1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2019 */
6 /* Copyright (c) The Exim Maintainers 2020 - 2021 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Portions Copyright (c) The OpenSSL Project 1999 */
11 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
12 library. It is #included into the tls.c file when that library is used. The
13 code herein is based on a patch that was originally contributed by Steve
14 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
16 No cryptographic code is included in Exim. All this module does is to call
17 functions from the OpenSSL library. */
22 #include <openssl/lhash.h>
23 #include <openssl/ssl.h>
24 #include <openssl/err.h>
25 #include <openssl/rand.h>
26 #ifndef OPENSSL_NO_ECDH
27 # include <openssl/ec.h>
30 # include <openssl/ocsp.h>
38 # define EXIM_OCSP_SKEW_SECONDS (300L)
39 # define EXIM_OCSP_MAX_AGE (-1L)
42 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
43 # define EXIM_HAVE_OPENSSL_TLSEXT
45 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
46 # define EXIM_HAVE_RSA_GENKEY_EX
48 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
49 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define OPENSSL_AUTO_SHA256
52 # define EXIM_HAVE_EPHEM_RSA_KEX
53 # define EXIM_HAVE_RAND_PSEUDO
55 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
56 # define EXIM_HAVE_SHA256
59 /* X509_check_host provides sane certificate hostname checking, but was added
60 to OpenSSL late, after other projects forked off the code-base. So in
61 addition to guarding against the base version number, beware that LibreSSL
62 does not (at this time) support this function.
64 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
65 opt to disentangle and ask a LibreSSL user to provide glue for a third
66 crypto provider for libtls instead of continuing to tie the OpenSSL glue
67 into even twistier knots. If LibreSSL gains the same API, we can just
68 change this guard and punt the issue for a while longer. */
70 #ifndef LIBRESSL_VERSION_NUMBER
71 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
72 # define EXIM_HAVE_OPENSSL_CHECKHOST
73 # define EXIM_HAVE_OPENSSL_DH_BITS
74 # define EXIM_HAVE_OPENSSL_TLS_METHOD
75 # define EXIM_HAVE_OPENSSL_KEYLOG
76 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
77 # define EXIM_HAVE_SESSION_TICKET
78 # define EXIM_HAVE_OPESSL_TRACE
79 # define EXIM_HAVE_OPESSL_GET0_SERIAL
81 # define EXIM_HAVE_OCSP
83 # define EXIM_HAVE_ALPN /* fail ret from hshake-cb is ignored by LibreSSL */
85 # define EXIM_NEED_OPENSSL_INIT
87 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
88 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
89 # define EXIM_HAVE_OPENSSL_CHECKHOST
93 #if LIBRESSL_VERSION_NUMBER >= 0x3040000fL
94 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
97 #if !defined(LIBRESSL_VERSION_NUMBER) \
98 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
99 # if !defined(OPENSSL_NO_ECDH)
100 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
101 # define EXIM_HAVE_ECDH
103 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
104 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
109 #ifndef LIBRESSL_VERSION_NUMBER
110 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
111 # define OPENSSL_HAVE_KEYLOG_CB
112 # define OPENSSL_HAVE_NUM_TICKETS
113 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
115 # define OPENSSL_BAD_SRVR_OURCERT
119 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
120 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
121 # define DISABLE_OCSP
124 #ifndef DISABLE_TLS_RESUME
125 # if OPENSSL_VERSION_NUMBER < 0x0101010L
126 # error OpenSSL version too old for session-resumption
130 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
131 # include <openssl/x509v3.h>
134 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
135 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
136 # define SSL_CIPHER_get_id(c) (c->id)
138 # ifndef MACRO_PREDEF
139 # include "tls-cipher-stdname.c"
143 /*************************************************
144 * OpenSSL option parse *
145 *************************************************/
147 typedef struct exim_openssl_option {
150 } exim_openssl_option;
151 /* We could use a macro to expand, but we need the ifdef and not all the
152 options document which version they were introduced in. Policylet: include
153 all options unless explicitly for DTLS, let the administrator choose which
156 This list is current as of:
159 XXX could we autobuild this list, as with predefined-macros?
160 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
161 Also allow a numeric literal?
163 static exim_openssl_option exim_openssl_options[] = {
164 /* KEEP SORTED ALPHABETICALLY! */
166 { US"all", (long) SSL_OP_ALL },
168 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
169 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
171 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
172 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
174 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
175 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
177 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
178 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
180 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
181 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
183 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
184 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
186 #ifdef SSL_OP_EPHEMERAL_RSA
187 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
189 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
190 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
192 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
193 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
195 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
196 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
198 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
199 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
201 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
202 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
204 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
205 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
207 #ifdef SSL_OP_NO_ANTI_REPLAY
208 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
210 #ifdef SSL_OP_NO_COMPRESSION
211 { US"no_compression", SSL_OP_NO_COMPRESSION },
213 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
214 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
216 #ifdef SSL_OP_NO_RENEGOTIATION
217 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
219 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
220 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
222 #ifdef SSL_OP_NO_SSLv2
223 { US"no_sslv2", SSL_OP_NO_SSLv2 },
225 #ifdef SSL_OP_NO_SSLv3
226 { US"no_sslv3", SSL_OP_NO_SSLv3 },
228 #ifdef SSL_OP_NO_TICKET
229 { US"no_ticket", SSL_OP_NO_TICKET },
231 #ifdef SSL_OP_NO_TLSv1
232 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
234 #ifdef SSL_OP_NO_TLSv1_1
235 # if OPENSSL_VERSION_NUMBER < 0x30000000L
236 # if SSL_OP_NO_TLSv1_1 == 0x00000400L
237 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
238 # warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
239 # define NO_SSL_OP_NO_TLSv1_1
242 # ifndef NO_SSL_OP_NO_TLSv1_1
243 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
246 #ifdef SSL_OP_NO_TLSv1_2
247 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
249 #ifdef SSL_OP_NO_TLSv1_3
250 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
252 #ifdef SSL_OP_PRIORITIZE_CHACHA
253 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
255 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
256 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
258 #ifdef SSL_OP_SINGLE_DH_USE
259 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
261 #ifdef SSL_OP_SINGLE_ECDH_USE
262 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
264 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
265 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
267 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
268 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
270 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
271 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
273 #ifdef SSL_OP_TLS_D5_BUG
274 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
276 #ifdef SSL_OP_TLS_ROLLBACK_BUG
277 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
279 #ifdef SSL_OP_TLSEXT_PADDING
280 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
285 static int exim_openssl_options_size = nelem(exim_openssl_options);
286 static long init_options = 0;
295 for (struct exim_openssl_option * o = exim_openssl_options;
296 o < exim_openssl_options + nelem(exim_openssl_options); o++)
298 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
299 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
301 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
302 builtin_macro_create(buf);
305 # ifndef DISABLE_TLS_RESUME
306 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
308 # ifdef SSL_OP_NO_TLSv1_3
309 builtin_macro_create(US"_HAVE_TLS1_3");
311 # ifdef OPENSSL_BAD_SRVR_OURCERT
312 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
314 # ifdef EXIM_HAVE_OCSP
315 builtin_macro_create(US"_HAVE_TLS_OCSP");
316 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
318 # ifdef EXIM_HAVE_ALPN
319 builtin_macro_create(US"_HAVE_TLS_ALPN");
324 /******************************************************************************/
326 /* Structure for collecting random data for seeding. */
328 typedef struct randstuff {
333 /* Local static variables */
335 static BOOL client_verify_callback_called = FALSE;
336 static BOOL server_verify_callback_called = FALSE;
337 static const uschar *sid_ctx = US"exim";
339 /* We have three different contexts to care about.
341 Simple case: client, `client_ctx`
342 As a client, we can be doing a callout or cut-through delivery while receiving
343 a message. So we have a client context, which should have options initialised
344 from the SMTP Transport. We may also concurrently want to make TLS connections
345 to utility daemons, so client-contexts are allocated and passed around in call
346 args rather than using a gobal.
349 There are two cases: with and without ServerNameIndication from the client.
350 Given TLS SNI, we can be using different keys, certs and various other
351 configuration settings, because they're re-expanded with $tls_sni set. This
352 allows vhosting with TLS. This SNI is sent in the handshake.
353 A client might not send SNI, so we need a fallback, and an initial setup too.
354 So as a server, we start out using `server_ctx`.
355 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
356 `server_sni` from `server_ctx` and then initialise settings by re-expanding
364 } exim_openssl_client_tls_ctx;
367 /* static SSL_CTX *server_ctx = NULL; */
368 /* static SSL *server_ssl = NULL; */
370 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
371 static SSL_CTX *server_sni = NULL;
373 #ifdef EXIM_HAVE_ALPN
374 static BOOL server_seen_alpn = FALSE;
377 static char ssl_errstring[256];
379 static int ssl_session_timeout = 7200; /* Two hours */
380 static BOOL client_verify_optional = FALSE;
381 static BOOL server_verify_optional = FALSE;
383 static BOOL reexpand_tls_files_for_sni = FALSE;
386 typedef struct ocsp_resp {
387 struct ocsp_resp * next;
388 OCSP_RESPONSE * resp;
391 typedef struct exim_openssl_state {
392 exim_tlslib_state lib_state;
393 #define lib_ctx libdata0
394 #define lib_ssl libdata1
397 uschar * certificate;
401 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
405 const uschar *file_expanded;
406 ocsp_resplist *olist;
409 X509_STORE *verify_store; /* non-null if status requested */
410 BOOL verify_required;
415 /* these are cached from first expand */
416 uschar * server_cipher_list;
417 /* only passed down to tls_error: */
419 const uschar * verify_cert_hostnames;
420 #ifndef DISABLE_EVENT
421 uschar * event_action;
423 } exim_openssl_state_st;
425 /* should figure out a cleanup of API to handle state preserved per
426 implementation, for various reasons, which can be void * in the APIs.
427 For now, we hack around it. */
428 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
429 exim_openssl_state_st state_server = {.is_server = TRUE};
432 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
437 static int tls_server_stapling_cb(SSL *s, void *arg);
442 /* Daemon-called, before every connection, key create/rotate */
443 #ifndef DISABLE_TLS_RESUME
444 static void tk_init(void);
445 static int tls_exdata_idx = -1;
449 tls_per_lib_daemon_tick(void)
451 #ifndef DISABLE_TLS_RESUME
456 /* Called once at daemon startup */
459 tls_per_lib_daemon_init(void)
461 tls_daemon_creds_reload();
465 /*************************************************
467 *************************************************/
469 /* Called from lots of places when errors occur before actually starting to do
470 the TLS handshake, that is, while the session is still in clear. Always returns
471 DEFER for a server and FAIL for a client so that most calls can use "return
472 tls_error(...)" to do this processing and then give an appropriate return. A
473 single function is used for both server and client, because it is called from
474 some shared functions.
477 prefix text to include in the logged error
478 host NULL if setting up a server;
479 the connected host if setting up a client
480 msg error message or NULL if we should ask OpenSSL
481 errstr pointer to output error message
483 Returns: OK/DEFER/FAIL
487 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
491 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
492 msg = US ssl_errstring;
495 msg = string_sprintf("(%s): %s", prefix, msg);
496 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
497 if (errstr) *errstr = msg;
498 return host ? FAIL : DEFER;
503 /**************************************************
504 * General library initalisation *
505 **************************************************/
508 lib_rand_init(void * addr)
511 if (!RAND_status()) return TRUE;
513 gettimeofday(&r.tv, NULL);
515 RAND_seed(US (&r), sizeof(r));
516 RAND_seed(US big_buffer, big_buffer_size);
517 if (addr) RAND_seed(US addr, sizeof(addr));
519 return RAND_status();
524 tls_openssl_init(void)
526 static BOOL once = FALSE;
530 #ifdef EXIM_NEED_OPENSSL_INIT
531 SSL_load_error_strings(); /* basic set up */
532 OpenSSL_add_ssl_algorithms();
535 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
536 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
537 list of available digests. */
538 EVP_add_digest(EVP_sha256());
541 (void) lib_rand_init(NULL);
542 (void) tls_openssl_options_parse(openssl_options, &init_options);
547 /*************************************************
548 * Initialize for DH *
549 *************************************************/
551 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
555 sctx The current SSL CTX (inbound or outbound)
556 dhparam DH parameter file or fixed parameter identity string
557 errstr error string pointer
559 Returns: TRUE if OK (nothing to set up, or setup worked)
563 init_dh(SSL_CTX * sctx, uschar * dhparam, uschar ** errstr)
566 #if OPENSSL_VERSION_NUMBER < 0x30000000L
575 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
578 if (!dhexpanded || !*dhexpanded)
579 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
580 else if (dhexpanded[0] == '/')
582 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
584 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
585 NULL, US strerror(errno), errstr);
591 if (Ustrcmp(dhexpanded, "none") == 0)
593 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
597 if (!(pem = std_dh_prime_named(dhexpanded)))
599 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
600 NULL, US strerror(errno), errstr);
603 bio = BIO_new_mem_buf(CS pem, -1);
607 #if OPENSSL_VERSION_NUMBER < 0x30000000L
608 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)
610 pkey = PEM_read_bio_Parameters_ex(bio, NULL, NULL, NULL)
615 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
620 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
621 an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with 2236.
622 But older OpenSSL can only report in bytes (octets), not bits. If someone wants
623 to dance at the edge, then they can raise the limit or use current libraries. */
625 #if OPENSSL_VERSION_NUMBER < 0x30000000L
626 # ifdef EXIM_HAVE_OPENSSL_DH_BITS
627 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
628 This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
629 dh_bitsize = DH_bits(dh);
631 dh_bitsize = 8 * DH_size(dh);
634 dh_bitsize = EVP_PKEY_get_bits(pkey);
637 /* Even if it is larger, we silently return success rather than cause things to
638 fail out, so that a too-large DH will not knock out all TLS; it's a debatable
639 choice. Likewise for a failing attempt to set one. */
641 if (dh_bitsize <= tls_dh_max_bits)
644 #if OPENSSL_VERSION_NUMBER < 0x30000000L
645 SSL_CTX_set_tmp_dh(sctx, dh)
647 SSL_CTX_set0_tmp_dh_pkey(sctx, pkey)
651 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
652 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (D-H param setting '%s'): %s",
653 dhexpanded ? dhexpanded : US"default", ssl_errstring);
654 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
655 /* EVP_PKEY_free(pkey); crashes */
660 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
661 dhexpanded ? dhexpanded : US"default", dh_bitsize);
665 debug_printf("dhparams '%s' %d bits, is > tls_dh_max_bits limit of %d\n",
666 dhexpanded ? dhexpanded : US"default", dh_bitsize, tls_dh_max_bits);
668 #if OPENSSL_VERSION_NUMBER < 0x30000000L
671 /* The EVP_PKEY ownership stays with the ctx; do not free it */
680 /*************************************************
681 * Initialize for ECDH *
682 *************************************************/
684 /* Load parameters for ECDH encryption. Server only.
686 For now, we stick to NIST P-256 because: it's simple and easy to configure;
687 it avoids any patent issues that might bite redistributors; despite events in
688 the news and concerns over curve choices, we're not cryptographers, we're not
689 pretending to be, and this is "good enough" to be better than no support,
690 protecting against most adversaries. Given another year or two, there might
691 be sufficient clarity about a "right" way forward to let us make an informed
692 decision, instead of a knee-jerk reaction.
694 Longer-term, we should look at supporting both various named curves and
695 external files generated with "openssl ecparam", much as we do for init_dh().
696 We should also support "none" as a value, to explicitly avoid initialisation.
701 sctx The current SSL CTX (inbound or outbound)
702 errstr error string pointer
704 Returns: TRUE if OK (nothing to set up, or setup worked)
708 init_ecdh(SSL_CTX * sctx, uschar ** errstr)
710 #ifdef OPENSSL_NO_ECDH
718 # ifndef EXIM_HAVE_ECDH
720 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
724 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
726 if (!exp_curve || !*exp_curve)
729 /* "auto" needs to be handled carefully.
730 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
731 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
732 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
733 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
734 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
736 if (Ustrcmp(exp_curve, "auto") == 0)
738 #if OPENSSL_VERSION_NUMBER < 0x10002000L
739 DEBUG(D_tls) debug_printf(
740 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
741 exp_curve = US"prime256v1";
743 # if defined SSL_CTRL_SET_ECDH_AUTO
744 DEBUG(D_tls) debug_printf(
745 "ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n");
746 SSL_CTX_set_ecdh_auto(sctx, 1);
749 DEBUG(D_tls) debug_printf(
750 "ECDH OpenSSL 1.1.0+: temp key parameter settings: default selection\n");
756 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
757 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
758 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
759 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
763 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
768 # if OPENSSL_VERSION_NUMBER < 0x30000000L
771 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
773 tls_error(US"Unable to create ec curve", NULL, NULL, errstr);
777 /* The "tmp" in the name here refers to setting a temporary key
778 not to the stability of the interface. */
780 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
781 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), NULL, NULL, errstr);
783 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
787 #else /* v 3.0.0 + */
789 if ((rv = SSL_CTX_set1_groups(sctx, &nid, 1)) == 0)
790 tls_error(string_sprintf("Error enabling '%s' group", exp_curve), NULL, NULL, errstr);
792 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' group\n", exp_curve);
798 # endif /*EXIM_HAVE_ECDH*/
799 #endif /*OPENSSL_NO_ECDH*/
804 /*************************************************
805 * Expand key and cert file specs *
806 *************************************************/
808 #if OPENSSL_VERSION_NUMBER < 0x30000000L
811 s SSL connection (not used)
815 Returns: pointer to generated key
819 rsa_callback(SSL *s, int export, int keylength)
822 #ifdef EXIM_HAVE_RSA_GENKEY_EX
823 BIGNUM *bn = BN_new();
826 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
828 # ifdef EXIM_HAVE_RSA_GENKEY_EX
829 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
830 || !(rsa_key = RSA_new())
831 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
834 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
838 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
839 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
845 #endif /* pre-3.0.0 */
849 /* Create and install a selfsigned certificate, for use in server mode */
850 /*XXX we could arrange to call this during prelo for a null tls_certificate option.
851 The normal cache inval + relo will suffice.
852 Just need a timer for inval. */
855 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
862 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
863 where = US"allocating pkey";
864 if (!(pkey = EVP_PKEY_new()))
867 where = US"allocating cert";
868 if (!(x509 = X509_new()))
871 where = US"generating pkey";
872 #if OPENSSL_VERSION_NUMBER < 0x30000000L
875 if (!(rsa = rsa_callback(NULL, 0, 2048)))
878 where = US"assigning pkey";
879 if (!EVP_PKEY_assign_RSA(pkey, rsa))
883 pkey = EVP_RSA_gen(2048);
886 X509_set_version(x509, 2); /* N+1 - version 3 */
887 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
888 X509_gmtime_adj(X509_get_notBefore(x509), 0);
889 X509_gmtime_adj(X509_get_notAfter(x509), (long)2 * 60 * 60); /* 2 hour */
890 X509_set_pubkey(x509, pkey);
892 name = X509_get_subject_name(x509);
893 X509_NAME_add_entry_by_txt(name, "C",
894 MBSTRING_ASC, CUS "UK", -1, -1, 0);
895 X509_NAME_add_entry_by_txt(name, "O",
896 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
897 X509_NAME_add_entry_by_txt(name, "CN",
898 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
899 X509_set_issuer_name(x509, name);
901 where = US"signing cert";
902 if (!X509_sign(x509, pkey, EVP_md5()))
905 where = US"installing selfsign cert";
906 if (!SSL_CTX_use_certificate(sctx, x509))
909 where = US"installing selfsign key";
910 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
916 (void) tls_error(where, NULL, NULL, errstr);
917 if (x509) X509_free(x509);
918 if (pkey) EVP_PKEY_free(pkey);
928 /*************************************************
929 * Information callback *
930 *************************************************/
932 /* The SSL library functions call this from time to time to indicate what they
933 are doing. We copy the string to the debugging output when TLS debugging has
945 info_callback(SSL *s, int where, int ret)
951 if (where & SSL_ST_CONNECT)
952 str = US"SSL_connect";
953 else if (where & SSL_ST_ACCEPT)
954 str = US"SSL_accept";
956 str = US"SSL info (undefined)";
958 if (where & SSL_CB_LOOP)
959 debug_printf("%s: %s\n", str, SSL_state_string_long(s));
960 else if (where & SSL_CB_ALERT)
961 debug_printf("SSL3 alert %s:%s:%s\n",
962 str = where & SSL_CB_READ ? US"read" : US"write",
963 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
964 else if (where & SSL_CB_EXIT)
967 debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
969 debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
971 else if (where & SSL_CB_HANDSHAKE_START)
972 debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
973 else if (where & SSL_CB_HANDSHAKE_DONE)
974 debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s));
978 #ifdef OPENSSL_HAVE_KEYLOG_CB
980 keylog_callback(const SSL *ssl, const char *line)
984 DEBUG(D_tls) debug_printf("%.200s\n", line);
985 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
986 if (!(fp = fopen(filename, "a"))) return;
987 fprintf(fp, "%s\n", line);
996 #ifndef DISABLE_EVENT
998 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
999 BOOL *calledp, const BOOL *optionalp, const uschar * what)
1005 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
1008 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
1009 old_cert = tlsp->peercert;
1010 tlsp->peercert = X509_dup(cert);
1011 /* NB we do not bother setting peerdn */
1012 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth), &errno)))
1014 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
1015 "depth=%d cert=%s: %s",
1016 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1017 what, depth, dn, yield);
1021 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
1022 return 1; /* reject (leaving peercert set) */
1024 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
1025 "(host in tls_try_verify_hosts)\n");
1026 tlsp->verify_override = TRUE;
1028 X509_free(tlsp->peercert);
1029 tlsp->peercert = old_cert;
1035 /*************************************************
1036 * Callback for verification *
1037 *************************************************/
1039 /* The SSL library does certificate verification if set up to do so. This
1040 callback has the current yes/no state is in "state". If verification succeeded,
1041 we set the certificate-verified flag. If verification failed, what happens
1042 depends on whether the client is required to present a verifiable certificate
1045 If verification is optional, we change the state to yes, but still log the
1046 verification error. For some reason (it really would help to have proper
1047 documentation of OpenSSL), this callback function then gets called again, this
1048 time with state = 1. We must take care not to set the private verified flag on
1049 the second time through.
1051 Note: this function is not called if the client fails to present a certificate
1052 when asked. We get here only if a certificate has been received. Handling of
1053 optional verification for this case is done when requesting SSL to verify, by
1054 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
1056 May be called multiple times for different issues with a certificate, even
1057 for a given "depth" in the certificate chain.
1060 preverify_ok current yes/no state as 1/0
1061 x509ctx certificate information.
1062 tlsp per-direction (client vs. server) support data
1063 calledp has-been-called flag
1064 optionalp verification-is-optional flag
1066 Returns: 0 if verification should fail, otherwise 1
1070 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1071 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1073 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1074 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1077 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1079 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1080 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1081 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1084 dn[sizeof(dn)-1] = '\0';
1086 tlsp->verify_override = FALSE;
1087 if (preverify_ok == 0)
1089 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1090 *verify_mode, sender_host_address)
1092 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1093 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1095 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1099 if (!tlsp->peercert)
1100 tlsp->peercert = X509_dup(cert); /* record failing cert */
1101 return 0; /* reject */
1103 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1104 "tls_try_verify_hosts)\n");
1105 tlsp->verify_override = TRUE;
1108 else if (depth != 0)
1110 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1111 #ifndef DISABLE_OCSP
1112 if (tlsp == &tls_out && client_static_state->u_ocsp.client.verify_store)
1113 { /* client, wanting stapling */
1114 /* Add the server cert's signing chain as the one
1115 for the verification of the OCSP stapled information. */
1117 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1120 sk_X509_push(client_static_state->verify_stack, cert);
1123 #ifndef DISABLE_EVENT
1124 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1125 return 0; /* reject, with peercert set */
1130 const uschar * verify_cert_hostnames;
1132 if ( tlsp == &tls_out
1133 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1134 /* client, wanting hostname check */
1137 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1138 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1139 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1141 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1142 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1145 const uschar * list = verify_cert_hostnames;
1148 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1149 if ((rc = X509_check_host(cert, CCS name, 0,
1150 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1151 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1156 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1157 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1164 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1167 uschar * extra = verify_mode
1168 ? string_sprintf(" (during %c-verify for [%s])",
1169 *verify_mode, sender_host_address)
1171 log_write(0, LOG_MAIN,
1172 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1173 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1174 extra, dn, verify_cert_hostnames);
1178 if (!tlsp->peercert)
1179 tlsp->peercert = X509_dup(cert); /* record failing cert */
1180 return 0; /* reject */
1182 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1183 "tls_try_verify_hosts)\n");
1184 tlsp->verify_override = TRUE;
1188 #ifndef DISABLE_EVENT
1189 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1190 return 0; /* reject, with peercert set */
1193 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1194 *calledp ? "" : " authenticated", dn);
1198 return 1; /* accept, at least for this level */
1202 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1204 return verify_callback(preverify_ok, x509ctx, &tls_out,
1205 &client_verify_callback_called, &client_verify_optional);
1209 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1211 return verify_callback(preverify_ok, x509ctx, &tls_in,
1212 &server_verify_callback_called, &server_verify_optional);
1218 /* This gets called *by* the dane library verify callback, which interposes
1222 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1224 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1226 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1227 #ifndef DISABLE_EVENT
1228 BOOL dummy_called, optional = FALSE;
1231 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1233 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1234 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1235 deliver_host_address);
1238 dn[sizeof(dn)-1] = '\0';
1240 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1241 preverify_ok ? "ok":"BAD", depth, dn);
1243 #ifndef DISABLE_EVENT
1244 if (verify_event(&tls_out, cert, depth, dn,
1245 &dummy_called, &optional, US"DANE"))
1246 return 0; /* reject, with peercert set */
1249 if (preverify_ok == 1)
1251 tls_out.dane_verified = TRUE;
1252 #ifndef DISABLE_OCSP
1253 if (client_static_state->u_ocsp.client.verify_store)
1254 { /* client, wanting stapling */
1255 /* Add the server cert's signing chain as the one
1256 for the verification of the OCSP stapled information. */
1258 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1261 sk_X509_push(client_static_state->verify_stack, cert);
1267 int err = X509_STORE_CTX_get_error(x509ctx);
1269 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1270 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1273 return preverify_ok;
1276 #endif /*SUPPORT_DANE*/
1279 #ifndef DISABLE_OCSP
1280 /*************************************************
1281 * Load OCSP information into state *
1282 *************************************************/
1283 /* Called to load the server OCSP response from the given file into memory, once
1284 caller has determined this is needed. Checks validity. Debugs a message
1287 ASSUMES: single response, for single cert.
1290 state various parts of session state
1291 filename the filename putatively holding an OCSP response
1292 is_pem file is PEM format; otherwise is DER
1296 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1300 OCSP_RESPONSE * resp;
1301 OCSP_BASICRESP * basic_response;
1302 OCSP_SINGLERESP * single_response;
1303 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1304 STACK_OF(X509) * sk;
1305 unsigned long verify_flags;
1306 int status, reason, i;
1309 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1311 if (!filename || !*filename) return;
1314 if (!(bio = BIO_new_file(CS filename, "rb")))
1316 log_write(0, LOG_MAIN|LOG_PANIC,
1317 "Failed to open OCSP response file \"%s\": %.100s",
1318 filename, ERR_reason_error_string(ERR_get_error()));
1324 uschar * data, * freep;
1327 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1329 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
1330 filename, ERR_reason_error_string(ERR_get_error()));
1334 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1335 OPENSSL_free(freep);
1338 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1343 log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
1344 filename, ERR_reason_error_string(ERR_get_error()));
1348 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1350 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1351 OCSP_response_status_str(status), status);
1357 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1358 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1363 if (!(basic_response = OCSP_response_get1_basic(resp)))
1366 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1370 sk = state->verify_stack;
1371 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1373 /* May need to expose ability to adjust those flags?
1374 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1375 OCSP_TRUSTOTHER OCSP_NOINTERN */
1377 /* This does a full verify on the OCSP proof before we load it for serving
1378 up; possibly overkill - just date-checks might be nice enough.
1380 OCSP_basic_verify takes a "store" arg, but does not
1381 use it for the chain verification, which is all we do
1382 when OCSP_NOVERIFY is set. The content from the wire
1383 "basic_response" and a cert-stack "sk" are all that is used.
1385 We have a stack, loaded in setup_certs() if tls_verify_certificates
1386 was a file (not a directory, or "system"). It is unfortunate we
1387 cannot used the connection context store, as that would neatly
1388 handle the "system" case too, but there seems to be no library
1389 function for getting a stack from a store.
1390 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1391 We do not free the stack since it could be needed a second time for
1394 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1395 be a public interface into the OpenSSL library (there's no manual entry) -
1396 But what with? We also use OCSP_basic_verify in the client stapling callback.
1397 And there we NEED it; we must verify that status... unless the
1398 library does it for us anyway? */
1400 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
1404 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1405 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
1410 /* Here's the simplifying assumption: there's only one response, for the
1411 one certificate we use, and nothing for anything else in a chain. If this
1412 proves false, we need to extract a cert id from our issued cert
1413 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1414 right cert in the stack and then calls OCSP_single_get0_status()).
1416 I'm hoping to avoid reworking a bunch more of how we handle state here.
1418 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1421 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1424 debug_printf("Unable to get first response from OCSP basic response.\n");
1428 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1429 if (status != V_OCSP_CERTSTATUS_GOOD)
1431 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1432 OCSP_cert_status_str(status), status,
1433 OCSP_crl_reason_str(reason), reason);
1437 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1439 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
1444 /* Add the resp to the list used by tls_server_stapling_cb() */
1446 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1447 while (oentry = *op)
1449 *op = oentry = store_get(sizeof(ocsp_resplist), GET_UNTAINTED);
1450 oentry->next = NULL;
1451 oentry->resp = resp;
1456 if (f.running_in_test_harness)
1458 extern char ** environ;
1459 if (environ) for (uschar ** p = USS environ; *p; p++)
1460 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1462 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1463 goto supply_response;
1471 ocsp_free_response_list(exim_openssl_state_st * cbinfo)
1473 for (ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; olist;
1474 olist = olist->next)
1475 OCSP_RESPONSE_free(olist->resp);
1476 cbinfo->u_ocsp.server.olist = NULL;
1478 #endif /*!DISABLE_OCSP*/
1485 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1488 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1489 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1490 return tls_error(string_sprintf(
1491 "SSL_CTX_use_certificate_chain_file file=%s", file),
1492 cbinfo->host, NULL, errstr);
1497 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1500 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1501 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1502 return tls_error(string_sprintf(
1503 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1510 /* Called once during tls_init and possibly again during TLS setup, for a
1511 new context, if Server Name Indication was used and tls_sni was seen in
1512 the certificate string.
1515 sctx the SSL_CTX* to update
1516 state various parts of session state
1517 errstr error string pointer
1519 Returns: OK/DEFER/FAIL
1523 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1528 if (!state->certificate)
1530 if (!state->is_server) /* client */
1533 if (tls_install_selfsign(sctx, errstr) != OK)
1540 if ( !reexpand_tls_files_for_sni
1541 && ( Ustrstr(state->certificate, US"tls_sni")
1542 || Ustrstr(state->certificate, US"tls_in_sni")
1543 || Ustrstr(state->certificate, US"tls_out_sni")
1545 reexpand_tls_files_for_sni = TRUE;
1547 if (!expand_check(state->certificate, US"tls_certificate", &expanded, errstr))
1551 if (state->is_server)
1553 const uschar * file_list = expanded;
1556 #ifndef DISABLE_OCSP
1557 const uschar * olist = state->u_ocsp.server.file;
1560 BOOL fmt_pem = FALSE;
1563 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1565 if (olist && !*olist)
1568 if ( state->u_ocsp.server.file_expanded && olist
1569 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1571 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1576 ocsp_free_response_list(state);
1577 state->u_ocsp.server.file_expanded = olist;
1581 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1583 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1586 #ifndef DISABLE_OCSP
1588 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1590 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1595 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1600 ocsp_load_response(state, ofile, fmt_pem);
1603 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1607 else /* would there ever be a need for multiple client certs? */
1608 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1611 if ( state->privatekey
1612 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr))
1615 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1616 of the expansion is an empty string, ignore it also, and assume the private
1617 key is in the same file as the certificate. */
1619 if (expanded && *expanded)
1620 if (state->is_server)
1622 const uschar * file_list = expanded;
1626 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1627 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1630 else /* would there ever be a need for multiple client certs? */
1631 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1641 /**************************************************
1642 * One-time init credentials for server and client *
1643 **************************************************/
1646 normalise_ciphers(uschar ** ciphers, const uschar * pre_expansion_ciphers)
1648 uschar * s = *ciphers;
1650 if (!s || !Ustrchr(s, '_')) return; /* no change needed */
1652 if (s == pre_expansion_ciphers)
1653 s = string_copy(s); /* get writable copy */
1655 for (uschar * t = s; *t; t++) if (*t == '_') *t = '-';
1660 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1661 uschar * ciphers, uschar ** errstr)
1663 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1664 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1665 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1666 state->server_cipher_list = ciphers;
1673 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1676 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1677 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1679 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1681 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1683 /* Set up the information callback, which outputs if debugging is at a suitable
1688 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1689 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1690 /* this needs a debug build of OpenSSL */
1691 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
1693 #ifdef OPENSSL_HAVE_KEYLOG_CB
1694 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
1698 /* Automatically re-try reads/writes after renegotiation. */
1699 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1706 tls_server_creds_init(void)
1709 uschar * dummy_errstr;
1710 unsigned lifetime = 0;
1714 state_server.lib_state = null_tls_preload;
1716 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1718 state_server.lib_state.lib_ctx = ctx;
1720 /* Preload DH params and EC curve */
1722 if (opt_unset_or_noexpand(tls_dhparam))
1724 DEBUG(D_tls) debug_printf("TLS: preloading DH params for server\n");
1725 if (init_dh(ctx, tls_dhparam, &dummy_errstr))
1726 state_server.lib_state.dh = TRUE;
1729 DEBUG(D_tls) debug_printf("TLS: not preloading DH params for server\n");
1730 if (opt_unset_or_noexpand(tls_eccurve))
1732 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for server\n");
1733 if (init_ecdh(ctx, &dummy_errstr))
1734 state_server.lib_state.ecdh = TRUE;
1737 DEBUG(D_tls) debug_printf("TLS: not preloading ECDH curve for server\n");
1739 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1740 /* If we can, preload the server-side cert, key and ocsp */
1742 if ( opt_set_and_noexpand(tls_certificate)
1743 # ifndef DISABLE_OCSP
1744 && opt_unset_or_noexpand(tls_ocsp_file)
1746 && opt_unset_or_noexpand(tls_privatekey))
1748 /* Set watches on the filenames. The implementation does de-duplication
1749 so we can just blindly do them all. */
1751 if ( tls_set_watch(tls_certificate, TRUE)
1752 # ifndef DISABLE_OCSP
1753 && tls_set_watch(tls_ocsp_file, TRUE)
1755 && tls_set_watch(tls_privatekey, TRUE))
1757 state_server.certificate = tls_certificate;
1758 state_server.privatekey = tls_privatekey;
1759 #ifndef DISABLE_OCSP
1760 state_server.u_ocsp.server.file = tls_ocsp_file;
1763 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1764 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1765 state_server.lib_state.conn_certs = TRUE;
1768 else if ( !tls_certificate && !tls_privatekey
1769 # ifndef DISABLE_OCSP
1773 { /* Generate & preload a selfsigned cert. No files to watch. */
1774 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1776 state_server.lib_state.conn_certs = TRUE;
1777 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1781 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1784 /* If we can, preload the Authorities for checking client certs against.
1785 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1786 at TLS conn startup */
1788 if ( opt_set_and_noexpand(tls_verify_certificates)
1789 && opt_unset_or_noexpand(tls_crl))
1791 /* Watch the default dir also as they are always included */
1793 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1794 && tls_set_watch(tls_verify_certificates, FALSE)
1795 && tls_set_watch(tls_crl, FALSE))
1797 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1799 if (setup_certs(ctx, tls_verify_certificates, tls_crl, NULL, &dummy_errstr)
1801 state_server.lib_state.cabundle = TRUE;
1805 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1806 #endif /* EXIM_HAVE_INOTIFY */
1809 /* If we can, preload the ciphers control string */
1811 if (opt_set_and_noexpand(tls_require_ciphers))
1813 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1814 normalise_ciphers(&tls_require_ciphers, tls_require_ciphers);
1815 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1816 &dummy_errstr) == OK)
1817 state_server.lib_state.pri_string = TRUE;
1820 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1827 /* Preload whatever creds are static, onto a transport. The client can then
1828 just copy the pointer as it starts up.
1829 Called from the daemon after a cache-invalidate with watch set; called from
1830 a queue-run startup with watch clear. */
1833 tls_client_creds_init(transport_instance * t, BOOL watch)
1835 smtp_transport_options_block * ob = t->options_block;
1836 exim_openssl_state_st tpt_dummy_state;
1837 host_item * dummy_host = (host_item *)1;
1838 uschar * dummy_errstr;
1843 ob->tls_preload = null_tls_preload;
1844 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1846 ob->tls_preload.lib_ctx = ctx;
1848 tpt_dummy_state.lib_state = ob->tls_preload;
1850 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1851 if ( opt_set_and_noexpand(ob->tls_certificate)
1852 && opt_unset_or_noexpand(ob->tls_privatekey))
1855 || ( tls_set_watch(ob->tls_certificate, FALSE)
1856 && tls_set_watch(ob->tls_privatekey, FALSE)
1859 uschar * pkey = ob->tls_privatekey;
1862 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1864 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1866 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1867 pkey ? pkey : ob->tls_certificate,
1870 ob->tls_preload.conn_certs = TRUE;
1875 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1878 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1879 && opt_unset_or_noexpand(ob->tls_crl))
1882 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1883 && tls_set_watch(ob->tls_verify_certificates, FALSE)
1884 && tls_set_watch(ob->tls_crl, FALSE)
1888 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1890 if (setup_certs(ctx, ob->tls_verify_certificates,
1891 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
1892 ob->tls_preload.cabundle = TRUE;
1897 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1899 #endif /*EXIM_HAVE_INOTIFY*/
1903 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1904 /* Invalidate the creds cached, by dropping the current ones.
1905 Call when we notice one of the source files has changed. */
1908 tls_server_creds_invalidate(void)
1910 SSL_CTX_free(state_server.lib_state.lib_ctx);
1911 state_server.lib_state = null_tls_preload;
1916 tls_client_creds_invalidate(transport_instance * t)
1918 smtp_transport_options_block * ob = t->options_block;
1919 SSL_CTX_free(ob->tls_preload.lib_ctx);
1920 ob->tls_preload = null_tls_preload;
1926 tls_server_creds_invalidate(void)
1930 tls_client_creds_invalidate(transport_instance * t)
1933 #endif /*EXIM_HAVE_INOTIFY*/
1937 #ifndef DISABLE_OCSP
1939 x509_store_dump_cert_s_names(X509_STORE * store)
1941 STACK_OF(X509_OBJECT) * roots= store->objs;
1942 static uschar name[256];
1944 for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
1946 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
1947 if(tmp_obj->type == X509_LU_X509)
1949 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
1950 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
1952 name[sizeof(name)-1] = '\0';
1953 debug_printf(" %s\n", name);
1962 #ifndef DISABLE_TLS_RESUME
1963 /* Manage the keysets used for encrypting the session tickets, on the server. */
1965 typedef struct { /* Session ticket encryption key */
1968 const EVP_CIPHER * aes_cipher;
1969 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
1970 # if OPENSSL_VERSION_NUMBER < 0x30000000L
1971 const EVP_MD * hmac_hash;
1973 const uschar * hmac_hashname;
1975 uschar hmac_key[16];
1980 static exim_stek exim_tk; /* current key */
1981 static exim_stek exim_tk_old; /* previous key */
1986 time_t t = time(NULL);
1988 if (exim_tk.name[0])
1990 if (exim_tk.renew >= t) return;
1991 exim_tk_old = exim_tk;
1994 if (f.running_in_test_harness) ssl_session_timeout = 6;
1996 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
1997 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
1998 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
1999 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
2001 exim_tk.name[0] = 'E';
2002 exim_tk.aes_cipher = EVP_aes_256_cbc();
2003 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2004 exim_tk.hmac_hash = EVP_sha256();
2006 exim_tk.hmac_hashname = US "sha256";
2008 exim_tk.expire = t + ssl_session_timeout;
2009 exim_tk.renew = t + ssl_session_timeout/2;
2015 if (!exim_tk.name[0]) return NULL;
2020 tk_find(const uschar * name)
2022 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
2023 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
2030 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2038 /*XXX will want these dependent on the ssl session strength */
2039 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2040 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2041 key->hmac_hash, NULL);
2044 OSSL_PARAM params[3];
2045 uschar * hk = string_copy(key->hmac_hashname); /* need nonconst */
2046 params[0] = OSSL_PARAM_construct_octet_string("key", key->hmac_key, sizeof(key->hmac_key));
2047 params[1] = OSSL_PARAM_construct_utf8_string("digest", CS hk, 0);
2048 params[2] = OSSL_PARAM_construct_end();
2049 if (EVP_MAC_CTX_set_params(hctx, params) == 0)
2051 DEBUG(D_tls) debug_printf("EVP_MAC_CTX_set_params: %s\n",
2052 ERR_reason_error_string(ERR_get_error()));
2053 return 0; /* error in mac initialisation */
2060 /* Callback for session tickets, on server */
2062 ticket_key_callback(SSL * ssl, uschar key_name[16],
2063 uschar * iv, EVP_CIPHER_CTX * c_ctx,
2064 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2071 tls_support * tlsp = state_server.tlsp;
2076 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
2077 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2079 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
2080 return -1; /* insufficient random */
2082 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
2083 return 0; /* key couldn't be created */
2084 memcpy(key_name, key->name, 16);
2085 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
2087 if (tk_hmac_init(hctx, key) == 0) return 0;
2088 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2090 DEBUG(D_tls) debug_printf("ticket created\n");
2095 time_t now = time(NULL);
2097 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
2098 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2100 if (!(key = tk_find(key_name)) || key->expire < now)
2104 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
2105 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
2110 if (tk_hmac_init(hctx, key) == 0) return 0;
2111 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2113 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2115 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2116 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2117 be better. To do that we'd have to encode ticket lifetime in the name as
2118 we don't yet see the restored session. Could check posthandshake for TLS1.3
2119 and trigger a new ticket then, but cannot do that for TLS1.2 */
2120 return key->renew < now ? 2 : 1;
2123 #endif /* !DISABLE_TLS_RESUME */
2128 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2129 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2131 /* If verification is optional, don't fail if no certificate */
2133 SSL_CTX_set_verify(ctx,
2134 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2139 /*************************************************
2140 * Callback to handle SNI *
2141 *************************************************/
2143 /* Called when acting as server during the TLS session setup if a Server Name
2144 Indication extension was sent by the client.
2146 API documentation is OpenSSL s_server.c implementation.
2149 s SSL* of the current session
2150 ad unknown (part of OpenSSL API) (unused)
2151 arg Callback of "our" registered data
2153 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2155 XXX might need to change to using ClientHello callback,
2156 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2159 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2161 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
2163 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2164 exim_openssl_state_st *state = (exim_openssl_state_st *) arg;
2166 int old_pool = store_pool;
2167 uschar * dummy_errstr;
2170 return SSL_TLSEXT_ERR_OK;
2172 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2173 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2175 /* Make the extension value available for expansion */
2176 store_pool = POOL_PERM;
2177 tls_in.sni = string_copy_taint(US servername, GET_TAINTED);
2178 store_pool = old_pool;
2180 if (!reexpand_tls_files_for_sni)
2181 return SSL_TLSEXT_ERR_OK;
2183 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2184 not confident that memcpy wouldn't break some internal reference counting.
2185 Especially since there's a references struct member, which would be off. */
2187 if (lib_ctx_new(&server_sni, NULL, &dummy_errstr) != OK)
2190 /* Not sure how many of these are actually needed, since SSL object
2191 already exists. Might even need this selfsame callback, for reneg? */
2194 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2195 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2196 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2197 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2198 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2199 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2200 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2203 if ( !init_dh(server_sni, state->dhparam, &dummy_errstr)
2204 || !init_ecdh(server_sni, &dummy_errstr)
2208 if ( state->server_cipher_list
2209 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2212 #ifndef DISABLE_OCSP
2213 if (state->u_ocsp.server.file)
2215 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2216 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2222 if ( !expand_check(tls_verify_certificates, US"tls_verify_certificates",
2223 &expcerts, &dummy_errstr)
2224 || (rc = setup_certs(server_sni, expcerts, tls_crl, NULL,
2225 &dummy_errstr)) != OK)
2228 if (expcerts && *expcerts)
2229 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2232 /* do this after setup_certs, because this can require the certs for verifying
2233 OCSP information. */
2234 if ((rc = tls_expand_session_files(server_sni, state, &dummy_errstr)) != OK)
2237 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2238 SSL_set_SSL_CTX(s, server_sni);
2239 return SSL_TLSEXT_ERR_OK;
2241 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
2243 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2248 #ifdef EXIM_HAVE_ALPN
2249 /*************************************************
2250 * Callback to handle ALPN *
2251 *************************************************/
2253 /* Called on server if tls_alpn nonblank after expansion,
2254 when client offers ALPN, after the SNI callback.
2255 If set and not matching the list then we dump the connection */
2258 tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen,
2259 const uschar * in, unsigned int inlen, void * arg)
2261 server_seen_alpn = TRUE;
2264 debug_printf("Received TLS ALPN offer:");
2265 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2268 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2269 debug_printf(" '%.*s'", siz, in + pos + 1);
2271 debug_printf(". Our list: '%s'\n", tls_alpn);
2274 /* Look for an acceptable ALPN */
2276 if ( inlen > 1 /* at least one name */
2277 && in[0]+1 == inlen /* filling the vector, so exactly one name */
2280 const uschar * list = tls_alpn;
2282 for (uschar * name; name = string_nextinlist(&list, &sep, NULL, 0); )
2283 if (Ustrncmp(in+1, name, in[0]) == 0)
2285 *out = in+1; /* we checked for exactly one, so can just point to it */
2287 return SSL_TLSEXT_ERR_OK; /* use ALPN */
2291 /* More than one name from clilent, or name did not match our list. */
2293 /* This will be fatal to the TLS conn; would be nice to kill TCP also.
2294 Maybe as an option in future; for now leave control to the config (must-tls). */
2296 DEBUG(D_tls) debug_printf("TLS ALPN rejected\n");
2297 return SSL_TLSEXT_ERR_ALERT_FATAL;
2299 #endif /* EXIM_HAVE_ALPN */
2303 #ifndef DISABLE_OCSP
2305 /*************************************************
2306 * Callback to handle OCSP Stapling *
2307 *************************************************/
2309 /* Called when acting as server during the TLS session setup if the client
2310 requests OCSP information with a Certificate Status Request.
2312 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2318 tls_server_stapling_cb(SSL *s, void *arg)
2320 const exim_openssl_state_st * state = arg;
2321 ocsp_resplist * olist = state->u_ocsp.server.olist;
2322 uschar * response_der; /*XXX blob */
2323 int response_der_len;
2326 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2327 olist ? "have" : "lack");
2329 tls_in.ocsp = OCSP_NOT_RESP;
2331 return SSL_TLSEXT_ERR_NOACK;
2333 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
2335 const X509 * cert_sent = SSL_get_certificate(s);
2336 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2337 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2339 for (; olist; olist = olist->next)
2341 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2342 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2343 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2344 ASN1_INTEGER * res_cert_serial;
2345 const BIGNUM * resp_bn;
2346 ASN1_OCTET_STRING * res_cert_iNameHash;
2349 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2350 (OCSP_CERTID *) cid);
2351 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2355 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2356 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2359 if (BN_cmp(cert_bn, resp_bn) == 0)
2361 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2363 /*XXX TODO: check the rest of the list for duplicate matches.
2364 If any, need to also check the Issuer Name hash.
2365 Without this, we will provide the wrong status in the case of
2370 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2374 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2375 return SSL_TLSEXT_ERR_NOACK;
2381 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2382 return SSL_TLSEXT_ERR_NOACK;
2386 /*XXX could we do the i2d earlier, rather than during the callback? */
2387 response_der = NULL;
2388 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2389 if (response_der_len <= 0)
2390 return SSL_TLSEXT_ERR_NOACK;
2392 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2393 response_der, response_der_len);
2394 tls_in.ocsp = OCSP_VFIED;
2395 return SSL_TLSEXT_ERR_OK;
2400 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
2402 BIO_printf(bp, "\t%s: ", str);
2403 ASN1_GENERALIZEDTIME_print(bp, time);
2408 tls_client_stapling_cb(SSL *s, void *arg)
2410 exim_openssl_state_st * cbinfo = arg;
2411 const unsigned char * p;
2413 OCSP_RESPONSE * rsp;
2414 OCSP_BASICRESP * bs;
2417 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2418 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
2420 { /* Expect this when we requested ocsp but got none */
2421 if (SSL_session_reused(s) && tls_out.ocsp == OCSP_VFIED)
2423 DEBUG(D_tls) debug_printf(" null, but resumed; ocsp vfy stored with session is good\n");
2426 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2427 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2429 DEBUG(D_tls) debug_printf(" null\n");
2430 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2433 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2435 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2436 if (LOGGING(tls_cipher))
2437 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2439 DEBUG(D_tls) debug_printf(" parse error\n");
2443 if (!(bs = OCSP_response_get1_basic(rsp)))
2445 tls_out.ocsp = OCSP_FAILED;
2446 if (LOGGING(tls_cipher))
2447 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2449 DEBUG(D_tls) debug_printf(" error parsing response\n");
2450 OCSP_RESPONSE_free(rsp);
2454 /* We'd check the nonce here if we'd put one in the request. */
2455 /* However that would defeat cacheability on the server so we don't. */
2457 /* This section of code reworked from OpenSSL apps source;
2458 The OpenSSL Project retains copyright:
2459 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2463 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2464 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2467 DEBUG(D_tls) bp = BIO_new(BIO_s_mem());
2469 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2471 /* Use the chain that verified the server cert to verify the stapled info */
2472 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
2474 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
2475 cbinfo->u_ocsp.client.verify_store, OCSP_NOEXPLICIT)) <= 0)
2476 if (ERR_peek_error())
2478 tls_out.ocsp = OCSP_FAILED;
2479 if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
2480 "Received TLS cert status response, itself unverifiable: %s",
2481 ERR_reason_error_string(ERR_peek_error()));
2484 BIO_printf(bp, "OCSP response verify failure\n");
2485 ERR_print_errors(bp);
2486 OCSP_RESPONSE_print(bp, rsp, 0);
2491 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2492 " in the root CA certificate; ignoring\n");
2494 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2496 /*XXX So we have a good stapled OCSP status. How do we know
2497 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2498 OCSP_resp_find_status() which matches on a cert id, which presumably
2499 we should use. Making an id needs OCSP_cert_id_new(), which takes
2500 issuerName, issuerKey, serialNumber. Are they all in the cert?
2502 For now, carry on blindly accepting the resp. */
2505 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2506 OCSP_resp_count(bs) - 1;
2508 sk_OCSP_SINGLERESP_num(sresp) - 1;
2512 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2514 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2516 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2517 - but what happens with a GnuTLS-style input?
2519 we could do with a debug label for each singleresp
2520 - it has a certID with a serialNumber, but I see no API to get that
2522 status = OCSP_single_get0_status(single, &reason, &rev,
2523 &thisupd, &nextupd);
2527 time_print(bp, "This OCSP Update", thisupd);
2528 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
2530 if (!OCSP_check_validity(thisupd, nextupd,
2531 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2533 tls_out.ocsp = OCSP_FAILED;
2534 DEBUG(D_tls) ERR_print_errors(bp);
2535 log_write(0, LOG_MAIN, "OCSP dates invalid");
2539 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2540 OCSP_cert_status_str(status));
2543 case V_OCSP_CERTSTATUS_GOOD:
2544 continue; /* the idx loop */
2545 case V_OCSP_CERTSTATUS_REVOKED:
2546 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2547 reason != -1 ? "; reason: " : "",
2548 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2549 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2552 log_write(0, LOG_MAIN,
2553 "Server certificate status unknown, in OCSP stapling");
2561 tls_out.ocsp = OCSP_VFIED;
2565 tls_out.ocsp = OCSP_FAILED;
2566 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2570 int len = (int) BIO_get_mem_data(bp, CSS &s);
2571 if (len > 0) debug_printf("%.*s", len, s);
2576 OCSP_RESPONSE_free(rsp);
2579 #endif /*!DISABLE_OCSP*/
2582 /*************************************************
2583 * Initialize for TLS *
2584 *************************************************/
2585 /* Called from both server and client code, to do preliminary initialization
2586 of the library. We allocate and return a context structure.
2589 host connected host, if client; NULL if server
2590 ob transport options block, if client; NULL if server
2591 ocsp_file file of stapling info (server); flag for require ocsp (client)
2592 addr address if client; NULL if server (for some randomness)
2593 caller_state place to put pointer to allocated state-struct
2594 errstr error string pointer
2596 Returns: OK/DEFER/FAIL
2600 tls_init(host_item * host, smtp_transport_options_block * ob,
2601 #ifndef DISABLE_OCSP
2604 address_item *addr, exim_openssl_state_st ** caller_state,
2609 exim_openssl_state_st * state;
2612 if (host) /* client */
2614 state = store_malloc(sizeof(exim_openssl_state_st));
2615 memset(state, 0, sizeof(*state));
2616 state->certificate = ob->tls_certificate;
2617 state->privatekey = ob->tls_privatekey;
2618 state->is_server = FALSE;
2619 state->dhparam = NULL;
2620 state->lib_state = ob->tls_preload;
2624 state = &state_server;
2625 state->certificate = tls_certificate;
2626 state->privatekey = tls_privatekey;
2627 state->is_server = TRUE;
2628 state->dhparam = tls_dhparam;
2629 state->lib_state = state_server.lib_state;
2635 if (!state->lib_state.pri_string)
2636 state->server_cipher_list = NULL;
2638 #ifndef DISABLE_EVENT
2639 state->event_action = NULL;
2644 /* It turns out that we need to seed the random number generator this early in
2645 order to get the full complement of ciphers to work. It took me roughly a day
2646 of work to discover this by experiment.
2648 On systems that have /dev/urandom, SSL may automatically seed itself from
2649 there. Otherwise, we have to make something up as best we can. Double check
2652 Although we likely called this before, at daemon startup, this is a chance
2653 to mix in further variable info (time, pid) if needed. */
2655 if (!lib_rand_init(addr))
2656 return tls_error(US"RAND_status", host,
2657 US"unable to seed random number generator", errstr);
2659 /* Apply administrator-supplied work-arounds.
2660 Historically we applied just one requested option,
2661 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2662 moved to an administrator-controlled list of options to specify and
2663 grandfathered in the first one as the default value for "openssl_options".
2665 No OpenSSL version number checks: the options we accept depend upon the
2666 availability of the option value macros from OpenSSL. */
2669 if (!tls_openssl_options_parse(openssl_options, &init_options))
2670 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2672 /* Create a context.
2673 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2674 negotiation in the different methods; as far as I can tell, the only
2675 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2676 when OpenSSL is built without SSLv2 support.
2677 By disabling with openssl_options, we can let admins re-enable with the
2680 if (!(ctx = state->lib_state.lib_ctx))
2682 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2684 state->lib_state.lib_ctx = ctx;
2687 #ifndef DISABLE_TLS_RESUME
2688 tlsp->resumption = RESUME_SUPPORTED;
2692 #ifndef DISABLE_TLS_RESUME
2693 /* Should the server offer session resumption? */
2694 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2696 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2697 init_options &= ~SSL_OP_NO_TICKET;
2698 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2699 tlsp->host_resumable = TRUE;
2703 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
2704 if (!(SSL_CTX_set_options(ctx, init_options)))
2705 return tls_error(string_sprintf(
2706 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2709 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2711 /* We'd like to disable session cache unconditionally, but foolish Outlook
2712 Express clients then give up the first TLS connection and make a second one
2713 (which works). Only when there is an IMAP service on the same machine.
2714 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2715 now, until we work out a decent way of presenting control to the config. It
2716 will never be used because we use a new context every time. */
2718 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2721 /* Initialize with DH parameters if supplied */
2722 /* Initialize ECDH temp key parameter selection */
2726 if (state->lib_state.dh)
2727 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2729 if (!init_dh(ctx, state->dhparam, errstr)) return DEFER;
2731 if (state->lib_state.ecdh)
2732 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
2734 if (!init_ecdh(ctx, errstr)) return DEFER;
2737 /* Set up certificate and key (and perhaps OCSP info) */
2739 if (state->lib_state.conn_certs)
2742 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
2746 #ifndef DISABLE_OCSP
2749 state->u_ocsp.server.file = ocsp_file;
2750 state->u_ocsp.server.file_expanded = NULL;
2751 state->u_ocsp.server.olist = NULL;
2754 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
2757 /* If we need to handle SNI or OCSP, do so */
2759 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2760 # ifndef DISABLE_OCSP
2761 if (!(state->verify_stack = sk_X509_new_null()))
2763 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2768 if (!host) /* server */
2770 # ifndef DISABLE_OCSP
2771 /* We check u_ocsp.server.file, not server.olist, because we care about if
2772 the option exists, not what the current expansion might be, as SNI might
2773 change the certificate and OCSP file in use between now and the time the
2774 callback is invoked. */
2775 if (state->u_ocsp.server.file)
2777 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2778 SSL_CTX_set_tlsext_status_arg(ctx, state);
2781 /* We always do this, so that $tls_sni is available even if not used in
2783 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2784 SSL_CTX_set_tlsext_servername_arg(ctx, state);
2786 # ifdef EXIM_HAVE_ALPN
2787 if (tls_alpn && *tls_alpn)
2790 if ( expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr)
2791 && *exp_alpn && !isblank(*exp_alpn))
2793 tls_alpn = exp_alpn; /* subprocess so ok to overwrite */
2794 SSL_CTX_set_alpn_select_cb(ctx, tls_server_alpn_cb, state);
2801 # ifndef DISABLE_OCSP
2803 if(ocsp_file) /* wanting stapling */
2805 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
2807 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2810 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2811 SSL_CTX_set_tlsext_status_arg(ctx, state);
2816 state->verify_cert_hostnames = NULL;
2818 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
2819 /* Set up the RSA callback */
2820 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
2823 /* Finally, set the session cache timeout, and we are done.
2824 The period appears to be also used for (server-generated) session tickets */
2826 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
2827 DEBUG(D_tls) debug_printf("Initialized TLS\n");
2829 *caller_state = state;
2837 /*************************************************
2838 * Get name of cipher in use *
2839 *************************************************/
2842 Argument: pointer to an SSL structure for the connection
2843 pointer to number of bits for cipher
2844 Returns: pointer to allocated string in perm-pool
2848 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
2850 int pool = store_pool;
2851 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
2852 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2853 the accessor functions use const in the prototype. */
2855 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
2858 SSL_CIPHER_get_bits(c, bits);
2860 store_pool = POOL_PERM;
2861 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2863 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2868 /* Get IETF-standard name for ciphersuite.
2869 Argument: pointer to an SSL structure for the connection
2870 Returns: pointer to string
2873 static const uschar *
2874 cipher_stdname_ssl(SSL * ssl)
2876 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2877 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2879 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2880 return cipher_stdname(id >> 8, id & 0xff);
2885 static const uschar *
2886 tlsver_name(SSL * ssl)
2889 int pool = store_pool;
2891 store_pool = POOL_PERM;
2892 s = string_copy(US SSL_get_version(ssl));
2894 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
2895 for (;; p++) if (!(*p = p[1])) break;
2901 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
2903 /*XXX we might consider a list-of-certs variable for the cert chain.
2904 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2905 in list-handling functions, also consider the difference between the entire
2906 chain and the elements sent by the peer. */
2908 tlsp->peerdn = NULL;
2910 /* Will have already noted peercert on a verify fail; possibly not the leaf */
2911 if (!tlsp->peercert)
2912 tlsp->peercert = SSL_get_peer_certificate(ssl);
2913 /* Beware anonymous ciphers which lead to server_cert being NULL */
2915 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2916 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2919 int oldpool = store_pool;
2921 peerdn[siz-1] = '\0'; /* paranoia */
2922 store_pool = POOL_PERM;
2923 tlsp->peerdn = string_copy(peerdn);
2924 store_pool = oldpool;
2926 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2927 but they don't get called on session-resumption. So use the official
2928 interface, which uses the resumed value. Unfortunately this claims verified
2929 when it actually failed but we're in try-verify mode, due to us wanting the
2930 knowlege that it failed so needing to have the callback and forcing a
2931 permissive return. If we don't force it, the TLS startup is failed.
2932 The extra bit of information is set in verify_override in the cb, stashed
2933 for resumption next to the TLS session, and used here. */
2935 if (!tlsp->verify_override)
2936 tlsp->certificate_verified =
2938 tlsp->dane_verified ||
2940 SSL_get_verify_result(ssl) == X509_V_OK;
2948 /*************************************************
2949 * Set up for verifying certificates *
2950 *************************************************/
2952 #ifndef DISABLE_OCSP
2953 /* Load certs from file, return TRUE on success */
2956 chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
2959 STACK_OF(X509) * verify_stack = *vp;
2962 while (sk_X509_num(verify_stack) > 0)
2963 X509_free(sk_X509_pop(verify_stack));
2965 verify_stack = sk_X509_new_null();
2967 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
2968 for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
2969 sk_X509_push(verify_stack, x);
2978 /* Called by both client and server startup; on the server possibly
2979 repeated after a Server Name Indication.
2982 sctx SSL_CTX* to initialise
2983 certs certs file, expanded
2984 crl CRL file or NULL
2985 host NULL in a server; the remote host in a client
2986 errstr error string pointer
2988 Returns: OK/DEFER/FAIL
2992 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
2995 uschar *expcerts, *expcrl;
2997 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
2999 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3001 if (expcerts && *expcerts)
3003 /* Tell the library to use its compiled-in location for the system default
3004 CA bundle. Then add the ones specified in the config, if any. */
3006 if (!SSL_CTX_set_default_verify_paths(sctx))
3007 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
3009 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
3011 struct stat statbuf;
3013 if (Ustat(expcerts, &statbuf) < 0)
3015 log_write(0, LOG_MAIN|LOG_PANIC,
3016 "failed to stat %s for certificates", expcerts);
3022 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
3023 { file = NULL; dir = expcerts; }
3026 STACK_OF(X509) * verify_stack =
3027 #ifndef DISABLE_OCSP
3028 !host ? state_server.verify_stack :
3031 STACK_OF(X509) ** vp = &verify_stack;
3033 file = expcerts; dir = NULL;
3034 #ifndef DISABLE_OCSP
3035 /* In the server if we will be offering an OCSP proof, load chain from
3036 file for verifying the OCSP proof at load time. */
3038 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
3039 This is inconsistent with the need to verify the OCSP proof of the server cert.
3042 && statbuf.st_size > 0
3043 && state_server.u_ocsp.server.file
3044 && !chain_from_pem_file(file, vp)
3047 log_write(0, LOG_MAIN|LOG_PANIC,
3048 "failed to load cert chain from %s", file);
3054 /* If a certificate file is empty, the load function fails with an
3055 unhelpful error message. If we skip it, we get the correct behaviour (no
3056 certificates are recognized, but the error message is still misleading (it
3057 says no certificate was supplied). But this is better. */
3059 if ( (!file || statbuf.st_size > 0)
3060 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
3061 return tls_error(US"SSL_CTX_load_verify_locations",
3062 host, NULL, errstr);
3064 /* On the server load the list of CAs for which we will accept certs, for
3065 sending to the client. This is only for the one-file
3066 tls_verify_certificates variant.
3067 If a list isn't loaded into the server, but some verify locations are set,
3068 the server end appears to make a wildcard request for client certs.
3069 Meanwhile, the client library as default behaviour *ignores* the list
3070 we send over the wire - see man SSL_CTX_set_client_cert_cb.
3071 Because of this, and that the dir variant is likely only used for
3072 the public-CA bundle (not for a private CA), not worth fixing. */
3076 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
3077 int i = sk_X509_NAME_num(names);
3079 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
3080 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
3081 i, i>1 ? "ies":"y");
3085 debug_printf("Added dir for additional certificate authorities\n");
3089 /* Handle a certificate revocation list. */
3091 #if OPENSSL_VERSION_NUMBER > 0x00907000L
3093 /* This bit of code is now the version supplied by Lars Mainka. (I have
3094 merely reformatted it into the Exim code style.)
3096 "From here I changed the code to add support for multiple crl's
3097 in pem format in one file or to support hashed directory entries in
3098 pem format instead of a file. This method now uses the library function
3099 X509_STORE_load_locations to add the CRL location to the SSL context.
3100 OpenSSL will then handle the verify against CA certs and CRLs by
3101 itself in the verify callback." */
3103 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
3104 if (expcrl && *expcrl)
3106 struct stat statbufcrl;
3107 if (Ustat(expcrl, &statbufcrl) < 0)
3109 log_write(0, LOG_MAIN|LOG_PANIC,
3110 "failed to stat %s for certificates revocation lists", expcrl);
3115 /* is it a file or directory? */
3117 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
3118 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
3122 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
3128 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
3130 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
3131 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
3133 /* setting the flags to check against the complete crl chain */
3135 X509_STORE_set_flags(cvstore,
3136 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
3140 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3149 tls_dump_keylog(SSL * ssl)
3151 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3152 BIO * bp = BIO_new(BIO_s_mem());
3155 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3156 len = (int) BIO_get_mem_data(bp, CSS &s);
3157 if (len > 0) debug_printf("%.*s", len, s);
3163 /*************************************************
3164 * Start a TLS session in a server *
3165 *************************************************/
3166 /* This is called when Exim is running as a server, after having received
3167 the STARTTLS command. It must respond to that command, and then negotiate
3171 errstr pointer to error message
3173 Returns: OK on success
3174 DEFER for errors before the start of the negotiation
3175 FAIL for errors during the negotiation; the server can't
3180 tls_server_start(uschar ** errstr)
3183 uschar * expciphers;
3184 exim_openssl_state_st * dummy_statep;
3187 static uschar peerdn[256];
3189 /* Check for previous activation */
3191 if (tls_in.active.sock >= 0)
3193 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3194 smtp_printf("554 Already in TLS\r\n", FALSE);
3198 /* Initialize the SSL library. If it fails, it will already have logged
3201 rc = tls_init(NULL, NULL,
3202 #ifndef DISABLE_OCSP
3205 NULL, &dummy_statep, &tls_in, errstr);
3206 if (rc != OK) return rc;
3207 ctx = state_server.lib_state.lib_ctx;
3209 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3210 were historically separated by underscores. So that I can use either form in my
3211 tests, and also for general convenience, we turn underscores into hyphens here.
3213 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3214 for TLS 1.3 . Since we do not call it at present we get the default list:
3215 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3218 if (state_server.lib_state.pri_string)
3219 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3222 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3227 normalise_ciphers(&expciphers, tls_require_ciphers);
3228 if ((rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3233 /* If this is a host for which certificate verification is mandatory or
3234 optional, set up appropriately. */
3236 tls_in.certificate_verified = FALSE;
3238 tls_in.dane_verified = FALSE;
3240 server_verify_callback_called = FALSE;
3242 if (verify_check_host(&tls_verify_hosts) == OK)
3243 server_verify_optional = FALSE;
3244 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3245 server_verify_optional = TRUE;
3251 if (!expand_check(tls_verify_certificates, US"tls_verify_certificates",
3254 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3256 if (state_server.lib_state.cabundle)
3257 { DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n"); }
3259 if ((rc = setup_certs(ctx, expcerts, tls_crl, NULL, errstr)) != OK)
3262 if (expcerts && *expcerts)
3263 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3267 #ifndef DISABLE_TLS_RESUME
3268 # if OPENSSL_VERSION_NUMBER < 0x30000000L
3269 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3270 /* despite working, appears to always return failure, so ignoring */
3272 SSL_CTX_set_tlsext_ticket_key_evp_cb(ctx, ticket_key_callback);
3273 /* despite working, appears to always return failure, so ignoring */
3277 #ifdef OPENSSL_HAVE_NUM_TICKETS
3278 # ifndef DISABLE_TLS_RESUME
3279 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3281 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3286 /* Prepare for new connection */
3288 if (!(ssl = SSL_new(ctx)))
3289 return tls_error(US"SSL_new", NULL, NULL, errstr);
3290 state_server.lib_state.lib_ssl = ssl;
3292 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3294 * With the SSL_clear(), we get strange interoperability bugs with
3295 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3296 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3298 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3299 * session shutdown. In this case, we have a brand new object and there's no
3300 * obvious reason to immediately clear it. I'm guessing that this was
3301 * originally added because of incomplete initialisation which the clear fixed,
3302 * in some historic release.
3305 /* Set context and tell client to go ahead, except in the case of TLS startup
3306 on connection, where outputting anything now upsets the clients and tends to
3307 make them disconnect. We need to have an explicit fflush() here, to force out
3308 the response. Other smtp_printf() calls do not need it, because in non-TLS
3309 mode, the fflush() happens when smtp_getc() is called. */
3311 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3312 if (!tls_in.on_connect)
3314 smtp_printf("220 TLS go ahead\r\n", FALSE);
3318 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3319 that the OpenSSL library doesn't. */
3321 SSL_set_wfd(ssl, fileno(smtp_out));
3322 SSL_set_rfd(ssl, fileno(smtp_in));
3323 SSL_set_accept_state(ssl);
3325 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3328 sigalrm_seen = FALSE;
3329 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3330 rc = SSL_accept(ssl);
3335 int error = SSL_get_error(ssl, rc);
3338 case SSL_ERROR_NONE:
3341 case SSL_ERROR_ZERO_RETURN:
3342 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3343 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3344 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3346 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3349 tls_close(NULL, TLS_NO_SHUTDOWN);
3352 /* Handle genuine errors */
3356 int r = ERR_GET_REASON(ERR_peek_error());
3357 if ( r == SSL_R_WRONG_VERSION_NUMBER
3358 #ifdef SSL_R_VERSION_TOO_LOW
3359 || r == SSL_R_VERSION_TOO_LOW
3361 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3362 s = string_sprintf("(%s)", SSL_get_version(ssl));
3363 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
3364 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3369 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3370 if (error == SSL_ERROR_SYSCALL)
3374 *errstr = US"SSL_accept: TCP connection closed by peer";
3375 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3378 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3380 (void) tls_error(US"SSL_accept", NULL,
3381 sigalrm_seen ? US"timed out"
3382 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3384 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3389 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3390 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3391 anon-authentication ciphersuite negotiated. */
3393 #ifndef DISABLE_TLS_RESUME
3394 if (SSL_session_reused(ssl))
3396 tls_in.resumption |= RESUME_USED;
3397 DEBUG(D_tls) debug_printf("Session reused\n");
3401 #ifdef EXIM_HAVE_ALPN
3402 /* If require-alpn, check server_seen_alpn here. Else abort TLS */
3403 if (!tls_alpn || !*tls_alpn)
3404 { DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n"); }
3405 else if (!server_seen_alpn)
3406 if (verify_check_host(&hosts_require_alpn) == OK)
3408 /* We'd like to send a definitive Alert but OpenSSL provides no facility */
3410 tls_error(US"handshake", NULL, US"ALPN required but not negotiated", errstr);
3414 { DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n"); }
3417 const uschar * name;
3419 SSL_get0_alpn_selected(ssl, &name, &len);
3421 debug_printf("ALPN negotiated: '%.*s'\n", (int)*name, name+1);
3423 debug_printf("ALPN: no protocol negotiated\n");
3428 /* TLS has been set up. Record data for the connection,
3429 adjust the input functions to read via TLS, and initialize things. */
3431 #ifdef SSL_get_extms_support
3432 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3434 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3436 tls_in.ver = tlsver_name(ssl);
3437 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3438 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3443 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3444 debug_printf("Shared ciphers: %s\n", buf);
3446 tls_dump_keylog(ssl);
3448 #ifdef EXIM_HAVE_SESSION_TICKET
3450 SSL_SESSION * ss = SSL_get_session(ssl);
3451 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3452 debug_printf("The session has a ticket, life %lu seconds\n",
3453 SSL_SESSION_get_ticket_lifetime_hint(ss));
3458 /* Record the certificate we presented */
3460 X509 * crt = SSL_get_certificate(ssl);
3461 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3464 /* Channel-binding info for authenticators
3465 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/ */
3468 size_t len = SSL_get_peer_finished(ssl, &c, 0);
3469 int old_pool = store_pool;
3471 SSL_get_peer_finished(ssl, s = store_get((int)len, GET_UNTAINTED), len);
3472 store_pool = POOL_PERM;
3473 tls_in.channelbinding = b64encode_taint(CUS s, (int)len, GET_UNTAINTED);
3474 store_pool = old_pool;
3475 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p\n", tls_in.channelbinding);
3478 /* Only used by the server-side tls (tls_in), including tls_getc.
3479 Client-side (tls_out) reads (seem to?) go via
3480 smtp_read_response()/ip_recv().
3481 Hence no need to duplicate for _in and _out.
3483 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3484 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3485 ssl_xfer_eof = ssl_xfer_error = FALSE;
3487 receive_getc = tls_getc;
3488 receive_getbuf = tls_getbuf;
3489 receive_get_cache = tls_get_cache;
3490 receive_hasc = tls_hasc;
3491 receive_ungetc = tls_ungetc;
3492 receive_feof = tls_feof;
3493 receive_ferror = tls_ferror;
3495 tls_in.active.sock = fileno(smtp_out);
3496 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3504 tls_client_basic_ctx_init(SSL_CTX * ctx,
3505 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3510 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3511 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3512 host patterns if one of them is set with content. */
3514 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3515 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3517 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3518 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3521 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3523 client_verify_optional = FALSE;
3524 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3525 client_verify_optional = TRUE;
3531 if (!expand_check(ob->tls_verify_certificates, US"tls_verify_certificates",
3534 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3536 if (state->lib_state.cabundle)
3537 { DEBUG(D_tls) debug_printf("TLS: CA bundle was preloaded\n"); }
3539 if ((rc = setup_certs(ctx, expcerts, ob->tls_crl, host, errstr)) != OK)
3542 if (expcerts && *expcerts)
3543 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3546 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3548 state->verify_cert_hostnames =
3550 string_domain_utf8_to_alabel(host->certname, NULL);
3554 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3555 state->verify_cert_hostnames);
3563 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3566 const char * hostnames[2] = { CS host->name, NULL };
3569 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3570 return tls_error(US"hostnames load", host, NULL, errstr);
3572 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3573 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3574 ) if (rr->type == T_TLSA && rr->size > 3)
3576 const uschar * p = rr->data;
3577 uint8_t usage, selector, mtype;
3578 const char * mdname;
3582 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3583 if (usage != 2 && usage != 3) continue;
3590 default: continue; /* Only match-types 0, 1, 2 are supported */
3591 case 0: mdname = NULL; break;
3592 case 1: mdname = "sha256"; break;
3593 case 2: mdname = "sha512"; break;
3597 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3600 return tls_error(US"tlsa load", host, NULL, errstr);
3601 case 0: /* action not taken */
3605 tls_out.tlsa_usage |= 1<<usage;
3611 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3614 #endif /*SUPPORT_DANE*/
3618 #ifndef DISABLE_TLS_RESUME
3619 /* On the client, get any stashed session for the given IP from hints db
3620 and apply it to the ssl-connection for attempted resumption. */
3623 tls_retrieve_session(tls_support * tlsp, SSL * ssl)
3625 if (tlsp->host_resumable)
3627 const uschar * key = tlsp->resume_index;
3628 dbdata_tls_session * dt;
3630 open_db dbblock, * dbm_file;
3632 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3634 debug_printf("checking for resumable session for %s\n", tlsp->resume_index);
3635 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3637 if ((dt = dbfn_read_with_length(dbm_file, tlsp->resume_index, &len)))
3639 SSL_SESSION * ss = NULL;
3640 const uschar * sess_asn1 = dt->session;
3642 len -= sizeof(dbdata_tls_session);
3643 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3647 ERR_error_string_n(ERR_get_error(),
3648 ssl_errstring, sizeof(ssl_errstring));
3649 debug_printf("decoding session: %s\n", ssl_errstring);
3654 unsigned long lifetime =
3655 #ifdef EXIM_HAVE_SESSION_TICKET
3656 SSL_SESSION_get_ticket_lifetime_hint(ss);
3657 #else /* Use, fairly arbitrilarily, what we as server would */
3658 f.running_in_test_harness ? 6 : ssl_session_timeout;
3660 if (lifetime + dt->time_stamp < time(NULL))
3662 DEBUG(D_tls) debug_printf("session expired\n");
3663 dbfn_delete(dbm_file, tlsp->resume_index);
3665 else if (SSL_set_session(ssl, ss))
3667 DEBUG(D_tls) debug_printf("good session\n");
3668 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3669 tlsp->verify_override = dt->verify_override;
3670 tlsp->ocsp = dt->ocsp;
3674 ERR_error_string_n(ERR_get_error(),
3675 ssl_errstring, sizeof(ssl_errstring));
3676 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3681 DEBUG(D_tls) debug_printf("no session record\n");
3682 dbfn_close(dbm_file);
3688 /* On the client, save the session for later resumption */
3691 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3693 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3696 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3698 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3700 # ifdef OPENSSL_HAVE_NUM_TICKETS
3701 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3704 int len = i2d_SSL_SESSION(ss, NULL);
3705 int dlen = sizeof(dbdata_tls_session) + len;
3706 dbdata_tls_session * dt = store_get(dlen, GET_TAINTED);
3707 uschar * s = dt->session;
3708 open_db dbblock, * dbm_file;
3710 DEBUG(D_tls) debug_printf("session is resumable\n");
3711 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3713 dt->verify_override = tlsp->verify_override;
3714 dt->ocsp = tlsp->ocsp;
3715 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3717 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3719 dbfn_write(dbm_file, tlsp->resume_index, dt, dlen);
3720 dbfn_close(dbm_file);
3721 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3729 /* Construct a key for session DB lookup, and setup the SSL_CTX for resumption */
3732 tls_client_ctx_resume_prehandshake(
3733 exim_openssl_client_tls_ctx * exim_client_ctx, smtp_connect_args * conn_args,
3734 tls_support * tlsp, smtp_transport_options_block * ob)
3736 tlsp->host_resumable = TRUE;
3737 tls_client_resmption_key(tlsp, conn_args, ob);
3739 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3740 SSL_SESS_CACHE_CLIENT
3741 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3742 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3746 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3747 host_item * host, uschar ** errstr)
3749 if (tlsp->host_resumable)
3752 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3753 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3755 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3756 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
3758 tls_error(US"set ex_data", host, NULL, errstr);
3761 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state);
3764 tlsp->resumption = RESUME_SUPPORTED;
3765 /* Pick up a previous session, saved on an old ticket */
3766 tls_retrieve_session(tlsp, ssl);
3771 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
3774 if (SSL_session_reused(exim_client_ctx->ssl))
3776 DEBUG(D_tls) debug_printf("The session was reused\n");
3777 tlsp->resumption |= RESUME_USED;
3780 #endif /* !DISABLE_TLS_RESUME */
3783 #ifdef EXIM_HAVE_ALPN
3784 /* Expand and convert an Exim list to an ALPN list. False return for fail.
3785 NULL plist return for silent no-ALPN.
3787 Overwite the passed-in list with the expanded version.
3791 tls_alpn_plist(uschar ** tls_alpn, const uschar ** plist, unsigned * plen,
3796 if (!expand_check(*tls_alpn, US"tls_alpn", &exp_alpn, errstr))
3798 *tls_alpn = exp_alpn;
3802 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
3807 /* The server implementation only accepts exactly one protocol name
3808 but it's little extra code complexity in the client. */
3810 const uschar * list = exp_alpn;
3811 uschar * p = store_get(Ustrlen(exp_alpn), exp_alpn), * s, * t;
3815 for (t = p; s = string_nextinlist(&list, &sep, NULL, 0); t += len)
3817 *t++ = len = (uschar) Ustrlen(s);
3820 *plist = (*plen = t - p) ? p : NULL;
3824 #endif /* EXIM_HAVE_ALPN */
3827 /*************************************************
3828 * Start a TLS session in a client *
3829 *************************************************/
3831 /* Called from the smtp transport after STARTTLS has been accepted.
3834 cctx connection context
3835 conn_args connection details
3836 cookie datum for randomness; can be NULL
3837 tlsp record details of TLS channel configuration here; must be non-NULL
3838 errstr error string pointer
3840 Returns: TRUE for success with TLS session context set in connection context,
3845 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3846 void * cookie, tls_support * tlsp, uschar ** errstr)
3848 host_item * host = conn_args->host; /* for msgs and option-tests */
3849 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3850 smtp_transport_options_block * ob = tb
3851 ? (smtp_transport_options_block *)tb->options_block
3852 : &smtp_transport_option_defaults;
3853 exim_openssl_client_tls_ctx * exim_client_ctx;
3854 uschar * expciphers;
3856 static uschar peerdn[256];
3858 #ifndef DISABLE_OCSP
3859 BOOL request_ocsp = FALSE;
3860 BOOL require_ocsp = FALSE;
3864 store_pool = POOL_PERM;
3865 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), GET_UNTAINTED);
3866 exim_client_ctx->corked = NULL;
3870 tlsp->tlsa_usage = 0;
3873 #ifndef DISABLE_OCSP
3875 # ifdef SUPPORT_DANE
3876 /*XXX this should be moved to caller, to be common across gnutls/openssl */
3877 if ( conn_args->dane
3878 && ob->hosts_request_ocsp[0] == '*'
3879 && ob->hosts_request_ocsp[1] == '\0'
3882 /* Unchanged from default. Use a safer one under DANE */
3883 request_ocsp = TRUE;
3884 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3885 " {= {4}{$tls_out_tlsa_usage}} } "
3891 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
3892 request_ocsp = TRUE;
3894 # ifdef SUPPORT_DANE
3898 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3902 rc = tls_init(host, ob,
3903 #ifndef DISABLE_OCSP
3904 (void *)(long)request_ocsp,
3906 cookie, &client_static_state, tlsp, errstr);
3907 if (rc != OK) return FALSE;
3909 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
3911 tlsp->certificate_verified = FALSE;
3912 client_verify_callback_called = FALSE;
3916 if (conn_args->dane)
3918 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3919 other failures should be treated as problems. */
3920 if (ob->dane_require_tls_ciphers &&
3921 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3922 &expciphers, errstr))
3924 if (expciphers && *expciphers == '\0')
3927 normalise_ciphers(&expciphers, ob->dane_require_tls_ciphers);
3932 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
3933 &expciphers, errstr))
3936 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3937 are separated by underscores. So that I can use either form in my tests, and
3938 also for general convenience, we turn underscores into hyphens here. */
3940 normalise_ciphers(&expciphers, ob->tls_require_ciphers);
3945 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
3946 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
3948 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
3954 if (conn_args->dane)
3956 SSL_CTX_set_verify(exim_client_ctx->ctx,
3957 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
3958 verify_callback_client_dane);
3960 if (!DANESSL_library_init())
3962 tls_error(US"library init", host, NULL, errstr);
3965 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
3967 tls_error(US"context init", host, NULL, errstr);
3975 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
3976 client_static_state, errstr) != OK)
3981 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
3984 { DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n"); }
3985 else if (!Ustrlen(tlsp->sni))
3989 #ifndef EXIM_HAVE_OPENSSL_TLSEXT
3990 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
3998 #ifdef EXIM_HAVE_ALPN
4000 const uschar * plist;
4003 if (!tls_alpn_plist(&ob->tls_alpn, &plist, &plen, errstr))
4006 if (SSL_CTX_set_alpn_protos(exim_client_ctx->ctx, plist, plen) != 0)
4008 tls_error(US"alpn init", host, NULL, errstr);
4012 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
4015 log_write(0, LOG_MAIN, "ALPN unusable with this OpenSSL library version; ignoring \"%s\"\n",
4019 #ifndef DISABLE_TLS_RESUME
4020 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
4021 tls_client_ctx_resume_prehandshake(exim_client_ctx, conn_args, tlsp, ob);
4025 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
4027 tls_error(US"SSL_new", host, NULL, errstr);
4030 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
4031 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
4032 SSL_set_connect_state(exim_client_ctx->ssl);
4034 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
4037 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
4038 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
4043 if (conn_args->dane)
4044 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
4048 #ifndef DISABLE_OCSP
4049 /* Request certificate status at connection-time. If the server
4050 does OCSP stapling we will get the callback (set in tls_init()) */
4051 # ifdef SUPPORT_DANE
4055 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4056 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4058 { /* Re-eval now $tls_out_tlsa_usage is populated. If
4059 this means we avoid the OCSP request, we wasted the setup
4060 cost in tls_init(). */
4061 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
4062 request_ocsp = require_ocsp
4063 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4070 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
4071 client_static_state->u_ocsp.client.verify_required = require_ocsp;
4072 tlsp->ocsp = OCSP_NOT_RESP;
4076 #ifndef DISABLE_TLS_RESUME
4077 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
4082 #ifndef DISABLE_EVENT
4083 client_static_state->event_action = tb ? tb->event_action : NULL;
4086 /* There doesn't seem to be a built-in timeout on connection. */
4088 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
4089 sigalrm_seen = FALSE;
4090 ALARM(ob->command_timeout);
4091 rc = SSL_connect(exim_client_ctx->ssl);
4095 if (conn_args->dane)
4096 DANESSL_cleanup(exim_client_ctx->ssl);
4101 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
4107 debug_printf("SSL_connect succeeded\n");
4108 tls_dump_keylog(exim_client_ctx->ssl);
4111 #ifndef DISABLE_TLS_RESUME
4112 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
4115 #ifdef EXIM_HAVE_ALPN
4116 if (ob->tls_alpn) /* We requested. See what was negotiated. */
4118 const uschar * name;
4121 SSL_get0_alpn_selected(exim_client_ctx->ssl, &name, &len);
4123 { DEBUG(D_tls) debug_printf("ALPN negotiated %u: '%.*s'\n", len, (int)*name, name+1); }
4124 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
4126 /* Would like to send a relevant fatal Alert, but OpenSSL has no API */
4127 tls_error(US"handshake", host, US"ALPN required but not negotiated", errstr);
4133 #ifdef SSL_get_extms_support
4134 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
4136 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
4138 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
4139 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
4140 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
4142 /* Record the certificate we presented */
4144 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
4145 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
4148 /*XXX will this work with continued-TLS? */
4149 /* Channel-binding info for authenticators */
4152 size_t len = SSL_get_finished(exim_client_ctx->ssl, &c, 0);
4153 int old_pool = store_pool;
4155 SSL_get_finished(exim_client_ctx->ssl, s = store_get((int)len, GET_TAINTED), len);
4156 store_pool = POOL_PERM;
4157 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, GET_TAINTED);
4158 store_pool = old_pool;
4159 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
4162 tlsp->active.sock = cctx->sock;
4163 tlsp->active.tls_ctx = exim_client_ctx;
4164 cctx->tls_ctx = exim_client_ctx;
4173 tls_refill(unsigned lim)
4175 SSL * ssl = state_server.lib_state.lib_ssl;
4179 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4180 ssl_xfer_buffer, ssl_xfer_buffer_size);
4183 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4184 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
4185 MIN(ssl_xfer_buffer_size, lim));
4186 error = SSL_get_error(ssl, inbytes);
4187 if (smtp_receive_timeout > 0) ALARM_CLR(0);
4189 if (had_command_timeout) /* set by signal handler */
4190 smtp_command_timeout_exit(); /* does not return */
4191 if (had_command_sigterm)
4192 smtp_command_sigterm_exit();
4193 if (had_data_timeout)
4194 smtp_data_timeout_exit();
4195 if (had_data_sigint)
4196 smtp_data_sigint_exit();
4198 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
4199 closed down, not that the socket itself has been closed down. Revert to
4200 non-SSL handling. */
4204 case SSL_ERROR_NONE:
4207 case SSL_ERROR_ZERO_RETURN:
4208 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4210 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
4213 tls_close(NULL, TLS_NO_SHUTDOWN);
4216 /* Handle genuine errors */
4218 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4219 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
4220 ssl_xfer_error = TRUE;
4224 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
4225 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
4226 debug_printf(" - syscall %s\n", strerror(errno));
4227 ssl_xfer_error = TRUE;
4231 #ifndef DISABLE_DKIM
4232 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
4234 ssl_xfer_buffer_hwm = inbytes;
4235 ssl_xfer_buffer_lwm = 0;
4240 /*************************************************
4241 * TLS version of getc *
4242 *************************************************/
4244 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
4245 it refills the buffer via the SSL reading function.
4247 Arguments: lim Maximum amount to read/buffer
4248 Returns: the next character or EOF
4250 Only used by the server-side TLS.
4254 tls_getc(unsigned lim)
4256 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4257 if (!tls_refill(lim))
4258 return ssl_xfer_error ? EOF : smtp_getc(lim);
4260 /* Something in the buffer; return next uschar */
4262 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
4268 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm;
4272 tls_getbuf(unsigned * len)
4277 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4278 if (!tls_refill(*len))
4280 if (!ssl_xfer_error) return smtp_getbuf(len);
4285 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4287 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4288 ssl_xfer_buffer_lwm += size;
4295 tls_get_cache(unsigned lim)
4297 #ifndef DISABLE_DKIM
4298 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4299 debug_printf("tls_get_cache\n");
4303 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4309 tls_could_getc(void)
4311 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4312 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4316 /*************************************************
4317 * Read bytes from TLS channel *
4318 *************************************************/
4322 ct_ctx client context pointer, or NULL for the one global server context
4326 Returns: the number of bytes read
4327 -1 after a failed read, including EOF
4329 Only used by the client-side TLS.
4333 tls_read(void * ct_ctx, uschar *buff, size_t len)
4335 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4336 : state_server.lib_state.lib_ssl;
4340 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4341 buff, (unsigned int)len);
4344 inbytes = SSL_read(ssl, CS buff, len);
4345 error = SSL_get_error(ssl, inbytes);
4347 if (error == SSL_ERROR_ZERO_RETURN)
4349 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4352 else if (error != SSL_ERROR_NONE)
4362 /*************************************************
4363 * Write bytes down TLS channel *
4364 *************************************************/
4368 ct_ctx client context pointer, or NULL for the one global server context
4371 more further data expected soon
4373 Returns: the number of bytes after a successful write,
4374 -1 after a failed write
4376 Used by both server-side and client-side TLS. Calling with len zero and more unset
4377 will flush buffered writes; buff can be null for this case.
4381 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4384 int outbytes, error;
4386 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4387 : state_server.lib_state.lib_ssl;
4388 static gstring * server_corked = NULL;
4389 gstring ** corkedp = ct_ctx
4390 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4391 gstring * corked = *corkedp;
4393 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4394 buff, (unsigned long)len, more ? ", more" : "");
4396 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4397 "more" is notified. This hack is only ok if small amounts are involved AND only
4398 one stream does it, in one context (i.e. no store reset). Currently it is used
4399 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4400 We support callouts done by the server process by using a separate client
4401 context for the stashed information. */
4402 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4403 a store reset there, so use POOL_PERM. */
4404 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4408 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4410 int save_pool = store_pool;
4411 store_pool = POOL_PERM;
4413 corked = string_catn(corked, buff, len);
4415 store_pool = save_pool;
4422 buff = CUS corked->s;
4427 for (int left = len; left > 0;)
4429 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4431 outbytes = SSL_write(ssl, CS buff, left);
4432 error = SSL_get_error(ssl, outbytes);
4433 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4436 case SSL_ERROR_NONE: /* the usual case */
4442 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4443 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4446 case SSL_ERROR_ZERO_RETURN:
4447 log_write(0, LOG_MAIN, "SSL channel closed on write");
4450 case SSL_ERROR_SYSCALL:
4451 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4452 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4453 sender_fullhost ? sender_fullhost : US"<unknown>",
4455 else if (LOGGING(protocol_detail))
4456 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4457 " SMTP response and TLS close\n", sender_host_address);
4459 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4460 " client reset TCP before TLS close\n", sender_host_address);
4464 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4475 ct_ctx client TLS context pointer, or NULL for the one global server context
4479 tls_shutdown_wr(void * ct_ctx)
4481 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4482 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4483 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4486 if (*fdp < 0) return; /* TLS was not active */
4488 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4490 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
4491 rc = SSL_shutdown(*sslp);
4492 if (rc < 0) DEBUG(D_tls)
4494 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4495 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4499 /*************************************************
4500 * Close down a TLS session *
4501 *************************************************/
4503 /* This is also called from within a delivery subprocess forked from the
4504 daemon, to shut down the TLS library, without actually doing a shutdown (which
4505 would tamper with the SSL session in the parent process).
4508 ct_ctx client TLS context pointer, or NULL for the one global server context
4509 do_shutdown 0 no data-flush or TLS close-alert
4510 1 if TLS close-alert is to be sent,
4511 2 if also response to be waited for
4515 Used by both server-side and client-side TLS.
4519 tls_close(void * ct_ctx, int do_shutdown)
4521 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4522 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4523 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4525 if (*fdp < 0) return; /* TLS was not active */
4527 if (do_shutdown > TLS_NO_SHUTDOWN)
4530 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4531 do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
4533 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4535 if ( ( do_shutdown >= TLS_SHUTDOWN_WONLY
4536 || (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4538 && do_shutdown > TLS_SHUTDOWN_NOWAIT
4541 #ifdef EXIM_TCP_CORK
4542 (void) setsockopt(*fdp, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
4545 rc = SSL_shutdown(*sslp); /* wait for response */
4549 if (rc < 0) DEBUG(D_tls)
4551 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4552 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4556 if (!o_ctx) /* server side */
4558 #ifndef DISABLE_OCSP
4559 sk_X509_pop_free(state_server.verify_stack, X509_free);
4560 state_server.verify_stack = NULL;
4563 receive_getc = smtp_getc;
4564 receive_getbuf = smtp_getbuf;
4565 receive_get_cache = smtp_get_cache;
4566 receive_hasc = smtp_hasc;
4567 receive_ungetc = smtp_ungetc;
4568 receive_feof = smtp_feof;
4569 receive_ferror = smtp_ferror;
4570 tls_in.active.tls_ctx = NULL;
4572 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4583 /*************************************************
4584 * Let tls_require_ciphers be checked at startup *
4585 *************************************************/
4587 /* The tls_require_ciphers option, if set, must be something which the
4590 Returns: NULL on success, or error message
4594 tls_validate_require_cipher(void)
4597 uschar * expciphers, * err;
4601 if (!(tls_require_ciphers && *tls_require_ciphers))
4604 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4606 return US"failed to expand tls_require_ciphers";
4608 if (!(expciphers && *expciphers))
4611 normalise_ciphers(&expciphers, tls_require_ciphers);
4614 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4617 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4619 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4621 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4622 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4623 expciphers, ssl_errstring);
4634 /*************************************************
4635 * Report the library versions. *
4636 *************************************************/
4638 /* There have historically been some issues with binary compatibility in
4639 OpenSSL libraries; if Exim (like many other applications) is built against
4640 one version of OpenSSL but the run-time linker picks up another version,
4641 it can result in serious failures, including crashing with a SIGSEGV. So
4642 report the version found by the compiler and the run-time version.
4644 Note: some OS vendors backport security fixes without changing the version
4645 number/string, and the version date remains unchanged. The _build_ date
4646 will change, so we can more usefully assist with version diagnosis by also
4647 reporting the build date.
4649 Arguments: string to append to
4654 tls_version_report(gstring * g)
4656 return string_fmt_append(g,
4657 "Library version: OpenSSL: Compile: %s\n"
4660 OPENSSL_VERSION_TEXT,
4661 SSLeay_version(SSLEAY_VERSION),
4662 SSLeay_version(SSLEAY_BUILT_ON));
4663 /* third line is 38 characters for the %s and the line is 73 chars long;
4664 the OpenSSL output includes a "built on: " prefix already. */
4670 /*************************************************
4671 * Random number generation *
4672 *************************************************/
4674 /* Pseudo-random number generation. The result is not expected to be
4675 cryptographically strong but not so weak that someone will shoot themselves
4676 in the foot using it as a nonce in input in some email header scheme or
4677 whatever weirdness they'll twist this into. The result should handle fork()
4678 and avoid repeating sequences. OpenSSL handles that for us.
4682 Returns a random number in range [0, max-1]
4686 vaguely_random_number(int max)
4690 static pid_t pidlast = 0;
4692 uschar smallbuf[sizeof(r)];
4698 if (pidnow != pidlast)
4700 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
4701 is unique for each thread", this doesn't apparently apply across processes,
4702 so our own warning from vaguely_random_number_fallback() applies here too.
4703 Fix per PostgreSQL. */
4709 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
4713 gettimeofday(&r.tv, NULL);
4716 RAND_seed(US (&r), sizeof(r));
4718 /* We're after pseudo-random, not random; if we still don't have enough data
4719 in the internal PRNG then our options are limited. We could sleep and hope
4720 for entropy to come along (prayer technique) but if the system is so depleted
4721 in the first place then something is likely to just keep taking it. Instead,
4722 we'll just take whatever little bit of pseudo-random we can still manage to
4725 needed_len = sizeof(r);
4726 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4727 asked for a number less than 10. */
4728 for (r = max, i = 0; r; ++i)
4734 #ifdef EXIM_HAVE_RAND_PSEUDO
4735 /* We do not care if crypto-strong */
4736 i = RAND_pseudo_bytes(smallbuf, needed_len);
4738 i = RAND_bytes(smallbuf, needed_len);
4744 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
4745 return vaguely_random_number_fallback(max);
4749 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4752 /* We don't particularly care about weighted results; if someone wants
4753 smooth distribution and cares enough then they should submit a patch then. */
4760 /*************************************************
4761 * OpenSSL option parse *
4762 *************************************************/
4764 /* Parse one option for tls_openssl_options_parse below
4767 name one option name
4768 value place to store a value for it
4769 Returns success or failure in parsing
4775 tls_openssl_one_option_parse(uschar *name, long *value)
4778 int last = exim_openssl_options_size;
4779 while (last > first)
4781 int middle = (first + last)/2;
4782 int c = Ustrcmp(name, exim_openssl_options[middle].name);
4785 *value = exim_openssl_options[middle].value;
4799 /*************************************************
4800 * OpenSSL option parsing logic *
4801 *************************************************/
4803 /* OpenSSL has a number of compatibility options which an administrator might
4804 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
4805 we look like log_selector.
4808 option_spec the administrator-supplied string of options
4809 results ptr to long storage for the options bitmap
4810 Returns success or failure
4814 tls_openssl_options_parse(uschar *option_spec, long *results)
4817 uschar * exp, * end;
4818 BOOL adding, item_parsed;
4820 /* Server: send no (<= TLS1.2) session tickets */
4821 result = SSL_OP_NO_TICKET;
4823 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
4824 from default because it increases BEAST susceptibility. */
4825 #ifdef SSL_OP_NO_SSLv2
4826 result |= SSL_OP_NO_SSLv2;
4828 #ifdef SSL_OP_NO_SSLv3
4829 result |= SSL_OP_NO_SSLv3;
4831 #ifdef SSL_OP_SINGLE_DH_USE
4832 result |= SSL_OP_SINGLE_DH_USE;
4834 #ifdef SSL_OP_NO_RENEGOTIATION
4835 result |= SSL_OP_NO_RENEGOTIATION;
4844 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
4847 for (uschar * s = exp; *s; /**/)
4849 while (isspace(*s)) ++s;
4852 if (*s != '+' && *s != '-')
4854 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
4855 "+ or - expected but found \"%s\"\n", s);
4858 adding = *s++ == '+';
4859 for (end = s; *end && !isspace(*end); ) end++;
4860 item_parsed = tls_openssl_one_option_parse(string_copyn(s, end-s), &item);
4863 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
4866 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
4867 adding ? "adding to " : "removing from", result, item, s);
4879 #endif /*!MACRO_PREDEF*/
4882 /* End of tls-openssl.c */