1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2019 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Portions Copyright (c) The OpenSSL Project 1999 */
11 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
12 library. It is #included into the tls.c file when that library is used. The
13 code herein is based on a patch that was originally contributed by Steve
14 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
16 No cryptographic code is included in Exim. All this module does is to call
17 functions from the OpenSSL library. */
22 #include <openssl/lhash.h>
23 #include <openssl/ssl.h>
24 #include <openssl/err.h>
25 #include <openssl/rand.h>
26 #ifndef OPENSSL_NO_ECDH
27 # include <openssl/ec.h>
30 # include <openssl/ocsp.h>
38 # define EXIM_OCSP_SKEW_SECONDS (300L)
39 # define EXIM_OCSP_MAX_AGE (-1L)
42 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
43 # define EXIM_HAVE_OPENSSL_TLSEXT
45 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
46 # define EXIM_HAVE_RSA_GENKEY_EX
48 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
49 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define OPENSSL_AUTO_SHA256
51 # define EXIM_HAVE_ALPN
53 # define EXIM_HAVE_EPHEM_RSA_KEX
54 # define EXIM_HAVE_RAND_PSEUDO
56 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
57 # define EXIM_HAVE_SHA256
60 /* X509_check_host provides sane certificate hostname checking, but was added
61 to OpenSSL late, after other projects forked off the code-base. So in
62 addition to guarding against the base version number, beware that LibreSSL
63 does not (at this time) support this function.
65 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
66 opt to disentangle and ask a LibreSSL user to provide glue for a third
67 crypto provider for libtls instead of continuing to tie the OpenSSL glue
68 into even twistier knots. If LibreSSL gains the same API, we can just
69 change this guard and punt the issue for a while longer. */
71 #ifndef LIBRESSL_VERSION_NUMBER
72 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
73 # define EXIM_HAVE_OPENSSL_CHECKHOST
74 # define EXIM_HAVE_OPENSSL_DH_BITS
75 # define EXIM_HAVE_OPENSSL_TLS_METHOD
76 # define EXIM_HAVE_OPENSSL_KEYLOG
77 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
78 # define EXIM_HAVE_SESSION_TICKET
79 # define EXIM_HAVE_OPESSL_TRACE
80 # define EXIM_HAVE_OPESSL_GET0_SERIAL
82 # define EXIM_HAVE_OCSP
85 # define EXIM_NEED_OPENSSL_INIT
87 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
88 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
89 # define EXIM_HAVE_OPENSSL_CHECKHOST
93 #if !defined(LIBRESSL_VERSION_NUMBER) \
94 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
95 # if !defined(OPENSSL_NO_ECDH)
96 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
97 # define EXIM_HAVE_ECDH
99 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
100 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
105 #ifndef LIBRESSL_VERSION_NUMBER
106 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
107 # define OPENSSL_HAVE_KEYLOG_CB
108 # define OPENSSL_HAVE_NUM_TICKETS
109 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
111 # define OPENSSL_BAD_SRVR_OURCERT
115 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
116 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
117 # define DISABLE_OCSP
120 #ifndef DISABLE_TLS_RESUME
121 # if OPENSSL_VERSION_NUMBER < 0x0101010L
122 # error OpenSSL version too old for session-resumption
126 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
127 # include <openssl/x509v3.h>
130 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
131 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
132 # define SSL_CIPHER_get_id(c) (c->id)
134 # ifndef MACRO_PREDEF
135 # include "tls-cipher-stdname.c"
139 /*************************************************
140 * OpenSSL option parse *
141 *************************************************/
143 typedef struct exim_openssl_option {
146 } exim_openssl_option;
147 /* We could use a macro to expand, but we need the ifdef and not all the
148 options document which version they were introduced in. Policylet: include
149 all options unless explicitly for DTLS, let the administrator choose which
152 This list is current as of:
155 XXX could we autobuild this list, as with predefined-macros?
156 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
157 Also allow a numeric literal?
159 static exim_openssl_option exim_openssl_options[] = {
160 /* KEEP SORTED ALPHABETICALLY! */
162 { US"all", (long) SSL_OP_ALL },
164 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
165 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
167 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
168 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
170 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
171 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
173 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
174 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
176 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
177 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
179 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
180 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
182 #ifdef SSL_OP_EPHEMERAL_RSA
183 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
185 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
186 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
188 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
189 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
191 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
192 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
194 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
195 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
197 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
198 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
200 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
201 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
203 #ifdef SSL_OP_NO_ANTI_REPLAY
204 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
206 #ifdef SSL_OP_NO_COMPRESSION
207 { US"no_compression", SSL_OP_NO_COMPRESSION },
209 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
210 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
212 #ifdef SSL_OP_NO_RENEGOTIATION
213 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
215 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
216 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
218 #ifdef SSL_OP_NO_SSLv2
219 { US"no_sslv2", SSL_OP_NO_SSLv2 },
221 #ifdef SSL_OP_NO_SSLv3
222 { US"no_sslv3", SSL_OP_NO_SSLv3 },
224 #ifdef SSL_OP_NO_TICKET
225 { US"no_ticket", SSL_OP_NO_TICKET },
227 #ifdef SSL_OP_NO_TLSv1
228 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
230 #ifdef SSL_OP_NO_TLSv1_1
231 # if SSL_OP_NO_TLSv1_1 == 0x00000400L
232 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
233 # warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
235 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
238 #ifdef SSL_OP_NO_TLSv1_2
239 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
241 #ifdef SSL_OP_NO_TLSv1_3
242 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
244 #ifdef SSL_OP_PRIORITIZE_CHACHA
245 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
247 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
248 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
250 #ifdef SSL_OP_SINGLE_DH_USE
251 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
253 #ifdef SSL_OP_SINGLE_ECDH_USE
254 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
256 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
257 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
259 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
260 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
262 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
263 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
265 #ifdef SSL_OP_TLS_D5_BUG
266 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
268 #ifdef SSL_OP_TLS_ROLLBACK_BUG
269 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
271 #ifdef SSL_OP_TLSEXT_PADDING
272 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
277 static int exim_openssl_options_size = nelem(exim_openssl_options);
278 static long init_options = 0;
287 for (struct exim_openssl_option * o = exim_openssl_options;
288 o < exim_openssl_options + nelem(exim_openssl_options); o++)
290 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
291 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
293 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
294 builtin_macro_create(buf);
297 # ifndef DISABLE_TLS_RESUME
298 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
300 # ifdef SSL_OP_NO_TLSv1_3
301 builtin_macro_create(US"_HAVE_TLS1_3");
303 # ifdef OPENSSL_BAD_SRVR_OURCERT
304 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
306 # ifdef EXIM_HAVE_OCSP
307 builtin_macro_create(US"_HAVE_TLS_OCSP");
308 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
313 /******************************************************************************/
315 /* Structure for collecting random data for seeding. */
317 typedef struct randstuff {
322 /* Local static variables */
324 static BOOL client_verify_callback_called = FALSE;
325 static BOOL server_verify_callback_called = FALSE;
326 static const uschar *sid_ctx = US"exim";
328 /* We have three different contexts to care about.
330 Simple case: client, `client_ctx`
331 As a client, we can be doing a callout or cut-through delivery while receiving
332 a message. So we have a client context, which should have options initialised
333 from the SMTP Transport. We may also concurrently want to make TLS connections
334 to utility daemons, so client-contexts are allocated and passed around in call
335 args rather than using a gobal.
338 There are two cases: with and without ServerNameIndication from the client.
339 Given TLS SNI, we can be using different keys, certs and various other
340 configuration settings, because they're re-expanded with $tls_sni set. This
341 allows vhosting with TLS. This SNI is sent in the handshake.
342 A client might not send SNI, so we need a fallback, and an initial setup too.
343 So as a server, we start out using `server_ctx`.
344 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
345 `server_sni` from `server_ctx` and then initialise settings by re-expanding
353 } exim_openssl_client_tls_ctx;
356 /* static SSL_CTX *server_ctx = NULL; */
357 /* static SSL *server_ssl = NULL; */
359 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
360 static SSL_CTX *server_sni = NULL;
362 #ifdef EXIM_HAVE_ALPN
363 static BOOL server_seen_alpn = FALSE;
366 static char ssl_errstring[256];
368 static int ssl_session_timeout = 7200; /* Two hours */
369 static BOOL client_verify_optional = FALSE;
370 static BOOL server_verify_optional = FALSE;
372 static BOOL reexpand_tls_files_for_sni = FALSE;
375 typedef struct ocsp_resp {
376 struct ocsp_resp * next;
377 OCSP_RESPONSE * resp;
380 typedef struct exim_openssl_state {
381 exim_tlslib_state lib_state;
382 #define lib_ctx libdata0
383 #define lib_ssl libdata1
386 uschar * certificate;
390 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
394 const uschar *file_expanded;
395 ocsp_resplist *olist;
398 X509_STORE *verify_store; /* non-null if status requested */
399 BOOL verify_required;
404 /* these are cached from first expand */
405 uschar * server_cipher_list;
406 /* only passed down to tls_error: */
408 const uschar * verify_cert_hostnames;
409 #ifndef DISABLE_EVENT
410 uschar * event_action;
412 } exim_openssl_state_st;
414 /* should figure out a cleanup of API to handle state preserved per
415 implementation, for various reasons, which can be void * in the APIs.
416 For now, we hack around it. */
417 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
418 exim_openssl_state_st state_server = {.is_server = TRUE};
421 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
426 static int tls_server_stapling_cb(SSL *s, void *arg);
431 /* Daemon-called, before every connection, key create/rotate */
432 #ifndef DISABLE_TLS_RESUME
433 static void tk_init(void);
434 static int tls_exdata_idx = -1;
438 tls_per_lib_daemon_tick(void)
440 #ifndef DISABLE_TLS_RESUME
445 /* Called once at daemon startup */
448 tls_per_lib_daemon_init(void)
450 tls_daemon_creds_reload();
454 /*************************************************
456 *************************************************/
458 /* Called from lots of places when errors occur before actually starting to do
459 the TLS handshake, that is, while the session is still in clear. Always returns
460 DEFER for a server and FAIL for a client so that most calls can use "return
461 tls_error(...)" to do this processing and then give an appropriate return. A
462 single function is used for both server and client, because it is called from
463 some shared functions.
466 prefix text to include in the logged error
467 host NULL if setting up a server;
468 the connected host if setting up a client
469 msg error message or NULL if we should ask OpenSSL
470 errstr pointer to output error message
472 Returns: OK/DEFER/FAIL
476 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
480 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
481 msg = US ssl_errstring;
484 msg = string_sprintf("(%s): %s", prefix, msg);
485 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
486 if (errstr) *errstr = msg;
487 return host ? FAIL : DEFER;
492 /**************************************************
493 * General library initalisation *
494 **************************************************/
497 lib_rand_init(void * addr)
500 if (!RAND_status()) return TRUE;
502 gettimeofday(&r.tv, NULL);
504 RAND_seed(US (&r), sizeof(r));
505 RAND_seed(US big_buffer, big_buffer_size);
506 if (addr) RAND_seed(US addr, sizeof(addr));
508 return RAND_status();
513 tls_openssl_init(void)
515 static BOOL once = FALSE;
519 #ifdef EXIM_NEED_OPENSSL_INIT
520 SSL_load_error_strings(); /* basic set up */
521 OpenSSL_add_ssl_algorithms();
524 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
525 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
526 list of available digests. */
527 EVP_add_digest(EVP_sha256());
530 (void) lib_rand_init(NULL);
531 (void) tls_openssl_options_parse(openssl_options, &init_options);
536 /*************************************************
537 * Initialize for DH *
538 *************************************************/
540 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
543 sctx The current SSL CTX (inbound or outbound)
544 dhparam DH parameter file or fixed parameter identity string
545 host connected host, if client; NULL if server
546 errstr error string pointer
548 Returns: TRUE if OK (nothing to set up, or setup worked)
552 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host, uschar ** errstr)
560 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
563 if (!dhexpanded || !*dhexpanded)
564 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
565 else if (dhexpanded[0] == '/')
567 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
569 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
570 host, US strerror(errno), errstr);
576 if (Ustrcmp(dhexpanded, "none") == 0)
578 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
582 if (!(pem = std_dh_prime_named(dhexpanded)))
584 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
585 host, US strerror(errno), errstr);
588 bio = BIO_new_mem_buf(CS pem, -1);
591 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
594 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
599 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
600 * an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with
601 * 2236. But older OpenSSL can only report in bytes (octets), not bits.
602 * If someone wants to dance at the edge, then they can raise the limit or use
603 * current libraries. */
604 #ifdef EXIM_HAVE_OPENSSL_DH_BITS
605 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
606 * This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
607 dh_bitsize = DH_bits(dh);
609 dh_bitsize = 8 * DH_size(dh);
612 /* Even if it is larger, we silently return success rather than cause things
613 * to fail out, so that a too-large DH will not knock out all TLS; it's a
614 * debatable choice. */
615 if (dh_bitsize > tls_dh_max_bits)
618 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d\n",
619 dh_bitsize, tls_dh_max_bits);
623 SSL_CTX_set_tmp_dh(sctx, dh);
625 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
626 dhexpanded ? dhexpanded : US"default", dh_bitsize);
638 /*************************************************
639 * Initialize for ECDH *
640 *************************************************/
642 /* Load parameters for ECDH encryption.
644 For now, we stick to NIST P-256 because: it's simple and easy to configure;
645 it avoids any patent issues that might bite redistributors; despite events in
646 the news and concerns over curve choices, we're not cryptographers, we're not
647 pretending to be, and this is "good enough" to be better than no support,
648 protecting against most adversaries. Given another year or two, there might
649 be sufficient clarity about a "right" way forward to let us make an informed
650 decision, instead of a knee-jerk reaction.
652 Longer-term, we should look at supporting both various named curves and
653 external files generated with "openssl ecparam", much as we do for init_dh().
654 We should also support "none" as a value, to explicitly avoid initialisation.
659 sctx The current SSL CTX (inbound or outbound)
660 host connected host, if client; NULL if server
661 errstr error string pointer
663 Returns: TRUE if OK (nothing to set up, or setup worked)
667 init_ecdh(SSL_CTX * sctx, host_item * host, uschar ** errstr)
669 #ifdef OPENSSL_NO_ECDH
678 if (host) /* No ECDH setup for clients, only for servers */
681 # ifndef EXIM_HAVE_ECDH
683 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
687 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
689 if (!exp_curve || !*exp_curve)
692 /* "auto" needs to be handled carefully.
693 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
694 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
695 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
696 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
697 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
699 if (Ustrcmp(exp_curve, "auto") == 0)
701 #if OPENSSL_VERSION_NUMBER < 0x10002000L
702 DEBUG(D_tls) debug_printf(
703 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
704 exp_curve = US"prime256v1";
706 # if defined SSL_CTRL_SET_ECDH_AUTO
707 DEBUG(D_tls) debug_printf(
708 "ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n");
709 SSL_CTX_set_ecdh_auto(sctx, 1);
712 DEBUG(D_tls) debug_printf(
713 "ECDH OpenSSL 1.1.0+: temp key parameter settings: default selection\n");
719 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
720 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
721 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
722 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
726 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
731 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
733 tls_error(US"Unable to create ec curve", host, NULL, errstr);
737 /* The "tmp" in the name here refers to setting a temporary key
738 not to the stability of the interface. */
740 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
741 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL, errstr);
743 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
748 # endif /*EXIM_HAVE_ECDH*/
749 #endif /*OPENSSL_NO_ECDH*/
754 /*************************************************
755 * Expand key and cert file specs *
756 *************************************************/
760 s SSL connection (not used)
764 Returns: pointer to generated key
768 rsa_callback(SSL *s, int export, int keylength)
771 #ifdef EXIM_HAVE_RSA_GENKEY_EX
772 BIGNUM *bn = BN_new();
775 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
777 #ifdef EXIM_HAVE_RSA_GENKEY_EX
778 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
779 || !(rsa_key = RSA_new())
780 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
783 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
787 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
788 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
797 /* Create and install a selfsigned certificate, for use in server mode */
798 /*XXX we could arrange to call this during prelo for a null tls_certificate option.
799 The normal cache inval + relo will suffice.
800 Just need a timer for inval. */
803 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
811 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
812 where = US"allocating pkey";
813 if (!(pkey = EVP_PKEY_new()))
816 where = US"allocating cert";
817 if (!(x509 = X509_new()))
820 where = US"generating pkey";
821 if (!(rsa = rsa_callback(NULL, 0, 2048)))
824 where = US"assigning pkey";
825 if (!EVP_PKEY_assign_RSA(pkey, rsa))
828 X509_set_version(x509, 2); /* N+1 - version 3 */
829 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
830 X509_gmtime_adj(X509_get_notBefore(x509), 0);
831 X509_gmtime_adj(X509_get_notAfter(x509), (long)2 * 60 * 60); /* 2 hour */
832 X509_set_pubkey(x509, pkey);
834 name = X509_get_subject_name(x509);
835 X509_NAME_add_entry_by_txt(name, "C",
836 MBSTRING_ASC, CUS "UK", -1, -1, 0);
837 X509_NAME_add_entry_by_txt(name, "O",
838 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
839 X509_NAME_add_entry_by_txt(name, "CN",
840 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
841 X509_set_issuer_name(x509, name);
843 where = US"signing cert";
844 if (!X509_sign(x509, pkey, EVP_md5()))
847 where = US"installing selfsign cert";
848 if (!SSL_CTX_use_certificate(sctx, x509))
851 where = US"installing selfsign key";
852 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
858 (void) tls_error(where, NULL, NULL, errstr);
859 if (x509) X509_free(x509);
860 if (pkey) EVP_PKEY_free(pkey);
870 /*************************************************
871 * Information callback *
872 *************************************************/
874 /* The SSL library functions call this from time to time to indicate what they
875 are doing. We copy the string to the debugging output when TLS debugging has
887 info_callback(SSL *s, int where, int ret)
893 if (where & SSL_ST_CONNECT)
894 str = US"SSL_connect";
895 else if (where & SSL_ST_ACCEPT)
896 str = US"SSL_accept";
898 str = US"SSL info (undefined)";
900 if (where & SSL_CB_LOOP)
901 debug_printf("%s: %s\n", str, SSL_state_string_long(s));
902 else if (where & SSL_CB_ALERT)
903 debug_printf("SSL3 alert %s:%s:%s\n",
904 str = where & SSL_CB_READ ? US"read" : US"write",
905 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
906 else if (where & SSL_CB_EXIT)
909 debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
911 debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
913 else if (where & SSL_CB_HANDSHAKE_START)
914 debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
915 else if (where & SSL_CB_HANDSHAKE_DONE)
916 debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s));
920 #ifdef OPENSSL_HAVE_KEYLOG_CB
922 keylog_callback(const SSL *ssl, const char *line)
926 DEBUG(D_tls) debug_printf("%.200s\n", line);
927 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
928 if (!(fp = fopen(filename, "a"))) return;
929 fprintf(fp, "%s\n", line);
938 #ifndef DISABLE_EVENT
940 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
941 BOOL *calledp, const BOOL *optionalp, const uschar * what)
947 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
950 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
951 old_cert = tlsp->peercert;
952 tlsp->peercert = X509_dup(cert);
953 /* NB we do not bother setting peerdn */
954 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
956 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
957 "depth=%d cert=%s: %s",
958 tlsp == &tls_out ? deliver_host_address : sender_host_address,
959 what, depth, dn, yield);
963 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
964 return 1; /* reject (leaving peercert set) */
966 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
967 "(host in tls_try_verify_hosts)\n");
968 tlsp->verify_override = TRUE;
970 X509_free(tlsp->peercert);
971 tlsp->peercert = old_cert;
977 /*************************************************
978 * Callback for verification *
979 *************************************************/
981 /* The SSL library does certificate verification if set up to do so. This
982 callback has the current yes/no state is in "state". If verification succeeded,
983 we set the certificate-verified flag. If verification failed, what happens
984 depends on whether the client is required to present a verifiable certificate
987 If verification is optional, we change the state to yes, but still log the
988 verification error. For some reason (it really would help to have proper
989 documentation of OpenSSL), this callback function then gets called again, this
990 time with state = 1. We must take care not to set the private verified flag on
991 the second time through.
993 Note: this function is not called if the client fails to present a certificate
994 when asked. We get here only if a certificate has been received. Handling of
995 optional verification for this case is done when requesting SSL to verify, by
996 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
998 May be called multiple times for different issues with a certificate, even
999 for a given "depth" in the certificate chain.
1002 preverify_ok current yes/no state as 1/0
1003 x509ctx certificate information.
1004 tlsp per-direction (client vs. server) support data
1005 calledp has-been-called flag
1006 optionalp verification-is-optional flag
1008 Returns: 0 if verification should fail, otherwise 1
1012 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1013 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1015 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1016 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1019 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1021 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1022 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1023 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1026 dn[sizeof(dn)-1] = '\0';
1028 tlsp->verify_override = FALSE;
1029 if (preverify_ok == 0)
1031 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1032 *verify_mode, sender_host_address)
1034 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1035 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1037 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1041 if (!tlsp->peercert)
1042 tlsp->peercert = X509_dup(cert); /* record failing cert */
1043 return 0; /* reject */
1045 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1046 "tls_try_verify_hosts)\n");
1047 tlsp->verify_override = TRUE;
1050 else if (depth != 0)
1052 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1053 #ifndef DISABLE_OCSP
1054 if (tlsp == &tls_out && client_static_state->u_ocsp.client.verify_store)
1055 { /* client, wanting stapling */
1056 /* Add the server cert's signing chain as the one
1057 for the verification of the OCSP stapled information. */
1059 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1062 sk_X509_push(client_static_state->verify_stack, cert);
1065 #ifndef DISABLE_EVENT
1066 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1067 return 0; /* reject, with peercert set */
1072 const uschar * verify_cert_hostnames;
1074 if ( tlsp == &tls_out
1075 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1076 /* client, wanting hostname check */
1079 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1080 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1081 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1083 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1084 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1087 const uschar * list = verify_cert_hostnames;
1090 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1091 if ((rc = X509_check_host(cert, CCS name, 0,
1092 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1093 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1098 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1099 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1106 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1109 uschar * extra = verify_mode
1110 ? string_sprintf(" (during %c-verify for [%s])",
1111 *verify_mode, sender_host_address)
1113 log_write(0, LOG_MAIN,
1114 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1115 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1116 extra, dn, verify_cert_hostnames);
1120 if (!tlsp->peercert)
1121 tlsp->peercert = X509_dup(cert); /* record failing cert */
1122 return 0; /* reject */
1124 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1125 "tls_try_verify_hosts)\n");
1126 tlsp->verify_override = TRUE;
1130 #ifndef DISABLE_EVENT
1131 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1132 return 0; /* reject, with peercert set */
1135 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1136 *calledp ? "" : " authenticated", dn);
1140 return 1; /* accept, at least for this level */
1144 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1146 return verify_callback(preverify_ok, x509ctx, &tls_out,
1147 &client_verify_callback_called, &client_verify_optional);
1151 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1153 return verify_callback(preverify_ok, x509ctx, &tls_in,
1154 &server_verify_callback_called, &server_verify_optional);
1160 /* This gets called *by* the dane library verify callback, which interposes
1164 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1166 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1168 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1169 #ifndef DISABLE_EVENT
1170 BOOL dummy_called, optional = FALSE;
1173 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1175 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1176 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1177 deliver_host_address);
1180 dn[sizeof(dn)-1] = '\0';
1182 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1183 preverify_ok ? "ok":"BAD", depth, dn);
1185 #ifndef DISABLE_EVENT
1186 if (verify_event(&tls_out, cert, depth, dn,
1187 &dummy_called, &optional, US"DANE"))
1188 return 0; /* reject, with peercert set */
1191 if (preverify_ok == 1)
1193 tls_out.dane_verified = TRUE;
1194 #ifndef DISABLE_OCSP
1195 if (client_static_state->u_ocsp.client.verify_store)
1196 { /* client, wanting stapling */
1197 /* Add the server cert's signing chain as the one
1198 for the verification of the OCSP stapled information. */
1200 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1203 sk_X509_push(client_static_state->verify_stack, cert);
1209 int err = X509_STORE_CTX_get_error(x509ctx);
1211 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1212 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1215 return preverify_ok;
1218 #endif /*SUPPORT_DANE*/
1221 #ifndef DISABLE_OCSP
1222 /*************************************************
1223 * Load OCSP information into state *
1224 *************************************************/
1225 /* Called to load the server OCSP response from the given file into memory, once
1226 caller has determined this is needed. Checks validity. Debugs a message
1229 ASSUMES: single response, for single cert.
1232 state various parts of session state
1233 filename the filename putatively holding an OCSP response
1234 is_pem file is PEM format; otherwise is DER
1238 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1242 OCSP_RESPONSE * resp;
1243 OCSP_BASICRESP * basic_response;
1244 OCSP_SINGLERESP * single_response;
1245 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1246 STACK_OF(X509) * sk;
1247 unsigned long verify_flags;
1248 int status, reason, i;
1251 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1253 if (!filename || !*filename) return;
1256 if (!(bio = BIO_new_file(CS filename, "rb")))
1258 log_write(0, LOG_MAIN|LOG_PANIC,
1259 "Failed to open OCSP response file \"%s\": %.100s",
1260 filename, ERR_reason_error_string(ERR_get_error()));
1266 uschar * data, * freep;
1269 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1271 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
1272 filename, ERR_reason_error_string(ERR_get_error()));
1276 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1277 OPENSSL_free(freep);
1280 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1285 log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
1286 filename, ERR_reason_error_string(ERR_get_error()));
1290 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1292 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1293 OCSP_response_status_str(status), status);
1299 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1300 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1305 if (!(basic_response = OCSP_response_get1_basic(resp)))
1308 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1312 sk = state->verify_stack;
1313 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1315 /* May need to expose ability to adjust those flags?
1316 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1317 OCSP_TRUSTOTHER OCSP_NOINTERN */
1319 /* This does a full verify on the OCSP proof before we load it for serving
1320 up; possibly overkill - just date-checks might be nice enough.
1322 OCSP_basic_verify takes a "store" arg, but does not
1323 use it for the chain verification, which is all we do
1324 when OCSP_NOVERIFY is set. The content from the wire
1325 "basic_response" and a cert-stack "sk" are all that is used.
1327 We have a stack, loaded in setup_certs() if tls_verify_certificates
1328 was a file (not a directory, or "system"). It is unfortunate we
1329 cannot used the connection context store, as that would neatly
1330 handle the "system" case too, but there seems to be no library
1331 function for getting a stack from a store.
1332 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1333 We do not free the stack since it could be needed a second time for
1336 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1337 be a public interface into the OpenSSL library (there's no manual entry) -
1338 But what with? We also use OCSP_basic_verify in the client stapling callback.
1339 And there we NEED it; we must verify that status... unless the
1340 library does it for us anyway? */
1342 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
1346 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1347 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
1352 /* Here's the simplifying assumption: there's only one response, for the
1353 one certificate we use, and nothing for anything else in a chain. If this
1354 proves false, we need to extract a cert id from our issued cert
1355 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1356 right cert in the stack and then calls OCSP_single_get0_status()).
1358 I'm hoping to avoid reworking a bunch more of how we handle state here.
1360 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1363 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1366 debug_printf("Unable to get first response from OCSP basic response.\n");
1370 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1371 if (status != V_OCSP_CERTSTATUS_GOOD)
1373 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1374 OCSP_cert_status_str(status), status,
1375 OCSP_crl_reason_str(reason), reason);
1379 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1381 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
1386 /* Add the resp to the list used by tls_server_stapling_cb() */
1388 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1389 while (oentry = *op)
1391 *op = oentry = store_get(sizeof(ocsp_resplist), FALSE);
1392 oentry->next = NULL;
1393 oentry->resp = resp;
1398 if (f.running_in_test_harness)
1400 extern char ** environ;
1401 if (environ) for (uschar ** p = USS environ; *p; p++)
1402 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1404 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1405 goto supply_response;
1413 ocsp_free_response_list(exim_openssl_state_st * cbinfo)
1415 for (ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; olist;
1416 olist = olist->next)
1417 OCSP_RESPONSE_free(olist->resp);
1418 cbinfo->u_ocsp.server.olist = NULL;
1420 #endif /*!DISABLE_OCSP*/
1427 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1430 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1431 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1432 return tls_error(string_sprintf(
1433 "SSL_CTX_use_certificate_chain_file file=%s", file),
1434 cbinfo->host, NULL, errstr);
1439 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1442 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1443 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1444 return tls_error(string_sprintf(
1445 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1452 /* Called once during tls_init and possibly again during TLS setup, for a
1453 new context, if Server Name Indication was used and tls_sni was seen in
1454 the certificate string.
1457 sctx the SSL_CTX* to update
1458 state various parts of session state
1459 errstr error string pointer
1461 Returns: OK/DEFER/FAIL
1465 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1470 if (!state->certificate)
1472 if (!state->is_server) /* client */
1475 if (tls_install_selfsign(sctx, errstr) != OK)
1482 if ( !reexpand_tls_files_for_sni
1483 && ( Ustrstr(state->certificate, US"tls_sni")
1484 || Ustrstr(state->certificate, US"tls_in_sni")
1485 || Ustrstr(state->certificate, US"tls_out_sni")
1487 reexpand_tls_files_for_sni = TRUE;
1489 if (!expand_check(state->certificate, US"tls_certificate", &expanded, errstr))
1493 if (state->is_server)
1495 const uschar * file_list = expanded;
1498 #ifndef DISABLE_OCSP
1499 const uschar * olist = state->u_ocsp.server.file;
1502 BOOL fmt_pem = FALSE;
1505 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1507 if (olist && !*olist)
1510 if ( state->u_ocsp.server.file_expanded && olist
1511 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1513 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1518 ocsp_free_response_list(state);
1519 state->u_ocsp.server.file_expanded = olist;
1523 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1525 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1528 #ifndef DISABLE_OCSP
1530 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1532 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1537 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1542 ocsp_load_response(state, ofile, fmt_pem);
1545 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1549 else /* would there ever be a need for multiple client certs? */
1550 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1553 if ( state->privatekey
1554 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr))
1557 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1558 of the expansion is an empty string, ignore it also, and assume the private
1559 key is in the same file as the certificate. */
1561 if (expanded && *expanded)
1562 if (state->is_server)
1564 const uschar * file_list = expanded;
1568 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1569 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1572 else /* would there ever be a need for multiple client certs? */
1573 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1583 /**************************************************
1584 * One-time init credentials for server and client *
1585 **************************************************/
1588 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1589 uschar * ciphers, uschar ** errstr)
1591 for (uschar * s = ciphers; *s; s++ ) if (*s == '_') *s = '-';
1592 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1593 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1594 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1595 state->server_cipher_list = ciphers;
1602 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1605 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1606 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1608 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1610 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1612 /* Set up the information callback, which outputs if debugging is at a suitable
1617 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1618 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1619 /* this needs a debug build of OpenSSL */
1620 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
1622 #ifdef OPENSSL_HAVE_KEYLOG_CB
1623 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
1627 /* Automatically re-try reads/writes after renegotiation. */
1628 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1635 tls_server_creds_init(void)
1638 uschar * dummy_errstr;
1639 unsigned lifetime = 0;
1643 state_server.lib_state = null_tls_preload;
1645 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1647 state_server.lib_state.lib_ctx = ctx;
1649 /* Preload DH params and EC curve */
1651 if (opt_unset_or_noexpand(tls_dhparam))
1653 DEBUG(D_tls) debug_printf("TLS: preloading DH params for server\n");
1654 if (init_dh(ctx, tls_dhparam, NULL, &dummy_errstr))
1655 state_server.lib_state.dh = TRUE;
1657 if (opt_unset_or_noexpand(tls_eccurve))
1659 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for server\n");
1660 if (init_ecdh(ctx, NULL, &dummy_errstr))
1661 state_server.lib_state.ecdh = TRUE;
1664 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1665 /* If we can, preload the server-side cert, key and ocsp */
1667 if ( opt_set_and_noexpand(tls_certificate)
1668 # ifndef DISABLE_OCSP
1669 && opt_unset_or_noexpand(tls_ocsp_file)
1671 && opt_unset_or_noexpand(tls_privatekey))
1673 /* Set watches on the filenames. The implementation does de-duplication
1674 so we can just blindly do them all. */
1676 if ( tls_set_watch(tls_certificate, TRUE)
1677 # ifndef DISABLE_OCSP
1678 && tls_set_watch(tls_ocsp_file, TRUE)
1680 && tls_set_watch(tls_privatekey, TRUE))
1682 state_server.certificate = tls_certificate;
1683 state_server.privatekey = tls_privatekey;
1684 #ifndef DISABLE_OCSP
1685 state_server.u_ocsp.server.file = tls_ocsp_file;
1688 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1689 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1690 state_server.lib_state.conn_certs = TRUE;
1693 else if ( !tls_certificate && !tls_privatekey
1694 # ifndef DISABLE_OCSP
1698 { /* Generate & preload a selfsigned cert. No files to watch. */
1699 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1701 state_server.lib_state.conn_certs = TRUE;
1702 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1706 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1709 /* If we can, preload the Authorities for checking client certs against.
1710 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1711 at TLS conn startup */
1713 if ( opt_set_and_noexpand(tls_verify_certificates)
1714 && opt_unset_or_noexpand(tls_crl))
1716 /* Watch the default dir also as they are always included */
1718 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1719 && tls_set_watch(tls_verify_certificates, FALSE)
1720 && tls_set_watch(tls_crl, FALSE))
1722 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1724 if (setup_certs(ctx, tls_verify_certificates, tls_crl, NULL, &dummy_errstr)
1726 state_server.lib_state.cabundle = TRUE;
1730 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1731 #endif /* EXIM_HAVE_INOTIFY */
1734 /* If we can, preload the ciphers control string */
1736 if (opt_set_and_noexpand(tls_require_ciphers))
1738 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1739 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1740 &dummy_errstr) == OK)
1741 state_server.lib_state.pri_string = TRUE;
1744 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1751 /* Preload whatever creds are static, onto a transport. The client can then
1752 just copy the pointer as it starts up.
1753 Called from the daemon after a cache-invalidate with watch set; called from
1754 a queue-run startup with watch clear. */
1757 tls_client_creds_init(transport_instance * t, BOOL watch)
1759 smtp_transport_options_block * ob = t->options_block;
1760 exim_openssl_state_st tpt_dummy_state;
1761 host_item * dummy_host = (host_item *)1;
1762 uschar * dummy_errstr;
1767 ob->tls_preload = null_tls_preload;
1768 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1770 ob->tls_preload.lib_ctx = ctx;
1772 tpt_dummy_state.lib_state = ob->tls_preload;
1774 if (opt_unset_or_noexpand(tls_dhparam))
1776 DEBUG(D_tls) debug_printf("TLS: preloading DH params for transport '%s'\n", t->name);
1777 if (init_dh(ctx, tls_dhparam, NULL, &dummy_errstr))
1778 ob->tls_preload.dh = TRUE;
1780 if (opt_unset_or_noexpand(tls_eccurve))
1782 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for transport '%s'\n", t->name);
1783 if (init_ecdh(ctx, NULL, &dummy_errstr))
1784 ob->tls_preload.ecdh = TRUE;
1787 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1788 if ( opt_set_and_noexpand(ob->tls_certificate)
1789 && opt_unset_or_noexpand(ob->tls_privatekey))
1792 || ( tls_set_watch(ob->tls_certificate, FALSE)
1793 && tls_set_watch(ob->tls_privatekey, FALSE)
1796 uschar * pkey = ob->tls_privatekey;
1799 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1801 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1803 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1804 pkey ? pkey : ob->tls_certificate,
1807 ob->tls_preload.conn_certs = TRUE;
1812 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1815 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1816 && opt_unset_or_noexpand(ob->tls_crl))
1819 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1820 && tls_set_watch(ob->tls_verify_certificates, FALSE)
1821 && tls_set_watch(ob->tls_crl, FALSE)
1825 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1827 if (setup_certs(ctx, ob->tls_verify_certificates,
1828 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
1829 ob->tls_preload.cabundle = TRUE;
1834 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1836 #endif /*EXIM_HAVE_INOTIFY*/
1840 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1841 /* Invalidate the creds cached, by dropping the current ones.
1842 Call when we notice one of the source files has changed. */
1845 tls_server_creds_invalidate(void)
1847 SSL_CTX_free(state_server.lib_state.lib_ctx);
1848 state_server.lib_state = null_tls_preload;
1853 tls_client_creds_invalidate(transport_instance * t)
1855 smtp_transport_options_block * ob = t->options_block;
1856 SSL_CTX_free(ob->tls_preload.lib_ctx);
1857 ob->tls_preload = null_tls_preload;
1863 tls_server_creds_invalidate(void)
1867 tls_client_creds_invalidate(transport_instance * t)
1870 #endif /*EXIM_HAVE_INOTIFY*/
1874 #ifndef DISABLE_OCSP
1876 x509_store_dump_cert_s_names(X509_STORE * store)
1878 STACK_OF(X509_OBJECT) * roots= store->objs;
1879 static uschar name[256];
1881 for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
1883 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
1884 if(tmp_obj->type == X509_LU_X509)
1886 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
1887 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
1889 name[sizeof(name)-1] = '\0';
1890 debug_printf(" %s\n", name);
1899 #ifndef DISABLE_TLS_RESUME
1900 /* Manage the keysets used for encrypting the session tickets, on the server. */
1902 typedef struct { /* Session ticket encryption key */
1905 const EVP_CIPHER * aes_cipher;
1906 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
1907 const EVP_MD * hmac_hash;
1908 uschar hmac_key[16];
1913 static exim_stek exim_tk; /* current key */
1914 static exim_stek exim_tk_old; /* previous key */
1919 time_t t = time(NULL);
1921 if (exim_tk.name[0])
1923 if (exim_tk.renew >= t) return;
1924 exim_tk_old = exim_tk;
1927 if (f.running_in_test_harness) ssl_session_timeout = 6;
1929 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
1930 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
1931 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
1932 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
1934 exim_tk.name[0] = 'E';
1935 exim_tk.aes_cipher = EVP_aes_256_cbc();
1936 exim_tk.hmac_hash = EVP_sha256();
1937 exim_tk.expire = t + ssl_session_timeout;
1938 exim_tk.renew = t + ssl_session_timeout/2;
1944 if (!exim_tk.name[0]) return NULL;
1949 tk_find(const uschar * name)
1951 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
1952 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
1956 /* Callback for session tickets, on server */
1958 ticket_key_callback(SSL * ssl, uschar key_name[16],
1959 uschar * iv, EVP_CIPHER_CTX * c_ctx, HMAC_CTX * hctx, int enc)
1961 tls_support * tlsp = state_server.tlsp;
1966 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
1967 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
1969 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
1970 return -1; /* insufficient random */
1972 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
1973 return 0; /* key couldn't be created */
1974 memcpy(key_name, key->name, 16);
1975 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
1977 /*XXX will want these dependent on the ssl session strength */
1978 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
1979 key->hmac_hash, NULL);
1980 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
1982 DEBUG(D_tls) debug_printf("ticket created\n");
1987 time_t now = time(NULL);
1989 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
1990 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
1992 if (!(key = tk_find(key_name)) || key->expire < now)
1996 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
1997 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
2002 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2003 key->hmac_hash, NULL);
2004 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2006 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2008 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2009 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2010 be better. To do that we'd have to encode ticket lifetime in the name as
2011 we don't yet see the restored session. Could check posthandshake for TLS1.3
2012 and trigger a new ticket then, but cannot do that for TLS1.2 */
2013 return key->renew < now ? 2 : 1;
2021 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2022 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2024 /* If verification is optional, don't fail if no certificate */
2026 SSL_CTX_set_verify(ctx,
2027 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2032 /*************************************************
2033 * Callback to handle SNI *
2034 *************************************************/
2036 /* Called when acting as server during the TLS session setup if a Server Name
2037 Indication extension was sent by the client.
2039 API documentation is OpenSSL s_server.c implementation.
2042 s SSL* of the current session
2043 ad unknown (part of OpenSSL API) (unused)
2044 arg Callback of "our" registered data
2046 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2048 XXX might need to change to using ClientHello callback,
2049 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2052 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2054 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
2056 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2057 exim_openssl_state_st *state = (exim_openssl_state_st *) arg;
2059 int old_pool = store_pool;
2060 uschar * dummy_errstr;
2063 return SSL_TLSEXT_ERR_OK;
2065 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2066 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2068 /* Make the extension value available for expansion */
2069 store_pool = POOL_PERM;
2070 tls_in.sni = string_copy_taint(US servername, TRUE);
2071 store_pool = old_pool;
2073 if (!reexpand_tls_files_for_sni)
2074 return SSL_TLSEXT_ERR_OK;
2076 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2077 not confident that memcpy wouldn't break some internal reference counting.
2078 Especially since there's a references struct member, which would be off. */
2080 if (lib_ctx_new(&server_sni, NULL, &dummy_errstr) != OK)
2083 /* Not sure how many of these are actually needed, since SSL object
2084 already exists. Might even need this selfsame callback, for reneg? */
2087 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2088 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2089 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2090 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2091 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2092 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2093 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2096 if ( !init_dh(server_sni, state->dhparam, NULL, &dummy_errstr)
2097 || !init_ecdh(server_sni, NULL, &dummy_errstr)
2101 if ( state->server_cipher_list
2102 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2105 #ifndef DISABLE_OCSP
2106 if (state->u_ocsp.server.file)
2108 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2109 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2115 if ( !expand_check(tls_verify_certificates, US"tls_verify_certificates",
2116 &expcerts, &dummy_errstr)
2117 || (rc = setup_certs(server_sni, expcerts, tls_crl, NULL,
2118 &dummy_errstr)) != OK)
2121 if (expcerts && *expcerts)
2122 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2125 /* do this after setup_certs, because this can require the certs for verifying
2126 OCSP information. */
2127 if ((rc = tls_expand_session_files(server_sni, state, &dummy_errstr)) != OK)
2130 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2131 SSL_set_SSL_CTX(s, server_sni);
2132 return SSL_TLSEXT_ERR_OK;
2134 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
2136 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2141 #ifdef EXIM_HAVE_ALPN
2142 /*************************************************
2143 * Callback to handle ALPN *
2144 *************************************************/
2146 /* Called on server if tls_alpn nonblank after expansion,
2147 when client offers ALPN, after the SNI callback.
2148 If set and not matching the list then we dump the connection */
2151 tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen,
2152 const uschar * in, unsigned int inlen, void * arg)
2154 const exim_openssl_state_st * state = arg;
2156 server_seen_alpn = TRUE;
2159 debug_printf("Received TLS ALPN offer:");
2160 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2163 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2164 debug_printf(" '%.*s'", siz, in + pos + 1);
2166 debug_printf(". Our list: '%s'\n", tls_alpn);
2169 /* Look for an acceptable ALPN */
2171 if ( inlen > 1 /* at least one name */
2172 && in[0]+1 == inlen /* filling the vector, so exactly one name */
2175 const uschar * list = tls_alpn;
2177 for (uschar * name; name = string_nextinlist(&list, &sep, NULL, 0); )
2178 if (Ustrncmp(in+1, name, in[0]) == 0)
2180 *out = in; /* we checked for exactly one, so can just point to it */
2182 return SSL_TLSEXT_ERR_OK; /* use ALPN */
2186 /* More than one name from clilent, or name did not match our list. */
2188 /* This will be fatal to the TLS conn; would be nice to kill TCP also.
2189 Maybe as an option in future; for now leave control to the config (must-tls). */
2191 DEBUG(D_tls) debug_printf("TLS ALPN rejected\n");
2192 return SSL_TLSEXT_ERR_ALERT_FATAL;
2194 #endif /* EXIM_HAVE_ALPN */
2198 #ifndef DISABLE_OCSP
2200 /*************************************************
2201 * Callback to handle OCSP Stapling *
2202 *************************************************/
2204 /* Called when acting as server during the TLS session setup if the client
2205 requests OCSP information with a Certificate Status Request.
2207 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2213 tls_server_stapling_cb(SSL *s, void *arg)
2215 const exim_openssl_state_st * state = arg;
2216 ocsp_resplist * olist = state->u_ocsp.server.olist;
2217 uschar * response_der; /*XXX blob */
2218 int response_der_len;
2221 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2222 olist ? "have" : "lack");
2224 tls_in.ocsp = OCSP_NOT_RESP;
2226 return SSL_TLSEXT_ERR_NOACK;
2228 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
2230 const X509 * cert_sent = SSL_get_certificate(s);
2231 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2232 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2233 const X509_NAME * cert_issuer = X509_get_issuer_name(cert_sent);
2237 for (; olist; olist = olist->next)
2239 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2240 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2241 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2242 ASN1_INTEGER * res_cert_serial;
2243 const BIGNUM * resp_bn;
2244 ASN1_OCTET_STRING * res_cert_iNameHash;
2247 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2248 (OCSP_CERTID *) cid);
2249 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2253 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2254 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2257 if (BN_cmp(cert_bn, resp_bn) == 0)
2259 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2261 /*XXX TODO: check the rest of the list for duplicate matches.
2262 If any, need to also check the Issuer Name hash.
2263 Without this, we will provide the wrong status in the case of
2268 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2272 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2273 return SSL_TLSEXT_ERR_NOACK;
2279 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2280 return SSL_TLSEXT_ERR_NOACK;
2284 /*XXX could we do the i2d earlier, rather than during the callback? */
2285 response_der = NULL;
2286 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2287 if (response_der_len <= 0)
2288 return SSL_TLSEXT_ERR_NOACK;
2290 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2291 response_der, response_der_len);
2292 tls_in.ocsp = OCSP_VFIED;
2293 return SSL_TLSEXT_ERR_OK;
2298 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
2300 BIO_printf(bp, "\t%s: ", str);
2301 ASN1_GENERALIZEDTIME_print(bp, time);
2306 tls_client_stapling_cb(SSL *s, void *arg)
2308 exim_openssl_state_st * cbinfo = arg;
2309 const unsigned char * p;
2311 OCSP_RESPONSE * rsp;
2312 OCSP_BASICRESP * bs;
2315 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2316 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
2319 /* Expect this when we requested ocsp but got none */
2320 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2321 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2323 DEBUG(D_tls) debug_printf(" null\n");
2324 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2327 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2329 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2330 if (LOGGING(tls_cipher))
2331 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2333 DEBUG(D_tls) debug_printf(" parse error\n");
2337 if (!(bs = OCSP_response_get1_basic(rsp)))
2339 tls_out.ocsp = OCSP_FAILED;
2340 if (LOGGING(tls_cipher))
2341 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2343 DEBUG(D_tls) debug_printf(" error parsing response\n");
2344 OCSP_RESPONSE_free(rsp);
2348 /* We'd check the nonce here if we'd put one in the request. */
2349 /* However that would defeat cacheability on the server so we don't. */
2351 /* This section of code reworked from OpenSSL apps source;
2352 The OpenSSL Project retains copyright:
2353 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2357 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2358 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2361 DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
2363 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2365 /* Use the chain that verified the server cert to verify the stapled info */
2366 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
2368 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
2369 cbinfo->u_ocsp.client.verify_store, OCSP_NOEXPLICIT)) <= 0)
2370 if (ERR_peek_error())
2372 tls_out.ocsp = OCSP_FAILED;
2373 if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
2374 "Received TLS cert status response, itself unverifiable: %s",
2375 ERR_reason_error_string(ERR_peek_error()));
2376 BIO_printf(bp, "OCSP response verify failure\n");
2377 ERR_print_errors(bp);
2378 OCSP_RESPONSE_print(bp, rsp, 0);
2382 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2383 " in the root CA certificate; ignoring\n");
2385 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2387 /*XXX So we have a good stapled OCSP status. How do we know
2388 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2389 OCSP_resp_find_status() which matches on a cert id, which presumably
2390 we should use. Making an id needs OCSP_cert_id_new(), which takes
2391 issuerName, issuerKey, serialNumber. Are they all in the cert?
2393 For now, carry on blindly accepting the resp. */
2396 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2397 OCSP_resp_count(bs) - 1;
2399 sk_OCSP_SINGLERESP_num(sresp) - 1;
2403 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2405 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2407 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2408 - but what happens with a GnuTLS-style input?
2410 we could do with a debug label for each singleresp
2411 - it has a certID with a serialNumber, but I see no API to get that
2413 status = OCSP_single_get0_status(single, &reason, &rev,
2414 &thisupd, &nextupd);
2416 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
2417 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
2418 if (!OCSP_check_validity(thisupd, nextupd,
2419 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2421 tls_out.ocsp = OCSP_FAILED;
2422 DEBUG(D_tls) ERR_print_errors(bp);
2423 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
2427 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2428 OCSP_cert_status_str(status));
2431 case V_OCSP_CERTSTATUS_GOOD:
2432 continue; /* the idx loop */
2433 case V_OCSP_CERTSTATUS_REVOKED:
2434 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2435 reason != -1 ? "; reason: " : "",
2436 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2437 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2440 log_write(0, LOG_MAIN,
2441 "Server certificate status unknown, in OCSP stapling");
2449 tls_out.ocsp = OCSP_VFIED;
2453 tls_out.ocsp = OCSP_FAILED;
2454 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2459 OCSP_RESPONSE_free(rsp);
2462 #endif /*!DISABLE_OCSP*/
2465 /*************************************************
2466 * Initialize for TLS *
2467 *************************************************/
2468 /* Called from both server and client code, to do preliminary initialization
2469 of the library. We allocate and return a context structure.
2472 host connected host, if client; NULL if server
2473 ob transport options block, if client; NULL if server
2474 ocsp_file file of stapling info (server); flag for require ocsp (client)
2475 addr address if client; NULL if server (for some randomness)
2476 caller_state place to put pointer to allocated state-struct
2477 errstr error string pointer
2479 Returns: OK/DEFER/FAIL
2483 tls_init(host_item * host, smtp_transport_options_block * ob,
2484 #ifndef DISABLE_OCSP
2487 address_item *addr, exim_openssl_state_st ** caller_state,
2492 exim_openssl_state_st * state;
2495 if (host) /* client */
2497 state = store_malloc(sizeof(exim_openssl_state_st));
2498 memset(state, 0, sizeof(*state));
2499 state->certificate = ob->tls_certificate;
2500 state->privatekey = ob->tls_privatekey;
2501 state->is_server = FALSE;
2502 state->dhparam = NULL;
2503 state->lib_state = ob->tls_preload;
2507 state = &state_server;
2508 state->certificate = tls_certificate;
2509 state->privatekey = tls_privatekey;
2510 state->is_server = TRUE;
2511 state->dhparam = tls_dhparam;
2512 state->lib_state = state_server.lib_state;
2518 if (!state->lib_state.pri_string)
2519 state->server_cipher_list = NULL;
2521 #ifndef DISABLE_EVENT
2522 state->event_action = NULL;
2527 /* It turns out that we need to seed the random number generator this early in
2528 order to get the full complement of ciphers to work. It took me roughly a day
2529 of work to discover this by experiment.
2531 On systems that have /dev/urandom, SSL may automatically seed itself from
2532 there. Otherwise, we have to make something up as best we can. Double check
2535 Although we likely called this before, at daemon startup, this is a chance
2536 to mix in further variable info (time, pid) if needed. */
2538 if (!lib_rand_init(addr))
2539 return tls_error(US"RAND_status", host,
2540 US"unable to seed random number generator", errstr);
2542 /* Apply administrator-supplied work-arounds.
2543 Historically we applied just one requested option,
2544 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2545 moved to an administrator-controlled list of options to specify and
2546 grandfathered in the first one as the default value for "openssl_options".
2548 No OpenSSL version number checks: the options we accept depend upon the
2549 availability of the option value macros from OpenSSL. */
2552 if (!tls_openssl_options_parse(openssl_options, &init_options))
2553 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2555 /* Create a context.
2556 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2557 negotiation in the different methods; as far as I can tell, the only
2558 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2559 when OpenSSL is built without SSLv2 support.
2560 By disabling with openssl_options, we can let admins re-enable with the
2563 if (!(ctx = state->lib_state.lib_ctx))
2565 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2567 state->lib_state.lib_ctx = ctx;
2570 #ifndef DISABLE_TLS_RESUME
2571 tlsp->resumption = RESUME_SUPPORTED;
2575 #ifndef DISABLE_TLS_RESUME
2576 /* Should the server offer session resumption? */
2577 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2579 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2580 init_options &= ~SSL_OP_NO_TICKET;
2581 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2582 tlsp->host_resumable = TRUE;
2586 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
2587 if (!(SSL_CTX_set_options(ctx, init_options)))
2588 return tls_error(string_sprintf(
2589 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2592 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2594 /* We'd like to disable session cache unconditionally, but foolish Outlook
2595 Express clients then give up the first TLS connection and make a second one
2596 (which works). Only when there is an IMAP service on the same machine.
2597 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2598 now, until we work out a decent way of presenting control to the config. It
2599 will never be used because we use a new context every time. */
2601 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2604 /* Initialize with DH parameters if supplied */
2605 /* Initialize ECDH temp key parameter selection */
2607 if (state->lib_state.dh)
2608 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2610 if (!init_dh(ctx, state->dhparam, host, errstr)) return DEFER;
2612 if (state->lib_state.ecdh)
2613 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
2615 if (!init_ecdh(ctx, host, errstr)) return DEFER;
2617 /* Set up certificate and key (and perhaps OCSP info) */
2619 if (state->lib_state.conn_certs)
2622 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
2626 #ifndef DISABLE_OCSP
2629 state->u_ocsp.server.file = ocsp_file;
2630 state->u_ocsp.server.file_expanded = NULL;
2631 state->u_ocsp.server.olist = NULL;
2634 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
2637 /* If we need to handle SNI or OCSP, do so */
2639 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2640 # ifndef DISABLE_OCSP
2641 if (!(state->verify_stack = sk_X509_new_null()))
2643 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2648 if (!host) /* server */
2650 # ifndef DISABLE_OCSP
2651 /* We check u_ocsp.server.file, not server.olist, because we care about if
2652 the option exists, not what the current expansion might be, as SNI might
2653 change the certificate and OCSP file in use between now and the time the
2654 callback is invoked. */
2655 if (state->u_ocsp.server.file)
2657 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2658 SSL_CTX_set_tlsext_status_arg(ctx, state);
2661 /* We always do this, so that $tls_sni is available even if not used in
2663 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2664 SSL_CTX_set_tlsext_servername_arg(ctx, state);
2666 # ifdef EXIM_HAVE_ALPN
2667 if (tls_alpn && *tls_alpn)
2670 if ( expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr)
2671 && *exp_alpn && !isblank(*exp_alpn))
2673 tls_alpn = exp_alpn; /* subprocess so ok to overwrite */
2674 SSL_CTX_set_alpn_select_cb(ctx, tls_server_alpn_cb, state);
2681 # ifndef DISABLE_OCSP
2683 if(ocsp_file) /* wanting stapling */
2685 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
2687 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2690 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2691 SSL_CTX_set_tlsext_status_arg(ctx, state);
2696 state->verify_cert_hostnames = NULL;
2698 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
2699 /* Set up the RSA callback */
2700 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
2703 /* Finally, set the session cache timeout, and we are done.
2704 The period appears to be also used for (server-generated) session tickets */
2706 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
2707 DEBUG(D_tls) debug_printf("Initialized TLS\n");
2709 *caller_state = state;
2717 /*************************************************
2718 * Get name of cipher in use *
2719 *************************************************/
2722 Argument: pointer to an SSL structure for the connection
2723 pointer to number of bits for cipher
2724 Returns: pointer to allocated string in perm-pool
2728 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
2730 int pool = store_pool;
2731 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
2732 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2733 the accessor functions use const in the prototype. */
2735 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
2738 SSL_CIPHER_get_bits(c, bits);
2740 store_pool = POOL_PERM;
2741 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2743 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2748 /* Get IETF-standard name for ciphersuite.
2749 Argument: pointer to an SSL structure for the connection
2750 Returns: pointer to string
2753 static const uschar *
2754 cipher_stdname_ssl(SSL * ssl)
2756 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2757 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2759 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2760 return cipher_stdname(id >> 8, id & 0xff);
2765 static const uschar *
2766 tlsver_name(SSL * ssl)
2769 int pool = store_pool;
2771 store_pool = POOL_PERM;
2772 s = string_copy(US SSL_get_version(ssl));
2774 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
2775 for (;; p++) if (!(*p = p[1])) break;
2781 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
2783 /*XXX we might consider a list-of-certs variable for the cert chain.
2784 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2785 in list-handling functions, also consider the difference between the entire
2786 chain and the elements sent by the peer. */
2788 tlsp->peerdn = NULL;
2790 /* Will have already noted peercert on a verify fail; possibly not the leaf */
2791 if (!tlsp->peercert)
2792 tlsp->peercert = SSL_get_peer_certificate(ssl);
2793 /* Beware anonymous ciphers which lead to server_cert being NULL */
2795 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2796 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2799 int oldpool = store_pool;
2801 peerdn[siz-1] = '\0'; /* paranoia */
2802 store_pool = POOL_PERM;
2803 tlsp->peerdn = string_copy(peerdn);
2804 store_pool = oldpool;
2806 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2807 but they don't get called on session-resumption. So use the official
2808 interface, which uses the resumed value. Unfortunately this claims verified
2809 when it actually failed but we're in try-verify mode, due to us wanting the
2810 knowlege that it failed so needing to have the callback and forcing a
2811 permissive return. If we don't force it, the TLS startup is failed.
2812 The extra bit of information is set in verify_override in the cb, stashed
2813 for resumption next to the TLS session, and used here. */
2815 if (!tlsp->verify_override)
2816 tlsp->certificate_verified =
2818 tlsp->dane_verified ||
2820 SSL_get_verify_result(ssl) == X509_V_OK;
2828 /*************************************************
2829 * Set up for verifying certificates *
2830 *************************************************/
2832 #ifndef DISABLE_OCSP
2833 /* Load certs from file, return TRUE on success */
2836 chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
2839 STACK_OF(X509) * verify_stack = *vp;
2843 while (sk_X509_num(verify_stack) > 0)
2844 X509_free(sk_X509_pop(verify_stack));
2846 verify_stack = sk_X509_new_null();
2848 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
2849 for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
2850 sk_X509_push(verify_stack, x);
2859 /* Called by both client and server startup; on the server possibly
2860 repeated after a Server Name Indication.
2863 sctx SSL_CTX* to initialise
2864 certs certs file, expanded
2865 crl CRL file or NULL
2866 host NULL in a server; the remote host in a client
2867 errstr error string pointer
2869 Returns: OK/DEFER/FAIL
2873 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
2876 uschar *expcerts, *expcrl;
2878 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
2880 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
2882 if (expcerts && *expcerts)
2884 /* Tell the library to use its compiled-in location for the system default
2885 CA bundle. Then add the ones specified in the config, if any. */
2887 if (!SSL_CTX_set_default_verify_paths(sctx))
2888 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
2890 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
2892 struct stat statbuf;
2894 if (Ustat(expcerts, &statbuf) < 0)
2896 log_write(0, LOG_MAIN|LOG_PANIC,
2897 "failed to stat %s for certificates", expcerts);
2903 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
2904 { file = NULL; dir = expcerts; }
2907 STACK_OF(X509) * verify_stack =
2908 #ifndef DISABLE_OCSP
2909 !host ? state_server.verify_stack :
2912 STACK_OF(X509) ** vp = &verify_stack;
2914 file = expcerts; dir = NULL;
2915 #ifndef DISABLE_OCSP
2916 /* In the server if we will be offering an OCSP proof, load chain from
2917 file for verifying the OCSP proof at load time. */
2919 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
2920 This is inconsistent with the need to verify the OCSP proof of the server cert.
2923 && statbuf.st_size > 0
2924 && state_server.u_ocsp.server.file
2925 && !chain_from_pem_file(file, vp)
2928 log_write(0, LOG_MAIN|LOG_PANIC,
2929 "failed to load cert chain from %s", file);
2935 /* If a certificate file is empty, the load function fails with an
2936 unhelpful error message. If we skip it, we get the correct behaviour (no
2937 certificates are recognized, but the error message is still misleading (it
2938 says no certificate was supplied). But this is better. */
2940 if ( (!file || statbuf.st_size > 0)
2941 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
2942 return tls_error(US"SSL_CTX_load_verify_locations",
2943 host, NULL, errstr);
2945 /* On the server load the list of CAs for which we will accept certs, for
2946 sending to the client. This is only for the one-file
2947 tls_verify_certificates variant.
2948 If a list isn't loaded into the server, but some verify locations are set,
2949 the server end appears to make a wildcard request for client certs.
2950 Meanwhile, the client library as default behaviour *ignores* the list
2951 we send over the wire - see man SSL_CTX_set_client_cert_cb.
2952 Because of this, and that the dir variant is likely only used for
2953 the public-CA bundle (not for a private CA), not worth fixing. */
2957 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
2958 int i = sk_X509_NAME_num(names);
2960 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
2961 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
2962 i, i>1 ? "ies":"y");
2966 debug_printf("Added dir for additional certificate authorities\n");
2970 /* Handle a certificate revocation list. */
2972 #if OPENSSL_VERSION_NUMBER > 0x00907000L
2974 /* This bit of code is now the version supplied by Lars Mainka. (I have
2975 merely reformatted it into the Exim code style.)
2977 "From here I changed the code to add support for multiple crl's
2978 in pem format in one file or to support hashed directory entries in
2979 pem format instead of a file. This method now uses the library function
2980 X509_STORE_load_locations to add the CRL location to the SSL context.
2981 OpenSSL will then handle the verify against CA certs and CRLs by
2982 itself in the verify callback." */
2984 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
2985 if (expcrl && *expcrl)
2987 struct stat statbufcrl;
2988 if (Ustat(expcrl, &statbufcrl) < 0)
2990 log_write(0, LOG_MAIN|LOG_PANIC,
2991 "failed to stat %s for certificates revocation lists", expcrl);
2996 /* is it a file or directory? */
2998 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
2999 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
3003 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
3009 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
3011 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
3012 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
3014 /* setting the flags to check against the complete crl chain */
3016 X509_STORE_set_flags(cvstore,
3017 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
3021 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3029 /*************************************************
3030 * Start a TLS session in a server *
3031 *************************************************/
3032 /* This is called when Exim is running as a server, after having received
3033 the STARTTLS command. It must respond to that command, and then negotiate
3037 errstr pointer to error message
3039 Returns: OK on success
3040 DEFER for errors before the start of the negotiation
3041 FAIL for errors during the negotiation; the server can't
3046 tls_server_start(uschar ** errstr)
3049 uschar * expciphers;
3050 exim_openssl_state_st * dummy_statep;
3053 static uschar peerdn[256];
3055 /* Check for previous activation */
3057 if (tls_in.active.sock >= 0)
3059 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3060 smtp_printf("554 Already in TLS\r\n", FALSE);
3064 /* Initialize the SSL library. If it fails, it will already have logged
3067 rc = tls_init(NULL, NULL,
3068 #ifndef DISABLE_OCSP
3071 NULL, &dummy_statep, &tls_in, errstr);
3072 if (rc != OK) return rc;
3073 ctx = state_server.lib_state.lib_ctx;
3075 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3076 were historically separated by underscores. So that I can use either form in my
3077 tests, and also for general convenience, we turn underscores into hyphens here.
3079 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3080 for TLS 1.3 . Since we do not call it at present we get the default list:
3081 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3084 if (state_server.lib_state.pri_string)
3085 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3088 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3092 && (rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3096 /* If this is a host for which certificate verification is mandatory or
3097 optional, set up appropriately. */
3099 tls_in.certificate_verified = FALSE;
3101 tls_in.dane_verified = FALSE;
3103 server_verify_callback_called = FALSE;
3105 if (verify_check_host(&tls_verify_hosts) == OK)
3106 server_verify_optional = FALSE;
3107 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3108 server_verify_optional = TRUE;
3114 if (!expand_check(tls_verify_certificates, US"tls_verify_certificates",
3117 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3119 if (state_server.lib_state.cabundle)
3120 { DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n"); }
3122 if ((rc = setup_certs(ctx, expcerts, tls_crl, NULL, errstr)) != OK)
3125 if (expcerts && *expcerts)
3126 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3130 #ifndef DISABLE_TLS_RESUME
3131 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3132 /* despite working, appears to always return failure, so ignoring */
3134 #ifdef OPENSSL_HAVE_NUM_TICKETS
3135 # ifndef DISABLE_TLS_RESUME
3136 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3138 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3143 /* Prepare for new connection */
3145 if (!(ssl = SSL_new(ctx)))
3146 return tls_error(US"SSL_new", NULL, NULL, errstr);
3147 state_server.lib_state.lib_ssl = ssl;
3149 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3151 * With the SSL_clear(), we get strange interoperability bugs with
3152 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3153 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3155 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3156 * session shutdown. In this case, we have a brand new object and there's no
3157 * obvious reason to immediately clear it. I'm guessing that this was
3158 * originally added because of incomplete initialisation which the clear fixed,
3159 * in some historic release.
3162 /* Set context and tell client to go ahead, except in the case of TLS startup
3163 on connection, where outputting anything now upsets the clients and tends to
3164 make them disconnect. We need to have an explicit fflush() here, to force out
3165 the response. Other smtp_printf() calls do not need it, because in non-TLS
3166 mode, the fflush() happens when smtp_getc() is called. */
3168 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3169 if (!tls_in.on_connect)
3171 smtp_printf("220 TLS go ahead\r\n", FALSE);
3175 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3176 that the OpenSSL library doesn't. */
3178 SSL_set_wfd(ssl, fileno(smtp_out));
3179 SSL_set_rfd(ssl, fileno(smtp_in));
3180 SSL_set_accept_state(ssl);
3182 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3185 sigalrm_seen = FALSE;
3186 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3187 rc = SSL_accept(ssl);
3192 int error = SSL_get_error(ssl, rc);
3195 case SSL_ERROR_NONE:
3198 case SSL_ERROR_ZERO_RETURN:
3199 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3200 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3202 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3205 tls_close(NULL, TLS_NO_SHUTDOWN);
3208 /* Handle genuine errors */
3212 int r = ERR_GET_REASON(ERR_peek_error());
3213 if ( r == SSL_R_WRONG_VERSION_NUMBER
3214 #ifdef SSL_R_VERSION_TOO_LOW
3215 || r == SSL_R_VERSION_TOO_LOW
3217 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3218 s = string_sprintf("%s (%s)", s, SSL_get_version(ssl));
3219 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
3224 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3225 if (error == SSL_ERROR_SYSCALL)
3229 *errstr = US"SSL_accept: TCP connection closed by peer";
3232 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3234 (void) tls_error(US"SSL_accept", NULL,
3235 sigalrm_seen ? US"timed out"
3236 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3242 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3243 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3244 anon-authentication ciphersuite negotiated. */
3246 #ifndef DISABLE_TLS_RESUME
3247 if (SSL_session_reused(ssl))
3249 tls_in.resumption |= RESUME_USED;
3250 DEBUG(D_tls) debug_printf("Session reused\n");
3254 #ifdef EXIM_HAVE_ALPN
3255 /* If require-alpn, check server_seen_alpn here. Else abort TLS */
3256 if (!tls_alpn || !*tls_alpn)
3257 { DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n"); }
3258 else if (!server_seen_alpn)
3259 if (verify_check_host(&hosts_require_alpn) == OK)
3261 /* We'd like to send a definitive Alert but OpenSSL provides no facility */
3263 tls_error(US"handshake", NULL, US"ALPN required but not negotiated", errstr);
3267 { DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n"); }
3270 const uschar * name;
3272 SSL_get0_alpn_selected(ssl, &name, &len);
3273 debug_printf("ALPN negotiated: '%.*s'\n", (int)*name, name+1);
3278 /* TLS has been set up. Record data for the connection,
3279 adjust the input functions to read via TLS, and initialize things. */
3281 #ifdef SSL_get_extms_support
3282 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3284 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3286 tls_in.ver = tlsver_name(ssl);
3287 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3288 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3293 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3294 debug_printf("Shared ciphers: %s\n", buf);
3296 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3298 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
3299 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3304 #ifdef EXIM_HAVE_SESSION_TICKET
3306 SSL_SESSION * ss = SSL_get_session(ssl);
3307 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3308 debug_printf("The session has a ticket, life %lu seconds\n",
3309 SSL_SESSION_get_ticket_lifetime_hint(ss));
3314 /* Record the certificate we presented */
3316 X509 * crt = SSL_get_certificate(ssl);
3317 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3320 /* Channel-binding info for authenticators
3321 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/ */
3324 size_t len = SSL_get_peer_finished(ssl, &c, 0);
3325 int old_pool = store_pool;
3327 SSL_get_peer_finished(ssl, s = store_get((int)len, FALSE), len);
3328 store_pool = POOL_PERM;
3329 tls_in.channelbinding = b64encode_taint(CUS s, (int)len, FALSE);
3330 store_pool = old_pool;
3331 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p\n", tls_in.channelbinding);
3334 /* Only used by the server-side tls (tls_in), including tls_getc.
3335 Client-side (tls_out) reads (seem to?) go via
3336 smtp_read_response()/ip_recv().
3337 Hence no need to duplicate for _in and _out.
3339 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3340 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3341 ssl_xfer_eof = ssl_xfer_error = FALSE;
3343 receive_getc = tls_getc;
3344 receive_getbuf = tls_getbuf;
3345 receive_get_cache = tls_get_cache;
3346 receive_ungetc = tls_ungetc;
3347 receive_feof = tls_feof;
3348 receive_ferror = tls_ferror;
3349 receive_smtp_buffered = tls_smtp_buffered;
3351 tls_in.active.sock = fileno(smtp_out);
3352 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3360 tls_client_basic_ctx_init(SSL_CTX * ctx,
3361 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3366 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3367 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3368 host patterns if one of them is set with content. */
3370 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3371 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3373 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3374 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3377 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3379 client_verify_optional = FALSE;
3380 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3381 client_verify_optional = TRUE;
3387 if (!expand_check(ob->tls_verify_certificates, US"tls_verify_certificates",
3390 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3392 if (state->lib_state.cabundle)
3393 { DEBUG(D_tls) debug_printf("TLS: CA bundle was preloaded\n"); }
3395 if ((rc = setup_certs(ctx, expcerts, ob->tls_crl, host, errstr)) != OK)
3398 if (expcerts && *expcerts)
3399 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3402 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3404 state->verify_cert_hostnames =
3406 string_domain_utf8_to_alabel(host->certname, NULL);
3410 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3411 state->verify_cert_hostnames);
3419 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3422 const char * hostnames[2] = { CS host->name, NULL };
3425 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3426 return tls_error(US"hostnames load", host, NULL, errstr);
3428 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3429 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3430 ) if (rr->type == T_TLSA && rr->size > 3)
3432 const uschar * p = rr->data;
3433 uint8_t usage, selector, mtype;
3434 const char * mdname;
3438 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3439 if (usage != 2 && usage != 3) continue;
3446 default: continue; /* Only match-types 0, 1, 2 are supported */
3447 case 0: mdname = NULL; break;
3448 case 1: mdname = "sha256"; break;
3449 case 2: mdname = "sha512"; break;
3453 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3456 return tls_error(US"tlsa load", host, NULL, errstr);
3457 case 0: /* action not taken */
3461 tls_out.tlsa_usage |= 1<<usage;
3467 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3470 #endif /*SUPPORT_DANE*/
3474 #ifndef DISABLE_TLS_RESUME
3475 /* On the client, get any stashed session for the given IP from hints db
3476 and apply it to the ssl-connection for attempted resumption. */
3479 tls_retrieve_session(tls_support * tlsp, SSL * ssl, const uschar * key)
3481 tlsp->resumption |= RESUME_SUPPORTED;
3482 if (tlsp->host_resumable)
3484 dbdata_tls_session * dt;
3486 open_db dbblock, * dbm_file;
3488 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3489 DEBUG(D_tls) debug_printf("checking for resumable session for %s\n", key);
3490 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3492 /* key for the db is the IP */
3493 if ((dt = dbfn_read_with_length(dbm_file, key, &len)))
3495 SSL_SESSION * ss = NULL;
3496 const uschar * sess_asn1 = dt->session;
3498 len -= sizeof(dbdata_tls_session);
3499 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3503 ERR_error_string_n(ERR_get_error(),
3504 ssl_errstring, sizeof(ssl_errstring));
3505 debug_printf("decoding session: %s\n", ssl_errstring);
3510 unsigned long lifetime =
3511 #ifdef EXIM_HAVE_SESSION_TICKET
3512 SSL_SESSION_get_ticket_lifetime_hint(ss);
3513 #else /* Use, fairly arbitrilarily, what we as server would */
3514 f.running_in_test_harness ? 6 : ssl_session_timeout;
3516 if (lifetime + dt->time_stamp < time(NULL))
3518 DEBUG(D_tls) debug_printf("session expired\n");
3519 dbfn_delete(dbm_file, key);
3521 else if (!SSL_set_session(ssl, ss))
3525 ERR_error_string_n(ERR_get_error(),
3526 ssl_errstring, sizeof(ssl_errstring));
3527 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3532 DEBUG(D_tls) debug_printf("good session\n");
3533 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3534 tlsp->verify_override = dt->verify_override;
3535 tlsp->ocsp = dt->ocsp;
3540 DEBUG(D_tls) debug_printf("no session record\n");
3541 dbfn_close(dbm_file);
3547 /* On the client, save the session for later resumption */
3550 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3552 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3555 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3557 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3559 # ifdef OPENSSL_HAVE_NUM_TICKETS
3560 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3563 int len = i2d_SSL_SESSION(ss, NULL);
3564 int dlen = sizeof(dbdata_tls_session) + len;
3565 dbdata_tls_session * dt = store_get(dlen, TRUE);
3566 uschar * s = dt->session;
3567 open_db dbblock, * dbm_file;
3569 DEBUG(D_tls) debug_printf("session is resumable\n");
3570 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3572 dt->verify_override = tlsp->verify_override;
3573 dt->ocsp = tlsp->ocsp;
3574 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3576 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3578 const uschar * key = cbinfo->host->address;
3579 dbfn_delete(dbm_file, key);
3580 dbfn_write(dbm_file, key, dt, dlen);
3581 dbfn_close(dbm_file);
3582 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3591 tls_client_ctx_resume_prehandshake(
3592 exim_openssl_client_tls_ctx * exim_client_ctx, tls_support * tlsp,
3593 smtp_transport_options_block * ob, host_item * host)
3595 /* Should the client request a session resumption ticket? */
3596 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3598 tlsp->host_resumable = TRUE;
3600 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3601 SSL_SESS_CACHE_CLIENT
3602 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3603 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3608 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3609 host_item * host, uschar ** errstr)
3611 if (tlsp->host_resumable)
3614 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3615 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3617 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3618 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
3620 tls_error(US"set ex_data", host, NULL, errstr);
3623 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state);
3626 tlsp->resumption = RESUME_SUPPORTED;
3627 /* Pick up a previous session, saved on an old ticket */
3628 tls_retrieve_session(tlsp, ssl, host->address);
3633 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
3636 if (SSL_session_reused(exim_client_ctx->ssl))
3638 DEBUG(D_tls) debug_printf("The session was reused\n");
3639 tlsp->resumption |= RESUME_USED;
3642 #endif /* !DISABLE_TLS_RESUME */
3645 #ifdef EXIM_HAVE_ALPN
3646 /* Expand and convert an Exim list to an ALPN list. False return for fail.
3647 NULL plist return for silent no-ALPN.
3651 tls_alpn_plist(const uschar * tls_alpn, const uschar ** plist, unsigned * plen,
3656 if (!expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr))
3661 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
3666 /* The server implementation only accepts exactly one protocol name
3667 but it's little extra code complexity in the client. */
3669 const uschar * list = exp_alpn;
3670 uschar * p = store_get(Ustrlen(exp_alpn), is_tainted(exp_alpn)), * s, * t;
3674 for (t = p; s = string_nextinlist(&list, &sep, NULL, 0); t += len)
3676 *t++ = len = (uschar) Ustrlen(s);
3679 *plist = (*plen = t - p) ? p : NULL;
3683 #endif /* EXIM_HAVE_ALPN */
3686 /*************************************************
3687 * Start a TLS session in a client *
3688 *************************************************/
3690 /* Called from the smtp transport after STARTTLS has been accepted.
3693 cctx connection context
3694 conn_args connection details
3695 cookie datum for randomness; can be NULL
3696 tlsp record details of TLS channel configuration here; must be non-NULL
3697 errstr error string pointer
3699 Returns: TRUE for success with TLS session context set in connection context,
3704 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3705 void * cookie, tls_support * tlsp, uschar ** errstr)
3707 host_item * host = conn_args->host; /* for msgs and option-tests */
3708 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3709 smtp_transport_options_block * ob = tb
3710 ? (smtp_transport_options_block *)tb->options_block
3711 : &smtp_transport_option_defaults;
3712 exim_openssl_client_tls_ctx * exim_client_ctx;
3713 uschar * expciphers;
3715 static uschar peerdn[256];
3717 #ifndef DISABLE_OCSP
3718 BOOL request_ocsp = FALSE;
3719 BOOL require_ocsp = FALSE;
3723 store_pool = POOL_PERM;
3724 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), FALSE);
3725 exim_client_ctx->corked = NULL;
3729 tlsp->tlsa_usage = 0;
3732 #ifndef DISABLE_OCSP
3734 # ifdef SUPPORT_DANE
3735 /*XXX this should be moved to caller, to be common across gnutls/openssl */
3736 if ( conn_args->dane
3737 && ob->hosts_request_ocsp[0] == '*'
3738 && ob->hosts_request_ocsp[1] == '\0'
3741 /* Unchanged from default. Use a safer one under DANE */
3742 request_ocsp = TRUE;
3743 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3744 " {= {4}{$tls_out_tlsa_usage}} } "
3750 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
3751 request_ocsp = TRUE;
3753 # ifdef SUPPORT_DANE
3757 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3761 rc = tls_init(host, ob,
3762 #ifndef DISABLE_OCSP
3763 (void *)(long)request_ocsp,
3765 cookie, &client_static_state, tlsp, errstr);
3766 if (rc != OK) return FALSE;
3768 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
3770 tlsp->certificate_verified = FALSE;
3771 client_verify_callback_called = FALSE;
3775 if (conn_args->dane)
3777 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3778 other failures should be treated as problems. */
3779 if (ob->dane_require_tls_ciphers &&
3780 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3781 &expciphers, errstr))
3783 if (expciphers && *expciphers == '\0')
3788 !expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
3789 &expciphers, errstr))
3792 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3793 are separated by underscores. So that I can use either form in my tests, and
3794 also for general convenience, we turn underscores into hyphens here. */
3798 uschar *s = expciphers;
3799 while (*s) { if (*s == '_') *s = '-'; s++; }
3800 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
3801 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
3803 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
3809 if (conn_args->dane)
3811 SSL_CTX_set_verify(exim_client_ctx->ctx,
3812 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
3813 verify_callback_client_dane);
3815 if (!DANESSL_library_init())
3817 tls_error(US"library init", host, NULL, errstr);
3820 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
3822 tls_error(US"context init", host, NULL, errstr);
3830 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
3831 client_static_state, errstr) != OK)
3834 #ifndef DISABLE_TLS_RESUME
3835 tls_client_ctx_resume_prehandshake(exim_client_ctx, tlsp, ob, host);
3839 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
3841 tls_error(US"SSL_new", host, NULL, errstr);
3844 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
3846 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
3847 SSL_set_connect_state(exim_client_ctx->ssl);
3851 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
3855 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
3857 else if (!Ustrlen(tlsp->sni))
3861 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
3862 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
3863 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
3865 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
3872 #ifdef EXIM_HAVE_ALPN
3874 const uschar * plist;
3877 if (!tls_alpn_plist(ob->tls_alpn, &plist, &plen, errstr))
3880 if (SSL_set_alpn_protos(exim_client_ctx->ssl, plist, plen) != 0)
3882 tls_error(US"alpn init", host, NULL, errstr);
3886 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
3889 log_write(0, LOG_MAIN, "ALPN unusable with this OpenSSL library version; ignoring \"%s\"\n",
3894 if (conn_args->dane)
3895 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
3899 #ifndef DISABLE_OCSP
3900 /* Request certificate status at connection-time. If the server
3901 does OCSP stapling we will get the callback (set in tls_init()) */
3902 # ifdef SUPPORT_DANE
3906 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3907 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3909 { /* Re-eval now $tls_out_tlsa_usage is populated. If
3910 this means we avoid the OCSP request, we wasted the setup
3911 cost in tls_init(). */
3912 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3913 request_ocsp = require_ocsp
3914 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3921 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
3922 client_static_state->u_ocsp.client.verify_required = require_ocsp;
3923 tlsp->ocsp = OCSP_NOT_RESP;
3927 #ifndef DISABLE_TLS_RESUME
3928 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
3933 #ifndef DISABLE_EVENT
3934 client_static_state->event_action = tb ? tb->event_action : NULL;
3937 /* There doesn't seem to be a built-in timeout on connection. */
3939 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
3940 sigalrm_seen = FALSE;
3941 ALARM(ob->command_timeout);
3942 rc = SSL_connect(exim_client_ctx->ssl);
3946 if (conn_args->dane)
3947 DANESSL_cleanup(exim_client_ctx->ssl);
3952 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
3958 debug_printf("SSL_connect succeeded\n");
3959 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3961 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
3962 SSL_SESSION_print_keylog(bp, SSL_get_session(exim_client_ctx->ssl));
3968 #ifndef DISABLE_TLS_RESUME
3969 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
3972 #ifdef EXIM_HAVE_ALPN
3973 if (ob->tls_alpn) /* We requested. See what was negotiated. */
3975 const uschar * name;
3978 SSL_get0_alpn_selected(exim_client_ctx->ssl, &name, &len);
3980 { DEBUG(D_tls) debug_printf("ALPN negotiated %u: '%.*s'\n", len, (int)*name, name+1); }
3981 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
3983 /* Would like to send a relevant fatal Alert, but OpenSSL has no API */
3984 tls_error(US"handshake", host, US"ALPN required but not negotiated", errstr);
3990 #ifdef SSL_get_extms_support
3991 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
3993 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
3995 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
3996 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
3997 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
3999 /* Record the certificate we presented */
4001 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
4002 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
4005 /*XXX will this work with continued-TLS? */
4006 /* Channel-binding info for authenticators */
4009 size_t len = SSL_get_finished(exim_client_ctx->ssl, &c, 0);
4010 int old_pool = store_pool;
4012 SSL_get_finished(exim_client_ctx->ssl, s = store_get((int)len, TRUE), len);
4013 store_pool = POOL_PERM;
4014 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, TRUE);
4015 store_pool = old_pool;
4016 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
4019 tlsp->active.sock = cctx->sock;
4020 tlsp->active.tls_ctx = exim_client_ctx;
4021 cctx->tls_ctx = exim_client_ctx;
4030 tls_refill(unsigned lim)
4032 SSL * ssl = state_server.lib_state.lib_ssl;
4036 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4037 ssl_xfer_buffer, ssl_xfer_buffer_size);
4040 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4041 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
4042 MIN(ssl_xfer_buffer_size, lim));
4043 error = SSL_get_error(ssl, inbytes);
4044 if (smtp_receive_timeout > 0) ALARM_CLR(0);
4046 if (had_command_timeout) /* set by signal handler */
4047 smtp_command_timeout_exit(); /* does not return */
4048 if (had_command_sigterm)
4049 smtp_command_sigterm_exit();
4050 if (had_data_timeout)
4051 smtp_data_timeout_exit();
4052 if (had_data_sigint)
4053 smtp_data_sigint_exit();
4055 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
4056 closed down, not that the socket itself has been closed down. Revert to
4057 non-SSL handling. */
4061 case SSL_ERROR_NONE:
4064 case SSL_ERROR_ZERO_RETURN:
4065 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4067 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
4070 tls_close(NULL, TLS_NO_SHUTDOWN);
4073 /* Handle genuine errors */
4075 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4076 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
4077 ssl_xfer_error = TRUE;
4081 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
4082 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
4083 debug_printf(" - syscall %s\n", strerror(errno));
4084 ssl_xfer_error = TRUE;
4088 #ifndef DISABLE_DKIM
4089 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
4091 ssl_xfer_buffer_hwm = inbytes;
4092 ssl_xfer_buffer_lwm = 0;
4097 /*************************************************
4098 * TLS version of getc *
4099 *************************************************/
4101 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
4102 it refills the buffer via the SSL reading function.
4104 Arguments: lim Maximum amount to read/buffer
4105 Returns: the next character or EOF
4107 Only used by the server-side TLS.
4111 tls_getc(unsigned lim)
4113 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4114 if (!tls_refill(lim))
4115 return ssl_xfer_error ? EOF : smtp_getc(lim);
4117 /* Something in the buffer; return next uschar */
4119 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
4123 tls_getbuf(unsigned * len)
4128 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4129 if (!tls_refill(*len))
4131 if (!ssl_xfer_error) return smtp_getbuf(len);
4136 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4138 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4139 ssl_xfer_buffer_lwm += size;
4148 #ifndef DISABLE_DKIM
4149 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4151 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4157 tls_could_read(void)
4159 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4160 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4164 /*************************************************
4165 * Read bytes from TLS channel *
4166 *************************************************/
4170 ct_ctx client context pointer, or NULL for the one global server context
4174 Returns: the number of bytes read
4175 -1 after a failed read, including EOF
4177 Only used by the client-side TLS.
4181 tls_read(void * ct_ctx, uschar *buff, size_t len)
4183 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4184 : state_server.lib_state.lib_ssl;
4188 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4189 buff, (unsigned int)len);
4192 inbytes = SSL_read(ssl, CS buff, len);
4193 error = SSL_get_error(ssl, inbytes);
4195 if (error == SSL_ERROR_ZERO_RETURN)
4197 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4200 else if (error != SSL_ERROR_NONE)
4210 /*************************************************
4211 * Write bytes down TLS channel *
4212 *************************************************/
4216 ct_ctx client context pointer, or NULL for the one global server context
4219 more further data expected soon
4221 Returns: the number of bytes after a successful write,
4222 -1 after a failed write
4224 Used by both server-side and client-side TLS. Calling with len zero and more unset
4225 will flush buffered writes; buff can be null for this case.
4229 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4232 int outbytes, error;
4234 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4235 : state_server.lib_state.lib_ssl;
4236 static gstring * server_corked = NULL;
4237 gstring ** corkedp = ct_ctx
4238 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4239 gstring * corked = *corkedp;
4241 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4242 buff, (unsigned long)len, more ? ", more" : "");
4244 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4245 "more" is notified. This hack is only ok if small amounts are involved AND only
4246 one stream does it, in one context (i.e. no store reset). Currently it is used
4247 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4248 We support callouts done by the server process by using a separate client
4249 context for the stashed information. */
4250 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4251 a store reset there, so use POOL_PERM. */
4252 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4256 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4258 int save_pool = store_pool;
4259 store_pool = POOL_PERM;
4261 corked = string_catn(corked, buff, len);
4263 store_pool = save_pool;
4270 buff = CUS corked->s;
4275 for (int left = len; left > 0;)
4277 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4279 outbytes = SSL_write(ssl, CS buff, left);
4280 error = SSL_get_error(ssl, outbytes);
4281 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4284 case SSL_ERROR_NONE: /* the usual case */
4290 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4291 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4294 case SSL_ERROR_ZERO_RETURN:
4295 log_write(0, LOG_MAIN, "SSL channel closed on write");
4298 case SSL_ERROR_SYSCALL:
4299 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4300 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4301 sender_fullhost ? sender_fullhost : US"<unknown>",
4303 else if (LOGGING(protocol_detail))
4304 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4305 " SMTP response and TLS close\n", sender_host_address);
4307 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4308 " client reset TCP before TLS close\n", sender_host_address);
4312 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4323 ct_ctx client TLS context pointer, or NULL for the one global server context
4327 tls_shutdown_wr(void * ct_ctx)
4329 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4330 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4331 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4334 if (*fdp < 0) return; /* TLS was not active */
4336 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4338 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
4339 rc = SSL_shutdown(*sslp);
4340 if (rc < 0) DEBUG(D_tls)
4342 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4343 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4347 /*************************************************
4348 * Close down a TLS session *
4349 *************************************************/
4351 /* This is also called from within a delivery subprocess forked from the
4352 daemon, to shut down the TLS library, without actually doing a shutdown (which
4353 would tamper with the SSL session in the parent process).
4356 ct_ctx client TLS context pointer, or NULL for the one global server context
4357 do_shutdown 0 no data-flush or TLS close-alert
4358 1 if TLS close-alert is to be sent,
4359 2 if also response to be waited for
4363 Used by both server-side and client-side TLS.
4367 tls_close(void * ct_ctx, int do_shutdown)
4369 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4370 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4371 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4373 if (*fdp < 0) return; /* TLS was not active */
4378 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4379 do_shutdown > 1 ? " (with response-wait)" : "");
4381 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4383 if ( (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4387 rc = SSL_shutdown(*sslp); /* wait for response */
4391 if (rc < 0) DEBUG(D_tls)
4393 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4394 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4398 if (!o_ctx) /* server side */
4400 #ifndef DISABLE_OCSP
4401 sk_X509_pop_free(state_server.verify_stack, X509_free);
4402 state_server.verify_stack = NULL;
4405 receive_getc = smtp_getc;
4406 receive_getbuf = smtp_getbuf;
4407 receive_get_cache = smtp_get_cache;
4408 receive_ungetc = smtp_ungetc;
4409 receive_feof = smtp_feof;
4410 receive_ferror = smtp_ferror;
4411 receive_smtp_buffered = smtp_buffered;
4412 tls_in.active.tls_ctx = NULL;
4414 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4425 /*************************************************
4426 * Let tls_require_ciphers be checked at startup *
4427 *************************************************/
4429 /* The tls_require_ciphers option, if set, must be something which the
4432 Returns: NULL on success, or error message
4436 tls_validate_require_cipher(void)
4439 uschar *s, *expciphers, *err;
4443 if (!(tls_require_ciphers && *tls_require_ciphers))
4446 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4448 return US"failed to expand tls_require_ciphers";
4450 if (!(expciphers && *expciphers))
4453 /* normalisation ripped from above */
4455 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
4459 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4462 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4464 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4466 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4467 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4468 expciphers, ssl_errstring);
4479 /*************************************************
4480 * Report the library versions. *
4481 *************************************************/
4483 /* There have historically been some issues with binary compatibility in
4484 OpenSSL libraries; if Exim (like many other applications) is built against
4485 one version of OpenSSL but the run-time linker picks up another version,
4486 it can result in serious failures, including crashing with a SIGSEGV. So
4487 report the version found by the compiler and the run-time version.
4489 Note: some OS vendors backport security fixes without changing the version
4490 number/string, and the version date remains unchanged. The _build_ date
4491 will change, so we can more usefully assist with version diagnosis by also
4492 reporting the build date.
4494 Arguments: a FILE* to print the results to
4499 tls_version_report(FILE *f)
4501 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
4504 OPENSSL_VERSION_TEXT,
4505 SSLeay_version(SSLEAY_VERSION),
4506 SSLeay_version(SSLEAY_BUILT_ON));
4507 /* third line is 38 characters for the %s and the line is 73 chars long;
4508 the OpenSSL output includes a "built on: " prefix already. */
4514 /*************************************************
4515 * Random number generation *
4516 *************************************************/
4518 /* Pseudo-random number generation. The result is not expected to be
4519 cryptographically strong but not so weak that someone will shoot themselves
4520 in the foot using it as a nonce in input in some email header scheme or
4521 whatever weirdness they'll twist this into. The result should handle fork()
4522 and avoid repeating sequences. OpenSSL handles that for us.
4526 Returns a random number in range [0, max-1]
4530 vaguely_random_number(int max)
4534 static pid_t pidlast = 0;
4536 uschar smallbuf[sizeof(r)];
4542 if (pidnow != pidlast)
4544 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
4545 is unique for each thread", this doesn't apparently apply across processes,
4546 so our own warning from vaguely_random_number_fallback() applies here too.
4547 Fix per PostgreSQL. */
4553 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
4557 gettimeofday(&r.tv, NULL);
4560 RAND_seed(US (&r), sizeof(r));
4562 /* We're after pseudo-random, not random; if we still don't have enough data
4563 in the internal PRNG then our options are limited. We could sleep and hope
4564 for entropy to come along (prayer technique) but if the system is so depleted
4565 in the first place then something is likely to just keep taking it. Instead,
4566 we'll just take whatever little bit of pseudo-random we can still manage to
4569 needed_len = sizeof(r);
4570 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4571 asked for a number less than 10. */
4572 for (r = max, i = 0; r; ++i)
4578 #ifdef EXIM_HAVE_RAND_PSEUDO
4579 /* We do not care if crypto-strong */
4580 i = RAND_pseudo_bytes(smallbuf, needed_len);
4582 i = RAND_bytes(smallbuf, needed_len);
4588 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
4589 return vaguely_random_number_fallback(max);
4593 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4596 /* We don't particularly care about weighted results; if someone wants
4597 smooth distribution and cares enough then they should submit a patch then. */
4604 /*************************************************
4605 * OpenSSL option parse *
4606 *************************************************/
4608 /* Parse one option for tls_openssl_options_parse below
4611 name one option name
4612 value place to store a value for it
4613 Returns success or failure in parsing
4619 tls_openssl_one_option_parse(uschar *name, long *value)
4622 int last = exim_openssl_options_size;
4623 while (last > first)
4625 int middle = (first + last)/2;
4626 int c = Ustrcmp(name, exim_openssl_options[middle].name);
4629 *value = exim_openssl_options[middle].value;
4643 /*************************************************
4644 * OpenSSL option parsing logic *
4645 *************************************************/
4647 /* OpenSSL has a number of compatibility options which an administrator might
4648 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
4649 we look like log_selector.
4652 option_spec the administrator-supplied string of options
4653 results ptr to long storage for the options bitmap
4654 Returns success or failure
4658 tls_openssl_options_parse(uschar *option_spec, long *results)
4661 uschar * exp, * end;
4662 BOOL adding, item_parsed;
4664 /* Server: send no (<= TLS1.2) session tickets */
4665 result = SSL_OP_NO_TICKET;
4667 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
4668 from default because it increases BEAST susceptibility. */
4669 #ifdef SSL_OP_NO_SSLv2
4670 result |= SSL_OP_NO_SSLv2;
4672 #ifdef SSL_OP_NO_SSLv3
4673 result |= SSL_OP_NO_SSLv3;
4675 #ifdef SSL_OP_SINGLE_DH_USE
4676 result |= SSL_OP_SINGLE_DH_USE;
4678 #ifdef SSL_OP_NO_RENEGOTIATION
4679 result |= SSL_OP_NO_RENEGOTIATION;
4688 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
4691 for (uschar * s = exp; *s; /**/)
4693 while (isspace(*s)) ++s;
4696 if (*s != '+' && *s != '-')
4698 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
4699 "+ or - expected but found \"%s\"\n", s);
4702 adding = *s++ == '+';
4703 for (end = s; *end && !isspace(*end); ) end++;
4704 item_parsed = tls_openssl_one_option_parse(string_copyn(s, end-s), &item);
4707 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
4710 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
4711 adding ? "adding to " : "removing from", result, item, s);
4723 #endif /*!MACRO_PREDEF*/
4726 /* End of tls-openssl.c */