1 /* $Cambridge: exim/src/src/tls-openssl.c,v 1.2 2004/11/25 15:29:37 ph10 Exp $ */
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
7 /* Copyright (c) University of Cambridge 1995 - 2004 */
8 /* See the file NOTICE for conditions of use and distribution. */
10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11 library. It is #included into the tls.c file when that library is used. The
12 code herein is based on a patch that was originally contributed by Steve
13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
15 No cryptographic code is included in Exim. All this module does is to call
16 functions from the OpenSSL library. */
21 #include <openssl/lhash.h>
22 #include <openssl/ssl.h>
23 #include <openssl/err.h>
24 #include <openssl/rand.h>
26 /* Structure for collecting random data for seeding. */
28 typedef struct randstuff {
33 /* Local static variables */
35 static BOOL verify_callback_called = FALSE;
36 static const uschar *sid_ctx = US"exim";
38 static SSL_CTX *ctx = NULL;
39 static SSL *ssl = NULL;
41 static char ssl_errstring[256];
43 static int ssl_session_timeout = 200;
44 static BOOL verify_optional = FALSE;
50 /*************************************************
52 *************************************************/
54 /* Called from lots of places when errors occur before actually starting to do
55 the TLS handshake, that is, while the session is still in clear. Always returns
56 DEFER for a server and FAIL for a client so that most calls can use "return
57 tls_error(...)" to do this processing and then give an appropriate return. A
58 single function is used for both server and client, because it is called from
59 some shared functions.
62 prefix text to include in the logged error
63 host NULL if setting up a server;
64 the connected host if setting up a client
66 Returns: OK/DEFER/FAIL
70 tls_error(uschar *prefix, host_item *host)
72 ERR_error_string(ERR_get_error(), ssl_errstring);
75 log_write(0, LOG_MAIN, "TLS error on connection from %s (%s): %s",
76 (sender_fullhost != NULL)? sender_fullhost : US"local process",
77 prefix, ssl_errstring);
82 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s): %s",
83 host->name, host->address, prefix, ssl_errstring);
90 /*************************************************
91 * Callback to generate RSA key *
92 *************************************************/
100 Returns: pointer to generated key
104 rsa_callback(SSL *s, int export, int keylength)
107 export = export; /* Shut picky compilers up */
108 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
109 rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
112 ERR_error_string(ERR_get_error(), ssl_errstring);
113 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
123 /*************************************************
124 * Callback for verification *
125 *************************************************/
127 /* The SSL library does certificate verification if set up to do so. This
128 callback has the current yes/no state is in "state". If verification succeeded,
129 we set up the tls_peerdn string. If verification failed, what happens depends
130 on whether the client is required to present a verifiable certificate or not.
132 If verification is optional, we change the state to yes, but still log the
133 verification error. For some reason (it really would help to have proper
134 documentation of OpenSSL), this callback function then gets called again, this
135 time with state = 1. In fact, that's useful, because we can set up the peerdn
136 value, but we must take care not to set the private verified flag on the second
139 Note: this function is not called if the client fails to present a certificate
140 when asked. We get here only if a certificate has been received. Handling of
141 optional verification for this case is done when requesting SSL to verify, by
142 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
145 state current yes/no state as 1/0
146 x509ctx certificate information.
148 Returns: 1 if verified, 0 if not
152 verify_callback(int state, X509_STORE_CTX *x509ctx)
154 static uschar txt[256];
156 X509_NAME_oneline(X509_get_subject_name(x509ctx->current_cert),
157 CS txt, sizeof(txt));
161 log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
162 x509ctx->error_depth,
163 X509_verify_cert_error_string(x509ctx->error),
165 tls_certificate_verified = FALSE;
166 verify_callback_called = TRUE;
167 if (!verify_optional) return 0; /* reject */
168 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
169 "tls_try_verify_hosts)\n");
170 return 1; /* accept */
173 if (x509ctx->error_depth != 0)
175 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d cert=%s\n",
176 x509ctx->error_depth, txt);
180 DEBUG(D_tls) debug_printf("SSL%s peer: %s\n",
181 verify_callback_called? "" : " authenticated", txt);
186 debug_printf("+++verify_callback_called=%d\n", verify_callback_called);
188 if (!verify_callback_called) tls_certificate_verified = TRUE;
189 verify_callback_called = TRUE;
191 return 1; /* accept */
196 /*************************************************
197 * Information callback *
198 *************************************************/
200 /* The SSL library functions call this from time to time to indicate what they
201 are doing. We copy the string to the debugging output when the level is high
213 info_callback(SSL *s, int where, int ret)
217 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
222 /*************************************************
223 * Initialize for DH *
224 *************************************************/
226 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
229 dhparam DH parameter file
231 Returns: TRUE if OK (nothing to set up, or setup worked)
235 init_dh(uschar *dhparam)
242 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
245 if (dhexpanded == NULL) return TRUE;
247 if ((bio = BIO_new_file(CS dhexpanded, "r")) == NULL)
249 log_write(0, LOG_MAIN, "DH: could not read %s: %s", dhexpanded,
255 if ((dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)) == NULL)
257 log_write(0, LOG_MAIN, "DH: could not load params from %s",
263 SSL_CTX_set_tmp_dh(ctx, dh);
265 debug_printf("Diffie-Hellman initialized from %s with %d-bit key\n",
266 dhexpanded, 8*DH_size(dh));
278 /*************************************************
279 * Initialize for TLS *
280 *************************************************/
282 /* Called from both server and client code, to do preliminary initialization of
286 host connected host, if client; NULL if server
287 dhparam DH parameter file
288 certificate certificate file
289 privatekey private key
290 addr address if client; NULL if server (for some randomness)
292 Returns: OK/DEFER/FAIL
296 tls_init(host_item *host, uschar *dhparam, uschar *certificate, uschar *privatekey,
299 SSL_load_error_strings(); /* basic set up */
300 OpenSSL_add_ssl_algorithms();
302 /* Create a context */
304 ctx = SSL_CTX_new((host == NULL)?
305 SSLv23_server_method() : SSLv23_client_method());
307 if (ctx == NULL) return tls_error(US"SSL_CTX_new", host);
309 /* It turns out that we need to seed the random number generator this early in
310 order to get the full complement of ciphers to work. It took me roughly a day
311 of work to discover this by experiment.
313 On systems that have /dev/urandom, SSL may automatically seed itself from
314 there. Otherwise, we have to make something up as best we can. Double check
323 RAND_seed((uschar *)(&r), sizeof(r));
324 RAND_seed((uschar *)big_buffer, big_buffer_size);
325 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
331 log_write(0, LOG_MAIN, "TLS error on connection from %s: "
332 "unable to seed random number generator",
333 (sender_fullhost != NULL)? sender_fullhost : US"local process");
338 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s]: "
339 "unable to seed random number generator",
340 host->name, host->address);
346 /* Set up the information callback, which outputs if debugging is at a suitable
349 if (!(SSL_CTX_set_info_callback(ctx, (void (*)())info_callback)))
350 return tls_error(US"SSL_CTX_set_info_callback", host);
352 /* The following patch was supplied by Robert Roselius */
354 #if OPENSSL_VERSION_NUMBER > 0x00906040L
355 /* Enable client-bug workaround.
356 Versions of OpenSSL as of 0.9.6d include a "CBC countermeasure" feature,
357 which causes problems with some clients (such as the Certicom SSL Plus
358 library used by Eudora). This option, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS,
359 disables the coutermeasure allowing Eudora to connect.
360 Some poppers and MTAs use SSL_OP_ALL, which enables all such bug
362 /* XXX (Silently?) ignore failure here? XXX*/
364 if (!(SSL_CTX_set_options(ctx, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)))
365 return tls_error(US"SSL_CTX_set_option", host);
368 /* Initialize with DH parameters if supplied */
370 if (!init_dh(dhparam)) return DEFER;
372 /* Set up certificate and key */
374 if (certificate != NULL)
377 if (!expand_check(certificate, US"tls_certificate", &expanded))
380 if (expanded != NULL)
382 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
383 if (!SSL_CTX_use_certificate_chain_file(ctx, CS expanded))
384 return tls_error(string_sprintf(
385 "SSL_CTX_use_certificate_chain_file file=%s", expanded), host);
388 if (privatekey != NULL &&
389 !expand_check(privatekey, US"tls_privatekey", &expanded))
392 if (expanded != NULL)
394 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
395 if (!SSL_CTX_use_PrivateKey_file(ctx, CS expanded, SSL_FILETYPE_PEM))
396 return tls_error(string_sprintf(
397 "SSL_CTX_use_PrivateKey_file file=%s", expanded), host);
401 /* Set up the RSA callback */
403 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
405 /* Finally, set the timeout, and we are done */
407 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
408 DEBUG(D_tls) debug_printf("Initialized TLS\n");
415 /*************************************************
416 * Get name of cipher in use *
417 *************************************************/
419 /* The answer is left in a static buffer, and tls_cipher is set to point
422 Argument: pointer to an SSL structure for the connection
427 construct_cipher_name(SSL *ssl)
429 static uschar cipherbuf[256];
434 switch (ssl->session->ssl_version)
452 c = SSL_get_current_cipher(ssl);
453 SSL_CIPHER_get_bits(c, &bits);
455 string_format(cipherbuf, sizeof(cipherbuf), "%s:%s:%u", ver,
456 SSL_CIPHER_get_name(c), bits);
457 tls_cipher = cipherbuf;
459 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
466 /*************************************************
467 * Set up for verifying certificates *
468 *************************************************/
470 /* Called by both client and server startup
473 certs certs file or NULL
475 host NULL in a server; the remote host in a client
476 optional TRUE if called from a server for a host in tls_try_verify_hosts;
477 otherwise passed as FALSE
479 Returns: OK/DEFER/FAIL
483 setup_certs(uschar *certs, uschar *crl, host_item *host, BOOL optional)
485 uschar *expcerts, *expcrl;
487 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
490 if (expcerts != NULL)
493 if (!SSL_CTX_set_default_verify_paths(ctx))
494 return tls_error(US"SSL_CTX_set_default_verify_paths", host);
496 if (Ustat(expcerts, &statbuf) < 0)
498 log_write(0, LOG_MAIN|LOG_PANIC,
499 "failed to stat %s for certificates", expcerts);
505 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
506 { file = NULL; dir = expcerts; }
508 { file = expcerts; dir = NULL; }
510 /* If a certificate file is empty, the next function fails with an
511 unhelpful error message. If we skip it, we get the correct behaviour (no
512 certificates are recognized, but the error message is still misleading (it
513 says no certificate was supplied.) But this is better. */
515 if ((file == NULL || statbuf.st_size > 0) &&
516 !SSL_CTX_load_verify_locations(ctx, CS file, CS dir))
517 return tls_error(US"SSL_CTX_load_verify_locations", host);
521 SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(CS file));
525 /* Handle a certificate revocation list. */
527 #if OPENSSL_VERSION_NUMBER > 0x00907000L
529 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
530 if (expcrl != NULL && *expcrl != 0)
536 cvstore = SSL_CTX_get_cert_store(ctx); /* cert validation store */
538 crl_bio = BIO_new(BIO_s_file_internal());
541 if (BIO_read_filename(crl_bio, expcrl))
543 crl_x509 = PEM_read_bio_X509_CRL(crl_bio, NULL, NULL, NULL);
545 X509_STORE_add_crl(cvstore, crl_x509);
546 X509_CRL_free(crl_x509);
547 X509_STORE_set_flags(cvstore,
548 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
553 return tls_error(US"BIO_read_filename", host);
556 else return tls_error(US"BIO_new", host);
559 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
561 /* If verification is optional, don't fail if no certificate */
563 SSL_CTX_set_verify(ctx,
564 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
573 /*************************************************
574 * Start a TLS session in a server *
575 *************************************************/
577 /* This is called when Exim is running as a server, after having received
578 the STARTTLS command. It must respond to that command, and then negotiate
582 require_ciphers allowed ciphers
584 Returns: OK on success
585 DEFER for errors before the start of the negotiation
586 FAIL for errors during the negotation; the server can't
591 tls_server_start(uschar *require_ciphers)
596 /* Check for previous activation */
600 log_write(0, LOG_MAIN, "STARTTLS received in already encrypted "
601 "connection from %s",
602 (sender_fullhost != NULL)? sender_fullhost : US"local process");
603 smtp_printf("554 Already in TLS\r\n");
607 /* Initialize the SSL library. If it fails, it will already have logged
610 rc = tls_init(NULL, tls_dhparam, tls_certificate, tls_privatekey, NULL);
611 if (rc != OK) return rc;
613 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
616 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
617 are separated by underscores. So that I can use either form in my tests, and
618 also for general convenience, we turn underscores into hyphens here. */
620 if (expciphers != NULL)
622 uschar *s = expciphers;
623 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
624 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
625 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
626 return tls_error(US"SSL_CTX_set_cipher_list", NULL);
629 /* If this is a host for which certificate verification is mandatory or
630 optional, set up appropriately. */
632 tls_certificate_verified = FALSE;
633 verify_callback_called = FALSE;
635 if (verify_check_host(&tls_verify_hosts) == OK)
637 rc = setup_certs(tls_verify_certificates, tls_crl, NULL, FALSE);
638 if (rc != OK) return rc;
639 verify_optional = FALSE;
641 else if (verify_check_host(&tls_try_verify_hosts) == OK)
643 rc = setup_certs(tls_verify_certificates, tls_crl, NULL, TRUE);
644 if (rc != OK) return rc;
645 verify_optional = TRUE;
648 /* Prepare for new connection */
650 if ((ssl = SSL_new(ctx)) == NULL) return tls_error(US"SSL_new", NULL);
653 /* Set context and tell client to go ahead, except in the case of TLS startup
654 on connection, where outputting anything now upsets the clients and tends to
655 make them disconnect. We need to have an explicit fflush() here, to force out
656 the response. Other smtp_printf() calls do not need it, because in non-TLS
657 mode, the fflush() happens when smtp_getc() is called. */
659 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
662 smtp_printf("220 TLS go ahead\r\n");
666 /* Now negotiate the TLS session. We put our own timer on it, since it seems
667 that the OpenSSL library doesn't. */
669 SSL_set_fd(ssl, fileno(smtp_out));
670 SSL_set_accept_state(ssl);
672 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
674 sigalrm_seen = FALSE;
675 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
676 rc = SSL_accept(ssl);
681 if (sigalrm_seen) Ustrcpy(ssl_errstring, "timed out");
682 else ERR_error_string(ERR_get_error(), ssl_errstring);
683 log_write(0, LOG_MAIN, "TLS error on connection from %s (SSL_accept): %s",
684 (sender_fullhost != NULL)? sender_fullhost : US"local process",
689 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
691 /* TLS has been set up. Adjust the input functions to read via TLS,
692 and initialize things. */
694 construct_cipher_name(ssl);
699 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)) != NULL)
700 debug_printf("Shared ciphers: %s\n", buf);
704 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
705 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
706 ssl_xfer_eof = ssl_xfer_error = 0;
708 receive_getc = tls_getc;
709 receive_ungetc = tls_ungetc;
710 receive_feof = tls_feof;
711 receive_ferror = tls_ferror;
713 tls_active = fileno(smtp_out);
721 /*************************************************
722 * Start a TLS session in a client *
723 *************************************************/
725 /* Called from the smtp transport after STARTTLS has been accepted.
728 fd the fd of the connection
729 host connected host (for messages)
730 dhparam DH parameter file
731 certificate certificate file
732 privatekey private key file
733 verify_certs file for certificate verify
734 crl file containing CRL
735 require_ciphers list of allowed ciphers
737 Returns: OK on success
738 FAIL otherwise - note that tls_error() will not give DEFER
739 because this is not a server
743 tls_client_start(int fd, host_item *host, address_item *addr, uschar *dhparam,
744 uschar *certificate, uschar *privatekey, uschar *verify_certs, uschar *crl,
745 uschar *require_ciphers, int timeout)
747 static uschar txt[256];
752 rc = tls_init(host, dhparam, certificate, privatekey, addr);
753 if (rc != OK) return rc;
755 tls_certificate_verified = FALSE;
756 verify_callback_called = FALSE;
758 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
761 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
762 are separated by underscores. So that I can use either form in my tests, and
763 also for general convenience, we turn underscores into hyphens here. */
765 if (expciphers != NULL)
767 uschar *s = expciphers;
768 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
769 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
770 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
771 return tls_error(US"SSL_CTX_set_cipher_list", host);
774 rc = setup_certs(verify_certs, crl, host, FALSE);
775 if (rc != OK) return rc;
777 if ((ssl = SSL_new(ctx)) == NULL) return tls_error(US"SSL_new", host);
778 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
780 SSL_set_connect_state(ssl);
782 /* There doesn't seem to be a built-in timeout on connection. */
784 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
785 sigalrm_seen = FALSE;
787 rc = SSL_connect(ssl);
794 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s]: "
795 "SSL_connect timed out", host->name, host->address);
798 else return tls_error(US"SSL_connect", host);
801 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
803 server_cert = SSL_get_peer_certificate (ssl);
804 tls_peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
805 CS txt, sizeof(txt));
808 construct_cipher_name(ssl); /* Sets tls_cipher */
818 /*************************************************
819 * TLS version of getc *
820 *************************************************/
822 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
823 it refills the buffer via the SSL reading function.
826 Returns: the next character or EOF
832 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
837 DEBUG(D_tls) debug_printf("Calling SSL_read(%lx, %lx, %u)\n", (long)ssl,
838 (long)ssl_xfer_buffer, ssl_xfer_buffer_size);
840 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
841 inbytes = SSL_read(ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
842 error = SSL_get_error(ssl, inbytes);
845 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
846 closed down, not that the socket itself has been closed down. Revert to
849 if (error == SSL_ERROR_ZERO_RETURN)
851 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
853 receive_getc = smtp_getc;
854 receive_ungetc = smtp_ungetc;
855 receive_feof = smtp_feof;
856 receive_ferror = smtp_ferror;
867 /* Handle genuine errors */
869 else if (error != SSL_ERROR_NONE)
871 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
876 ssl_xfer_buffer_hwm = inbytes;
877 ssl_xfer_buffer_lwm = 0;
880 /* Something in the buffer; return next uschar */
882 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
887 /*************************************************
888 * Read bytes from TLS channel *
889 *************************************************/
896 Returns: the number of bytes read
897 -1 after a failed read
901 tls_read(uschar *buff, size_t len)
906 DEBUG(D_tls) debug_printf("Calling SSL_read(%lx, %lx, %u)\n", (long)ssl,
907 (long)buff, (unsigned int)len);
909 inbytes = SSL_read(ssl, CS buff, len);
910 error = SSL_get_error(ssl, inbytes);
912 if (error == SSL_ERROR_ZERO_RETURN)
914 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
917 else if (error != SSL_ERROR_NONE)
929 /*************************************************
930 * Write bytes down TLS channel *
931 *************************************************/
938 Returns: the number of bytes after a successful write,
939 -1 after a failed write
943 tls_write(const uschar *buff, size_t len)
949 DEBUG(D_tls) debug_printf("tls_do_write(%lx, %d)\n", (long)buff, left);
952 DEBUG(D_tls) debug_printf("SSL_write(SSL, %lx, %d)\n", (long)buff, left);
953 outbytes = SSL_write(ssl, CS buff, left);
954 error = SSL_get_error(ssl, outbytes);
955 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
959 ERR_error_string(ERR_get_error(), ssl_errstring);
960 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
968 case SSL_ERROR_ZERO_RETURN:
969 log_write(0, LOG_MAIN, "SSL channel closed on write");
973 log_write(0, LOG_MAIN, "SSL_write error %d", error);
982 /*************************************************
983 * Close down a TLS session *
984 *************************************************/
986 /* This is also called from within a delivery subprocess forked from the
987 daemon, to shut down the TLS library, without actually doing a shutdown (which
988 would tamper with the SSL session in the parent process).
990 Arguments: TRUE if SSL_shutdown is to be called
995 tls_close(BOOL shutdown)
997 if (tls_active < 0) return; /* TLS was not active */
1001 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
1011 /* End of tls-openssl.c */