1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2019 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Portions Copyright (c) The OpenSSL Project 1999 */
11 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
12 library. It is #included into the tls.c file when that library is used. The
13 code herein is based on a patch that was originally contributed by Steve
14 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
16 No cryptographic code is included in Exim. All this module does is to call
17 functions from the OpenSSL library. */
22 #include <openssl/lhash.h>
23 #include <openssl/ssl.h>
24 #include <openssl/err.h>
25 #include <openssl/rand.h>
26 #ifndef OPENSSL_NO_ECDH
27 # include <openssl/ec.h>
30 # include <openssl/ocsp.h>
38 # define EXIM_OCSP_SKEW_SECONDS (300L)
39 # define EXIM_OCSP_MAX_AGE (-1L)
42 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
43 # define EXIM_HAVE_OPENSSL_TLSEXT
45 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
46 # define EXIM_HAVE_RSA_GENKEY_EX
48 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
49 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define EXIM_HAVE_SSL_GET0_VERIFIED_CHAIN
51 # define OPENSSL_AUTO_SHA256
52 # define OPENSSL_MIN_PROTO_VERSION
54 # define EXIM_HAVE_EPHEM_RSA_KEX
55 # define EXIM_HAVE_RAND_PSEUDO
57 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
58 # define EXIM_HAVE_SHA256
61 /* X509_check_host provides sane certificate hostname checking, but was added
62 to OpenSSL late, after other projects forked off the code-base. So in
63 addition to guarding against the base version number, beware that LibreSSL
64 does not (at this time) support this function.
66 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
67 opt to disentangle and ask a LibreSSL user to provide glue for a third
68 crypto provider for libtls instead of continuing to tie the OpenSSL glue
69 into even twistier knots. If LibreSSL gains the same API, we can just
70 change this guard and punt the issue for a while longer. */
72 #ifndef LIBRESSL_VERSION_NUMBER
73 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
74 # define EXIM_HAVE_OPENSSL_CHECKHOST
75 # define EXIM_HAVE_OPENSSL_DH_BITS
76 # define EXIM_HAVE_OPENSSL_TLS_METHOD
77 # define EXIM_HAVE_OPENSSL_KEYLOG
78 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
79 # define EXIM_HAVE_SESSION_TICKET
80 # define EXIM_HAVE_OPESSL_TRACE
81 # define EXIM_HAVE_OPESSL_GET0_SERIAL
82 # define EXIM_HAVE_OPESSL_OCSP_RESP_GET0_CERTS
84 # define EXIM_HAVE_OCSP
86 # define EXIM_HAVE_ALPN /* fail ret from hshake-cb is ignored by LibreSSL */
88 # define EXIM_NEED_OPENSSL_INIT
90 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
91 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
92 # define EXIM_HAVE_OPENSSL_CHECKHOST
96 #if LIBRESSL_VERSION_NUMBER >= 0x3040000fL
97 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
100 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x030000000L)
101 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
102 # define EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
105 #if !defined(LIBRESSL_VERSION_NUMBER) \
106 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
107 # if !defined(OPENSSL_NO_ECDH)
108 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
109 # define EXIM_HAVE_ECDH
111 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
112 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
117 #ifndef LIBRESSL_VERSION_NUMBER
118 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
119 # define OPENSSL_HAVE_KEYLOG_CB
120 # define OPENSSL_HAVE_NUM_TICKETS
121 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
122 # define EXIM_HAVE_EXP_CHNL_BNGNG
123 # define EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER
125 # define OPENSSL_BAD_SRVR_OURCERT
129 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x010002000L)
130 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
133 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
134 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
135 # define DISABLE_OCSP
138 #ifndef DISABLE_TLS_RESUME
139 # if OPENSSL_VERSION_NUMBER < 0x0101010L
140 # error OpenSSL version too old for session-resumption
144 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
145 # include <openssl/x509v3.h>
148 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
149 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
150 # define SSL_CIPHER_get_id(c) (c->id)
152 # ifndef MACRO_PREDEF
153 # include "tls-cipher-stdname.c"
157 /*************************************************
158 * OpenSSL option parse *
159 *************************************************/
161 typedef struct exim_openssl_option {
164 } exim_openssl_option;
165 /* We could use a macro to expand, but we need the ifdef and not all the
166 options document which version they were introduced in. Policylet: include
167 all options unless explicitly for DTLS, let the administrator choose which
170 This list is current as of:
173 XXX could we autobuild this list, as with predefined-macros?
174 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
175 Also allow a numeric literal?
177 static exim_openssl_option exim_openssl_options[] = {
178 /* KEEP SORTED ALPHABETICALLY! */
180 { US"all", (long) SSL_OP_ALL },
182 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
183 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
185 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
186 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
188 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
189 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
191 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
192 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
194 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
195 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
197 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
198 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
200 #ifdef SSL_OP_EPHEMERAL_RSA
201 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
203 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
204 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
206 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
207 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
209 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
210 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
212 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
213 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
215 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
216 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
218 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
219 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
221 #ifdef SSL_OP_NO_ANTI_REPLAY
222 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
224 #ifdef SSL_OP_NO_COMPRESSION
225 { US"no_compression", SSL_OP_NO_COMPRESSION },
227 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
228 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
230 #ifdef SSL_OP_NO_RENEGOTIATION
231 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
233 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
234 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
236 #ifdef SSL_OP_NO_SSLv2
237 { US"no_sslv2", SSL_OP_NO_SSLv2 },
239 #ifdef SSL_OP_NO_SSLv3
240 { US"no_sslv3", SSL_OP_NO_SSLv3 },
242 #ifdef SSL_OP_NO_TICKET
243 { US"no_ticket", SSL_OP_NO_TICKET },
245 #ifdef SSL_OP_NO_TLSv1
246 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
248 #ifdef SSL_OP_NO_TLSv1_1
249 # if OPENSSL_VERSION_NUMBER < 0x30000000L
250 # if SSL_OP_NO_TLSv1_1 == 0x00000400L
251 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
252 # warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
253 # define NO_SSL_OP_NO_TLSv1_1
256 # ifndef NO_SSL_OP_NO_TLSv1_1
257 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
260 #ifdef SSL_OP_NO_TLSv1_2
261 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
263 #ifdef SSL_OP_NO_TLSv1_3
264 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
266 #ifdef SSL_OP_PRIORITIZE_CHACHA
267 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
269 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
270 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
272 #ifdef SSL_OP_SINGLE_DH_USE
273 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
275 #ifdef SSL_OP_SINGLE_ECDH_USE
276 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
278 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
279 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
281 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
282 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
284 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
285 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
287 #ifdef SSL_OP_TLS_D5_BUG
288 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
290 #ifdef SSL_OP_TLS_ROLLBACK_BUG
291 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
293 #ifdef SSL_OP_TLSEXT_PADDING
294 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
299 static int exim_openssl_options_size = nelem(exim_openssl_options);
300 static long init_options = 0;
309 for (struct exim_openssl_option * o = exim_openssl_options;
310 o < exim_openssl_options + nelem(exim_openssl_options); o++)
312 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
313 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
315 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
316 builtin_macro_create(buf);
319 # ifndef DISABLE_TLS_RESUME
320 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
322 # ifdef SSL_OP_NO_TLSv1_3
323 builtin_macro_create(US"_HAVE_TLS1_3");
325 # ifdef OPENSSL_BAD_SRVR_OURCERT
326 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
328 # ifdef EXIM_HAVE_OCSP
329 builtin_macro_create(US"_HAVE_TLS_OCSP");
330 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
332 # ifdef EXIM_HAVE_ALPN
333 builtin_macro_create(US"_HAVE_TLS_ALPN");
338 /******************************************************************************/
340 /* Structure for collecting random data for seeding. */
342 typedef struct randstuff {
347 /* Local static variables */
349 static BOOL client_verify_callback_called = FALSE;
350 static BOOL server_verify_callback_called = FALSE;
351 static const uschar *sid_ctx = US"exim";
353 /* We have three different contexts to care about.
355 Simple case: client, `client_ctx`
356 As a client, we can be doing a callout or cut-through delivery while receiving
357 a message. So we have a client context, which should have options initialised
358 from the SMTP Transport. We may also concurrently want to make TLS connections
359 to utility daemons, so client-contexts are allocated and passed around in call
360 args rather than using a gobal.
363 There are two cases: with and without ServerNameIndication from the client.
364 Given TLS SNI, we can be using different keys, certs and various other
365 configuration settings, because they're re-expanded with $tls_sni set. This
366 allows vhosting with TLS. This SNI is sent in the handshake.
367 A client might not send SNI, so we need a fallback, and an initial setup too.
368 So as a server, we start out using `server_ctx`.
369 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
370 `server_sni` from `server_ctx` and then initialise settings by re-expanding
378 } exim_openssl_client_tls_ctx;
381 /* static SSL_CTX *server_ctx = NULL; */
382 /* static SSL *server_ssl = NULL; */
384 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
385 static SSL_CTX *server_sni = NULL;
387 #ifdef EXIM_HAVE_ALPN
388 static BOOL server_seen_alpn = FALSE;
391 static char ssl_errstring[256];
393 static int ssl_session_timeout = 7200; /* Two hours */
394 static BOOL client_verify_optional = FALSE;
395 static BOOL server_verify_optional = FALSE;
397 static BOOL reexpand_tls_files_for_sni = FALSE;
400 typedef struct ocsp_resp {
401 struct ocsp_resp * next;
402 OCSP_RESPONSE * resp;
405 typedef struct exim_openssl_state {
406 exim_tlslib_state lib_state;
407 #define lib_ctx libdata0
408 #define lib_ssl libdata1
411 uschar * certificate;
418 const uschar *file_expanded;
419 ocsp_resplist *olist;
420 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
423 X509_STORE *verify_store; /* non-null if status requested */
424 uschar *verify_errstr; /* only if _required */
425 BOOL verify_required;
430 /* these are cached from first expand */
431 uschar * server_cipher_list;
432 /* only passed down to tls_error: */
434 const uschar * verify_cert_hostnames;
435 #ifndef DISABLE_EVENT
436 uschar * event_action;
438 } exim_openssl_state_st;
440 /* should figure out a cleanup of API to handle state preserved per
441 implementation, for various reasons, which can be void * in the APIs.
442 For now, we hack around it. */
443 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
444 exim_openssl_state_st state_server = {.is_server = TRUE};
447 setup_certs(SSL_CTX * sctx, uschar ** certs, uschar * crl, host_item * host,
452 static int tls_server_stapling_cb(SSL *s, void *arg);
453 static void x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk);
454 static void x509_store_dump_cert_s_names(X509_STORE * store);
459 /* Daemon-called, before every connection, key create/rotate */
460 #ifndef DISABLE_TLS_RESUME
461 static void tk_init(void);
462 static int tls_exdata_idx = -1;
466 tls_per_lib_daemon_tick(void)
468 #ifndef DISABLE_TLS_RESUME
473 /* Called once at daemon startup */
476 tls_per_lib_daemon_init(void)
478 tls_daemon_creds_reload();
482 /*************************************************
484 *************************************************/
486 /* Called from lots of places when errors occur before actually starting to do
487 the TLS handshake, that is, while the session is still in clear. Always returns
488 DEFER for a server and FAIL for a client so that most calls can use "return
489 tls_error(...)" to do this processing and then give an appropriate return. A
490 single function is used for both server and client, because it is called from
491 some shared functions.
494 prefix text to include in the logged error
495 host NULL if setting up a server;
496 the connected host if setting up a client
497 msg error message or NULL if we should ask OpenSSL
498 errstr pointer to output error message
500 Returns: OK/DEFER/FAIL
504 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
508 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
509 msg = US ssl_errstring;
512 msg = string_sprintf("(%s): %s", prefix, msg);
513 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
514 if (errstr) *errstr = msg;
515 return host ? FAIL : DEFER;
520 /**************************************************
521 * General library initalisation *
522 **************************************************/
525 lib_rand_init(void * addr)
528 if (!RAND_status()) return TRUE;
530 gettimeofday(&r.tv, NULL);
532 RAND_seed(US (&r), sizeof(r));
533 RAND_seed(US big_buffer, big_buffer_size);
534 if (addr) RAND_seed(US addr, sizeof(addr));
536 return RAND_status();
541 tls_openssl_init(void)
543 static BOOL once = FALSE;
547 #ifdef EXIM_NEED_OPENSSL_INIT
548 SSL_load_error_strings(); /* basic set up */
549 OpenSSL_add_ssl_algorithms();
552 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
553 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
554 list of available digests. */
555 EVP_add_digest(EVP_sha256());
558 (void) lib_rand_init(NULL);
559 (void) tls_openssl_options_parse(openssl_options, &init_options);
564 /*************************************************
565 * Initialize for DH *
566 *************************************************/
568 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
572 sctx The current SSL CTX (inbound or outbound)
573 dhparam DH parameter file or fixed parameter identity string
574 errstr error string pointer
576 Returns: TRUE if OK (nothing to set up, or setup worked)
580 init_dh(SSL_CTX * sctx, uschar * dhparam, uschar ** errstr)
583 #if OPENSSL_VERSION_NUMBER < 0x30000000L
592 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
595 if (!dhexpanded || !*dhexpanded)
596 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
597 else if (dhexpanded[0] == '/')
599 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
601 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
602 NULL, US strerror(errno), errstr);
608 if (Ustrcmp(dhexpanded, "none") == 0)
610 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
614 if (!(pem = std_dh_prime_named(dhexpanded)))
616 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
617 NULL, US strerror(errno), errstr);
620 bio = BIO_new_mem_buf(CS pem, -1);
624 #if OPENSSL_VERSION_NUMBER < 0x30000000L
625 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)
627 pkey = PEM_read_bio_Parameters_ex(bio, NULL, NULL, NULL)
632 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
637 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
638 an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with 2236.
639 But older OpenSSL can only report in bytes (octets), not bits. If someone wants
640 to dance at the edge, then they can raise the limit or use current libraries. */
642 #if OPENSSL_VERSION_NUMBER < 0x30000000L
643 # ifdef EXIM_HAVE_OPENSSL_DH_BITS
644 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
645 This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
646 dh_bitsize = DH_bits(dh);
648 dh_bitsize = 8 * DH_size(dh);
651 dh_bitsize = EVP_PKEY_get_bits(pkey);
654 /* Even if it is larger, we silently return success rather than cause things to
655 fail out, so that a too-large DH will not knock out all TLS; it's a debatable
656 choice. Likewise for a failing attempt to set one. */
658 if (dh_bitsize <= tls_dh_max_bits)
661 #if OPENSSL_VERSION_NUMBER < 0x30000000L
662 SSL_CTX_set_tmp_dh(sctx, dh)
664 SSL_CTX_set0_tmp_dh_pkey(sctx, pkey)
668 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
669 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (D-H param setting '%s'): %s",
670 dhexpanded ? dhexpanded : US"default", ssl_errstring);
671 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
672 /* EVP_PKEY_free(pkey); crashes */
677 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
678 dhexpanded ? dhexpanded : US"default", dh_bitsize);
682 debug_printf("dhparams '%s' %d bits, is > tls_dh_max_bits limit of %d\n",
683 dhexpanded ? dhexpanded : US"default", dh_bitsize, tls_dh_max_bits);
685 #if OPENSSL_VERSION_NUMBER < 0x30000000L
688 /* The EVP_PKEY ownership stays with the ctx; do not free it */
697 /*************************************************
698 * Initialize for ECDH *
699 *************************************************/
701 /* Load parameters for ECDH encryption. Server only.
703 For now, we stick to NIST P-256 because: it's simple and easy to configure;
704 it avoids any patent issues that might bite redistributors; despite events in
705 the news and concerns over curve choices, we're not cryptographers, we're not
706 pretending to be, and this is "good enough" to be better than no support,
707 protecting against most adversaries. Given another year or two, there might
708 be sufficient clarity about a "right" way forward to let us make an informed
709 decision, instead of a knee-jerk reaction.
711 Longer-term, we should look at supporting both various named curves and
712 external files generated with "openssl ecparam", much as we do for init_dh().
713 We should also support "none" as a value, to explicitly avoid initialisation.
718 sctx The current SSL CTX (inbound or outbound)
719 errstr error string pointer
721 Returns: TRUE if OK (nothing to set up, or setup worked)
725 init_ecdh(SSL_CTX * sctx, uschar ** errstr)
727 #ifdef OPENSSL_NO_ECDH
735 # ifndef EXIM_HAVE_ECDH
737 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
741 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
743 if (!exp_curve || !*exp_curve)
746 /* "auto" needs to be handled carefully.
747 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
748 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
749 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
750 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
751 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
753 if (Ustrcmp(exp_curve, "auto") == 0)
755 #if OPENSSL_VERSION_NUMBER < 0x10002000L
756 DEBUG(D_tls) debug_printf(
757 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
758 exp_curve = US"prime256v1";
760 # if defined SSL_CTRL_SET_ECDH_AUTO
761 DEBUG(D_tls) debug_printf(
762 "ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n");
763 SSL_CTX_set_ecdh_auto(sctx, 1);
766 DEBUG(D_tls) debug_printf(
767 "ECDH OpenSSL 1.1.0+: temp key parameter settings: default selection\n");
773 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
774 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
775 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
776 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
780 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
785 # if OPENSSL_VERSION_NUMBER < 0x30000000L
788 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
790 tls_error(US"Unable to create ec curve", NULL, NULL, errstr);
794 /* The "tmp" in the name here refers to setting a temporary key
795 not to the stability of the interface. */
797 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
798 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), NULL, NULL, errstr);
800 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
804 #else /* v 3.0.0 + */
806 if ((rv = SSL_CTX_set1_groups(sctx, &nid, 1)) == 0)
807 tls_error(string_sprintf("Error enabling '%s' group", exp_curve), NULL, NULL, errstr);
809 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' group\n", exp_curve);
815 # endif /*EXIM_HAVE_ECDH*/
816 #endif /*OPENSSL_NO_ECDH*/
821 /*************************************************
822 * Expand key and cert file specs *
823 *************************************************/
825 #if OPENSSL_VERSION_NUMBER < 0x30000000L
828 s SSL connection (not used)
832 Returns: pointer to generated key
836 rsa_callback(SSL *s, int export, int keylength)
839 #ifdef EXIM_HAVE_RSA_GENKEY_EX
840 BIGNUM *bn = BN_new();
843 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
845 # ifdef EXIM_HAVE_RSA_GENKEY_EX
846 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
847 || !(rsa_key = RSA_new())
848 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
851 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
855 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
856 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
862 #endif /* pre-3.0.0 */
866 /* Create and install a selfsigned certificate, for use in server mode */
867 /*XXX we could arrange to call this during prelo for a null tls_certificate option.
868 The normal cache inval + relo will suffice.
869 Just need a timer for inval. */
872 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
879 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
880 where = US"allocating pkey";
881 if (!(pkey = EVP_PKEY_new()))
884 where = US"allocating cert";
885 if (!(x509 = X509_new()))
888 where = US"generating pkey";
889 #if OPENSSL_VERSION_NUMBER < 0x30000000L
892 if (!(rsa = rsa_callback(NULL, 0, 2048)))
895 where = US"assigning pkey";
896 if (!EVP_PKEY_assign_RSA(pkey, rsa))
900 pkey = EVP_RSA_gen(2048);
903 X509_set_version(x509, 2); /* N+1 - version 3 */
904 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
905 X509_gmtime_adj(X509_get_notBefore(x509), 0);
906 X509_gmtime_adj(X509_get_notAfter(x509), (long)2 * 60 * 60); /* 2 hour */
907 X509_set_pubkey(x509, pkey);
909 name = X509_get_subject_name(x509);
910 X509_NAME_add_entry_by_txt(name, "C",
911 MBSTRING_ASC, CUS "UK", -1, -1, 0);
912 X509_NAME_add_entry_by_txt(name, "O",
913 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
914 X509_NAME_add_entry_by_txt(name, "CN",
915 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
916 X509_set_issuer_name(x509, name);
918 where = US"signing cert";
919 if (!X509_sign(x509, pkey, EVP_md5()))
922 where = US"installing selfsign cert";
923 if (!SSL_CTX_use_certificate(sctx, x509))
926 where = US"installing selfsign key";
927 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
933 (void) tls_error(where, NULL, NULL, errstr);
934 if (x509) X509_free(x509);
935 if (pkey) EVP_PKEY_free(pkey);
945 /*************************************************
946 * Information callback *
947 *************************************************/
949 /* The SSL library functions call this from time to time to indicate what they
950 are doing. We copy the string to the debugging output when TLS debugging has
962 info_callback(SSL * s, int where, int ret)
968 if (where & SSL_ST_CONNECT) g = string_append_listele(g, ',', US"SSL_connect");
969 if (where & SSL_ST_ACCEPT) g = string_append_listele(g, ',', US"SSL_accept");
970 if (where & SSL_CB_LOOP) g = string_append_listele(g, ',', US"state_chg");
971 if (where & SSL_CB_EXIT) g = string_append_listele(g, ',', US"hshake_exit");
972 if (where & SSL_CB_READ) g = string_append_listele(g, ',', US"read");
973 if (where & SSL_CB_WRITE) g = string_append_listele(g, ',', US"write");
974 if (where & SSL_CB_ALERT) g = string_append_listele(g, ',', US"alert");
975 if (where & SSL_CB_HANDSHAKE_START) g = string_append_listele(g, ',', US"hshake_start");
976 if (where & SSL_CB_HANDSHAKE_DONE) g = string_append_listele(g, ',', US"hshake_done");
978 if (where & SSL_CB_LOOP)
979 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
980 else if (where & SSL_CB_ALERT)
981 debug_printf("SSL %s %s:%s\n", g->s,
982 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
983 else if (where & SSL_CB_EXIT)
986 debug_printf("SSL %s: %s in %s\n", g->s,
987 ret == 0 ? "failed" : "error", SSL_state_string_long(s));
989 else if (where & (SSL_CB_HANDSHAKE_START | SSL_CB_HANDSHAKE_DONE))
990 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
994 #ifdef OPENSSL_HAVE_KEYLOG_CB
996 keylog_callback(const SSL *ssl, const char *line)
1000 DEBUG(D_tls) debug_printf("%.200s\n", line);
1001 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
1002 if (!(fp = fopen(filename, "a"))) return;
1003 fprintf(fp, "%s\n", line);
1012 #ifndef DISABLE_EVENT
1014 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
1015 BOOL *calledp, const BOOL *optionalp, const uschar * what)
1021 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
1024 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
1025 old_cert = tlsp->peercert;
1026 tlsp->peercert = X509_dup(cert);
1027 /* NB we do not bother setting peerdn */
1028 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth), &errno)))
1030 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
1031 "depth=%d cert=%s: %s",
1032 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1033 what, depth, dn, yield);
1037 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
1038 return 1; /* reject (leaving peercert set) */
1040 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
1041 "(host in tls_try_verify_hosts)\n");
1042 tlsp->verify_override = TRUE;
1044 X509_free(tlsp->peercert);
1045 tlsp->peercert = old_cert;
1051 /*************************************************
1052 * Callback for verification *
1053 *************************************************/
1055 /* The SSL library does certificate verification if set up to do so. This
1056 callback has the current yes/no state is in "state". If verification succeeded,
1057 we set the certificate-verified flag. If verification failed, what happens
1058 depends on whether the client is required to present a verifiable certificate
1061 If verification is optional, we change the state to yes, but still log the
1062 verification error. For some reason (it really would help to have proper
1063 documentation of OpenSSL), this callback function then gets called again, this
1064 time with state = 1. We must take care not to set the private verified flag on
1065 the second time through.
1067 Note: this function is not called if the client fails to present a certificate
1068 when asked. We get here only if a certificate has been received. Handling of
1069 optional verification for this case is done when requesting SSL to verify, by
1070 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
1072 May be called multiple times for different issues with a certificate, even
1073 for a given "depth" in the certificate chain.
1076 preverify_ok current yes/no state as 1/0
1077 x509ctx certificate information.
1078 tlsp per-direction (client vs. server) support data
1079 calledp has-been-called flag
1080 optionalp verification-is-optional flag
1082 Returns: 0 if verification should fail, otherwise 1
1086 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1087 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1089 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1090 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1093 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1095 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1096 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1097 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1100 dn[sizeof(dn)-1] = '\0';
1102 tlsp->verify_override = FALSE;
1103 if (preverify_ok == 0)
1105 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1106 *verify_mode, sender_host_address)
1108 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1109 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1111 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1115 if (!tlsp->peercert)
1116 tlsp->peercert = X509_dup(cert); /* record failing cert */
1117 return 0; /* reject */
1119 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1120 "tls_try_verify_hosts)\n");
1121 tlsp->verify_override = TRUE;
1124 else if (depth != 0)
1126 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1127 #ifndef DISABLE_EVENT
1128 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1129 return 0; /* reject, with peercert set */
1134 const uschar * verify_cert_hostnames;
1136 if ( tlsp == &tls_out
1137 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1138 /* client, wanting hostname check */
1141 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1142 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1143 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1145 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1146 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1149 const uschar * list = verify_cert_hostnames;
1152 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1153 if ((rc = X509_check_host(cert, CCS name, 0,
1154 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1155 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1160 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1161 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1168 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1171 uschar * extra = verify_mode
1172 ? string_sprintf(" (during %c-verify for [%s])",
1173 *verify_mode, sender_host_address)
1175 log_write(0, LOG_MAIN,
1176 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1177 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1178 extra, dn, verify_cert_hostnames);
1182 if (!tlsp->peercert)
1183 tlsp->peercert = X509_dup(cert); /* record failing cert */
1184 return 0; /* reject */
1186 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1187 "tls_try_verify_hosts)\n");
1188 tlsp->verify_override = TRUE;
1192 #ifndef DISABLE_EVENT
1193 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1194 return 0; /* reject, with peercert set */
1197 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1198 *calledp ? "" : " authenticated", dn);
1202 return 1; /* accept, at least for this level */
1206 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1208 return verify_callback(preverify_ok, x509ctx, &tls_out,
1209 &client_verify_callback_called, &client_verify_optional);
1213 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1215 return verify_callback(preverify_ok, x509ctx, &tls_in,
1216 &server_verify_callback_called, &server_verify_optional);
1222 /* This gets called *by* the dane library verify callback, which interposes
1226 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1228 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1230 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1231 #ifndef DISABLE_EVENT
1232 BOOL dummy_called, optional = FALSE;
1235 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1237 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1238 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1239 deliver_host_address);
1242 dn[sizeof(dn)-1] = '\0';
1244 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1245 preverify_ok ? "ok":"BAD", depth, dn);
1247 #ifndef DISABLE_EVENT
1248 if (verify_event(&tls_out, cert, depth, dn,
1249 &dummy_called, &optional, US"DANE"))
1250 return 0; /* reject, with peercert set */
1253 if (preverify_ok == 1)
1254 tls_out.dane_verified = TRUE;
1257 int err = X509_STORE_CTX_get_error(x509ctx);
1259 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1260 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1263 return preverify_ok;
1266 #endif /*SUPPORT_DANE*/
1269 #ifndef DISABLE_OCSP
1271 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1273 BIO_printf(bp, "\t%s: ", str);
1274 ASN1_GENERALIZEDTIME_print(bp, time);
1278 /*************************************************
1279 * Load OCSP information into state *
1280 *************************************************/
1281 /* Called to load the server OCSP response from the given file into memory, once
1282 caller has determined this is needed. Checks validity. Debugs a message
1285 ASSUMES: single response, for single cert.
1288 state various parts of session state
1289 filename the filename putatively holding an OCSP response
1290 is_pem file is PEM format; otherwise is DER
1294 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1298 OCSP_RESPONSE * resp;
1299 OCSP_BASICRESP * basic_response;
1300 OCSP_SINGLERESP * single_response;
1301 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1302 STACK_OF(X509) * sk;
1303 int status, reason, i;
1306 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1308 if (!filename || !*filename) return;
1311 if (!(bio = BIO_new_file(CS filename, "rb")))
1313 log_write(0, LOG_MAIN|LOG_PANIC,
1314 "Failed to open OCSP response file \"%s\": %.100s",
1315 filename, ERR_reason_error_string(ERR_get_error()));
1321 uschar * data, * freep;
1324 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1326 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
1327 filename, ERR_reason_error_string(ERR_get_error()));
1331 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1332 OPENSSL_free(freep);
1335 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1340 log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
1341 filename, ERR_reason_error_string(ERR_get_error()));
1345 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1347 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1348 OCSP_response_status_str(status), status);
1354 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1355 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1360 if (!(basic_response = OCSP_response_get1_basic(resp)))
1363 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1367 sk = state->u_ocsp.server.verify_stack; /* set by setup_certs() / chain_from_pem_file() */
1369 /* May need to expose ability to adjust those flags?
1370 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1371 OCSP_TRUSTOTHER OCSP_NOINTERN */
1373 /* This does a partial verify (only the signer link, not the whole chain-to-CA)
1374 on the OCSP proof before we load it for serving up; possibly overkill -
1375 just date-checks might be nice enough.
1377 OCSP_basic_verify takes a "store" arg, but does not
1378 use it for the chain verification, when OCSP_NOVERIFY is set.
1379 The content from the wire "basic_response" and a cert-stack "sk" are all
1382 We have a stack, loaded in setup_certs() if tls_verify_certificates
1383 was a file (not a directory, or "system"). It is unfortunate we
1384 cannot used the connection context store, as that would neatly
1385 handle the "system" case too, but there seems to be no library
1386 function for getting a stack from a store.
1387 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1388 [ 3.0.0 - sk = X509_STORE_get1_all_certs(store) ]
1389 We do not free the stack since it could be needed a second time for
1392 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1393 be a public interface into the OpenSSL library (there's no manual entry) -
1394 (in 3.0.0 + is is public)
1395 But what with? We also use OCSP_basic_verify in the client stapling callback.
1396 And there we NEED it; we must verify that status... unless the
1397 library does it for us anyway? */
1399 if ((i = OCSP_basic_verify(basic_response, sk, NULL, OCSP_NOVERIFY)) < 0)
1403 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1404 debug_printf("OCSP response has bad signature: %s\n", US ssl_errstring);
1409 /* Here's the simplifying assumption: there's only one response, for the
1410 one certificate we use, and nothing for anything else in a chain. If this
1411 proves false, we need to extract a cert id from our issued cert
1412 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1413 right cert in the stack and then calls OCSP_single_get0_status()).
1415 I'm hoping to avoid reworking a bunch more of how we handle state here.
1417 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1420 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1423 debug_printf("Unable to get first response from OCSP basic response.\n");
1427 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1428 if (status != V_OCSP_CERTSTATUS_GOOD)
1430 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1431 OCSP_cert_status_str(status), status,
1432 OCSP_crl_reason_str(reason), reason);
1436 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1440 BIO * bp = BIO_new(BIO_s_mem());
1443 time_print(bp, "This OCSP Update", thisupd);
1444 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
1445 if ((len = (int) BIO_get_mem_data(bp, CSS &s)) > 0) debug_printf("%.*s", len, s);
1446 debug_printf("OCSP status invalid times.\n");
1452 /* Add the resp to the list used by tls_server_stapling_cb() */
1454 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1455 while (oentry = *op)
1457 *op = oentry = store_get(sizeof(ocsp_resplist), GET_UNTAINTED);
1458 oentry->next = NULL;
1459 oentry->resp = resp;
1464 if (f.running_in_test_harness)
1466 extern char ** environ;
1467 if (environ) for (uschar ** p = USS environ; *p; p++)
1468 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1470 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1471 goto supply_response;
1479 ocsp_free_response_list(exim_openssl_state_st * state)
1481 for (ocsp_resplist * olist = state->u_ocsp.server.olist; olist;
1482 olist = olist->next)
1483 OCSP_RESPONSE_free(olist->resp);
1484 state->u_ocsp.server.olist = NULL;
1486 #endif /*!DISABLE_OCSP*/
1493 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1496 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1497 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1498 return tls_error(string_sprintf(
1499 "SSL_CTX_use_certificate_chain_file file=%s", file),
1500 cbinfo->host, NULL, errstr);
1505 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1508 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1509 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1510 return tls_error(string_sprintf(
1511 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1518 /* Called once during tls_init and possibly again during TLS setup, for a
1519 new context, if Server Name Indication was used and tls_sni was seen in
1520 the certificate string.
1523 sctx the SSL_CTX* to update
1524 state various parts of session state
1525 errstr error string pointer
1527 Returns: OK/DEFER/FAIL
1531 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1536 if (!state->certificate)
1538 if (!state->is_server) /* client */
1541 if (tls_install_selfsign(sctx, errstr) != OK)
1548 if ( !reexpand_tls_files_for_sni
1549 && ( Ustrstr(state->certificate, US"tls_sni")
1550 || Ustrstr(state->certificate, US"tls_in_sni")
1551 || Ustrstr(state->certificate, US"tls_out_sni")
1553 reexpand_tls_files_for_sni = TRUE;
1555 if (!expand_check(state->certificate, US"tls_certificate", &expanded, errstr))
1559 if (state->is_server)
1561 const uschar * file_list = expanded;
1564 #ifndef DISABLE_OCSP
1565 const uschar * olist = state->u_ocsp.server.file;
1568 BOOL fmt_pem = FALSE;
1571 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1573 if (olist && !*olist)
1576 /* If doing a re-expand after SNI, avoid reloading the OCSP
1577 responses when the list of filenames has not changed.
1578 The creds-invali on content change wipes file_expanded, so that
1579 always reloads here. */
1581 if ( state->u_ocsp.server.file_expanded && olist
1582 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1584 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1589 ocsp_free_response_list(state);
1590 state->u_ocsp.server.file_expanded = olist;
1594 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1596 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1599 #ifndef DISABLE_OCSP
1601 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1603 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1608 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1613 ocsp_load_response(state, ofile, fmt_pem);
1616 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1620 else /* would there ever be a need for multiple client certs? */
1621 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1624 if ( state->privatekey
1625 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr))
1628 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1629 of the expansion is an empty string, ignore it also, and assume the private
1630 key is in the same file as the certificate. */
1632 if (expanded && *expanded)
1633 if (state->is_server)
1635 const uschar * file_list = expanded;
1639 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1640 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1643 else /* would there ever be a need for multiple client certs? */
1644 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1654 /**************************************************
1655 * One-time init credentials for server and client *
1656 **************************************************/
1659 normalise_ciphers(uschar ** ciphers, const uschar * pre_expansion_ciphers)
1661 uschar * s = *ciphers;
1663 if (!s || !Ustrchr(s, '_')) return; /* no change needed */
1665 if (s == pre_expansion_ciphers)
1666 s = string_copy(s); /* get writable copy */
1668 for (uschar * t = s; *t; t++) if (*t == '_') *t = '-';
1673 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1674 uschar * ciphers, uschar ** errstr)
1676 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1677 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1678 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1679 state->server_cipher_list = ciphers;
1686 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1689 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1690 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1692 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1694 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1696 /* Set up the information callback, which outputs if debugging is at a suitable
1701 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1702 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1703 /* this needs a debug build of OpenSSL */
1704 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
1706 #ifdef OPENSSL_HAVE_KEYLOG_CB
1707 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
1711 /* Automatically re-try reads/writes after renegotiation. */
1712 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1719 tls_server_creds_init(void)
1722 uschar * dummy_errstr;
1723 unsigned lifetime = 0;
1727 state_server.lib_state = null_tls_preload;
1729 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1731 state_server.lib_state.lib_ctx = ctx;
1733 /* Preload DH params and EC curve */
1735 if (opt_unset_or_noexpand(tls_dhparam))
1737 DEBUG(D_tls) debug_printf("TLS: preloading DH params for server\n");
1738 if (init_dh(ctx, tls_dhparam, &dummy_errstr))
1739 state_server.lib_state.dh = TRUE;
1742 DEBUG(D_tls) debug_printf("TLS: not preloading DH params for server\n");
1743 if (opt_unset_or_noexpand(tls_eccurve))
1745 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for server\n");
1746 if (init_ecdh(ctx, &dummy_errstr))
1747 state_server.lib_state.ecdh = TRUE;
1750 DEBUG(D_tls) debug_printf("TLS: not preloading ECDH curve for server\n");
1752 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1753 /* If we can, preload the Authorities for checking client certs against.
1754 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1755 at TLS conn startup.
1756 Do this before the server ocsp so that its info can verify the ocsp. */
1758 if ( opt_set_and_noexpand(tls_verify_certificates)
1759 && opt_unset_or_noexpand(tls_crl))
1761 /* Watch the default dir also as they are always included */
1763 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1764 && tls_set_watch(tls_verify_certificates, FALSE)
1765 && tls_set_watch(tls_crl, FALSE))
1767 uschar * v_certs = tls_verify_certificates;
1768 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1770 if (setup_certs(ctx, &v_certs, tls_crl, NULL, &dummy_errstr) == OK)
1771 state_server.lib_state.cabundle = TRUE;
1773 /* If we can, preload the server-side cert, key and ocsp */
1775 if ( opt_set_and_noexpand(tls_certificate)
1776 # ifndef DISABLE_OCSP
1777 && opt_unset_or_noexpand(tls_ocsp_file)
1779 && opt_unset_or_noexpand(tls_privatekey))
1781 /* Set watches on the filenames. The implementation does de-duplication
1782 so we can just blindly do them all. */
1784 if ( tls_set_watch(tls_certificate, TRUE)
1785 # ifndef DISABLE_OCSP
1786 && tls_set_watch(tls_ocsp_file, TRUE)
1788 && tls_set_watch(tls_privatekey, TRUE))
1790 state_server.certificate = tls_certificate;
1791 state_server.privatekey = tls_privatekey;
1792 #ifndef DISABLE_OCSP
1793 state_server.u_ocsp.server.file = tls_ocsp_file;
1796 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1797 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1798 state_server.lib_state.conn_certs = TRUE;
1801 else if ( !tls_certificate && !tls_privatekey
1802 # ifndef DISABLE_OCSP
1806 { /* Generate & preload a selfsigned cert. No files to watch. */
1807 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1809 state_server.lib_state.conn_certs = TRUE;
1810 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1814 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1818 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1821 #endif /* EXIM_HAVE_INOTIFY */
1824 /* If we can, preload the ciphers control string */
1826 if (opt_set_and_noexpand(tls_require_ciphers))
1828 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1829 normalise_ciphers(&tls_require_ciphers, tls_require_ciphers);
1830 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1831 &dummy_errstr) == OK)
1832 state_server.lib_state.pri_string = TRUE;
1835 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1842 /* Preload whatever creds are static, onto a transport. The client can then
1843 just copy the pointer as it starts up.
1844 Called from the daemon after a cache-invalidate with watch set; called from
1845 a queue-run startup with watch clear. */
1848 tls_client_creds_init(transport_instance * t, BOOL watch)
1850 smtp_transport_options_block * ob = t->options_block;
1851 exim_openssl_state_st tpt_dummy_state;
1852 host_item * dummy_host = (host_item *)1;
1853 uschar * dummy_errstr;
1858 ob->tls_preload = null_tls_preload;
1859 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1861 ob->tls_preload.lib_ctx = ctx;
1863 tpt_dummy_state.lib_state = ob->tls_preload;
1865 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1866 if ( opt_set_and_noexpand(ob->tls_certificate)
1867 && opt_unset_or_noexpand(ob->tls_privatekey))
1870 || ( tls_set_watch(ob->tls_certificate, FALSE)
1871 && tls_set_watch(ob->tls_privatekey, FALSE)
1874 uschar * pkey = ob->tls_privatekey;
1877 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1879 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1881 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1882 pkey ? pkey : ob->tls_certificate,
1885 ob->tls_preload.conn_certs = TRUE;
1890 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1893 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1894 && opt_unset_or_noexpand(ob->tls_crl))
1897 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1898 && tls_set_watch(ob->tls_verify_certificates, FALSE)
1899 && tls_set_watch(ob->tls_crl, FALSE)
1902 uschar * v_certs = ob->tls_verify_certificates;
1904 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1906 if (setup_certs(ctx, &v_certs,
1907 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
1908 ob->tls_preload.cabundle = TRUE;
1913 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1915 #endif /*EXIM_HAVE_INOTIFY*/
1919 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1920 /* Invalidate the creds cached, by dropping the current ones.
1921 Call when we notice one of the source files has changed. */
1924 tls_server_creds_invalidate(void)
1926 SSL_CTX_free(state_server.lib_state.lib_ctx);
1927 state_server.lib_state = null_tls_preload;
1928 #ifndef DISABLE_OCSP
1929 state_server.u_ocsp.server.file_expanded = NULL;
1935 tls_client_creds_invalidate(transport_instance * t)
1937 smtp_transport_options_block * ob = t->options_block;
1938 SSL_CTX_free(ob->tls_preload.lib_ctx);
1939 ob->tls_preload = null_tls_preload;
1945 tls_server_creds_invalidate(void)
1949 tls_client_creds_invalidate(transport_instance * t)
1952 #endif /*EXIM_HAVE_INOTIFY*/
1957 #ifndef DISABLE_OCSP
1959 debug_print_sn(const X509 * cert)
1961 X509_NAME * sn = X509_get_subject_name((X509 *)cert);
1962 static uschar name[256];
1963 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
1965 name[sizeof(name)-1] = '\0';
1966 debug_printf(" %s\n", name);
1971 x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk)
1974 debug_printf(" (null)\n");
1977 int idx = sk_X509_num(sk);
1979 debug_printf(" (empty)\n");
1981 while (--idx >= 0) debug_print_sn(sk_X509_value(sk, idx));
1986 x509_store_dump_cert_s_names(X509_STORE * store)
1988 # ifdef EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
1990 debug_printf(" (no store)\n");
1993 STACK_OF(X509) * sk = X509_STORE_get1_all_certs(store);
1994 x509_stack_dump_cert_s_names(sk);
1995 sk_X509_pop_free(sk, X509_free);
1999 #endif /*!DISABLE_OCSP*/
2004 #ifndef DISABLE_TLS_RESUME
2005 /* Manage the keysets used for encrypting the session tickets, on the server. */
2007 typedef struct { /* Session ticket encryption key */
2010 const EVP_CIPHER * aes_cipher;
2011 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
2012 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2013 const EVP_MD * hmac_hash;
2015 const uschar * hmac_hashname;
2017 uschar hmac_key[16];
2022 static exim_stek exim_tk; /* current key */
2023 static exim_stek exim_tk_old; /* previous key */
2028 time_t t = time(NULL);
2030 if (exim_tk.name[0])
2032 if (exim_tk.renew >= t) return;
2033 exim_tk_old = exim_tk;
2036 if (f.running_in_test_harness) ssl_session_timeout = 6;
2038 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
2039 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
2040 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
2041 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
2043 exim_tk.name[0] = 'E';
2044 exim_tk.aes_cipher = EVP_aes_256_cbc();
2045 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2046 exim_tk.hmac_hash = EVP_sha256();
2048 exim_tk.hmac_hashname = US "sha256";
2050 exim_tk.expire = t + ssl_session_timeout;
2051 exim_tk.renew = t + ssl_session_timeout/2;
2057 if (!exim_tk.name[0]) return NULL;
2062 tk_find(const uschar * name)
2064 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
2065 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
2072 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2080 /*XXX will want these dependent on the ssl session strength */
2081 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2082 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2083 key->hmac_hash, NULL);
2086 OSSL_PARAM params[3];
2087 uschar * hk = string_copy(key->hmac_hashname); /* need nonconst */
2088 params[0] = OSSL_PARAM_construct_octet_string("key", key->hmac_key, sizeof(key->hmac_key));
2089 params[1] = OSSL_PARAM_construct_utf8_string("digest", CS hk, 0);
2090 params[2] = OSSL_PARAM_construct_end();
2091 if (EVP_MAC_CTX_set_params(hctx, params) == 0)
2093 DEBUG(D_tls) debug_printf("EVP_MAC_CTX_set_params: %s\n",
2094 ERR_reason_error_string(ERR_get_error()));
2095 return 0; /* error in mac initialisation */
2102 /* Callback for session tickets, on server */
2104 ticket_key_callback(SSL * ssl, uschar key_name[16],
2105 uschar * iv, EVP_CIPHER_CTX * c_ctx,
2106 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2113 tls_support * tlsp = state_server.tlsp;
2118 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
2119 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2121 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
2122 return -1; /* insufficient random */
2124 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
2125 return 0; /* key couldn't be created */
2126 memcpy(key_name, key->name, 16);
2127 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
2129 if (tk_hmac_init(hctx, key) == 0) return 0;
2130 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2132 DEBUG(D_tls) debug_printf("ticket created\n");
2137 time_t now = time(NULL);
2139 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
2140 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2142 if (!(key = tk_find(key_name)) || key->expire < now)
2146 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
2147 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
2152 if (tk_hmac_init(hctx, key) == 0) return 0;
2153 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2155 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2157 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2158 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2159 be better. To do that we'd have to encode ticket lifetime in the name as
2160 we don't yet see the restored session. Could check posthandshake for TLS1.3
2161 and trigger a new ticket then, but cannot do that for TLS1.2 */
2162 return key->renew < now ? 2 : 1;
2165 #endif /* !DISABLE_TLS_RESUME */
2170 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2171 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2173 /* If verification is optional, don't fail if no certificate */
2175 SSL_CTX_set_verify(ctx,
2176 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2181 /*************************************************
2182 * Callback to handle SNI *
2183 *************************************************/
2185 /* Called when acting as server during the TLS session setup if a Server Name
2186 Indication extension was sent by the client.
2188 API documentation is OpenSSL s_server.c implementation.
2191 s SSL* of the current session
2192 ad unknown (part of OpenSSL API) (unused)
2193 arg Callback of "our" registered data
2195 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2197 XXX might need to change to using ClientHello callback,
2198 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2201 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2203 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
2205 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2206 exim_openssl_state_st *state = (exim_openssl_state_st *) arg;
2208 int old_pool = store_pool;
2209 uschar * dummy_errstr;
2212 return SSL_TLSEXT_ERR_OK;
2214 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2215 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2217 /* Make the extension value available for expansion */
2218 store_pool = POOL_PERM;
2219 tls_in.sni = string_copy_taint(US servername, GET_TAINTED);
2220 store_pool = old_pool;
2222 if (!reexpand_tls_files_for_sni)
2223 return SSL_TLSEXT_ERR_OK;
2225 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2226 not confident that memcpy wouldn't break some internal reference counting.
2227 Especially since there's a references struct member, which would be off. */
2229 if (lib_ctx_new(&server_sni, NULL, &dummy_errstr) != OK)
2232 /* Not sure how many of these are actually needed, since SSL object
2233 already exists. Might even need this selfsame callback, for reneg? */
2236 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2237 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2238 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2239 #ifdef OPENSSL_MIN_PROTO_VERSION
2240 SSL_CTX_set_min_proto_version(server_sni, SSL3_VERSION);
2242 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2243 SSL_CTX_clear_options(server_sni, ~SSL_CTX_get_options(ctx));
2244 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2245 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2246 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2249 if ( !init_dh(server_sni, state->dhparam, &dummy_errstr)
2250 || !init_ecdh(server_sni, &dummy_errstr)
2254 if ( state->server_cipher_list
2255 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2258 #ifndef DISABLE_OCSP
2259 if (state->u_ocsp.server.file)
2261 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2262 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2267 uschar * v_certs = tls_verify_certificates;
2268 if ((rc = setup_certs(server_sni, &v_certs, tls_crl, NULL,
2269 &dummy_errstr)) != OK)
2272 if (v_certs && *v_certs)
2273 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2276 /* do this after setup_certs, because this can require the certs for verifying
2277 OCSP information. */
2278 if ((rc = tls_expand_session_files(server_sni, state, &dummy_errstr)) != OK)
2281 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2282 SSL_set_SSL_CTX(s, server_sni);
2283 return SSL_TLSEXT_ERR_OK;
2285 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
2287 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2292 #ifdef EXIM_HAVE_ALPN
2293 /*************************************************
2294 * Callback to handle ALPN *
2295 *************************************************/
2297 /* Called on server if tls_alpn nonblank after expansion,
2298 when client offers ALPN, after the SNI callback.
2299 If set and not matching the list then we dump the connection */
2302 tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen,
2303 const uschar * in, unsigned int inlen, void * arg)
2305 server_seen_alpn = TRUE;
2308 debug_printf("Received TLS ALPN offer:");
2309 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2312 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2313 debug_printf(" '%.*s'", siz, in + pos + 1);
2315 debug_printf(". Our list: '%s'\n", tls_alpn);
2318 /* Look for an acceptable ALPN */
2320 if ( inlen > 1 /* at least one name */
2321 && in[0]+1 == inlen /* filling the vector, so exactly one name */
2324 const uschar * list = tls_alpn;
2326 for (uschar * name; name = string_nextinlist(&list, &sep, NULL, 0); )
2327 if (Ustrncmp(in+1, name, in[0]) == 0)
2329 *out = in+1; /* we checked for exactly one, so can just point to it */
2331 return SSL_TLSEXT_ERR_OK; /* use ALPN */
2335 /* More than one name from clilent, or name did not match our list. */
2337 /* This will be fatal to the TLS conn; would be nice to kill TCP also.
2338 Maybe as an option in future; for now leave control to the config (must-tls). */
2340 DEBUG(D_tls) debug_printf("TLS ALPN rejected\n");
2341 return SSL_TLSEXT_ERR_ALERT_FATAL;
2343 #endif /* EXIM_HAVE_ALPN */
2347 #ifndef DISABLE_OCSP
2349 /*************************************************
2350 * Callback to handle OCSP Stapling *
2351 *************************************************/
2353 /* Called when acting as server during the TLS session setup if the client
2354 requests OCSP information with a Certificate Status Request.
2356 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2362 tls_server_stapling_cb(SSL *s, void *arg)
2364 const exim_openssl_state_st * state = arg;
2365 ocsp_resplist * olist = state->u_ocsp.server.olist;
2366 uschar * response_der; /*XXX blob */
2367 int response_der_len;
2370 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2371 olist ? "have" : "lack");
2373 tls_in.ocsp = OCSP_NOT_RESP;
2375 return SSL_TLSEXT_ERR_NOACK;
2377 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
2379 const X509 * cert_sent = SSL_get_certificate(s);
2380 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2381 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2383 for (; olist; olist = olist->next)
2385 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2386 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2387 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2388 ASN1_INTEGER * res_cert_serial;
2389 const BIGNUM * resp_bn;
2390 ASN1_OCTET_STRING * res_cert_iNameHash;
2393 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2394 (OCSP_CERTID *) cid);
2395 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2399 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2400 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2403 if (BN_cmp(cert_bn, resp_bn) == 0)
2405 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2407 /*XXX TODO: check the rest of the list for duplicate matches.
2408 If any, need to also check the Issuer Name hash.
2409 Without this, we will provide the wrong status in the case of
2414 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2418 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2419 return SSL_TLSEXT_ERR_NOACK;
2425 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2426 return SSL_TLSEXT_ERR_NOACK;
2430 /*XXX could we do the i2d earlier, rather than during the callback? */
2431 response_der = NULL;
2432 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2433 if (response_der_len <= 0)
2434 return SSL_TLSEXT_ERR_NOACK;
2436 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2437 response_der, response_der_len);
2438 tls_in.ocsp = OCSP_VFIED;
2439 return SSL_TLSEXT_ERR_OK;
2444 add_chain_to_store(X509_STORE * store, STACK_OF(X509) * sk,
2445 const char * debug_text)
2451 debug_printf("chain for %s:\n", debug_text);
2452 x509_stack_dump_cert_s_names(sk);
2455 if ((idx = sk_X509_num(sk)) > 0)
2457 X509_STORE_add_cert(store, sk_X509_value(sk, idx));
2462 tls_client_stapling_cb(SSL * ssl, void * arg)
2464 exim_openssl_state_st * cbinfo = arg;
2465 const unsigned char * p;
2467 OCSP_RESPONSE * rsp;
2468 OCSP_BASICRESP * bs;
2471 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2472 len = SSL_get_tlsext_status_ocsp_resp(ssl, &p);
2474 { /* Expect this when we requested ocsp but got none */
2475 if (SSL_session_reused(ssl) && tls_out.ocsp == OCSP_VFIED)
2477 DEBUG(D_tls) debug_printf(" null, but resumed; ocsp vfy stored with session is good\n");
2481 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2482 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2484 DEBUG(D_tls) debug_printf(" null\n");
2486 if (!cbinfo->u_ocsp.client.verify_required)
2488 cbinfo->u_ocsp.client.verify_errstr =
2489 US"(SSL_connect) Required TLS certificate status not received";
2493 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2495 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2496 if (LOGGING(tls_cipher))
2497 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2499 DEBUG(D_tls) debug_printf(" parse error\n");
2503 if (!(bs = OCSP_response_get1_basic(rsp)))
2505 tls_out.ocsp = OCSP_FAILED;
2506 if (LOGGING(tls_cipher))
2507 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2509 DEBUG(D_tls) debug_printf(" error parsing response\n");
2510 OCSP_RESPONSE_free(rsp);
2514 /* We'd check the nonce here if we'd put one in the request. */
2515 /* However that would defeat cacheability on the server so we don't. */
2517 /* This section of code reworked from OpenSSL apps source;
2518 The OpenSSL Project retains copyright:
2519 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2523 X509_STORE * verify_store = NULL;
2524 BOOL have_verified_OCSP_signer = FALSE;
2525 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2526 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2529 DEBUG(D_tls) bp = BIO_new(BIO_s_mem());
2531 /* Use the CA & chain that verified the server cert to verify the stapled info */
2534 /* If this routine is not available, we've avoided [in tls_client_start()]
2535 asking for certificate-status under DANE, so this callback won't run for
2536 that combination. It still will for non-DANE. */
2538 #ifdef EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER
2541 if ( tls_out.dane_verified
2542 && (have_verified_OCSP_signer =
2543 OCSP_resp_get0_signer(bs, &signer, SSL_get0_verified_chain(ssl)) == 1))
2546 debug_printf("signer for OCSP basicres is in the verified chain;"
2547 " shortcut its verification\n");
2552 STACK_OF(X509) * verified_chain;
2554 verify_store = X509_STORE_new();
2556 SSL_get0_chain_certs(ssl, &verified_chain);
2557 add_chain_to_store(verify_store, verified_chain,
2558 "'current cert' per SSL_get0_chain_certs()");
2559 #ifdef EXIM_HAVE_SSL_GET0_VERIFIED_CHAIN
2560 verified_chain = SSL_get0_verified_chain(ssl);
2561 add_chain_to_store(verify_store, verified_chain,
2562 "SSL_get0_verified_chain()");
2569 debug_printf("Untrusted intermediate cert stack (from SSL_get_peer_cert_chain()):\n");
2570 x509_stack_dump_cert_s_names(SSL_get_peer_cert_chain(ssl));
2572 debug_printf("will use this CA store for verifying basicresp:\n");
2573 x509_store_dump_cert_s_names(verify_store);
2575 /* OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2577 debug_printf("certs contained in basicresp:\n");
2578 x509_stack_dump_cert_s_names(
2579 #ifdef EXIM_HAVE_OPESSL_OCSP_RESP_GET0_CERTS
2580 OCSP_resp_get0_certs(bs)
2586 #ifdef EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
2587 /* could do via X509_STORE_get0_objects(); not worth it just for debug info */
2590 if (OCSP_resp_get0_signer(bs, &signer, X509_STORE_get1_all_certs(verify_store)) == 1)
2592 debug_printf("found signer for basicres:\n");
2593 debug_print_sn(signer);
2597 debug_printf("failed to find signer for basicres:\n");
2598 ERR_print_errors(bp);
2607 /* Under DANE the trust-anchor (at least in TA mode) is indicated by the TLSA
2608 record in DNS, and probably is not the root of the chain of certificates. So
2609 accept a partial chain for that case (and hope that anchor is visible for
2610 verifying the OCSP stapling).
2611 XXX for EE mode it won't even be that. Does that make OCSP useless for EE?
2613 Worse, for LetsEncrypt-mode (ocsp signer is leaf-signer) under DANE, the
2614 data used within OpenSSL for the signer has nil pointers for signing
2615 algorithms - and a crash results. Avoid this by shortcutting verification,
2616 having determined that the OCSP signer is in the (DANE-)validated set.
2619 #ifndef OCSP_PARTIAL_CHAIN /* defined for 3.0.0 onwards */
2620 # define OCSP_PARTIAL_CHAIN 0
2623 if ((i = OCSP_basic_verify(bs, SSL_get_peer_cert_chain(ssl),
2626 tls_out.dane_verified
2627 ? have_verified_OCSP_signer
2628 ? OCSP_NOVERIFY | OCSP_NOEXPLICIT
2629 : OCSP_PARTIAL_CHAIN | OCSP_NOEXPLICIT
2632 OCSP_NOEXPLICIT)) <= 0)
2634 DEBUG(D_tls) debug_printf("OCSP_basic_verify() fail: returned %d\n", i);
2635 if (ERR_peek_error())
2637 tls_out.ocsp = OCSP_FAILED;
2638 if (LOGGING(tls_cipher))
2640 static uschar peerdn[256];
2641 const uschar * errstr;;
2643 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
2644 ERR_peek_error_all(NULL, NULL, NULL, CCSS &errstr, NULL);
2647 errstr = CUS ERR_reason_error_string(ERR_peek_error());
2649 X509_NAME_oneline(X509_get_subject_name(SSL_get_peer_certificate(ssl)),
2650 CS peerdn, sizeof(peerdn));
2651 log_write(0, LOG_MAIN,
2652 "[%s] %s Received TLS cert (DN: '%.*s') status response, "
2653 "itself unverifiable: %s",
2654 deliver_host_address, deliver_host,
2655 (int)sizeof(peerdn), peerdn, errstr);
2659 BIO_printf(bp, "OCSP response verify failure\n");
2660 ERR_print_errors(bp);
2663 int len = (int) BIO_get_mem_data(bp, CSS &s);
2664 if (len > 0) debug_printf("%.*s", len, s);
2667 OCSP_RESPONSE_print(bp, rsp, 0);
2672 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2673 " in the root CA certificate; ignoring\n");
2676 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2678 /*XXX So we have a good stapled OCSP status. How do we know
2679 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2680 OCSP_resp_find_status() which matches on a cert id, which presumably
2681 we should use. Making an id needs OCSP_cert_id_new(), which takes
2682 issuerName, issuerKey, serialNumber. Are they all in the cert?
2684 For now, carry on blindly accepting the resp. */
2687 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2688 OCSP_resp_count(bs) - 1;
2690 sk_OCSP_SINGLERESP_num(sresp) - 1;
2694 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2696 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2698 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2699 - but what happens with a GnuTLS-style input?
2701 we could do with a debug label for each singleresp
2702 - it has a certID with a serialNumber, but I see no API to get that
2704 status = OCSP_single_get0_status(single, &reason, &rev,
2705 &thisupd, &nextupd);
2709 time_print(bp, "This OCSP Update", thisupd);
2710 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
2712 if (!OCSP_check_validity(thisupd, nextupd,
2713 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2715 tls_out.ocsp = OCSP_FAILED;
2716 DEBUG(D_tls) ERR_print_errors(bp);
2717 cbinfo->u_ocsp.client.verify_errstr =
2718 US"(SSL_connect) Server certificate status is out-of-date";
2719 log_write(0, LOG_MAIN, "OCSP dates invalid");
2723 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2724 OCSP_cert_status_str(status));
2727 case V_OCSP_CERTSTATUS_GOOD:
2728 continue; /* the idx loop */
2729 case V_OCSP_CERTSTATUS_REVOKED:
2730 cbinfo->u_ocsp.client.verify_errstr =
2731 US"(SSL_connect) Server certificate revoked";
2732 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2733 reason != -1 ? "; reason: " : "",
2734 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2735 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2738 cbinfo->u_ocsp.client.verify_errstr =
2739 US"(SSL_connect) Server certificate has unknown status";
2740 log_write(0, LOG_MAIN,
2741 "Server certificate status unknown, in OCSP stapling");
2749 tls_out.ocsp = OCSP_VFIED;
2753 tls_out.ocsp = OCSP_FAILED;
2754 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2758 int len = (int) BIO_get_mem_data(bp, CSS &s);
2759 if (len > 0) debug_printf("%.*s", len, s);
2764 OCSP_RESPONSE_free(rsp);
2767 #endif /*!DISABLE_OCSP*/
2770 /*************************************************
2771 * Initialize for TLS *
2772 *************************************************/
2773 /* Called from both server and client code, to do preliminary initialization
2774 of the library. We allocate and return a context structure.
2777 host connected host, if client; NULL if server
2778 ob transport options block, if client; NULL if server
2779 ocsp_file file of stapling info (server); flag for require ocsp (client)
2780 addr address if client; NULL if server (for some randomness)
2781 caller_state place to put pointer to allocated state-struct
2782 errstr error string pointer
2784 Returns: OK/DEFER/FAIL
2788 tls_init(host_item * host, smtp_transport_options_block * ob,
2789 #ifndef DISABLE_OCSP
2792 address_item *addr, exim_openssl_state_st ** caller_state,
2793 tls_support * tlsp, uschar ** errstr)
2796 exim_openssl_state_st * state;
2799 if (host) /* client */
2801 state = store_malloc(sizeof(exim_openssl_state_st));
2802 memset(state, 0, sizeof(*state));
2803 state->certificate = ob->tls_certificate;
2804 state->privatekey = ob->tls_privatekey;
2805 state->is_server = FALSE;
2806 state->dhparam = NULL;
2807 state->lib_state = ob->tls_preload;
2811 state = &state_server;
2812 state->certificate = tls_certificate;
2813 state->privatekey = tls_privatekey;
2814 state->is_server = TRUE;
2815 state->dhparam = tls_dhparam;
2816 state->lib_state = state_server.lib_state;
2822 if (!state->lib_state.pri_string)
2823 state->server_cipher_list = NULL;
2825 #ifndef DISABLE_EVENT
2826 state->event_action = NULL;
2831 /* It turns out that we need to seed the random number generator this early in
2832 order to get the full complement of ciphers to work. It took me roughly a day
2833 of work to discover this by experiment.
2835 On systems that have /dev/urandom, SSL may automatically seed itself from
2836 there. Otherwise, we have to make something up as best we can. Double check
2839 Although we likely called this before, at daemon startup, this is a chance
2840 to mix in further variable info (time, pid) if needed. */
2842 if (!lib_rand_init(addr))
2843 return tls_error(US"RAND_status", host,
2844 US"unable to seed random number generator", errstr);
2846 /* Apply administrator-supplied work-arounds.
2847 Historically we applied just one requested option,
2848 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2849 moved to an administrator-controlled list of options to specify and
2850 grandfathered in the first one as the default value for "openssl_options".
2852 No OpenSSL version number checks: the options we accept depend upon the
2853 availability of the option value macros from OpenSSL. */
2856 if (!tls_openssl_options_parse(openssl_options, &init_options))
2857 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2859 /* Create a context.
2860 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2861 negotiation in the different methods; as far as I can tell, the only
2862 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2863 when OpenSSL is built without SSLv2 support.
2864 By disabling with openssl_options, we can let admins re-enable with the
2867 if (!(ctx = state->lib_state.lib_ctx))
2869 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2871 state->lib_state.lib_ctx = ctx;
2874 #ifndef DISABLE_TLS_RESUME
2875 tlsp->resumption = RESUME_SUPPORTED;
2879 #ifndef DISABLE_TLS_RESUME
2880 /* Should the server offer session resumption? */
2881 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2883 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2884 init_options &= ~SSL_OP_NO_TICKET;
2885 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2886 tlsp->host_resumable = TRUE;
2890 #ifdef OPENSSL_MIN_PROTO_VERSION
2891 SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
2893 DEBUG(D_tls) debug_printf("setting SSL CTX options: %016lx\n", init_options);
2894 SSL_CTX_set_options(ctx, init_options);
2896 uint64_t readback = SSL_CTX_clear_options(ctx, ~init_options);
2897 if (readback != init_options)
2898 return tls_error(string_sprintf(
2899 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2903 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2905 /* We'd like to disable session cache unconditionally, but foolish Outlook
2906 Express clients then give up the first TLS connection and make a second one
2907 (which works). Only when there is an IMAP service on the same machine.
2908 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2909 now, until we work out a decent way of presenting control to the config. It
2910 will never be used because we use a new context every time. */
2912 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2915 /* Initialize with DH parameters if supplied */
2916 /* Initialize ECDH temp key parameter selection */
2920 if (state->lib_state.dh)
2921 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2923 if (!init_dh(ctx, state->dhparam, errstr)) return DEFER;
2925 if (state->lib_state.ecdh)
2926 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
2928 if (!init_ecdh(ctx, errstr)) return DEFER;
2931 /* Set up certificate and key (and perhaps OCSP info) */
2933 if (state->lib_state.conn_certs)
2936 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
2940 #ifndef DISABLE_OCSP
2941 if (!host) /* server */
2943 state->u_ocsp.server.file = ocsp_file;
2944 state->u_ocsp.server.file_expanded = NULL;
2945 state->u_ocsp.server.olist = NULL;
2948 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
2951 /* If we need to handle SNI or OCSP, do so */
2953 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2954 # ifndef DISABLE_OCSP
2955 if (!host && !(state->u_ocsp.server.verify_stack = sk_X509_new_null()))
2957 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2962 if (!host) /* server */
2964 # ifndef DISABLE_OCSP
2965 /* We check u_ocsp.server.file, not server.olist, because we care about if
2966 the option exists, not what the current expansion might be, as SNI might
2967 change the certificate and OCSP file in use between now and the time the
2968 callback is invoked. */
2969 if (state->u_ocsp.server.file)
2971 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2972 SSL_CTX_set_tlsext_status_arg(ctx, state);
2975 /* We always do this, so that $tls_sni is available even if not used in
2977 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2978 SSL_CTX_set_tlsext_servername_arg(ctx, state);
2980 # ifdef EXIM_HAVE_ALPN
2981 if (tls_alpn && *tls_alpn)
2984 if ( expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr)
2985 && *exp_alpn && !isblank(*exp_alpn))
2987 tls_alpn = exp_alpn; /* subprocess so ok to overwrite */
2988 SSL_CTX_set_alpn_select_cb(ctx, tls_server_alpn_cb, state);
2995 # ifndef DISABLE_OCSP
2997 if(ocsp_file) /* wanting stapling */
2999 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
3001 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
3005 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
3006 SSL_CTX_set_tlsext_status_arg(ctx, state);
3009 #endif /*EXIM_HAVE_OPENSSL_TLSEXT*/
3011 state->verify_cert_hostnames = NULL;
3013 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
3014 /* Set up the RSA callback */
3015 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
3018 /* Finally, set the session cache timeout, and we are done.
3019 The period appears to be also used for (server-generated) session tickets */
3021 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
3022 DEBUG(D_tls) debug_printf("Initialized TLS\n");
3024 *caller_state = state;
3032 /*************************************************
3033 * Get name of cipher in use *
3034 *************************************************/
3037 Argument: pointer to an SSL structure for the connection
3038 pointer to number of bits for cipher
3039 Returns: pointer to allocated string in perm-pool
3043 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
3045 int pool = store_pool;
3046 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
3047 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
3048 the accessor functions use const in the prototype. */
3050 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
3053 SSL_CIPHER_get_bits(c, bits);
3055 store_pool = POOL_PERM;
3056 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
3058 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
3063 /* Get IETF-standard name for ciphersuite.
3064 Argument: pointer to an SSL structure for the connection
3065 Returns: pointer to string
3068 static const uschar *
3069 cipher_stdname_ssl(SSL * ssl)
3071 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
3072 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
3074 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
3075 return cipher_stdname(id >> 8, id & 0xff);
3080 static const uschar *
3081 tlsver_name(SSL * ssl)
3084 int pool = store_pool;
3086 store_pool = POOL_PERM;
3087 s = string_copy(US SSL_get_version(ssl));
3089 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
3090 for (;; p++) if (!(*p = p[1])) break;
3096 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
3098 /*XXX we might consider a list-of-certs variable for the cert chain.
3099 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
3100 in list-handling functions, also consider the difference between the entire
3101 chain and the elements sent by the peer. */
3103 tlsp->peerdn = NULL;
3105 /* Will have already noted peercert on a verify fail; possibly not the leaf */
3106 if (!tlsp->peercert)
3107 tlsp->peercert = SSL_get_peer_certificate(ssl);
3108 /* Beware anonymous ciphers which lead to server_cert being NULL */
3110 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
3111 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
3114 int oldpool = store_pool;
3116 peerdn[siz-1] = '\0'; /* paranoia */
3117 store_pool = POOL_PERM;
3118 tlsp->peerdn = string_copy(peerdn);
3119 store_pool = oldpool;
3121 /* We used to set CV in the cert-verify callbacks (either plain or dane)
3122 but they don't get called on session-resumption. So use the official
3123 interface, which uses the resumed value. Unfortunately this claims verified
3124 when it actually failed but we're in try-verify mode, due to us wanting the
3125 knowlege that it failed so needing to have the callback and forcing a
3126 permissive return. If we don't force it, the TLS startup is failed.
3127 The extra bit of information is set in verify_override in the cb, stashed
3128 for resumption next to the TLS session, and used here. */
3130 if (!tlsp->verify_override)
3131 tlsp->certificate_verified =
3133 tlsp->dane_verified ||
3135 SSL_get_verify_result(ssl) == X509_V_OK;
3143 /*************************************************
3144 * Set up for verifying certificates *
3145 *************************************************/
3147 #ifndef DISABLE_OCSP
3148 /* In the server, load certs from file, return TRUE on success */
3151 chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
3154 STACK_OF(X509) * verify_stack = *vp;
3157 while (sk_X509_num(verify_stack) > 0)
3158 X509_free(sk_X509_pop(verify_stack));
3160 verify_stack = sk_X509_new_null();
3162 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
3163 for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
3164 sk_X509_push(verify_stack, x);
3173 /* Called by both client and server startup; on the server possibly
3174 repeated after a Server Name Indication.
3177 sctx SSL_CTX* to initialise
3178 certsp certs file, returned expanded
3179 crl CRL file or NULL
3180 host NULL in a server; the remote host in a client
3181 errstr error string pointer
3183 Returns: OK/DEFER/FAIL
3187 setup_certs(SSL_CTX * sctx, uschar ** certsp, uschar * crl, host_item * host,
3190 uschar * expcerts, * expcrl;
3192 if (!expand_check(*certsp, US"tls_verify_certificates", &expcerts, errstr))
3194 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3197 if (expcerts && *expcerts)
3199 /* Tell the library to use its compiled-in location for the system default
3200 CA bundle. Then add the ones specified in the config, if any. */
3202 if (!SSL_CTX_set_default_verify_paths(sctx))
3203 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
3205 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
3207 struct stat statbuf;
3209 if (Ustat(expcerts, &statbuf) < 0)
3211 log_write(0, LOG_MAIN|LOG_PANIC,
3212 "failed to stat %s for certificates", expcerts);
3218 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
3219 { file = NULL; dir = expcerts; }
3222 STACK_OF(X509) * verify_stack =
3223 #ifndef DISABLE_OCSP
3224 !host ? state_server.u_ocsp.server.verify_stack :
3227 STACK_OF(X509) ** vp = &verify_stack;
3229 file = expcerts; dir = NULL;
3230 #ifndef DISABLE_OCSP
3231 /* In the server if we will be offering an OCSP proof; load chain from
3232 file for verifying the OCSP proof at load time. */
3234 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
3235 This is inconsistent with the need to verify the OCSP proof of the server cert.
3237 /* *debug_printf("file for checking server ocsp stapling is: %s\n", file); */
3239 && statbuf.st_size > 0
3240 && state_server.u_ocsp.server.file
3241 && !chain_from_pem_file(file, vp)
3244 log_write(0, LOG_MAIN|LOG_PANIC,
3245 "failed to load cert chain from %s", file);
3251 /* If a certificate file is empty, the load function fails with an
3252 unhelpful error message. If we skip it, we get the correct behaviour (no
3253 certificates are recognized, but the error message is still misleading (it
3254 says no certificate was supplied). But this is better. */
3256 if ( (!file || statbuf.st_size > 0)
3257 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
3258 return tls_error(US"SSL_CTX_load_verify_locations",
3259 host, NULL, errstr);
3261 /* On the server load the list of CAs for which we will accept certs, for
3262 sending to the client. This is only for the one-file
3263 tls_verify_certificates variant.
3264 If a list isn't loaded into the server, but some verify locations are set,
3265 the server end appears to make a wildcard request for client certs.
3266 Meanwhile, the client library as default behaviour *ignores* the list
3267 we send over the wire - see man SSL_CTX_set_client_cert_cb.
3268 Because of this, and that the dir variant is likely only used for
3269 the public-CA bundle (not for a private CA), not worth fixing. */
3273 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
3274 int i = sk_X509_NAME_num(names);
3276 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
3277 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
3278 i, i>1 ? "ies":"y");
3282 debug_printf("Added dir for additional certificate authorities\n");
3286 /* Handle a certificate revocation list. */
3288 #if OPENSSL_VERSION_NUMBER > 0x00907000L
3290 /* This bit of code is now the version supplied by Lars Mainka. (I have
3291 merely reformatted it into the Exim code style.)
3293 "From here I changed the code to add support for multiple crl's
3294 in pem format in one file or to support hashed directory entries in
3295 pem format instead of a file. This method now uses the library function
3296 X509_STORE_load_locations to add the CRL location to the SSL context.
3297 OpenSSL will then handle the verify against CA certs and CRLs by
3298 itself in the verify callback." */
3300 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
3301 if (expcrl && *expcrl)
3303 struct stat statbufcrl;
3304 if (Ustat(expcrl, &statbufcrl) < 0)
3306 log_write(0, LOG_MAIN|LOG_PANIC,
3307 "failed to stat %s for certificates revocation lists", expcrl);
3312 /* is it a file or directory? */
3314 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
3315 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
3319 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
3325 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
3327 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
3328 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
3330 /* setting the flags to check against the complete crl chain */
3332 X509_STORE_set_flags(cvstore,
3333 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
3337 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3346 tls_dump_keylog(SSL * ssl)
3348 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3349 BIO * bp = BIO_new(BIO_s_mem());
3352 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3353 len = (int) BIO_get_mem_data(bp, CSS &s);
3354 if (len > 0) debug_printf("%.*s", len, s);
3360 /* Channel-binding info for authenticators
3361 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/
3366 tls_get_channel_binding(SSL * ssl, tls_support * tlsp, const void * taintval)
3371 #ifdef EXIM_HAVE_EXPORT_CHNL_BNGNG
3372 if (SSL_version(ssl) > TLS1_2_VERSION)
3374 /* It's not documented by OpenSSL how big the output buffer must be.
3375 The OpenSSL testcases use 80 bytes but don't say why. The GnuTLS impl only
3376 serves out 32B. RFC 9266 says it is 32B.
3377 Interop fails unless we use the same each end. */
3380 tlsp->channelbind_exporter = TRUE;
3381 taintval = GET_UNTAINTED;
3382 if (SSL_export_keying_material(ssl,
3383 s = store_get((int)len, taintval), len,
3384 "EXPORTER-Channel-Binding", (size_t) 24,
3391 len = SSL_get_peer_finished(ssl, &c, 0);
3392 len = SSL_get_peer_finished(ssl, s = store_get((int)len, taintval), len);
3397 int old_pool = store_pool;
3398 store_pool = POOL_PERM;
3399 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, taintval);
3400 store_pool = old_pool;
3401 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
3406 /*************************************************
3407 * Start a TLS session in a server *
3408 *************************************************/
3409 /* This is called when Exim is running as a server, after having received
3410 the STARTTLS command. It must respond to that command, and then negotiate
3414 errstr pointer to error message
3416 Returns: OK on success
3417 DEFER for errors before the start of the negotiation
3418 FAIL for errors during the negotiation; the server can't
3423 tls_server_start(uschar ** errstr)
3426 uschar * expciphers;
3427 exim_openssl_state_st * dummy_statep;
3430 static uschar peerdn[256];
3432 /* Check for previous activation */
3434 if (tls_in.active.sock >= 0)
3436 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3437 smtp_printf("554 Already in TLS\r\n", FALSE);
3441 /* Initialize the SSL library. If it fails, it will already have logged
3444 rc = tls_init(NULL, NULL,
3445 #ifndef DISABLE_OCSP
3448 NULL, &dummy_statep, &tls_in, errstr);
3449 if (rc != OK) return rc;
3450 ctx = state_server.lib_state.lib_ctx;
3452 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3453 were historically separated by underscores. So that I can use either form in my
3454 tests, and also for general convenience, we turn underscores into hyphens here.
3456 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3457 for TLS 1.3 . Since we do not call it at present we get the default list:
3458 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3461 if (state_server.lib_state.pri_string)
3462 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3465 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3470 normalise_ciphers(&expciphers, tls_require_ciphers);
3471 if ((rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3476 /* If this is a host for which certificate verification is mandatory or
3477 optional, set up appropriately. */
3479 tls_in.certificate_verified = FALSE;
3481 tls_in.dane_verified = FALSE;
3483 server_verify_callback_called = FALSE;
3485 if (verify_check_host(&tls_verify_hosts) == OK)
3486 server_verify_optional = FALSE;
3487 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3488 server_verify_optional = TRUE;
3493 uschar * v_certs = tls_verify_certificates;
3495 if (state_server.lib_state.cabundle)
3497 DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n");
3498 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3502 if ((rc = setup_certs(ctx, &v_certs, tls_crl, NULL, errstr)) != OK)
3504 if (v_certs && *v_certs)
3505 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3510 #ifndef DISABLE_TLS_RESUME
3511 # if OPENSSL_VERSION_NUMBER < 0x30000000L
3512 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3513 /* despite working, appears to always return failure, so ignoring */
3515 SSL_CTX_set_tlsext_ticket_key_evp_cb(ctx, ticket_key_callback);
3516 /* despite working, appears to always return failure, so ignoring */
3520 #ifdef OPENSSL_HAVE_NUM_TICKETS
3521 # ifndef DISABLE_TLS_RESUME
3522 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3524 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3529 /* Prepare for new connection */
3531 if (!(ssl = SSL_new(ctx)))
3532 return tls_error(US"SSL_new", NULL, NULL, errstr);
3533 state_server.lib_state.lib_ssl = ssl;
3535 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3537 * With the SSL_clear(), we get strange interoperability bugs with
3538 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3539 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3541 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3542 * session shutdown. In this case, we have a brand new object and there's no
3543 * obvious reason to immediately clear it. I'm guessing that this was
3544 * originally added because of incomplete initialisation which the clear fixed,
3545 * in some historic release.
3548 /* Set context and tell client to go ahead, except in the case of TLS startup
3549 on connection, where outputting anything now upsets the clients and tends to
3550 make them disconnect. We need to have an explicit fflush() here, to force out
3551 the response. Other smtp_printf() calls do not need it, because in non-TLS
3552 mode, the fflush() happens when smtp_getc() is called. */
3554 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3555 if (!tls_in.on_connect)
3557 smtp_printf("220 TLS go ahead\r\n", FALSE);
3561 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3562 that the OpenSSL library doesn't. */
3564 SSL_set_wfd(ssl, fileno(smtp_out));
3565 SSL_set_rfd(ssl, fileno(smtp_in));
3566 SSL_set_accept_state(ssl);
3568 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3571 sigalrm_seen = FALSE;
3572 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3573 rc = SSL_accept(ssl);
3578 int error = SSL_get_error(ssl, rc);
3581 case SSL_ERROR_NONE:
3584 case SSL_ERROR_ZERO_RETURN:
3585 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3586 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3587 #ifndef DISABLE_EVENT
3588 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3590 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3593 tls_close(NULL, TLS_NO_SHUTDOWN);
3596 /* Handle genuine errors */
3600 int r = ERR_GET_REASON(ERR_peek_error());
3601 if ( r == SSL_R_WRONG_VERSION_NUMBER
3602 #ifdef SSL_R_VERSION_TOO_LOW
3603 || r == SSL_R_VERSION_TOO_LOW
3605 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3606 s = string_sprintf("(%s)", SSL_get_version(ssl));
3607 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
3608 #ifndef DISABLE_EVENT
3609 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3615 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3616 if (error == SSL_ERROR_SYSCALL)
3620 *errstr = US"SSL_accept: TCP connection closed by peer";
3621 #ifndef DISABLE_EVENT
3622 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3626 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3628 (void) tls_error(US"SSL_accept", NULL,
3629 sigalrm_seen ? US"timed out"
3630 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3632 #ifndef DISABLE_EVENT
3633 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3639 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3640 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3641 anon-authentication ciphersuite negotiated. */
3643 #ifndef DISABLE_TLS_RESUME
3644 if (SSL_session_reused(ssl))
3646 tls_in.resumption |= RESUME_USED;
3647 DEBUG(D_tls) debug_printf("Session reused\n");
3651 #ifdef EXIM_HAVE_ALPN
3652 /* If require-alpn, check server_seen_alpn here. Else abort TLS */
3653 if (!tls_alpn || !*tls_alpn)
3654 { DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n"); }
3655 else if (!server_seen_alpn)
3656 if (verify_check_host(&hosts_require_alpn) == OK)
3658 /* We'd like to send a definitive Alert but OpenSSL provides no facility */
3660 tls_error(US"handshake", NULL, US"ALPN required but not negotiated", errstr);
3664 { DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n"); }
3667 const uschar * name;
3669 SSL_get0_alpn_selected(ssl, &name, &len);
3671 debug_printf("ALPN negotiated: '%.*s'\n", (int)*name, name+1);
3673 debug_printf("ALPN: no protocol negotiated\n");
3678 /* TLS has been set up. Record data for the connection,
3679 adjust the input functions to read via TLS, and initialize things. */
3681 #ifdef SSL_get_extms_support
3682 /*XXX what does this return for tls1.3 ? */
3683 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3685 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3687 tls_in.ver = tlsver_name(ssl);
3688 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3689 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3694 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3695 debug_printf("Shared ciphers: %s\n", buf);
3697 tls_dump_keylog(ssl);
3699 #ifdef EXIM_HAVE_SESSION_TICKET
3701 SSL_SESSION * ss = SSL_get_session(ssl);
3702 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3703 debug_printf("The session has a ticket, life %lu seconds\n",
3704 SSL_SESSION_get_ticket_lifetime_hint(ss));
3709 /* Record the certificate we presented */
3711 X509 * crt = SSL_get_certificate(ssl);
3712 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3715 tls_get_channel_binding(ssl, &tls_in, GET_UNTAINTED);
3717 /* Only used by the server-side tls (tls_in), including tls_getc.
3718 Client-side (tls_out) reads (seem to?) go via
3719 smtp_read_response()/ip_recv().
3720 Hence no need to duplicate for _in and _out.
3722 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3723 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3724 ssl_xfer_eof = ssl_xfer_error = FALSE;
3726 receive_getc = tls_getc;
3727 receive_getbuf = tls_getbuf;
3728 receive_get_cache = tls_get_cache;
3729 receive_hasc = tls_hasc;
3730 receive_ungetc = tls_ungetc;
3731 receive_feof = tls_feof;
3732 receive_ferror = tls_ferror;
3734 tls_in.active.sock = fileno(smtp_out);
3735 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3743 tls_client_basic_ctx_init(SSL_CTX * ctx,
3744 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3749 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3750 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3751 host patterns if one of them is set with content. */
3753 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3754 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3756 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3757 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3760 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3762 client_verify_optional = FALSE;
3763 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3764 client_verify_optional = TRUE;
3769 uschar * v_certs = ob->tls_verify_certificates;
3771 if (state->lib_state.cabundle)
3773 DEBUG(D_tls) debug_printf("TLS: CA bundle for tpt was preloaded\n");
3774 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3778 if ((rc = setup_certs(ctx, &v_certs, ob->tls_crl, host, errstr)) != OK)
3780 if (v_certs && *v_certs)
3781 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3785 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3787 state->verify_cert_hostnames =
3789 string_domain_utf8_to_alabel(host->certname, NULL);
3793 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3794 state->verify_cert_hostnames);
3802 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3805 const char * hostnames[2] = { CS host->name, NULL };
3808 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3809 return tls_error(US"hostnames load", host, NULL, errstr);
3811 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3812 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3813 ) if (rr->type == T_TLSA && rr->size > 3)
3815 const uschar * p = rr->data;
3816 uint8_t usage, selector, mtype;
3817 const char * mdname;
3821 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3822 if (usage != 2 && usage != 3) continue;
3829 default: continue; /* Only match-types 0, 1, 2 are supported */
3830 case 0: mdname = NULL; break;
3831 case 1: mdname = "sha256"; break;
3832 case 2: mdname = "sha512"; break;
3836 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3839 return tls_error(US"tlsa load", host, NULL, errstr);
3840 case 0: /* action not taken */
3844 tls_out.tlsa_usage |= 1<<usage;
3850 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3853 #endif /*SUPPORT_DANE*/
3857 #ifndef DISABLE_TLS_RESUME
3858 /* On the client, get any stashed session for the given IP from hints db
3859 and apply it to the ssl-connection for attempted resumption. */
3862 tls_retrieve_session(tls_support * tlsp, SSL * ssl)
3864 if (tlsp->host_resumable)
3866 dbdata_tls_session * dt;
3868 open_db dbblock, * dbm_file;
3870 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3872 debug_printf("checking for resumable session for %s\n", tlsp->resume_index);
3873 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3875 if ((dt = dbfn_read_with_length(dbm_file, tlsp->resume_index, &len)))
3877 SSL_SESSION * ss = NULL;
3878 const uschar * sess_asn1 = dt->session;
3880 len -= sizeof(dbdata_tls_session);
3881 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3885 ERR_error_string_n(ERR_get_error(),
3886 ssl_errstring, sizeof(ssl_errstring));
3887 debug_printf("decoding session: %s\n", ssl_errstring);
3892 unsigned long lifetime =
3893 #ifdef EXIM_HAVE_SESSION_TICKET
3894 SSL_SESSION_get_ticket_lifetime_hint(ss);
3895 #else /* Use, fairly arbitrilarily, what we as server would */
3896 f.running_in_test_harness ? 6 : ssl_session_timeout;
3898 if (lifetime + dt->time_stamp < time(NULL))
3900 DEBUG(D_tls) debug_printf("session expired\n");
3901 dbfn_delete(dbm_file, tlsp->resume_index);
3903 else if (SSL_set_session(ssl, ss))
3905 DEBUG(D_tls) debug_printf("good session\n");
3906 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3907 tlsp->verify_override = dt->verify_override;
3908 tlsp->ocsp = dt->ocsp;
3912 ERR_error_string_n(ERR_get_error(),
3913 ssl_errstring, sizeof(ssl_errstring));
3914 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3919 DEBUG(D_tls) debug_printf("no session record\n");
3920 dbfn_close(dbm_file);
3926 /* On the client, save the session for later resumption */
3929 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3931 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3934 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3936 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3938 # ifdef OPENSSL_HAVE_NUM_TICKETS
3939 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3942 int len = i2d_SSL_SESSION(ss, NULL);
3943 int dlen = sizeof(dbdata_tls_session) + len;
3944 dbdata_tls_session * dt = store_get(dlen, GET_TAINTED);
3945 uschar * s = dt->session;
3946 open_db dbblock, * dbm_file;
3948 DEBUG(D_tls) debug_printf("session is resumable\n");
3949 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3951 dt->verify_override = tlsp->verify_override;
3952 dt->ocsp = tlsp->ocsp;
3953 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3955 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3957 dbfn_write(dbm_file, tlsp->resume_index, dt, dlen);
3958 dbfn_close(dbm_file);
3959 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3967 /* Construct a key for session DB lookup, and setup the SSL_CTX for resumption */
3970 tls_client_ctx_resume_prehandshake(
3971 exim_openssl_client_tls_ctx * exim_client_ctx, smtp_connect_args * conn_args,
3972 tls_support * tlsp, smtp_transport_options_block * ob)
3974 tlsp->host_resumable = TRUE;
3975 tls_client_resmption_key(tlsp, conn_args, ob);
3977 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3978 SSL_SESS_CACHE_CLIENT
3979 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3980 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3984 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3985 host_item * host, uschar ** errstr)
3987 if (tlsp->host_resumable)
3990 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3991 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3993 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3994 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
3996 tls_error(US"set ex_data", host, NULL, errstr);
3999 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state);
4002 tlsp->resumption = RESUME_SUPPORTED;
4003 /* Pick up a previous session, saved on an old ticket */
4004 tls_retrieve_session(tlsp, ssl);
4009 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
4012 if (SSL_session_reused(exim_client_ctx->ssl))
4014 DEBUG(D_tls) debug_printf("The session was reused\n");
4015 tlsp->resumption |= RESUME_USED;
4018 #endif /* !DISABLE_TLS_RESUME */
4021 #ifdef EXIM_HAVE_ALPN
4022 /* Expand and convert an Exim list to an ALPN list. False return for fail.
4023 NULL plist return for silent no-ALPN.
4025 Overwite the passed-in list with the expanded version.
4029 tls_alpn_plist(uschar ** tls_alpn, const uschar ** plist, unsigned * plen,
4034 if (!expand_check(*tls_alpn, US"tls_alpn", &exp_alpn, errstr))
4036 *tls_alpn = exp_alpn;
4040 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
4045 /* The server implementation only accepts exactly one protocol name
4046 but it's little extra code complexity in the client. */
4048 const uschar * list = exp_alpn;
4049 uschar * p = store_get(Ustrlen(exp_alpn), exp_alpn), * s, * t;
4053 for (t = p; s = string_nextinlist(&list, &sep, NULL, 0); t += len)
4055 *t++ = len = (uschar) Ustrlen(s);
4058 *plist = (*plen = t - p) ? p : NULL;
4062 #endif /* EXIM_HAVE_ALPN */
4065 /*************************************************
4066 * Start a TLS session in a client *
4067 *************************************************/
4069 /* Called from the smtp transport after STARTTLS has been accepted.
4072 cctx connection context
4073 conn_args connection details
4074 cookie datum for randomness; can be NULL
4075 tlsp record details of TLS channel configuration here; must be non-NULL
4076 errstr error string pointer
4078 Returns: TRUE for success with TLS session context set in connection context,
4083 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
4084 void * cookie, tls_support * tlsp, uschar ** errstr)
4086 host_item * host = conn_args->host; /* for msgs and option-tests */
4087 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
4088 smtp_transport_options_block * ob = tb
4089 ? (smtp_transport_options_block *)tb->options_block
4090 : &smtp_transport_option_defaults;
4091 exim_openssl_client_tls_ctx * exim_client_ctx;
4092 uschar * expciphers;
4094 static uschar peerdn[256];
4096 #ifndef DISABLE_OCSP
4097 BOOL request_ocsp = FALSE;
4098 BOOL require_ocsp = FALSE;
4102 store_pool = POOL_PERM;
4103 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), GET_UNTAINTED);
4104 exim_client_ctx->corked = NULL;
4108 tlsp->tlsa_usage = 0;
4111 #ifndef DISABLE_OCSP
4113 # ifdef SUPPORT_DANE
4114 if ( conn_args->dane
4115 && ob->hosts_request_ocsp[0] == '*'
4116 && ob->hosts_request_ocsp[1] == '\0'
4119 /* Unchanged from default. Use a safer one under DANE */
4120 request_ocsp = TRUE;
4121 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
4122 " {= {4}{$tls_out_tlsa_usage}} } "
4128 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
4129 request_ocsp = TRUE;
4131 # ifdef SUPPORT_DANE
4135 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4137 # if defined(SUPPORT_DANE) && !defined(EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER)
4138 if (conn_args->dane && (require_ocsp || request_ocsp))
4140 DEBUG(D_tls) debug_printf("OpenSSL version to early to combine OCSP"
4141 " and DANE; disabling OCSP\n");
4142 require_ocsp = request_ocsp = FALSE;
4148 rc = tls_init(host, ob,
4149 #ifndef DISABLE_OCSP
4150 (void *)(long)request_ocsp,
4152 cookie, &client_static_state, tlsp, errstr);
4153 if (rc != OK) return FALSE;
4155 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
4157 tlsp->certificate_verified = FALSE;
4158 client_verify_callback_called = FALSE;
4162 if (conn_args->dane)
4164 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
4165 other failures should be treated as problems. */
4166 if (ob->dane_require_tls_ciphers &&
4167 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
4168 &expciphers, errstr))
4170 if (expciphers && *expciphers == '\0')
4173 normalise_ciphers(&expciphers, ob->dane_require_tls_ciphers);
4178 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
4179 &expciphers, errstr))
4182 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
4183 are separated by underscores. So that I can use either form in my tests, and
4184 also for general convenience, we turn underscores into hyphens here. */
4186 normalise_ciphers(&expciphers, ob->tls_require_ciphers);
4191 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
4192 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
4194 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
4200 if (conn_args->dane)
4202 SSL_CTX_set_verify(exim_client_ctx->ctx,
4203 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
4204 verify_callback_client_dane);
4206 if (!DANESSL_library_init())
4208 tls_error(US"library init", host, NULL, errstr);
4211 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
4213 tls_error(US"context init", host, NULL, errstr);
4216 DEBUG(D_tls) debug_printf("since dane-mode conn, not loading the usual CA bundle\n");
4222 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
4223 client_static_state, errstr) != OK)
4228 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
4231 { DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n"); }
4232 else if (!Ustrlen(tlsp->sni))
4236 #ifndef EXIM_HAVE_OPENSSL_TLSEXT
4237 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
4245 #ifdef EXIM_HAVE_ALPN
4247 const uschar * plist;
4250 if (!tls_alpn_plist(&ob->tls_alpn, &plist, &plen, errstr))
4253 if (SSL_CTX_set_alpn_protos(exim_client_ctx->ctx, plist, plen) != 0)
4255 tls_error(US"alpn init", host, NULL, errstr);
4259 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
4262 log_write(0, LOG_MAIN, "ALPN unusable with this OpenSSL library version; ignoring \"%s\"\n",
4266 #ifndef DISABLE_TLS_RESUME
4267 /*XXX have_lbserver: another cmdline arg possibly, for continued-conn, but use
4268 will be very low. */
4270 if (!conn_args->have_lbserver) /* wanted for tls_client_resmption_key() */
4271 { DEBUG(D_tls) debug_printf("resumption not supported on continued-connection\n"); }
4272 else if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
4273 tls_client_ctx_resume_prehandshake(exim_client_ctx, conn_args, tlsp, ob);
4277 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
4279 tls_error(US"SSL_new", host, NULL, errstr);
4282 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
4283 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
4284 SSL_set_connect_state(exim_client_ctx->ssl);
4286 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
4289 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
4290 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
4295 if (conn_args->dane)
4296 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
4300 #ifndef DISABLE_OCSP
4301 /* Request certificate status at connection-time. If the server
4302 does OCSP stapling we will get the callback (set in tls_init()) */
4303 # ifdef SUPPORT_DANE
4307 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4308 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4310 { /* Re-eval now $tls_out_tlsa_usage is populated. If
4311 this means we avoid the OCSP request, we wasted the setup
4312 cost in tls_init(). */
4313 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
4314 request_ocsp = require_ocsp
4315 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4322 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
4323 client_static_state->u_ocsp.client.verify_required = require_ocsp;
4324 tlsp->ocsp = OCSP_NOT_RESP;
4328 #ifndef DISABLE_TLS_RESUME
4329 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
4334 #ifndef DISABLE_EVENT
4335 client_static_state->event_action = tb ? tb->event_action : NULL;
4338 /* There doesn't seem to be a built-in timeout on connection. */
4340 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
4341 sigalrm_seen = FALSE;
4342 ALARM(ob->command_timeout);
4343 rc = SSL_connect(exim_client_ctx->ssl);
4347 if (conn_args->dane)
4348 DANESSL_cleanup(exim_client_ctx->ssl);
4353 #ifndef DISABLE_OCSP
4354 if (client_static_state->u_ocsp.client.verify_errstr)
4355 { if (errstr) *errstr = client_static_state->u_ocsp.client.verify_errstr; }
4358 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
4364 debug_printf("SSL_connect succeeded\n");
4365 tls_dump_keylog(exim_client_ctx->ssl);
4368 #ifndef DISABLE_TLS_RESUME
4369 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
4372 #ifdef EXIM_HAVE_ALPN
4373 if (ob->tls_alpn) /* We requested. See what was negotiated. */
4375 const uschar * name;
4378 SSL_get0_alpn_selected(exim_client_ctx->ssl, &name, &len);
4380 { DEBUG(D_tls) debug_printf("ALPN negotiated %u: '%.*s'\n", len, (int)*name, name+1); }
4381 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
4383 /* Would like to send a relevant fatal Alert, but OpenSSL has no API */
4384 tls_error(US"handshake", host, US"ALPN required but not negotiated", errstr);
4390 #ifdef SSL_get_extms_support
4391 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
4393 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
4395 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
4396 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
4397 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
4399 /* Record the certificate we presented */
4401 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
4402 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
4405 /*XXX will this work with continued-TLS? */
4406 tls_get_channel_binding(exim_client_ctx->ssl, tlsp, GET_TAINTED);
4408 tlsp->active.sock = cctx->sock;
4409 tlsp->active.tls_ctx = exim_client_ctx;
4410 cctx->tls_ctx = exim_client_ctx;
4419 tls_refill(unsigned lim)
4421 SSL * ssl = state_server.lib_state.lib_ssl;
4425 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4426 ssl_xfer_buffer, ssl_xfer_buffer_size);
4429 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4430 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
4431 MIN(ssl_xfer_buffer_size, lim));
4432 error = SSL_get_error(ssl, inbytes);
4433 if (smtp_receive_timeout > 0) ALARM_CLR(0);
4435 if (had_command_timeout) /* set by signal handler */
4436 smtp_command_timeout_exit(); /* does not return */
4437 if (had_command_sigterm)
4438 smtp_command_sigterm_exit();
4439 if (had_data_timeout)
4440 smtp_data_timeout_exit();
4441 if (had_data_sigint)
4442 smtp_data_sigint_exit();
4444 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
4445 closed down, not that the socket itself has been closed down. Revert to
4446 non-SSL handling. */
4450 case SSL_ERROR_NONE:
4453 case SSL_ERROR_ZERO_RETURN:
4454 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4456 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
4459 tls_close(NULL, TLS_NO_SHUTDOWN);
4462 /* Handle genuine errors */
4464 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4465 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
4466 ssl_xfer_error = TRUE;
4470 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
4471 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
4472 debug_printf(" - syscall %s\n", strerror(errno));
4473 ssl_xfer_error = TRUE;
4477 #ifndef DISABLE_DKIM
4478 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
4480 ssl_xfer_buffer_hwm = inbytes;
4481 ssl_xfer_buffer_lwm = 0;
4486 /*************************************************
4487 * TLS version of getc *
4488 *************************************************/
4490 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
4491 it refills the buffer via the SSL reading function.
4493 Arguments: lim Maximum amount to read/buffer
4494 Returns: the next character or EOF
4496 Only used by the server-side TLS.
4500 tls_getc(unsigned lim)
4502 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4503 if (!tls_refill(lim))
4504 return ssl_xfer_error ? EOF : smtp_getc(lim);
4506 /* Something in the buffer; return next uschar */
4508 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
4514 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm;
4518 tls_getbuf(unsigned * len)
4523 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4524 if (!tls_refill(*len))
4526 if (!ssl_xfer_error) return smtp_getbuf(len);
4531 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4533 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4534 ssl_xfer_buffer_lwm += size;
4541 tls_get_cache(unsigned lim)
4543 #ifndef DISABLE_DKIM
4544 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4548 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4554 tls_could_getc(void)
4556 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4557 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4561 /*************************************************
4562 * Read bytes from TLS channel *
4563 *************************************************/
4567 ct_ctx client context pointer, or NULL for the one global server context
4571 Returns: the number of bytes read
4572 -1 after a failed read, including EOF
4574 Only used by the client-side TLS.
4578 tls_read(void * ct_ctx, uschar *buff, size_t len)
4580 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4581 : state_server.lib_state.lib_ssl;
4585 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4586 buff, (unsigned int)len);
4589 inbytes = SSL_read(ssl, CS buff, len);
4590 error = SSL_get_error(ssl, inbytes);
4592 if (error == SSL_ERROR_ZERO_RETURN)
4594 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4597 else if (error != SSL_ERROR_NONE)
4607 /*************************************************
4608 * Write bytes down TLS channel *
4609 *************************************************/
4613 ct_ctx client context pointer, or NULL for the one global server context
4616 more further data expected soon
4618 Returns: the number of bytes after a successful write,
4619 -1 after a failed write
4621 Used by both server-side and client-side TLS. Calling with len zero and more unset
4622 will flush buffered writes; buff can be null for this case.
4626 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4629 int outbytes, error;
4631 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4632 : state_server.lib_state.lib_ssl;
4633 static gstring * server_corked = NULL;
4634 gstring ** corkedp = ct_ctx
4635 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4636 gstring * corked = *corkedp;
4638 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4639 buff, (unsigned long)len, more ? ", more" : "");
4641 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4642 "more" is notified. This hack is only ok if small amounts are involved AND only
4643 one stream does it, in one context (i.e. no store reset). Currently it is used
4644 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4645 We support callouts done by the server process by using a separate client
4646 context for the stashed information. */
4647 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4648 a store reset there, so use POOL_PERM. */
4649 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4653 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4655 int save_pool = store_pool;
4656 store_pool = POOL_PERM;
4658 corked = string_catn(corked, buff, len);
4660 store_pool = save_pool;
4667 buff = CUS corked->s;
4672 for (int left = len; left > 0;)
4674 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4676 outbytes = SSL_write(ssl, CS buff, left);
4677 error = SSL_get_error(ssl, outbytes);
4678 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4681 case SSL_ERROR_NONE: /* the usual case */
4687 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4688 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4691 case SSL_ERROR_ZERO_RETURN:
4692 log_write(0, LOG_MAIN, "SSL channel closed on write");
4695 case SSL_ERROR_SYSCALL:
4696 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4697 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4698 sender_fullhost ? sender_fullhost : US"<unknown>",
4700 else if (LOGGING(protocol_detail))
4701 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4702 " SMTP response and TLS close\n", sender_host_address);
4704 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4705 " client reset TCP before TLS close\n", sender_host_address);
4709 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4720 ct_ctx client TLS context pointer, or NULL for the one global server context
4724 tls_shutdown_wr(void * ct_ctx)
4726 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4727 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4728 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4731 if (*fdp < 0) return; /* TLS was not active */
4733 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4735 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
4736 rc = SSL_shutdown(*sslp);
4737 if (rc < 0) DEBUG(D_tls)
4739 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4740 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4744 /*************************************************
4745 * Close down a TLS session *
4746 *************************************************/
4748 /* This is also called from within a delivery subprocess forked from the
4749 daemon, to shut down the TLS library, without actually doing a shutdown (which
4750 would tamper with the SSL session in the parent process).
4753 ct_ctx client TLS context pointer, or NULL for the one global server context
4754 do_shutdown 0 no data-flush or TLS close-alert
4755 1 if TLS close-alert is to be sent,
4756 2 if also response to be waited for
4760 Used by both server-side and client-side TLS.
4764 tls_close(void * ct_ctx, int do_shutdown)
4766 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4767 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4768 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4770 if (*fdp < 0) return; /* TLS was not active */
4772 if (do_shutdown > TLS_NO_SHUTDOWN)
4775 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4776 do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
4778 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4780 if ( ( do_shutdown >= TLS_SHUTDOWN_WONLY
4781 || (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4783 && do_shutdown > TLS_SHUTDOWN_NOWAIT
4786 #ifdef EXIM_TCP_CORK
4787 (void) setsockopt(*fdp, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
4790 rc = SSL_shutdown(*sslp); /* wait for response */
4794 if (rc < 0) DEBUG(D_tls)
4796 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4797 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4801 if (!o_ctx) /* server side */
4803 #ifndef DISABLE_OCSP
4804 sk_X509_pop_free(state_server.u_ocsp.server.verify_stack, X509_free);
4805 state_server.u_ocsp.server.verify_stack = NULL;
4808 receive_getc = smtp_getc;
4809 receive_getbuf = smtp_getbuf;
4810 receive_get_cache = smtp_get_cache;
4811 receive_hasc = smtp_hasc;
4812 receive_ungetc = smtp_ungetc;
4813 receive_feof = smtp_feof;
4814 receive_ferror = smtp_ferror;
4815 tls_in.active.tls_ctx = NULL;
4817 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4828 /*************************************************
4829 * Let tls_require_ciphers be checked at startup *
4830 *************************************************/
4832 /* The tls_require_ciphers option, if set, must be something which the
4835 Returns: NULL on success, or error message
4839 tls_validate_require_cipher(void)
4842 uschar * expciphers, * err;
4846 if (!(tls_require_ciphers && *tls_require_ciphers))
4849 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4851 return US"failed to expand tls_require_ciphers";
4853 if (!(expciphers && *expciphers))
4856 normalise_ciphers(&expciphers, tls_require_ciphers);
4859 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4862 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4864 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4866 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4867 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4868 expciphers, ssl_errstring);
4879 /*************************************************
4880 * Report the library versions. *
4881 *************************************************/
4883 /* There have historically been some issues with binary compatibility in
4884 OpenSSL libraries; if Exim (like many other applications) is built against
4885 one version of OpenSSL but the run-time linker picks up another version,
4886 it can result in serious failures, including crashing with a SIGSEGV. So
4887 report the version found by the compiler and the run-time version.
4889 Note: some OS vendors backport security fixes without changing the version
4890 number/string, and the version date remains unchanged. The _build_ date
4891 will change, so we can more usefully assist with version diagnosis by also
4892 reporting the build date.
4894 Arguments: string to append to
4899 tls_version_report(gstring * g)
4901 return string_fmt_append(g,
4902 "Library version: OpenSSL: Compile: %s\n"
4905 OPENSSL_VERSION_TEXT,
4906 SSLeay_version(SSLEAY_VERSION),
4907 SSLeay_version(SSLEAY_BUILT_ON));
4908 /* third line is 38 characters for the %s and the line is 73 chars long;
4909 the OpenSSL output includes a "built on: " prefix already. */
4915 /*************************************************
4916 * Random number generation *
4917 *************************************************/
4919 /* Pseudo-random number generation. The result is not expected to be
4920 cryptographically strong but not so weak that someone will shoot themselves
4921 in the foot using it as a nonce in input in some email header scheme or
4922 whatever weirdness they'll twist this into. The result should handle fork()
4923 and avoid repeating sequences. OpenSSL handles that for us.
4927 Returns a random number in range [0, max-1]
4931 vaguely_random_number(int max)
4935 static pid_t pidlast = 0;
4937 uschar smallbuf[sizeof(r)];
4943 if (pidnow != pidlast)
4945 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
4946 is unique for each thread", this doesn't apparently apply across processes,
4947 so our own warning from vaguely_random_number_fallback() applies here too.
4948 Fix per PostgreSQL. */
4954 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
4958 gettimeofday(&r.tv, NULL);
4961 RAND_seed(US (&r), sizeof(r));
4963 /* We're after pseudo-random, not random; if we still don't have enough data
4964 in the internal PRNG then our options are limited. We could sleep and hope
4965 for entropy to come along (prayer technique) but if the system is so depleted
4966 in the first place then something is likely to just keep taking it. Instead,
4967 we'll just take whatever little bit of pseudo-random we can still manage to
4970 needed_len = sizeof(r);
4971 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4972 asked for a number less than 10. */
4973 for (r = max, i = 0; r; ++i)
4979 #ifdef EXIM_HAVE_RAND_PSEUDO
4980 /* We do not care if crypto-strong */
4981 i = RAND_pseudo_bytes(smallbuf, needed_len);
4983 i = RAND_bytes(smallbuf, needed_len);
4989 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
4990 return vaguely_random_number_fallback(max);
4994 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4997 /* We don't particularly care about weighted results; if someone wants
4998 smooth distribution and cares enough then they should submit a patch then. */
5005 /*************************************************
5006 * OpenSSL option parse *
5007 *************************************************/
5009 /* Parse one option for tls_openssl_options_parse below
5012 name one option name
5013 value place to store a value for it
5014 Returns success or failure in parsing
5020 tls_openssl_one_option_parse(uschar *name, long *value)
5023 int last = exim_openssl_options_size;
5024 while (last > first)
5026 int middle = (first + last)/2;
5027 int c = Ustrcmp(name, exim_openssl_options[middle].name);
5030 *value = exim_openssl_options[middle].value;
5044 /*************************************************
5045 * OpenSSL option parsing logic *
5046 *************************************************/
5048 /* OpenSSL has a number of compatibility options which an administrator might
5049 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
5050 we look like log_selector.
5053 option_spec the administrator-supplied string of options
5054 results ptr to long storage for the options bitmap
5055 Returns success or failure
5059 tls_openssl_options_parse(uschar *option_spec, long *results)
5062 uschar * exp, * end;
5063 BOOL adding, item_parsed;
5065 /* Server: send no (<= TLS1.2) session tickets */
5066 result = SSL_OP_NO_TICKET;
5068 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
5069 from default because it increases BEAST susceptibility. */
5070 #ifdef SSL_OP_NO_SSLv2
5071 result |= SSL_OP_NO_SSLv2;
5073 #ifdef SSL_OP_NO_SSLv3
5074 result |= SSL_OP_NO_SSLv3;
5076 #ifdef SSL_OP_SINGLE_DH_USE
5077 result |= SSL_OP_SINGLE_DH_USE;
5079 #ifdef SSL_OP_NO_RENEGOTIATION
5080 result |= SSL_OP_NO_RENEGOTIATION;
5089 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
5092 for (uschar * s = exp; *s; /**/)
5094 while (isspace(*s)) ++s;
5097 if (*s != '+' && *s != '-')
5099 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
5100 "+ or - expected but found \"%s\"\n", s);
5103 adding = *s++ == '+';
5104 for (end = s; *end && !isspace(*end); ) end++;
5105 item_parsed = tls_openssl_one_option_parse(string_copyn(s, end-s), &item);
5108 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
5111 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
5112 adding ? "adding to " : "removing from", result, item, s);
5124 #endif /*!MACRO_PREDEF*/
5127 /* End of tls-openssl.c */