1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2019 */
7 /* See the file NOTICE for conditions of use and distribution. */
8 /* SPDX-License-Identifier: GPL-2.0-or-later */
10 /* Portions Copyright (c) The OpenSSL Project 1999 */
12 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
13 library. It is #included into the tls.c file when that library is used. The
14 code herein is based on a patch that was originally contributed by Steve
15 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
17 No cryptographic code is included in Exim. All this module does is to call
18 functions from the OpenSSL library. */
23 #include <openssl/lhash.h>
24 #include <openssl/ssl.h>
25 #include <openssl/err.h>
26 #include <openssl/rand.h>
27 #ifndef OPENSSL_NO_ECDH
28 # include <openssl/ec.h>
31 # include <openssl/ocsp.h>
39 # define EXIM_OCSP_SKEW_SECONDS (300L)
40 # define EXIM_OCSP_MAX_AGE (-1L)
43 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
44 # define EXIM_HAVE_OPENSSL_TLSEXT
46 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
47 # define EXIM_HAVE_RSA_GENKEY_EX
49 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
50 # define EXIM_HAVE_OCSP_RESP_COUNT
51 # define OPENSSL_AUTO_SHA256
52 # define OPENSSL_MIN_PROTO_VERSION
54 # define EXIM_HAVE_EPHEM_RSA_KEX
55 # define EXIM_HAVE_RAND_PSEUDO
57 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
58 # define EXIM_HAVE_SHA256
61 /* X509_check_host provides sane certificate hostname checking, but was added
62 to OpenSSL late, after other projects forked off the code-base. So in
63 addition to guarding against the base version number, beware that LibreSSL
64 does not (at this time) support this function.
66 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
67 opt to disentangle and ask a LibreSSL user to provide glue for a third
68 crypto provider for libtls instead of continuing to tie the OpenSSL glue
69 into even twistier knots. If LibreSSL gains the same API, we can just
70 change this guard and punt the issue for a while longer. */
72 #ifndef LIBRESSL_VERSION_NUMBER
73 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
74 # define EXIM_HAVE_OPENSSL_CHECKHOST
75 # define EXIM_HAVE_OPENSSL_DH_BITS
76 # define EXIM_HAVE_OPENSSL_TLS_METHOD
77 # define EXIM_HAVE_OPENSSL_KEYLOG
78 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
79 # define EXIM_HAVE_SESSION_TICKET
80 # define EXIM_HAVE_OPESSL_TRACE
81 # define EXIM_HAVE_OPESSL_GET0_SERIAL
82 # define EXIM_HAVE_OPESSL_OCSP_RESP_GET0_CERTS
83 # define EXIM_HAVE_SSL_GET0_VERIFIED_CHAIN
85 # define EXIM_HAVE_OCSP
87 # define EXIM_HAVE_ALPN /* fail ret from hshake-cb is ignored by LibreSSL */
89 # define EXIM_NEED_OPENSSL_INIT
91 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
92 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
93 # define EXIM_HAVE_OPENSSL_CHECKHOST
97 #if LIBRESSL_VERSION_NUMBER >= 0x3040000fL
98 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
101 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x030000000L)
102 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
103 # define EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
106 #if !defined(LIBRESSL_VERSION_NUMBER) \
107 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
108 # if !defined(OPENSSL_NO_ECDH)
109 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
110 # define EXIM_HAVE_ECDH
112 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
113 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
118 #ifndef LIBRESSL_VERSION_NUMBER
119 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
120 # define OPENSSL_HAVE_KEYLOG_CB
121 # define OPENSSL_HAVE_NUM_TICKETS
122 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
123 # define EXIM_HAVE_EXP_CHNL_BNGNG
124 # define EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER
125 # define EXIM_HAVE_OPENSSL_SET1_GROUPS
127 # define OPENSSL_BAD_SRVR_OURCERT
131 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x010002000L)
132 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
135 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
136 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
137 # define DISABLE_OCSP
140 #ifndef DISABLE_TLS_RESUME
141 # if OPENSSL_VERSION_NUMBER < 0x0101010L
142 # error OpenSSL version too old for session-resumption
146 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
147 # include <openssl/x509v3.h>
150 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
151 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
152 # define SSL_CIPHER_get_id(c) (c->id)
154 # ifndef MACRO_PREDEF
155 # include "tls-cipher-stdname.c"
159 #define TESTSUITE_TICKET_LIFE 10 /* seconds */
160 /*************************************************
161 * OpenSSL option parse *
162 *************************************************/
164 typedef struct exim_openssl_option {
167 } exim_openssl_option;
168 /* We could use a macro to expand, but we need the ifdef and not all the
169 options document which version they were introduced in. Policylet: include
170 all options unless explicitly for DTLS, let the administrator choose which
173 This list is current as of:
176 XXX could we autobuild this list, as with predefined-macros?
177 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
178 Also allow a numeric literal?
180 static exim_openssl_option exim_openssl_options[] = {
181 /* KEEP SORTED ALPHABETICALLY! */
183 { US"all", (long) SSL_OP_ALL },
185 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
186 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
188 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
189 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
191 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
192 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
194 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
195 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
197 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
198 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
200 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
201 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
203 #ifdef SSL_OP_EPHEMERAL_RSA
204 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
206 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
207 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
209 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
210 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
212 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
213 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
215 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
216 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
218 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
219 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
221 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
222 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
224 #ifdef SSL_OP_NO_ANTI_REPLAY
225 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
227 #ifdef SSL_OP_NO_COMPRESSION
228 { US"no_compression", SSL_OP_NO_COMPRESSION },
230 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
231 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
233 #ifdef SSL_OP_NO_RENEGOTIATION
234 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
236 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
237 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
239 #ifdef SSL_OP_NO_SSLv2
240 { US"no_sslv2", SSL_OP_NO_SSLv2 },
242 #ifdef SSL_OP_NO_SSLv3
243 { US"no_sslv3", SSL_OP_NO_SSLv3 },
245 #ifdef SSL_OP_NO_TICKET
246 { US"no_ticket", SSL_OP_NO_TICKET },
248 #ifdef SSL_OP_NO_TLSv1
249 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
251 #ifdef SSL_OP_NO_TLSv1_1
252 # if OPENSSL_VERSION_NUMBER < 0x30000000L
253 # if SSL_OP_NO_TLSv1_1 == 0x00000400L
254 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
255 # warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
256 # define NO_SSL_OP_NO_TLSv1_1
259 # ifndef NO_SSL_OP_NO_TLSv1_1
260 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
263 #ifdef SSL_OP_NO_TLSv1_2
264 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
266 #ifdef SSL_OP_NO_TLSv1_3
267 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
269 #ifdef SSL_OP_PRIORITIZE_CHACHA
270 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
272 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
273 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
275 #ifdef SSL_OP_SINGLE_DH_USE
276 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
278 #ifdef SSL_OP_SINGLE_ECDH_USE
279 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
281 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
282 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
284 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
285 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
287 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
288 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
290 #ifdef SSL_OP_TLS_D5_BUG
291 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
293 #ifdef SSL_OP_TLS_ROLLBACK_BUG
294 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
296 #ifdef SSL_OP_TLSEXT_PADDING
297 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
302 static int exim_openssl_options_size = nelem(exim_openssl_options);
303 static long init_options = 0;
312 for (struct exim_openssl_option * o = exim_openssl_options;
313 o < exim_openssl_options + nelem(exim_openssl_options); o++)
315 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
316 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
318 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
319 builtin_macro_create(buf);
322 # ifndef DISABLE_TLS_RESUME
323 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
325 # ifdef SSL_OP_NO_TLSv1_3
326 builtin_macro_create(US"_HAVE_TLS1_3");
328 # ifdef OPENSSL_BAD_SRVR_OURCERT
329 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
331 # ifdef EXIM_HAVE_OCSP
332 builtin_macro_create(US"_HAVE_TLS_OCSP");
333 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
335 # ifdef EXIM_HAVE_ALPN
336 builtin_macro_create(US"_HAVE_TLS_ALPN");
341 /******************************************************************************/
343 /* Structure for collecting random data for seeding. */
345 typedef struct randstuff {
350 /* Local static variables */
352 static BOOL client_verify_callback_called = FALSE;
353 static BOOL server_verify_callback_called = FALSE;
354 static const uschar *sid_ctx = US"exim";
356 /* We have three different contexts to care about.
358 Simple case: client, `client_ctx`
359 As a client, we can be doing a callout or cut-through delivery while receiving
360 a message. So we have a client context, which should have options initialised
361 from the SMTP Transport. We may also concurrently want to make TLS connections
362 to utility daemons, so client-contexts are allocated and passed around in call
363 args rather than using a gobal.
366 There are two cases: with and without ServerNameIndication from the client.
367 Given TLS SNI, we can be using different keys, certs and various other
368 configuration settings, because they're re-expanded with $tls_sni set. This
369 allows vhosting with TLS. This SNI is sent in the handshake.
370 A client might not send SNI, so we need a fallback, and an initial setup too.
371 So as a server, we start out using `server_ctx`.
372 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
373 `server_sni` from `server_ctx` and then initialise settings by re-expanding
381 } exim_openssl_client_tls_ctx;
384 /* static SSL_CTX *server_ctx = NULL; */
385 /* static SSL *server_ssl = NULL; */
387 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
388 static SSL_CTX *server_sni = NULL;
390 #ifdef EXIM_HAVE_ALPN
391 static BOOL server_seen_alpn = FALSE;
394 static char ssl_errstring[256];
396 static int ssl_session_timeout = 7200; /* Two hours */
397 static BOOL client_verify_optional = FALSE;
398 static BOOL server_verify_optional = FALSE;
400 static BOOL reexpand_tls_files_for_sni = FALSE;
403 typedef struct ocsp_resp {
404 struct ocsp_resp * next;
405 OCSP_RESPONSE * resp;
408 typedef struct exim_openssl_state {
409 exim_tlslib_state lib_state;
410 #define lib_ctx libdata0
411 #define lib_ssl libdata1
414 uschar * certificate;
421 const uschar *file_expanded;
422 ocsp_resplist *olist;
423 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
426 X509_STORE *verify_store; /* non-null if status requested */
427 uschar *verify_errstr; /* only if _required */
428 BOOL verify_required;
433 /* these are cached from first expand */
434 uschar * server_cipher_list;
435 /* only passed down to tls_error: */
437 const uschar * verify_cert_hostnames;
438 #ifndef DISABLE_EVENT
439 uschar * event_action;
441 } exim_openssl_state_st;
443 /* should figure out a cleanup of API to handle state preserved per
444 implementation, for various reasons, which can be void * in the APIs.
445 For now, we hack around it. */
446 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
447 exim_openssl_state_st state_server = {.is_server = TRUE};
450 setup_certs(SSL_CTX * sctx, uschar ** certs, uschar * crl, host_item * host,
455 static int tls_server_stapling_cb(SSL *s, void *arg);
456 static void x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk);
457 static void x509_store_dump_cert_s_names(X509_STORE * store);
462 /* Daemon-called, before every connection, key create/rotate */
463 #ifndef DISABLE_TLS_RESUME
464 static void tk_init(void);
465 static int tls_exdata_idx = -1;
469 tls_per_lib_daemon_tick(void)
471 #ifndef DISABLE_TLS_RESUME
476 /* Called once at daemon startup */
479 tls_per_lib_daemon_init(void)
481 tls_daemon_creds_reload();
485 /*************************************************
487 *************************************************/
489 /* Called from lots of places when errors occur before actually starting to do
490 the TLS handshake, that is, while the session is still in clear. Always returns
491 DEFER for a server and FAIL for a client so that most calls can use "return
492 tls_error(...)" to do this processing and then give an appropriate return. A
493 single function is used for both server and client, because it is called from
494 some shared functions.
497 prefix text to include in the logged error
498 host NULL if setting up a server;
499 the connected host if setting up a client
500 msg error message or NULL if we should ask OpenSSL
501 errstr pointer to output error message
503 Returns: OK/DEFER/FAIL
507 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
511 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
512 msg = US ssl_errstring;
515 msg = string_sprintf("(%s): %s", prefix, msg);
516 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
517 if (errstr) *errstr = msg;
518 return host ? FAIL : DEFER;
523 /**************************************************
524 * General library initalisation *
525 **************************************************/
528 lib_rand_init(void * addr)
531 if (!RAND_status()) return TRUE;
533 gettimeofday(&r.tv, NULL);
535 RAND_seed(US (&r), sizeof(r));
536 RAND_seed(US big_buffer, big_buffer_size);
537 if (addr) RAND_seed(US addr, sizeof(addr));
539 return RAND_status();
544 tls_openssl_init(void)
546 static BOOL once = FALSE;
550 #ifdef EXIM_NEED_OPENSSL_INIT
551 SSL_load_error_strings(); /* basic set up */
552 OpenSSL_add_ssl_algorithms();
555 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
556 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
557 list of available digests. */
558 EVP_add_digest(EVP_sha256());
561 (void) lib_rand_init(NULL);
562 (void) tls_openssl_options_parse(openssl_options, &init_options);
567 /*************************************************
568 * Initialize for DH *
569 *************************************************/
571 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
575 sctx The current SSL CTX (inbound or outbound)
576 dhparam DH parameter file or fixed parameter identity string
577 errstr error string pointer
579 Returns: TRUE if OK (nothing to set up, or setup worked)
583 init_dh(SSL_CTX * sctx, uschar * dhparam, uschar ** errstr)
586 #if OPENSSL_VERSION_NUMBER < 0x30000000L
595 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
598 if (!dhexpanded || !*dhexpanded)
599 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
600 else if (dhexpanded[0] == '/')
602 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
604 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
605 NULL, US strerror(errno), errstr);
611 if (Ustrcmp(dhexpanded, "none") == 0)
613 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
617 if (!(pem = std_dh_prime_named(dhexpanded)))
619 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
620 NULL, US strerror(errno), errstr);
623 bio = BIO_new_mem_buf(CS pem, -1);
627 #if OPENSSL_VERSION_NUMBER < 0x30000000L
628 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)
630 pkey = PEM_read_bio_Parameters_ex(bio, NULL, NULL, NULL)
635 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
640 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
641 an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with 2236.
642 But older OpenSSL can only report in bytes (octets), not bits. If someone wants
643 to dance at the edge, then they can raise the limit or use current libraries. */
645 #if OPENSSL_VERSION_NUMBER < 0x30000000L
646 # ifdef EXIM_HAVE_OPENSSL_DH_BITS
647 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
648 This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
649 dh_bitsize = DH_bits(dh);
651 dh_bitsize = 8 * DH_size(dh);
654 dh_bitsize = EVP_PKEY_get_bits(pkey);
657 /* Even if it is larger, we silently return success rather than cause things to
658 fail out, so that a too-large DH will not knock out all TLS; it's a debatable
659 choice. Likewise for a failing attempt to set one. */
661 if (dh_bitsize <= tls_dh_max_bits)
664 #if OPENSSL_VERSION_NUMBER < 0x30000000L
665 SSL_CTX_set_tmp_dh(sctx, dh)
667 SSL_CTX_set0_tmp_dh_pkey(sctx, pkey)
671 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
672 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (D-H param setting '%s'): %s",
673 dhexpanded ? dhexpanded : US"default", ssl_errstring);
674 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
675 /* EVP_PKEY_free(pkey); crashes */
680 debug_printf(" Diffie-Hellman initialized from %s with %d-bit prime\n",
681 dhexpanded ? dhexpanded : US"default", dh_bitsize);
685 debug_printf(" dhparams '%s' %d bits, is > tls_dh_max_bits limit of %d\n",
686 dhexpanded ? dhexpanded : US"default", dh_bitsize, tls_dh_max_bits);
688 #if OPENSSL_VERSION_NUMBER < 0x30000000L
691 /* The EVP_PKEY ownership stays with the ctx; do not free it */
700 /*************************************************
701 * Initialize for ECDH *
702 *************************************************/
704 /* "auto" needs to be handled carefully.
705 OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
706 OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
707 (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
708 OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
709 https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
714 init_ecdh_auto(SSL_CTX * sctx)
716 #if OPENSSL_VERSION_NUMBER < 0x10002000L
717 DEBUG(D_tls) debug_printf(
718 " ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
719 return US"prime256v1";
722 # if defined SSL_CTRL_SET_ECDH_AUTO
724 DEBUG(D_tls) debug_printf(
725 " ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n");
726 SSL_CTX_set_ecdh_auto(sctx, 1);
731 DEBUG(D_tls) debug_printf(
732 " ECDH OpenSSL 1.1.0+: temp key parameter settings: library default selection\n");
739 /* Load parameters for ECDH encryption. Server only.
741 For now, we stick to NIST P-256 because: it's simple and easy to configure;
742 it avoids any patent issues that might bite redistributors; despite events in
743 the news and concerns over curve choices, we're not cryptographers, we're not
744 pretending to be, and this is "good enough" to be better than no support,
745 protecting against most adversaries. Given another year or two, there might
746 be sufficient clarity about a "right" way forward to let us make an informed
747 decision, instead of a knee-jerk reaction.
749 Longer-term, we should look at supporting both various named curves and
750 external files generated with "openssl ecparam", much as we do for init_dh().
751 We should also support "none" as a value, to explicitly avoid initialisation.
756 sctx The current SSL CTX (inbound or outbound)
757 errstr error string pointer
759 Returns: TRUE if OK (nothing to set up, or setup worked)
763 init_ecdh(SSL_CTX * sctx, uschar ** errstr)
765 #ifdef OPENSSL_NO_ECDH
769 # ifndef EXIM_HAVE_ECDH
771 debug_printf(" No OpenSSL API to define ECDH parameters, skipping\n");
776 int ngroups, rc, sep;
777 const uschar * curves_list, * curve;
778 # ifdef EXIM_HAVE_OPENSSL_SET1_GROUPS
784 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
787 /* Is the option deliberately empty? */
789 if (!exp_curve || !*exp_curve)
792 /* Limit the list to hardwired array size. Drop out if any element is "suto". */
794 curves_list = exp_curve;
797 ngroups < nelem(nids)
798 && (curve = string_nextinlist(&curves_list, &sep, NULL, 0));
800 if (Ustrcmp(curve, "auto") == 0)
802 DEBUG(D_tls) if (ngroups > 0)
803 debug_printf(" tls_eccurve 'auto' item takes precedence\n");
804 if ((exp_curve = init_ecdh_auto(sctx))) break; /* have a curve name to set */
805 return TRUE; /* all done */
810 /* Translate to NIDs */
812 curves_list = exp_curve;
813 for (ngroups = 0; curve = string_nextinlist(&curves_list, &sep, NULL, 0);
815 if ( (nids[ngroups] = OBJ_sn2nid (CCS curve)) == NID_undef
816 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
817 && (nids[ngroups] = EC_curve_nist2nid(CCS curve)) == NID_undef
821 uschar * s = string_sprintf("Unknown curve name in tls_eccurve '%s'", curve);
822 DEBUG(D_tls) debug_printf("TLS error: %s\n", s);
823 if (errstr) *errstr = s;
827 # ifdef EXIM_HAVE_OPENSSL_SET1_GROUPS
830 if ((rc = SSL_CTX_set1_groups(sctx, nids, ngroups)) == 0)
831 tls_error(string_sprintf("Error enabling '%s' group(s)", exp_curve), NULL, NULL, errstr);
833 DEBUG(D_tls) debug_printf(" ECDH: enabled '%s' group(s)\n", exp_curve);
835 # else /* Cannot handle a list; only 1 element nids array */
838 if (!(ecdh = EC_KEY_new_by_curve_name(nids[0])))
840 tls_error(US"Unable to create ec curve", NULL, NULL, errstr);
844 /* The "tmp" in the name here refers to setting a temporary key
845 not to the stability of the interface. */
847 if ((rc = SSL_CTX_set_tmp_ecdh(sctx, ecdh)) == 0)
848 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), NULL, NULL, errstr);
850 DEBUG(D_tls) debug_printf(" ECDH: enabled '%s' curve\n", exp_curve);
853 # endif /*!EXIM_HAVE_OPENSSL_SET1_GROUPS*/
857 # endif /*EXIM_HAVE_ECDH*/
858 #endif /*OPENSSL_NO_ECDH*/
863 /*************************************************
864 * Expand key and cert file specs *
865 *************************************************/
867 #if OPENSSL_VERSION_NUMBER < 0x30000000L
870 s SSL connection (not used)
874 Returns: pointer to generated key
878 rsa_callback(SSL *s, int export, int keylength)
881 #ifdef EXIM_HAVE_RSA_GENKEY_EX
882 BIGNUM *bn = BN_new();
885 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
887 # ifdef EXIM_HAVE_RSA_GENKEY_EX
888 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
889 || !(rsa_key = RSA_new())
890 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
893 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
897 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
898 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
904 #endif /* pre-3.0.0 */
908 /* Create and install a selfsigned certificate, for use in server mode */
909 /*XXX we could arrange to call this during prelo for a null tls_certificate option.
910 The normal cache inval + relo will suffice.
911 Just need a timer for inval. */
914 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
921 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
922 where = US"allocating pkey";
923 if (!(pkey = EVP_PKEY_new()))
926 where = US"allocating cert";
927 if (!(x509 = X509_new()))
930 where = US"generating pkey";
931 #if OPENSSL_VERSION_NUMBER < 0x30000000L
934 if (!(rsa = rsa_callback(NULL, 0, 2048)))
937 where = US"assigning pkey";
938 if (!EVP_PKEY_assign_RSA(pkey, rsa))
942 pkey = EVP_RSA_gen(2048);
945 X509_set_version(x509, 2); /* N+1 - version 3 */
946 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
947 X509_gmtime_adj(X509_get_notBefore(x509), 0);
948 X509_gmtime_adj(X509_get_notAfter(x509), (long)2 * 60 * 60); /* 2 hour */
949 X509_set_pubkey(x509, pkey);
951 name = X509_get_subject_name(x509);
952 X509_NAME_add_entry_by_txt(name, "C",
953 MBSTRING_ASC, CUS "UK", -1, -1, 0);
954 X509_NAME_add_entry_by_txt(name, "O",
955 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
956 X509_NAME_add_entry_by_txt(name, "CN",
957 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
958 X509_set_issuer_name(x509, name);
960 where = US"signing cert";
961 if (!X509_sign(x509, pkey, EVP_md5()))
964 where = US"installing selfsign cert";
965 if (!SSL_CTX_use_certificate(sctx, x509))
968 where = US"installing selfsign key";
969 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
975 (void) tls_error(where, NULL, NULL, errstr);
976 if (x509) X509_free(x509);
977 if (pkey) EVP_PKEY_free(pkey);
987 /*************************************************
988 * Information callback *
989 *************************************************/
991 /* The SSL library functions call this from time to time to indicate what they
992 are doing. We copy the string to the debugging output when TLS debugging has
1004 info_callback(const SSL * s, int where, int ret)
1010 if (where & SSL_ST_CONNECT) g = string_append_listele(g, ',', US"SSL_connect");
1011 if (where & SSL_ST_ACCEPT) g = string_append_listele(g, ',', US"SSL_accept");
1012 if (where & SSL_CB_LOOP) g = string_append_listele(g, ',', US"state_chg");
1013 if (where & SSL_CB_EXIT) g = string_append_listele(g, ',', US"hshake_exit");
1014 if (where & SSL_CB_READ) g = string_append_listele(g, ',', US"read");
1015 if (where & SSL_CB_WRITE) g = string_append_listele(g, ',', US"write");
1016 if (where & SSL_CB_ALERT) g = string_append_listele(g, ',', US"alert");
1017 if (where & SSL_CB_HANDSHAKE_START) g = string_append_listele(g, ',', US"hshake_start");
1018 if (where & SSL_CB_HANDSHAKE_DONE) g = string_append_listele(g, ',', US"hshake_done");
1020 if (where & SSL_CB_LOOP)
1021 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
1022 else if (where & SSL_CB_ALERT)
1023 debug_printf("SSL %s %s:%s\n", g->s,
1024 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
1025 else if (where & SSL_CB_EXIT)
1028 debug_printf("SSL %s: %s in %s\n", g->s,
1029 ret == 0 ? "failed" : "error", SSL_state_string_long(s));
1031 else if (where & (SSL_CB_HANDSHAKE_START | SSL_CB_HANDSHAKE_DONE))
1032 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
1036 #ifdef OPENSSL_HAVE_KEYLOG_CB
1038 keylog_callback(const SSL *ssl, const char *line)
1042 DEBUG(D_tls) debug_printf("%.200s\n", line);
1043 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
1044 if (!(fp = fopen(filename, "a"))) return;
1045 fprintf(fp, "%s\n", line);
1054 #ifndef DISABLE_EVENT
1056 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
1057 BOOL *calledp, const BOOL *optionalp, const uschar * what)
1063 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
1066 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
1067 old_cert = tlsp->peercert;
1068 tlsp->peercert = X509_dup(cert);
1069 /* NB we do not bother setting peerdn */
1070 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth), &errno)))
1072 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
1073 "depth=%d cert=%s: %s",
1074 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1075 what, depth, dn, yield);
1079 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
1080 return 1; /* reject (leaving peercert set) */
1082 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
1083 "(host in tls_try_verify_hosts)\n");
1084 tlsp->verify_override = TRUE;
1086 X509_free(tlsp->peercert);
1087 tlsp->peercert = old_cert;
1093 /*************************************************
1094 * Callback for verification *
1095 *************************************************/
1097 /* The SSL library does certificate verification if set up to do so. This
1098 callback has the current yes/no state is in "state". If verification succeeded,
1099 we set the certificate-verified flag. If verification failed, what happens
1100 depends on whether the client is required to present a verifiable certificate
1103 If verification is optional, we change the state to yes, but still log the
1104 verification error. For some reason (it really would help to have proper
1105 documentation of OpenSSL), this callback function then gets called again, this
1106 time with state = 1. We must take care not to set the private verified flag on
1107 the second time through.
1109 Note: this function is not called if the client fails to present a certificate
1110 when asked. We get here only if a certificate has been received. Handling of
1111 optional verification for this case is done when requesting SSL to verify, by
1112 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
1114 May be called multiple times for different issues with a certificate, even
1115 for a given "depth" in the certificate chain.
1118 preverify_ok current yes/no state as 1/0
1119 x509ctx certificate information.
1120 tlsp per-direction (client vs. server) support data
1121 calledp has-been-called flag
1122 optionalp verification-is-optional flag
1124 Returns: 0 if verification should fail, otherwise 1
1128 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1129 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1131 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1132 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1135 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1137 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1138 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1139 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1142 dn[sizeof(dn)-1] = '\0';
1144 tlsp->verify_override = FALSE;
1145 if (preverify_ok == 0)
1147 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1148 *verify_mode, sender_host_address)
1150 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1151 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1153 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1157 if (!tlsp->peercert)
1158 tlsp->peercert = X509_dup(cert); /* record failing cert */
1159 return 0; /* reject */
1161 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1162 "tls_try_verify_hosts)\n");
1163 tlsp->verify_override = TRUE;
1166 else if (depth != 0)
1168 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1169 #ifndef DISABLE_EVENT
1170 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1171 return 0; /* reject, with peercert set */
1176 const uschar * verify_cert_hostnames;
1178 if ( tlsp == &tls_out
1179 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1180 /* client, wanting hostname check */
1183 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1184 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1185 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1187 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1188 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1191 const uschar * list = verify_cert_hostnames;
1194 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1196 DEBUG(D_tls|D_lookup) debug_printf_indent("%s suitable for cert, per OpenSSL?", name);
1197 if ((rc = X509_check_host(cert, CCS name, 0,
1198 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1199 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1204 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1205 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1208 DEBUG(D_tls|D_lookup) debug_printf_indent(" yes\n");
1211 else DEBUG(D_tls|D_lookup) debug_printf_indent(" no\n");
1215 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1218 uschar * extra = verify_mode
1219 ? string_sprintf(" (during %c-verify for [%s])",
1220 *verify_mode, sender_host_address)
1222 log_write(0, LOG_MAIN,
1223 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1224 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1225 extra, dn, verify_cert_hostnames);
1229 if (!tlsp->peercert)
1230 tlsp->peercert = X509_dup(cert); /* record failing cert */
1231 return 0; /* reject */
1233 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1234 "tls_try_verify_hosts)\n");
1235 tlsp->verify_override = TRUE;
1239 #ifndef DISABLE_EVENT
1240 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1241 return 0; /* reject, with peercert set */
1244 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1245 *calledp ? "" : " authenticated", dn);
1249 return 1; /* accept, at least for this level */
1253 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1255 return verify_callback(preverify_ok, x509ctx, &tls_out,
1256 &client_verify_callback_called, &client_verify_optional);
1260 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1262 return verify_callback(preverify_ok, x509ctx, &tls_in,
1263 &server_verify_callback_called, &server_verify_optional);
1269 /* This gets called *by* the dane library verify callback, which interposes
1273 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1275 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1277 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1278 #ifndef DISABLE_EVENT
1279 BOOL dummy_called, optional = FALSE;
1282 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1284 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1285 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1286 deliver_host_address);
1289 dn[sizeof(dn)-1] = '\0';
1291 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1292 preverify_ok ? "ok":"BAD", depth, dn);
1294 #ifndef DISABLE_EVENT
1295 if (verify_event(&tls_out, cert, depth, dn,
1296 &dummy_called, &optional, US"DANE"))
1297 return 0; /* reject, with peercert set */
1300 if (preverify_ok == 1)
1301 tls_out.dane_verified = TRUE;
1304 int err = X509_STORE_CTX_get_error(x509ctx);
1306 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1307 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1310 return preverify_ok;
1313 #endif /*SUPPORT_DANE*/
1316 #ifndef DISABLE_OCSP
1318 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1320 BIO_printf(bp, "\t%s: ", str);
1321 ASN1_GENERALIZEDTIME_print(bp, time);
1325 /*************************************************
1326 * Load OCSP information into state *
1327 *************************************************/
1328 /* Called to load the server OCSP response from the given file into memory, once
1329 caller has determined this is needed. Checks validity. Debugs a message
1332 ASSUMES: single response, for single cert.
1335 state various parts of session state
1336 filename the filename putatively holding an OCSP response
1337 is_pem file is PEM format; otherwise is DER
1341 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1345 OCSP_RESPONSE * resp;
1346 OCSP_BASICRESP * basic_response;
1347 OCSP_SINGLERESP * single_response;
1348 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1349 STACK_OF(X509) * sk;
1350 int status, reason, i;
1353 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1355 if (!filename || !*filename) return;
1358 if (!(bio = BIO_new_file(CS filename, "rb")))
1360 log_write(0, LOG_MAIN|LOG_PANIC,
1361 "Failed to open OCSP response file \"%s\": %.100s",
1362 filename, ERR_reason_error_string(ERR_get_error()));
1368 uschar * data, * freep;
1371 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1373 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
1374 filename, ERR_reason_error_string(ERR_get_error()));
1378 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1379 OPENSSL_free(freep);
1382 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1387 log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
1388 filename, ERR_reason_error_string(ERR_get_error()));
1392 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1394 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1395 OCSP_response_status_str(status), status);
1401 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1402 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1407 if (!(basic_response = OCSP_response_get1_basic(resp)))
1410 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1414 sk = state->u_ocsp.server.verify_stack; /* set by setup_certs() / chain_from_pem_file() */
1416 /* May need to expose ability to adjust those flags?
1417 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1418 OCSP_TRUSTOTHER OCSP_NOINTERN */
1420 /* This does a partial verify (only the signer link, not the whole chain-to-CA)
1421 on the OCSP proof before we load it for serving up; possibly overkill -
1422 just date-checks might be nice enough.
1424 OCSP_basic_verify takes a "store" arg, but does not
1425 use it for the chain verification, when OCSP_NOVERIFY is set.
1426 The content from the wire "basic_response" and a cert-stack "sk" are all
1429 We have a stack, loaded in setup_certs() if tls_verify_certificates
1430 was a file (not a directory, or "system"). It is unfortunate we
1431 cannot used the connection context store, as that would neatly
1432 handle the "system" case too, but there seems to be no library
1433 function for getting a stack from a store.
1434 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1435 [ 3.0.0 - sk = X509_STORE_get1_all_certs(store) ]
1436 We do not free the stack since it could be needed a second time for
1439 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1440 be a public interface into the OpenSSL library (there's no manual entry) -
1441 (in 3.0.0 + is is public)
1442 But what with? We also use OCSP_basic_verify in the client stapling callback.
1443 And there we NEED it; we must verify that status... unless the
1444 library does it for us anyway? */
1446 if ((i = OCSP_basic_verify(basic_response, sk, NULL, OCSP_NOVERIFY)) < 0)
1450 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1451 debug_printf("OCSP response has bad signature: %s\n", US ssl_errstring);
1456 /* Here's the simplifying assumption: there's only one response, for the
1457 one certificate we use, and nothing for anything else in a chain. If this
1458 proves false, we need to extract a cert id from our issued cert
1459 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1460 right cert in the stack and then calls OCSP_single_get0_status()).
1462 I'm hoping to avoid reworking a bunch more of how we handle state here.
1464 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1467 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1470 debug_printf("Unable to get first response from OCSP basic response.\n");
1474 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1475 if (status != V_OCSP_CERTSTATUS_GOOD)
1477 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1478 OCSP_cert_status_str(status), status,
1479 OCSP_crl_reason_str(reason), reason);
1483 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1487 BIO * bp = BIO_new(BIO_s_mem());
1490 time_print(bp, "This OCSP Update", thisupd);
1491 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
1492 if ((len = (int) BIO_get_mem_data(bp, CSS &s)) > 0) debug_printf("%.*s", len, s);
1493 debug_printf("OCSP status invalid times.\n");
1499 /* Add the resp to the list used by tls_server_stapling_cb() */
1501 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1502 while (oentry = *op)
1504 *op = oentry = store_get(sizeof(ocsp_resplist), GET_UNTAINTED);
1505 oentry->next = NULL;
1506 oentry->resp = resp;
1511 if (f.running_in_test_harness)
1513 extern char ** environ;
1514 if (environ) for (uschar ** p = USS environ; *p; p++)
1515 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1517 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1518 goto supply_response;
1526 ocsp_free_response_list(exim_openssl_state_st * state)
1528 for (ocsp_resplist * olist = state->u_ocsp.server.olist; olist;
1529 olist = olist->next)
1530 OCSP_RESPONSE_free(olist->resp);
1531 state->u_ocsp.server.olist = NULL;
1533 #endif /*!DISABLE_OCSP*/
1540 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1543 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1544 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1545 return tls_error(string_sprintf(
1546 "SSL_CTX_use_certificate_chain_file file=%s", file),
1547 cbinfo->host, NULL, errstr);
1552 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1555 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1556 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1557 return tls_error(string_sprintf(
1558 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1565 /* Called once during tls_init and possibly again during TLS setup, for a
1566 new context, if Server Name Indication was used and tls_sni was seen in
1567 the certificate string.
1570 sctx the SSL_CTX* to update
1571 state various parts of session state
1572 errstr error string pointer
1574 Returns: OK/DEFER/FAIL
1578 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1583 if (!state->certificate)
1585 if (!state->is_server) /* client */
1588 if (tls_install_selfsign(sctx, errstr) != OK)
1595 if ( !reexpand_tls_files_for_sni
1596 && ( Ustrstr(state->certificate, US"tls_sni")
1597 || Ustrstr(state->certificate, US"tls_in_sni")
1598 || Ustrstr(state->certificate, US"tls_out_sni")
1600 reexpand_tls_files_for_sni = TRUE;
1602 if ( !expand_check(state->certificate, US"tls_certificate", &expanded, errstr)
1603 || f.expand_string_forcedfail)
1605 if (f.expand_string_forcedfail)
1606 *errstr = US"expansion of tls_certificate failed";
1611 if (state->is_server)
1613 const uschar * file_list = expanded;
1616 #ifndef DISABLE_OCSP
1617 const uschar * olist = state->u_ocsp.server.file;
1620 BOOL fmt_pem = FALSE;
1623 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1625 if (olist && !*olist)
1628 /* If doing a re-expand after SNI, avoid reloading the OCSP
1629 responses when the list of filenames has not changed.
1630 The creds-invali on content change wipes file_expanded, so that
1631 always reloads here. */
1633 if ( state->u_ocsp.server.file_expanded && olist
1634 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1636 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1641 ocsp_free_response_list(state);
1642 state->u_ocsp.server.file_expanded = olist;
1646 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1648 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1651 #ifndef DISABLE_OCSP
1653 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1655 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1660 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1665 ocsp_load_response(state, ofile, fmt_pem);
1668 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1672 else /* would there ever be a need for multiple client certs? */
1673 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1676 if ( state->privatekey
1677 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr)
1678 || f.expand_string_forcedfail)
1680 if (f.expand_string_forcedfail)
1681 *errstr = US"expansion of tls_privatekey failed";
1685 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1686 of the expansion is an empty string, ignore it also, and assume the private
1687 key is in the same file as the certificate. */
1689 if (expanded && *expanded)
1690 if (state->is_server)
1692 const uschar * file_list = expanded;
1696 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1697 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1700 else /* would there ever be a need for multiple client certs? */
1701 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1711 /**************************************************
1712 * One-time init credentials for server and client *
1713 **************************************************/
1716 normalise_ciphers(uschar ** ciphers, const uschar * pre_expansion_ciphers)
1718 uschar * s = *ciphers;
1720 if (!s || !Ustrchr(s, '_')) return; /* no change needed */
1722 if (s == pre_expansion_ciphers)
1723 s = string_copy(s); /* get writable copy */
1725 for (uschar * t = s; *t; t++) if (*t == '_') *t = '-';
1730 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1731 uschar * ciphers, uschar ** errstr)
1733 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1734 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1735 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1736 state->server_cipher_list = ciphers;
1743 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1746 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1747 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1749 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1751 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1753 /* Set up the information callback, which outputs if debugging is at a suitable
1758 SSL_CTX_set_info_callback(ctx, info_callback);
1759 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1760 /* this needs a debug build of OpenSSL */
1761 SSL_CTX_set_msg_callback(ctx, SSL_trace);
1763 #ifdef OPENSSL_HAVE_KEYLOG_CB
1764 SSL_CTX_set_keylog_callback(ctx, keylog_callback);
1768 /* Automatically re-try reads/writes after renegotiation. */
1769 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1776 tls_server_creds_init(void)
1779 uschar * dummy_errstr;
1780 unsigned lifetime = 0;
1784 state_server.lib_state = null_tls_preload;
1786 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1788 state_server.lib_state.lib_ctx = ctx;
1790 /* Preload DH params and EC curve */
1792 if (opt_unset_or_noexpand(tls_dhparam))
1794 DEBUG(D_tls) debug_printf("TLS: preloading DH params '%s' for server\n", tls_dhparam);
1795 if (init_dh(ctx, tls_dhparam, &dummy_errstr))
1796 state_server.lib_state.dh = TRUE;
1799 DEBUG(D_tls) debug_printf("TLS: not preloading DH params for server\n");
1800 if (opt_unset_or_noexpand(tls_eccurve))
1802 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve '%s' for server\n", tls_eccurve);
1803 if (init_ecdh(ctx, &dummy_errstr))
1804 state_server.lib_state.ecdh = TRUE;
1807 DEBUG(D_tls) debug_printf("TLS: not preloading ECDH curve for server\n");
1809 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1810 /* If we can, preload the Authorities for checking client certs against.
1811 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1812 at TLS conn startup.
1813 Do this before the server ocsp so that its info can verify the ocsp. */
1815 if ( opt_set_and_noexpand(tls_verify_certificates)
1816 && opt_unset_or_noexpand(tls_crl))
1818 /* Watch the default dir also as they are always included */
1820 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1821 && tls_set_watch(tls_verify_certificates, FALSE)
1822 && tls_set_watch(tls_crl, FALSE))
1824 uschar * v_certs = tls_verify_certificates;
1825 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1827 if (setup_certs(ctx, &v_certs, tls_crl, NULL, &dummy_errstr) == OK)
1828 state_server.lib_state.cabundle = TRUE;
1830 /* If we can, preload the server-side cert, key and ocsp */
1832 if ( opt_set_and_noexpand(tls_certificate)
1833 # ifndef DISABLE_OCSP
1834 && opt_unset_or_noexpand(tls_ocsp_file)
1836 && opt_unset_or_noexpand(tls_privatekey))
1838 /* Set watches on the filenames. The implementation does de-duplication
1839 so we can just blindly do them all. */
1841 if ( tls_set_watch(tls_certificate, TRUE)
1842 # ifndef DISABLE_OCSP
1843 && tls_set_watch(tls_ocsp_file, TRUE)
1845 && tls_set_watch(tls_privatekey, TRUE))
1847 state_server.certificate = tls_certificate;
1848 state_server.privatekey = tls_privatekey;
1849 #ifndef DISABLE_OCSP
1850 state_server.u_ocsp.server.file = tls_ocsp_file;
1853 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1854 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1855 state_server.lib_state.conn_certs = TRUE;
1858 else if ( !tls_certificate && !tls_privatekey
1859 # ifndef DISABLE_OCSP
1863 { /* Generate & preload a selfsigned cert. No files to watch. */
1864 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1866 state_server.lib_state.conn_certs = TRUE;
1867 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1871 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1875 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1878 #endif /* EXIM_HAVE_INOTIFY */
1881 /* If we can, preload the ciphers control string */
1883 if (opt_set_and_noexpand(tls_require_ciphers))
1885 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1886 normalise_ciphers(&tls_require_ciphers, tls_require_ciphers);
1887 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1888 &dummy_errstr) == OK)
1889 state_server.lib_state.pri_string = TRUE;
1892 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1899 /* Preload whatever creds are static, onto a transport. The client can then
1900 just copy the pointer as it starts up.
1901 Called from the daemon after a cache-invalidate with watch set; called from
1902 a queue-run startup with watch clear. */
1905 tls_client_creds_init(transport_instance * t, BOOL watch)
1907 smtp_transport_options_block * ob = t->options_block;
1908 exim_openssl_state_st tpt_dummy_state;
1909 host_item * dummy_host = (host_item *)1;
1910 uschar * dummy_errstr;
1915 ob->tls_preload = null_tls_preload;
1916 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1918 ob->tls_preload.lib_ctx = ctx;
1920 tpt_dummy_state.lib_state = ob->tls_preload;
1922 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1923 if ( opt_set_and_noexpand(ob->tls_certificate)
1924 && opt_unset_or_noexpand(ob->tls_privatekey))
1927 || ( tls_set_watch(ob->tls_certificate, FALSE)
1928 && tls_set_watch(ob->tls_privatekey, FALSE)
1931 uschar * pkey = ob->tls_privatekey;
1934 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1936 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1938 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1939 pkey ? pkey : ob->tls_certificate,
1942 ob->tls_preload.conn_certs = TRUE;
1947 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1950 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1951 && opt_unset_or_noexpand(ob->tls_crl))
1954 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1955 && tls_set_watch(ob->tls_verify_certificates, FALSE)
1956 && tls_set_watch(ob->tls_crl, FALSE)
1959 uschar * v_certs = ob->tls_verify_certificates;
1961 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1963 if (setup_certs(ctx, &v_certs,
1964 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
1965 ob->tls_preload.cabundle = TRUE;
1970 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1972 #endif /*EXIM_HAVE_INOTIFY*/
1976 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1977 /* Invalidate the creds cached, by dropping the current ones.
1978 Call when we notice one of the source files has changed. */
1981 tls_server_creds_invalidate(void)
1983 SSL_CTX_free(state_server.lib_state.lib_ctx);
1984 state_server.lib_state = null_tls_preload;
1985 #ifndef DISABLE_OCSP
1986 state_server.u_ocsp.server.file_expanded = NULL;
1992 tls_client_creds_invalidate(transport_instance * t)
1994 smtp_transport_options_block * ob = t->options_block;
1995 SSL_CTX_free(ob->tls_preload.lib_ctx);
1996 ob->tls_preload = null_tls_preload;
2002 tls_server_creds_invalidate(void)
2006 tls_client_creds_invalidate(transport_instance * t)
2009 #endif /*EXIM_HAVE_INOTIFY*/
2014 #ifndef DISABLE_OCSP
2016 debug_print_sn(const X509 * cert)
2018 X509_NAME * sn = X509_get_subject_name((X509 *)cert);
2019 static uschar name[256];
2020 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
2022 name[sizeof(name)-1] = '\0';
2023 debug_printf(" %s\n", name);
2028 x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk)
2031 debug_printf(" (null)\n");
2034 int idx = sk_X509_num(sk);
2036 debug_printf(" (empty)\n");
2038 while (--idx >= 0) debug_print_sn(sk_X509_value(sk, idx));
2043 x509_store_dump_cert_s_names(X509_STORE * store)
2045 # ifdef EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
2047 debug_printf(" (no store)\n");
2050 STACK_OF(X509) * sk = X509_STORE_get1_all_certs(store);
2051 x509_stack_dump_cert_s_names(sk);
2052 sk_X509_pop_free(sk, X509_free);
2056 #endif /*!DISABLE_OCSP*/
2061 #ifndef DISABLE_TLS_RESUME
2062 /* Manage the keysets used for encrypting the session tickets, on the server. */
2064 typedef struct { /* Session ticket encryption key */
2067 const EVP_CIPHER * aes_cipher;
2068 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
2069 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2070 const EVP_MD * hmac_hash;
2072 const uschar * hmac_hashname;
2074 uschar hmac_key[16];
2079 static exim_stek exim_tk; /* current key */
2080 static exim_stek exim_tk_old; /* previous key */
2085 time_t t = time(NULL);
2087 if (exim_tk.name[0])
2089 if (exim_tk.renew >= t) return;
2090 exim_tk_old = exim_tk;
2093 if (f.running_in_test_harness) ssl_session_timeout = TESTSUITE_TICKET_LIFE;
2095 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
2096 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
2097 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
2098 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
2100 exim_tk.name[0] = 'E';
2101 exim_tk.aes_cipher = EVP_aes_256_cbc();
2102 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2103 exim_tk.hmac_hash = EVP_sha256();
2105 exim_tk.hmac_hashname = US "sha256";
2107 exim_tk.expire = t + ssl_session_timeout;
2108 exim_tk.renew = t + ssl_session_timeout/2;
2114 if (!exim_tk.name[0]) return NULL;
2119 tk_find(const uschar * name)
2121 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
2122 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
2129 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2137 /*XXX will want these dependent on the ssl session strength */
2138 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2139 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2140 key->hmac_hash, NULL);
2143 OSSL_PARAM params[3];
2144 uschar * hk = string_copy(key->hmac_hashname); /* need nonconst */
2145 params[0] = OSSL_PARAM_construct_octet_string("key", key->hmac_key, sizeof(key->hmac_key));
2146 params[1] = OSSL_PARAM_construct_utf8_string("digest", CS hk, 0);
2147 params[2] = OSSL_PARAM_construct_end();
2148 if (EVP_MAC_CTX_set_params(hctx, params) == 0)
2150 DEBUG(D_tls) debug_printf("EVP_MAC_CTX_set_params: %s\n",
2151 ERR_reason_error_string(ERR_get_error()));
2152 return 0; /* error in mac initialisation */
2159 /* Callback for session tickets, on server */
2161 ticket_key_callback(SSL * ssl, uschar key_name[16],
2162 uschar * iv, EVP_CIPHER_CTX * c_ctx,
2163 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2170 tls_support * tlsp = state_server.tlsp;
2175 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
2176 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2178 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
2179 return -1; /* insufficient random */
2181 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
2182 return 0; /* key couldn't be created */
2183 memcpy(key_name, key->name, 16);
2184 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
2186 if (tk_hmac_init(hctx, key) == 0) return 0;
2187 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2189 DEBUG(D_tls) debug_printf("ticket created\n");
2194 time_t now = time(NULL);
2196 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
2197 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2199 if (!(key = tk_find(key_name)) || key->expire < now)
2203 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
2204 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
2209 if (tk_hmac_init(hctx, key) == 0) return 0;
2210 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2212 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2214 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2215 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2216 be better. To do that we'd have to encode ticket lifetime in the name as
2217 we don't yet see the restored session. Could check posthandshake for TLS1.3
2218 and trigger a new ticket then, but cannot do that for TLS1.2 */
2219 return key->renew < now ? 2 : 1;
2222 #endif /* !DISABLE_TLS_RESUME */
2227 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2228 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2230 /* If verification is optional, don't fail if no certificate */
2232 SSL_CTX_set_verify(ctx,
2233 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2238 /*************************************************
2239 * Callback to handle SNI *
2240 *************************************************/
2242 /* Called when acting as server during the TLS session setup if a Server Name
2243 Indication extension was sent by the client.
2245 API documentation is OpenSSL s_server.c implementation.
2248 s SSL* of the current session
2249 ad unknown (part of OpenSSL API) (unused)
2250 arg Callback of "our" registered data
2252 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2254 XXX might need to change to using ClientHello callback,
2255 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2258 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2260 tls_servername_cb(SSL * s, int * ad ARG_UNUSED, void * arg)
2262 const char * servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2263 exim_openssl_state_st * state = (exim_openssl_state_st *) arg;
2265 int old_pool = store_pool;
2269 return SSL_TLSEXT_ERR_OK;
2271 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2272 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2274 /* Make the extension value available for expansion */
2275 store_pool = POOL_PERM;
2276 tls_in.sni = string_copy_taint(US servername, GET_TAINTED);
2277 store_pool = old_pool;
2279 if (!reexpand_tls_files_for_sni)
2280 return SSL_TLSEXT_ERR_OK;
2282 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2283 not confident that memcpy wouldn't break some internal reference counting.
2284 Especially since there's a references struct member, which would be off. */
2286 if (lib_ctx_new(&server_sni, NULL, &errstr) != OK)
2289 /* Not sure how many of these are actually needed, since SSL object
2290 already exists. Might even need this selfsame callback, for reneg? */
2293 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2294 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2295 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2296 #ifdef OPENSSL_MIN_PROTO_VERSION
2297 SSL_CTX_set_min_proto_version(server_sni, SSL3_VERSION);
2299 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2300 SSL_CTX_clear_options(server_sni, ~SSL_CTX_get_options(ctx));
2301 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2302 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2303 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2306 if ( !init_dh(server_sni, state->dhparam, &errstr)
2307 || !init_ecdh(server_sni, &errstr)
2311 if ( state->server_cipher_list
2312 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2315 #ifndef DISABLE_OCSP
2316 if (state->u_ocsp.server.file)
2318 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2319 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2324 uschar * v_certs = tls_verify_certificates;
2325 if ((rc = setup_certs(server_sni, &v_certs, tls_crl, NULL,
2329 if (v_certs && *v_certs)
2330 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2333 /* do this after setup_certs, because this can require the certs for verifying
2334 OCSP information. */
2335 if ((rc = tls_expand_session_files(server_sni, state, &errstr)) != OK)
2338 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2339 SSL_set_SSL_CTX(s, server_sni);
2340 return SSL_TLSEXT_ERR_OK;
2343 log_write(0, LOG_MAIN|LOG_PANIC, "%s", errstr);
2344 return SSL_TLSEXT_ERR_ALERT_FATAL;
2346 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2351 #ifdef EXIM_HAVE_ALPN
2352 /*************************************************
2353 * Callback to handle ALPN *
2354 *************************************************/
2356 /* Called on server if tls_alpn nonblank after expansion,
2357 when client offers ALPN, after the SNI callback.
2358 If set and not matching the list then we dump the connection */
2361 tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen,
2362 const uschar * in, unsigned int inlen, void * arg)
2366 server_seen_alpn = TRUE;
2369 debug_printf("Received TLS ALPN offer:");
2370 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2373 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2374 debug_printf(" '%.*s'", siz, in + pos + 1);
2376 debug_printf(". Our list: '%s'\n", tls_alpn);
2379 /* Look for an acceptable ALPN */
2381 if ( inlen > 1 /* at least one name */
2382 && in[0]+1 == inlen /* filling the vector, so exactly one name */
2385 const uschar * list = tls_alpn;
2387 for (uschar * name; name = string_nextinlist(&list, &sep, NULL, 0); )
2388 if (Ustrncmp(in+1, name, in[0]) == 0)
2390 *out = in+1; /* we checked for exactly one, so can just point to it */
2392 return SSL_TLSEXT_ERR_OK; /* use ALPN */
2396 /* More than one name from client, or name did not match our list. */
2398 /* This will be fatal to the TLS conn; would be nice to kill TCP also.
2399 Maybe as an option in future; for now leave control to the config (must-tls). */
2401 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2404 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2405 g = string_append_listele_n(g, ':', in + pos + 1, siz);
2407 log_write(0, LOG_MAIN, "TLS ALPN (%s) rejected", string_from_gstring(g));
2408 gstring_release_unused(g);
2409 return SSL_TLSEXT_ERR_ALERT_FATAL;
2411 #endif /* EXIM_HAVE_ALPN */
2415 #ifndef DISABLE_OCSP
2417 /*************************************************
2418 * Callback to handle OCSP Stapling *
2419 *************************************************/
2421 /* Called when acting as server during the TLS session setup if the client
2422 requests OCSP information with a Certificate Status Request.
2424 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2430 tls_server_stapling_cb(SSL *s, void *arg)
2432 const exim_openssl_state_st * state = arg;
2433 ocsp_resplist * olist = state->u_ocsp.server.olist;
2434 uschar * response_der; /*XXX blob */
2435 int response_der_len;
2438 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2439 olist ? "have" : "lack");
2441 tls_in.ocsp = OCSP_NOT_RESP;
2443 return SSL_TLSEXT_ERR_NOACK;
2445 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
2447 const X509 * cert_sent = SSL_get_certificate(s);
2448 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2449 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2451 for (; olist; olist = olist->next)
2453 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2454 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2455 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2456 ASN1_INTEGER * res_cert_serial;
2457 const BIGNUM * resp_bn;
2458 ASN1_OCTET_STRING * res_cert_iNameHash;
2461 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2462 (OCSP_CERTID *) cid);
2463 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2467 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2468 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2471 if (BN_cmp(cert_bn, resp_bn) == 0)
2473 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2475 /*XXX TODO: check the rest of the list for duplicate matches.
2476 If any, need to also check the Issuer Name hash.
2477 Without this, we will provide the wrong status in the case of
2482 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2486 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2487 return SSL_TLSEXT_ERR_NOACK;
2493 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2494 return SSL_TLSEXT_ERR_NOACK;
2498 /*XXX could we do the i2d earlier, rather than during the callback? */
2499 response_der = NULL;
2500 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2501 if (response_der_len <= 0)
2502 return SSL_TLSEXT_ERR_NOACK;
2504 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2505 response_der, response_der_len);
2506 tls_in.ocsp = OCSP_VFIED;
2507 return SSL_TLSEXT_ERR_OK;
2512 add_chain_to_store(X509_STORE * store, STACK_OF(X509) * sk,
2513 const char * debug_text)
2519 debug_printf("chain for %s:\n", debug_text);
2520 x509_stack_dump_cert_s_names(sk);
2523 if ((idx = sk_X509_num(sk)) > 0)
2525 X509_STORE_add_cert(store, sk_X509_value(sk, idx));
2530 tls_client_stapling_cb(SSL * ssl, void * arg)
2532 exim_openssl_state_st * cbinfo = arg;
2533 const unsigned char * p;
2535 OCSP_RESPONSE * rsp;
2536 OCSP_BASICRESP * bs;
2539 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2540 len = SSL_get_tlsext_status_ocsp_resp(ssl, &p);
2542 { /* Expect this when we requested ocsp but got none */
2543 if (SSL_session_reused(ssl) && tls_out.ocsp == OCSP_VFIED)
2545 DEBUG(D_tls) debug_printf(" null, but resumed; ocsp vfy stored with session is good\n");
2549 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2550 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2552 DEBUG(D_tls) debug_printf(" null\n");
2554 if (!cbinfo->u_ocsp.client.verify_required)
2556 cbinfo->u_ocsp.client.verify_errstr =
2557 US"(SSL_connect) Required TLS certificate status not received";
2561 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2563 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2564 if (LOGGING(tls_cipher))
2565 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2567 DEBUG(D_tls) debug_printf(" parse error\n");
2571 if (!(bs = OCSP_response_get1_basic(rsp)))
2573 tls_out.ocsp = OCSP_FAILED;
2574 if (LOGGING(tls_cipher))
2575 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2577 DEBUG(D_tls) debug_printf(" error parsing response\n");
2578 OCSP_RESPONSE_free(rsp);
2582 /* We'd check the nonce here if we'd put one in the request. */
2583 /* However that would defeat cacheability on the server so we don't. */
2585 /* This section of code reworked from OpenSSL apps source;
2586 The OpenSSL Project retains copyright:
2587 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2591 X509_STORE * verify_store = NULL;
2592 BOOL have_verified_OCSP_signer = FALSE;
2593 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2594 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2597 DEBUG(D_tls) bp = BIO_new(BIO_s_mem());
2599 /* Use the CA & chain that verified the server cert to verify the stapled info */
2600 /*XXX could we do an event here, for observability of ocsp? What reasonable data could we give access to? */
2601 /* Dates would be a start. Do we need another opaque variable type, as for certs, plus an extract expansion? */
2604 /* If this routine is not available, we've avoided [in tls_client_start()]
2605 asking for certificate-status under DANE, so this callback won't run for
2606 that combination. It still will for non-DANE. */
2608 #ifdef EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER
2611 if ( tls_out.dane_verified
2612 && (have_verified_OCSP_signer =
2613 OCSP_resp_get0_signer(bs, &signer, SSL_get0_verified_chain(ssl)) == 1))
2616 debug_printf("signer for OCSP basicres is in the verified chain;"
2617 " shortcut its verification\n");
2622 STACK_OF(X509) * verified_chain;
2624 verify_store = X509_STORE_new();
2626 SSL_get0_chain_certs(ssl, &verified_chain);
2627 add_chain_to_store(verify_store, verified_chain,
2628 "'current cert' per SSL_get0_chain_certs()");
2629 #ifdef EXIM_HAVE_SSL_GET0_VERIFIED_CHAIN
2630 verified_chain = SSL_get0_verified_chain(ssl);
2631 add_chain_to_store(verify_store, verified_chain,
2632 "SSL_get0_verified_chain()");
2639 debug_printf("Untrusted intermediate cert stack (from SSL_get_peer_cert_chain()):\n");
2640 x509_stack_dump_cert_s_names(SSL_get_peer_cert_chain(ssl));
2642 debug_printf("will use this CA store for verifying basicresp:\n");
2643 x509_store_dump_cert_s_names(verify_store);
2645 /* OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2647 debug_printf("certs contained in basicresp:\n");
2648 x509_stack_dump_cert_s_names(
2649 #ifdef EXIM_HAVE_OPESSL_OCSP_RESP_GET0_CERTS
2650 OCSP_resp_get0_certs(bs)
2656 #ifdef EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
2657 /* could do via X509_STORE_get0_objects(); not worth it just for debug info */
2660 if (OCSP_resp_get0_signer(bs, &signer, X509_STORE_get1_all_certs(verify_store)) == 1)
2662 debug_printf("found signer for basicres:\n");
2663 debug_print_sn(signer);
2667 debug_printf("failed to find signer for basicres:\n");
2668 ERR_print_errors(bp);
2677 /* Under DANE the trust-anchor (at least in TA mode) is indicated by the TLSA
2678 record in DNS, and probably is not the root of the chain of certificates. So
2679 accept a partial chain for that case (and hope that anchor is visible for
2680 verifying the OCSP stapling).
2681 XXX for EE mode it won't even be that. Does that make OCSP useless for EE?
2683 Worse, for LetsEncrypt-mode (ocsp signer is leaf-signer) under DANE, the
2684 data used within OpenSSL for the signer has nil pointers for signing
2685 algorithms - and a crash results. Avoid this by shortcutting verification,
2686 having determined that the OCSP signer is in the (DANE-)validated set.
2689 #ifndef OCSP_PARTIAL_CHAIN /* defined for 3.0.0 onwards */
2690 # define OCSP_PARTIAL_CHAIN 0
2693 if ((i = OCSP_basic_verify(bs, SSL_get_peer_cert_chain(ssl),
2696 tls_out.dane_verified
2697 ? have_verified_OCSP_signer
2698 ? OCSP_NOVERIFY | OCSP_NOEXPLICIT
2699 : OCSP_PARTIAL_CHAIN | OCSP_NOEXPLICIT
2702 OCSP_NOEXPLICIT)) <= 0)
2704 DEBUG(D_tls) debug_printf("OCSP_basic_verify() fail: returned %d\n", i);
2705 if (ERR_peek_error())
2707 tls_out.ocsp = OCSP_FAILED;
2708 if (LOGGING(tls_cipher))
2710 static uschar peerdn[256];
2711 const uschar * errstr;;
2713 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
2714 ERR_peek_error_all(NULL, NULL, NULL, CCSS &errstr, NULL);
2717 errstr = CUS ERR_reason_error_string(ERR_peek_error());
2719 X509_NAME_oneline(X509_get_subject_name(SSL_get_peer_certificate(ssl)),
2720 CS peerdn, sizeof(peerdn));
2721 log_write(0, LOG_MAIN,
2722 "[%s] %s Received TLS cert (DN: '%.*s') status response, "
2723 "itself unverifiable: %s",
2724 deliver_host_address, deliver_host,
2725 (int)sizeof(peerdn), peerdn, errstr);
2729 BIO_printf(bp, "OCSP response verify failure\n");
2730 ERR_print_errors(bp);
2733 int len = (int) BIO_get_mem_data(bp, CSS &s);
2734 if (len > 0) debug_printf("%.*s", len, s);
2737 OCSP_RESPONSE_print(bp, rsp, 0);
2742 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2743 " in the root CA certificate; ignoring\n");
2746 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2748 /*XXX So we have a good stapled OCSP status. How do we know
2749 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2750 OCSP_resp_find_status() which matches on a cert id, which presumably
2751 we should use. Making an id needs OCSP_cert_id_new(), which takes
2752 issuerName, issuerKey, serialNumber. Are they all in the cert?
2754 For now, carry on blindly accepting the resp. */
2757 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2758 OCSP_resp_count(bs) - 1;
2760 sk_OCSP_SINGLERESP_num(sresp) - 1;
2764 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2766 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2768 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2769 - but what happens with a GnuTLS-style input?
2771 we could do with a debug label for each singleresp
2772 - it has a certID with a serialNumber, but I see no API to get that
2774 status = OCSP_single_get0_status(single, &reason, &rev,
2775 &thisupd, &nextupd);
2779 time_print(bp, "This OCSP Update", thisupd);
2780 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
2782 if (!OCSP_check_validity(thisupd, nextupd,
2783 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2785 tls_out.ocsp = OCSP_FAILED;
2786 DEBUG(D_tls) ERR_print_errors(bp);
2787 cbinfo->u_ocsp.client.verify_errstr =
2788 US"(SSL_connect) Server certificate status is out-of-date";
2789 log_write(0, LOG_MAIN, "OCSP dates invalid");
2793 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2794 OCSP_cert_status_str(status));
2797 case V_OCSP_CERTSTATUS_GOOD:
2798 continue; /* the idx loop */
2799 case V_OCSP_CERTSTATUS_REVOKED:
2800 cbinfo->u_ocsp.client.verify_errstr =
2801 US"(SSL_connect) Server certificate revoked";
2802 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2803 reason != -1 ? "; reason: " : "",
2804 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2805 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2808 cbinfo->u_ocsp.client.verify_errstr =
2809 US"(SSL_connect) Server certificate has unknown status";
2810 log_write(0, LOG_MAIN,
2811 "Server certificate status unknown, in OCSP stapling");
2819 tls_out.ocsp = OCSP_VFIED;
2823 tls_out.ocsp = OCSP_FAILED;
2824 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2828 int len = (int) BIO_get_mem_data(bp, CSS &s);
2829 if (len > 0) debug_printf("%.*s", len, s);
2834 OCSP_RESPONSE_free(rsp);
2837 #endif /*!DISABLE_OCSP*/
2840 /*************************************************
2841 * Initialize for TLS *
2842 *************************************************/
2843 /* Called from both server and client code, to do preliminary initialization
2844 of the library. We allocate and return a context structure.
2847 host connected host, if client; NULL if server
2848 ob transport options block, if client; NULL if server
2849 ocsp_file file of stapling info (server); flag for require ocsp (client)
2850 addr address if client; NULL if server (for some randomness)
2851 caller_state place to put pointer to allocated state-struct
2852 errstr error string pointer
2854 Returns: OK/DEFER/FAIL
2858 tls_init(host_item * host, smtp_transport_options_block * ob,
2859 #ifndef DISABLE_OCSP
2862 address_item *addr, exim_openssl_state_st ** caller_state,
2863 tls_support * tlsp, uschar ** errstr)
2866 exim_openssl_state_st * state;
2869 if (host) /* client */
2871 state = store_malloc(sizeof(exim_openssl_state_st));
2872 memset(state, 0, sizeof(*state));
2873 state->certificate = ob->tls_certificate;
2874 state->privatekey = ob->tls_privatekey;
2875 state->is_server = FALSE;
2876 state->dhparam = NULL;
2877 state->lib_state = ob->tls_preload;
2881 state = &state_server;
2882 state->certificate = tls_certificate;
2883 state->privatekey = tls_privatekey;
2884 state->is_server = TRUE;
2885 state->dhparam = tls_dhparam;
2886 state->lib_state = state_server.lib_state;
2892 if (!state->lib_state.pri_string)
2893 state->server_cipher_list = NULL;
2895 #ifndef DISABLE_EVENT
2896 state->event_action = NULL;
2901 /* It turns out that we need to seed the random number generator this early in
2902 order to get the full complement of ciphers to work. It took me roughly a day
2903 of work to discover this by experiment.
2905 On systems that have /dev/urandom, SSL may automatically seed itself from
2906 there. Otherwise, we have to make something up as best we can. Double check
2909 Although we likely called this before, at daemon startup, this is a chance
2910 to mix in further variable info (time, pid) if needed. */
2912 if (!lib_rand_init(addr))
2913 return tls_error(US"RAND_status", host,
2914 US"unable to seed random number generator", errstr);
2916 /* Apply administrator-supplied work-arounds.
2917 Historically we applied just one requested option,
2918 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2919 moved to an administrator-controlled list of options to specify and
2920 grandfathered in the first one as the default value for "openssl_options".
2922 No OpenSSL version number checks: the options we accept depend upon the
2923 availability of the option value macros from OpenSSL. */
2926 if (!tls_openssl_options_parse(openssl_options, &init_options))
2927 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2929 /* Create a context.
2930 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2931 negotiation in the different methods; as far as I can tell, the only
2932 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2933 when OpenSSL is built without SSLv2 support.
2934 By disabling with openssl_options, we can let admins re-enable with the
2937 if (!(ctx = state->lib_state.lib_ctx))
2939 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2941 state->lib_state.lib_ctx = ctx;
2944 #ifndef DISABLE_TLS_RESUME
2945 tlsp->resumption = RESUME_SUPPORTED;
2949 #ifndef DISABLE_TLS_RESUME
2950 /* Should the server offer session resumption? */
2951 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2953 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2954 init_options &= ~SSL_OP_NO_TICKET;
2955 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2956 tlsp->host_resumable = TRUE;
2960 #ifdef OPENSSL_MIN_PROTO_VERSION
2961 SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
2963 DEBUG(D_tls) debug_printf("setting SSL CTX options: %016lx\n", init_options);
2964 SSL_CTX_set_options(ctx, init_options);
2966 uint64_t readback = SSL_CTX_clear_options(ctx, ~init_options);
2967 if (readback != init_options)
2968 return tls_error(string_sprintf(
2969 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2973 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2975 /* We'd like to disable session cache unconditionally, but foolish Outlook
2976 Express clients then give up the first TLS connection and make a second one
2977 (which works). Only when there is an IMAP service on the same machine.
2978 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2979 now, until we work out a decent way of presenting control to the config. It
2980 will never be used because we use a new context every time. */
2982 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2985 /* Initialize with DH parameters if supplied */
2986 /* Initialize ECDH temp key parameter selection */
2990 if (state->lib_state.dh)
2991 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2993 if (!init_dh(ctx, state->dhparam, errstr)) return DEFER;
2995 if (state->lib_state.ecdh)
2996 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
2998 if (!init_ecdh(ctx, errstr)) return DEFER;
3001 /* Set up certificate and key (and perhaps OCSP info) */
3003 if (state->lib_state.conn_certs)
3006 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
3010 #ifndef DISABLE_OCSP
3011 if (!host) /* server */
3013 state->u_ocsp.server.file = ocsp_file;
3014 state->u_ocsp.server.file_expanded = NULL;
3015 state->u_ocsp.server.olist = NULL;
3018 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
3021 /* If we need to handle SNI or OCSP, do so */
3023 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
3024 # ifndef DISABLE_OCSP
3025 if (!host && !(state->u_ocsp.server.verify_stack = sk_X509_new_null()))
3027 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
3032 if (!host) /* server */
3034 # ifndef DISABLE_OCSP
3035 /* We check u_ocsp.server.file, not server.olist, because we care about if
3036 the option exists, not what the current expansion might be, as SNI might
3037 change the certificate and OCSP file in use between now and the time the
3038 callback is invoked. */
3039 if (state->u_ocsp.server.file)
3041 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
3042 SSL_CTX_set_tlsext_status_arg(ctx, state);
3045 /* We always do this, so that $tls_sni is available even if not used in
3047 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
3048 SSL_CTX_set_tlsext_servername_arg(ctx, state);
3050 # ifdef EXIM_HAVE_ALPN
3051 if (tls_alpn && *tls_alpn)
3054 if ( expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr)
3055 && *exp_alpn && !isblank(*exp_alpn))
3057 tls_alpn = exp_alpn; /* subprocess so ok to overwrite */
3058 SSL_CTX_set_alpn_select_cb(ctx, tls_server_alpn_cb, state);
3065 # ifndef DISABLE_OCSP
3067 if(ocsp_file) /* wanting stapling */
3069 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
3071 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
3075 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
3076 SSL_CTX_set_tlsext_status_arg(ctx, state);
3079 #endif /*EXIM_HAVE_OPENSSL_TLSEXT*/
3081 state->verify_cert_hostnames = NULL;
3083 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
3084 /* Set up the RSA callback */
3085 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
3088 /* Finally, set the session cache timeout, and we are done.
3089 The period appears to be also used for (server-generated) session tickets */
3091 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
3092 DEBUG(D_tls) debug_printf("Initialized TLS\n");
3094 *caller_state = state;
3102 /*************************************************
3103 * Get name of cipher in use *
3104 *************************************************/
3107 Argument: pointer to an SSL structure for the connection
3108 pointer to number of bits for cipher
3109 Returns: pointer to allocated string in perm-pool
3113 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
3115 int pool = store_pool;
3116 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
3117 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
3118 the accessor functions use const in the prototype. */
3120 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
3123 SSL_CIPHER_get_bits(c, bits);
3125 store_pool = POOL_PERM;
3126 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
3128 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
3133 /* Get IETF-standard name for ciphersuite.
3134 Argument: pointer to an SSL structure for the connection
3135 Returns: pointer to string
3138 static const uschar *
3139 cipher_stdname_ssl(SSL * ssl)
3141 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
3142 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
3144 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
3145 return cipher_stdname(id >> 8, id & 0xff);
3150 static const uschar *
3151 tlsver_name(SSL * ssl)
3154 int pool = store_pool;
3156 store_pool = POOL_PERM;
3157 s = string_copy(US SSL_get_version(ssl));
3159 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
3160 for (;; p++) if (!(*p = p[1])) break;
3166 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
3168 /*XXX we might consider a list-of-certs variable for the cert chain.
3169 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
3170 in list-handling functions, also consider the difference between the entire
3171 chain and the elements sent by the peer. */
3173 tlsp->peerdn = NULL;
3175 /* Will have already noted peercert on a verify fail; possibly not the leaf */
3176 if (!tlsp->peercert)
3177 tlsp->peercert = SSL_get_peer_certificate(ssl);
3178 /* Beware anonymous ciphers which lead to server_cert being NULL */
3180 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
3181 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
3184 int oldpool = store_pool;
3186 peerdn[siz-1] = '\0'; /* paranoia */
3187 store_pool = POOL_PERM;
3188 tlsp->peerdn = string_copy(peerdn);
3189 store_pool = oldpool;
3191 /* We used to set CV in the cert-verify callbacks (either plain or dane)
3192 but they don't get called on session-resumption. So use the official
3193 interface, which uses the resumed value. Unfortunately this claims verified
3194 when it actually failed but we're in try-verify mode, due to us wanting the
3195 knowlege that it failed so needing to have the callback and forcing a
3196 permissive return. If we don't force it, the TLS startup is failed.
3197 The extra bit of information is set in verify_override in the cb, stashed
3198 for resumption next to the TLS session, and used here. */
3200 if (!tlsp->verify_override)
3201 tlsp->certificate_verified =
3203 tlsp->dane_verified ||
3205 SSL_get_verify_result(ssl) == X509_V_OK;
3213 /*************************************************
3214 * Set up for verifying certificates *
3215 *************************************************/
3217 #ifndef DISABLE_OCSP
3218 /* In the server, load certs from file, return TRUE on success */
3221 chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
3224 STACK_OF(X509) * verify_stack = *vp;
3227 while (sk_X509_num(verify_stack) > 0)
3228 X509_free(sk_X509_pop(verify_stack));
3230 verify_stack = sk_X509_new_null();
3232 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
3233 for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
3234 sk_X509_push(verify_stack, x);
3243 /* Called by both client and server startup; on the server possibly
3244 repeated after a Server Name Indication.
3247 sctx SSL_CTX* to initialise
3248 certsp certs file, returned expanded
3249 crl CRL file or NULL
3250 host NULL in a server; the remote host in a client
3251 errstr error string pointer
3253 Returns: OK/DEFER/FAIL
3257 setup_certs(SSL_CTX * sctx, uschar ** certsp, uschar * crl, host_item * host,
3260 uschar * expcerts, * expcrl;
3262 if (!expand_check(*certsp, US"tls_verify_certificates", &expcerts, errstr))
3264 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3267 if (expcerts && *expcerts)
3269 /* Tell the library to use its compiled-in location for the system default
3270 CA bundle. Then add the ones specified in the config, if any. */
3272 if (!SSL_CTX_set_default_verify_paths(sctx))
3273 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
3275 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
3277 struct stat statbuf;
3279 if (Ustat(expcerts, &statbuf) < 0)
3281 log_write(0, LOG_MAIN|LOG_PANIC,
3282 "failed to stat %s for certificates", expcerts);
3288 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
3289 { file = NULL; dir = expcerts; }
3292 STACK_OF(X509) * verify_stack =
3293 #ifndef DISABLE_OCSP
3294 !host ? state_server.u_ocsp.server.verify_stack :
3297 STACK_OF(X509) ** vp = &verify_stack;
3299 file = expcerts; dir = NULL;
3300 #ifndef DISABLE_OCSP
3301 /* In the server if we will be offering an OCSP proof; load chain from
3302 file for verifying the OCSP proof at load time. */
3304 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
3305 This is inconsistent with the need to verify the OCSP proof of the server cert.
3307 /* *debug_printf("file for checking server ocsp stapling is: %s\n", file); */
3309 && statbuf.st_size > 0
3310 && state_server.u_ocsp.server.file
3311 && !chain_from_pem_file(file, vp)
3314 log_write(0, LOG_MAIN|LOG_PANIC,
3315 "failed to load cert chain from %s", file);
3321 /* If a certificate file is empty, the load function fails with an
3322 unhelpful error message. If we skip it, we get the correct behaviour (no
3323 certificates are recognized, but the error message is still misleading (it
3324 says no certificate was supplied). But this is better. */
3326 if ( (!file || statbuf.st_size > 0)
3327 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
3328 return tls_error(US"SSL_CTX_load_verify_locations",
3329 host, NULL, errstr);
3331 /* On the server load the list of CAs for which we will accept certs, for
3332 sending to the client. This is only for the one-file
3333 tls_verify_certificates variant.
3334 If a list isn't loaded into the server, but some verify locations are set,
3335 the server end appears to make a wildcard request for client certs.
3336 Meanwhile, the client library as default behaviour *ignores* the list
3337 we send over the wire - see man SSL_CTX_set_client_cert_cb.
3338 Because of this, and that the dir variant is likely only used for
3339 the public-CA bundle (not for a private CA), not worth fixing. */
3343 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
3344 int i = sk_X509_NAME_num(names);
3346 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
3347 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
3348 i, i>1 ? "ies":"y");
3352 debug_printf("Added dir for additional certificate authorities\n");
3356 /* Handle a certificate revocation list. */
3358 #if OPENSSL_VERSION_NUMBER > 0x00907000L
3360 /* This bit of code is now the version supplied by Lars Mainka. (I have
3361 merely reformatted it into the Exim code style.)
3363 "From here I changed the code to add support for multiple crl's
3364 in pem format in one file or to support hashed directory entries in
3365 pem format instead of a file. This method now uses the library function
3366 X509_STORE_load_locations to add the CRL location to the SSL context.
3367 OpenSSL will then handle the verify against CA certs and CRLs by
3368 itself in the verify callback." */
3370 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
3371 if (expcrl && *expcrl)
3373 struct stat statbufcrl;
3374 if (Ustat(expcrl, &statbufcrl) < 0)
3376 log_write(0, LOG_MAIN|LOG_PANIC,
3377 "failed to stat %s for certificates revocation lists", expcrl);
3382 /* is it a file or directory? */
3384 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
3385 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
3389 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
3395 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
3397 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
3398 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
3400 /* setting the flags to check against the complete crl chain */
3402 X509_STORE_set_flags(cvstore,
3403 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
3407 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3416 tls_dump_keylog(SSL * ssl)
3418 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3419 BIO * bp = BIO_new(BIO_s_mem());
3422 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3423 len = (int) BIO_get_mem_data(bp, CSS &s);
3424 if (len > 0) debug_printf("%.*s", len, s);
3430 /* Channel-binding info for authenticators
3431 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/
3436 tls_get_channel_binding(SSL * ssl, tls_support * tlsp, const void * taintval)
3441 #ifdef EXIM_HAVE_EXPORT_CHNL_BNGNG
3442 if (SSL_version(ssl) > TLS1_2_VERSION)
3444 /* It's not documented by OpenSSL how big the output buffer must be.
3445 The OpenSSL testcases use 80 bytes but don't say why. The GnuTLS impl only
3446 serves out 32B. RFC 9266 says it is 32B.
3447 Interop fails unless we use the same each end. */
3450 tlsp->channelbind_exporter = TRUE;
3451 taintval = GET_UNTAINTED;
3452 if (SSL_export_keying_material(ssl,
3453 s = store_get((int)len, taintval), len,
3454 "EXPORTER-Channel-Binding", (size_t) 24,
3461 len = SSL_get_peer_finished(ssl, &c, 0);
3462 len = SSL_get_peer_finished(ssl, s = store_get((int)len, taintval), len);
3467 int old_pool = store_pool;
3468 store_pool = POOL_PERM;
3469 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, taintval);
3470 store_pool = old_pool;
3471 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
3476 /*************************************************
3477 * Start a TLS session in a server *
3478 *************************************************/
3479 /* This is called when Exim is running as a server, after having received
3480 the STARTTLS command. It must respond to that command, and then negotiate
3484 errstr pointer to error message
3486 Returns: OK on success
3487 DEFER for errors before the start of the negotiation
3488 FAIL for errors during the negotiation; the server can't
3493 tls_server_start(uschar ** errstr)
3496 uschar * expciphers;
3497 exim_openssl_state_st * dummy_statep;
3500 static uschar peerdn[256];
3502 /* Check for previous activation */
3504 if (tls_in.active.sock >= 0)
3506 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3507 smtp_printf("554 Already in TLS\r\n", FALSE);
3511 /* Initialize the SSL library. If it fails, it will already have logged
3514 rc = tls_init(NULL, NULL,
3515 #ifndef DISABLE_OCSP
3518 NULL, &dummy_statep, &tls_in, errstr);
3519 if (rc != OK) return rc;
3520 ctx = state_server.lib_state.lib_ctx;
3522 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3523 were historically separated by underscores. So that I can use either form in my
3524 tests, and also for general convenience, we turn underscores into hyphens here.
3526 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3527 for TLS 1.3 . Since we do not call it at present we get the default list:
3528 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3531 if (state_server.lib_state.pri_string)
3532 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3535 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3540 normalise_ciphers(&expciphers, tls_require_ciphers);
3541 if ((rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3546 /* If this is a host for which certificate verification is mandatory or
3547 optional, set up appropriately. */
3549 tls_in.certificate_verified = FALSE;
3551 tls_in.dane_verified = FALSE;
3553 server_verify_callback_called = FALSE;
3555 if (verify_check_host(&tls_verify_hosts) == OK)
3556 server_verify_optional = FALSE;
3557 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3558 server_verify_optional = TRUE;
3563 uschar * v_certs = tls_verify_certificates;
3565 if (state_server.lib_state.cabundle)
3567 DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n");
3568 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3572 if ((rc = setup_certs(ctx, &v_certs, tls_crl, NULL, errstr)) != OK)
3574 if (v_certs && *v_certs)
3575 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3580 #ifndef DISABLE_TLS_RESUME
3581 # if OPENSSL_VERSION_NUMBER < 0x30000000L
3582 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3583 /* despite working, appears to always return failure, so ignoring */
3585 SSL_CTX_set_tlsext_ticket_key_evp_cb(ctx, ticket_key_callback);
3586 /* despite working, appears to always return failure, so ignoring */
3590 #ifdef OPENSSL_HAVE_NUM_TICKETS
3591 # ifndef DISABLE_TLS_RESUME
3592 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3594 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3599 /* Prepare for new connection */
3601 if (!(ssl = SSL_new(ctx)))
3602 return tls_error(US"SSL_new", NULL, NULL, errstr);
3603 state_server.lib_state.lib_ssl = ssl;
3605 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3607 * With the SSL_clear(), we get strange interoperability bugs with
3608 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3609 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3611 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3612 * session shutdown. In this case, we have a brand new object and there's no
3613 * obvious reason to immediately clear it. I'm guessing that this was
3614 * originally added because of incomplete initialisation which the clear fixed,
3615 * in some historic release.
3618 /* Set context and tell client to go ahead, except in the case of TLS startup
3619 on connection, where outputting anything now upsets the clients and tends to
3620 make them disconnect. We need to have an explicit fflush() here, to force out
3621 the response. Other smtp_printf() calls do not need it, because in non-TLS
3622 mode, the fflush() happens when smtp_getc() is called. */
3624 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3625 if (!tls_in.on_connect)
3627 smtp_printf("220 TLS go ahead\r\n", FALSE);
3631 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3632 that the OpenSSL library doesn't. */
3634 SSL_set_wfd(ssl, fileno(smtp_out));
3635 SSL_set_rfd(ssl, fileno(smtp_in));
3636 SSL_set_accept_state(ssl);
3638 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3641 sigalrm_seen = FALSE;
3642 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3643 rc = SSL_accept(ssl);
3648 int error = SSL_get_error(ssl, rc);
3651 case SSL_ERROR_NONE:
3654 case SSL_ERROR_ZERO_RETURN:
3655 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3656 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3657 #ifndef DISABLE_EVENT
3658 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3660 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3663 tls_close(NULL, TLS_NO_SHUTDOWN);
3666 /* Handle genuine errors */
3670 int r = ERR_GET_REASON(ERR_peek_error());
3671 if ( r == SSL_R_WRONG_VERSION_NUMBER
3672 #ifdef SSL_R_VERSION_TOO_LOW
3673 || r == SSL_R_VERSION_TOO_LOW
3675 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3676 s = string_sprintf("(%s)", SSL_get_version(ssl));
3677 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
3678 #ifndef DISABLE_EVENT
3679 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3685 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3686 if (error == SSL_ERROR_SYSCALL)
3690 *errstr = US"SSL_accept: TCP connection closed by peer";
3691 #ifndef DISABLE_EVENT
3692 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3696 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3698 (void) tls_error(US"SSL_accept", NULL,
3699 sigalrm_seen ? US"timed out"
3700 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3702 #ifndef DISABLE_EVENT
3703 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3709 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3710 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3711 anon-authentication ciphersuite negotiated. */
3713 #ifndef DISABLE_TLS_RESUME
3714 if (SSL_session_reused(ssl))
3716 tls_in.resumption |= RESUME_USED;
3717 DEBUG(D_tls) debug_printf("Session reused\n");
3721 #ifdef EXIM_HAVE_ALPN
3722 /* If require-alpn, check server_seen_alpn here. Else abort TLS */
3723 if (!tls_alpn || !*tls_alpn)
3724 { DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n"); }
3725 else if (!server_seen_alpn)
3726 if (verify_check_host(&hosts_require_alpn) == OK)
3728 /* We'd like to send a definitive Alert but OpenSSL provides no facility */
3730 tls_error(US"handshake", NULL, US"ALPN required but not negotiated", errstr);
3734 { DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n"); }
3737 const uschar * name;
3739 SSL_get0_alpn_selected(ssl, &name, &len);
3741 debug_printf("ALPN negotiated: '%.*s'\n", (int)*name, name+1);
3743 debug_printf("ALPN: no protocol negotiated\n");
3748 /* TLS has been set up. Record data for the connection,
3749 adjust the input functions to read via TLS, and initialize things. */
3751 #ifdef SSL_get_extms_support
3752 /*XXX what does this return for tls1.3 ? */
3753 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3755 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3757 tls_in.ver = tlsver_name(ssl);
3758 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3759 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3764 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3765 debug_printf("Shared ciphers: %s\n", buf);
3767 tls_dump_keylog(ssl);
3769 #ifdef EXIM_HAVE_SESSION_TICKET
3771 SSL_SESSION * ss = SSL_get_session(ssl);
3772 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3773 debug_printf("The session has a ticket, life %lu seconds\n",
3774 SSL_SESSION_get_ticket_lifetime_hint(ss));
3779 /* Record the certificate we presented */
3781 X509 * crt = SSL_get_certificate(ssl);
3782 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3785 tls_get_channel_binding(ssl, &tls_in, GET_UNTAINTED);
3787 /* Only used by the server-side tls (tls_in), including tls_getc.
3788 Client-side (tls_out) reads (seem to?) go via
3789 smtp_read_response()/ip_recv().
3790 Hence no need to duplicate for _in and _out.
3792 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3793 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3794 ssl_xfer_eof = ssl_xfer_error = FALSE;
3796 receive_getc = tls_getc;
3797 receive_getbuf = tls_getbuf;
3798 receive_get_cache = tls_get_cache;
3799 receive_hasc = tls_hasc;
3800 receive_ungetc = tls_ungetc;
3801 receive_feof = tls_feof;
3802 receive_ferror = tls_ferror;
3804 tls_in.active.sock = fileno(smtp_out);
3805 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3813 tls_client_basic_ctx_init(SSL_CTX * ctx,
3814 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3819 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3820 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3821 host patterns if one of them is set with content. */
3823 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3824 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3826 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3827 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3830 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3832 client_verify_optional = FALSE;
3833 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3834 client_verify_optional = TRUE;
3839 uschar * v_certs = ob->tls_verify_certificates;
3841 if (state->lib_state.cabundle)
3843 DEBUG(D_tls) debug_printf("TLS: CA bundle for tpt was preloaded\n");
3844 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3848 if ((rc = setup_certs(ctx, &v_certs, ob->tls_crl, host, errstr)) != OK)
3850 if (v_certs && *v_certs)
3851 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3855 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3857 state->verify_cert_hostnames =
3859 string_domain_utf8_to_alabel(host->certname, NULL);
3863 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3864 state->verify_cert_hostnames);
3872 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3875 const char * hostnames[2] = { CS host->name, NULL };
3878 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3879 return tls_error(US"hostnames load", host, NULL, errstr);
3881 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3882 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3883 ) if (rr->type == T_TLSA && rr->size > 3)
3885 const uschar * p = rr->data;
3886 uint8_t usage, selector, mtype;
3887 const char * mdname;
3891 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3892 if (usage != 2 && usage != 3) continue;
3899 default: continue; /* Only match-types 0, 1, 2 are supported */
3900 case 0: mdname = NULL; break;
3901 case 1: mdname = "sha256"; break;
3902 case 2: mdname = "sha512"; break;
3906 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3909 return tls_error(US"tlsa load", host, NULL, errstr);
3910 case 0: /* action not taken */
3914 tls_out.tlsa_usage |= 1<<usage;
3920 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3923 #endif /*SUPPORT_DANE*/
3927 #ifndef DISABLE_TLS_RESUME
3928 /* On the client, get any stashed session for the given IP from hints db
3929 and apply it to the ssl-connection for attempted resumption. */
3932 tls_retrieve_session(tls_support * tlsp, SSL * ssl)
3934 if (tlsp->host_resumable)
3936 dbdata_tls_session * dt;
3938 open_db dbblock, * dbm_file;
3940 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3942 debug_printf("checking for resumable session for %s\n", tlsp->resume_index);
3943 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3945 if ((dt = dbfn_read_with_length(dbm_file, tlsp->resume_index, &len)))
3947 SSL_SESSION * ss = NULL;
3948 const uschar * sess_asn1 = dt->session;
3950 len -= sizeof(dbdata_tls_session);
3951 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3955 ERR_error_string_n(ERR_get_error(),
3956 ssl_errstring, sizeof(ssl_errstring));
3957 debug_printf("decoding session: %s\n", ssl_errstring);
3962 unsigned long lifetime =
3963 #ifdef EXIM_HAVE_SESSION_TICKET
3964 SSL_SESSION_get_ticket_lifetime_hint(ss);
3965 #else /* Use, fairly arbitrilarily, what we as server would */
3966 f.running_in_test_harness ? TESTSUITE_TICKET_LIFE : ssl_session_timeout;
3968 time_t now = time(NULL), expires = lifetime + dt->time_stamp;
3971 DEBUG(D_tls) debug_printf("session expired (by " TIME_T_FMT "s from %lus)\n", now - expires, lifetime);
3972 dbfn_delete(dbm_file, tlsp->resume_index);
3974 else if (SSL_set_session(ssl, ss))
3976 DEBUG(D_tls) debug_printf("good session (" TIME_T_FMT "s left of %lus)\n", expires - now, lifetime);
3977 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3978 tlsp->verify_override = dt->verify_override;
3979 tlsp->ocsp = dt->ocsp;
3983 ERR_error_string_n(ERR_get_error(),
3984 ssl_errstring, sizeof(ssl_errstring));
3985 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3990 DEBUG(D_tls) debug_printf("no session record\n");
3991 dbfn_close(dbm_file);
3997 /* On the client, save the session for later resumption */
4000 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
4002 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
4005 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
4007 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
4009 # ifdef OPENSSL_HAVE_NUM_TICKETS
4010 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
4013 int len = i2d_SSL_SESSION(ss, NULL);
4014 int dlen = sizeof(dbdata_tls_session) + len;
4015 dbdata_tls_session * dt = store_get(dlen, GET_TAINTED);
4016 uschar * s = dt->session;
4017 open_db dbblock, * dbm_file;
4019 DEBUG(D_tls) debug_printf("session is resumable\n");
4020 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
4022 dt->verify_override = tlsp->verify_override;
4023 dt->ocsp = tlsp->ocsp;
4024 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
4026 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
4028 dbfn_write(dbm_file, tlsp->resume_index, dt, dlen);
4029 dbfn_close(dbm_file);
4030 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
4038 /* Construct a key for session DB lookup, and setup the SSL_CTX for resumption */
4041 tls_client_ctx_resume_prehandshake(
4042 exim_openssl_client_tls_ctx * exim_client_ctx, smtp_connect_args * conn_args,
4043 tls_support * tlsp, smtp_transport_options_block * ob)
4045 tlsp->host_resumable = TRUE;
4046 tls_client_resmption_key(tlsp, conn_args, ob);
4048 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
4049 SSL_SESS_CACHE_CLIENT
4050 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
4051 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
4055 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
4056 host_item * host, uschar ** errstr)
4058 if (tlsp->host_resumable)
4061 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
4062 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
4064 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
4065 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
4067 tls_error(US"set ex_data", host, NULL, errstr);
4070 /* debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state); */
4073 tlsp->resumption = RESUME_SUPPORTED;
4074 /* Pick up a previous session, saved on an old ticket */
4075 tls_retrieve_session(tlsp, ssl);
4080 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
4083 if (SSL_session_reused(exim_client_ctx->ssl))
4085 DEBUG(D_tls) debug_printf("The session was reused\n");
4086 tlsp->resumption |= RESUME_USED;
4089 #endif /* !DISABLE_TLS_RESUME */
4092 #ifdef EXIM_HAVE_ALPN
4093 /* Expand and convert an Exim list to an ALPN list. False return for fail.
4094 NULL plist return for silent no-ALPN.
4096 Overwite the passed-in list with the expanded version.
4100 tls_alpn_plist(uschar ** tls_alpn, const uschar ** plist, unsigned * plen,
4105 if (!expand_check(*tls_alpn, US"tls_alpn", &exp_alpn, errstr))
4107 *tls_alpn = exp_alpn;
4111 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
4116 /* The server implementation only accepts exactly one protocol name
4117 but it's little extra code complexity in the client. */
4119 const uschar * list = exp_alpn;
4120 uschar * p = store_get(Ustrlen(exp_alpn), exp_alpn), * s, * t;
4124 for (t = p; s = string_nextinlist(&list, &sep, NULL, 0); t += len)
4126 *t++ = len = (uschar) Ustrlen(s);
4129 *plist = (*plen = t - p) ? p : NULL;
4133 #endif /* EXIM_HAVE_ALPN */
4136 /*************************************************
4137 * Start a TLS session in a client *
4138 *************************************************/
4140 /* Called from the smtp transport after STARTTLS has been accepted.
4143 cctx connection context
4144 conn_args connection details
4145 cookie datum for randomness; can be NULL
4146 tlsp record details of TLS channel configuration here; must be non-NULL
4147 errstr error string pointer
4149 Returns: TRUE for success with TLS session context set in connection context,
4154 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
4155 void * cookie, tls_support * tlsp, uschar ** errstr)
4157 host_item * host = conn_args->host; /* for msgs and option-tests */
4158 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
4159 smtp_transport_options_block * ob = tb
4160 ? (smtp_transport_options_block *)tb->options_block
4161 : &smtp_transport_option_defaults;
4162 exim_openssl_client_tls_ctx * exim_client_ctx;
4163 uschar * expciphers;
4165 static uschar peerdn[256];
4167 #ifndef DISABLE_OCSP
4168 BOOL request_ocsp = FALSE;
4169 BOOL require_ocsp = FALSE;
4173 store_pool = POOL_PERM;
4174 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), GET_UNTAINTED);
4175 exim_client_ctx->corked = NULL;
4179 tlsp->tlsa_usage = 0;
4182 #ifndef DISABLE_OCSP
4184 # ifdef SUPPORT_DANE
4185 if ( conn_args->dane
4186 && ob->hosts_request_ocsp[0] == '*'
4187 && ob->hosts_request_ocsp[1] == '\0'
4190 /* Unchanged from default. Use a safer one under DANE */
4191 request_ocsp = TRUE;
4192 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
4193 " {= {4}{$tls_out_tlsa_usage}} } "
4199 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
4200 request_ocsp = TRUE;
4202 # ifdef SUPPORT_DANE
4206 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4208 # if defined(SUPPORT_DANE) && !defined(EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER)
4209 if (conn_args->dane && (require_ocsp || request_ocsp))
4211 DEBUG(D_tls) debug_printf("OpenSSL version to early to combine OCSP"
4212 " and DANE; disabling OCSP\n");
4213 require_ocsp = request_ocsp = FALSE;
4219 rc = tls_init(host, ob,
4220 #ifndef DISABLE_OCSP
4221 (void *)(long)request_ocsp,
4223 cookie, &client_static_state, tlsp, errstr);
4224 if (rc != OK) return FALSE;
4226 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
4228 tlsp->certificate_verified = FALSE;
4229 client_verify_callback_called = FALSE;
4233 if (conn_args->dane)
4235 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
4236 other failures should be treated as problems. */
4237 if (ob->dane_require_tls_ciphers &&
4238 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
4239 &expciphers, errstr))
4241 if (expciphers && *expciphers == '\0')
4244 normalise_ciphers(&expciphers, ob->dane_require_tls_ciphers);
4249 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
4250 &expciphers, errstr))
4253 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
4254 are separated by underscores. So that I can use either form in my tests, and
4255 also for general convenience, we turn underscores into hyphens here. */
4257 normalise_ciphers(&expciphers, ob->tls_require_ciphers);
4262 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
4263 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
4265 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
4271 if (conn_args->dane)
4273 SSL_CTX_set_verify(exim_client_ctx->ctx,
4274 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
4275 verify_callback_client_dane);
4277 if (!DANESSL_library_init())
4279 tls_error(US"library init", host, NULL, errstr);
4282 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
4284 tls_error(US"context init", host, NULL, errstr);
4287 DEBUG(D_tls) debug_printf("since dane-mode conn, not loading the usual CA bundle\n");
4293 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
4294 client_static_state, errstr) != OK)
4299 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
4302 { DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n"); }
4303 else if (!Ustrlen(tlsp->sni))
4307 #ifndef EXIM_HAVE_OPENSSL_TLSEXT
4308 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
4316 #ifdef EXIM_HAVE_ALPN
4318 const uschar * plist;
4321 if (!tls_alpn_plist(&ob->tls_alpn, &plist, &plen, errstr))
4324 if (SSL_CTX_set_alpn_protos(exim_client_ctx->ctx, plist, plen) != 0)
4326 tls_error(US"alpn init", host, NULL, errstr);
4330 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
4333 log_write(0, LOG_MAIN, "ALPN unusable with this OpenSSL library version; ignoring \"%s\"\n",
4337 #ifndef DISABLE_TLS_RESUME
4338 /*XXX have_lbserver: another cmdline arg possibly, for continued-conn, but use
4339 will be very low. */
4341 if (!conn_args->have_lbserver) /* wanted for tls_client_resmption_key() */
4342 { DEBUG(D_tls) debug_printf("resumption not supported on continued-connection\n"); }
4343 else if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
4344 tls_client_ctx_resume_prehandshake(exim_client_ctx, conn_args, tlsp, ob);
4348 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
4350 tls_error(US"SSL_new", host, NULL, errstr);
4353 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
4354 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
4355 SSL_set_connect_state(exim_client_ctx->ssl);
4357 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
4360 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
4361 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
4366 if (conn_args->dane)
4367 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
4371 #ifndef DISABLE_OCSP
4372 /* Request certificate status at connection-time. If the server
4373 does OCSP stapling we will get the callback (set in tls_init()) */
4374 # ifdef SUPPORT_DANE
4378 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4379 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4381 { /* Re-eval now $tls_out_tlsa_usage is populated. If
4382 this means we avoid the OCSP request, we wasted the setup
4383 cost in tls_init(). */
4384 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
4385 request_ocsp = require_ocsp
4386 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4393 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
4394 client_static_state->u_ocsp.client.verify_required = require_ocsp;
4395 tlsp->ocsp = OCSP_NOT_RESP;
4399 #ifndef DISABLE_TLS_RESUME
4400 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
4405 #ifndef DISABLE_EVENT
4406 client_static_state->event_action = tb ? tb->event_action : NULL;
4409 /* There doesn't seem to be a built-in timeout on connection. */
4411 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
4412 sigalrm_seen = FALSE;
4413 ALARM(ob->command_timeout);
4414 rc = SSL_connect(exim_client_ctx->ssl);
4418 if (conn_args->dane)
4419 DANESSL_cleanup(exim_client_ctx->ssl);
4424 #ifndef DISABLE_OCSP
4425 if (client_static_state->u_ocsp.client.verify_errstr)
4426 { if (errstr) *errstr = client_static_state->u_ocsp.client.verify_errstr; }
4429 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
4435 debug_printf("SSL_connect succeeded\n");
4436 tls_dump_keylog(exim_client_ctx->ssl);
4439 #ifndef DISABLE_TLS_RESUME
4440 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
4443 #ifdef EXIM_HAVE_ALPN
4444 if (ob->tls_alpn) /* We requested. See what was negotiated. */
4446 const uschar * name;
4449 SSL_get0_alpn_selected(exim_client_ctx->ssl, &name, &len);
4451 { DEBUG(D_tls) debug_printf("ALPN negotiated %u: '%.*s'\n", len, (int)*name, name+1); }
4452 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
4454 /* Would like to send a relevant fatal Alert, but OpenSSL has no API */
4455 tls_error(US"handshake", host, US"ALPN required but not negotiated", errstr);
4461 #ifdef SSL_get_extms_support
4462 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
4464 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
4466 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
4467 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
4468 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
4470 /* Record the certificate we presented */
4472 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
4473 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
4476 /*XXX will this work with continued-TLS? */
4477 tls_get_channel_binding(exim_client_ctx->ssl, tlsp, GET_TAINTED);
4479 tlsp->active.sock = cctx->sock;
4480 tlsp->active.tls_ctx = exim_client_ctx;
4481 cctx->tls_ctx = exim_client_ctx;
4490 tls_refill(unsigned lim)
4492 SSL * ssl = state_server.lib_state.lib_ssl;
4496 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4497 ssl_xfer_buffer, ssl_xfer_buffer_size);
4500 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4501 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
4502 MIN(ssl_xfer_buffer_size, lim));
4503 error = SSL_get_error(ssl, inbytes);
4504 if (smtp_receive_timeout > 0) ALARM_CLR(0);
4506 if (had_command_timeout) /* set by signal handler */
4507 smtp_command_timeout_exit(); /* does not return */
4508 if (had_command_sigterm)
4509 smtp_command_sigterm_exit();
4510 if (had_data_timeout)
4511 smtp_data_timeout_exit();
4512 if (had_data_sigint)
4513 smtp_data_sigint_exit();
4515 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
4516 closed down, not that the socket itself has been closed down. Revert to
4517 non-SSL handling. */
4521 case SSL_ERROR_NONE:
4524 case SSL_ERROR_ZERO_RETURN:
4525 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4527 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
4530 tls_close(NULL, TLS_NO_SHUTDOWN);
4533 /* Handle genuine errors */
4535 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4536 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
4537 ssl_xfer_error = TRUE;
4541 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
4542 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
4543 debug_printf(" - syscall %s\n", strerror(errno));
4544 ssl_xfer_error = TRUE;
4548 #ifndef DISABLE_DKIM
4549 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
4551 ssl_xfer_buffer_hwm = inbytes;
4552 ssl_xfer_buffer_lwm = 0;
4557 /*************************************************
4558 * TLS version of getc *
4559 *************************************************/
4561 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
4562 it refills the buffer via the SSL reading function.
4564 Arguments: lim Maximum amount to read/buffer
4565 Returns: the next character or EOF
4567 Only used by the server-side TLS.
4571 tls_getc(unsigned lim)
4573 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4574 if (!tls_refill(lim))
4575 return ssl_xfer_error ? EOF : smtp_getc(lim);
4577 /* Something in the buffer; return next uschar */
4579 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
4585 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm;
4589 tls_getbuf(unsigned * len)
4594 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4595 if (!tls_refill(*len))
4597 if (!ssl_xfer_error) return smtp_getbuf(len);
4602 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4604 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4605 ssl_xfer_buffer_lwm += size;
4612 tls_get_cache(unsigned lim)
4614 #ifndef DISABLE_DKIM
4615 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4619 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4625 tls_could_getc(void)
4627 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4628 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4632 /*************************************************
4633 * Read bytes from TLS channel *
4634 *************************************************/
4638 ct_ctx client context pointer, or NULL for the one global server context
4642 Returns: the number of bytes read
4643 -1 after a failed read, including EOF
4645 Only used by the client-side TLS.
4649 tls_read(void * ct_ctx, uschar *buff, size_t len)
4651 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4652 : state_server.lib_state.lib_ssl;
4656 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4657 buff, (unsigned int)len);
4660 inbytes = SSL_read(ssl, CS buff, len);
4661 error = SSL_get_error(ssl, inbytes);
4663 if (error == SSL_ERROR_ZERO_RETURN)
4665 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4668 else if (error != SSL_ERROR_NONE)
4678 /*************************************************
4679 * Write bytes down TLS channel *
4680 *************************************************/
4684 ct_ctx client context pointer, or NULL for the one global server context
4687 more further data expected soon
4689 Returns: the number of bytes after a successful write,
4690 -1 after a failed write
4692 Used by both server-side and client-side TLS. Calling with len zero and more unset
4693 will flush buffered writes; buff can be null for this case.
4697 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4700 int outbytes, error;
4702 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4703 : state_server.lib_state.lib_ssl;
4704 static gstring * server_corked = NULL;
4705 gstring ** corkedp = ct_ctx
4706 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4707 gstring * corked = *corkedp;
4709 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4710 buff, (unsigned long)len, more ? ", more" : "");
4712 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4713 "more" is notified. This hack is only ok if small amounts are involved AND only
4714 one stream does it, in one context (i.e. no store reset). Currently it is used
4715 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4716 We support callouts done by the server process by using a separate client
4717 context for the stashed information. */
4718 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4719 a store reset there, so use POOL_PERM. */
4720 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4724 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4726 int save_pool = store_pool;
4727 store_pool = POOL_PERM;
4729 corked = string_catn(corked, buff, len);
4731 store_pool = save_pool;
4738 buff = CUS corked->s;
4743 for (int left = len; left > 0;)
4745 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4747 outbytes = SSL_write(ssl, CS buff, left);
4748 error = SSL_get_error(ssl, outbytes);
4749 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4752 case SSL_ERROR_NONE: /* the usual case */
4758 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4759 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4762 case SSL_ERROR_ZERO_RETURN:
4763 log_write(0, LOG_MAIN, "SSL channel closed on write");
4766 case SSL_ERROR_SYSCALL:
4767 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4768 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4769 sender_fullhost ? sender_fullhost : US"<unknown>",
4771 else if (LOGGING(protocol_detail))
4772 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4773 " SMTP response and TLS close\n", sender_host_address);
4775 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4776 " client reset TCP before TLS close\n", sender_host_address);
4780 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4791 ct_ctx client TLS context pointer, or NULL for the one global server context
4795 tls_shutdown_wr(void * ct_ctx)
4797 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4798 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4799 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4802 if (*fdp < 0) return; /* TLS was not active */
4804 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4806 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
4807 rc = SSL_shutdown(*sslp);
4808 if (rc < 0) DEBUG(D_tls)
4810 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4811 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4815 /*************************************************
4816 * Close down a TLS session *
4817 *************************************************/
4819 /* This is also called from within a delivery subprocess forked from the
4820 daemon, to shut down the TLS library, without actually doing a shutdown (which
4821 would tamper with the SSL session in the parent process).
4824 ct_ctx client TLS context pointer, or NULL for the one global server context
4825 do_shutdown 0 no data-flush or TLS close-alert
4826 1 if TLS close-alert is to be sent,
4827 2 if also response to be waited for
4831 Used by both server-side and client-side TLS.
4835 tls_close(void * ct_ctx, int do_shutdown)
4837 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4838 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4839 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4841 if (*fdp < 0) return; /* TLS was not active */
4843 if (do_shutdown > TLS_NO_SHUTDOWN)
4846 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4847 do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
4849 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4851 if ( ( do_shutdown >= TLS_SHUTDOWN_WONLY
4852 || (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4854 && do_shutdown > TLS_SHUTDOWN_NOWAIT
4857 #ifdef EXIM_TCP_CORK
4858 (void) setsockopt(*fdp, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
4861 rc = SSL_shutdown(*sslp); /* wait for response */
4865 if (rc < 0) DEBUG(D_tls)
4867 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4868 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4872 if (!o_ctx) /* server side */
4874 #ifndef DISABLE_OCSP
4875 sk_X509_pop_free(state_server.u_ocsp.server.verify_stack, X509_free);
4876 state_server.u_ocsp.server.verify_stack = NULL;
4879 receive_getc = smtp_getc;
4880 receive_getbuf = smtp_getbuf;
4881 receive_get_cache = smtp_get_cache;
4882 receive_hasc = smtp_hasc;
4883 receive_ungetc = smtp_ungetc;
4884 receive_feof = smtp_feof;
4885 receive_ferror = smtp_ferror;
4886 tls_in.active.tls_ctx = NULL;
4888 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4899 /*************************************************
4900 * Let tls_require_ciphers be checked at startup *
4901 *************************************************/
4903 /* The tls_require_ciphers option, if set, must be something which the
4906 Returns: NULL on success, or error message
4910 tls_validate_require_cipher(void)
4913 uschar * expciphers, * err;
4917 if (!(tls_require_ciphers && *tls_require_ciphers))
4920 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4922 return US"failed to expand tls_require_ciphers";
4924 if (!(expciphers && *expciphers))
4927 normalise_ciphers(&expciphers, tls_require_ciphers);
4930 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4933 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4935 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4937 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4938 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4939 expciphers, ssl_errstring);
4950 /*************************************************
4951 * Report the library versions. *
4952 *************************************************/
4954 /* There have historically been some issues with binary compatibility in
4955 OpenSSL libraries; if Exim (like many other applications) is built against
4956 one version of OpenSSL but the run-time linker picks up another version,
4957 it can result in serious failures, including crashing with a SIGSEGV. So
4958 report the version found by the compiler and the run-time version.
4960 Note: some OS vendors backport security fixes without changing the version
4961 number/string, and the version date remains unchanged. The _build_ date
4962 will change, so we can more usefully assist with version diagnosis by also
4963 reporting the build date.
4965 Arguments: string to append to
4970 tls_version_report(gstring * g)
4972 return string_fmt_append(g,
4973 "Library version: OpenSSL: Compile: %s\n"
4976 OPENSSL_VERSION_TEXT,
4977 SSLeay_version(SSLEAY_VERSION),
4978 SSLeay_version(SSLEAY_BUILT_ON));
4979 /* third line is 38 characters for the %s and the line is 73 chars long;
4980 the OpenSSL output includes a "built on: " prefix already. */
4986 /*************************************************
4987 * Random number generation *
4988 *************************************************/
4990 /* Pseudo-random number generation. The result is not expected to be
4991 cryptographically strong but not so weak that someone will shoot themselves
4992 in the foot using it as a nonce in input in some email header scheme or
4993 whatever weirdness they'll twist this into. The result should handle fork()
4994 and avoid repeating sequences. OpenSSL handles that for us.
4998 Returns a random number in range [0, max-1]
5002 vaguely_random_number(int max)
5006 static pid_t pidlast = 0;
5008 uschar smallbuf[sizeof(r)];
5014 if (pidnow != pidlast)
5016 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
5017 is unique for each thread", this doesn't apparently apply across processes,
5018 so our own warning from vaguely_random_number_fallback() applies here too.
5019 Fix per PostgreSQL. */
5025 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
5029 gettimeofday(&r.tv, NULL);
5032 RAND_seed(US (&r), sizeof(r));
5034 /* We're after pseudo-random, not random; if we still don't have enough data
5035 in the internal PRNG then our options are limited. We could sleep and hope
5036 for entropy to come along (prayer technique) but if the system is so depleted
5037 in the first place then something is likely to just keep taking it. Instead,
5038 we'll just take whatever little bit of pseudo-random we can still manage to
5041 needed_len = sizeof(r);
5042 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
5043 asked for a number less than 10. */
5044 for (r = max, i = 0; r; ++i)
5050 #ifdef EXIM_HAVE_RAND_PSEUDO
5051 /* We do not care if crypto-strong */
5052 i = RAND_pseudo_bytes(smallbuf, needed_len);
5054 i = RAND_bytes(smallbuf, needed_len);
5060 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
5061 return vaguely_random_number_fallback(max);
5065 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
5068 /* We don't particularly care about weighted results; if someone wants
5069 smooth distribution and cares enough then they should submit a patch then. */
5076 /*************************************************
5077 * OpenSSL option parse *
5078 *************************************************/
5080 /* Parse one option for tls_openssl_options_parse below
5083 name one option name
5084 value place to store a value for it
5085 Returns success or failure in parsing
5091 tls_openssl_one_option_parse(uschar *name, long *value)
5094 int last = exim_openssl_options_size;
5095 while (last > first)
5097 int middle = (first + last)/2;
5098 int c = Ustrcmp(name, exim_openssl_options[middle].name);
5101 *value = exim_openssl_options[middle].value;
5115 /*************************************************
5116 * OpenSSL option parsing logic *
5117 *************************************************/
5119 /* OpenSSL has a number of compatibility options which an administrator might
5120 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
5121 we look like log_selector.
5124 option_spec the administrator-supplied string of options
5125 results ptr to long storage for the options bitmap
5126 Returns success or failure
5130 tls_openssl_options_parse(uschar *option_spec, long *results)
5133 uschar * exp, * end;
5134 BOOL adding, item_parsed;
5136 /* Server: send no (<= TLS1.2) session tickets */
5137 result = SSL_OP_NO_TICKET;
5139 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
5140 from default because it increases BEAST susceptibility. */
5141 #ifdef SSL_OP_NO_SSLv2
5142 result |= SSL_OP_NO_SSLv2;
5144 #ifdef SSL_OP_NO_SSLv3
5145 result |= SSL_OP_NO_SSLv3;
5147 #ifdef SSL_OP_SINGLE_DH_USE
5148 result |= SSL_OP_SINGLE_DH_USE;
5150 #ifdef SSL_OP_NO_RENEGOTIATION
5151 result |= SSL_OP_NO_RENEGOTIATION;
5160 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
5163 for (uschar * s = exp; *s; /**/)
5165 while (isspace(*s)) ++s;
5168 if (*s != '+' && *s != '-')
5170 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
5171 "+ or - expected but found \"%s\"\n", s);
5174 adding = *s++ == '+';
5175 for (end = s; *end && !isspace(*end); ) end++;
5176 item_parsed = tls_openssl_one_option_parse(string_copyn(s, end-s), &item);
5179 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
5182 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
5183 adding ? "adding to " : "removing from", result, item, s);
5195 #endif /*!MACRO_PREDEF*/
5198 /* End of tls-openssl.c */