1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2019 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Portions Copyright (c) The OpenSSL Project 1999 */
11 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
12 library. It is #included into the tls.c file when that library is used. The
13 code herein is based on a patch that was originally contributed by Steve
14 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
16 No cryptographic code is included in Exim. All this module does is to call
17 functions from the OpenSSL library. */
22 #include <openssl/lhash.h>
23 #include <openssl/ssl.h>
24 #include <openssl/err.h>
25 #include <openssl/rand.h>
26 #ifndef OPENSSL_NO_ECDH
27 # include <openssl/ec.h>
30 # include <openssl/ocsp.h>
38 # define EXIM_OCSP_SKEW_SECONDS (300L)
39 # define EXIM_OCSP_MAX_AGE (-1L)
42 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
43 # define EXIM_HAVE_OPENSSL_TLSEXT
45 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
46 # define EXIM_HAVE_RSA_GENKEY_EX
48 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
49 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define OPENSSL_AUTO_SHA256
51 # define EXIM_HAVE_ALPN
53 # define EXIM_HAVE_EPHEM_RSA_KEX
54 # define EXIM_HAVE_RAND_PSEUDO
56 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
57 # define EXIM_HAVE_SHA256
60 /* X509_check_host provides sane certificate hostname checking, but was added
61 to OpenSSL late, after other projects forked off the code-base. So in
62 addition to guarding against the base version number, beware that LibreSSL
63 does not (at this time) support this function.
65 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
66 opt to disentangle and ask a LibreSSL user to provide glue for a third
67 crypto provider for libtls instead of continuing to tie the OpenSSL glue
68 into even twistier knots. If LibreSSL gains the same API, we can just
69 change this guard and punt the issue for a while longer. */
71 #ifndef LIBRESSL_VERSION_NUMBER
72 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
73 # define EXIM_HAVE_OPENSSL_CHECKHOST
74 # define EXIM_HAVE_OPENSSL_DH_BITS
75 # define EXIM_HAVE_OPENSSL_TLS_METHOD
76 # define EXIM_HAVE_OPENSSL_KEYLOG
77 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
78 # define EXIM_HAVE_SESSION_TICKET
79 # define EXIM_HAVE_OPESSL_TRACE
80 # define EXIM_HAVE_OPESSL_GET0_SERIAL
82 # define EXIM_HAVE_OCSP
85 # define EXIM_NEED_OPENSSL_INIT
87 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
88 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
89 # define EXIM_HAVE_OPENSSL_CHECKHOST
93 #if !defined(LIBRESSL_VERSION_NUMBER) \
94 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
95 # if !defined(OPENSSL_NO_ECDH)
96 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
97 # define EXIM_HAVE_ECDH
99 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
100 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
105 #ifndef LIBRESSL_VERSION_NUMBER
106 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
107 # define OPENSSL_HAVE_KEYLOG_CB
108 # define OPENSSL_HAVE_NUM_TICKETS
109 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
111 # define OPENSSL_BAD_SRVR_OURCERT
115 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
116 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
117 # define DISABLE_OCSP
120 #ifndef DISABLE_TLS_RESUME
121 # if OPENSSL_VERSION_NUMBER < 0x0101010L
122 # error OpenSSL version too old for session-resumption
126 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
127 # include <openssl/x509v3.h>
130 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
131 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
132 # define SSL_CIPHER_get_id(c) (c->id)
134 # ifndef MACRO_PREDEF
135 # include "tls-cipher-stdname.c"
139 /*************************************************
140 * OpenSSL option parse *
141 *************************************************/
143 typedef struct exim_openssl_option {
146 } exim_openssl_option;
147 /* We could use a macro to expand, but we need the ifdef and not all the
148 options document which version they were introduced in. Policylet: include
149 all options unless explicitly for DTLS, let the administrator choose which
152 This list is current as of:
155 XXX could we autobuild this list, as with predefined-macros?
156 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
157 Also allow a numeric literal?
159 static exim_openssl_option exim_openssl_options[] = {
160 /* KEEP SORTED ALPHABETICALLY! */
162 { US"all", (long) SSL_OP_ALL },
164 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
165 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
167 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
168 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
170 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
171 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
173 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
174 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
176 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
177 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
179 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
180 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
182 #ifdef SSL_OP_EPHEMERAL_RSA
183 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
185 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
186 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
188 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
189 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
191 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
192 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
194 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
195 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
197 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
198 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
200 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
201 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
203 #ifdef SSL_OP_NO_ANTI_REPLAY
204 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
206 #ifdef SSL_OP_NO_COMPRESSION
207 { US"no_compression", SSL_OP_NO_COMPRESSION },
209 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
210 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
212 #ifdef SSL_OP_NO_RENEGOTIATION
213 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
215 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
216 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
218 #ifdef SSL_OP_NO_SSLv2
219 { US"no_sslv2", SSL_OP_NO_SSLv2 },
221 #ifdef SSL_OP_NO_SSLv3
222 { US"no_sslv3", SSL_OP_NO_SSLv3 },
224 #ifdef SSL_OP_NO_TICKET
225 { US"no_ticket", SSL_OP_NO_TICKET },
227 #ifdef SSL_OP_NO_TLSv1
228 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
230 #ifdef SSL_OP_NO_TLSv1_1
231 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
232 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
233 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
235 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
238 #ifdef SSL_OP_NO_TLSv1_2
239 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
241 #ifdef SSL_OP_NO_TLSv1_3
242 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
244 #ifdef SSL_OP_PRIORITIZE_CHACHA
245 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
247 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
248 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
250 #ifdef SSL_OP_SINGLE_DH_USE
251 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
253 #ifdef SSL_OP_SINGLE_ECDH_USE
254 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
256 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
257 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
259 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
260 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
262 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
263 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
265 #ifdef SSL_OP_TLS_D5_BUG
266 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
268 #ifdef SSL_OP_TLS_ROLLBACK_BUG
269 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
271 #ifdef SSL_OP_TLSEXT_PADDING
272 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
277 static int exim_openssl_options_size = nelem(exim_openssl_options);
278 static long init_options = 0;
287 for (struct exim_openssl_option * o = exim_openssl_options;
288 o < exim_openssl_options + nelem(exim_openssl_options); o++)
290 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
291 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
293 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
294 builtin_macro_create(buf);
297 # ifndef DISABLE_TLS_RESUME
298 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
300 # ifdef SSL_OP_NO_TLSv1_3
301 builtin_macro_create(US"_HAVE_TLS1_3");
303 # ifdef OPENSSL_BAD_SRVR_OURCERT
304 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
306 # ifdef EXIM_HAVE_OCSP
307 builtin_macro_create(US"_HAVE_TLS_OCSP");
308 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
313 /******************************************************************************/
315 /* Structure for collecting random data for seeding. */
317 typedef struct randstuff {
322 /* Local static variables */
324 static BOOL client_verify_callback_called = FALSE;
325 static BOOL server_verify_callback_called = FALSE;
326 static const uschar *sid_ctx = US"exim";
328 /* We have three different contexts to care about.
330 Simple case: client, `client_ctx`
331 As a client, we can be doing a callout or cut-through delivery while receiving
332 a message. So we have a client context, which should have options initialised
333 from the SMTP Transport. We may also concurrently want to make TLS connections
334 to utility daemons, so client-contexts are allocated and passed around in call
335 args rather than using a gobal.
338 There are two cases: with and without ServerNameIndication from the client.
339 Given TLS SNI, we can be using different keys, certs and various other
340 configuration settings, because they're re-expanded with $tls_sni set. This
341 allows vhosting with TLS. This SNI is sent in the handshake.
342 A client might not send SNI, so we need a fallback, and an initial setup too.
343 So as a server, we start out using `server_ctx`.
344 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
345 `server_sni` from `server_ctx` and then initialise settings by re-expanding
353 } exim_openssl_client_tls_ctx;
356 /* static SSL_CTX *server_ctx = NULL; */
357 /* static SSL *server_ssl = NULL; */
359 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
360 static SSL_CTX *server_sni = NULL;
363 static char ssl_errstring[256];
365 static int ssl_session_timeout = 7200; /* Two hours */
366 static BOOL client_verify_optional = FALSE;
367 static BOOL server_verify_optional = FALSE;
369 static BOOL reexpand_tls_files_for_sni = FALSE;
372 typedef struct ocsp_resp {
373 struct ocsp_resp * next;
374 OCSP_RESPONSE * resp;
377 typedef struct exim_openssl_state {
378 exim_tlslib_state lib_state;
379 #define lib_ctx libdata0
380 #define lib_ssl libdata1
383 uschar * certificate;
387 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
391 const uschar *file_expanded;
392 ocsp_resplist *olist;
395 X509_STORE *verify_store; /* non-null if status requested */
396 BOOL verify_required;
401 /* these are cached from first expand */
402 uschar * server_cipher_list;
403 /* only passed down to tls_error: */
405 const uschar * verify_cert_hostnames;
406 #ifndef DISABLE_EVENT
407 uschar * event_action;
409 } exim_openssl_state_st;
411 /* should figure out a cleanup of API to handle state preserved per
412 implementation, for various reasons, which can be void * in the APIs.
413 For now, we hack around it. */
414 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
415 exim_openssl_state_st state_server = {.is_server = TRUE};
418 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
423 static int tls_server_stapling_cb(SSL *s, void *arg);
428 /* Daemon-called, before every connection, key create/rotate */
429 #ifndef DISABLE_TLS_RESUME
430 static void tk_init(void);
431 static int tls_exdata_idx = -1;
435 tls_per_lib_daemon_tick(void)
437 #ifndef DISABLE_TLS_RESUME
442 /* Called once at daemon startup */
445 tls_per_lib_daemon_init(void)
447 tls_daemon_creds_reload();
451 /*************************************************
453 *************************************************/
455 /* Called from lots of places when errors occur before actually starting to do
456 the TLS handshake, that is, while the session is still in clear. Always returns
457 DEFER for a server and FAIL for a client so that most calls can use "return
458 tls_error(...)" to do this processing and then give an appropriate return. A
459 single function is used for both server and client, because it is called from
460 some shared functions.
463 prefix text to include in the logged error
464 host NULL if setting up a server;
465 the connected host if setting up a client
466 msg error message or NULL if we should ask OpenSSL
467 errstr pointer to output error message
469 Returns: OK/DEFER/FAIL
473 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
477 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
478 msg = US ssl_errstring;
481 msg = string_sprintf("(%s): %s", prefix, msg);
482 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
483 if (errstr) *errstr = msg;
484 return host ? FAIL : DEFER;
489 /**************************************************
490 * General library initalisation *
491 **************************************************/
494 lib_rand_init(void * addr)
497 if (!RAND_status()) return TRUE;
499 gettimeofday(&r.tv, NULL);
501 RAND_seed(US (&r), sizeof(r));
502 RAND_seed(US big_buffer, big_buffer_size);
503 if (addr) RAND_seed(US addr, sizeof(addr));
505 return RAND_status();
510 tls_openssl_init(void)
512 static BOOL once = FALSE;
516 #ifdef EXIM_NEED_OPENSSL_INIT
517 SSL_load_error_strings(); /* basic set up */
518 OpenSSL_add_ssl_algorithms();
521 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
522 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
523 list of available digests. */
524 EVP_add_digest(EVP_sha256());
527 (void) lib_rand_init(NULL);
528 (void) tls_openssl_options_parse(openssl_options, &init_options);
533 /*************************************************
534 * Initialize for DH *
535 *************************************************/
537 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
540 sctx The current SSL CTX (inbound or outbound)
541 dhparam DH parameter file or fixed parameter identity string
542 host connected host, if client; NULL if server
543 errstr error string pointer
545 Returns: TRUE if OK (nothing to set up, or setup worked)
549 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host, uschar ** errstr)
557 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
560 if (!dhexpanded || !*dhexpanded)
561 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
562 else if (dhexpanded[0] == '/')
564 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
566 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
567 host, US strerror(errno), errstr);
573 if (Ustrcmp(dhexpanded, "none") == 0)
575 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
579 if (!(pem = std_dh_prime_named(dhexpanded)))
581 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
582 host, US strerror(errno), errstr);
585 bio = BIO_new_mem_buf(CS pem, -1);
588 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
591 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
596 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
597 * an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with
598 * 2236. But older OpenSSL can only report in bytes (octets), not bits.
599 * If someone wants to dance at the edge, then they can raise the limit or use
600 * current libraries. */
601 #ifdef EXIM_HAVE_OPENSSL_DH_BITS
602 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
603 * This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
604 dh_bitsize = DH_bits(dh);
606 dh_bitsize = 8 * DH_size(dh);
609 /* Even if it is larger, we silently return success rather than cause things
610 * to fail out, so that a too-large DH will not knock out all TLS; it's a
611 * debatable choice. */
612 if (dh_bitsize > tls_dh_max_bits)
615 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d\n",
616 dh_bitsize, tls_dh_max_bits);
620 SSL_CTX_set_tmp_dh(sctx, dh);
622 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
623 dhexpanded ? dhexpanded : US"default", dh_bitsize);
635 /*************************************************
636 * Initialize for ECDH *
637 *************************************************/
639 /* Load parameters for ECDH encryption.
641 For now, we stick to NIST P-256 because: it's simple and easy to configure;
642 it avoids any patent issues that might bite redistributors; despite events in
643 the news and concerns over curve choices, we're not cryptographers, we're not
644 pretending to be, and this is "good enough" to be better than no support,
645 protecting against most adversaries. Given another year or two, there might
646 be sufficient clarity about a "right" way forward to let us make an informed
647 decision, instead of a knee-jerk reaction.
649 Longer-term, we should look at supporting both various named curves and
650 external files generated with "openssl ecparam", much as we do for init_dh().
651 We should also support "none" as a value, to explicitly avoid initialisation.
656 sctx The current SSL CTX (inbound or outbound)
657 host connected host, if client; NULL if server
658 errstr error string pointer
660 Returns: TRUE if OK (nothing to set up, or setup worked)
664 init_ecdh(SSL_CTX * sctx, host_item * host, uschar ** errstr)
666 #ifdef OPENSSL_NO_ECDH
675 if (host) /* No ECDH setup for clients, only for servers */
678 # ifndef EXIM_HAVE_ECDH
680 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
684 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
686 if (!exp_curve || !*exp_curve)
689 /* "auto" needs to be handled carefully.
690 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
691 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
692 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
693 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
694 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
696 if (Ustrcmp(exp_curve, "auto") == 0)
698 #if OPENSSL_VERSION_NUMBER < 0x10002000L
699 DEBUG(D_tls) debug_printf(
700 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
701 exp_curve = US"prime256v1";
703 # if defined SSL_CTRL_SET_ECDH_AUTO
704 DEBUG(D_tls) debug_printf(
705 "ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n");
706 SSL_CTX_set_ecdh_auto(sctx, 1);
709 DEBUG(D_tls) debug_printf(
710 "ECDH OpenSSL 1.1.0+: temp key parameter settings: default selection\n");
716 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
717 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
718 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
719 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
723 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
728 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
730 tls_error(US"Unable to create ec curve", host, NULL, errstr);
734 /* The "tmp" in the name here refers to setting a temporary key
735 not to the stability of the interface. */
737 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
738 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL, errstr);
740 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
745 # endif /*EXIM_HAVE_ECDH*/
746 #endif /*OPENSSL_NO_ECDH*/
751 /*************************************************
752 * Expand key and cert file specs *
753 *************************************************/
757 s SSL connection (not used)
761 Returns: pointer to generated key
765 rsa_callback(SSL *s, int export, int keylength)
768 #ifdef EXIM_HAVE_RSA_GENKEY_EX
769 BIGNUM *bn = BN_new();
772 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
774 #ifdef EXIM_HAVE_RSA_GENKEY_EX
775 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
776 || !(rsa_key = RSA_new())
777 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
780 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
784 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
785 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
794 /* Create and install a selfsigned certificate, for use in server mode */
795 /*XXX we could arrange to call this during prelo for a null tls_certificate option.
796 The normal cache inval + relo will suffice.
797 Just need a timer for inval. */
800 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
808 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
809 where = US"allocating pkey";
810 if (!(pkey = EVP_PKEY_new()))
813 where = US"allocating cert";
814 if (!(x509 = X509_new()))
817 where = US"generating pkey";
818 if (!(rsa = rsa_callback(NULL, 0, 2048)))
821 where = US"assigning pkey";
822 if (!EVP_PKEY_assign_RSA(pkey, rsa))
825 X509_set_version(x509, 2); /* N+1 - version 3 */
826 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
827 X509_gmtime_adj(X509_get_notBefore(x509), 0);
828 X509_gmtime_adj(X509_get_notAfter(x509), (long)2 * 60 * 60); /* 2 hour */
829 X509_set_pubkey(x509, pkey);
831 name = X509_get_subject_name(x509);
832 X509_NAME_add_entry_by_txt(name, "C",
833 MBSTRING_ASC, CUS "UK", -1, -1, 0);
834 X509_NAME_add_entry_by_txt(name, "O",
835 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
836 X509_NAME_add_entry_by_txt(name, "CN",
837 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
838 X509_set_issuer_name(x509, name);
840 where = US"signing cert";
841 if (!X509_sign(x509, pkey, EVP_md5()))
844 where = US"installing selfsign cert";
845 if (!SSL_CTX_use_certificate(sctx, x509))
848 where = US"installing selfsign key";
849 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
855 (void) tls_error(where, NULL, NULL, errstr);
856 if (x509) X509_free(x509);
857 if (pkey) EVP_PKEY_free(pkey);
867 /*************************************************
868 * Information callback *
869 *************************************************/
871 /* The SSL library functions call this from time to time to indicate what they
872 are doing. We copy the string to the debugging output when TLS debugging has
884 info_callback(SSL *s, int where, int ret)
890 if (where & SSL_ST_CONNECT)
891 str = US"SSL_connect";
892 else if (where & SSL_ST_ACCEPT)
893 str = US"SSL_accept";
895 str = US"SSL info (undefined)";
897 if (where & SSL_CB_LOOP)
898 debug_printf("%s: %s\n", str, SSL_state_string_long(s));
899 else if (where & SSL_CB_ALERT)
900 debug_printf("SSL3 alert %s:%s:%s\n",
901 str = where & SSL_CB_READ ? US"read" : US"write",
902 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
903 else if (where & SSL_CB_EXIT)
906 debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
908 debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
910 else if (where & SSL_CB_HANDSHAKE_START)
911 debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
912 else if (where & SSL_CB_HANDSHAKE_DONE)
913 debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s));
917 #ifdef OPENSSL_HAVE_KEYLOG_CB
919 keylog_callback(const SSL *ssl, const char *line)
923 DEBUG(D_tls) debug_printf("%.200s\n", line);
924 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
925 if (!(fp = fopen(filename, "a"))) return;
926 fprintf(fp, "%s\n", line);
935 #ifndef DISABLE_EVENT
937 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
938 BOOL *calledp, const BOOL *optionalp, const uschar * what)
944 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
947 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
948 old_cert = tlsp->peercert;
949 tlsp->peercert = X509_dup(cert);
950 /* NB we do not bother setting peerdn */
951 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
953 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
954 "depth=%d cert=%s: %s",
955 tlsp == &tls_out ? deliver_host_address : sender_host_address,
956 what, depth, dn, yield);
960 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
961 return 1; /* reject (leaving peercert set) */
963 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
964 "(host in tls_try_verify_hosts)\n");
965 tlsp->verify_override = TRUE;
967 X509_free(tlsp->peercert);
968 tlsp->peercert = old_cert;
974 /*************************************************
975 * Callback for verification *
976 *************************************************/
978 /* The SSL library does certificate verification if set up to do so. This
979 callback has the current yes/no state is in "state". If verification succeeded,
980 we set the certificate-verified flag. If verification failed, what happens
981 depends on whether the client is required to present a verifiable certificate
984 If verification is optional, we change the state to yes, but still log the
985 verification error. For some reason (it really would help to have proper
986 documentation of OpenSSL), this callback function then gets called again, this
987 time with state = 1. We must take care not to set the private verified flag on
988 the second time through.
990 Note: this function is not called if the client fails to present a certificate
991 when asked. We get here only if a certificate has been received. Handling of
992 optional verification for this case is done when requesting SSL to verify, by
993 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
995 May be called multiple times for different issues with a certificate, even
996 for a given "depth" in the certificate chain.
999 preverify_ok current yes/no state as 1/0
1000 x509ctx certificate information.
1001 tlsp per-direction (client vs. server) support data
1002 calledp has-been-called flag
1003 optionalp verification-is-optional flag
1005 Returns: 0 if verification should fail, otherwise 1
1009 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1010 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1012 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1013 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1016 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1018 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1019 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1020 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1023 dn[sizeof(dn)-1] = '\0';
1025 tlsp->verify_override = FALSE;
1026 if (preverify_ok == 0)
1028 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1029 *verify_mode, sender_host_address)
1031 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1032 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1034 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1038 if (!tlsp->peercert)
1039 tlsp->peercert = X509_dup(cert); /* record failing cert */
1040 return 0; /* reject */
1042 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1043 "tls_try_verify_hosts)\n");
1044 tlsp->verify_override = TRUE;
1047 else if (depth != 0)
1049 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1050 #ifndef DISABLE_OCSP
1051 if (tlsp == &tls_out && client_static_state->u_ocsp.client.verify_store)
1052 { /* client, wanting stapling */
1053 /* Add the server cert's signing chain as the one
1054 for the verification of the OCSP stapled information. */
1056 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1059 sk_X509_push(client_static_state->verify_stack, cert);
1062 #ifndef DISABLE_EVENT
1063 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1064 return 0; /* reject, with peercert set */
1069 const uschar * verify_cert_hostnames;
1071 if ( tlsp == &tls_out
1072 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1073 /* client, wanting hostname check */
1076 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1077 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1078 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1080 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1081 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1084 const uschar * list = verify_cert_hostnames;
1087 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1088 if ((rc = X509_check_host(cert, CCS name, 0,
1089 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1090 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1095 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1096 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1103 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1106 uschar * extra = verify_mode
1107 ? string_sprintf(" (during %c-verify for [%s])",
1108 *verify_mode, sender_host_address)
1110 log_write(0, LOG_MAIN,
1111 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1112 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1113 extra, dn, verify_cert_hostnames);
1117 if (!tlsp->peercert)
1118 tlsp->peercert = X509_dup(cert); /* record failing cert */
1119 return 0; /* reject */
1121 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1122 "tls_try_verify_hosts)\n");
1123 tlsp->verify_override = TRUE;
1127 #ifndef DISABLE_EVENT
1128 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1129 return 0; /* reject, with peercert set */
1132 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1133 *calledp ? "" : " authenticated", dn);
1137 return 1; /* accept, at least for this level */
1141 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1143 return verify_callback(preverify_ok, x509ctx, &tls_out,
1144 &client_verify_callback_called, &client_verify_optional);
1148 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1150 return verify_callback(preverify_ok, x509ctx, &tls_in,
1151 &server_verify_callback_called, &server_verify_optional);
1157 /* This gets called *by* the dane library verify callback, which interposes
1161 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1163 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1165 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1166 #ifndef DISABLE_EVENT
1167 BOOL dummy_called, optional = FALSE;
1170 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1172 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1173 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1174 deliver_host_address);
1177 dn[sizeof(dn)-1] = '\0';
1179 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1180 preverify_ok ? "ok":"BAD", depth, dn);
1182 #ifndef DISABLE_EVENT
1183 if (verify_event(&tls_out, cert, depth, dn,
1184 &dummy_called, &optional, US"DANE"))
1185 return 0; /* reject, with peercert set */
1188 if (preverify_ok == 1)
1190 tls_out.dane_verified = TRUE;
1191 #ifndef DISABLE_OCSP
1192 if (client_static_state->u_ocsp.client.verify_store)
1193 { /* client, wanting stapling */
1194 /* Add the server cert's signing chain as the one
1195 for the verification of the OCSP stapled information. */
1197 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1200 sk_X509_push(client_static_state->verify_stack, cert);
1206 int err = X509_STORE_CTX_get_error(x509ctx);
1208 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1209 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1212 return preverify_ok;
1215 #endif /*SUPPORT_DANE*/
1218 #ifndef DISABLE_OCSP
1219 /*************************************************
1220 * Load OCSP information into state *
1221 *************************************************/
1222 /* Called to load the server OCSP response from the given file into memory, once
1223 caller has determined this is needed. Checks validity. Debugs a message
1226 ASSUMES: single response, for single cert.
1229 state various parts of session state
1230 filename the filename putatively holding an OCSP response
1231 is_pem file is PEM format; otherwise is DER
1235 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1239 OCSP_RESPONSE * resp;
1240 OCSP_BASICRESP * basic_response;
1241 OCSP_SINGLERESP * single_response;
1242 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1243 STACK_OF(X509) * sk;
1244 unsigned long verify_flags;
1245 int status, reason, i;
1248 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1250 if (!filename || !*filename) return;
1253 if (!(bio = BIO_new_file(CS filename, "rb")))
1255 log_write(0, LOG_MAIN|LOG_PANIC,
1256 "Failed to open OCSP response file \"%s\": %.100s",
1257 filename, ERR_reason_error_string(ERR_get_error()));
1263 uschar * data, * freep;
1266 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1268 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
1269 filename, ERR_reason_error_string(ERR_get_error()));
1273 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1274 OPENSSL_free(freep);
1277 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1282 log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
1283 filename, ERR_reason_error_string(ERR_get_error()));
1287 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1289 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1290 OCSP_response_status_str(status), status);
1296 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1297 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1302 if (!(basic_response = OCSP_response_get1_basic(resp)))
1305 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1309 sk = state->verify_stack;
1310 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1312 /* May need to expose ability to adjust those flags?
1313 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1314 OCSP_TRUSTOTHER OCSP_NOINTERN */
1316 /* This does a full verify on the OCSP proof before we load it for serving
1317 up; possibly overkill - just date-checks might be nice enough.
1319 OCSP_basic_verify takes a "store" arg, but does not
1320 use it for the chain verification, which is all we do
1321 when OCSP_NOVERIFY is set. The content from the wire
1322 "basic_response" and a cert-stack "sk" are all that is used.
1324 We have a stack, loaded in setup_certs() if tls_verify_certificates
1325 was a file (not a directory, or "system"). It is unfortunate we
1326 cannot used the connection context store, as that would neatly
1327 handle the "system" case too, but there seems to be no library
1328 function for getting a stack from a store.
1329 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1330 We do not free the stack since it could be needed a second time for
1333 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1334 be a public interface into the OpenSSL library (there's no manual entry) -
1335 But what with? We also use OCSP_basic_verify in the client stapling callback.
1336 And there we NEED it; we must verify that status... unless the
1337 library does it for us anyway? */
1339 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
1343 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1344 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
1349 /* Here's the simplifying assumption: there's only one response, for the
1350 one certificate we use, and nothing for anything else in a chain. If this
1351 proves false, we need to extract a cert id from our issued cert
1352 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1353 right cert in the stack and then calls OCSP_single_get0_status()).
1355 I'm hoping to avoid reworking a bunch more of how we handle state here.
1357 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1360 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1363 debug_printf("Unable to get first response from OCSP basic response.\n");
1367 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1368 if (status != V_OCSP_CERTSTATUS_GOOD)
1370 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1371 OCSP_cert_status_str(status), status,
1372 OCSP_crl_reason_str(reason), reason);
1376 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1378 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
1383 /* Add the resp to the list used by tls_server_stapling_cb() */
1385 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1386 while (oentry = *op)
1388 *op = oentry = store_get(sizeof(ocsp_resplist), FALSE);
1389 oentry->next = NULL;
1390 oentry->resp = resp;
1395 if (f.running_in_test_harness)
1397 extern char ** environ;
1398 if (environ) for (uschar ** p = USS environ; *p; p++)
1399 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1401 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1402 goto supply_response;
1410 ocsp_free_response_list(exim_openssl_state_st * cbinfo)
1412 for (ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; olist;
1413 olist = olist->next)
1414 OCSP_RESPONSE_free(olist->resp);
1415 cbinfo->u_ocsp.server.olist = NULL;
1417 #endif /*!DISABLE_OCSP*/
1424 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1427 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1428 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1429 return tls_error(string_sprintf(
1430 "SSL_CTX_use_certificate_chain_file file=%s", file),
1431 cbinfo->host, NULL, errstr);
1436 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1439 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1440 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1441 return tls_error(string_sprintf(
1442 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1449 /* Called once during tls_init and possibly again during TLS setup, for a
1450 new context, if Server Name Indication was used and tls_sni was seen in
1451 the certificate string.
1454 sctx the SSL_CTX* to update
1455 state various parts of session state
1456 errstr error string pointer
1458 Returns: OK/DEFER/FAIL
1462 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1467 if (!state->certificate)
1469 if (!state->is_server) /* client */
1472 if (tls_install_selfsign(sctx, errstr) != OK)
1479 if ( !reexpand_tls_files_for_sni
1480 && ( Ustrstr(state->certificate, US"tls_sni")
1481 || Ustrstr(state->certificate, US"tls_in_sni")
1482 || Ustrstr(state->certificate, US"tls_out_sni")
1484 reexpand_tls_files_for_sni = TRUE;
1486 if (!expand_check(state->certificate, US"tls_certificate", &expanded, errstr))
1490 if (state->is_server)
1492 const uschar * file_list = expanded;
1495 #ifndef DISABLE_OCSP
1496 const uschar * olist = state->u_ocsp.server.file;
1499 BOOL fmt_pem = FALSE;
1502 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1504 if (olist && !*olist)
1507 if ( state->u_ocsp.server.file_expanded && olist
1508 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1510 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1515 ocsp_free_response_list(state);
1516 state->u_ocsp.server.file_expanded = olist;
1520 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1522 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1525 #ifndef DISABLE_OCSP
1527 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1529 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1534 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1539 ocsp_load_response(state, ofile, fmt_pem);
1542 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1546 else /* would there ever be a need for multiple client certs? */
1547 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1550 if ( state->privatekey
1551 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr))
1554 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1555 of the expansion is an empty string, ignore it also, and assume the private
1556 key is in the same file as the certificate. */
1558 if (expanded && *expanded)
1559 if (state->is_server)
1561 const uschar * file_list = expanded;
1565 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1566 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1569 else /* would there ever be a need for multiple client certs? */
1570 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1580 /**************************************************
1581 * One-time init credentials for server and client *
1582 **************************************************/
1585 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1586 uschar * ciphers, uschar ** errstr)
1588 for (uschar * s = ciphers; *s; s++ ) if (*s == '_') *s = '-';
1589 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1590 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1591 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1592 state->server_cipher_list = ciphers;
1599 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1602 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1603 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1605 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1607 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1609 /* Set up the information callback, which outputs if debugging is at a suitable
1614 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1615 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1616 /* this needs a debug build of OpenSSL */
1617 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
1619 #ifdef OPENSSL_HAVE_KEYLOG_CB
1620 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
1624 /* Automatically re-try reads/writes after renegotiation. */
1625 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1632 tls_server_creds_init(void)
1635 uschar * dummy_errstr;
1636 unsigned lifetime = 0;
1640 state_server.lib_state = null_tls_preload;
1642 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1644 state_server.lib_state.lib_ctx = ctx;
1646 /* Preload DH params and EC curve */
1648 if (opt_unset_or_noexpand(tls_dhparam))
1650 DEBUG(D_tls) debug_printf("TLS: preloading DH params for server\n");
1651 if (init_dh(ctx, tls_dhparam, NULL, &dummy_errstr))
1652 state_server.lib_state.dh = TRUE;
1654 if (opt_unset_or_noexpand(tls_eccurve))
1656 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for server\n");
1657 if (init_ecdh(ctx, NULL, &dummy_errstr))
1658 state_server.lib_state.ecdh = TRUE;
1661 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1662 /* If we can, preload the server-side cert, key and ocsp */
1664 if ( opt_set_and_noexpand(tls_certificate)
1665 # ifndef DISABLE_OCSP
1666 && opt_unset_or_noexpand(tls_ocsp_file)
1668 && opt_unset_or_noexpand(tls_privatekey))
1670 /* Set watches on the filenames. The implementation does de-duplication
1671 so we can just blindly do them all. */
1673 if ( tls_set_watch(tls_certificate, TRUE)
1674 # ifndef DISABLE_OCSP
1675 && tls_set_watch(tls_ocsp_file, TRUE)
1677 && tls_set_watch(tls_privatekey, TRUE))
1679 state_server.certificate = tls_certificate;
1680 state_server.privatekey = tls_privatekey;
1681 #ifndef DISABLE_OCSP
1682 state_server.u_ocsp.server.file = tls_ocsp_file;
1685 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1686 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1687 state_server.lib_state.conn_certs = TRUE;
1690 else if ( !tls_certificate && !tls_privatekey
1691 # ifndef DISABLE_OCSP
1695 { /* Generate & preload a selfsigned cert. No files to watch. */
1696 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1698 state_server.lib_state.conn_certs = TRUE;
1699 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1703 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1706 /* If we can, preload the Authorities for checking client certs against.
1707 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1708 at TLS conn startup */
1710 if ( opt_set_and_noexpand(tls_verify_certificates)
1711 && opt_unset_or_noexpand(tls_crl))
1713 /* Watch the default dir also as they are always included */
1715 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1716 && tls_set_watch(tls_verify_certificates, FALSE)
1717 && tls_set_watch(tls_crl, FALSE))
1719 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1721 if (setup_certs(ctx, tls_verify_certificates, tls_crl, NULL, &dummy_errstr)
1723 state_server.lib_state.cabundle = TRUE;
1727 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1728 #endif /* EXIM_HAVE_INOTIFY */
1731 /* If we can, preload the ciphers control string */
1733 if (opt_set_and_noexpand(tls_require_ciphers))
1735 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1736 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1737 &dummy_errstr) == OK)
1738 state_server.lib_state.pri_string = TRUE;
1741 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1748 /* Preload whatever creds are static, onto a transport. The client can then
1749 just copy the pointer as it starts up.
1750 Called from the daemon after a cache-invalidate with watch set; called from
1751 a queue-run startup with watch clear. */
1754 tls_client_creds_init(transport_instance * t, BOOL watch)
1756 smtp_transport_options_block * ob = t->options_block;
1757 exim_openssl_state_st tpt_dummy_state;
1758 host_item * dummy_host = (host_item *)1;
1759 uschar * dummy_errstr;
1764 ob->tls_preload = null_tls_preload;
1765 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1767 ob->tls_preload.lib_ctx = ctx;
1769 tpt_dummy_state.lib_state = ob->tls_preload;
1771 if (opt_unset_or_noexpand(tls_dhparam))
1773 DEBUG(D_tls) debug_printf("TLS: preloading DH params for transport '%s'\n", t->name);
1774 if (init_dh(ctx, tls_dhparam, NULL, &dummy_errstr))
1775 ob->tls_preload.dh = TRUE;
1777 if (opt_unset_or_noexpand(tls_eccurve))
1779 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for transport '%s'\n", t->name);
1780 if (init_ecdh(ctx, NULL, &dummy_errstr))
1781 ob->tls_preload.ecdh = TRUE;
1784 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1785 if ( opt_set_and_noexpand(ob->tls_certificate)
1786 && opt_unset_or_noexpand(ob->tls_privatekey))
1789 || ( tls_set_watch(ob->tls_certificate, FALSE)
1790 && tls_set_watch(ob->tls_privatekey, FALSE)
1793 uschar * pkey = ob->tls_privatekey;
1796 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1798 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1800 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1801 pkey ? pkey : ob->tls_certificate,
1804 ob->tls_preload.conn_certs = TRUE;
1809 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1812 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1813 && opt_unset_or_noexpand(ob->tls_crl))
1816 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1817 && tls_set_watch(ob->tls_verify_certificates, FALSE)
1818 && tls_set_watch(ob->tls_crl, FALSE)
1822 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1824 if (setup_certs(ctx, ob->tls_verify_certificates,
1825 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
1826 ob->tls_preload.cabundle = TRUE;
1831 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1833 #endif /*EXIM_HAVE_INOTIFY*/
1837 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1838 /* Invalidate the creds cached, by dropping the current ones.
1839 Call when we notice one of the source files has changed. */
1842 tls_server_creds_invalidate(void)
1844 SSL_CTX_free(state_server.lib_state.lib_ctx);
1845 state_server.lib_state = null_tls_preload;
1850 tls_client_creds_invalidate(transport_instance * t)
1852 smtp_transport_options_block * ob = t->options_block;
1853 SSL_CTX_free(ob->tls_preload.lib_ctx);
1854 ob->tls_preload = null_tls_preload;
1860 tls_server_creds_invalidate(void)
1864 tls_client_creds_invalidate(transport_instance * t)
1867 #endif /*EXIM_HAVE_INOTIFY*/
1871 #ifndef DISABLE_OCSP
1873 x509_store_dump_cert_s_names(X509_STORE * store)
1875 STACK_OF(X509_OBJECT) * roots= store->objs;
1876 static uschar name[256];
1878 for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
1880 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
1881 if(tmp_obj->type == X509_LU_X509)
1883 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
1884 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
1886 name[sizeof(name)-1] = '\0';
1887 debug_printf(" %s\n", name);
1896 #ifndef DISABLE_TLS_RESUME
1897 /* Manage the keysets used for encrypting the session tickets, on the server. */
1899 typedef struct { /* Session ticket encryption key */
1902 const EVP_CIPHER * aes_cipher;
1903 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
1904 const EVP_MD * hmac_hash;
1905 uschar hmac_key[16];
1910 static exim_stek exim_tk; /* current key */
1911 static exim_stek exim_tk_old; /* previous key */
1916 time_t t = time(NULL);
1918 if (exim_tk.name[0])
1920 if (exim_tk.renew >= t) return;
1921 exim_tk_old = exim_tk;
1924 if (f.running_in_test_harness) ssl_session_timeout = 6;
1926 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
1927 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
1928 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
1929 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
1931 exim_tk.name[0] = 'E';
1932 exim_tk.aes_cipher = EVP_aes_256_cbc();
1933 exim_tk.hmac_hash = EVP_sha256();
1934 exim_tk.expire = t + ssl_session_timeout;
1935 exim_tk.renew = t + ssl_session_timeout/2;
1941 if (!exim_tk.name[0]) return NULL;
1946 tk_find(const uschar * name)
1948 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
1949 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
1953 /* Callback for session tickets, on server */
1955 ticket_key_callback(SSL * ssl, uschar key_name[16],
1956 uschar * iv, EVP_CIPHER_CTX * c_ctx, HMAC_CTX * hctx, int enc)
1958 tls_support * tlsp = state_server.tlsp;
1963 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
1964 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
1966 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
1967 return -1; /* insufficient random */
1969 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
1970 return 0; /* key couldn't be created */
1971 memcpy(key_name, key->name, 16);
1972 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
1974 /*XXX will want these dependent on the ssl session strength */
1975 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
1976 key->hmac_hash, NULL);
1977 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
1979 DEBUG(D_tls) debug_printf("ticket created\n");
1984 time_t now = time(NULL);
1986 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
1987 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
1989 if (!(key = tk_find(key_name)) || key->expire < now)
1993 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
1994 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
1999 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2000 key->hmac_hash, NULL);
2001 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2003 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2005 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2006 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2007 be better. To do that we'd have to encode ticket lifetime in the name as
2008 we don't yet see the restored session. Could check posthandshake for TLS1.3
2009 and trigger a new ticket then, but cannot do that for TLS1.2 */
2010 return key->renew < now ? 2 : 1;
2018 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2019 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2021 /* If verification is optional, don't fail if no certificate */
2023 SSL_CTX_set_verify(ctx,
2024 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2029 /*************************************************
2030 * Callback to handle SNI *
2031 *************************************************/
2033 /* Called when acting as server during the TLS session setup if a Server Name
2034 Indication extension was sent by the client.
2036 API documentation is OpenSSL s_server.c implementation.
2039 s SSL* of the current session
2040 ad unknown (part of OpenSSL API) (unused)
2041 arg Callback of "our" registered data
2043 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2045 XXX might need to change to using ClientHello callback,
2046 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2049 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2051 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
2053 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2054 exim_openssl_state_st *state = (exim_openssl_state_st *) arg;
2056 int old_pool = store_pool;
2057 uschar * dummy_errstr;
2060 return SSL_TLSEXT_ERR_OK;
2062 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2063 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2065 /* Make the extension value available for expansion */
2066 store_pool = POOL_PERM;
2067 tls_in.sni = string_copy_taint(US servername, TRUE);
2068 store_pool = old_pool;
2070 if (!reexpand_tls_files_for_sni)
2071 return SSL_TLSEXT_ERR_OK;
2073 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2074 not confident that memcpy wouldn't break some internal reference counting.
2075 Especially since there's a references struct member, which would be off. */
2077 if (lib_ctx_new(&server_sni, NULL, &dummy_errstr) != OK)
2080 /* Not sure how many of these are actually needed, since SSL object
2081 already exists. Might even need this selfsame callback, for reneg? */
2084 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2085 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2086 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2087 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2088 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2089 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2090 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2093 if ( !init_dh(server_sni, state->dhparam, NULL, &dummy_errstr)
2094 || !init_ecdh(server_sni, NULL, &dummy_errstr)
2098 if ( state->server_cipher_list
2099 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2102 #ifndef DISABLE_OCSP
2103 if (state->u_ocsp.server.file)
2105 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2106 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2112 if ( !expand_check(tls_verify_certificates, US"tls_verify_certificates",
2113 &expcerts, &dummy_errstr)
2114 || (rc = setup_certs(server_sni, expcerts, tls_crl, NULL,
2115 &dummy_errstr)) != OK)
2118 if (expcerts && *expcerts)
2119 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2122 /* do this after setup_certs, because this can require the certs for verifying
2123 OCSP information. */
2124 if ((rc = tls_expand_session_files(server_sni, state, &dummy_errstr)) != OK)
2127 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2128 SSL_set_SSL_CTX(s, server_sni);
2129 return SSL_TLSEXT_ERR_OK;
2131 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
2133 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2138 #ifdef EXIM_HAVE_ALPN
2139 /*************************************************
2140 * Callback to handle ALPN *
2141 *************************************************/
2143 /* SSL_CTX_set_alpn_select_cb() */
2144 /* Called on server when client offers ALPN, after the SNI callback.
2145 If set and not e?smtp then we dump the connection */
2148 tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen,
2149 const uschar * in, unsigned int inlen, void * arg)
2151 const exim_openssl_state_st * state = arg;
2155 debug_printf("Received TLS ALPN offer:");
2156 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2159 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2160 debug_printf(" '%.*s'", siz, in + pos + 1);
2165 /* Look for an acceptable ALPN */
2166 if ( inlen > 1 /* at least one name */
2167 && in[0]+1 == inlen /* filling the vector, so exactly one name */
2168 && ( Ustrncmp(in+1, "smtp", in[0]) == 0
2169 || Ustrncmp(in+1, "esmtp", in[0]) == 0
2172 *out = in; /* we checked for exactly one, so can just point to it */
2174 return SSL_TLSEXT_ERR_OK; /* use ALPN */
2177 /* Reject unacceptable ALPN */
2178 /* This will be fatal to the TLS conn; would be nice to kill TCP also */
2179 return SSL_TLSEXT_ERR_ALERT_FATAL;
2181 #endif /* EXIM_HAVE_ALPN */
2185 #ifndef DISABLE_OCSP
2187 /*************************************************
2188 * Callback to handle OCSP Stapling *
2189 *************************************************/
2191 /* Called when acting as server during the TLS session setup if the client
2192 requests OCSP information with a Certificate Status Request.
2194 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2200 tls_server_stapling_cb(SSL *s, void *arg)
2202 const exim_openssl_state_st * state = arg;
2203 ocsp_resplist * olist = state->u_ocsp.server.olist;
2204 uschar * response_der; /*XXX blob */
2205 int response_der_len;
2208 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2209 olist ? "have" : "lack");
2211 tls_in.ocsp = OCSP_NOT_RESP;
2213 return SSL_TLSEXT_ERR_NOACK;
2215 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
2217 const X509 * cert_sent = SSL_get_certificate(s);
2218 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2219 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2220 const X509_NAME * cert_issuer = X509_get_issuer_name(cert_sent);
2224 for (; olist; olist = olist->next)
2226 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2227 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2228 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2229 ASN1_INTEGER * res_cert_serial;
2230 const BIGNUM * resp_bn;
2231 ASN1_OCTET_STRING * res_cert_iNameHash;
2234 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2235 (OCSP_CERTID *) cid);
2236 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2240 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2241 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2244 if (BN_cmp(cert_bn, resp_bn) == 0)
2246 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2248 /*XXX TODO: check the rest of the list for duplicate matches.
2249 If any, need to also check the Issuer Name hash.
2250 Without this, we will provide the wrong status in the case of
2255 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2259 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2260 return SSL_TLSEXT_ERR_NOACK;
2266 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2267 return SSL_TLSEXT_ERR_NOACK;
2271 /*XXX could we do the i2d earlier, rather than during the callback? */
2272 response_der = NULL;
2273 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2274 if (response_der_len <= 0)
2275 return SSL_TLSEXT_ERR_NOACK;
2277 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2278 response_der, response_der_len);
2279 tls_in.ocsp = OCSP_VFIED;
2280 return SSL_TLSEXT_ERR_OK;
2285 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
2287 BIO_printf(bp, "\t%s: ", str);
2288 ASN1_GENERALIZEDTIME_print(bp, time);
2293 tls_client_stapling_cb(SSL *s, void *arg)
2295 exim_openssl_state_st * cbinfo = arg;
2296 const unsigned char * p;
2298 OCSP_RESPONSE * rsp;
2299 OCSP_BASICRESP * bs;
2302 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2303 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
2306 /* Expect this when we requested ocsp but got none */
2307 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2308 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2310 DEBUG(D_tls) debug_printf(" null\n");
2311 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2314 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2316 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2317 if (LOGGING(tls_cipher))
2318 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2320 DEBUG(D_tls) debug_printf(" parse error\n");
2324 if (!(bs = OCSP_response_get1_basic(rsp)))
2326 tls_out.ocsp = OCSP_FAILED;
2327 if (LOGGING(tls_cipher))
2328 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2330 DEBUG(D_tls) debug_printf(" error parsing response\n");
2331 OCSP_RESPONSE_free(rsp);
2335 /* We'd check the nonce here if we'd put one in the request. */
2336 /* However that would defeat cacheability on the server so we don't. */
2338 /* This section of code reworked from OpenSSL apps source;
2339 The OpenSSL Project retains copyright:
2340 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2344 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2345 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2348 DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
2350 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2352 /* Use the chain that verified the server cert to verify the stapled info */
2353 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
2355 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
2356 cbinfo->u_ocsp.client.verify_store, OCSP_NOEXPLICIT)) <= 0)
2357 if (ERR_peek_error())
2359 tls_out.ocsp = OCSP_FAILED;
2360 if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
2361 "Received TLS cert status response, itself unverifiable: %s",
2362 ERR_reason_error_string(ERR_peek_error()));
2363 BIO_printf(bp, "OCSP response verify failure\n");
2364 ERR_print_errors(bp);
2365 OCSP_RESPONSE_print(bp, rsp, 0);
2369 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2370 " in the root CA certificate; ignoring\n");
2372 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2374 /*XXX So we have a good stapled OCSP status. How do we know
2375 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2376 OCSP_resp_find_status() which matches on a cert id, which presumably
2377 we should use. Making an id needs OCSP_cert_id_new(), which takes
2378 issuerName, issuerKey, serialNumber. Are they all in the cert?
2380 For now, carry on blindly accepting the resp. */
2383 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2384 OCSP_resp_count(bs) - 1;
2386 sk_OCSP_SINGLERESP_num(sresp) - 1;
2390 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2392 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2394 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2395 - but what happens with a GnuTLS-style input?
2397 we could do with a debug label for each singleresp
2398 - it has a certID with a serialNumber, but I see no API to get that
2400 status = OCSP_single_get0_status(single, &reason, &rev,
2401 &thisupd, &nextupd);
2403 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
2404 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
2405 if (!OCSP_check_validity(thisupd, nextupd,
2406 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2408 tls_out.ocsp = OCSP_FAILED;
2409 DEBUG(D_tls) ERR_print_errors(bp);
2410 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
2414 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2415 OCSP_cert_status_str(status));
2418 case V_OCSP_CERTSTATUS_GOOD:
2419 continue; /* the idx loop */
2420 case V_OCSP_CERTSTATUS_REVOKED:
2421 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2422 reason != -1 ? "; reason: " : "",
2423 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2424 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2427 log_write(0, LOG_MAIN,
2428 "Server certificate status unknown, in OCSP stapling");
2436 tls_out.ocsp = OCSP_VFIED;
2440 tls_out.ocsp = OCSP_FAILED;
2441 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2446 OCSP_RESPONSE_free(rsp);
2449 #endif /*!DISABLE_OCSP*/
2452 /*************************************************
2453 * Initialize for TLS *
2454 *************************************************/
2455 /* Called from both server and client code, to do preliminary initialization
2456 of the library. We allocate and return a context structure.
2459 host connected host, if client; NULL if server
2460 ob transport options block, if client; NULL if server
2461 ocsp_file file of stapling info (server); flag for require ocsp (client)
2462 addr address if client; NULL if server (for some randomness)
2463 caller_state place to put pointer to allocated state-struct
2464 errstr error string pointer
2466 Returns: OK/DEFER/FAIL
2470 tls_init(host_item * host, smtp_transport_options_block * ob,
2471 #ifndef DISABLE_OCSP
2474 address_item *addr, exim_openssl_state_st ** caller_state,
2479 exim_openssl_state_st * state;
2482 if (host) /* client */
2484 state = store_malloc(sizeof(exim_openssl_state_st));
2485 memset(state, 0, sizeof(*state));
2486 state->certificate = ob->tls_certificate;
2487 state->privatekey = ob->tls_privatekey;
2488 state->is_server = FALSE;
2489 state->dhparam = NULL;
2490 state->lib_state = ob->tls_preload;
2494 state = &state_server;
2495 state->certificate = tls_certificate;
2496 state->privatekey = tls_privatekey;
2497 state->is_server = TRUE;
2498 state->dhparam = tls_dhparam;
2499 state->lib_state = state_server.lib_state;
2505 if (!state->lib_state.pri_string)
2506 state->server_cipher_list = NULL;
2508 #ifndef DISABLE_EVENT
2509 state->event_action = NULL;
2514 /* It turns out that we need to seed the random number generator this early in
2515 order to get the full complement of ciphers to work. It took me roughly a day
2516 of work to discover this by experiment.
2518 On systems that have /dev/urandom, SSL may automatically seed itself from
2519 there. Otherwise, we have to make something up as best we can. Double check
2522 Although we likely called this before, at daemon startup, this is a chance
2523 to mix in further variable info (time, pid) if needed. */
2525 if (!lib_rand_init(addr))
2526 return tls_error(US"RAND_status", host,
2527 US"unable to seed random number generator", errstr);
2529 /* Apply administrator-supplied work-arounds.
2530 Historically we applied just one requested option,
2531 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2532 moved to an administrator-controlled list of options to specify and
2533 grandfathered in the first one as the default value for "openssl_options".
2535 No OpenSSL version number checks: the options we accept depend upon the
2536 availability of the option value macros from OpenSSL. */
2539 if (!tls_openssl_options_parse(openssl_options, &init_options))
2540 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2542 /* Create a context.
2543 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2544 negotiation in the different methods; as far as I can tell, the only
2545 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2546 when OpenSSL is built without SSLv2 support.
2547 By disabling with openssl_options, we can let admins re-enable with the
2550 if (!(ctx = state->lib_state.lib_ctx))
2552 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2554 state->lib_state.lib_ctx = ctx;
2557 #ifndef DISABLE_TLS_RESUME
2558 tlsp->resumption = RESUME_SUPPORTED;
2562 #ifndef DISABLE_TLS_RESUME
2563 /* Should the server offer session resumption? */
2564 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2566 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2567 init_options &= ~SSL_OP_NO_TICKET;
2568 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2569 tlsp->host_resumable = TRUE;
2573 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
2574 if (!(SSL_CTX_set_options(ctx, init_options)))
2575 return tls_error(string_sprintf(
2576 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2579 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2581 /* We'd like to disable session cache unconditionally, but foolish Outlook
2582 Express clients then give up the first TLS connection and make a second one
2583 (which works). Only when there is an IMAP service on the same machine.
2584 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2585 now, until we work out a decent way of presenting control to the config. It
2586 will never be used because we use a new context every time. */
2588 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2591 /* Initialize with DH parameters if supplied */
2592 /* Initialize ECDH temp key parameter selection */
2594 if (state->lib_state.dh)
2595 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2597 if (!init_dh(ctx, state->dhparam, host, errstr)) return DEFER;
2599 if (state->lib_state.ecdh)
2600 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
2602 if (!init_ecdh(ctx, host, errstr)) return DEFER;
2604 /* Set up certificate and key (and perhaps OCSP info) */
2606 if (state->lib_state.conn_certs)
2609 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
2613 #ifndef DISABLE_OCSP
2616 state->u_ocsp.server.file = ocsp_file;
2617 state->u_ocsp.server.file_expanded = NULL;
2618 state->u_ocsp.server.olist = NULL;
2621 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
2624 /* If we need to handle SNI or OCSP, do so */
2626 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2627 # ifndef DISABLE_OCSP
2628 if (!(state->verify_stack = sk_X509_new_null()))
2630 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2635 if (!host) /* server */
2637 # ifndef DISABLE_OCSP
2638 /* We check u_ocsp.server.file, not server.olist, because we care about if
2639 the option exists, not what the current expansion might be, as SNI might
2640 change the certificate and OCSP file in use between now and the time the
2641 callback is invoked. */
2642 if (state->u_ocsp.server.file)
2644 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2645 SSL_CTX_set_tlsext_status_arg(ctx, state);
2648 /* We always do this, so that $tls_sni is available even if not used in
2650 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2651 SSL_CTX_set_tlsext_servername_arg(ctx, state);
2652 # ifdef EXIM_HAVE_ALPN
2653 SSL_CTX_set_alpn_select_cb(ctx, tls_server_alpn_cb, state);
2656 # ifndef DISABLE_OCSP
2658 if(ocsp_file) /* wanting stapling */
2660 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
2662 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2665 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2666 SSL_CTX_set_tlsext_status_arg(ctx, state);
2671 state->verify_cert_hostnames = NULL;
2673 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
2674 /* Set up the RSA callback */
2675 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
2678 /* Finally, set the session cache timeout, and we are done.
2679 The period appears to be also used for (server-generated) session tickets */
2681 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
2682 DEBUG(D_tls) debug_printf("Initialized TLS\n");
2684 *caller_state = state;
2692 /*************************************************
2693 * Get name of cipher in use *
2694 *************************************************/
2697 Argument: pointer to an SSL structure for the connection
2698 pointer to number of bits for cipher
2699 Returns: pointer to allocated string in perm-pool
2703 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
2705 int pool = store_pool;
2706 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
2707 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2708 the accessor functions use const in the prototype. */
2710 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
2713 SSL_CIPHER_get_bits(c, bits);
2715 store_pool = POOL_PERM;
2716 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2718 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2723 /* Get IETF-standard name for ciphersuite.
2724 Argument: pointer to an SSL structure for the connection
2725 Returns: pointer to string
2728 static const uschar *
2729 cipher_stdname_ssl(SSL * ssl)
2731 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2732 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2734 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2735 return cipher_stdname(id >> 8, id & 0xff);
2740 static const uschar *
2741 tlsver_name(SSL * ssl)
2744 int pool = store_pool;
2746 store_pool = POOL_PERM;
2747 s = string_copy(US SSL_get_version(ssl));
2749 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
2750 for (;; p++) if (!(*p = p[1])) break;
2756 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
2758 /*XXX we might consider a list-of-certs variable for the cert chain.
2759 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2760 in list-handling functions, also consider the difference between the entire
2761 chain and the elements sent by the peer. */
2763 tlsp->peerdn = NULL;
2765 /* Will have already noted peercert on a verify fail; possibly not the leaf */
2766 if (!tlsp->peercert)
2767 tlsp->peercert = SSL_get_peer_certificate(ssl);
2768 /* Beware anonymous ciphers which lead to server_cert being NULL */
2770 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2771 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2774 int oldpool = store_pool;
2776 peerdn[siz-1] = '\0'; /* paranoia */
2777 store_pool = POOL_PERM;
2778 tlsp->peerdn = string_copy(peerdn);
2779 store_pool = oldpool;
2781 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2782 but they don't get called on session-resumption. So use the official
2783 interface, which uses the resumed value. Unfortunately this claims verified
2784 when it actually failed but we're in try-verify mode, due to us wanting the
2785 knowlege that it failed so needing to have the callback and forcing a
2786 permissive return. If we don't force it, the TLS startup is failed.
2787 The extra bit of information is set in verify_override in the cb, stashed
2788 for resumption next to the TLS session, and used here. */
2790 if (!tlsp->verify_override)
2791 tlsp->certificate_verified =
2793 tlsp->dane_verified ||
2795 SSL_get_verify_result(ssl) == X509_V_OK;
2803 /*************************************************
2804 * Set up for verifying certificates *
2805 *************************************************/
2807 #ifndef DISABLE_OCSP
2808 /* Load certs from file, return TRUE on success */
2811 chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
2814 STACK_OF(X509) * verify_stack = *vp;
2818 while (sk_X509_num(verify_stack) > 0)
2819 X509_free(sk_X509_pop(verify_stack));
2821 verify_stack = sk_X509_new_null();
2823 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
2824 for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
2825 sk_X509_push(verify_stack, x);
2834 /* Called by both client and server startup; on the server possibly
2835 repeated after a Server Name Indication.
2838 sctx SSL_CTX* to initialise
2839 certs certs file, expanded
2840 crl CRL file or NULL
2841 host NULL in a server; the remote host in a client
2842 errstr error string pointer
2844 Returns: OK/DEFER/FAIL
2848 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
2851 uschar *expcerts, *expcrl;
2853 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
2855 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
2857 if (expcerts && *expcerts)
2859 /* Tell the library to use its compiled-in location for the system default
2860 CA bundle. Then add the ones specified in the config, if any. */
2862 if (!SSL_CTX_set_default_verify_paths(sctx))
2863 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
2865 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
2867 struct stat statbuf;
2869 if (Ustat(expcerts, &statbuf) < 0)
2871 log_write(0, LOG_MAIN|LOG_PANIC,
2872 "failed to stat %s for certificates", expcerts);
2878 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
2879 { file = NULL; dir = expcerts; }
2882 STACK_OF(X509) * verify_stack =
2883 #ifndef DISABLE_OCSP
2884 !host ? state_server.verify_stack :
2887 STACK_OF(X509) ** vp = &verify_stack;
2889 file = expcerts; dir = NULL;
2890 #ifndef DISABLE_OCSP
2891 /* In the server if we will be offering an OCSP proof, load chain from
2892 file for verifying the OCSP proof at load time. */
2894 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
2895 This is inconsistent with the need to verify the OCSP proof of the server cert.
2898 && statbuf.st_size > 0
2899 && state_server.u_ocsp.server.file
2900 && !chain_from_pem_file(file, vp)
2903 log_write(0, LOG_MAIN|LOG_PANIC,
2904 "failed to load cert chain from %s", file);
2910 /* If a certificate file is empty, the load function fails with an
2911 unhelpful error message. If we skip it, we get the correct behaviour (no
2912 certificates are recognized, but the error message is still misleading (it
2913 says no certificate was supplied). But this is better. */
2915 if ( (!file || statbuf.st_size > 0)
2916 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
2917 return tls_error(US"SSL_CTX_load_verify_locations",
2918 host, NULL, errstr);
2920 /* On the server load the list of CAs for which we will accept certs, for
2921 sending to the client. This is only for the one-file
2922 tls_verify_certificates variant.
2923 If a list isn't loaded into the server, but some verify locations are set,
2924 the server end appears to make a wildcard request for client certs.
2925 Meanwhile, the client library as default behaviour *ignores* the list
2926 we send over the wire - see man SSL_CTX_set_client_cert_cb.
2927 Because of this, and that the dir variant is likely only used for
2928 the public-CA bundle (not for a private CA), not worth fixing. */
2932 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
2933 int i = sk_X509_NAME_num(names);
2935 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
2936 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
2937 i, i>1 ? "ies":"y");
2941 debug_printf("Added dir for additional certificate authorities\n");
2945 /* Handle a certificate revocation list. */
2947 #if OPENSSL_VERSION_NUMBER > 0x00907000L
2949 /* This bit of code is now the version supplied by Lars Mainka. (I have
2950 merely reformatted it into the Exim code style.)
2952 "From here I changed the code to add support for multiple crl's
2953 in pem format in one file or to support hashed directory entries in
2954 pem format instead of a file. This method now uses the library function
2955 X509_STORE_load_locations to add the CRL location to the SSL context.
2956 OpenSSL will then handle the verify against CA certs and CRLs by
2957 itself in the verify callback." */
2959 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
2960 if (expcrl && *expcrl)
2962 struct stat statbufcrl;
2963 if (Ustat(expcrl, &statbufcrl) < 0)
2965 log_write(0, LOG_MAIN|LOG_PANIC,
2966 "failed to stat %s for certificates revocation lists", expcrl);
2971 /* is it a file or directory? */
2973 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
2974 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
2978 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
2984 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
2986 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
2987 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
2989 /* setting the flags to check against the complete crl chain */
2991 X509_STORE_set_flags(cvstore,
2992 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
2996 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3004 /*************************************************
3005 * Start a TLS session in a server *
3006 *************************************************/
3007 /* This is called when Exim is running as a server, after having received
3008 the STARTTLS command. It must respond to that command, and then negotiate
3012 errstr pointer to error message
3014 Returns: OK on success
3015 DEFER for errors before the start of the negotiation
3016 FAIL for errors during the negotiation; the server can't
3021 tls_server_start(uschar ** errstr)
3024 uschar * expciphers;
3025 exim_openssl_state_st * dummy_statep;
3028 static uschar peerdn[256];
3030 /* Check for previous activation */
3032 if (tls_in.active.sock >= 0)
3034 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3035 smtp_printf("554 Already in TLS\r\n", FALSE);
3039 /* Initialize the SSL library. If it fails, it will already have logged
3042 rc = tls_init(NULL, NULL,
3043 #ifndef DISABLE_OCSP
3046 NULL, &dummy_statep, &tls_in, errstr);
3047 if (rc != OK) return rc;
3048 ctx = state_server.lib_state.lib_ctx;
3050 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3051 were historically separated by underscores. So that I can use either form in my
3052 tests, and also for general convenience, we turn underscores into hyphens here.
3054 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3055 for TLS 1.3 . Since we do not call it at present we get the default list:
3056 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3059 if (state_server.lib_state.pri_string)
3060 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3063 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3067 && (rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3071 /* If this is a host for which certificate verification is mandatory or
3072 optional, set up appropriately. */
3074 tls_in.certificate_verified = FALSE;
3076 tls_in.dane_verified = FALSE;
3078 server_verify_callback_called = FALSE;
3080 if (verify_check_host(&tls_verify_hosts) == OK)
3081 server_verify_optional = FALSE;
3082 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3083 server_verify_optional = TRUE;
3089 if (!expand_check(tls_verify_certificates, US"tls_verify_certificates",
3092 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3094 if (state_server.lib_state.cabundle)
3095 { DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n"); }
3097 if ((rc = setup_certs(ctx, expcerts, tls_crl, NULL, errstr)) != OK)
3100 if (expcerts && *expcerts)
3101 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3105 #ifndef DISABLE_TLS_RESUME
3106 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3107 /* despite working, appears to always return failure, so ignoring */
3109 #ifdef OPENSSL_HAVE_NUM_TICKETS
3110 # ifndef DISABLE_TLS_RESUME
3111 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3113 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3118 /* Prepare for new connection */
3120 if (!(ssl = SSL_new(ctx)))
3121 return tls_error(US"SSL_new", NULL, NULL, errstr);
3122 state_server.lib_state.lib_ssl = ssl;
3124 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3126 * With the SSL_clear(), we get strange interoperability bugs with
3127 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3128 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3130 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3131 * session shutdown. In this case, we have a brand new object and there's no
3132 * obvious reason to immediately clear it. I'm guessing that this was
3133 * originally added because of incomplete initialisation which the clear fixed,
3134 * in some historic release.
3137 /* Set context and tell client to go ahead, except in the case of TLS startup
3138 on connection, where outputting anything now upsets the clients and tends to
3139 make them disconnect. We need to have an explicit fflush() here, to force out
3140 the response. Other smtp_printf() calls do not need it, because in non-TLS
3141 mode, the fflush() happens when smtp_getc() is called. */
3143 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3144 if (!tls_in.on_connect)
3146 smtp_printf("220 TLS go ahead\r\n", FALSE);
3150 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3151 that the OpenSSL library doesn't. */
3153 SSL_set_wfd(ssl, fileno(smtp_out));
3154 SSL_set_rfd(ssl, fileno(smtp_in));
3155 SSL_set_accept_state(ssl);
3157 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3160 sigalrm_seen = FALSE;
3161 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3162 rc = SSL_accept(ssl);
3167 int error = SSL_get_error(ssl, rc);
3170 case SSL_ERROR_NONE:
3173 case SSL_ERROR_ZERO_RETURN:
3174 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3175 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3177 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3180 tls_close(NULL, TLS_NO_SHUTDOWN);
3183 /* Handle genuine errors */
3187 int r = ERR_GET_REASON(ERR_peek_error());
3188 if ( r == SSL_R_WRONG_VERSION_NUMBER
3189 #ifdef SSL_R_VERSION_TOO_LOW
3190 || r == SSL_R_VERSION_TOO_LOW
3192 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3193 s = string_sprintf("%s (%s)", s, SSL_get_version(ssl));
3194 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
3199 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3200 if (error == SSL_ERROR_SYSCALL)
3204 *errstr = US"SSL_accept: TCP connection closed by peer";
3207 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3209 (void) tls_error(US"SSL_accept", NULL,
3210 sigalrm_seen ? US"timed out"
3211 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3217 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3218 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3219 anon-authentication ciphersuite negotiated. */
3221 #ifndef DISABLE_TLS_RESUME
3222 if (SSL_session_reused(ssl))
3224 tls_in.resumption |= RESUME_USED;
3225 DEBUG(D_tls) debug_printf("Session reused\n");
3229 /* TLS has been set up. Record data for the connection,
3230 adjust the input functions to read via TLS, and initialize things. */
3232 #ifdef SSL_get_extms_support
3233 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3235 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3237 tls_in.ver = tlsver_name(ssl);
3238 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3239 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3244 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3245 debug_printf("Shared ciphers: %s\n", buf);
3247 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3249 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
3250 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3255 #ifdef EXIM_HAVE_SESSION_TICKET
3257 SSL_SESSION * ss = SSL_get_session(ssl);
3258 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3259 debug_printf("The session has a ticket, life %lu seconds\n",
3260 SSL_SESSION_get_ticket_lifetime_hint(ss));
3265 /* Record the certificate we presented */
3267 X509 * crt = SSL_get_certificate(ssl);
3268 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3271 /* Channel-binding info for authenticators
3272 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/ */
3275 size_t len = SSL_get_peer_finished(ssl, &c, 0);
3276 int old_pool = store_pool;
3278 SSL_get_peer_finished(ssl, s = store_get((int)len, FALSE), len);
3279 store_pool = POOL_PERM;
3280 tls_in.channelbinding = b64encode_taint(CUS s, (int)len, FALSE);
3281 store_pool = old_pool;
3282 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p\n", tls_in.channelbinding);
3285 /* Only used by the server-side tls (tls_in), including tls_getc.
3286 Client-side (tls_out) reads (seem to?) go via
3287 smtp_read_response()/ip_recv().
3288 Hence no need to duplicate for _in and _out.
3290 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3291 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3292 ssl_xfer_eof = ssl_xfer_error = FALSE;
3294 receive_getc = tls_getc;
3295 receive_getbuf = tls_getbuf;
3296 receive_get_cache = tls_get_cache;
3297 receive_ungetc = tls_ungetc;
3298 receive_feof = tls_feof;
3299 receive_ferror = tls_ferror;
3300 receive_smtp_buffered = tls_smtp_buffered;
3302 tls_in.active.sock = fileno(smtp_out);
3303 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3311 tls_client_basic_ctx_init(SSL_CTX * ctx,
3312 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3317 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3318 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3319 host patterns if one of them is set with content. */
3321 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3322 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3324 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3325 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3328 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3330 client_verify_optional = FALSE;
3331 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3332 client_verify_optional = TRUE;
3338 if (!expand_check(ob->tls_verify_certificates, US"tls_verify_certificates",
3341 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3343 if (state->lib_state.cabundle)
3344 { DEBUG(D_tls) debug_printf("TLS: CA bundle was preloaded\n"); }
3346 if ((rc = setup_certs(ctx, expcerts, ob->tls_crl, host, errstr)) != OK)
3349 if (expcerts && *expcerts)
3350 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3353 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3355 state->verify_cert_hostnames =
3357 string_domain_utf8_to_alabel(host->certname, NULL);
3361 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3362 state->verify_cert_hostnames);
3370 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3373 const char * hostnames[2] = { CS host->name, NULL };
3376 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3377 return tls_error(US"hostnames load", host, NULL, errstr);
3379 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3380 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3381 ) if (rr->type == T_TLSA && rr->size > 3)
3383 const uschar * p = rr->data;
3384 uint8_t usage, selector, mtype;
3385 const char * mdname;
3389 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3390 if (usage != 2 && usage != 3) continue;
3397 default: continue; /* Only match-types 0, 1, 2 are supported */
3398 case 0: mdname = NULL; break;
3399 case 1: mdname = "sha256"; break;
3400 case 2: mdname = "sha512"; break;
3404 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3407 return tls_error(US"tlsa load", host, NULL, errstr);
3408 case 0: /* action not taken */
3412 tls_out.tlsa_usage |= 1<<usage;
3418 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3421 #endif /*SUPPORT_DANE*/
3425 #ifndef DISABLE_TLS_RESUME
3426 /* On the client, get any stashed session for the given IP from hints db
3427 and apply it to the ssl-connection for attempted resumption. */
3430 tls_retrieve_session(tls_support * tlsp, SSL * ssl, const uschar * key)
3432 tlsp->resumption |= RESUME_SUPPORTED;
3433 if (tlsp->host_resumable)
3435 dbdata_tls_session * dt;
3437 open_db dbblock, * dbm_file;
3439 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3440 DEBUG(D_tls) debug_printf("checking for resumable session for %s\n", key);
3441 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3443 /* key for the db is the IP */
3444 if ((dt = dbfn_read_with_length(dbm_file, key, &len)))
3446 SSL_SESSION * ss = NULL;
3447 const uschar * sess_asn1 = dt->session;
3449 len -= sizeof(dbdata_tls_session);
3450 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3454 ERR_error_string_n(ERR_get_error(),
3455 ssl_errstring, sizeof(ssl_errstring));
3456 debug_printf("decoding session: %s\n", ssl_errstring);
3461 unsigned long lifetime =
3462 #ifdef EXIM_HAVE_SESSION_TICKET
3463 SSL_SESSION_get_ticket_lifetime_hint(ss);
3464 #else /* Use, fairly arbitrilarily, what we as server would */
3465 f.running_in_test_harness ? 6 : ssl_session_timeout;
3467 if (lifetime + dt->time_stamp < time(NULL))
3469 DEBUG(D_tls) debug_printf("session expired\n");
3470 dbfn_delete(dbm_file, key);
3472 else if (!SSL_set_session(ssl, ss))
3476 ERR_error_string_n(ERR_get_error(),
3477 ssl_errstring, sizeof(ssl_errstring));
3478 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3483 DEBUG(D_tls) debug_printf("good session\n");
3484 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3485 tlsp->verify_override = dt->verify_override;
3486 tlsp->ocsp = dt->ocsp;
3491 DEBUG(D_tls) debug_printf("no session record\n");
3492 dbfn_close(dbm_file);
3498 /* On the client, save the session for later resumption */
3501 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3503 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3506 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3508 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3510 # ifdef OPENSSL_HAVE_NUM_TICKETS
3511 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3514 int len = i2d_SSL_SESSION(ss, NULL);
3515 int dlen = sizeof(dbdata_tls_session) + len;
3516 dbdata_tls_session * dt = store_get(dlen, TRUE);
3517 uschar * s = dt->session;
3518 open_db dbblock, * dbm_file;
3520 DEBUG(D_tls) debug_printf("session is resumable\n");
3521 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3523 dt->verify_override = tlsp->verify_override;
3524 dt->ocsp = tlsp->ocsp;
3525 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3527 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3529 const uschar * key = cbinfo->host->address;
3530 dbfn_delete(dbm_file, key);
3531 dbfn_write(dbm_file, key, dt, dlen);
3532 dbfn_close(dbm_file);
3533 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3542 tls_client_ctx_resume_prehandshake(
3543 exim_openssl_client_tls_ctx * exim_client_ctx, tls_support * tlsp,
3544 smtp_transport_options_block * ob, host_item * host)
3546 /* Should the client request a session resumption ticket? */
3547 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3549 tlsp->host_resumable = TRUE;
3551 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3552 SSL_SESS_CACHE_CLIENT
3553 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3554 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3559 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3560 host_item * host, uschar ** errstr)
3562 if (tlsp->host_resumable)
3565 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3566 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3568 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3569 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
3571 tls_error(US"set ex_data", host, NULL, errstr);
3574 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state);
3577 tlsp->resumption = RESUME_SUPPORTED;
3578 /* Pick up a previous session, saved on an old ticket */
3579 tls_retrieve_session(tlsp, ssl, host->address);
3584 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
3587 if (SSL_session_reused(exim_client_ctx->ssl))
3589 DEBUG(D_tls) debug_printf("The session was reused\n");
3590 tlsp->resumption |= RESUME_USED;
3593 #endif /* !DISABLE_TLS_RESUME */
3596 /*************************************************
3597 * Start a TLS session in a client *
3598 *************************************************/
3600 /* Called from the smtp transport after STARTTLS has been accepted.
3603 cctx connection context
3604 conn_args connection details
3605 cookie datum for randomness; can be NULL
3606 tlsp record details of TLS channel configuration here; must be non-NULL
3607 errstr error string pointer
3609 Returns: TRUE for success with TLS session context set in connection context,
3614 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3615 void * cookie, tls_support * tlsp, uschar ** errstr)
3617 host_item * host = conn_args->host; /* for msgs and option-tests */
3618 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3619 smtp_transport_options_block * ob = tb
3620 ? (smtp_transport_options_block *)tb->options_block
3621 : &smtp_transport_option_defaults;
3622 exim_openssl_client_tls_ctx * exim_client_ctx;
3623 uschar * expciphers;
3625 static uschar peerdn[256];
3627 #ifndef DISABLE_OCSP
3628 BOOL request_ocsp = FALSE;
3629 BOOL require_ocsp = FALSE;
3633 store_pool = POOL_PERM;
3634 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), FALSE);
3635 exim_client_ctx->corked = NULL;
3639 tlsp->tlsa_usage = 0;
3642 #ifndef DISABLE_OCSP
3644 # ifdef SUPPORT_DANE
3645 /*XXX this should be moved to caller, to be common across gnutls/openssl */
3646 if ( conn_args->dane
3647 && ob->hosts_request_ocsp[0] == '*'
3648 && ob->hosts_request_ocsp[1] == '\0'
3651 /* Unchanged from default. Use a safer one under DANE */
3652 request_ocsp = TRUE;
3653 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3654 " {= {4}{$tls_out_tlsa_usage}} } "
3660 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
3661 request_ocsp = TRUE;
3663 # ifdef SUPPORT_DANE
3667 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3671 rc = tls_init(host, ob,
3672 #ifndef DISABLE_OCSP
3673 (void *)(long)request_ocsp,
3675 cookie, &client_static_state, tlsp, errstr);
3676 if (rc != OK) return FALSE;
3678 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
3680 tlsp->certificate_verified = FALSE;
3681 client_verify_callback_called = FALSE;
3685 if (conn_args->dane)
3687 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3688 other failures should be treated as problems. */
3689 if (ob->dane_require_tls_ciphers &&
3690 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3691 &expciphers, errstr))
3693 if (expciphers && *expciphers == '\0')
3698 !expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
3699 &expciphers, errstr))
3702 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3703 are separated by underscores. So that I can use either form in my tests, and
3704 also for general convenience, we turn underscores into hyphens here. */
3708 uschar *s = expciphers;
3709 while (*s) { if (*s == '_') *s = '-'; s++; }
3710 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
3711 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
3713 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
3719 if (conn_args->dane)
3721 SSL_CTX_set_verify(exim_client_ctx->ctx,
3722 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
3723 verify_callback_client_dane);
3725 if (!DANESSL_library_init())
3727 tls_error(US"library init", host, NULL, errstr);
3730 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
3732 tls_error(US"context init", host, NULL, errstr);
3740 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
3741 client_static_state, errstr) != OK)
3744 #ifndef DISABLE_TLS_RESUME
3745 tls_client_ctx_resume_prehandshake(exim_client_ctx, tlsp, ob, host);
3749 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
3751 tls_error(US"SSL_new", host, NULL, errstr);
3754 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
3756 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
3757 SSL_set_connect_state(exim_client_ctx->ssl);
3761 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
3765 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
3767 else if (!Ustrlen(tlsp->sni))
3771 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
3772 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
3773 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
3775 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
3782 if (conn_args->dane)
3783 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
3787 #ifndef DISABLE_OCSP
3788 /* Request certificate status at connection-time. If the server
3789 does OCSP stapling we will get the callback (set in tls_init()) */
3790 # ifdef SUPPORT_DANE
3794 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3795 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3797 { /* Re-eval now $tls_out_tlsa_usage is populated. If
3798 this means we avoid the OCSP request, we wasted the setup
3799 cost in tls_init(). */
3800 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3801 request_ocsp = require_ocsp
3802 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3809 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
3810 client_static_state->u_ocsp.client.verify_required = require_ocsp;
3811 tlsp->ocsp = OCSP_NOT_RESP;
3815 #ifndef DISABLE_TLS_RESUME
3816 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
3821 #ifndef DISABLE_EVENT
3822 client_static_state->event_action = tb ? tb->event_action : NULL;
3825 /* There doesn't seem to be a built-in timeout on connection. */
3827 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
3828 sigalrm_seen = FALSE;
3829 ALARM(ob->command_timeout);
3830 rc = SSL_connect(exim_client_ctx->ssl);
3834 if (conn_args->dane)
3835 DANESSL_cleanup(exim_client_ctx->ssl);
3840 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
3846 debug_printf("SSL_connect succeeded\n");
3847 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3849 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
3850 SSL_SESSION_print_keylog(bp, SSL_get_session(exim_client_ctx->ssl));
3856 #ifndef DISABLE_TLS_RESUME
3857 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
3860 #ifdef SSL_get_extms_support
3861 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
3863 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
3865 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
3866 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
3867 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
3869 /* Record the certificate we presented */
3871 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
3872 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
3875 /*XXX will this work with continued-TLS? */
3876 /* Channel-binding info for authenticators */
3879 size_t len = SSL_get_finished(exim_client_ctx->ssl, &c, 0);
3880 int old_pool = store_pool;
3882 SSL_get_finished(exim_client_ctx->ssl, s = store_get((int)len, TRUE), len);
3883 store_pool = POOL_PERM;
3884 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, TRUE);
3885 store_pool = old_pool;
3886 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
3889 tlsp->active.sock = cctx->sock;
3890 tlsp->active.tls_ctx = exim_client_ctx;
3891 cctx->tls_ctx = exim_client_ctx;
3900 tls_refill(unsigned lim)
3902 SSL * ssl = state_server.lib_state.lib_ssl;
3906 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
3907 ssl_xfer_buffer, ssl_xfer_buffer_size);
3910 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3911 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
3912 MIN(ssl_xfer_buffer_size, lim));
3913 error = SSL_get_error(ssl, inbytes);
3914 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3916 if (had_command_timeout) /* set by signal handler */
3917 smtp_command_timeout_exit(); /* does not return */
3918 if (had_command_sigterm)
3919 smtp_command_sigterm_exit();
3920 if (had_data_timeout)
3921 smtp_data_timeout_exit();
3922 if (had_data_sigint)
3923 smtp_data_sigint_exit();
3925 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
3926 closed down, not that the socket itself has been closed down. Revert to
3927 non-SSL handling. */
3931 case SSL_ERROR_NONE:
3934 case SSL_ERROR_ZERO_RETURN:
3935 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3937 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3940 tls_close(NULL, TLS_NO_SHUTDOWN);
3943 /* Handle genuine errors */
3945 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3946 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
3947 ssl_xfer_error = TRUE;
3951 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3952 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
3953 debug_printf(" - syscall %s\n", strerror(errno));
3954 ssl_xfer_error = TRUE;
3958 #ifndef DISABLE_DKIM
3959 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
3961 ssl_xfer_buffer_hwm = inbytes;
3962 ssl_xfer_buffer_lwm = 0;
3967 /*************************************************
3968 * TLS version of getc *
3969 *************************************************/
3971 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3972 it refills the buffer via the SSL reading function.
3974 Arguments: lim Maximum amount to read/buffer
3975 Returns: the next character or EOF
3977 Only used by the server-side TLS.
3981 tls_getc(unsigned lim)
3983 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
3984 if (!tls_refill(lim))
3985 return ssl_xfer_error ? EOF : smtp_getc(lim);
3987 /* Something in the buffer; return next uschar */
3989 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
3993 tls_getbuf(unsigned * len)
3998 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
3999 if (!tls_refill(*len))
4001 if (!ssl_xfer_error) return smtp_getbuf(len);
4006 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4008 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4009 ssl_xfer_buffer_lwm += size;
4018 #ifndef DISABLE_DKIM
4019 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4021 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4027 tls_could_read(void)
4029 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4030 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4034 /*************************************************
4035 * Read bytes from TLS channel *
4036 *************************************************/
4040 ct_ctx client context pointer, or NULL for the one global server context
4044 Returns: the number of bytes read
4045 -1 after a failed read, including EOF
4047 Only used by the client-side TLS.
4051 tls_read(void * ct_ctx, uschar *buff, size_t len)
4053 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4054 : state_server.lib_state.lib_ssl;
4058 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4059 buff, (unsigned int)len);
4062 inbytes = SSL_read(ssl, CS buff, len);
4063 error = SSL_get_error(ssl, inbytes);
4065 if (error == SSL_ERROR_ZERO_RETURN)
4067 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4070 else if (error != SSL_ERROR_NONE)
4080 /*************************************************
4081 * Write bytes down TLS channel *
4082 *************************************************/
4086 ct_ctx client context pointer, or NULL for the one global server context
4089 more further data expected soon
4091 Returns: the number of bytes after a successful write,
4092 -1 after a failed write
4094 Used by both server-side and client-side TLS. Calling with len zero and more unset
4095 will flush buffered writes; buff can be null for this case.
4099 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4102 int outbytes, error;
4104 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4105 : state_server.lib_state.lib_ssl;
4106 static gstring * server_corked = NULL;
4107 gstring ** corkedp = ct_ctx
4108 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4109 gstring * corked = *corkedp;
4111 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4112 buff, (unsigned long)len, more ? ", more" : "");
4114 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4115 "more" is notified. This hack is only ok if small amounts are involved AND only
4116 one stream does it, in one context (i.e. no store reset). Currently it is used
4117 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4118 We support callouts done by the server process by using a separate client
4119 context for the stashed information. */
4120 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4121 a store reset there, so use POOL_PERM. */
4122 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4126 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4128 int save_pool = store_pool;
4129 store_pool = POOL_PERM;
4131 corked = string_catn(corked, buff, len);
4133 store_pool = save_pool;
4140 buff = CUS corked->s;
4145 for (int left = len; left > 0;)
4147 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4149 outbytes = SSL_write(ssl, CS buff, left);
4150 error = SSL_get_error(ssl, outbytes);
4151 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4154 case SSL_ERROR_NONE: /* the usual case */
4160 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4161 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4164 case SSL_ERROR_ZERO_RETURN:
4165 log_write(0, LOG_MAIN, "SSL channel closed on write");
4168 case SSL_ERROR_SYSCALL:
4169 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4170 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4171 sender_fullhost ? sender_fullhost : US"<unknown>",
4173 else if (LOGGING(protocol_detail))
4174 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4175 " SMTP response and TLS close\n", sender_host_address);
4177 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4178 " client reset TCP before TLS close\n", sender_host_address);
4182 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4193 ct_ctx client TLS context pointer, or NULL for the one global server context
4197 tls_shutdown_wr(void * ct_ctx)
4199 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4200 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4201 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4204 if (*fdp < 0) return; /* TLS was not active */
4206 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4208 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
4209 rc = SSL_shutdown(*sslp);
4210 if (rc < 0) DEBUG(D_tls)
4212 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4213 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4217 /*************************************************
4218 * Close down a TLS session *
4219 *************************************************/
4221 /* This is also called from within a delivery subprocess forked from the
4222 daemon, to shut down the TLS library, without actually doing a shutdown (which
4223 would tamper with the SSL session in the parent process).
4226 ct_ctx client TLS context pointer, or NULL for the one global server context
4227 do_shutdown 0 no data-flush or TLS close-alert
4228 1 if TLS close-alert is to be sent,
4229 2 if also response to be waited for
4233 Used by both server-side and client-side TLS.
4237 tls_close(void * ct_ctx, int do_shutdown)
4239 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4240 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4241 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4243 if (*fdp < 0) return; /* TLS was not active */
4248 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4249 do_shutdown > 1 ? " (with response-wait)" : "");
4251 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4253 if ( (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4257 rc = SSL_shutdown(*sslp); /* wait for response */
4261 if (rc < 0) DEBUG(D_tls)
4263 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4264 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4268 if (!o_ctx) /* server side */
4270 #ifndef DISABLE_OCSP
4271 sk_X509_pop_free(state_server.verify_stack, X509_free);
4272 state_server.verify_stack = NULL;
4275 receive_getc = smtp_getc;
4276 receive_getbuf = smtp_getbuf;
4277 receive_get_cache = smtp_get_cache;
4278 receive_ungetc = smtp_ungetc;
4279 receive_feof = smtp_feof;
4280 receive_ferror = smtp_ferror;
4281 receive_smtp_buffered = smtp_buffered;
4282 tls_in.active.tls_ctx = NULL;
4284 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4295 /*************************************************
4296 * Let tls_require_ciphers be checked at startup *
4297 *************************************************/
4299 /* The tls_require_ciphers option, if set, must be something which the
4302 Returns: NULL on success, or error message
4306 tls_validate_require_cipher(void)
4309 uschar *s, *expciphers, *err;
4313 if (!(tls_require_ciphers && *tls_require_ciphers))
4316 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4318 return US"failed to expand tls_require_ciphers";
4320 if (!(expciphers && *expciphers))
4323 /* normalisation ripped from above */
4325 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
4329 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4332 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4334 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4336 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4337 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4338 expciphers, ssl_errstring);
4349 /*************************************************
4350 * Report the library versions. *
4351 *************************************************/
4353 /* There have historically been some issues with binary compatibility in
4354 OpenSSL libraries; if Exim (like many other applications) is built against
4355 one version of OpenSSL but the run-time linker picks up another version,
4356 it can result in serious failures, including crashing with a SIGSEGV. So
4357 report the version found by the compiler and the run-time version.
4359 Note: some OS vendors backport security fixes without changing the version
4360 number/string, and the version date remains unchanged. The _build_ date
4361 will change, so we can more usefully assist with version diagnosis by also
4362 reporting the build date.
4364 Arguments: a FILE* to print the results to
4369 tls_version_report(FILE *f)
4371 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
4374 OPENSSL_VERSION_TEXT,
4375 SSLeay_version(SSLEAY_VERSION),
4376 SSLeay_version(SSLEAY_BUILT_ON));
4377 /* third line is 38 characters for the %s and the line is 73 chars long;
4378 the OpenSSL output includes a "built on: " prefix already. */
4384 /*************************************************
4385 * Random number generation *
4386 *************************************************/
4388 /* Pseudo-random number generation. The result is not expected to be
4389 cryptographically strong but not so weak that someone will shoot themselves
4390 in the foot using it as a nonce in input in some email header scheme or
4391 whatever weirdness they'll twist this into. The result should handle fork()
4392 and avoid repeating sequences. OpenSSL handles that for us.
4396 Returns a random number in range [0, max-1]
4400 vaguely_random_number(int max)
4404 static pid_t pidlast = 0;
4406 uschar smallbuf[sizeof(r)];
4412 if (pidnow != pidlast)
4414 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
4415 is unique for each thread", this doesn't apparently apply across processes,
4416 so our own warning from vaguely_random_number_fallback() applies here too.
4417 Fix per PostgreSQL. */
4423 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
4427 gettimeofday(&r.tv, NULL);
4430 RAND_seed(US (&r), sizeof(r));
4432 /* We're after pseudo-random, not random; if we still don't have enough data
4433 in the internal PRNG then our options are limited. We could sleep and hope
4434 for entropy to come along (prayer technique) but if the system is so depleted
4435 in the first place then something is likely to just keep taking it. Instead,
4436 we'll just take whatever little bit of pseudo-random we can still manage to
4439 needed_len = sizeof(r);
4440 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4441 asked for a number less than 10. */
4442 for (r = max, i = 0; r; ++i)
4448 #ifdef EXIM_HAVE_RAND_PSEUDO
4449 /* We do not care if crypto-strong */
4450 i = RAND_pseudo_bytes(smallbuf, needed_len);
4452 i = RAND_bytes(smallbuf, needed_len);
4458 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
4459 return vaguely_random_number_fallback(max);
4463 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4466 /* We don't particularly care about weighted results; if someone wants
4467 smooth distribution and cares enough then they should submit a patch then. */
4474 /*************************************************
4475 * OpenSSL option parse *
4476 *************************************************/
4478 /* Parse one option for tls_openssl_options_parse below
4481 name one option name
4482 value place to store a value for it
4483 Returns success or failure in parsing
4489 tls_openssl_one_option_parse(uschar *name, long *value)
4492 int last = exim_openssl_options_size;
4493 while (last > first)
4495 int middle = (first + last)/2;
4496 int c = Ustrcmp(name, exim_openssl_options[middle].name);
4499 *value = exim_openssl_options[middle].value;
4513 /*************************************************
4514 * OpenSSL option parsing logic *
4515 *************************************************/
4517 /* OpenSSL has a number of compatibility options which an administrator might
4518 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
4519 we look like log_selector.
4522 option_spec the administrator-supplied string of options
4523 results ptr to long storage for the options bitmap
4524 Returns success or failure
4528 tls_openssl_options_parse(uschar *option_spec, long *results)
4531 uschar * exp, * end;
4533 BOOL adding, item_parsed;
4535 /* Server: send no (<= TLS1.2) session tickets */
4536 result = SSL_OP_NO_TICKET;
4538 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
4539 from default because it increases BEAST susceptibility. */
4540 #ifdef SSL_OP_NO_SSLv2
4541 result |= SSL_OP_NO_SSLv2;
4543 #ifdef SSL_OP_NO_SSLv3
4544 result |= SSL_OP_NO_SSLv3;
4546 #ifdef SSL_OP_SINGLE_DH_USE
4547 result |= SSL_OP_SINGLE_DH_USE;
4549 #ifdef SSL_OP_NO_RENEGOTIATION
4550 result |= SSL_OP_NO_RENEGOTIATION;
4559 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
4562 for (uschar * s = exp; *s; /**/)
4564 while (isspace(*s)) ++s;
4567 if (*s != '+' && *s != '-')
4569 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
4570 "+ or - expected but found \"%s\"\n", s);
4573 adding = *s++ == '+';
4574 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
4577 item_parsed = tls_openssl_one_option_parse(s, &item);
4581 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
4584 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
4585 adding ? "adding to " : "removing from", result, item, s);
4597 #endif /*!MACRO_PREDEF*/
4600 /* End of tls-openssl.c */