or dane)
3120 but they don't get called on session-resumption. So use the official
3121 interface, which uses the resumed value. Unfortunately this claims verified
3122 when it actually failed but we're in try-verify mode, due to us wanting the
3123 knowlege that it failed so needing to have the callback and forcing a
3124 permissive return. If we don't force it, the TLS startup is failed.
3125 The extra bit of information is set in verify_override in the cb, stashed
3126 for resumption next to the TLS session, and used here. */
3128 if (!tlsp->verify_override)
3129 tlsp->certificate_verified =
3131 tlsp->dane_verified ||
3133 SSL_get_verify_result(ssl) == X509_V_OK;
3141 /*************************************************
3142 * Set up for verifying certificates *
3143 *************************************************/
3145 #ifndef DISABLE_OCSP
3146 /* In the server, load certs from file, return TRUE on success */
3149 chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
3152 STACK_OF(X509) * verify_stack = *vp;
3155 while (sk_X509_num(verify_stack) > 0)
3156 X509_free(sk_X509_pop(verify_stack));
3158 verify_stack = sk_X509_new_null();
3160 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
3161 for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
3162 sk_X509_push(verify_stack, x);
3171 /* Called by both client and server startup; on the server possibly
3172 repeated after a Server Name Indication.
3175 sctx SSL_CTX* to initialise
3176 certsp certs file, returned expanded
3177 crl CRL file or NULL
3178 host NULL in a server; the remote host in a client
3179 errstr error string pointer
3181 Returns: OK/DEFER/FAIL
3185 setup_certs(SSL_CTX * sctx, uschar ** certsp, uschar * crl, host_item * host,
3188 uschar * expcerts, * expcrl;
3190 if (!expand_check(*certsp, US"tls_verify_certificates", &expcerts, errstr))
3192 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3195 if (expcerts && *expcerts)
3197 /* Tell the library to use its compiled-in location for the system default
3198 CA bundle. Then add the ones specified in the config, if any. */
3200 if (!SSL_CTX_set_default_verify_paths(sctx))
3201 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
3203 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
3205 struct stat statbuf;
3207 if (Ustat(expcerts, &statbuf) < 0)
3209 log_write(0, LOG_MAIN|LOG_PANIC,
3210 "failed to stat %s for certificates", expcerts);
3216 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
3217 { file = NULL; dir = expcerts; }
3220 STACK_OF(X509) * verify_stack =
3221 #ifndef DISABLE_OCSP
3222 !host ? state_server.u_ocsp.server.verify_stack :
3225 STACK_OF(X509) ** vp = &verify_stack;
3227 file = expcerts; dir = NULL;
3228 #ifndef DISABLE_OCSP
3229 /* In the server if we will be offering an OCSP proof; load chain from
3230 file for verifying the OCSP proof at load time. */
3232 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
3233 This is inconsistent with the need to verify the OCSP proof of the server cert.
3235 /* *debug_printf("file for checking server ocsp stapling is: %s\n", file); */
3237 && statbuf.st_size > 0
3238 && state_server.u_ocsp.server.file
3239 && !chain_from_pem_file(file, vp)
3242 log_write(0, LOG_MAIN|LOG_PANIC,
3243 "failed to load cert chain from %s", file);
3249 /* If a certificate file is empty, the load function fails with an
3250 unhelpful error message. If we skip it, we get the correct behaviour (no
3251 certificates are recognized, but the error message is still misleading (it
3252 says no certificate was supplied). But this is better. */
3254 if ( (!file || statbuf.st_size > 0)
3255 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
3256 return tls_error(US"SSL_CTX_load_verify_locations",
3257 host, NULL, errstr);
3259 /* On the server load the list of CAs for which we will accept certs, for
3260 sending to the client. This is only for the one-file
3261 tls_verify_certificates variant.
3262 If a list isn't loaded into the server, but some verify locations are set,
3263 the server end appears to make a wildcard request for client certs.
3264 Meanwhile, the client library as default behaviour *ignores* the list
3265 we send over the wire - see man SSL_CTX_set_client_cert_cb.
3266 Because of this, and that the dir variant is likely only used for
3267 the public-CA bundle (not for a private CA), not worth fixing. */
3271 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
3272 int i = sk_X509_NAME_num(names);
3274 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
3275 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
3276 i, i>1 ? "ies":"y");
3280 debug_printf("Added dir for additional certificate authorities\n");
3284 /* Handle a certificate revocation list. */
3286 #if OPENSSL_VERSION_NUMBER > 0x00907000L
3288 /* This bit of code is now the version supplied by Lars Mainka. (I have
3289 merely reformatted it into the Exim code style.)
3291 "From here I changed the code to add support for multiple crl's
3292 in pem format in one file or to support hashed directory entries in
3293 pem format instead of a file. This method now uses the library function
3294 X509_STORE_load_locations to add the CRL location to the SSL context.
3295 OpenSSL will then handle the verify against CA certs and CRLs by
3296 itself in the verify callback." */
3298 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
3299 if (expcrl && *expcrl)
3301 struct stat statbufcrl;
3302 if (Ustat(expcrl, &statbufcrl) < 0)
3304 log_write(0, LOG_MAIN|LOG_PANIC,
3305 "failed to stat %s for certificates revocation lists", expcrl);
3310 /* is it a file or directory? */
3312 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
3313 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
3317 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
3323 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
3325 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
3326 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
3328 /* setting the flags to check against the complete crl chain */
3330 X509_STORE_set_flags(cvstore,
3331 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
3335 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3344 tls_dump_keylog(SSL * ssl)
3346 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3347 BIO * bp = BIO_new(BIO_s_mem());
3350 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3351 len = (int) BIO_get_mem_data(bp, CSS &s);
3352 if (len > 0) debug_printf("%.*s", len, s);
3358 /* Channel-binding info for authenticators
3359 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/
3364 tls_get_channel_binding(SSL * ssl, tls_support * tlsp, const void * taintval)
3369 #ifdef EXIM_HAVE_EXPORT_CHNL_BNGNG
3370 if (SSL_version(ssl) > TLS1_2_VERSION)
3372 /* It's not documented by OpenSSL how big the output buffer must be.
3373 The OpenSSL testcases use 80 bytes but don't say why. The GnuTLS impl only
3374 serves out 32B. RFC 9266 says it is 32B.
3375 Interop fails unless we use the same each end. */
3378 tlsp->channelbind_exporter = TRUE;
3379 taintval = GET_UNTAINTED;
3380 if (SSL_export_keying_material(ssl,
3381 s = store_get((int)len, taintval), len,
3382 "EXPORTER-Channel-Binding", (size_t) 24,
3389 len = SSL_get_peer_finished(ssl, &c, 0);
3390 len = SSL_get_peer_finished(ssl, s = store_get((int)len, taintval), len);
3395 int old_pool = store_pool;
3396 store_pool = POOL_PERM;
3397 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, taintval);
3398 store_pool = old_pool;
3399 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
3404 /*************************************************
3405 * Start a TLS session in a server *
3406 *************************************************/
3407 /* This is called when Exim is running as a server, after having received
3408 the STARTTLS command. It must respond to that command, and then negotiate
3412 errstr pointer to error message
3414 Returns: OK on success
3415 DEFER for errors before the start of the negotiation
3416 FAIL for errors during the negotiation; the server can't
3421 tls_server_start(uschar ** errstr)
3424 uschar * expciphers;
3425 exim_openssl_state_st * dummy_statep;
3428 static uschar peerdn[256];
3430 /* Check for previous activation */
3432 if (tls_in.active.sock >= 0)
3434 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3435 smtp_printf("554 Already in TLS\r\n", FALSE);
3439 /* Initialize the SSL library. If it fails, it will already have logged
3442 rc = tls_init(NULL, NULL,
3443 #ifndef DISABLE_OCSP
3446 NULL, &dummy_statep, &tls_in, errstr);
3447 if (rc != OK) return rc;
3448 ctx = state_server.lib_state.lib_ctx;
3450 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3451 were historically separated by underscores. So that I can use either form in my
3452 tests, and also for general convenience, we turn underscores into hyphens here.
3454 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3455 for TLS 1.3 . Since we do not call it at present we get the default list:
3456 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3459 if (state_server.lib_state.pri_string)
3460 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3463 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3468 normalise_ciphers(&expciphers, tls_require_ciphers);
3469 if ((rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3474 /* If this is a host for which certificate verification is mandatory or
3475 optional, set up appropriately. */
3477 tls_in.certificate_verified = FALSE;
3479 tls_in.dane_verified = FALSE;
3481 server_verify_callback_called = FALSE;
3483 if (verify_check_host(&tls_verify_hosts) == OK)
3484 server_verify_optional = FALSE;
3485 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3486 server_verify_optional = TRUE;
3491 uschar * v_certs = tls_verify_certificates;
3493 if (state_server.lib_state.cabundle)
3495 DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n");
3496 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3500 if ((rc = setup_certs(ctx, &v_certs, tls_crl, NULL, errstr)) != OK)
3502 if (v_certs && *v_certs)
3503 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3508 #ifndef DISABLE_TLS_RESUME
3509 # if OPENSSL_VERSION_NUMBER < 0x30000000L
3510 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3511 /* despite working, appears to always return failure, so ignoring */
3513 SSL_CTX_set_tlsext_ticket_key_evp_cb(ctx, ticket_key_callback);
3514 /* despite working, appears to always return failure, so ignoring */
3518 #ifdef OPENSSL_HAVE_NUM_TICKETS
3519 # ifndef DISABLE_TLS_RESUME
3520 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3522 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3527 /* Prepare for new connection */
3529 if (!(ssl = SSL_new(ctx)))
3530 return tls_error(US"SSL_new", NULL, NULL, errstr);
3531 state_server.lib_state.lib_ssl = ssl;
3533 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3535 * With the SSL_clear(), we get strange interoperability bugs with
3536 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3537 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3539 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3540 * session shutdown. In this case, we have a brand new object and there's no
3541 * obvious reason to immediately clear it. I'm guessing that this was
3542 * originally added because of incomplete initialisation which the clear fixed,
3543 * in some historic release.
3546 /* Set context and tell client to go ahead, except in the case of TLS startup
3547 on connection, where outputting anything now upsets the clients and tends to
3548 make them disconnect. We need to have an explicit fflush() here, to force out
3549 the response. Other smtp_printf() calls do not need it, because in non-TLS
3550 mode, the fflush() happens when smtp_getc() is called. */
3552 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3553 if (!tls_in.on_connect)
3555 smtp_printf("220 TLS go ahead\r\n", FALSE);
3559 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3560 that the OpenSSL library doesn't. */
3562 SSL_set_wfd(ssl, fileno(smtp_out));
3563 SSL_set_rfd(ssl, fileno(smtp_in));
3564 SSL_set_accept_state(ssl);
3566 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3569 sigalrm_seen = FALSE;
3570 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3571 rc = SSL_accept(ssl);
3576 int error = SSL_get_error(ssl, rc);
3579 case SSL_ERROR_NONE:
3582 case SSL_ERROR_ZERO_RETURN:
3583 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3584 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3585 #ifndef DISABLE_EVENT
3586 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3588 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3591 tls_close(NULL, TLS_NO_SHUTDOWN);
3594 /* Handle genuine errors */
3598 int r = ERR_GET_REASON(ERR_peek_error());
3599 if ( r == SSL_R_WRONG_VERSION_NUMBER
3600 #ifdef SSL_R_VERSION_TOO_LOW
3601 || r == SSL_R_VERSION_TOO_LOW
3603 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3604 s = string_sprintf("(%s)", SSL_get_version(ssl));
3605 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
3606 #ifndef DISABLE_EVENT
3607 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3613 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3614 if (error == SSL_ERROR_SYSCALL)
3618 *errstr = US"SSL_accept: TCP connection closed by peer";
3619 #ifndef DISABLE_EVENT
3620 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3624 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3626 (void) tls_error(US"SSL_accept", NULL,
3627 sigalrm_seen ? US"timed out"
3628 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3630 #ifndef DISABLE_EVENT
3631 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3637 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3638 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3639 anon-authentication ciphersuite negotiated. */
3641 #ifndef DISABLE_TLS_RESUME
3642 if (SSL_session_reused(ssl))
3644 tls_in.resumption |= RESUME_USED;
3645 DEBUG(D_tls) debug_printf("Session reused\n");
3649 #ifdef EXIM_HAVE_ALPN
3650 /* If require-alpn, check server_seen_alpn here. Else abort TLS */
3651 if (!tls_alpn || !*tls_alpn)
3652 { DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n"); }
3653 else if (!server_seen_alpn)
3654 if (verify_check_host(&hosts_require_alpn) == OK)
3656 /* We'd like to send a definitive Alert but OpenSSL provides no facility */
3658 tls_error(US"handshake", NULL, US"ALPN required but not negotiated", errstr);
3662 { DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n"); }
3665 const uschar * name;
3667 SSL_get0_alpn_selected(ssl, &name, &len);
3669 debug_printf("ALPN negotiated: '%.*s'\n", (int)*name, name+1);
3671 debug_printf("ALPN: no protocol negotiated\n");
3676 /* TLS has been set up. Record data for the connection,
3677 adjust the input functions to read via TLS, and initialize things. */
3679 #ifdef SSL_get_extms_support
3680 /*XXX what does this return for tls1.3 ? */
3681 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3683 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3685 tls_in.ver = tlsver_name(ssl);
3686 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3687 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3692 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3693 debug_printf("Shared ciphers: %s\n", buf);
3695 tls_dump_keylog(ssl);
3697 #ifdef EXIM_HAVE_SESSION_TICKET
3699 SSL_SESSION * ss = SSL_get_session(ssl);
3700 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3701 debug_printf("The session has a ticket, life %lu seconds\n",
3702 SSL_SESSION_get_ticket_lifetime_hint(ss));
3707 /* Record the certificate we presented */
3709 X509 * crt = SSL_get_certificate(ssl);
3710 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3713 tls_get_channel_binding(ssl, &tls_in, GET_UNTAINTED);
3715 /* Only used by the server-side tls (tls_in), including tls_getc.
3716 Client-side (tls_out) reads (seem to?) go via
3717 smtp_read_response()/ip_recv().
3718 Hence no need to duplicate for _in and _out.
3720 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3721 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3722 ssl_xfer_eof = ssl_xfer_error = FALSE;
3724 receive_getc = tls_getc;
3725 receive_getbuf = tls_getbuf;
3726 receive_get_cache = tls_get_cache;
3727 receive_hasc = tls_hasc;
3728 receive_ungetc = tls_ungetc;
3729 receive_feof = tls_feof;
3730 receive_ferror = tls_ferror;
3732 tls_in.active.sock = fileno(smtp_out);
3733 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3741 tls_client_basic_ctx_init(SSL_CTX * ctx,
3742 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3747 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3748 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3749 host patterns if one of them is set with content. */
3751 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3752 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3754 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3755 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3758 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3760 client_verify_optional = FALSE;
3761 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3762 client_verify_optional = TRUE;
3767 uschar * v_certs = ob->tls_verify_certificates;
3769 if (state->lib_state.cabundle)
3771 DEBUG(D_tls) debug_printf("TLS: CA bundle for tpt was preloaded\n");
3772 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3776 if ((rc = setup_certs(ctx, &v_certs, ob->tls_crl, host, errstr)) != OK)
3778 if (v_certs && *v_certs)
3779 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3783 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3785 state->verify_cert_hostnames =
3787 string_domain_utf8_to_alabel(host->certname, NULL);
3791 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3792 state->verify_cert_hostnames);
3800 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3803 const char * hostnames[2] = { CS host->name, NULL };
3806 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3807 return tls_error(US"hostnames load", host, NULL, errstr);
3809 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3810 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3811 ) if (rr->type == T_TLSA && rr->size > 3)
3813 const uschar * p = rr->data;
3814 uint8_t usage, selector, mtype;
3815 const char * mdname;
3819 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3820 if (usage != 2 && usage != 3) continue;
3827 default: continue; /* Only match-types 0, 1, 2 are supported */
3828 case 0: mdname = NULL; break;
3829 case 1: mdname = "sha256"; break;
3830 case 2: mdname = "sha512"; break;
3834 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3837 return tls_error(US"tlsa load", host, NULL, errstr);
3838 case 0: /* action not taken */
3842 tls_out.tlsa_usage |= 1<<usage;
3848 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3851 #endif /*SUPPORT_DANE*/
3855 #ifndef DISABLE_TLS_RESUME
3856 /* On the client, get any stashed session for the given IP from hints db
3857 and apply it to the ssl-connection for attempted resumption. */
3860 tls_retrieve_session(tls_support * tlsp, SSL * ssl)
3862 if (tlsp->host_resumable)
3864 dbdata_tls_session * dt;
3866 open_db dbblock, * dbm_file;
3868 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3870 debug_printf("checking for resumable session for %s\n", tlsp->resume_index);
3871 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3873 if ((dt = dbfn_read_with_length(dbm_file, tlsp->resume_index, &len)))
3875 SSL_SESSION * ss = NULL;
3876 const uschar * sess_asn1 = dt->session;
3878 len -= sizeof(dbdata_tls_session);
3879 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3883 ERR_error_string_n(ERR_get_error(),
3884 ssl_errstring, sizeof(ssl_errstring));
3885 debug_printf("decoding session: %s\n", ssl_errstring);
3890 unsigned long lifetime =
3891 #ifdef EXIM_HAVE_SESSION_TICKET
3892 SSL_SESSION_get_ticket_lifetime_hint(ss);
3893 #else /* Use, fairly arbitrilarily, what we as server would */
3894 f.running_in_test_harness ? 6 : ssl_session_timeout;
3896 if (lifetime + dt->time_stamp < time(NULL))
3898 DEBUG(D_tls) debug_printf("session expired\n");
3899 dbfn_delete(dbm_file, tlsp->resume_index);
3901 else if (SSL_set_session(ssl, ss))
3903 DEBUG(D_tls) debug_printf("good session\n");
3904 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3905 tlsp->verify_override = dt->verify_override;
3906 tlsp->ocsp = dt->ocsp;
3910 ERR_error_string_n(ERR_get_error(),
3911 ssl_errstring, sizeof(ssl_errstring));
3912 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3917 DEBUG(D_tls) debug_printf("no session record\n");
3918 dbfn_close(dbm_file);
3924 /* On the client, save the session for later resumption */
3927 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3929 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3932 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3934 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3936 # ifdef OPENSSL_HAVE_NUM_TICKETS
3937 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3940 int len = i2d_SSL_SESSION(ss, NULL);
3941 int dlen = sizeof(dbdata_tls_session) + len;
3942 dbdata_tls_session * dt = store_get(dlen, GET_TAINTED);
3943 uschar * s = dt->session;
3944 open_db dbblock, * dbm_file;
3946 DEBUG(D_tls) debug_printf("session is resumable\n");
3947 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3949 dt->verify_override = tlsp->verify_override;
3950 dt->ocsp = tlsp->ocsp;
3951 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3953 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3955 dbfn_write(dbm_file, tlsp->resume_index, dt, dlen);
3956 dbfn_close(dbm_file);
3957 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3965 /* Construct a key for session DB lookup, and setup the SSL_CTX for resumption */
3968 tls_client_ctx_resume_prehandshake(
3969 exim_openssl_client_tls_ctx * exim_client_ctx, smtp_connect_args * conn_args,
3970 tls_support * tlsp, smtp_transport_options_block * ob)
3972 tlsp->host_resumable = TRUE;
3973 tls_client_resmption_key(tlsp, conn_args, ob);
3975 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3976 SSL_SESS_CACHE_CLIENT
3977 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3978 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3982 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3983 host_item * host, uschar ** errstr)
3985 if (tlsp->host_resumable)
3988 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3989 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3991 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3992 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
3994 tls_error(US"set ex_data", host, NULL, errstr);
3997 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state);
4000 tlsp->resumption = RESUME_SUPPORTED;
4001 /* Pick up a previous session, saved on an old ticket */
4002 tls_retrieve_session(tlsp, ssl);
4007 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
4010 if (SSL_session_reused(exim_client_ctx->ssl))
4012 DEBUG(D_tls) debug_printf("The session was reused\n");
4013 tlsp->resumption |= RESUME_USED;
4016 #endif /* !DISABLE_TLS_RESUME */
4019 #ifdef EXIM_HAVE_ALPN
4020 /* Expand and convert an Exim list to an ALPN list. False return for fail.
4021 NULL plist return for silent no-ALPN.
4023 Overwite the passed-in list with the expanded version.
4027 tls_alpn_plist(uschar ** tls_alpn, const uschar ** plist, unsigned * plen,
4032 if (!expand_check(*tls_alpn, US"tls_alpn", &exp_alpn, errstr))
4034 *tls_alpn = exp_alpn;
4038 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
4043 /* The server implementation only accepts exactly one protocol name
4044 but it's little extra code complexity in the client. */
4046 const uschar * list = exp_alpn;
4047 uschar * p = store_get(Ustrlen(exp_alpn), exp_alpn), * s, * t;
4051 for (t = p; s = string_nextinlist(&list, &sep, NULL, 0); t += len)
4053 *t++ = len = (uschar) Ustrlen(s);
4056 *plist = (*plen = t - p) ? p : NULL;
4060 #endif /* EXIM_HAVE_ALPN */
4063 /*************************************************
4064 * Start a TLS session in a client *
4065 *************************************************/
4067 /* Called from the smtp transport after STARTTLS has been accepted.
4070 cctx connection context
4071 conn_args connection details
4072 cookie datum for randomness; can be NULL
4073 tlsp record details of TLS channel configuration here; must be non-NULL
4074 errstr error string pointer
4076 Returns: TRUE for success with TLS session context set in connection context,
4081 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
4082 void * cookie, tls_support * tlsp, uschar ** errstr)
4084 host_item * host = conn_args->host; /* for msgs and option-tests */
4085 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
4086 smtp_transport_options_block * ob = tb
4087 ? (smtp_transport_options_block *)tb->options_block
4088 : &smtp_transport_option_defaults;
4089 exim_openssl_client_tls_ctx * exim_client_ctx;
4090 uschar * expciphers;
4092 static uschar peerdn[256];
4094 #ifndef DISABLE_OCSP
4095 BOOL request_ocsp = FALSE;
4096 BOOL require_ocsp = FALSE;
4100 store_pool = POOL_PERM;
4101 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), GET_UNTAINTED);
4102 exim_client_ctx->corked = NULL;
4106 tlsp->tlsa_usage = 0;
4109 #ifndef DISABLE_OCSP
4111 # ifdef SUPPORT_DANE
4112 if ( conn_args->dane
4113 && ob->hosts_request_ocsp[0] == '*'
4114 && ob->hosts_request_ocsp[1] == '\0'
4117 /* Unchanged from default. Use a safer one under DANE */
4118 request_ocsp = TRUE;
4119 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
4120 " {= {4}{$tls_out_tlsa_usage}} } "
4126 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
4127 request_ocsp = TRUE;
4129 # ifdef SUPPORT_DANE
4133 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4135 # if defined(SUPPORT_DANE) && !defined(EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER)
4136 if (conn_args->dane && (require_ocsp || request_ocsp))
4138 DEBUG(D_tls) debug_printf("OpenSSL version to early to combine OCSP"
4139 " and DANE; disabling OCSP\n");
4140 require_ocsp = request_ocsp = FALSE;
4146 rc = tls_init(host, ob,
4147 #ifndef DISABLE_OCSP
4148 (void *)(long)request_ocsp,
4150 cookie, &client_static_state, tlsp, errstr);
4151 if (rc != OK) return FALSE;
4153 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
4155 tlsp->certificate_verified = FALSE;
4156 client_verify_callback_called = FALSE;
4160 if (conn_args->dane)
4162 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
4163 other failures should be treated as problems. */
4164 if (ob->dane_require_tls_ciphers &&
4165 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
4166 &expciphers, errstr))
4168 if (expciphers && *expciphers == '\0')
4171 normalise_ciphers(&expciphers, ob->dane_require_tls_ciphers);
4176 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
4177 &expciphers, errstr))
4180 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
4181 are separated by underscores. So that I can use either form in my tests, and
4182 also for general convenience, we turn underscores into hyphens here. */
4184 normalise_ciphers(&expciphers, ob->tls_require_ciphers);
4189 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
4190 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
4192 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
4198 if (conn_args->dane)
4200 SSL_CTX_set_verify(exim_client_ctx->ctx,
4201 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
4202 verify_callback_client_dane);
4204 if (!DANESSL_library_init())
4206 tls_error(US"library init", host, NULL, errstr);
4209 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
4211 tls_error(US"context init", host, NULL, errstr);
4214 DEBUG(D_tls) debug_printf("since dane-mode conn, not loading the usual CA bundle\n");
4220 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
4221 client_static_state, errstr) != OK)
4226 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
4229 { DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n"); }
4230 else if (!Ustrlen(tlsp->sni))
4234 #ifndef EXIM_HAVE_OPENSSL_TLSEXT
4235 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
4243 #ifdef EXIM_HAVE_ALPN
4245 const uschar * plist;
4248 if (!tls_alpn_plist(&ob->tls_alpn, &plist, &plen, errstr))
4251 if (SSL_CTX_set_alpn_protos(exim_client_ctx->ctx, plist, plen) != 0)
4253 tls_error(US"alpn init", host, NULL, errstr);
4257 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
4260 log_write(0, LOG_MAIN, "ALPN unusable with this OpenSSL library version; ignoring \"%s\"\n",
4264 #ifndef DISABLE_TLS_RESUME
4265 /*XXX have_lbserver: another cmdline arg possibly, for continued-conn, but use
4266 will be very low. */
4268 if (!conn_args->have_lbserver) /* wanted for tls_client_resmption_key() */
4269 { DEBUG(D_tls) debug_printf("resumption not supported on continued-connection\n"); }
4270 else if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
4271 tls_client_ctx_resume_prehandshake(exim_client_ctx, conn_args, tlsp, ob);
4275 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
4277 tls_error(US"SSL_new", host, NULL, errstr);
4280 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
4281 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
4282 SSL_set_connect_state(exim_client_ctx->ssl);
4284 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
4287 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
4288 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
4293 if (conn_args->dane)
4294 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
4298 #ifndef DISABLE_OCSP
4299 /* Request certificate status at connection-time. If the server
4300 does OCSP stapling we will get the callback (set in tls_init()) */
4301 # ifdef SUPPORT_DANE
4305 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4306 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4308 { /* Re-eval now $tls_out_tlsa_usage is populated. If
4309 this means we avoid the OCSP request, we wasted the setup
4310 cost in tls_init(). */
4311 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
4312 request_ocsp = require_ocsp
4313 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4320 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
4321 client_static_state->u_ocsp.client.verify_required = require_ocsp;
4322 tlsp->ocsp = OCSP_NOT_RESP;
4326 #ifndef DISABLE_TLS_RESUME
4327 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
4332 #ifndef DISABLE_EVENT
4333 client_static_state->event_action = tb ? tb->event_action : NULL;
4336 /* There doesn't seem to be a built-in timeout on connection. */
4338 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
4339 sigalrm_seen = FALSE;
4340 ALARM(ob->command_timeout);
4341 rc = SSL_connect(exim_client_ctx->ssl);
4345 if (conn_args->dane)
4346 DANESSL_cleanup(exim_client_ctx->ssl);
4351 #ifndef DISABLE_OCSP
4352 if (client_static_state->u_ocsp.client.verify_errstr)
4353 { if (errstr) *errstr = client_static_state->u_ocsp.client.verify_errstr; }
4356 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
4362 debug_printf("SSL_connect succeeded\n");
4363 tls_dump_keylog(exim_client_ctx->ssl);
4366 #ifndef DISABLE_TLS_RESUME
4367 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
4370 #ifdef EXIM_HAVE_ALPN
4371 if (ob->tls_alpn) /* We requested. See what was negotiated. */
4373 const uschar * name;
4376 SSL_get0_alpn_selected(exim_client_ctx->ssl, &name, &len);
4378 { DEBUG(D_tls) debug_printf("ALPN negotiated %u: '%.*s'\n", len, (int)*name, name+1); }
4379 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
4381 /* Would like to send a relevant fatal Alert, but OpenSSL has no API */
4382 tls_error(US"handshake", host, US"ALPN required but not negotiated", errstr);
4388 #ifdef SSL_get_extms_support
4389 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
4391 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
4393 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
4394 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
4395 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
4397 /* Record the certificate we presented */
4399 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
4400 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
4403 /*XXX will this work with continued-TLS? */
4404 tls_get_channel_binding(exim_client_ctx->ssl, tlsp, GET_TAINTED);
4406 tlsp->active.sock = cctx->sock;
4407 tlsp->active.tls_ctx = exim_client_ctx;
4408 cctx->tls_ctx = exim_client_ctx;
4417 tls_refill(unsigned lim)
4419 SSL * ssl = state_server.lib_state.lib_ssl;
4423 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4424 ssl_xfer_buffer, ssl_xfer_buffer_size);
4427 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4428 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
4429 MIN(ssl_xfer_buffer_size, lim));
4430 error = SSL_get_error(ssl, inbytes);
4431 if (smtp_receive_timeout > 0) ALARM_CLR(0);
4433 if (had_command_timeout) /* set by signal handler */
4434 smtp_command_timeout_exit(); /* does not return */
4435 if (had_command_sigterm)
4436 smtp_command_sigterm_exit();
4437 if (had_data_timeout)
4438 smtp_data_timeout_exit();
4439 if (had_data_sigint)
4440 smtp_data_sigint_exit();
4442 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
4443 closed down, not that the socket itself has been closed down. Revert to
4444 non-SSL handling. */
4448 case SSL_ERROR_NONE:
4451 case SSL_ERROR_ZERO_RETURN:
4452 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4454 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
4457 tls_close(NULL, TLS_NO_SHUTDOWN);
4460 /* Handle genuine errors */
4462 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4463 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
4464 ssl_xfer_error = TRUE;
4468 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
4469 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
4470 debug_printf(" - syscall %s\n", strerror(errno));
4471 ssl_xfer_error = TRUE;
4475 #ifndef DISABLE_DKIM
4476 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
4478 ssl_xfer_buffer_hwm = inbytes;
4479 ssl_xfer_buffer_lwm = 0;
4484 /*************************************************
4485 * TLS version of getc *
4486 *************************************************/
4488 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
4489 it refills the buffer via the SSL reading function.
4491 Arguments: lim Maximum amount to read/buffer
4492 Returns: the next character or EOF
4494 Only used by the server-side TLS.
4498 tls_getc(unsigned lim)
4500 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4501 if (!tls_refill(lim))
4502 return ssl_xfer_error ? EOF : smtp_getc(lim);
4504 /* Something in the buffer; return next uschar */
4506 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
4512 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm;
4516 tls_getbuf(unsigned * len)
4521 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4522 if (!tls_refill(*len))
4524 if (!ssl_xfer_error) return smtp_getbuf(len);
4529 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4531 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4532 ssl_xfer_buffer_lwm += size;
4539 tls_get_cache(unsigned lim)
4541 #ifndef DISABLE_DKIM
4542 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4546 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4552 tls_could_getc(void)
4554 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4555 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4559 /*************************************************
4560 * Read bytes from TLS channel *
4561 *************************************************/
4565 ct_ctx client context pointer, or NULL for the one global server context
4569 Returns: the number of bytes read
4570 -1 after a failed read, including EOF
4572 Only used by the client-side TLS.
4576 tls_read(void * ct_ctx, uschar *buff, size_t len)
4578 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4579 : state_server.lib_state.lib_ssl;
4583 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4584 buff, (unsigned int)len);
4587 inbytes = SSL_read(ssl, CS buff, len);
4588 error = SSL_get_error(ssl, inbytes);
4590 if (error == SSL_ERROR_ZERO_RETURN)
4592 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4595 else if (error != SSL_ERROR_NONE)
4605 /*************************************************
4606 * Write bytes down TLS channel *
4607 *************************************************/
4611 ct_ctx client context pointer, or NULL for the one global server context
4614 more further data expected soon
4616 Returns: the number of bytes after a successful write,
4617 -1 after a failed write
4619 Used by both server-side and client-side TLS. Calling with len zero and more unset
4620 will flush buffered writes; buff can be null for this case.
4624 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4627 int outbytes, error;
4629 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4630 : state_server.lib_state.lib_ssl;
4631 static gstring * server_corked = NULL;
4632 gstring ** corkedp = ct_ctx
4633 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4634 gstring * corked = *corkedp;
4636 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4637 buff, (unsigned long)len, more ? ", more" : "");
4639 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4640 "more" is notified. This hack is only ok if small amounts are involved AND only
4641 one stream does it, in one context (i.e. no store reset). Currently it is used
4642 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4643 We support callouts done by the server process by using a separate client
4644 context for the stashed information. */
4645 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4646 a store reset there, so use POOL_PERM. */
4647 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4651 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4653 int save_pool = store_pool;
4654 store_pool = POOL_PERM;
4656 corked = string_catn(corked, buff, len);
4658 store_pool = save_pool;
4665 buff = CUS corked->s;
4670 for (int left = len; left > 0;)
4672 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4674 outbytes = SSL_write(ssl, CS buff, left);
4675 error = SSL_get_error(ssl, outbytes);
4676 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4679 case SSL_ERROR_NONE: /* the usual case */
4685 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4686 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4689 case SSL_ERROR_ZERO_RETURN:
4690 log_write(0, LOG_MAIN, "SSL channel closed on write");
4693 case SSL_ERROR_SYSCALL:
4694 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4695 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4696 sender_fullhost ? sender_fullhost : US"<unknown>",
4698 else if (LOGGING(protocol_detail))
4699 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4700 " SMTP response and TLS close\n", sender_host_address);
4702 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4703 " client reset TCP before TLS close\n", sender_host_address);
4707 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4718 ct_ctx client TLS context pointer, or NULL for the one global server context
4722 tls_shutdown_wr(void * ct_ctx)
4724 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4725 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4726 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4729 if (*fdp < 0) return; /* TLS was not active */
4731 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4733 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
4734 rc = SSL_shutdown(*sslp);
4735 if (rc < 0) DEBUG(D_tls)
4737 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4738 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4742 /*************************************************
4743 * Close down a TLS session *
4744 *************************************************/
4746 /* This is also called from within a delivery subprocess forked from the
4747 daemon, to shut down the TLS library, without actually doing a shutdown (which
4748 would tamper with the SSL session in the parent process).
4751 ct_ctx client TLS context pointer, or NULL for the one global server context
4752 do_shutdown 0 no data-flush or TLS close-alert
4753 1 if TLS close-alert is to be sent,
4754 2 if also response to be waited for
4758 Used by both server-side and client-side TLS.
4762 tls_close(void * ct_ctx, int do_shutdown)
4764 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4765 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4766 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4768 if (*fdp < 0) return; /* TLS was not active */
4770 if (do_shutdown > TLS_NO_SHUTDOWN)
4773 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4774 do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
4776 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4778 if ( ( do_shutdown >= TLS_SHUTDOWN_WONLY
4779 || (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4781 && do_shutdown > TLS_SHUTDOWN_NOWAIT
4784 #ifdef EXIM_TCP_CORK
4785 (void) setsockopt(*fdp, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
4788 rc = SSL_shutdown(*sslp); /* wait for response */
4792 if (rc < 0) DEBUG(D_tls)
4794 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4795 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4799 if (!o_ctx) /* server side */
4801 #ifndef DISABLE_OCSP
4802 sk_X509_pop_free(state_server.u_ocsp.server.verify_stack, X509_free);
4803 state_server.u_ocsp.server.verify_stack = NULL;
4806 receive_getc = smtp_getc;
4807 receive_getbuf = smtp_getbuf;
4808 receive_get_cache = smtp_get_cache;
4809 receive_hasc = smtp_hasc;
4810 receive_ungetc = smtp_ungetc;
4811 receive_feof = smtp_feof;
4812 receive_ferror = smtp_ferror;
4813 tls_in.active.tls_ctx = NULL;
4815 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4826 /*************************************************
4827 * Let tls_require_ciphers be checked at startup *
4828 *************************************************/
4830 /* The tls_require_ciphers option, if set, must be something which the
4833 Returns: NULL on success, or error message
4837 tls_validate_require_cipher(void)
4840 uschar * expciphers, * err;
4844 if (!(tls_require_ciphers && *tls_require_ciphers))
4847 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4849 return US"failed to expand tls_require_ciphers";
4851 if (!(expciphers && *expciphers))
4854 normalise_ciphers(&expciphers, tls_require_ciphers);
4857 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4860 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4862 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4864 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4865 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4866 expciphers, ssl_errstring);
4877 /*************************************************
4878 * Report the library versions. *
4879 *************************************************/
4881 /* There have historically been some issues with binary compatibility in
4882 OpenSSL libraries; if Exim (like many other applications) is built against
4883 one version of OpenSSL but the run-time linker picks up another version,
4884 it can result in serious failures, including crashing with a SIGSEGV. So
4885 report the version found by the compiler and the run-time version.
4887 Note: some OS vendors backport security fixes without changing the version
4888 number/string, and the version date remains unchanged. The _build_ date
4889 will change, so we can more usefully assist with version diagnosis by also
4890 reporting the build date.
4892 Arguments: string to append to
4897 tls_version_report(gstring * g)
4899 return string_fmt_append(g,
4900 "Library version: OpenSSL: Compile: %s\n"
4903 OPENSSL_VERSION_TEXT,
4904 SSLeay_version(SSLEAY_VERSION),
4905 SSLeay_version(SSLEAY_BUILT_ON));
4906 /* third line is 38 characters for the %s and the line is 73 chars long;
4907 the OpenSSL output includes a "built on: " prefix already. */
4913 /*************************************************
4914 * Random number generation *
4915 *************************************************/
4917 /* Pseudo-random number generation. The result is not expected to be
4918 cryptographically strong but not so weak that someone will shoot themselves
4919 in the foot using it as a nonce in input in some email header scheme or
4920 whatever weirdness they'll twist this into. The result should handle fork()
4921 and avoid repeating sequences. OpenSSL handles that for us.
4925 Returns a random number in range [0, max-1]
4929 vaguely_random_number(int max)
4933 static pid_t pidlast = 0;
4935 uschar smallbuf[sizeof(r)];
4941 if (pidnow != pidlast)
4943 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
4944 is unique for each thread", this doesn't apparently apply across processes,
4945 so our own warning from vaguely_random_number_fallback() applies here too.
4946 Fix per PostgreSQL. */
4952 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
4956 gettimeofday(&r.tv, NULL);
4959 RAND_seed(US (&r), sizeof(r));
4961 /* We're after pseudo-random, not random; if we still don't have enough data
4962 in the internal PRNG then our options are limited. We could sleep and hope
4963 for entropy to come along (prayer technique) but if the system is so depleted
4964 in the first place then something is likely to just keep taking it. Instead,
4965 we'll just take whatever little bit of pseudo-random we can still manage to
4968 needed_len = sizeof(r);
4969 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4970 asked for a number less than 10. */
4971 for (r = max, i = 0; r; ++i)
4977 #ifdef EXIM_HAVE_RAND_PSEUDO
4978 /* We do not care if crypto-strong */
4979 i = RAND_pseudo_bytes(smallbuf, needed_len);
4981 i = RAND_bytes(smallbuf, needed_len);
4987 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
4988 return vaguely_random_number_fallback(max);
4992 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4995 /* We don't particularly care about weighted results; if someone wants
4996 smooth distribution and cares enough then they should submit a patch then. */
5003 /*************************************************
5004 * OpenSSL option parse *
5005 *************************************************/
5007 /* Parse one option for tls_openssl_options_parse below
5010 name one option name
5011 value place to store a value for it
5012 Returns success or failure in parsing
5018 tls_openssl_one_option_parse(uschar *name, long *value)
5021 int last = exim_openssl_options_size;
5022 while (last > first)
5024 int middle = (first + last)/2;
5025 int c = Ustrcmp(name, exim_openssl_options[middle].name);
5028 *value = exim_openssl_options[middle].value;
5042 /*************************************************
5043 * OpenSSL option parsing logic *
5044 *************************************************/
5046 /* OpenSSL has a number of compatibility options which an administrator might
5047 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
5048 we look like log_selector.
5051 option_spec the administrator-supplied string of options
5052 results ptr to long storage for the options bitmap
5053 Returns success or failure
5057 tls_openssl_options_parse(uschar *option_spec, long *results)
5060 uschar * exp, * end;
5061 BOOL adding, item_parsed;
5063 /* Server: send no (<= TLS1.2) session tickets */
5064 result = SSL_OP_NO_TICKET;
5066 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
5067 from default because it increases BEAST susceptibility. */
5068 #ifdef SSL_OP_NO_SSLv2
5069 result |= SSL_OP_NO_SSLv2;
5071 #ifdef SSL_OP_NO_SSLv3
5072 result |= SSL_OP_NO_SSLv3;
5074 #ifdef SSL_OP_SINGLE_DH_USE
5075 result |= SSL_OP_SINGLE_DH_USE;
5077 #ifdef SSL_OP_NO_RENEGOTIATION
5078 result |= SSL_OP_NO_RENEGOTIATION;
5087 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
5090 for (uschar * s = exp; *s; /**/)
5092 while (isspace(*s)) ++s;
5095 if (*s != '+' && *s != '-')
5097 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
5098 "+ or - expected but found \"%s\"\n", s);
5101 adding = *s++ == '+';
5102 for (end = s; *end && !isspace(*end); ) end++;
5103 item_parsed = tls_openssl_one_option_parse(string_copyn(s, end-s), &item);
5106 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
5109 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
5110 adding ? "adding to " : "removing from", result, item, s);
5122 #endif /*!MACRO_PREDEF*/
5125 /* End of tls-openssl.c */