1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2019 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Portions Copyright (c) The OpenSSL Project 1999 */
11 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
12 library. It is #included into the tls.c file when that library is used. The
13 code herein is based on a patch that was originally contributed by Steve
14 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
16 No cryptographic code is included in Exim. All this module does is to call
17 functions from the OpenSSL library. */
22 #include <openssl/lhash.h>
23 #include <openssl/ssl.h>
24 #include <openssl/err.h>
25 #include <openssl/rand.h>
26 #ifndef OPENSSL_NO_ECDH
27 # include <openssl/ec.h>
30 # include <openssl/ocsp.h>
38 # define EXIM_OCSP_SKEW_SECONDS (300L)
39 # define EXIM_OCSP_MAX_AGE (-1L)
42 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
43 # define EXIM_HAVE_OPENSSL_TLSEXT
45 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
46 # define EXIM_HAVE_RSA_GENKEY_EX
48 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
49 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define OPENSSL_AUTO_SHA256
51 # define OPENSSL_MIN_PROTO_VERSION
53 # define EXIM_HAVE_EPHEM_RSA_KEX
54 # define EXIM_HAVE_RAND_PSEUDO
56 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
57 # define EXIM_HAVE_SHA256
60 /* X509_check_host provides sane certificate hostname checking, but was added
61 to OpenSSL late, after other projects forked off the code-base. So in
62 addition to guarding against the base version number, beware that LibreSSL
63 does not (at this time) support this function.
65 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
66 opt to disentangle and ask a LibreSSL user to provide glue for a third
67 crypto provider for libtls instead of continuing to tie the OpenSSL glue
68 into even twistier knots. If LibreSSL gains the same API, we can just
69 change this guard and punt the issue for a while longer. */
71 #ifndef LIBRESSL_VERSION_NUMBER
72 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
73 # define EXIM_HAVE_OPENSSL_CHECKHOST
74 # define EXIM_HAVE_OPENSSL_DH_BITS
75 # define EXIM_HAVE_OPENSSL_TLS_METHOD
76 # define EXIM_HAVE_OPENSSL_KEYLOG
77 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
78 # define EXIM_HAVE_SESSION_TICKET
79 # define EXIM_HAVE_OPESSL_TRACE
80 # define EXIM_HAVE_OPESSL_GET0_SERIAL
82 # define EXIM_HAVE_OCSP
84 # define EXIM_HAVE_ALPN /* fail ret from hshake-cb is ignored by LibreSSL */
86 # define EXIM_NEED_OPENSSL_INIT
88 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
89 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
90 # define EXIM_HAVE_OPENSSL_CHECKHOST
94 #if LIBRESSL_VERSION_NUMBER >= 0x3040000fL
95 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
98 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x030000000L)
99 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
102 #if !defined(LIBRESSL_VERSION_NUMBER) \
103 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
104 # if !defined(OPENSSL_NO_ECDH)
105 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
106 # define EXIM_HAVE_ECDH
108 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
109 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
114 #ifndef LIBRESSL_VERSION_NUMBER
115 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
116 # define OPENSSL_HAVE_KEYLOG_CB
117 # define OPENSSL_HAVE_NUM_TICKETS
118 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
119 # define EXIM_HAVE_EXP_CHNL_BNGNG
121 # define OPENSSL_BAD_SRVR_OURCERT
125 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x010002000L)
126 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
129 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
130 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
131 # define DISABLE_OCSP
134 #ifndef DISABLE_TLS_RESUME
135 # if OPENSSL_VERSION_NUMBER < 0x0101010L
136 # error OpenSSL version too old for session-resumption
140 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
141 # include <openssl/x509v3.h>
144 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
145 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
146 # define SSL_CIPHER_get_id(c) (c->id)
148 # ifndef MACRO_PREDEF
149 # include "tls-cipher-stdname.c"
153 /*************************************************
154 * OpenSSL option parse *
155 *************************************************/
157 typedef struct exim_openssl_option {
160 } exim_openssl_option;
161 /* We could use a macro to expand, but we need the ifdef and not all the
162 options document which version they were introduced in. Policylet: include
163 all options unless explicitly for DTLS, let the administrator choose which
166 This list is current as of:
169 XXX could we autobuild this list, as with predefined-macros?
170 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
171 Also allow a numeric literal?
173 static exim_openssl_option exim_openssl_options[] = {
174 /* KEEP SORTED ALPHABETICALLY! */
176 { US"all", (long) SSL_OP_ALL },
178 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
179 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
181 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
182 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
184 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
185 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
187 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
188 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
190 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
191 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
193 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
194 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
196 #ifdef SSL_OP_EPHEMERAL_RSA
197 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
199 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
200 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
202 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
203 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
205 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
206 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
208 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
209 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
211 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
212 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
214 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
215 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
217 #ifdef SSL_OP_NO_ANTI_REPLAY
218 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
220 #ifdef SSL_OP_NO_COMPRESSION
221 { US"no_compression", SSL_OP_NO_COMPRESSION },
223 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
224 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
226 #ifdef SSL_OP_NO_RENEGOTIATION
227 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
229 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
230 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
232 #ifdef SSL_OP_NO_SSLv2
233 { US"no_sslv2", SSL_OP_NO_SSLv2 },
235 #ifdef SSL_OP_NO_SSLv3
236 { US"no_sslv3", SSL_OP_NO_SSLv3 },
238 #ifdef SSL_OP_NO_TICKET
239 { US"no_ticket", SSL_OP_NO_TICKET },
241 #ifdef SSL_OP_NO_TLSv1
242 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
244 #ifdef SSL_OP_NO_TLSv1_1
245 # if OPENSSL_VERSION_NUMBER < 0x30000000L
246 # if SSL_OP_NO_TLSv1_1 == 0x00000400L
247 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
248 # warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
249 # define NO_SSL_OP_NO_TLSv1_1
252 # ifndef NO_SSL_OP_NO_TLSv1_1
253 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
256 #ifdef SSL_OP_NO_TLSv1_2
257 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
259 #ifdef SSL_OP_NO_TLSv1_3
260 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
262 #ifdef SSL_OP_PRIORITIZE_CHACHA
263 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
265 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
266 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
268 #ifdef SSL_OP_SINGLE_DH_USE
269 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
271 #ifdef SSL_OP_SINGLE_ECDH_USE
272 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
274 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
275 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
277 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
278 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
280 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
281 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
283 #ifdef SSL_OP_TLS_D5_BUG
284 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
286 #ifdef SSL_OP_TLS_ROLLBACK_BUG
287 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
289 #ifdef SSL_OP_TLSEXT_PADDING
290 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
295 static int exim_openssl_options_size = nelem(exim_openssl_options);
296 static long init_options = 0;
305 for (struct exim_openssl_option * o = exim_openssl_options;
306 o < exim_openssl_options + nelem(exim_openssl_options); o++)
308 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
309 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
311 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
312 builtin_macro_create(buf);
315 # ifndef DISABLE_TLS_RESUME
316 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
318 # ifdef SSL_OP_NO_TLSv1_3
319 builtin_macro_create(US"_HAVE_TLS1_3");
321 # ifdef OPENSSL_BAD_SRVR_OURCERT
322 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
324 # ifdef EXIM_HAVE_OCSP
325 builtin_macro_create(US"_HAVE_TLS_OCSP");
326 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
328 # ifdef EXIM_HAVE_ALPN
329 builtin_macro_create(US"_HAVE_TLS_ALPN");
334 /******************************************************************************/
336 /* Structure for collecting random data for seeding. */
338 typedef struct randstuff {
343 /* Local static variables */
345 static BOOL client_verify_callback_called = FALSE;
346 static BOOL server_verify_callback_called = FALSE;
347 static const uschar *sid_ctx = US"exim";
349 /* We have three different contexts to care about.
351 Simple case: client, `client_ctx`
352 As a client, we can be doing a callout or cut-through delivery while receiving
353 a message. So we have a client context, which should have options initialised
354 from the SMTP Transport. We may also concurrently want to make TLS connections
355 to utility daemons, so client-contexts are allocated and passed around in call
356 args rather than using a gobal.
359 There are two cases: with and without ServerNameIndication from the client.
360 Given TLS SNI, we can be using different keys, certs and various other
361 configuration settings, because they're re-expanded with $tls_sni set. This
362 allows vhosting with TLS. This SNI is sent in the handshake.
363 A client might not send SNI, so we need a fallback, and an initial setup too.
364 So as a server, we start out using `server_ctx`.
365 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
366 `server_sni` from `server_ctx` and then initialise settings by re-expanding
374 } exim_openssl_client_tls_ctx;
377 /* static SSL_CTX *server_ctx = NULL; */
378 /* static SSL *server_ssl = NULL; */
380 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
381 static SSL_CTX *server_sni = NULL;
383 #ifdef EXIM_HAVE_ALPN
384 static BOOL server_seen_alpn = FALSE;
387 static char ssl_errstring[256];
389 static int ssl_session_timeout = 7200; /* Two hours */
390 static BOOL client_verify_optional = FALSE;
391 static BOOL server_verify_optional = FALSE;
393 static BOOL reexpand_tls_files_for_sni = FALSE;
396 typedef struct ocsp_resp {
397 struct ocsp_resp * next;
398 OCSP_RESPONSE * resp;
401 typedef struct exim_openssl_state {
402 exim_tlslib_state lib_state;
403 #define lib_ctx libdata0
404 #define lib_ssl libdata1
407 uschar * certificate;
411 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
415 const uschar *file_expanded;
416 ocsp_resplist *olist;
419 X509_STORE *verify_store; /* non-null if status requested */
420 BOOL verify_required;
425 /* these are cached from first expand */
426 uschar * server_cipher_list;
427 /* only passed down to tls_error: */
429 const uschar * verify_cert_hostnames;
430 #ifndef DISABLE_EVENT
431 uschar * event_action;
433 } exim_openssl_state_st;
435 /* should figure out a cleanup of API to handle state preserved per
436 implementation, for various reasons, which can be void * in the APIs.
437 For now, we hack around it. */
438 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
439 exim_openssl_state_st state_server = {.is_server = TRUE};
442 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
447 static int tls_server_stapling_cb(SSL *s, void *arg);
452 /* Daemon-called, before every connection, key create/rotate */
453 #ifndef DISABLE_TLS_RESUME
454 static void tk_init(void);
455 static int tls_exdata_idx = -1;
459 tls_per_lib_daemon_tick(void)
461 #ifndef DISABLE_TLS_RESUME
466 /* Called once at daemon startup */
469 tls_per_lib_daemon_init(void)
471 tls_daemon_creds_reload();
475 /*************************************************
477 *************************************************/
479 /* Called from lots of places when errors occur before actually starting to do
480 the TLS handshake, that is, while the session is still in clear. Always returns
481 DEFER for a server and FAIL for a client so that most calls can use "return
482 tls_error(...)" to do this processing and then give an appropriate return. A
483 single function is used for both server and client, because it is called from
484 some shared functions.
487 prefix text to include in the logged error
488 host NULL if setting up a server;
489 the connected host if setting up a client
490 msg error message or NULL if we should ask OpenSSL
491 errstr pointer to output error message
493 Returns: OK/DEFER/FAIL
497 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
501 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
502 msg = US ssl_errstring;
505 msg = string_sprintf("(%s): %s", prefix, msg);
506 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
507 if (errstr) *errstr = msg;
508 return host ? FAIL : DEFER;
513 /**************************************************
514 * General library initalisation *
515 **************************************************/
518 lib_rand_init(void * addr)
521 if (!RAND_status()) return TRUE;
523 gettimeofday(&r.tv, NULL);
525 RAND_seed(US (&r), sizeof(r));
526 RAND_seed(US big_buffer, big_buffer_size);
527 if (addr) RAND_seed(US addr, sizeof(addr));
529 return RAND_status();
534 tls_openssl_init(void)
536 static BOOL once = FALSE;
540 #ifdef EXIM_NEED_OPENSSL_INIT
541 SSL_load_error_strings(); /* basic set up */
542 OpenSSL_add_ssl_algorithms();
545 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
546 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
547 list of available digests. */
548 EVP_add_digest(EVP_sha256());
551 (void) lib_rand_init(NULL);
552 (void) tls_openssl_options_parse(openssl_options, &init_options);
557 /*************************************************
558 * Initialize for DH *
559 *************************************************/
561 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
565 sctx The current SSL CTX (inbound or outbound)
566 dhparam DH parameter file or fixed parameter identity string
567 errstr error string pointer
569 Returns: TRUE if OK (nothing to set up, or setup worked)
573 init_dh(SSL_CTX * sctx, uschar * dhparam, uschar ** errstr)
576 #if OPENSSL_VERSION_NUMBER < 0x30000000L
585 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
588 if (!dhexpanded || !*dhexpanded)
589 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
590 else if (dhexpanded[0] == '/')
592 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
594 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
595 NULL, US strerror(errno), errstr);
601 if (Ustrcmp(dhexpanded, "none") == 0)
603 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
607 if (!(pem = std_dh_prime_named(dhexpanded)))
609 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
610 NULL, US strerror(errno), errstr);
613 bio = BIO_new_mem_buf(CS pem, -1);
617 #if OPENSSL_VERSION_NUMBER < 0x30000000L
618 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)
620 pkey = PEM_read_bio_Parameters_ex(bio, NULL, NULL, NULL)
625 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
630 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
631 an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with 2236.
632 But older OpenSSL can only report in bytes (octets), not bits. If someone wants
633 to dance at the edge, then they can raise the limit or use current libraries. */
635 #if OPENSSL_VERSION_NUMBER < 0x30000000L
636 # ifdef EXIM_HAVE_OPENSSL_DH_BITS
637 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
638 This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
639 dh_bitsize = DH_bits(dh);
641 dh_bitsize = 8 * DH_size(dh);
644 dh_bitsize = EVP_PKEY_get_bits(pkey);
647 /* Even if it is larger, we silently return success rather than cause things to
648 fail out, so that a too-large DH will not knock out all TLS; it's a debatable
649 choice. Likewise for a failing attempt to set one. */
651 if (dh_bitsize <= tls_dh_max_bits)
654 #if OPENSSL_VERSION_NUMBER < 0x30000000L
655 SSL_CTX_set_tmp_dh(sctx, dh)
657 SSL_CTX_set0_tmp_dh_pkey(sctx, pkey)
661 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
662 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (D-H param setting '%s'): %s",
663 dhexpanded ? dhexpanded : US"default", ssl_errstring);
664 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
665 /* EVP_PKEY_free(pkey); crashes */
670 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
671 dhexpanded ? dhexpanded : US"default", dh_bitsize);
675 debug_printf("dhparams '%s' %d bits, is > tls_dh_max_bits limit of %d\n",
676 dhexpanded ? dhexpanded : US"default", dh_bitsize, tls_dh_max_bits);
678 #if OPENSSL_VERSION_NUMBER < 0x30000000L
681 /* The EVP_PKEY ownership stays with the ctx; do not free it */
690 /*************************************************
691 * Initialize for ECDH *
692 *************************************************/
694 /* Load parameters for ECDH encryption. Server only.
696 For now, we stick to NIST P-256 because: it's simple and easy to configure;
697 it avoids any patent issues that might bite redistributors; despite events in
698 the news and concerns over curve choices, we're not cryptographers, we're not
699 pretending to be, and this is "good enough" to be better than no support,
700 protecting against most adversaries. Given another year or two, there might
701 be sufficient clarity about a "right" way forward to let us make an informed
702 decision, instead of a knee-jerk reaction.
704 Longer-term, we should look at supporting both various named curves and
705 external files generated with "openssl ecparam", much as we do for init_dh().
706 We should also support "none" as a value, to explicitly avoid initialisation.
711 sctx The current SSL CTX (inbound or outbound)
712 errstr error string pointer
714 Returns: TRUE if OK (nothing to set up, or setup worked)
718 init_ecdh(SSL_CTX * sctx, uschar ** errstr)
720 #ifdef OPENSSL_NO_ECDH
728 # ifndef EXIM_HAVE_ECDH
730 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
734 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
736 if (!exp_curve || !*exp_curve)
739 /* "auto" needs to be handled carefully.
740 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
741 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
742 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
743 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
744 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
746 if (Ustrcmp(exp_curve, "auto") == 0)
748 #if OPENSSL_VERSION_NUMBER < 0x10002000L
749 DEBUG(D_tls) debug_printf(
750 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
751 exp_curve = US"prime256v1";
753 # if defined SSL_CTRL_SET_ECDH_AUTO
754 DEBUG(D_tls) debug_printf(
755 "ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n");
756 SSL_CTX_set_ecdh_auto(sctx, 1);
759 DEBUG(D_tls) debug_printf(
760 "ECDH OpenSSL 1.1.0+: temp key parameter settings: default selection\n");
766 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
767 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
768 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
769 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
773 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
778 # if OPENSSL_VERSION_NUMBER < 0x30000000L
781 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
783 tls_error(US"Unable to create ec curve", NULL, NULL, errstr);
787 /* The "tmp" in the name here refers to setting a temporary key
788 not to the stability of the interface. */
790 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
791 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), NULL, NULL, errstr);
793 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
797 #else /* v 3.0.0 + */
799 if ((rv = SSL_CTX_set1_groups(sctx, &nid, 1)) == 0)
800 tls_error(string_sprintf("Error enabling '%s' group", exp_curve), NULL, NULL, errstr);
802 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' group\n", exp_curve);
808 # endif /*EXIM_HAVE_ECDH*/
809 #endif /*OPENSSL_NO_ECDH*/
814 /*************************************************
815 * Expand key and cert file specs *
816 *************************************************/
818 #if OPENSSL_VERSION_NUMBER < 0x30000000L
821 s SSL connection (not used)
825 Returns: pointer to generated key
829 rsa_callback(SSL *s, int export, int keylength)
832 #ifdef EXIM_HAVE_RSA_GENKEY_EX
833 BIGNUM *bn = BN_new();
836 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
838 # ifdef EXIM_HAVE_RSA_GENKEY_EX
839 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
840 || !(rsa_key = RSA_new())
841 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
844 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
848 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
849 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
855 #endif /* pre-3.0.0 */
859 /* Create and install a selfsigned certificate, for use in server mode */
860 /*XXX we could arrange to call this during prelo for a null tls_certificate option.
861 The normal cache inval + relo will suffice.
862 Just need a timer for inval. */
865 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
872 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
873 where = US"allocating pkey";
874 if (!(pkey = EVP_PKEY_new()))
877 where = US"allocating cert";
878 if (!(x509 = X509_new()))
881 where = US"generating pkey";
882 #if OPENSSL_VERSION_NUMBER < 0x30000000L
885 if (!(rsa = rsa_callback(NULL, 0, 2048)))
888 where = US"assigning pkey";
889 if (!EVP_PKEY_assign_RSA(pkey, rsa))
893 pkey = EVP_RSA_gen(2048);
896 X509_set_version(x509, 2); /* N+1 - version 3 */
897 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
898 X509_gmtime_adj(X509_get_notBefore(x509), 0);
899 X509_gmtime_adj(X509_get_notAfter(x509), (long)2 * 60 * 60); /* 2 hour */
900 X509_set_pubkey(x509, pkey);
902 name = X509_get_subject_name(x509);
903 X509_NAME_add_entry_by_txt(name, "C",
904 MBSTRING_ASC, CUS "UK", -1, -1, 0);
905 X509_NAME_add_entry_by_txt(name, "O",
906 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
907 X509_NAME_add_entry_by_txt(name, "CN",
908 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
909 X509_set_issuer_name(x509, name);
911 where = US"signing cert";
912 if (!X509_sign(x509, pkey, EVP_md5()))
915 where = US"installing selfsign cert";
916 if (!SSL_CTX_use_certificate(sctx, x509))
919 where = US"installing selfsign key";
920 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
926 (void) tls_error(where, NULL, NULL, errstr);
927 if (x509) X509_free(x509);
928 if (pkey) EVP_PKEY_free(pkey);
938 /*************************************************
939 * Information callback *
940 *************************************************/
942 /* The SSL library functions call this from time to time to indicate what they
943 are doing. We copy the string to the debugging output when TLS debugging has
955 info_callback(SSL * s, int where, int ret)
961 if (where & SSL_ST_CONNECT) g = string_append_listele(g, ',', US"SSL_connect");
962 if (where & SSL_ST_ACCEPT) g = string_append_listele(g, ',', US"SSL_accept");
963 if (where & SSL_CB_LOOP) g = string_append_listele(g, ',', US"state_chg");
964 if (where & SSL_CB_EXIT) g = string_append_listele(g, ',', US"hshake_exit");
965 if (where & SSL_CB_READ) g = string_append_listele(g, ',', US"read");
966 if (where & SSL_CB_WRITE) g = string_append_listele(g, ',', US"write");
967 if (where & SSL_CB_ALERT) g = string_append_listele(g, ',', US"alert");
968 if (where & SSL_CB_HANDSHAKE_START) g = string_append_listele(g, ',', US"hshake_start");
969 if (where & SSL_CB_HANDSHAKE_DONE) g = string_append_listele(g, ',', US"hshake_done");
971 if (where & SSL_CB_LOOP)
972 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
973 else if (where & SSL_CB_ALERT)
974 debug_printf("SSL %s %s:%s\n", g->s,
975 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
976 else if (where & SSL_CB_EXIT)
979 debug_printf("SSL %s: %s in %s\n", g->s,
980 ret == 0 ? "failed" : "error", SSL_state_string_long(s));
982 else if (where & (SSL_CB_HANDSHAKE_START | SSL_CB_HANDSHAKE_DONE))
983 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
987 #ifdef OPENSSL_HAVE_KEYLOG_CB
989 keylog_callback(const SSL *ssl, const char *line)
993 DEBUG(D_tls) debug_printf("%.200s\n", line);
994 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
995 if (!(fp = fopen(filename, "a"))) return;
996 fprintf(fp, "%s\n", line);
1005 #ifndef DISABLE_EVENT
1007 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
1008 BOOL *calledp, const BOOL *optionalp, const uschar * what)
1014 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
1017 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
1018 old_cert = tlsp->peercert;
1019 tlsp->peercert = X509_dup(cert);
1020 /* NB we do not bother setting peerdn */
1021 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth), &errno)))
1023 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
1024 "depth=%d cert=%s: %s",
1025 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1026 what, depth, dn, yield);
1030 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
1031 return 1; /* reject (leaving peercert set) */
1033 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
1034 "(host in tls_try_verify_hosts)\n");
1035 tlsp->verify_override = TRUE;
1037 X509_free(tlsp->peercert);
1038 tlsp->peercert = old_cert;
1044 /*************************************************
1045 * Callback for verification *
1046 *************************************************/
1048 /* The SSL library does certificate verification if set up to do so. This
1049 callback has the current yes/no state is in "state". If verification succeeded,
1050 we set the certificate-verified flag. If verification failed, what happens
1051 depends on whether the client is required to present a verifiable certificate
1054 If verification is optional, we change the state to yes, but still log the
1055 verification error. For some reason (it really would help to have proper
1056 documentation of OpenSSL), this callback function then gets called again, this
1057 time with state = 1. We must take care not to set the private verified flag on
1058 the second time through.
1060 Note: this function is not called if the client fails to present a certificate
1061 when asked. We get here only if a certificate has been received. Handling of
1062 optional verification for this case is done when requesting SSL to verify, by
1063 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
1065 May be called multiple times for different issues with a certificate, even
1066 for a given "depth" in the certificate chain.
1069 preverify_ok current yes/no state as 1/0
1070 x509ctx certificate information.
1071 tlsp per-direction (client vs. server) support data
1072 calledp has-been-called flag
1073 optionalp verification-is-optional flag
1075 Returns: 0 if verification should fail, otherwise 1
1079 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1080 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1082 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1083 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1086 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1088 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1089 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1090 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1093 dn[sizeof(dn)-1] = '\0';
1095 tlsp->verify_override = FALSE;
1096 if (preverify_ok == 0)
1098 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1099 *verify_mode, sender_host_address)
1101 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1102 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1104 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1108 if (!tlsp->peercert)
1109 tlsp->peercert = X509_dup(cert); /* record failing cert */
1110 return 0; /* reject */
1112 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1113 "tls_try_verify_hosts)\n");
1114 tlsp->verify_override = TRUE;
1117 else if (depth != 0)
1119 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1120 #ifndef DISABLE_OCSP
1121 if (tlsp == &tls_out && client_static_state->u_ocsp.client.verify_store)
1122 { /* client, wanting stapling */
1123 /* Add the server cert's signing chain as the one
1124 for the verification of the OCSP stapled information. */
1126 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1129 sk_X509_push(client_static_state->verify_stack, cert);
1132 #ifndef DISABLE_EVENT
1133 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1134 return 0; /* reject, with peercert set */
1139 const uschar * verify_cert_hostnames;
1141 if ( tlsp == &tls_out
1142 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1143 /* client, wanting hostname check */
1146 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1147 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1148 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1150 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1151 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1154 const uschar * list = verify_cert_hostnames;
1157 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1158 if ((rc = X509_check_host(cert, CCS name, 0,
1159 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1160 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1165 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1166 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1173 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1176 uschar * extra = verify_mode
1177 ? string_sprintf(" (during %c-verify for [%s])",
1178 *verify_mode, sender_host_address)
1180 log_write(0, LOG_MAIN,
1181 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1182 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1183 extra, dn, verify_cert_hostnames);
1187 if (!tlsp->peercert)
1188 tlsp->peercert = X509_dup(cert); /* record failing cert */
1189 return 0; /* reject */
1191 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1192 "tls_try_verify_hosts)\n");
1193 tlsp->verify_override = TRUE;
1197 #ifndef DISABLE_EVENT
1198 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1199 return 0; /* reject, with peercert set */
1202 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1203 *calledp ? "" : " authenticated", dn);
1207 return 1; /* accept, at least for this level */
1211 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1213 return verify_callback(preverify_ok, x509ctx, &tls_out,
1214 &client_verify_callback_called, &client_verify_optional);
1218 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1220 return verify_callback(preverify_ok, x509ctx, &tls_in,
1221 &server_verify_callback_called, &server_verify_optional);
1227 /* This gets called *by* the dane library verify callback, which interposes
1231 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1233 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1235 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1236 #ifndef DISABLE_EVENT
1237 BOOL dummy_called, optional = FALSE;
1240 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1242 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1243 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1244 deliver_host_address);
1247 dn[sizeof(dn)-1] = '\0';
1249 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1250 preverify_ok ? "ok":"BAD", depth, dn);
1252 #ifndef DISABLE_EVENT
1253 if (verify_event(&tls_out, cert, depth, dn,
1254 &dummy_called, &optional, US"DANE"))
1255 return 0; /* reject, with peercert set */
1258 if (preverify_ok == 1)
1260 tls_out.dane_verified = TRUE;
1261 #ifndef DISABLE_OCSP
1262 if (client_static_state->u_ocsp.client.verify_store)
1263 { /* client, wanting stapling */
1264 /* Add the server cert's signing chain as the one
1265 for the verification of the OCSP stapled information. */
1267 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1270 sk_X509_push(client_static_state->verify_stack, cert);
1276 int err = X509_STORE_CTX_get_error(x509ctx);
1278 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1279 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1282 return preverify_ok;
1285 #endif /*SUPPORT_DANE*/
1288 #ifndef DISABLE_OCSP
1289 /*************************************************
1290 * Load OCSP information into state *
1291 *************************************************/
1292 /* Called to load the server OCSP response from the given file into memory, once
1293 caller has determined this is needed. Checks validity. Debugs a message
1296 ASSUMES: single response, for single cert.
1299 state various parts of session state
1300 filename the filename putatively holding an OCSP response
1301 is_pem file is PEM format; otherwise is DER
1305 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1309 OCSP_RESPONSE * resp;
1310 OCSP_BASICRESP * basic_response;
1311 OCSP_SINGLERESP * single_response;
1312 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1313 STACK_OF(X509) * sk;
1314 unsigned long verify_flags;
1315 int status, reason, i;
1318 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1320 if (!filename || !*filename) return;
1323 if (!(bio = BIO_new_file(CS filename, "rb")))
1325 log_write(0, LOG_MAIN|LOG_PANIC,
1326 "Failed to open OCSP response file \"%s\": %.100s",
1327 filename, ERR_reason_error_string(ERR_get_error()));
1333 uschar * data, * freep;
1336 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1338 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
1339 filename, ERR_reason_error_string(ERR_get_error()));
1343 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1344 OPENSSL_free(freep);
1347 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1352 log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
1353 filename, ERR_reason_error_string(ERR_get_error()));
1357 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1359 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1360 OCSP_response_status_str(status), status);
1366 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1367 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1372 if (!(basic_response = OCSP_response_get1_basic(resp)))
1375 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1379 sk = state->verify_stack;
1380 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1382 /* May need to expose ability to adjust those flags?
1383 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1384 OCSP_TRUSTOTHER OCSP_NOINTERN */
1386 /* This does a full verify on the OCSP proof before we load it for serving
1387 up; possibly overkill - just date-checks might be nice enough.
1389 OCSP_basic_verify takes a "store" arg, but does not
1390 use it for the chain verification, which is all we do
1391 when OCSP_NOVERIFY is set. The content from the wire
1392 "basic_response" and a cert-stack "sk" are all that is used.
1394 We have a stack, loaded in setup_certs() if tls_verify_certificates
1395 was a file (not a directory, or "system"). It is unfortunate we
1396 cannot used the connection context store, as that would neatly
1397 handle the "system" case too, but there seems to be no library
1398 function for getting a stack from a store.
1399 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1400 We do not free the stack since it could be needed a second time for
1403 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1404 be a public interface into the OpenSSL library (there's no manual entry) -
1405 But what with? We also use OCSP_basic_verify in the client stapling callback.
1406 And there we NEED it; we must verify that status... unless the
1407 library does it for us anyway? */
1409 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
1413 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1414 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
1419 /* Here's the simplifying assumption: there's only one response, for the
1420 one certificate we use, and nothing for anything else in a chain. If this
1421 proves false, we need to extract a cert id from our issued cert
1422 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1423 right cert in the stack and then calls OCSP_single_get0_status()).
1425 I'm hoping to avoid reworking a bunch more of how we handle state here.
1427 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1430 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1433 debug_printf("Unable to get first response from OCSP basic response.\n");
1437 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1438 if (status != V_OCSP_CERTSTATUS_GOOD)
1440 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1441 OCSP_cert_status_str(status), status,
1442 OCSP_crl_reason_str(reason), reason);
1446 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1448 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
1453 /* Add the resp to the list used by tls_server_stapling_cb() */
1455 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1456 while (oentry = *op)
1458 *op = oentry = store_get(sizeof(ocsp_resplist), GET_UNTAINTED);
1459 oentry->next = NULL;
1460 oentry->resp = resp;
1465 if (f.running_in_test_harness)
1467 extern char ** environ;
1468 if (environ) for (uschar ** p = USS environ; *p; p++)
1469 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1471 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1472 goto supply_response;
1480 ocsp_free_response_list(exim_openssl_state_st * state)
1482 for (ocsp_resplist * olist = state->u_ocsp.server.olist; olist;
1483 olist = olist->next)
1484 OCSP_RESPONSE_free(olist->resp);
1485 state->u_ocsp.server.olist = NULL;
1487 #endif /*!DISABLE_OCSP*/
1494 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1497 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1498 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1499 return tls_error(string_sprintf(
1500 "SSL_CTX_use_certificate_chain_file file=%s", file),
1501 cbinfo->host, NULL, errstr);
1506 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1509 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1510 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1511 return tls_error(string_sprintf(
1512 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1519 /* Called once during tls_init and possibly again during TLS setup, for a
1520 new context, if Server Name Indication was used and tls_sni was seen in
1521 the certificate string.
1524 sctx the SSL_CTX* to update
1525 state various parts of session state
1526 errstr error string pointer
1528 Returns: OK/DEFER/FAIL
1532 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1537 if (!state->certificate)
1539 if (!state->is_server) /* client */
1542 if (tls_install_selfsign(sctx, errstr) != OK)
1549 if ( !reexpand_tls_files_for_sni
1550 && ( Ustrstr(state->certificate, US"tls_sni")
1551 || Ustrstr(state->certificate, US"tls_in_sni")
1552 || Ustrstr(state->certificate, US"tls_out_sni")
1554 reexpand_tls_files_for_sni = TRUE;
1556 if (!expand_check(state->certificate, US"tls_certificate", &expanded, errstr))
1560 if (state->is_server)
1562 const uschar * file_list = expanded;
1565 #ifndef DISABLE_OCSP
1566 const uschar * olist = state->u_ocsp.server.file;
1569 BOOL fmt_pem = FALSE;
1572 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1574 if (olist && !*olist)
1577 /* If doing a re-expand after SNI, avoid reloading the OCSP
1578 responses when the list of filenames has not changed.
1579 The creds-invali on content change wipes file_expanded, so that
1580 always reloads here. */
1582 if ( state->u_ocsp.server.file_expanded && olist
1583 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1585 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1590 ocsp_free_response_list(state);
1591 state->u_ocsp.server.file_expanded = olist;
1595 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1597 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1600 #ifndef DISABLE_OCSP
1602 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1604 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1609 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1614 ocsp_load_response(state, ofile, fmt_pem);
1617 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1621 else /* would there ever be a need for multiple client certs? */
1622 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1625 if ( state->privatekey
1626 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr))
1629 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1630 of the expansion is an empty string, ignore it also, and assume the private
1631 key is in the same file as the certificate. */
1633 if (expanded && *expanded)
1634 if (state->is_server)
1636 const uschar * file_list = expanded;
1640 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1641 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1644 else /* would there ever be a need for multiple client certs? */
1645 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1655 /**************************************************
1656 * One-time init credentials for server and client *
1657 **************************************************/
1660 normalise_ciphers(uschar ** ciphers, const uschar * pre_expansion_ciphers)
1662 uschar * s = *ciphers;
1664 if (!s || !Ustrchr(s, '_')) return; /* no change needed */
1666 if (s == pre_expansion_ciphers)
1667 s = string_copy(s); /* get writable copy */
1669 for (uschar * t = s; *t; t++) if (*t == '_') *t = '-';
1674 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1675 uschar * ciphers, uschar ** errstr)
1677 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1678 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1679 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1680 state->server_cipher_list = ciphers;
1687 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1690 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1691 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1693 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1695 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1697 /* Set up the information callback, which outputs if debugging is at a suitable
1702 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1703 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1704 /* this needs a debug build of OpenSSL */
1705 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
1707 #ifdef OPENSSL_HAVE_KEYLOG_CB
1708 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
1712 /* Automatically re-try reads/writes after renegotiation. */
1713 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1720 tls_server_creds_init(void)
1723 uschar * dummy_errstr;
1724 unsigned lifetime = 0;
1728 state_server.lib_state = null_tls_preload;
1730 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1732 state_server.lib_state.lib_ctx = ctx;
1734 /* Preload DH params and EC curve */
1736 if (opt_unset_or_noexpand(tls_dhparam))
1738 DEBUG(D_tls) debug_printf("TLS: preloading DH params for server\n");
1739 if (init_dh(ctx, tls_dhparam, &dummy_errstr))
1740 state_server.lib_state.dh = TRUE;
1743 DEBUG(D_tls) debug_printf("TLS: not preloading DH params for server\n");
1744 if (opt_unset_or_noexpand(tls_eccurve))
1746 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for server\n");
1747 if (init_ecdh(ctx, &dummy_errstr))
1748 state_server.lib_state.ecdh = TRUE;
1751 DEBUG(D_tls) debug_printf("TLS: not preloading ECDH curve for server\n");
1753 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1754 /* If we can, preload the server-side cert, key and ocsp */
1756 if ( opt_set_and_noexpand(tls_certificate)
1757 # ifndef DISABLE_OCSP
1758 && opt_unset_or_noexpand(tls_ocsp_file)
1760 && opt_unset_or_noexpand(tls_privatekey))
1762 /* Set watches on the filenames. The implementation does de-duplication
1763 so we can just blindly do them all. */
1765 if ( tls_set_watch(tls_certificate, TRUE)
1766 # ifndef DISABLE_OCSP
1767 && tls_set_watch(tls_ocsp_file, TRUE)
1769 && tls_set_watch(tls_privatekey, TRUE))
1771 state_server.certificate = tls_certificate;
1772 state_server.privatekey = tls_privatekey;
1773 #ifndef DISABLE_OCSP
1774 state_server.u_ocsp.server.file = tls_ocsp_file;
1777 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1778 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1779 state_server.lib_state.conn_certs = TRUE;
1782 else if ( !tls_certificate && !tls_privatekey
1783 # ifndef DISABLE_OCSP
1787 { /* Generate & preload a selfsigned cert. No files to watch. */
1788 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1790 state_server.lib_state.conn_certs = TRUE;
1791 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1795 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1798 /* If we can, preload the Authorities for checking client certs against.
1799 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1800 at TLS conn startup */
1802 if ( opt_set_and_noexpand(tls_verify_certificates)
1803 && opt_unset_or_noexpand(tls_crl))
1805 /* Watch the default dir also as they are always included */
1807 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1808 && tls_set_watch(tls_verify_certificates, FALSE)
1809 && tls_set_watch(tls_crl, FALSE))
1811 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1813 if (setup_certs(ctx, tls_verify_certificates, tls_crl, NULL, &dummy_errstr)
1815 state_server.lib_state.cabundle = TRUE;
1819 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1820 #endif /* EXIM_HAVE_INOTIFY */
1823 /* If we can, preload the ciphers control string */
1825 if (opt_set_and_noexpand(tls_require_ciphers))
1827 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1828 normalise_ciphers(&tls_require_ciphers, tls_require_ciphers);
1829 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1830 &dummy_errstr) == OK)
1831 state_server.lib_state.pri_string = TRUE;
1834 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1841 /* Preload whatever creds are static, onto a transport. The client can then
1842 just copy the pointer as it starts up.
1843 Called from the daemon after a cache-invalidate with watch set; called from
1844 a queue-run startup with watch clear. */
1847 tls_client_creds_init(transport_instance * t, BOOL watch)
1849 smtp_transport_options_block * ob = t->options_block;
1850 exim_openssl_state_st tpt_dummy_state;
1851 host_item * dummy_host = (host_item *)1;
1852 uschar * dummy_errstr;
1857 ob->tls_preload = null_tls_preload;
1858 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1860 ob->tls_preload.lib_ctx = ctx;
1862 tpt_dummy_state.lib_state = ob->tls_preload;
1864 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1865 if ( opt_set_and_noexpand(ob->tls_certificate)
1866 && opt_unset_or_noexpand(ob->tls_privatekey))
1869 || ( tls_set_watch(ob->tls_certificate, FALSE)
1870 && tls_set_watch(ob->tls_privatekey, FALSE)
1873 uschar * pkey = ob->tls_privatekey;
1876 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1878 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1880 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1881 pkey ? pkey : ob->tls_certificate,
1884 ob->tls_preload.conn_certs = TRUE;
1889 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1892 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1893 && opt_unset_or_noexpand(ob->tls_crl))
1896 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1897 && tls_set_watch(ob->tls_verify_certificates, FALSE)
1898 && tls_set_watch(ob->tls_crl, FALSE)
1902 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1904 if (setup_certs(ctx, ob->tls_verify_certificates,
1905 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
1906 ob->tls_preload.cabundle = TRUE;
1911 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1913 #endif /*EXIM_HAVE_INOTIFY*/
1917 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1918 /* Invalidate the creds cached, by dropping the current ones.
1919 Call when we notice one of the source files has changed. */
1922 tls_server_creds_invalidate(void)
1924 SSL_CTX_free(state_server.lib_state.lib_ctx);
1925 state_server.lib_state = null_tls_preload;
1926 #ifndef DISABLE_OCSP
1927 state_server.u_ocsp.server.file_expanded = NULL;
1933 tls_client_creds_invalidate(transport_instance * t)
1935 smtp_transport_options_block * ob = t->options_block;
1936 SSL_CTX_free(ob->tls_preload.lib_ctx);
1937 ob->tls_preload = null_tls_preload;
1943 tls_server_creds_invalidate(void)
1947 tls_client_creds_invalidate(transport_instance * t)
1950 #endif /*EXIM_HAVE_INOTIFY*/
1954 #ifndef DISABLE_OCSP
1956 x509_store_dump_cert_s_names(X509_STORE * store)
1958 STACK_OF(X509_OBJECT) * roots= store->objs;
1959 static uschar name[256];
1961 for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
1963 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
1964 if(tmp_obj->type == X509_LU_X509)
1966 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
1967 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
1969 name[sizeof(name)-1] = '\0';
1970 debug_printf(" %s\n", name);
1979 #ifndef DISABLE_TLS_RESUME
1980 /* Manage the keysets used for encrypting the session tickets, on the server. */
1982 typedef struct { /* Session ticket encryption key */
1985 const EVP_CIPHER * aes_cipher;
1986 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
1987 # if OPENSSL_VERSION_NUMBER < 0x30000000L
1988 const EVP_MD * hmac_hash;
1990 const uschar * hmac_hashname;
1992 uschar hmac_key[16];
1997 static exim_stek exim_tk; /* current key */
1998 static exim_stek exim_tk_old; /* previous key */
2003 time_t t = time(NULL);
2005 if (exim_tk.name[0])
2007 if (exim_tk.renew >= t) return;
2008 exim_tk_old = exim_tk;
2011 if (f.running_in_test_harness) ssl_session_timeout = 6;
2013 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
2014 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
2015 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
2016 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
2018 exim_tk.name[0] = 'E';
2019 exim_tk.aes_cipher = EVP_aes_256_cbc();
2020 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2021 exim_tk.hmac_hash = EVP_sha256();
2023 exim_tk.hmac_hashname = US "sha256";
2025 exim_tk.expire = t + ssl_session_timeout;
2026 exim_tk.renew = t + ssl_session_timeout/2;
2032 if (!exim_tk.name[0]) return NULL;
2037 tk_find(const uschar * name)
2039 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
2040 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
2047 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2055 /*XXX will want these dependent on the ssl session strength */
2056 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2057 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2058 key->hmac_hash, NULL);
2061 OSSL_PARAM params[3];
2062 uschar * hk = string_copy(key->hmac_hashname); /* need nonconst */
2063 params[0] = OSSL_PARAM_construct_octet_string("key", key->hmac_key, sizeof(key->hmac_key));
2064 params[1] = OSSL_PARAM_construct_utf8_string("digest", CS hk, 0);
2065 params[2] = OSSL_PARAM_construct_end();
2066 if (EVP_MAC_CTX_set_params(hctx, params) == 0)
2068 DEBUG(D_tls) debug_printf("EVP_MAC_CTX_set_params: %s\n",
2069 ERR_reason_error_string(ERR_get_error()));
2070 return 0; /* error in mac initialisation */
2077 /* Callback for session tickets, on server */
2079 ticket_key_callback(SSL * ssl, uschar key_name[16],
2080 uschar * iv, EVP_CIPHER_CTX * c_ctx,
2081 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2088 tls_support * tlsp = state_server.tlsp;
2093 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
2094 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2096 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
2097 return -1; /* insufficient random */
2099 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
2100 return 0; /* key couldn't be created */
2101 memcpy(key_name, key->name, 16);
2102 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
2104 if (tk_hmac_init(hctx, key) == 0) return 0;
2105 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2107 DEBUG(D_tls) debug_printf("ticket created\n");
2112 time_t now = time(NULL);
2114 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
2115 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2117 if (!(key = tk_find(key_name)) || key->expire < now)
2121 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
2122 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
2127 if (tk_hmac_init(hctx, key) == 0) return 0;
2128 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2130 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2132 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2133 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2134 be better. To do that we'd have to encode ticket lifetime in the name as
2135 we don't yet see the restored session. Could check posthandshake for TLS1.3
2136 and trigger a new ticket then, but cannot do that for TLS1.2 */
2137 return key->renew < now ? 2 : 1;
2140 #endif /* !DISABLE_TLS_RESUME */
2145 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2146 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2148 /* If verification is optional, don't fail if no certificate */
2150 SSL_CTX_set_verify(ctx,
2151 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2156 /*************************************************
2157 * Callback to handle SNI *
2158 *************************************************/
2160 /* Called when acting as server during the TLS session setup if a Server Name
2161 Indication extension was sent by the client.
2163 API documentation is OpenSSL s_server.c implementation.
2166 s SSL* of the current session
2167 ad unknown (part of OpenSSL API) (unused)
2168 arg Callback of "our" registered data
2170 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2172 XXX might need to change to using ClientHello callback,
2173 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2176 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2178 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
2180 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2181 exim_openssl_state_st *state = (exim_openssl_state_st *) arg;
2183 int old_pool = store_pool;
2184 uschar * dummy_errstr;
2187 return SSL_TLSEXT_ERR_OK;
2189 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2190 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2192 /* Make the extension value available for expansion */
2193 store_pool = POOL_PERM;
2194 tls_in.sni = string_copy_taint(US servername, GET_TAINTED);
2195 store_pool = old_pool;
2197 if (!reexpand_tls_files_for_sni)
2198 return SSL_TLSEXT_ERR_OK;
2200 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2201 not confident that memcpy wouldn't break some internal reference counting.
2202 Especially since there's a references struct member, which would be off. */
2204 if (lib_ctx_new(&server_sni, NULL, &dummy_errstr) != OK)
2207 /* Not sure how many of these are actually needed, since SSL object
2208 already exists. Might even need this selfsame callback, for reneg? */
2211 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2212 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2213 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2214 #ifdef OPENSSL_MIN_PROTO_VERSION
2215 SSL_CTX_set_min_proto_version(server_sni, SSL3_VERSION);
2217 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2218 SSL_CTX_clear_options(server_sni, ~SSL_CTX_get_options(ctx));
2219 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2220 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2221 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2224 if ( !init_dh(server_sni, state->dhparam, &dummy_errstr)
2225 || !init_ecdh(server_sni, &dummy_errstr)
2229 if ( state->server_cipher_list
2230 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2233 #ifndef DISABLE_OCSP
2234 if (state->u_ocsp.server.file)
2236 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2237 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2243 if ( !expand_check(tls_verify_certificates, US"tls_verify_certificates",
2244 &expcerts, &dummy_errstr)
2245 || (rc = setup_certs(server_sni, expcerts, tls_crl, NULL,
2246 &dummy_errstr)) != OK)
2249 if (expcerts && *expcerts)
2250 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2253 /* do this after setup_certs, because this can require the certs for verifying
2254 OCSP information. */
2255 if ((rc = tls_expand_session_files(server_sni, state, &dummy_errstr)) != OK)
2258 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2259 SSL_set_SSL_CTX(s, server_sni);
2260 return SSL_TLSEXT_ERR_OK;
2262 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
2264 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2269 #ifdef EXIM_HAVE_ALPN
2270 /*************************************************
2271 * Callback to handle ALPN *
2272 *************************************************/
2274 /* Called on server if tls_alpn nonblank after expansion,
2275 when client offers ALPN, after the SNI callback.
2276 If set and not matching the list then we dump the connection */
2279 tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen,
2280 const uschar * in, unsigned int inlen, void * arg)
2282 server_seen_alpn = TRUE;
2285 debug_printf("Received TLS ALPN offer:");
2286 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2289 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2290 debug_printf(" '%.*s'", siz, in + pos + 1);
2292 debug_printf(". Our list: '%s'\n", tls_alpn);
2295 /* Look for an acceptable ALPN */
2297 if ( inlen > 1 /* at least one name */
2298 && in[0]+1 == inlen /* filling the vector, so exactly one name */
2301 const uschar * list = tls_alpn;
2303 for (uschar * name; name = string_nextinlist(&list, &sep, NULL, 0); )
2304 if (Ustrncmp(in+1, name, in[0]) == 0)
2306 *out = in+1; /* we checked for exactly one, so can just point to it */
2308 return SSL_TLSEXT_ERR_OK; /* use ALPN */
2312 /* More than one name from clilent, or name did not match our list. */
2314 /* This will be fatal to the TLS conn; would be nice to kill TCP also.
2315 Maybe as an option in future; for now leave control to the config (must-tls). */
2317 DEBUG(D_tls) debug_printf("TLS ALPN rejected\n");
2318 return SSL_TLSEXT_ERR_ALERT_FATAL;
2320 #endif /* EXIM_HAVE_ALPN */
2324 #ifndef DISABLE_OCSP
2326 /*************************************************
2327 * Callback to handle OCSP Stapling *
2328 *************************************************/
2330 /* Called when acting as server during the TLS session setup if the client
2331 requests OCSP information with a Certificate Status Request.
2333 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2339 tls_server_stapling_cb(SSL *s, void *arg)
2341 const exim_openssl_state_st * state = arg;
2342 ocsp_resplist * olist = state->u_ocsp.server.olist;
2343 uschar * response_der; /*XXX blob */
2344 int response_der_len;
2347 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2348 olist ? "have" : "lack");
2350 tls_in.ocsp = OCSP_NOT_RESP;
2352 return SSL_TLSEXT_ERR_NOACK;
2354 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
2356 const X509 * cert_sent = SSL_get_certificate(s);
2357 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2358 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2360 for (; olist; olist = olist->next)
2362 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2363 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2364 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2365 ASN1_INTEGER * res_cert_serial;
2366 const BIGNUM * resp_bn;
2367 ASN1_OCTET_STRING * res_cert_iNameHash;
2370 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2371 (OCSP_CERTID *) cid);
2372 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2376 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2377 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2380 if (BN_cmp(cert_bn, resp_bn) == 0)
2382 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2384 /*XXX TODO: check the rest of the list for duplicate matches.
2385 If any, need to also check the Issuer Name hash.
2386 Without this, we will provide the wrong status in the case of
2391 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2395 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2396 return SSL_TLSEXT_ERR_NOACK;
2402 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2403 return SSL_TLSEXT_ERR_NOACK;
2407 /*XXX could we do the i2d earlier, rather than during the callback? */
2408 response_der = NULL;
2409 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2410 if (response_der_len <= 0)
2411 return SSL_TLSEXT_ERR_NOACK;
2413 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2414 response_der, response_der_len);
2415 tls_in.ocsp = OCSP_VFIED;
2416 return SSL_TLSEXT_ERR_OK;
2421 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
2423 BIO_printf(bp, "\t%s: ", str);
2424 ASN1_GENERALIZEDTIME_print(bp, time);
2429 tls_client_stapling_cb(SSL * ssl, void * arg)
2431 exim_openssl_state_st * cbinfo = arg;
2432 const unsigned char * p;
2434 OCSP_RESPONSE * rsp;
2435 OCSP_BASICRESP * bs;
2438 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2439 len = SSL_get_tlsext_status_ocsp_resp(ssl, &p);
2441 { /* Expect this when we requested ocsp but got none */
2442 if (SSL_session_reused(ssl) && tls_out.ocsp == OCSP_VFIED)
2444 DEBUG(D_tls) debug_printf(" null, but resumed; ocsp vfy stored with session is good\n");
2447 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2448 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2450 DEBUG(D_tls) debug_printf(" null\n");
2451 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2454 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2456 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2457 if (LOGGING(tls_cipher))
2458 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2460 DEBUG(D_tls) debug_printf(" parse error\n");
2464 if (!(bs = OCSP_response_get1_basic(rsp)))
2466 tls_out.ocsp = OCSP_FAILED;
2467 if (LOGGING(tls_cipher))
2468 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2470 DEBUG(D_tls) debug_printf(" error parsing response\n");
2471 OCSP_RESPONSE_free(rsp);
2475 /* We'd check the nonce here if we'd put one in the request. */
2476 /* However that would defeat cacheability on the server so we don't. */
2478 /* This section of code reworked from OpenSSL apps source;
2479 The OpenSSL Project retains copyright:
2480 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2484 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2485 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2488 DEBUG(D_tls) bp = BIO_new(BIO_s_mem());
2490 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2492 /* Use the chain that verified the server cert to verify the stapled info */
2493 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
2495 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
2496 cbinfo->u_ocsp.client.verify_store, OCSP_NOEXPLICIT)) <= 0)
2497 if (ERR_peek_error())
2499 tls_out.ocsp = OCSP_FAILED;
2500 if (LOGGING(tls_cipher))
2502 const uschar * errstr = CUS ERR_reason_error_string(ERR_peek_error());
2503 static uschar peerdn[256];
2504 X509_NAME_oneline(X509_get_subject_name(SSL_get_peer_certificate(ssl)),
2505 CS peerdn, sizeof(peerdn));
2506 log_write(0, LOG_MAIN,
2507 "[%s] %s Received TLS cert (DN: '%.*s') status response, "
2508 "itself unverifiable: %s",
2509 sender_host_address, sender_host_name,
2510 (int)sizeof(peerdn), peerdn,
2515 BIO_printf(bp, "OCSP response verify failure\n");
2516 ERR_print_errors(bp);
2517 OCSP_RESPONSE_print(bp, rsp, 0);
2522 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2523 " in the root CA certificate; ignoring\n");
2525 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2527 /*XXX So we have a good stapled OCSP status. How do we know
2528 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2529 OCSP_resp_find_status() which matches on a cert id, which presumably
2530 we should use. Making an id needs OCSP_cert_id_new(), which takes
2531 issuerName, issuerKey, serialNumber. Are they all in the cert?
2533 For now, carry on blindly accepting the resp. */
2536 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2537 OCSP_resp_count(bs) - 1;
2539 sk_OCSP_SINGLERESP_num(sresp) - 1;
2543 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2545 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2547 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2548 - but what happens with a GnuTLS-style input?
2550 we could do with a debug label for each singleresp
2551 - it has a certID with a serialNumber, but I see no API to get that
2553 status = OCSP_single_get0_status(single, &reason, &rev,
2554 &thisupd, &nextupd);
2558 time_print(bp, "This OCSP Update", thisupd);
2559 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
2561 if (!OCSP_check_validity(thisupd, nextupd,
2562 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2564 tls_out.ocsp = OCSP_FAILED;
2565 DEBUG(D_tls) ERR_print_errors(bp);
2566 log_write(0, LOG_MAIN, "OCSP dates invalid");
2570 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2571 OCSP_cert_status_str(status));
2574 case V_OCSP_CERTSTATUS_GOOD:
2575 continue; /* the idx loop */
2576 case V_OCSP_CERTSTATUS_REVOKED:
2577 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2578 reason != -1 ? "; reason: " : "",
2579 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2580 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2583 log_write(0, LOG_MAIN,
2584 "Server certificate status unknown, in OCSP stapling");
2592 tls_out.ocsp = OCSP_VFIED;
2596 tls_out.ocsp = OCSP_FAILED;
2597 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2601 int len = (int) BIO_get_mem_data(bp, CSS &s);
2602 if (len > 0) debug_printf("%.*s", len, s);
2607 OCSP_RESPONSE_free(rsp);
2610 #endif /*!DISABLE_OCSP*/
2613 /*************************************************
2614 * Initialize for TLS *
2615 *************************************************/
2616 /* Called from both server and client code, to do preliminary initialization
2617 of the library. We allocate and return a context structure.
2620 host connected host, if client; NULL if server
2621 ob transport options block, if client; NULL if server
2622 ocsp_file file of stapling info (server); flag for require ocsp (client)
2623 addr address if client; NULL if server (for some randomness)
2624 caller_state place to put pointer to allocated state-struct
2625 errstr error string pointer
2627 Returns: OK/DEFER/FAIL
2631 tls_init(host_item * host, smtp_transport_options_block * ob,
2632 #ifndef DISABLE_OCSP
2635 address_item *addr, exim_openssl_state_st ** caller_state,
2640 exim_openssl_state_st * state;
2643 if (host) /* client */
2645 state = store_malloc(sizeof(exim_openssl_state_st));
2646 memset(state, 0, sizeof(*state));
2647 state->certificate = ob->tls_certificate;
2648 state->privatekey = ob->tls_privatekey;
2649 state->is_server = FALSE;
2650 state->dhparam = NULL;
2651 state->lib_state = ob->tls_preload;
2655 state = &state_server;
2656 state->certificate = tls_certificate;
2657 state->privatekey = tls_privatekey;
2658 state->is_server = TRUE;
2659 state->dhparam = tls_dhparam;
2660 state->lib_state = state_server.lib_state;
2666 if (!state->lib_state.pri_string)
2667 state->server_cipher_list = NULL;
2669 #ifndef DISABLE_EVENT
2670 state->event_action = NULL;
2675 /* It turns out that we need to seed the random number generator this early in
2676 order to get the full complement of ciphers to work. It took me roughly a day
2677 of work to discover this by experiment.
2679 On systems that have /dev/urandom, SSL may automatically seed itself from
2680 there. Otherwise, we have to make something up as best we can. Double check
2683 Although we likely called this before, at daemon startup, this is a chance
2684 to mix in further variable info (time, pid) if needed. */
2686 if (!lib_rand_init(addr))
2687 return tls_error(US"RAND_status", host,
2688 US"unable to seed random number generator", errstr);
2690 /* Apply administrator-supplied work-arounds.
2691 Historically we applied just one requested option,
2692 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2693 moved to an administrator-controlled list of options to specify and
2694 grandfathered in the first one as the default value for "openssl_options".
2696 No OpenSSL version number checks: the options we accept depend upon the
2697 availability of the option value macros from OpenSSL. */
2700 if (!tls_openssl_options_parse(openssl_options, &init_options))
2701 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2703 /* Create a context.
2704 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2705 negotiation in the different methods; as far as I can tell, the only
2706 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2707 when OpenSSL is built without SSLv2 support.
2708 By disabling with openssl_options, we can let admins re-enable with the
2711 if (!(ctx = state->lib_state.lib_ctx))
2713 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2715 state->lib_state.lib_ctx = ctx;
2718 #ifndef DISABLE_TLS_RESUME
2719 tlsp->resumption = RESUME_SUPPORTED;
2723 #ifndef DISABLE_TLS_RESUME
2724 /* Should the server offer session resumption? */
2725 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2727 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2728 init_options &= ~SSL_OP_NO_TICKET;
2729 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2730 tlsp->host_resumable = TRUE;
2734 #ifdef OPENSSL_MIN_PROTO_VERSION
2735 SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
2737 DEBUG(D_tls) debug_printf("setting SSL CTX options: %016lx\n", init_options);
2738 SSL_CTX_set_options(ctx, init_options);
2740 uint64_t readback = SSL_CTX_clear_options(ctx, ~init_options);
2741 if (readback != init_options)
2742 return tls_error(string_sprintf(
2743 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2747 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2749 /* We'd like to disable session cache unconditionally, but foolish Outlook
2750 Express clients then give up the first TLS connection and make a second one
2751 (which works). Only when there is an IMAP service on the same machine.
2752 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2753 now, until we work out a decent way of presenting control to the config. It
2754 will never be used because we use a new context every time. */
2756 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2759 /* Initialize with DH parameters if supplied */
2760 /* Initialize ECDH temp key parameter selection */
2764 if (state->lib_state.dh)
2765 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2767 if (!init_dh(ctx, state->dhparam, errstr)) return DEFER;
2769 if (state->lib_state.ecdh)
2770 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
2772 if (!init_ecdh(ctx, errstr)) return DEFER;
2775 /* Set up certificate and key (and perhaps OCSP info) */
2777 if (state->lib_state.conn_certs)
2780 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
2784 #ifndef DISABLE_OCSP
2785 if (!host) /* server */
2787 state->u_ocsp.server.file = ocsp_file;
2788 state->u_ocsp.server.file_expanded = NULL;
2789 state->u_ocsp.server.olist = NULL;
2792 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
2795 /* If we need to handle SNI or OCSP, do so */
2797 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2798 # ifndef DISABLE_OCSP
2799 if (!(state->verify_stack = sk_X509_new_null()))
2801 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2806 if (!host) /* server */
2808 # ifndef DISABLE_OCSP
2809 /* We check u_ocsp.server.file, not server.olist, because we care about if
2810 the option exists, not what the current expansion might be, as SNI might
2811 change the certificate and OCSP file in use between now and the time the
2812 callback is invoked. */
2813 if (state->u_ocsp.server.file)
2815 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2816 SSL_CTX_set_tlsext_status_arg(ctx, state);
2819 /* We always do this, so that $tls_sni is available even if not used in
2821 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2822 SSL_CTX_set_tlsext_servername_arg(ctx, state);
2824 # ifdef EXIM_HAVE_ALPN
2825 if (tls_alpn && *tls_alpn)
2828 if ( expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr)
2829 && *exp_alpn && !isblank(*exp_alpn))
2831 tls_alpn = exp_alpn; /* subprocess so ok to overwrite */
2832 SSL_CTX_set_alpn_select_cb(ctx, tls_server_alpn_cb, state);
2839 # ifndef DISABLE_OCSP
2841 if(ocsp_file) /* wanting stapling */
2843 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
2845 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2848 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2849 SSL_CTX_set_tlsext_status_arg(ctx, state);
2854 state->verify_cert_hostnames = NULL;
2856 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
2857 /* Set up the RSA callback */
2858 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
2861 /* Finally, set the session cache timeout, and we are done.
2862 The period appears to be also used for (server-generated) session tickets */
2864 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
2865 DEBUG(D_tls) debug_printf("Initialized TLS\n");
2867 *caller_state = state;
2875 /*************************************************
2876 * Get name of cipher in use *
2877 *************************************************/
2880 Argument: pointer to an SSL structure for the connection
2881 pointer to number of bits for cipher
2882 Returns: pointer to allocated string in perm-pool
2886 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
2888 int pool = store_pool;
2889 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
2890 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2891 the accessor functions use const in the prototype. */
2893 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
2896 SSL_CIPHER_get_bits(c, bits);
2898 store_pool = POOL_PERM;
2899 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2901 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2906 /* Get IETF-standard name for ciphersuite.
2907 Argument: pointer to an SSL structure for the connection
2908 Returns: pointer to string
2911 static const uschar *
2912 cipher_stdname_ssl(SSL * ssl)
2914 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2915 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2917 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2918 return cipher_stdname(id >> 8, id & 0xff);
2923 static const uschar *
2924 tlsver_name(SSL * ssl)
2927 int pool = store_pool;
2929 store_pool = POOL_PERM;
2930 s = string_copy(US SSL_get_version(ssl));
2932 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
2933 for (;; p++) if (!(*p = p[1])) break;
2939 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
2941 /*XXX we might consider a list-of-certs variable for the cert chain.
2942 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2943 in list-handling functions, also consider the difference between the entire
2944 chain and the elements sent by the peer. */
2946 tlsp->peerdn = NULL;
2948 /* Will have already noted peercert on a verify fail; possibly not the leaf */
2949 if (!tlsp->peercert)
2950 tlsp->peercert = SSL_get_peer_certificate(ssl);
2951 /* Beware anonymous ciphers which lead to server_cert being NULL */
2953 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2954 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2957 int oldpool = store_pool;
2959 peerdn[siz-1] = '\0'; /* paranoia */
2960 store_pool = POOL_PERM;
2961 tlsp->peerdn = string_copy(peerdn);
2962 store_pool = oldpool;
2964 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2965 but they don't get called on session-resumption. So use the official
2966 interface, which uses the resumed value. Unfortunately this claims verified
2967 when it actually failed but we're in try-verify mode, due to us wanting the
2968 knowlege that it failed so needing to have the callback and forcing a
2969 permissive return. If we don't force it, the TLS startup is failed.
2970 The extra bit of information is set in verify_override in the cb, stashed
2971 for resumption next to the TLS session, and used here. */
2973 if (!tlsp->verify_override)
2974 tlsp->certificate_verified =
2976 tlsp->dane_verified ||
2978 SSL_get_verify_result(ssl) == X509_V_OK;
2986 /*************************************************
2987 * Set up for verifying certificates *
2988 *************************************************/
2990 #ifndef DISABLE_OCSP
2991 /* Load certs from file, return TRUE on success */
2994 chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
2997 STACK_OF(X509) * verify_stack = *vp;
3000 while (sk_X509_num(verify_stack) > 0)
3001 X509_free(sk_X509_pop(verify_stack));
3003 verify_stack = sk_X509_new_null();
3005 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
3006 for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
3007 sk_X509_push(verify_stack, x);
3016 /* Called by both client and server startup; on the server possibly
3017 repeated after a Server Name Indication.
3020 sctx SSL_CTX* to initialise
3021 certs certs file, expanded
3022 crl CRL file or NULL
3023 host NULL in a server; the remote host in a client
3024 errstr error string pointer
3026 Returns: OK/DEFER/FAIL
3030 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
3033 uschar *expcerts, *expcrl;
3035 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
3037 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3039 if (expcerts && *expcerts)
3041 /* Tell the library to use its compiled-in location for the system default
3042 CA bundle. Then add the ones specified in the config, if any. */
3044 if (!SSL_CTX_set_default_verify_paths(sctx))
3045 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
3047 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
3049 struct stat statbuf;
3051 if (Ustat(expcerts, &statbuf) < 0)
3053 log_write(0, LOG_MAIN|LOG_PANIC,
3054 "failed to stat %s for certificates", expcerts);
3060 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
3061 { file = NULL; dir = expcerts; }
3064 STACK_OF(X509) * verify_stack =
3065 #ifndef DISABLE_OCSP
3066 !host ? state_server.verify_stack :
3069 STACK_OF(X509) ** vp = &verify_stack;
3071 file = expcerts; dir = NULL;
3072 #ifndef DISABLE_OCSP
3073 /* In the server if we will be offering an OCSP proof, load chain from
3074 file for verifying the OCSP proof at load time. */
3076 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
3077 This is inconsistent with the need to verify the OCSP proof of the server cert.
3080 && statbuf.st_size > 0
3081 && state_server.u_ocsp.server.file
3082 && !chain_from_pem_file(file, vp)
3085 log_write(0, LOG_MAIN|LOG_PANIC,
3086 "failed to load cert chain from %s", file);
3092 /* If a certificate file is empty, the load function fails with an
3093 unhelpful error message. If we skip it, we get the correct behaviour (no
3094 certificates are recognized, but the error message is still misleading (it
3095 says no certificate was supplied). But this is better. */
3097 if ( (!file || statbuf.st_size > 0)
3098 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
3099 return tls_error(US"SSL_CTX_load_verify_locations",
3100 host, NULL, errstr);
3102 /* On the server load the list of CAs for which we will accept certs, for
3103 sending to the client. This is only for the one-file
3104 tls_verify_certificates variant.
3105 If a list isn't loaded into the server, but some verify locations are set,
3106 the server end appears to make a wildcard request for client certs.
3107 Meanwhile, the client library as default behaviour *ignores* the list
3108 we send over the wire - see man SSL_CTX_set_client_cert_cb.
3109 Because of this, and that the dir variant is likely only used for
3110 the public-CA bundle (not for a private CA), not worth fixing. */
3114 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
3115 int i = sk_X509_NAME_num(names);
3117 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
3118 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
3119 i, i>1 ? "ies":"y");
3123 debug_printf("Added dir for additional certificate authorities\n");
3127 /* Handle a certificate revocation list. */
3129 #if OPENSSL_VERSION_NUMBER > 0x00907000L
3131 /* This bit of code is now the version supplied by Lars Mainka. (I have
3132 merely reformatted it into the Exim code style.)
3134 "From here I changed the code to add support for multiple crl's
3135 in pem format in one file or to support hashed directory entries in
3136 pem format instead of a file. This method now uses the library function
3137 X509_STORE_load_locations to add the CRL location to the SSL context.
3138 OpenSSL will then handle the verify against CA certs and CRLs by
3139 itself in the verify callback." */
3141 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
3142 if (expcrl && *expcrl)
3144 struct stat statbufcrl;
3145 if (Ustat(expcrl, &statbufcrl) < 0)
3147 log_write(0, LOG_MAIN|LOG_PANIC,
3148 "failed to stat %s for certificates revocation lists", expcrl);
3153 /* is it a file or directory? */
3155 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
3156 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
3160 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
3166 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
3168 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
3169 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
3171 /* setting the flags to check against the complete crl chain */
3173 X509_STORE_set_flags(cvstore,
3174 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
3178 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3187 tls_dump_keylog(SSL * ssl)
3189 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3190 BIO * bp = BIO_new(BIO_s_mem());
3193 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3194 len = (int) BIO_get_mem_data(bp, CSS &s);
3195 if (len > 0) debug_printf("%.*s", len, s);
3201 /* Channel-binding info for authenticators
3202 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/
3207 tls_get_channel_binding(SSL * ssl, tls_support * tlsp, const void * taintval)
3212 #ifdef EXIM_HAVE_EXPORT_CHNL_BNGNG
3213 if (SSL_version(ssl) > TLS1_2_VERSION)
3215 /* It's not documented by OpenSSL how big the output buffer must be.
3216 The OpenSSL testcases use 80 bytes but don't say why. The GnuTLS impl only
3217 serves out 32B. RFC 9266 says it is 32B.
3218 Interop fails unless we use the same each end. */
3221 tlsp->channelbind_exporter = TRUE;
3222 taintval = GET_UNTAINTED;
3223 if (SSL_export_keying_material(ssl,
3224 s = store_get((int)len, taintval), len,
3225 "EXPORTER-Channel-Binding", (size_t) 24,
3232 len = SSL_get_peer_finished(ssl, &c, 0);
3233 len = SSL_get_peer_finished(ssl, s = store_get((int)len, taintval), len);
3238 int old_pool = store_pool;
3239 store_pool = POOL_PERM;
3240 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, taintval);
3241 store_pool = old_pool;
3242 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
3247 /*************************************************
3248 * Start a TLS session in a server *
3249 *************************************************/
3250 /* This is called when Exim is running as a server, after having received
3251 the STARTTLS command. It must respond to that command, and then negotiate
3255 errstr pointer to error message
3257 Returns: OK on success
3258 DEFER for errors before the start of the negotiation
3259 FAIL for errors during the negotiation; the server can't
3264 tls_server_start(uschar ** errstr)
3267 uschar * expciphers;
3268 exim_openssl_state_st * dummy_statep;
3271 static uschar peerdn[256];
3273 /* Check for previous activation */
3275 if (tls_in.active.sock >= 0)
3277 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3278 smtp_printf("554 Already in TLS\r\n", FALSE);
3282 /* Initialize the SSL library. If it fails, it will already have logged
3285 rc = tls_init(NULL, NULL,
3286 #ifndef DISABLE_OCSP
3289 NULL, &dummy_statep, &tls_in, errstr);
3290 if (rc != OK) return rc;
3291 ctx = state_server.lib_state.lib_ctx;
3293 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3294 were historically separated by underscores. So that I can use either form in my
3295 tests, and also for general convenience, we turn underscores into hyphens here.
3297 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3298 for TLS 1.3 . Since we do not call it at present we get the default list:
3299 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3302 if (state_server.lib_state.pri_string)
3303 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3306 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3311 normalise_ciphers(&expciphers, tls_require_ciphers);
3312 if ((rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3317 /* If this is a host for which certificate verification is mandatory or
3318 optional, set up appropriately. */
3320 tls_in.certificate_verified = FALSE;
3322 tls_in.dane_verified = FALSE;
3324 server_verify_callback_called = FALSE;
3326 if (verify_check_host(&tls_verify_hosts) == OK)
3327 server_verify_optional = FALSE;
3328 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3329 server_verify_optional = TRUE;
3335 if (!expand_check(tls_verify_certificates, US"tls_verify_certificates",
3338 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3340 if (state_server.lib_state.cabundle)
3341 { DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n"); }
3343 if ((rc = setup_certs(ctx, expcerts, tls_crl, NULL, errstr)) != OK)
3346 if (expcerts && *expcerts)
3347 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3351 #ifndef DISABLE_TLS_RESUME
3352 # if OPENSSL_VERSION_NUMBER < 0x30000000L
3353 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3354 /* despite working, appears to always return failure, so ignoring */
3356 SSL_CTX_set_tlsext_ticket_key_evp_cb(ctx, ticket_key_callback);
3357 /* despite working, appears to always return failure, so ignoring */
3361 #ifdef OPENSSL_HAVE_NUM_TICKETS
3362 # ifndef DISABLE_TLS_RESUME
3363 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3365 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3370 /* Prepare for new connection */
3372 if (!(ssl = SSL_new(ctx)))
3373 return tls_error(US"SSL_new", NULL, NULL, errstr);
3374 state_server.lib_state.lib_ssl = ssl;
3376 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3378 * With the SSL_clear(), we get strange interoperability bugs with
3379 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3380 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3382 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3383 * session shutdown. In this case, we have a brand new object and there's no
3384 * obvious reason to immediately clear it. I'm guessing that this was
3385 * originally added because of incomplete initialisation which the clear fixed,
3386 * in some historic release.
3389 /* Set context and tell client to go ahead, except in the case of TLS startup
3390 on connection, where outputting anything now upsets the clients and tends to
3391 make them disconnect. We need to have an explicit fflush() here, to force out
3392 the response. Other smtp_printf() calls do not need it, because in non-TLS
3393 mode, the fflush() happens when smtp_getc() is called. */
3395 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3396 if (!tls_in.on_connect)
3398 smtp_printf("220 TLS go ahead\r\n", FALSE);
3402 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3403 that the OpenSSL library doesn't. */
3405 SSL_set_wfd(ssl, fileno(smtp_out));
3406 SSL_set_rfd(ssl, fileno(smtp_in));
3407 SSL_set_accept_state(ssl);
3409 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3412 sigalrm_seen = FALSE;
3413 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3414 rc = SSL_accept(ssl);
3419 int error = SSL_get_error(ssl, rc);
3422 case SSL_ERROR_NONE:
3425 case SSL_ERROR_ZERO_RETURN:
3426 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3427 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3428 #ifndef DISABLE_EVENT
3429 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3431 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3434 tls_close(NULL, TLS_NO_SHUTDOWN);
3437 /* Handle genuine errors */
3441 int r = ERR_GET_REASON(ERR_peek_error());
3442 if ( r == SSL_R_WRONG_VERSION_NUMBER
3443 #ifdef SSL_R_VERSION_TOO_LOW
3444 || r == SSL_R_VERSION_TOO_LOW
3446 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3447 s = string_sprintf("(%s)", SSL_get_version(ssl));
3448 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
3449 #ifndef DISABLE_EVENT
3450 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3456 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3457 if (error == SSL_ERROR_SYSCALL)
3461 *errstr = US"SSL_accept: TCP connection closed by peer";
3462 #ifndef DISABLE_EVENT
3463 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3467 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3469 (void) tls_error(US"SSL_accept", NULL,
3470 sigalrm_seen ? US"timed out"
3471 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3473 #ifndef DISABLE_EVENT
3474 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3480 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3481 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3482 anon-authentication ciphersuite negotiated. */
3484 #ifndef DISABLE_TLS_RESUME
3485 if (SSL_session_reused(ssl))
3487 tls_in.resumption |= RESUME_USED;
3488 DEBUG(D_tls) debug_printf("Session reused\n");
3492 #ifdef EXIM_HAVE_ALPN
3493 /* If require-alpn, check server_seen_alpn here. Else abort TLS */
3494 if (!tls_alpn || !*tls_alpn)
3495 { DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n"); }
3496 else if (!server_seen_alpn)
3497 if (verify_check_host(&hosts_require_alpn) == OK)
3499 /* We'd like to send a definitive Alert but OpenSSL provides no facility */
3501 tls_error(US"handshake", NULL, US"ALPN required but not negotiated", errstr);
3505 { DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n"); }
3508 const uschar * name;
3510 SSL_get0_alpn_selected(ssl, &name, &len);
3512 debug_printf("ALPN negotiated: '%.*s'\n", (int)*name, name+1);
3514 debug_printf("ALPN: no protocol negotiated\n");
3519 /* TLS has been set up. Record data for the connection,
3520 adjust the input functions to read via TLS, and initialize things. */
3522 #ifdef SSL_get_extms_support
3523 /*XXX what does this return for tls1.3 ? */
3524 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3526 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3528 tls_in.ver = tlsver_name(ssl);
3529 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3530 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3535 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3536 debug_printf("Shared ciphers: %s\n", buf);
3538 tls_dump_keylog(ssl);
3540 #ifdef EXIM_HAVE_SESSION_TICKET
3542 SSL_SESSION * ss = SSL_get_session(ssl);
3543 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3544 debug_printf("The session has a ticket, life %lu seconds\n",
3545 SSL_SESSION_get_ticket_lifetime_hint(ss));
3550 /* Record the certificate we presented */
3552 X509 * crt = SSL_get_certificate(ssl);
3553 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3556 tls_get_channel_binding(ssl, &tls_in, GET_UNTAINTED);
3558 /* Only used by the server-side tls (tls_in), including tls_getc.
3559 Client-side (tls_out) reads (seem to?) go via
3560 smtp_read_response()/ip_recv().
3561 Hence no need to duplicate for _in and _out.
3563 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3564 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3565 ssl_xfer_eof = ssl_xfer_error = FALSE;
3567 receive_getc = tls_getc;
3568 receive_getbuf = tls_getbuf;
3569 receive_get_cache = tls_get_cache;
3570 receive_hasc = tls_hasc;
3571 receive_ungetc = tls_ungetc;
3572 receive_feof = tls_feof;
3573 receive_ferror = tls_ferror;
3575 tls_in.active.sock = fileno(smtp_out);
3576 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3584 tls_client_basic_ctx_init(SSL_CTX * ctx,
3585 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3590 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3591 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3592 host patterns if one of them is set with content. */
3594 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3595 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3597 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3598 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3601 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3603 client_verify_optional = FALSE;
3604 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3605 client_verify_optional = TRUE;
3611 if (!expand_check(ob->tls_verify_certificates, US"tls_verify_certificates",
3614 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3616 if (state->lib_state.cabundle)
3617 { DEBUG(D_tls) debug_printf("TLS: CA bundle was preloaded\n"); }
3619 if ((rc = setup_certs(ctx, expcerts, ob->tls_crl, host, errstr)) != OK)
3622 if (expcerts && *expcerts)
3623 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3626 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3628 state->verify_cert_hostnames =
3630 string_domain_utf8_to_alabel(host->certname, NULL);
3634 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3635 state->verify_cert_hostnames);
3643 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3646 const char * hostnames[2] = { CS host->name, NULL };
3649 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3650 return tls_error(US"hostnames load", host, NULL, errstr);
3652 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3653 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3654 ) if (rr->type == T_TLSA && rr->size > 3)
3656 const uschar * p = rr->data;
3657 uint8_t usage, selector, mtype;
3658 const char * mdname;
3662 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3663 if (usage != 2 && usage != 3) continue;
3670 default: continue; /* Only match-types 0, 1, 2 are supported */
3671 case 0: mdname = NULL; break;
3672 case 1: mdname = "sha256"; break;
3673 case 2: mdname = "sha512"; break;
3677 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3680 return tls_error(US"tlsa load", host, NULL, errstr);
3681 case 0: /* action not taken */
3685 tls_out.tlsa_usage |= 1<<usage;
3691 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3694 #endif /*SUPPORT_DANE*/
3698 #ifndef DISABLE_TLS_RESUME
3699 /* On the client, get any stashed session for the given IP from hints db
3700 and apply it to the ssl-connection for attempted resumption. */
3703 tls_retrieve_session(tls_support * tlsp, SSL * ssl)
3705 if (tlsp->host_resumable)
3707 const uschar * key = tlsp->resume_index;
3708 dbdata_tls_session * dt;
3710 open_db dbblock, * dbm_file;
3712 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3714 debug_printf("checking for resumable session for %s\n", tlsp->resume_index);
3715 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3717 if ((dt = dbfn_read_with_length(dbm_file, tlsp->resume_index, &len)))
3719 SSL_SESSION * ss = NULL;
3720 const uschar * sess_asn1 = dt->session;
3722 len -= sizeof(dbdata_tls_session);
3723 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3727 ERR_error_string_n(ERR_get_error(),
3728 ssl_errstring, sizeof(ssl_errstring));
3729 debug_printf("decoding session: %s\n", ssl_errstring);
3734 unsigned long lifetime =
3735 #ifdef EXIM_HAVE_SESSION_TICKET
3736 SSL_SESSION_get_ticket_lifetime_hint(ss);
3737 #else /* Use, fairly arbitrilarily, what we as server would */
3738 f.running_in_test_harness ? 6 : ssl_session_timeout;
3740 if (lifetime + dt->time_stamp < time(NULL))
3742 DEBUG(D_tls) debug_printf("session expired\n");
3743 dbfn_delete(dbm_file, tlsp->resume_index);
3745 else if (SSL_set_session(ssl, ss))
3747 DEBUG(D_tls) debug_printf("good session\n");
3748 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3749 tlsp->verify_override = dt->verify_override;
3750 tlsp->ocsp = dt->ocsp;
3754 ERR_error_string_n(ERR_get_error(),
3755 ssl_errstring, sizeof(ssl_errstring));
3756 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3761 DEBUG(D_tls) debug_printf("no session record\n");
3762 dbfn_close(dbm_file);
3768 /* On the client, save the session for later resumption */
3771 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3773 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3776 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3778 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3780 # ifdef OPENSSL_HAVE_NUM_TICKETS
3781 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3784 int len = i2d_SSL_SESSION(ss, NULL);
3785 int dlen = sizeof(dbdata_tls_session) + len;
3786 dbdata_tls_session * dt = store_get(dlen, GET_TAINTED);
3787 uschar * s = dt->session;
3788 open_db dbblock, * dbm_file;
3790 DEBUG(D_tls) debug_printf("session is resumable\n");
3791 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3793 dt->verify_override = tlsp->verify_override;
3794 dt->ocsp = tlsp->ocsp;
3795 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3797 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3799 dbfn_write(dbm_file, tlsp->resume_index, dt, dlen);
3800 dbfn_close(dbm_file);
3801 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3809 /* Construct a key for session DB lookup, and setup the SSL_CTX for resumption */
3812 tls_client_ctx_resume_prehandshake(
3813 exim_openssl_client_tls_ctx * exim_client_ctx, smtp_connect_args * conn_args,
3814 tls_support * tlsp, smtp_transport_options_block * ob)
3816 tlsp->host_resumable = TRUE;
3817 tls_client_resmption_key(tlsp, conn_args, ob);
3819 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3820 SSL_SESS_CACHE_CLIENT
3821 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3822 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3826 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3827 host_item * host, uschar ** errstr)
3829 if (tlsp->host_resumable)
3832 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3833 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3835 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3836 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
3838 tls_error(US"set ex_data", host, NULL, errstr);
3841 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state);
3844 tlsp->resumption = RESUME_SUPPORTED;
3845 /* Pick up a previous session, saved on an old ticket */
3846 tls_retrieve_session(tlsp, ssl);
3851 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
3854 if (SSL_session_reused(exim_client_ctx->ssl))
3856 DEBUG(D_tls) debug_printf("The session was reused\n");
3857 tlsp->resumption |= RESUME_USED;
3860 #endif /* !DISABLE_TLS_RESUME */
3863 #ifdef EXIM_HAVE_ALPN
3864 /* Expand and convert an Exim list to an ALPN list. False return for fail.
3865 NULL plist return for silent no-ALPN.
3867 Overwite the passed-in list with the expanded version.
3871 tls_alpn_plist(uschar ** tls_alpn, const uschar ** plist, unsigned * plen,
3876 if (!expand_check(*tls_alpn, US"tls_alpn", &exp_alpn, errstr))
3878 *tls_alpn = exp_alpn;
3882 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
3887 /* The server implementation only accepts exactly one protocol name
3888 but it's little extra code complexity in the client. */
3890 const uschar * list = exp_alpn;
3891 uschar * p = store_get(Ustrlen(exp_alpn), exp_alpn), * s, * t;
3895 for (t = p; s = string_nextinlist(&list, &sep, NULL, 0); t += len)
3897 *t++ = len = (uschar) Ustrlen(s);
3900 *plist = (*plen = t - p) ? p : NULL;
3904 #endif /* EXIM_HAVE_ALPN */
3907 /*************************************************
3908 * Start a TLS session in a client *
3909 *************************************************/
3911 /* Called from the smtp transport after STARTTLS has been accepted.
3914 cctx connection context
3915 conn_args connection details
3916 cookie datum for randomness; can be NULL
3917 tlsp record details of TLS channel configuration here; must be non-NULL
3918 errstr error string pointer
3920 Returns: TRUE for success with TLS session context set in connection context,
3925 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3926 void * cookie, tls_support * tlsp, uschar ** errstr)
3928 host_item * host = conn_args->host; /* for msgs and option-tests */
3929 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3930 smtp_transport_options_block * ob = tb
3931 ? (smtp_transport_options_block *)tb->options_block
3932 : &smtp_transport_option_defaults;
3933 exim_openssl_client_tls_ctx * exim_client_ctx;
3934 uschar * expciphers;
3936 static uschar peerdn[256];
3938 #ifndef DISABLE_OCSP
3939 BOOL request_ocsp = FALSE;
3940 BOOL require_ocsp = FALSE;
3944 store_pool = POOL_PERM;
3945 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), GET_UNTAINTED);
3946 exim_client_ctx->corked = NULL;
3950 tlsp->tlsa_usage = 0;
3953 #ifndef DISABLE_OCSP
3955 # ifdef SUPPORT_DANE
3956 /*XXX this should be moved to caller, to be common across gnutls/openssl */
3957 if ( conn_args->dane
3958 && ob->hosts_request_ocsp[0] == '*'
3959 && ob->hosts_request_ocsp[1] == '\0'
3962 /* Unchanged from default. Use a safer one under DANE */
3963 request_ocsp = TRUE;
3964 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3965 " {= {4}{$tls_out_tlsa_usage}} } "
3971 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
3972 request_ocsp = TRUE;
3974 # ifdef SUPPORT_DANE
3978 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3982 rc = tls_init(host, ob,
3983 #ifndef DISABLE_OCSP
3984 (void *)(long)request_ocsp,
3986 cookie, &client_static_state, tlsp, errstr);
3987 if (rc != OK) return FALSE;
3989 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
3991 tlsp->certificate_verified = FALSE;
3992 client_verify_callback_called = FALSE;
3996 if (conn_args->dane)
3998 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3999 other failures should be treated as problems. */
4000 if (ob->dane_require_tls_ciphers &&
4001 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
4002 &expciphers, errstr))
4004 if (expciphers && *expciphers == '\0')
4007 normalise_ciphers(&expciphers, ob->dane_require_tls_ciphers);
4012 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
4013 &expciphers, errstr))
4016 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
4017 are separated by underscores. So that I can use either form in my tests, and
4018 also for general convenience, we turn underscores into hyphens here. */
4020 normalise_ciphers(&expciphers, ob->tls_require_ciphers);
4025 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
4026 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
4028 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
4034 if (conn_args->dane)
4036 SSL_CTX_set_verify(exim_client_ctx->ctx,
4037 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
4038 verify_callback_client_dane);
4040 if (!DANESSL_library_init())
4042 tls_error(US"library init", host, NULL, errstr);
4045 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
4047 tls_error(US"context init", host, NULL, errstr);
4055 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
4056 client_static_state, errstr) != OK)
4061 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
4064 { DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n"); }
4065 else if (!Ustrlen(tlsp->sni))
4069 #ifndef EXIM_HAVE_OPENSSL_TLSEXT
4070 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
4078 #ifdef EXIM_HAVE_ALPN
4080 const uschar * plist;
4083 if (!tls_alpn_plist(&ob->tls_alpn, &plist, &plen, errstr))
4086 if (SSL_CTX_set_alpn_protos(exim_client_ctx->ctx, plist, plen) != 0)
4088 tls_error(US"alpn init", host, NULL, errstr);
4092 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
4095 log_write(0, LOG_MAIN, "ALPN unusable with this OpenSSL library version; ignoring \"%s\"\n",
4099 #ifndef DISABLE_TLS_RESUME
4100 /*XXX have_lbserver: another cmdline arg possibly, for continued-conn, but use
4101 will be very low. */
4103 if (!conn_args->have_lbserver) /* wanted for tls_client_resmption_key() */
4104 { DEBUG(D_tls) debug_printf("resumption not supported on continued-connection\n"); }
4105 else if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
4106 tls_client_ctx_resume_prehandshake(exim_client_ctx, conn_args, tlsp, ob);
4110 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
4112 tls_error(US"SSL_new", host, NULL, errstr);
4115 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
4116 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
4117 SSL_set_connect_state(exim_client_ctx->ssl);
4119 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
4122 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
4123 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
4128 if (conn_args->dane)
4129 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
4133 #ifndef DISABLE_OCSP
4134 /* Request certificate status at connection-time. If the server
4135 does OCSP stapling we will get the callback (set in tls_init()) */
4136 # ifdef SUPPORT_DANE
4140 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4141 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4143 { /* Re-eval now $tls_out_tlsa_usage is populated. If
4144 this means we avoid the OCSP request, we wasted the setup
4145 cost in tls_init(). */
4146 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
4147 request_ocsp = require_ocsp
4148 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4155 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
4156 client_static_state->u_ocsp.client.verify_required = require_ocsp;
4157 tlsp->ocsp = OCSP_NOT_RESP;
4161 #ifndef DISABLE_TLS_RESUME
4162 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
4167 #ifndef DISABLE_EVENT
4168 client_static_state->event_action = tb ? tb->event_action : NULL;
4171 /* There doesn't seem to be a built-in timeout on connection. */
4173 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
4174 sigalrm_seen = FALSE;
4175 ALARM(ob->command_timeout);
4176 rc = SSL_connect(exim_client_ctx->ssl);
4180 if (conn_args->dane)
4181 DANESSL_cleanup(exim_client_ctx->ssl);
4186 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
4192 debug_printf("SSL_connect succeeded\n");
4193 tls_dump_keylog(exim_client_ctx->ssl);
4196 #ifndef DISABLE_TLS_RESUME
4197 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
4200 #ifdef EXIM_HAVE_ALPN
4201 if (ob->tls_alpn) /* We requested. See what was negotiated. */
4203 const uschar * name;
4206 SSL_get0_alpn_selected(exim_client_ctx->ssl, &name, &len);
4208 { DEBUG(D_tls) debug_printf("ALPN negotiated %u: '%.*s'\n", len, (int)*name, name+1); }
4209 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
4211 /* Would like to send a relevant fatal Alert, but OpenSSL has no API */
4212 tls_error(US"handshake", host, US"ALPN required but not negotiated", errstr);
4218 #ifdef SSL_get_extms_support
4219 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
4221 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
4223 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
4224 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
4225 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
4227 /* Record the certificate we presented */
4229 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
4230 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
4233 /*XXX will this work with continued-TLS? */
4234 tls_get_channel_binding(exim_client_ctx->ssl, tlsp, GET_TAINTED);
4236 tlsp->active.sock = cctx->sock;
4237 tlsp->active.tls_ctx = exim_client_ctx;
4238 cctx->tls_ctx = exim_client_ctx;
4247 tls_refill(unsigned lim)
4249 SSL * ssl = state_server.lib_state.lib_ssl;
4253 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4254 ssl_xfer_buffer, ssl_xfer_buffer_size);
4257 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4258 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
4259 MIN(ssl_xfer_buffer_size, lim));
4260 error = SSL_get_error(ssl, inbytes);
4261 if (smtp_receive_timeout > 0) ALARM_CLR(0);
4263 if (had_command_timeout) /* set by signal handler */
4264 smtp_command_timeout_exit(); /* does not return */
4265 if (had_command_sigterm)
4266 smtp_command_sigterm_exit();
4267 if (had_data_timeout)
4268 smtp_data_timeout_exit();
4269 if (had_data_sigint)
4270 smtp_data_sigint_exit();
4272 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
4273 closed down, not that the socket itself has been closed down. Revert to
4274 non-SSL handling. */
4278 case SSL_ERROR_NONE:
4281 case SSL_ERROR_ZERO_RETURN:
4282 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4284 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
4287 tls_close(NULL, TLS_NO_SHUTDOWN);
4290 /* Handle genuine errors */
4292 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4293 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
4294 ssl_xfer_error = TRUE;
4298 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
4299 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
4300 debug_printf(" - syscall %s\n", strerror(errno));
4301 ssl_xfer_error = TRUE;
4305 #ifndef DISABLE_DKIM
4306 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
4308 ssl_xfer_buffer_hwm = inbytes;
4309 ssl_xfer_buffer_lwm = 0;
4314 /*************************************************
4315 * TLS version of getc *
4316 *************************************************/
4318 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
4319 it refills the buffer via the SSL reading function.
4321 Arguments: lim Maximum amount to read/buffer
4322 Returns: the next character or EOF
4324 Only used by the server-side TLS.
4328 tls_getc(unsigned lim)
4330 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4331 if (!tls_refill(lim))
4332 return ssl_xfer_error ? EOF : smtp_getc(lim);
4334 /* Something in the buffer; return next uschar */
4336 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
4342 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm;
4346 tls_getbuf(unsigned * len)
4351 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4352 if (!tls_refill(*len))
4354 if (!ssl_xfer_error) return smtp_getbuf(len);
4359 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4361 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4362 ssl_xfer_buffer_lwm += size;
4369 tls_get_cache(unsigned lim)
4371 #ifndef DISABLE_DKIM
4372 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4373 debug_printf("tls_get_cache\n");
4377 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4383 tls_could_getc(void)
4385 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4386 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4390 /*************************************************
4391 * Read bytes from TLS channel *
4392 *************************************************/
4396 ct_ctx client context pointer, or NULL for the one global server context
4400 Returns: the number of bytes read
4401 -1 after a failed read, including EOF
4403 Only used by the client-side TLS.
4407 tls_read(void * ct_ctx, uschar *buff, size_t len)
4409 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4410 : state_server.lib_state.lib_ssl;
4414 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4415 buff, (unsigned int)len);
4418 inbytes = SSL_read(ssl, CS buff, len);
4419 error = SSL_get_error(ssl, inbytes);
4421 if (error == SSL_ERROR_ZERO_RETURN)
4423 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4426 else if (error != SSL_ERROR_NONE)
4436 /*************************************************
4437 * Write bytes down TLS channel *
4438 *************************************************/
4442 ct_ctx client context pointer, or NULL for the one global server context
4445 more further data expected soon
4447 Returns: the number of bytes after a successful write,
4448 -1 after a failed write
4450 Used by both server-side and client-side TLS. Calling with len zero and more unset
4451 will flush buffered writes; buff can be null for this case.
4455 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4458 int outbytes, error;
4460 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4461 : state_server.lib_state.lib_ssl;
4462 static gstring * server_corked = NULL;
4463 gstring ** corkedp = ct_ctx
4464 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4465 gstring * corked = *corkedp;
4467 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4468 buff, (unsigned long)len, more ? ", more" : "");
4470 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4471 "more" is notified. This hack is only ok if small amounts are involved AND only
4472 one stream does it, in one context (i.e. no store reset). Currently it is used
4473 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4474 We support callouts done by the server process by using a separate client
4475 context for the stashed information. */
4476 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4477 a store reset there, so use POOL_PERM. */
4478 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4482 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4484 int save_pool = store_pool;
4485 store_pool = POOL_PERM;
4487 corked = string_catn(corked, buff, len);
4489 store_pool = save_pool;
4496 buff = CUS corked->s;
4501 for (int left = len; left > 0;)
4503 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4505 outbytes = SSL_write(ssl, CS buff, left);
4506 error = SSL_get_error(ssl, outbytes);
4507 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4510 case SSL_ERROR_NONE: /* the usual case */
4516 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4517 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4520 case SSL_ERROR_ZERO_RETURN:
4521 log_write(0, LOG_MAIN, "SSL channel closed on write");
4524 case SSL_ERROR_SYSCALL:
4525 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4526 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4527 sender_fullhost ? sender_fullhost : US"<unknown>",
4529 else if (LOGGING(protocol_detail))
4530 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4531 " SMTP response and TLS close\n", sender_host_address);
4533 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4534 " client reset TCP before TLS close\n", sender_host_address);
4538 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4549 ct_ctx client TLS context pointer, or NULL for the one global server context
4553 tls_shutdown_wr(void * ct_ctx)
4555 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4556 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4557 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4560 if (*fdp < 0) return; /* TLS was not active */
4562 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4564 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
4565 rc = SSL_shutdown(*sslp);
4566 if (rc < 0) DEBUG(D_tls)
4568 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4569 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4573 /*************************************************
4574 * Close down a TLS session *
4575 *************************************************/
4577 /* This is also called from within a delivery subprocess forked from the
4578 daemon, to shut down the TLS library, without actually doing a shutdown (which
4579 would tamper with the SSL session in the parent process).
4582 ct_ctx client TLS context pointer, or NULL for the one global server context
4583 do_shutdown 0 no data-flush or TLS close-alert
4584 1 if TLS close-alert is to be sent,
4585 2 if also response to be waited for
4589 Used by both server-side and client-side TLS.
4593 tls_close(void * ct_ctx, int do_shutdown)
4595 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4596 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4597 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4599 if (*fdp < 0) return; /* TLS was not active */
4601 if (do_shutdown > TLS_NO_SHUTDOWN)
4604 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4605 do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
4607 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4609 if ( ( do_shutdown >= TLS_SHUTDOWN_WONLY
4610 || (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4612 && do_shutdown > TLS_SHUTDOWN_NOWAIT
4615 #ifdef EXIM_TCP_CORK
4616 (void) setsockopt(*fdp, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
4619 rc = SSL_shutdown(*sslp); /* wait for response */
4623 if (rc < 0) DEBUG(D_tls)
4625 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4626 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4630 if (!o_ctx) /* server side */
4632 #ifndef DISABLE_OCSP
4633 sk_X509_pop_free(state_server.verify_stack, X509_free);
4634 state_server.verify_stack = NULL;
4637 receive_getc = smtp_getc;
4638 receive_getbuf = smtp_getbuf;
4639 receive_get_cache = smtp_get_cache;
4640 receive_hasc = smtp_hasc;
4641 receive_ungetc = smtp_ungetc;
4642 receive_feof = smtp_feof;
4643 receive_ferror = smtp_ferror;
4644 tls_in.active.tls_ctx = NULL;
4646 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4657 /*************************************************
4658 * Let tls_require_ciphers be checked at startup *
4659 *************************************************/
4661 /* The tls_require_ciphers option, if set, must be something which the
4664 Returns: NULL on success, or error message
4668 tls_validate_require_cipher(void)
4671 uschar * expciphers, * err;
4675 if (!(tls_require_ciphers && *tls_require_ciphers))
4678 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4680 return US"failed to expand tls_require_ciphers";
4682 if (!(expciphers && *expciphers))
4685 normalise_ciphers(&expciphers, tls_require_ciphers);
4688 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4691 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4693 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4695 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4696 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4697 expciphers, ssl_errstring);
4708 /*************************************************
4709 * Report the library versions. *
4710 *************************************************/
4712 /* There have historically been some issues with binary compatibility in
4713 OpenSSL libraries; if Exim (like many other applications) is built against
4714 one version of OpenSSL but the run-time linker picks up another version,
4715 it can result in serious failures, including crashing with a SIGSEGV. So
4716 report the version found by the compiler and the run-time version.
4718 Note: some OS vendors backport security fixes without changing the version
4719 number/string, and the version date remains unchanged. The _build_ date
4720 will change, so we can more usefully assist with version diagnosis by also
4721 reporting the build date.
4723 Arguments: string to append to
4728 tls_version_report(gstring * g)
4730 return string_fmt_append(g,
4731 "Library version: OpenSSL: Compile: %s\n"
4734 OPENSSL_VERSION_TEXT,
4735 SSLeay_version(SSLEAY_VERSION),
4736 SSLeay_version(SSLEAY_BUILT_ON));
4737 /* third line is 38 characters for the %s and the line is 73 chars long;
4738 the OpenSSL output includes a "built on: " prefix already. */
4744 /*************************************************
4745 * Random number generation *
4746 *************************************************/
4748 /* Pseudo-random number generation. The result is not expected to be
4749 cryptographically strong but not so weak that someone will shoot themselves
4750 in the foot using it as a nonce in input in some email header scheme or
4751 whatever weirdness they'll twist this into. The result should handle fork()
4752 and avoid repeating sequences. OpenSSL handles that for us.
4756 Returns a random number in range [0, max-1]
4760 vaguely_random_number(int max)
4764 static pid_t pidlast = 0;
4766 uschar smallbuf[sizeof(r)];
4772 if (pidnow != pidlast)
4774 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
4775 is unique for each thread", this doesn't apparently apply across processes,
4776 so our own warning from vaguely_random_number_fallback() applies here too.
4777 Fix per PostgreSQL. */
4783 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
4787 gettimeofday(&r.tv, NULL);
4790 RAND_seed(US (&r), sizeof(r));
4792 /* We're after pseudo-random, not random; if we still don't have enough data
4793 in the internal PRNG then our options are limited. We could sleep and hope
4794 for entropy to come along (prayer technique) but if the system is so depleted
4795 in the first place then something is likely to just keep taking it. Instead,
4796 we'll just take whatever little bit of pseudo-random we can still manage to
4799 needed_len = sizeof(r);
4800 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4801 asked for a number less than 10. */
4802 for (r = max, i = 0; r; ++i)
4808 #ifdef EXIM_HAVE_RAND_PSEUDO
4809 /* We do not care if crypto-strong */
4810 i = RAND_pseudo_bytes(smallbuf, needed_len);
4812 i = RAND_bytes(smallbuf, needed_len);
4818 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
4819 return vaguely_random_number_fallback(max);
4823 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4826 /* We don't particularly care about weighted results; if someone wants
4827 smooth distribution and cares enough then they should submit a patch then. */
4834 /*************************************************
4835 * OpenSSL option parse *
4836 *************************************************/
4838 /* Parse one option for tls_openssl_options_parse below
4841 name one option name
4842 value place to store a value for it
4843 Returns success or failure in parsing
4849 tls_openssl_one_option_parse(uschar *name, long *value)
4852 int last = exim_openssl_options_size;
4853 while (last > first)
4855 int middle = (first + last)/2;
4856 int c = Ustrcmp(name, exim_openssl_options[middle].name);
4859 *value = exim_openssl_options[middle].value;
4873 /*************************************************
4874 * OpenSSL option parsing logic *
4875 *************************************************/
4877 /* OpenSSL has a number of compatibility options which an administrator might
4878 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
4879 we look like log_selector.
4882 option_spec the administrator-supplied string of options
4883 results ptr to long storage for the options bitmap
4884 Returns success or failure
4888 tls_openssl_options_parse(uschar *option_spec, long *results)
4891 uschar * exp, * end;
4892 BOOL adding, item_parsed;
4894 /* Server: send no (<= TLS1.2) session tickets */
4895 result = SSL_OP_NO_TICKET;
4897 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
4898 from default because it increases BEAST susceptibility. */
4899 #ifdef SSL_OP_NO_SSLv2
4900 result |= SSL_OP_NO_SSLv2;
4902 #ifdef SSL_OP_NO_SSLv3
4903 result |= SSL_OP_NO_SSLv3;
4905 #ifdef SSL_OP_SINGLE_DH_USE
4906 result |= SSL_OP_SINGLE_DH_USE;
4908 #ifdef SSL_OP_NO_RENEGOTIATION
4909 result |= SSL_OP_NO_RENEGOTIATION;
4918 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
4921 for (uschar * s = exp; *s; /**/)
4923 while (isspace(*s)) ++s;
4926 if (*s != '+' && *s != '-')
4928 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
4929 "+ or - expected but found \"%s\"\n", s);
4932 adding = *s++ == '+';
4933 for (end = s; *end && !isspace(*end); ) end++;
4934 item_parsed = tls_openssl_one_option_parse(string_copyn(s, end-s), &item);
4937 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
4940 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
4941 adding ? "adding to " : "removing from", result, item, s);
4953 #endif /*!MACRO_PREDEF*/
4956 /* End of tls-openssl.c */