1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2019 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Portions Copyright (c) The OpenSSL Project 1999 */
11 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
12 library. It is #included into the tls.c file when that library is used. The
13 code herein is based on a patch that was originally contributed by Steve
14 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
16 No cryptographic code is included in Exim. All this module does is to call
17 functions from the OpenSSL library. */
22 #include <openssl/lhash.h>
23 #include <openssl/ssl.h>
24 #include <openssl/err.h>
25 #include <openssl/rand.h>
26 #ifndef OPENSSL_NO_ECDH
27 # include <openssl/ec.h>
30 # include <openssl/ocsp.h>
38 # define EXIM_OCSP_SKEW_SECONDS (300L)
39 # define EXIM_OCSP_MAX_AGE (-1L)
42 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
43 # define EXIM_HAVE_OPENSSL_TLSEXT
45 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
46 # define EXIM_HAVE_RSA_GENKEY_EX
48 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
49 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define OPENSSL_AUTO_SHA256
51 # define OPENSSL_MIN_PROTO_VERSION
53 # define EXIM_HAVE_EPHEM_RSA_KEX
54 # define EXIM_HAVE_RAND_PSEUDO
56 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
57 # define EXIM_HAVE_SHA256
60 /* X509_check_host provides sane certificate hostname checking, but was added
61 to OpenSSL late, after other projects forked off the code-base. So in
62 addition to guarding against the base version number, beware that LibreSSL
63 does not (at this time) support this function.
65 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
66 opt to disentangle and ask a LibreSSL user to provide glue for a third
67 crypto provider for libtls instead of continuing to tie the OpenSSL glue
68 into even twistier knots. If LibreSSL gains the same API, we can just
69 change this guard and punt the issue for a while longer. */
71 #ifndef LIBRESSL_VERSION_NUMBER
72 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
73 # define EXIM_HAVE_OPENSSL_CHECKHOST
74 # define EXIM_HAVE_OPENSSL_DH_BITS
75 # define EXIM_HAVE_OPENSSL_TLS_METHOD
76 # define EXIM_HAVE_OPENSSL_KEYLOG
77 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
78 # define EXIM_HAVE_SESSION_TICKET
79 # define EXIM_HAVE_OPESSL_TRACE
80 # define EXIM_HAVE_OPESSL_GET0_SERIAL
82 # define EXIM_HAVE_OCSP
84 # define EXIM_HAVE_ALPN /* fail ret from hshake-cb is ignored by LibreSSL */
86 # define EXIM_NEED_OPENSSL_INIT
88 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
89 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
90 # define EXIM_HAVE_OPENSSL_CHECKHOST
94 #if LIBRESSL_VERSION_NUMBER >= 0x3040000fL
95 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
98 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x030000000L)
99 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
102 #if !defined(LIBRESSL_VERSION_NUMBER) \
103 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
104 # if !defined(OPENSSL_NO_ECDH)
105 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
106 # define EXIM_HAVE_ECDH
108 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
109 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
114 #ifndef LIBRESSL_VERSION_NUMBER
115 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
116 # define OPENSSL_HAVE_KEYLOG_CB
117 # define OPENSSL_HAVE_NUM_TICKETS
118 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
119 # define EXIM_HAVE_EXP_CHNL_BNGNG
121 # define OPENSSL_BAD_SRVR_OURCERT
125 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x010002000L)
126 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
129 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
130 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
131 # define DISABLE_OCSP
134 #ifndef DISABLE_TLS_RESUME
135 # if OPENSSL_VERSION_NUMBER < 0x0101010L
136 # error OpenSSL version too old for session-resumption
140 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
141 # include <openssl/x509v3.h>
144 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
145 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
146 # define SSL_CIPHER_get_id(c) (c->id)
148 # ifndef MACRO_PREDEF
149 # include "tls-cipher-stdname.c"
153 /*************************************************
154 * OpenSSL option parse *
155 *************************************************/
157 typedef struct exim_openssl_option {
160 } exim_openssl_option;
161 /* We could use a macro to expand, but we need the ifdef and not all the
162 options document which version they were introduced in. Policylet: include
163 all options unless explicitly for DTLS, let the administrator choose which
166 This list is current as of:
169 XXX could we autobuild this list, as with predefined-macros?
170 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
171 Also allow a numeric literal?
173 static exim_openssl_option exim_openssl_options[] = {
174 /* KEEP SORTED ALPHABETICALLY! */
176 { US"all", (long) SSL_OP_ALL },
178 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
179 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
181 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
182 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
184 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
185 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
187 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
188 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
190 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
191 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
193 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
194 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
196 #ifdef SSL_OP_EPHEMERAL_RSA
197 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
199 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
200 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
202 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
203 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
205 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
206 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
208 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
209 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
211 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
212 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
214 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
215 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
217 #ifdef SSL_OP_NO_ANTI_REPLAY
218 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
220 #ifdef SSL_OP_NO_COMPRESSION
221 { US"no_compression", SSL_OP_NO_COMPRESSION },
223 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
224 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
226 #ifdef SSL_OP_NO_RENEGOTIATION
227 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
229 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
230 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
232 #ifdef SSL_OP_NO_SSLv2
233 { US"no_sslv2", SSL_OP_NO_SSLv2 },
235 #ifdef SSL_OP_NO_SSLv3
236 { US"no_sslv3", SSL_OP_NO_SSLv3 },
238 #ifdef SSL_OP_NO_TICKET
239 { US"no_ticket", SSL_OP_NO_TICKET },
241 #ifdef SSL_OP_NO_TLSv1
242 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
244 #ifdef SSL_OP_NO_TLSv1_1
245 # if OPENSSL_VERSION_NUMBER < 0x30000000L
246 # if SSL_OP_NO_TLSv1_1 == 0x00000400L
247 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
248 # warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
249 # define NO_SSL_OP_NO_TLSv1_1
252 # ifndef NO_SSL_OP_NO_TLSv1_1
253 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
256 #ifdef SSL_OP_NO_TLSv1_2
257 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
259 #ifdef SSL_OP_NO_TLSv1_3
260 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
262 #ifdef SSL_OP_PRIORITIZE_CHACHA
263 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
265 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
266 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
268 #ifdef SSL_OP_SINGLE_DH_USE
269 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
271 #ifdef SSL_OP_SINGLE_ECDH_USE
272 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
274 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
275 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
277 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
278 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
280 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
281 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
283 #ifdef SSL_OP_TLS_D5_BUG
284 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
286 #ifdef SSL_OP_TLS_ROLLBACK_BUG
287 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
289 #ifdef SSL_OP_TLSEXT_PADDING
290 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
295 static int exim_openssl_options_size = nelem(exim_openssl_options);
296 static long init_options = 0;
305 for (struct exim_openssl_option * o = exim_openssl_options;
306 o < exim_openssl_options + nelem(exim_openssl_options); o++)
308 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
309 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
311 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
312 builtin_macro_create(buf);
315 # ifndef DISABLE_TLS_RESUME
316 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
318 # ifdef SSL_OP_NO_TLSv1_3
319 builtin_macro_create(US"_HAVE_TLS1_3");
321 # ifdef OPENSSL_BAD_SRVR_OURCERT
322 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
324 # ifdef EXIM_HAVE_OCSP
325 builtin_macro_create(US"_HAVE_TLS_OCSP");
326 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
328 # ifdef EXIM_HAVE_ALPN
329 builtin_macro_create(US"_HAVE_TLS_ALPN");
334 /******************************************************************************/
336 /* Structure for collecting random data for seeding. */
338 typedef struct randstuff {
343 /* Local static variables */
345 static BOOL client_verify_callback_called = FALSE;
346 static BOOL server_verify_callback_called = FALSE;
347 static const uschar *sid_ctx = US"exim";
349 /* We have three different contexts to care about.
351 Simple case: client, `client_ctx`
352 As a client, we can be doing a callout or cut-through delivery while receiving
353 a message. So we have a client context, which should have options initialised
354 from the SMTP Transport. We may also concurrently want to make TLS connections
355 to utility daemons, so client-contexts are allocated and passed around in call
356 args rather than using a gobal.
359 There are two cases: with and without ServerNameIndication from the client.
360 Given TLS SNI, we can be using different keys, certs and various other
361 configuration settings, because they're re-expanded with $tls_sni set. This
362 allows vhosting with TLS. This SNI is sent in the handshake.
363 A client might not send SNI, so we need a fallback, and an initial setup too.
364 So as a server, we start out using `server_ctx`.
365 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
366 `server_sni` from `server_ctx` and then initialise settings by re-expanding
374 } exim_openssl_client_tls_ctx;
377 /* static SSL_CTX *server_ctx = NULL; */
378 /* static SSL *server_ssl = NULL; */
380 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
381 static SSL_CTX *server_sni = NULL;
383 #ifdef EXIM_HAVE_ALPN
384 static BOOL server_seen_alpn = FALSE;
387 static char ssl_errstring[256];
389 static int ssl_session_timeout = 7200; /* Two hours */
390 static BOOL client_verify_optional = FALSE;
391 static BOOL server_verify_optional = FALSE;
393 static BOOL reexpand_tls_files_for_sni = FALSE;
396 typedef struct ocsp_resp {
397 struct ocsp_resp * next;
398 OCSP_RESPONSE * resp;
401 typedef struct exim_openssl_state {
402 exim_tlslib_state lib_state;
403 #define lib_ctx libdata0
404 #define lib_ssl libdata1
407 uschar * certificate;
411 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
415 const uschar *file_expanded;
416 ocsp_resplist *olist;
419 X509_STORE *verify_store; /* non-null if status requested */
420 BOOL verify_required;
425 /* these are cached from first expand */
426 uschar * server_cipher_list;
427 /* only passed down to tls_error: */
429 const uschar * verify_cert_hostnames;
430 #ifndef DISABLE_EVENT
431 uschar * event_action;
433 } exim_openssl_state_st;
435 /* should figure out a cleanup of API to handle state preserved per
436 implementation, for various reasons, which can be void * in the APIs.
437 For now, we hack around it. */
438 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
439 exim_openssl_state_st state_server = {.is_server = TRUE};
442 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
447 static int tls_server_stapling_cb(SSL *s, void *arg);
448 static void x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk);
449 static void x509_store_dump_cert_s_names(X509_STORE * store);
454 /* Daemon-called, before every connection, key create/rotate */
455 #ifndef DISABLE_TLS_RESUME
456 static void tk_init(void);
457 static int tls_exdata_idx = -1;
461 tls_per_lib_daemon_tick(void)
463 #ifndef DISABLE_TLS_RESUME
468 /* Called once at daemon startup */
471 tls_per_lib_daemon_init(void)
473 tls_daemon_creds_reload();
477 /*************************************************
479 *************************************************/
481 /* Called from lots of places when errors occur before actually starting to do
482 the TLS handshake, that is, while the session is still in clear. Always returns
483 DEFER for a server and FAIL for a client so that most calls can use "return
484 tls_error(...)" to do this processing and then give an appropriate return. A
485 single function is used for both server and client, because it is called from
486 some shared functions.
489 prefix text to include in the logged error
490 host NULL if setting up a server;
491 the connected host if setting up a client
492 msg error message or NULL if we should ask OpenSSL
493 errstr pointer to output error message
495 Returns: OK/DEFER/FAIL
499 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
503 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
504 msg = US ssl_errstring;
507 msg = string_sprintf("(%s): %s", prefix, msg);
508 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
509 if (errstr) *errstr = msg;
510 return host ? FAIL : DEFER;
515 /**************************************************
516 * General library initalisation *
517 **************************************************/
520 lib_rand_init(void * addr)
523 if (!RAND_status()) return TRUE;
525 gettimeofday(&r.tv, NULL);
527 RAND_seed(US (&r), sizeof(r));
528 RAND_seed(US big_buffer, big_buffer_size);
529 if (addr) RAND_seed(US addr, sizeof(addr));
531 return RAND_status();
536 tls_openssl_init(void)
538 static BOOL once = FALSE;
542 #ifdef EXIM_NEED_OPENSSL_INIT
543 SSL_load_error_strings(); /* basic set up */
544 OpenSSL_add_ssl_algorithms();
547 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
548 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
549 list of available digests. */
550 EVP_add_digest(EVP_sha256());
553 (void) lib_rand_init(NULL);
554 (void) tls_openssl_options_parse(openssl_options, &init_options);
559 /*************************************************
560 * Initialize for DH *
561 *************************************************/
563 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
567 sctx The current SSL CTX (inbound or outbound)
568 dhparam DH parameter file or fixed parameter identity string
569 errstr error string pointer
571 Returns: TRUE if OK (nothing to set up, or setup worked)
575 init_dh(SSL_CTX * sctx, uschar * dhparam, uschar ** errstr)
578 #if OPENSSL_VERSION_NUMBER < 0x30000000L
587 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
590 if (!dhexpanded || !*dhexpanded)
591 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
592 else if (dhexpanded[0] == '/')
594 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
596 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
597 NULL, US strerror(errno), errstr);
603 if (Ustrcmp(dhexpanded, "none") == 0)
605 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
609 if (!(pem = std_dh_prime_named(dhexpanded)))
611 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
612 NULL, US strerror(errno), errstr);
615 bio = BIO_new_mem_buf(CS pem, -1);
619 #if OPENSSL_VERSION_NUMBER < 0x30000000L
620 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)
622 pkey = PEM_read_bio_Parameters_ex(bio, NULL, NULL, NULL)
627 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
632 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
633 an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with 2236.
634 But older OpenSSL can only report in bytes (octets), not bits. If someone wants
635 to dance at the edge, then they can raise the limit or use current libraries. */
637 #if OPENSSL_VERSION_NUMBER < 0x30000000L
638 # ifdef EXIM_HAVE_OPENSSL_DH_BITS
639 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
640 This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
641 dh_bitsize = DH_bits(dh);
643 dh_bitsize = 8 * DH_size(dh);
646 dh_bitsize = EVP_PKEY_get_bits(pkey);
649 /* Even if it is larger, we silently return success rather than cause things to
650 fail out, so that a too-large DH will not knock out all TLS; it's a debatable
651 choice. Likewise for a failing attempt to set one. */
653 if (dh_bitsize <= tls_dh_max_bits)
656 #if OPENSSL_VERSION_NUMBER < 0x30000000L
657 SSL_CTX_set_tmp_dh(sctx, dh)
659 SSL_CTX_set0_tmp_dh_pkey(sctx, pkey)
663 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
664 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (D-H param setting '%s'): %s",
665 dhexpanded ? dhexpanded : US"default", ssl_errstring);
666 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
667 /* EVP_PKEY_free(pkey); crashes */
672 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
673 dhexpanded ? dhexpanded : US"default", dh_bitsize);
677 debug_printf("dhparams '%s' %d bits, is > tls_dh_max_bits limit of %d\n",
678 dhexpanded ? dhexpanded : US"default", dh_bitsize, tls_dh_max_bits);
680 #if OPENSSL_VERSION_NUMBER < 0x30000000L
683 /* The EVP_PKEY ownership stays with the ctx; do not free it */
692 /*************************************************
693 * Initialize for ECDH *
694 *************************************************/
696 /* Load parameters for ECDH encryption. Server only.
698 For now, we stick to NIST P-256 because: it's simple and easy to configure;
699 it avoids any patent issues that might bite redistributors; despite events in
700 the news and concerns over curve choices, we're not cryptographers, we're not
701 pretending to be, and this is "good enough" to be better than no support,
702 protecting against most adversaries. Given another year or two, there might
703 be sufficient clarity about a "right" way forward to let us make an informed
704 decision, instead of a knee-jerk reaction.
706 Longer-term, we should look at supporting both various named curves and
707 external files generated with "openssl ecparam", much as we do for init_dh().
708 We should also support "none" as a value, to explicitly avoid initialisation.
713 sctx The current SSL CTX (inbound or outbound)
714 errstr error string pointer
716 Returns: TRUE if OK (nothing to set up, or setup worked)
720 init_ecdh(SSL_CTX * sctx, uschar ** errstr)
722 #ifdef OPENSSL_NO_ECDH
730 # ifndef EXIM_HAVE_ECDH
732 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
736 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
738 if (!exp_curve || !*exp_curve)
741 /* "auto" needs to be handled carefully.
742 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
743 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
744 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
745 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
746 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
748 if (Ustrcmp(exp_curve, "auto") == 0)
750 #if OPENSSL_VERSION_NUMBER < 0x10002000L
751 DEBUG(D_tls) debug_printf(
752 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
753 exp_curve = US"prime256v1";
755 # if defined SSL_CTRL_SET_ECDH_AUTO
756 DEBUG(D_tls) debug_printf(
757 "ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n");
758 SSL_CTX_set_ecdh_auto(sctx, 1);
761 DEBUG(D_tls) debug_printf(
762 "ECDH OpenSSL 1.1.0+: temp key parameter settings: default selection\n");
768 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
769 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
770 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
771 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
775 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
780 # if OPENSSL_VERSION_NUMBER < 0x30000000L
783 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
785 tls_error(US"Unable to create ec curve", NULL, NULL, errstr);
789 /* The "tmp" in the name here refers to setting a temporary key
790 not to the stability of the interface. */
792 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
793 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), NULL, NULL, errstr);
795 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
799 #else /* v 3.0.0 + */
801 if ((rv = SSL_CTX_set1_groups(sctx, &nid, 1)) == 0)
802 tls_error(string_sprintf("Error enabling '%s' group", exp_curve), NULL, NULL, errstr);
804 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' group\n", exp_curve);
810 # endif /*EXIM_HAVE_ECDH*/
811 #endif /*OPENSSL_NO_ECDH*/
816 /*************************************************
817 * Expand key and cert file specs *
818 *************************************************/
820 #if OPENSSL_VERSION_NUMBER < 0x30000000L
823 s SSL connection (not used)
827 Returns: pointer to generated key
831 rsa_callback(SSL *s, int export, int keylength)
834 #ifdef EXIM_HAVE_RSA_GENKEY_EX
835 BIGNUM *bn = BN_new();
838 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
840 # ifdef EXIM_HAVE_RSA_GENKEY_EX
841 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
842 || !(rsa_key = RSA_new())
843 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
846 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
850 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
851 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
857 #endif /* pre-3.0.0 */
861 /* Create and install a selfsigned certificate, for use in server mode */
862 /*XXX we could arrange to call this during prelo for a null tls_certificate option.
863 The normal cache inval + relo will suffice.
864 Just need a timer for inval. */
867 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
874 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
875 where = US"allocating pkey";
876 if (!(pkey = EVP_PKEY_new()))
879 where = US"allocating cert";
880 if (!(x509 = X509_new()))
883 where = US"generating pkey";
884 #if OPENSSL_VERSION_NUMBER < 0x30000000L
887 if (!(rsa = rsa_callback(NULL, 0, 2048)))
890 where = US"assigning pkey";
891 if (!EVP_PKEY_assign_RSA(pkey, rsa))
895 pkey = EVP_RSA_gen(2048);
898 X509_set_version(x509, 2); /* N+1 - version 3 */
899 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
900 X509_gmtime_adj(X509_get_notBefore(x509), 0);
901 X509_gmtime_adj(X509_get_notAfter(x509), (long)2 * 60 * 60); /* 2 hour */
902 X509_set_pubkey(x509, pkey);
904 name = X509_get_subject_name(x509);
905 X509_NAME_add_entry_by_txt(name, "C",
906 MBSTRING_ASC, CUS "UK", -1, -1, 0);
907 X509_NAME_add_entry_by_txt(name, "O",
908 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
909 X509_NAME_add_entry_by_txt(name, "CN",
910 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
911 X509_set_issuer_name(x509, name);
913 where = US"signing cert";
914 if (!X509_sign(x509, pkey, EVP_md5()))
917 where = US"installing selfsign cert";
918 if (!SSL_CTX_use_certificate(sctx, x509))
921 where = US"installing selfsign key";
922 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
928 (void) tls_error(where, NULL, NULL, errstr);
929 if (x509) X509_free(x509);
930 if (pkey) EVP_PKEY_free(pkey);
940 /*************************************************
941 * Information callback *
942 *************************************************/
944 /* The SSL library functions call this from time to time to indicate what they
945 are doing. We copy the string to the debugging output when TLS debugging has
957 info_callback(SSL * s, int where, int ret)
963 if (where & SSL_ST_CONNECT) g = string_append_listele(g, ',', US"SSL_connect");
964 if (where & SSL_ST_ACCEPT) g = string_append_listele(g, ',', US"SSL_accept");
965 if (where & SSL_CB_LOOP) g = string_append_listele(g, ',', US"state_chg");
966 if (where & SSL_CB_EXIT) g = string_append_listele(g, ',', US"hshake_exit");
967 if (where & SSL_CB_READ) g = string_append_listele(g, ',', US"read");
968 if (where & SSL_CB_WRITE) g = string_append_listele(g, ',', US"write");
969 if (where & SSL_CB_ALERT) g = string_append_listele(g, ',', US"alert");
970 if (where & SSL_CB_HANDSHAKE_START) g = string_append_listele(g, ',', US"hshake_start");
971 if (where & SSL_CB_HANDSHAKE_DONE) g = string_append_listele(g, ',', US"hshake_done");
973 if (where & SSL_CB_LOOP)
974 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
975 else if (where & SSL_CB_ALERT)
976 debug_printf("SSL %s %s:%s\n", g->s,
977 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
978 else if (where & SSL_CB_EXIT)
981 debug_printf("SSL %s: %s in %s\n", g->s,
982 ret == 0 ? "failed" : "error", SSL_state_string_long(s));
984 else if (where & (SSL_CB_HANDSHAKE_START | SSL_CB_HANDSHAKE_DONE))
985 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
989 #ifdef OPENSSL_HAVE_KEYLOG_CB
991 keylog_callback(const SSL *ssl, const char *line)
995 DEBUG(D_tls) debug_printf("%.200s\n", line);
996 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
997 if (!(fp = fopen(filename, "a"))) return;
998 fprintf(fp, "%s\n", line);
1007 #ifndef DISABLE_EVENT
1009 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
1010 BOOL *calledp, const BOOL *optionalp, const uschar * what)
1016 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
1019 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
1020 old_cert = tlsp->peercert;
1021 tlsp->peercert = X509_dup(cert);
1022 /* NB we do not bother setting peerdn */
1023 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth), &errno)))
1025 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
1026 "depth=%d cert=%s: %s",
1027 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1028 what, depth, dn, yield);
1032 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
1033 return 1; /* reject (leaving peercert set) */
1035 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
1036 "(host in tls_try_verify_hosts)\n");
1037 tlsp->verify_override = TRUE;
1039 X509_free(tlsp->peercert);
1040 tlsp->peercert = old_cert;
1046 /*************************************************
1047 * Callback for verification *
1048 *************************************************/
1050 /* The SSL library does certificate verification if set up to do so. This
1051 callback has the current yes/no state is in "state". If verification succeeded,
1052 we set the certificate-verified flag. If verification failed, what happens
1053 depends on whether the client is required to present a verifiable certificate
1056 If verification is optional, we change the state to yes, but still log the
1057 verification error. For some reason (it really would help to have proper
1058 documentation of OpenSSL), this callback function then gets called again, this
1059 time with state = 1. We must take care not to set the private verified flag on
1060 the second time through.
1062 Note: this function is not called if the client fails to present a certificate
1063 when asked. We get here only if a certificate has been received. Handling of
1064 optional verification for this case is done when requesting SSL to verify, by
1065 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
1067 May be called multiple times for different issues with a certificate, even
1068 for a given "depth" in the certificate chain.
1071 preverify_ok current yes/no state as 1/0
1072 x509ctx certificate information.
1073 tlsp per-direction (client vs. server) support data
1074 calledp has-been-called flag
1075 optionalp verification-is-optional flag
1077 Returns: 0 if verification should fail, otherwise 1
1081 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1082 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1084 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1085 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1088 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1090 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1091 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1092 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1095 dn[sizeof(dn)-1] = '\0';
1097 tlsp->verify_override = FALSE;
1098 if (preverify_ok == 0)
1100 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1101 *verify_mode, sender_host_address)
1103 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1104 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1106 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1110 if (!tlsp->peercert)
1111 tlsp->peercert = X509_dup(cert); /* record failing cert */
1112 return 0; /* reject */
1114 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1115 "tls_try_verify_hosts)\n");
1116 tlsp->verify_override = TRUE;
1119 else if (depth != 0)
1121 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1122 #ifndef DISABLE_OCSP
1123 if (tlsp == &tls_out && client_static_state->u_ocsp.client.verify_store)
1124 { /* client, wanting stapling */
1125 /* Add the server cert's signing chain as the one
1126 for the verification of the OCSP stapled information. */
1128 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1131 sk_X509_push(client_static_state->verify_stack, cert);
1134 #ifndef DISABLE_EVENT
1135 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1136 return 0; /* reject, with peercert set */
1141 const uschar * verify_cert_hostnames;
1143 if ( tlsp == &tls_out
1144 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1145 /* client, wanting hostname check */
1148 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1149 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1150 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1152 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1153 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1156 const uschar * list = verify_cert_hostnames;
1159 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1160 if ((rc = X509_check_host(cert, CCS name, 0,
1161 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1162 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1167 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1168 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1175 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1178 uschar * extra = verify_mode
1179 ? string_sprintf(" (during %c-verify for [%s])",
1180 *verify_mode, sender_host_address)
1182 log_write(0, LOG_MAIN,
1183 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1184 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1185 extra, dn, verify_cert_hostnames);
1189 if (!tlsp->peercert)
1190 tlsp->peercert = X509_dup(cert); /* record failing cert */
1191 return 0; /* reject */
1193 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1194 "tls_try_verify_hosts)\n");
1195 tlsp->verify_override = TRUE;
1199 #ifndef DISABLE_EVENT
1200 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1201 return 0; /* reject, with peercert set */
1204 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1205 *calledp ? "" : " authenticated", dn);
1209 return 1; /* accept, at least for this level */
1213 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1215 return verify_callback(preverify_ok, x509ctx, &tls_out,
1216 &client_verify_callback_called, &client_verify_optional);
1220 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1222 return verify_callback(preverify_ok, x509ctx, &tls_in,
1223 &server_verify_callback_called, &server_verify_optional);
1229 /* This gets called *by* the dane library verify callback, which interposes
1233 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1235 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1237 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1238 #ifndef DISABLE_EVENT
1239 BOOL dummy_called, optional = FALSE;
1242 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1244 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1245 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1246 deliver_host_address);
1249 dn[sizeof(dn)-1] = '\0';
1251 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1252 preverify_ok ? "ok":"BAD", depth, dn);
1254 #ifndef DISABLE_EVENT
1255 if (verify_event(&tls_out, cert, depth, dn,
1256 &dummy_called, &optional, US"DANE"))
1257 return 0; /* reject, with peercert set */
1260 if (preverify_ok == 1)
1262 tls_out.dane_verified = TRUE;
1263 #ifndef DISABLE_OCSP
1264 if (client_static_state->u_ocsp.client.verify_store)
1265 { /* client, wanting stapling */
1266 /* Add the server cert's signing chain as the one
1267 for the verification of the OCSP stapled information. */
1269 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1272 sk_X509_push(client_static_state->verify_stack, cert);
1278 int err = X509_STORE_CTX_get_error(x509ctx);
1280 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1281 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1284 return preverify_ok;
1287 #endif /*SUPPORT_DANE*/
1290 #ifndef DISABLE_OCSP
1291 /*************************************************
1292 * Load OCSP information into state *
1293 *************************************************/
1294 /* Called to load the server OCSP response from the given file into memory, once
1295 caller has determined this is needed. Checks validity. Debugs a message
1298 ASSUMES: single response, for single cert.
1301 state various parts of session state
1302 filename the filename putatively holding an OCSP response
1303 is_pem file is PEM format; otherwise is DER
1307 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1311 OCSP_RESPONSE * resp;
1312 OCSP_BASICRESP * basic_response;
1313 OCSP_SINGLERESP * single_response;
1314 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1315 STACK_OF(X509) * sk;
1316 int status, reason, i;
1319 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1321 if (!filename || !*filename) return;
1324 if (!(bio = BIO_new_file(CS filename, "rb")))
1326 log_write(0, LOG_MAIN|LOG_PANIC,
1327 "Failed to open OCSP response file \"%s\": %.100s",
1328 filename, ERR_reason_error_string(ERR_get_error()));
1334 uschar * data, * freep;
1337 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1339 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
1340 filename, ERR_reason_error_string(ERR_get_error()));
1344 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1345 OPENSSL_free(freep);
1348 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1353 log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
1354 filename, ERR_reason_error_string(ERR_get_error()));
1358 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1360 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1361 OCSP_response_status_str(status), status);
1367 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1368 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1373 if (!(basic_response = OCSP_response_get1_basic(resp)))
1376 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1380 sk = state->verify_stack; /* set by setup_certs() / chain_from_pem_file() */
1382 /* May need to expose ability to adjust those flags?
1383 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1384 OCSP_TRUSTOTHER OCSP_NOINTERN */
1386 /* This does a partial verify (only the signer link, not the whole chain-to-CA)
1387 on the OCSP proof before we load it for serving up; possibly overkill -
1388 just date-checks might be nice enough.
1390 OCSP_basic_verify takes a "store" arg, but does not
1391 use it for the chain verification, when OCSP_NOVERIFY is set.
1392 The content from the wire "basic_response" and a cert-stack "sk" are all
1395 We have a stack, loaded in setup_certs() if tls_verify_certificates
1396 was a file (not a directory, or "system"). It is unfortunate we
1397 cannot used the connection context store, as that would neatly
1398 handle the "system" case too, but there seems to be no library
1399 function for getting a stack from a store.
1400 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1401 We do not free the stack since it could be needed a second time for
1404 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1405 be a public interface into the OpenSSL library (there's no manual entry) -
1406 But what with? We also use OCSP_basic_verify in the client stapling callback.
1407 And there we NEED it; we must verify that status... unless the
1408 library does it for us anyway? */
1410 if ((i = OCSP_basic_verify(basic_response, sk, NULL, OCSP_NOVERIFY)) < 0)
1414 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1415 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
1420 /* Here's the simplifying assumption: there's only one response, for the
1421 one certificate we use, and nothing for anything else in a chain. If this
1422 proves false, we need to extract a cert id from our issued cert
1423 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1424 right cert in the stack and then calls OCSP_single_get0_status()).
1426 I'm hoping to avoid reworking a bunch more of how we handle state here.
1428 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1431 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1434 debug_printf("Unable to get first response from OCSP basic response.\n");
1438 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1439 if (status != V_OCSP_CERTSTATUS_GOOD)
1441 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1442 OCSP_cert_status_str(status), status,
1443 OCSP_crl_reason_str(reason), reason);
1447 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1449 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
1454 /* Add the resp to the list used by tls_server_stapling_cb() */
1456 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1457 while (oentry = *op)
1459 *op = oentry = store_get(sizeof(ocsp_resplist), GET_UNTAINTED);
1460 oentry->next = NULL;
1461 oentry->resp = resp;
1466 if (f.running_in_test_harness)
1468 extern char ** environ;
1469 if (environ) for (uschar ** p = USS environ; *p; p++)
1470 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1472 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1473 goto supply_response;
1481 ocsp_free_response_list(exim_openssl_state_st * state)
1483 for (ocsp_resplist * olist = state->u_ocsp.server.olist; olist;
1484 olist = olist->next)
1485 OCSP_RESPONSE_free(olist->resp);
1486 state->u_ocsp.server.olist = NULL;
1488 #endif /*!DISABLE_OCSP*/
1495 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1498 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1499 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1500 return tls_error(string_sprintf(
1501 "SSL_CTX_use_certificate_chain_file file=%s", file),
1502 cbinfo->host, NULL, errstr);
1507 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1510 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1511 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1512 return tls_error(string_sprintf(
1513 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1520 /* Called once during tls_init and possibly again during TLS setup, for a
1521 new context, if Server Name Indication was used and tls_sni was seen in
1522 the certificate string.
1525 sctx the SSL_CTX* to update
1526 state various parts of session state
1527 errstr error string pointer
1529 Returns: OK/DEFER/FAIL
1533 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1538 if (!state->certificate)
1540 if (!state->is_server) /* client */
1543 if (tls_install_selfsign(sctx, errstr) != OK)
1550 if ( !reexpand_tls_files_for_sni
1551 && ( Ustrstr(state->certificate, US"tls_sni")
1552 || Ustrstr(state->certificate, US"tls_in_sni")
1553 || Ustrstr(state->certificate, US"tls_out_sni")
1555 reexpand_tls_files_for_sni = TRUE;
1557 if (!expand_check(state->certificate, US"tls_certificate", &expanded, errstr))
1561 if (state->is_server)
1563 const uschar * file_list = expanded;
1566 #ifndef DISABLE_OCSP
1567 const uschar * olist = state->u_ocsp.server.file;
1570 BOOL fmt_pem = FALSE;
1573 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1575 if (olist && !*olist)
1578 /* If doing a re-expand after SNI, avoid reloading the OCSP
1579 responses when the list of filenames has not changed.
1580 The creds-invali on content change wipes file_expanded, so that
1581 always reloads here. */
1583 if ( state->u_ocsp.server.file_expanded && olist
1584 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1586 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1591 ocsp_free_response_list(state);
1592 state->u_ocsp.server.file_expanded = olist;
1596 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1598 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1601 #ifndef DISABLE_OCSP
1603 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1605 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1610 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1615 ocsp_load_response(state, ofile, fmt_pem);
1618 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1622 else /* would there ever be a need for multiple client certs? */
1623 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1626 if ( state->privatekey
1627 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr))
1630 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1631 of the expansion is an empty string, ignore it also, and assume the private
1632 key is in the same file as the certificate. */
1634 if (expanded && *expanded)
1635 if (state->is_server)
1637 const uschar * file_list = expanded;
1641 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1642 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1645 else /* would there ever be a need for multiple client certs? */
1646 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1656 /**************************************************
1657 * One-time init credentials for server and client *
1658 **************************************************/
1661 normalise_ciphers(uschar ** ciphers, const uschar * pre_expansion_ciphers)
1663 uschar * s = *ciphers;
1665 if (!s || !Ustrchr(s, '_')) return; /* no change needed */
1667 if (s == pre_expansion_ciphers)
1668 s = string_copy(s); /* get writable copy */
1670 for (uschar * t = s; *t; t++) if (*t == '_') *t = '-';
1675 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1676 uschar * ciphers, uschar ** errstr)
1678 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1679 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1680 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1681 state->server_cipher_list = ciphers;
1688 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1691 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1692 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1694 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1696 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1698 /* Set up the information callback, which outputs if debugging is at a suitable
1703 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1704 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1705 /* this needs a debug build of OpenSSL */
1706 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
1708 #ifdef OPENSSL_HAVE_KEYLOG_CB
1709 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
1713 /* Automatically re-try reads/writes after renegotiation. */
1714 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1721 tls_server_creds_init(void)
1724 uschar * dummy_errstr;
1725 unsigned lifetime = 0;
1729 state_server.lib_state = null_tls_preload;
1731 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1733 state_server.lib_state.lib_ctx = ctx;
1735 /* Preload DH params and EC curve */
1737 if (opt_unset_or_noexpand(tls_dhparam))
1739 DEBUG(D_tls) debug_printf("TLS: preloading DH params for server\n");
1740 if (init_dh(ctx, tls_dhparam, &dummy_errstr))
1741 state_server.lib_state.dh = TRUE;
1744 DEBUG(D_tls) debug_printf("TLS: not preloading DH params for server\n");
1745 if (opt_unset_or_noexpand(tls_eccurve))
1747 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for server\n");
1748 if (init_ecdh(ctx, &dummy_errstr))
1749 state_server.lib_state.ecdh = TRUE;
1752 DEBUG(D_tls) debug_printf("TLS: not preloading ECDH curve for server\n");
1754 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1755 /* If we can, preload the Authorities for checking client certs against.
1756 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1757 at TLS conn startup.
1758 Do this before the server ocsp so that its info can verify the ocsp. */
1760 if ( opt_set_and_noexpand(tls_verify_certificates)
1761 && opt_unset_or_noexpand(tls_crl))
1763 /* Watch the default dir also as they are always included */
1765 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1766 && tls_set_watch(tls_verify_certificates, FALSE)
1767 && tls_set_watch(tls_crl, FALSE))
1769 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1771 if (setup_certs(ctx, tls_verify_certificates, tls_crl, NULL, &dummy_errstr)
1773 state_server.lib_state.cabundle = TRUE;
1775 /* If we can, preload the server-side cert, key and ocsp */
1777 if ( opt_set_and_noexpand(tls_certificate)
1778 # ifndef DISABLE_OCSP
1779 && opt_unset_or_noexpand(tls_ocsp_file)
1781 && opt_unset_or_noexpand(tls_privatekey))
1783 /* Set watches on the filenames. The implementation does de-duplication
1784 so we can just blindly do them all. */
1786 if ( tls_set_watch(tls_certificate, TRUE)
1787 # ifndef DISABLE_OCSP
1788 && tls_set_watch(tls_ocsp_file, TRUE)
1790 && tls_set_watch(tls_privatekey, TRUE))
1792 state_server.certificate = tls_certificate;
1793 state_server.privatekey = tls_privatekey;
1794 #ifndef DISABLE_OCSP
1795 state_server.u_ocsp.server.file = tls_ocsp_file;
1798 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1799 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1800 state_server.lib_state.conn_certs = TRUE;
1803 else if ( !tls_certificate && !tls_privatekey
1804 # ifndef DISABLE_OCSP
1808 { /* Generate & preload a selfsigned cert. No files to watch. */
1809 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1811 state_server.lib_state.conn_certs = TRUE;
1812 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1816 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1820 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1823 #endif /* EXIM_HAVE_INOTIFY */
1826 /* If we can, preload the ciphers control string */
1828 if (opt_set_and_noexpand(tls_require_ciphers))
1830 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1831 normalise_ciphers(&tls_require_ciphers, tls_require_ciphers);
1832 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1833 &dummy_errstr) == OK)
1834 state_server.lib_state.pri_string = TRUE;
1837 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1844 /* Preload whatever creds are static, onto a transport. The client can then
1845 just copy the pointer as it starts up.
1846 Called from the daemon after a cache-invalidate with watch set; called from
1847 a queue-run startup with watch clear. */
1850 tls_client_creds_init(transport_instance * t, BOOL watch)
1852 smtp_transport_options_block * ob = t->options_block;
1853 exim_openssl_state_st tpt_dummy_state;
1854 host_item * dummy_host = (host_item *)1;
1855 uschar * dummy_errstr;
1860 ob->tls_preload = null_tls_preload;
1861 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1863 ob->tls_preload.lib_ctx = ctx;
1865 tpt_dummy_state.lib_state = ob->tls_preload;
1867 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1868 if ( opt_set_and_noexpand(ob->tls_certificate)
1869 && opt_unset_or_noexpand(ob->tls_privatekey))
1872 || ( tls_set_watch(ob->tls_certificate, FALSE)
1873 && tls_set_watch(ob->tls_privatekey, FALSE)
1876 uschar * pkey = ob->tls_privatekey;
1879 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1881 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1883 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1884 pkey ? pkey : ob->tls_certificate,
1887 ob->tls_preload.conn_certs = TRUE;
1892 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1895 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1896 && opt_unset_or_noexpand(ob->tls_crl))
1899 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1900 && tls_set_watch(ob->tls_verify_certificates, FALSE)
1901 && tls_set_watch(ob->tls_crl, FALSE)
1905 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1907 if (setup_certs(ctx, ob->tls_verify_certificates,
1908 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
1909 ob->tls_preload.cabundle = TRUE;
1914 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1916 #endif /*EXIM_HAVE_INOTIFY*/
1920 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1921 /* Invalidate the creds cached, by dropping the current ones.
1922 Call when we notice one of the source files has changed. */
1925 tls_server_creds_invalidate(void)
1927 SSL_CTX_free(state_server.lib_state.lib_ctx);
1928 state_server.lib_state = null_tls_preload;
1929 #ifndef DISABLE_OCSP
1930 state_server.u_ocsp.server.file_expanded = NULL;
1936 tls_client_creds_invalidate(transport_instance * t)
1938 smtp_transport_options_block * ob = t->options_block;
1939 SSL_CTX_free(ob->tls_preload.lib_ctx);
1940 ob->tls_preload = null_tls_preload;
1946 tls_server_creds_invalidate(void)
1950 tls_client_creds_invalidate(transport_instance * t)
1953 #endif /*EXIM_HAVE_INOTIFY*/
1957 #ifndef DISABLE_OCSP
1959 x509_store_dump_cert_s_names(X509_STORE * store)
1961 STACK_OF(X509_OBJECT) * roots= store->objs;
1962 static uschar name[256];
1964 for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
1966 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
1967 if(tmp_obj->type == X509_LU_X509)
1969 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
1970 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
1972 name[sizeof(name)-1] = '\0';
1973 debug_printf(" %s\n", name);
1982 #ifndef DISABLE_TLS_RESUME
1983 /* Manage the keysets used for encrypting the session tickets, on the server. */
1985 typedef struct { /* Session ticket encryption key */
1988 const EVP_CIPHER * aes_cipher;
1989 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
1990 # if OPENSSL_VERSION_NUMBER < 0x30000000L
1991 const EVP_MD * hmac_hash;
1993 const uschar * hmac_hashname;
1995 uschar hmac_key[16];
2000 static exim_stek exim_tk; /* current key */
2001 static exim_stek exim_tk_old; /* previous key */
2006 time_t t = time(NULL);
2008 if (exim_tk.name[0])
2010 if (exim_tk.renew >= t) return;
2011 exim_tk_old = exim_tk;
2014 if (f.running_in_test_harness) ssl_session_timeout = 6;
2016 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
2017 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
2018 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
2019 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
2021 exim_tk.name[0] = 'E';
2022 exim_tk.aes_cipher = EVP_aes_256_cbc();
2023 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2024 exim_tk.hmac_hash = EVP_sha256();
2026 exim_tk.hmac_hashname = US "sha256";
2028 exim_tk.expire = t + ssl_session_timeout;
2029 exim_tk.renew = t + ssl_session_timeout/2;
2035 if (!exim_tk.name[0]) return NULL;
2040 tk_find(const uschar * name)
2042 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
2043 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
2050 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2058 /*XXX will want these dependent on the ssl session strength */
2059 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2060 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2061 key->hmac_hash, NULL);
2064 OSSL_PARAM params[3];
2065 uschar * hk = string_copy(key->hmac_hashname); /* need nonconst */
2066 params[0] = OSSL_PARAM_construct_octet_string("key", key->hmac_key, sizeof(key->hmac_key));
2067 params[1] = OSSL_PARAM_construct_utf8_string("digest", CS hk, 0);
2068 params[2] = OSSL_PARAM_construct_end();
2069 if (EVP_MAC_CTX_set_params(hctx, params) == 0)
2071 DEBUG(D_tls) debug_printf("EVP_MAC_CTX_set_params: %s\n",
2072 ERR_reason_error_string(ERR_get_error()));
2073 return 0; /* error in mac initialisation */
2080 /* Callback for session tickets, on server */
2082 ticket_key_callback(SSL * ssl, uschar key_name[16],
2083 uschar * iv, EVP_CIPHER_CTX * c_ctx,
2084 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2091 tls_support * tlsp = state_server.tlsp;
2096 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
2097 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2099 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
2100 return -1; /* insufficient random */
2102 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
2103 return 0; /* key couldn't be created */
2104 memcpy(key_name, key->name, 16);
2105 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
2107 if (tk_hmac_init(hctx, key) == 0) return 0;
2108 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2110 DEBUG(D_tls) debug_printf("ticket created\n");
2115 time_t now = time(NULL);
2117 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
2118 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2120 if (!(key = tk_find(key_name)) || key->expire < now)
2124 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
2125 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
2130 if (tk_hmac_init(hctx, key) == 0) return 0;
2131 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2133 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2135 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2136 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2137 be better. To do that we'd have to encode ticket lifetime in the name as
2138 we don't yet see the restored session. Could check posthandshake for TLS1.3
2139 and trigger a new ticket then, but cannot do that for TLS1.2 */
2140 return key->renew < now ? 2 : 1;
2143 #endif /* !DISABLE_TLS_RESUME */
2148 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2149 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2151 /* If verification is optional, don't fail if no certificate */
2153 SSL_CTX_set_verify(ctx,
2154 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2159 /*************************************************
2160 * Callback to handle SNI *
2161 *************************************************/
2163 /* Called when acting as server during the TLS session setup if a Server Name
2164 Indication extension was sent by the client.
2166 API documentation is OpenSSL s_server.c implementation.
2169 s SSL* of the current session
2170 ad unknown (part of OpenSSL API) (unused)
2171 arg Callback of "our" registered data
2173 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2175 XXX might need to change to using ClientHello callback,
2176 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2179 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2181 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
2183 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2184 exim_openssl_state_st *state = (exim_openssl_state_st *) arg;
2186 int old_pool = store_pool;
2187 uschar * dummy_errstr;
2190 return SSL_TLSEXT_ERR_OK;
2192 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2193 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2195 /* Make the extension value available for expansion */
2196 store_pool = POOL_PERM;
2197 tls_in.sni = string_copy_taint(US servername, GET_TAINTED);
2198 store_pool = old_pool;
2200 if (!reexpand_tls_files_for_sni)
2201 return SSL_TLSEXT_ERR_OK;
2203 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2204 not confident that memcpy wouldn't break some internal reference counting.
2205 Especially since there's a references struct member, which would be off. */
2207 if (lib_ctx_new(&server_sni, NULL, &dummy_errstr) != OK)
2210 /* Not sure how many of these are actually needed, since SSL object
2211 already exists. Might even need this selfsame callback, for reneg? */
2214 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2215 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2216 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2217 #ifdef OPENSSL_MIN_PROTO_VERSION
2218 SSL_CTX_set_min_proto_version(server_sni, SSL3_VERSION);
2220 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2221 SSL_CTX_clear_options(server_sni, ~SSL_CTX_get_options(ctx));
2222 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2223 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2224 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2227 if ( !init_dh(server_sni, state->dhparam, &dummy_errstr)
2228 || !init_ecdh(server_sni, &dummy_errstr)
2232 if ( state->server_cipher_list
2233 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2236 #ifndef DISABLE_OCSP
2237 if (state->u_ocsp.server.file)
2239 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2240 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2246 if ( !expand_check(tls_verify_certificates, US"tls_verify_certificates",
2247 &expcerts, &dummy_errstr)
2248 || (rc = setup_certs(server_sni, expcerts, tls_crl, NULL,
2249 &dummy_errstr)) != OK)
2252 if (expcerts && *expcerts)
2253 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2256 /* do this after setup_certs, because this can require the certs for verifying
2257 OCSP information. */
2258 if ((rc = tls_expand_session_files(server_sni, state, &dummy_errstr)) != OK)
2261 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2262 SSL_set_SSL_CTX(s, server_sni);
2263 return SSL_TLSEXT_ERR_OK;
2265 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
2267 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2272 #ifdef EXIM_HAVE_ALPN
2273 /*************************************************
2274 * Callback to handle ALPN *
2275 *************************************************/
2277 /* Called on server if tls_alpn nonblank after expansion,
2278 when client offers ALPN, after the SNI callback.
2279 If set and not matching the list then we dump the connection */
2282 tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen,
2283 const uschar * in, unsigned int inlen, void * arg)
2285 server_seen_alpn = TRUE;
2288 debug_printf("Received TLS ALPN offer:");
2289 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2292 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2293 debug_printf(" '%.*s'", siz, in + pos + 1);
2295 debug_printf(". Our list: '%s'\n", tls_alpn);
2298 /* Look for an acceptable ALPN */
2300 if ( inlen > 1 /* at least one name */
2301 && in[0]+1 == inlen /* filling the vector, so exactly one name */
2304 const uschar * list = tls_alpn;
2306 for (uschar * name; name = string_nextinlist(&list, &sep, NULL, 0); )
2307 if (Ustrncmp(in+1, name, in[0]) == 0)
2309 *out = in+1; /* we checked for exactly one, so can just point to it */
2311 return SSL_TLSEXT_ERR_OK; /* use ALPN */
2315 /* More than one name from clilent, or name did not match our list. */
2317 /* This will be fatal to the TLS conn; would be nice to kill TCP also.
2318 Maybe as an option in future; for now leave control to the config (must-tls). */
2320 DEBUG(D_tls) debug_printf("TLS ALPN rejected\n");
2321 return SSL_TLSEXT_ERR_ALERT_FATAL;
2323 #endif /* EXIM_HAVE_ALPN */
2327 #ifndef DISABLE_OCSP
2329 /*************************************************
2330 * Callback to handle OCSP Stapling *
2331 *************************************************/
2333 /* Called when acting as server during the TLS session setup if the client
2334 requests OCSP information with a Certificate Status Request.
2336 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2342 tls_server_stapling_cb(SSL *s, void *arg)
2344 const exim_openssl_state_st * state = arg;
2345 ocsp_resplist * olist = state->u_ocsp.server.olist;
2346 uschar * response_der; /*XXX blob */
2347 int response_der_len;
2350 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2351 olist ? "have" : "lack");
2353 tls_in.ocsp = OCSP_NOT_RESP;
2355 return SSL_TLSEXT_ERR_NOACK;
2357 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
2359 const X509 * cert_sent = SSL_get_certificate(s);
2360 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2361 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2363 for (; olist; olist = olist->next)
2365 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2366 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2367 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2368 ASN1_INTEGER * res_cert_serial;
2369 const BIGNUM * resp_bn;
2370 ASN1_OCTET_STRING * res_cert_iNameHash;
2373 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2374 (OCSP_CERTID *) cid);
2375 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2379 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2380 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2383 if (BN_cmp(cert_bn, resp_bn) == 0)
2385 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2387 /*XXX TODO: check the rest of the list for duplicate matches.
2388 If any, need to also check the Issuer Name hash.
2389 Without this, we will provide the wrong status in the case of
2394 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2398 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2399 return SSL_TLSEXT_ERR_NOACK;
2405 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2406 return SSL_TLSEXT_ERR_NOACK;
2410 /*XXX could we do the i2d earlier, rather than during the callback? */
2411 response_der = NULL;
2412 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2413 if (response_der_len <= 0)
2414 return SSL_TLSEXT_ERR_NOACK;
2416 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2417 response_der, response_der_len);
2418 tls_in.ocsp = OCSP_VFIED;
2419 return SSL_TLSEXT_ERR_OK;
2424 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
2426 BIO_printf(bp, "\t%s: ", str);
2427 ASN1_GENERALIZEDTIME_print(bp, time);
2432 tls_client_stapling_cb(SSL * ssl, void * arg)
2434 exim_openssl_state_st * cbinfo = arg;
2435 const unsigned char * p;
2437 OCSP_RESPONSE * rsp;
2438 OCSP_BASICRESP * bs;
2441 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2442 len = SSL_get_tlsext_status_ocsp_resp(ssl, &p);
2444 { /* Expect this when we requested ocsp but got none */
2445 if (SSL_session_reused(ssl) && tls_out.ocsp == OCSP_VFIED)
2447 DEBUG(D_tls) debug_printf(" null, but resumed; ocsp vfy stored with session is good\n");
2450 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2451 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2453 DEBUG(D_tls) debug_printf(" null\n");
2454 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2457 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2459 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2460 if (LOGGING(tls_cipher))
2461 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2463 DEBUG(D_tls) debug_printf(" parse error\n");
2467 if (!(bs = OCSP_response_get1_basic(rsp)))
2469 tls_out.ocsp = OCSP_FAILED;
2470 if (LOGGING(tls_cipher))
2471 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2473 DEBUG(D_tls) debug_printf(" error parsing response\n");
2474 OCSP_RESPONSE_free(rsp);
2478 /* We'd check the nonce here if we'd put one in the request. */
2479 /* However that would defeat cacheability on the server so we don't. */
2481 /* This section of code reworked from OpenSSL apps source;
2482 The OpenSSL Project retains copyright:
2483 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2487 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2488 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2491 DEBUG(D_tls) bp = BIO_new(BIO_s_mem());
2493 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2495 /* Use the chain that verified the server cert to verify the stapled info */
2496 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
2498 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
2499 cbinfo->u_ocsp.client.verify_store, OCSP_NOEXPLICIT)) <= 0)
2500 if (ERR_peek_error())
2502 tls_out.ocsp = OCSP_FAILED;
2503 if (LOGGING(tls_cipher))
2505 const uschar * errstr = CUS ERR_reason_error_string(ERR_peek_error());
2506 static uschar peerdn[256];
2507 X509_NAME_oneline(X509_get_subject_name(SSL_get_peer_certificate(ssl)),
2508 CS peerdn, sizeof(peerdn));
2509 log_write(0, LOG_MAIN,
2510 "[%s] %s Received TLS cert (DN: '%.*s') status response, "
2511 "itself unverifiable: %s",
2512 sender_host_address, sender_host_name,
2513 (int)sizeof(peerdn), peerdn,
2518 BIO_printf(bp, "OCSP response verify failure\n");
2519 ERR_print_errors(bp);
2520 OCSP_RESPONSE_print(bp, rsp, 0);
2525 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2526 " in the root CA certificate; ignoring\n");
2528 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2530 /*XXX So we have a good stapled OCSP status. How do we know
2531 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2532 OCSP_resp_find_status() which matches on a cert id, which presumably
2533 we should use. Making an id needs OCSP_cert_id_new(), which takes
2534 issuerName, issuerKey, serialNumber. Are they all in the cert?
2536 For now, carry on blindly accepting the resp. */
2539 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2540 OCSP_resp_count(bs) - 1;
2542 sk_OCSP_SINGLERESP_num(sresp) - 1;
2546 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2548 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2550 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2551 - but what happens with a GnuTLS-style input?
2553 we could do with a debug label for each singleresp
2554 - it has a certID with a serialNumber, but I see no API to get that
2556 status = OCSP_single_get0_status(single, &reason, &rev,
2557 &thisupd, &nextupd);
2561 time_print(bp, "This OCSP Update", thisupd);
2562 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
2564 if (!OCSP_check_validity(thisupd, nextupd,
2565 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2567 tls_out.ocsp = OCSP_FAILED;
2568 DEBUG(D_tls) ERR_print_errors(bp);
2569 log_write(0, LOG_MAIN, "OCSP dates invalid");
2573 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2574 OCSP_cert_status_str(status));
2577 case V_OCSP_CERTSTATUS_GOOD:
2578 continue; /* the idx loop */
2579 case V_OCSP_CERTSTATUS_REVOKED:
2580 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2581 reason != -1 ? "; reason: " : "",
2582 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2583 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2586 log_write(0, LOG_MAIN,
2587 "Server certificate status unknown, in OCSP stapling");
2595 tls_out.ocsp = OCSP_VFIED;
2599 tls_out.ocsp = OCSP_FAILED;
2600 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2604 int len = (int) BIO_get_mem_data(bp, CSS &s);
2605 if (len > 0) debug_printf("%.*s", len, s);
2610 OCSP_RESPONSE_free(rsp);
2613 #endif /*!DISABLE_OCSP*/
2616 /*************************************************
2617 * Initialize for TLS *
2618 *************************************************/
2619 /* Called from both server and client code, to do preliminary initialization
2620 of the library. We allocate and return a context structure.
2623 host connected host, if client; NULL if server
2624 ob transport options block, if client; NULL if server
2625 ocsp_file file of stapling info (server); flag for require ocsp (client)
2626 addr address if client; NULL if server (for some randomness)
2627 caller_state place to put pointer to allocated state-struct
2628 errstr error string pointer
2630 Returns: OK/DEFER/FAIL
2634 tls_init(host_item * host, smtp_transport_options_block * ob,
2635 #ifndef DISABLE_OCSP
2638 address_item *addr, exim_openssl_state_st ** caller_state,
2643 exim_openssl_state_st * state;
2646 if (host) /* client */
2648 state = store_malloc(sizeof(exim_openssl_state_st));
2649 memset(state, 0, sizeof(*state));
2650 state->certificate = ob->tls_certificate;
2651 state->privatekey = ob->tls_privatekey;
2652 state->is_server = FALSE;
2653 state->dhparam = NULL;
2654 state->lib_state = ob->tls_preload;
2658 state = &state_server;
2659 state->certificate = tls_certificate;
2660 state->privatekey = tls_privatekey;
2661 state->is_server = TRUE;
2662 state->dhparam = tls_dhparam;
2663 state->lib_state = state_server.lib_state;
2669 if (!state->lib_state.pri_string)
2670 state->server_cipher_list = NULL;
2672 #ifndef DISABLE_EVENT
2673 state->event_action = NULL;
2678 /* It turns out that we need to seed the random number generator this early in
2679 order to get the full complement of ciphers to work. It took me roughly a day
2680 of work to discover this by experiment.
2682 On systems that have /dev/urandom, SSL may automatically seed itself from
2683 there. Otherwise, we have to make something up as best we can. Double check
2686 Although we likely called this before, at daemon startup, this is a chance
2687 to mix in further variable info (time, pid) if needed. */
2689 if (!lib_rand_init(addr))
2690 return tls_error(US"RAND_status", host,
2691 US"unable to seed random number generator", errstr);
2693 /* Apply administrator-supplied work-arounds.
2694 Historically we applied just one requested option,
2695 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2696 moved to an administrator-controlled list of options to specify and
2697 grandfathered in the first one as the default value for "openssl_options".
2699 No OpenSSL version number checks: the options we accept depend upon the
2700 availability of the option value macros from OpenSSL. */
2703 if (!tls_openssl_options_parse(openssl_options, &init_options))
2704 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2706 /* Create a context.
2707 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2708 negotiation in the different methods; as far as I can tell, the only
2709 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2710 when OpenSSL is built without SSLv2 support.
2711 By disabling with openssl_options, we can let admins re-enable with the
2714 if (!(ctx = state->lib_state.lib_ctx))
2716 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2718 state->lib_state.lib_ctx = ctx;
2721 #ifndef DISABLE_TLS_RESUME
2722 tlsp->resumption = RESUME_SUPPORTED;
2726 #ifndef DISABLE_TLS_RESUME
2727 /* Should the server offer session resumption? */
2728 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2730 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2731 init_options &= ~SSL_OP_NO_TICKET;
2732 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2733 tlsp->host_resumable = TRUE;
2737 #ifdef OPENSSL_MIN_PROTO_VERSION
2738 SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
2740 DEBUG(D_tls) debug_printf("setting SSL CTX options: %016lx\n", init_options);
2741 SSL_CTX_set_options(ctx, init_options);
2743 uint64_t readback = SSL_CTX_clear_options(ctx, ~init_options);
2744 if (readback != init_options)
2745 return tls_error(string_sprintf(
2746 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2750 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2752 /* We'd like to disable session cache unconditionally, but foolish Outlook
2753 Express clients then give up the first TLS connection and make a second one
2754 (which works). Only when there is an IMAP service on the same machine.
2755 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2756 now, until we work out a decent way of presenting control to the config. It
2757 will never be used because we use a new context every time. */
2759 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2762 /* Initialize with DH parameters if supplied */
2763 /* Initialize ECDH temp key parameter selection */
2767 if (state->lib_state.dh)
2768 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2770 if (!init_dh(ctx, state->dhparam, errstr)) return DEFER;
2772 if (state->lib_state.ecdh)
2773 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
2775 if (!init_ecdh(ctx, errstr)) return DEFER;
2778 /* Set up certificate and key (and perhaps OCSP info) */
2780 if (state->lib_state.conn_certs)
2783 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
2787 #ifndef DISABLE_OCSP
2788 if (!host) /* server */
2790 state->u_ocsp.server.file = ocsp_file;
2791 state->u_ocsp.server.file_expanded = NULL;
2792 state->u_ocsp.server.olist = NULL;
2795 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
2798 /* If we need to handle SNI or OCSP, do so */
2800 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2801 # ifndef DISABLE_OCSP
2802 if (!(state->verify_stack = sk_X509_new_null()))
2804 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2809 if (!host) /* server */
2811 # ifndef DISABLE_OCSP
2812 /* We check u_ocsp.server.file, not server.olist, because we care about if
2813 the option exists, not what the current expansion might be, as SNI might
2814 change the certificate and OCSP file in use between now and the time the
2815 callback is invoked. */
2816 if (state->u_ocsp.server.file)
2818 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2819 SSL_CTX_set_tlsext_status_arg(ctx, state);
2822 /* We always do this, so that $tls_sni is available even if not used in
2824 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2825 SSL_CTX_set_tlsext_servername_arg(ctx, state);
2827 # ifdef EXIM_HAVE_ALPN
2828 if (tls_alpn && *tls_alpn)
2831 if ( expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr)
2832 && *exp_alpn && !isblank(*exp_alpn))
2834 tls_alpn = exp_alpn; /* subprocess so ok to overwrite */
2835 SSL_CTX_set_alpn_select_cb(ctx, tls_server_alpn_cb, state);
2842 # ifndef DISABLE_OCSP
2844 if(ocsp_file) /* wanting stapling */
2846 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
2848 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2851 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2852 SSL_CTX_set_tlsext_status_arg(ctx, state);
2857 state->verify_cert_hostnames = NULL;
2859 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
2860 /* Set up the RSA callback */
2861 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
2864 /* Finally, set the session cache timeout, and we are done.
2865 The period appears to be also used for (server-generated) session tickets */
2867 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
2868 DEBUG(D_tls) debug_printf("Initialized TLS\n");
2870 *caller_state = state;
2878 /*************************************************
2879 * Get name of cipher in use *
2880 *************************************************/
2883 Argument: pointer to an SSL structure for the connection
2884 pointer to number of bits for cipher
2885 Returns: pointer to allocated string in perm-pool
2889 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
2891 int pool = store_pool;
2892 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
2893 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2894 the accessor functions use const in the prototype. */
2896 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
2899 SSL_CIPHER_get_bits(c, bits);
2901 store_pool = POOL_PERM;
2902 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2904 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2909 /* Get IETF-standard name for ciphersuite.
2910 Argument: pointer to an SSL structure for the connection
2911 Returns: pointer to string
2914 static const uschar *
2915 cipher_stdname_ssl(SSL * ssl)
2917 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2918 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2920 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2921 return cipher_stdname(id >> 8, id & 0xff);
2926 static const uschar *
2927 tlsver_name(SSL * ssl)
2930 int pool = store_pool;
2932 store_pool = POOL_PERM;
2933 s = string_copy(US SSL_get_version(ssl));
2935 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
2936 for (;; p++) if (!(*p = p[1])) break;
2942 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
2944 /*XXX we might consider a list-of-certs variable for the cert chain.
2945 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2946 in list-handling functions, also consider the difference between the entire
2947 chain and the elements sent by the peer. */
2949 tlsp->peerdn = NULL;
2951 /* Will have already noted peercert on a verify fail; possibly not the leaf */
2952 if (!tlsp->peercert)
2953 tlsp->peercert = SSL_get_peer_certificate(ssl);
2954 /* Beware anonymous ciphers which lead to server_cert being NULL */
2956 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2957 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2960 int oldpool = store_pool;
2962 peerdn[siz-1] = '\0'; /* paranoia */
2963 store_pool = POOL_PERM;
2964 tlsp->peerdn = string_copy(peerdn);
2965 store_pool = oldpool;
2967 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2968 but they don't get called on session-resumption. So use the official
2969 interface, which uses the resumed value. Unfortunately this claims verified
2970 when it actually failed but we're in try-verify mode, due to us wanting the
2971 knowlege that it failed so needing to have the callback and forcing a
2972 permissive return. If we don't force it, the TLS startup is failed.
2973 The extra bit of information is set in verify_override in the cb, stashed
2974 for resumption next to the TLS session, and used here. */
2976 if (!tlsp->verify_override)
2977 tlsp->certificate_verified =
2979 tlsp->dane_verified ||
2981 SSL_get_verify_result(ssl) == X509_V_OK;
2989 /*************************************************
2990 * Set up for verifying certificates *
2991 *************************************************/
2993 #ifndef DISABLE_OCSP
2994 /* Load certs from file, return TRUE on success */
2997 chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
3000 STACK_OF(X509) * verify_stack = *vp;
3003 while (sk_X509_num(verify_stack) > 0)
3004 X509_free(sk_X509_pop(verify_stack));
3006 verify_stack = sk_X509_new_null();
3008 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
3009 for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
3010 sk_X509_push(verify_stack, x);
3019 /* Called by both client and server startup; on the server possibly
3020 repeated after a Server Name Indication.
3023 sctx SSL_CTX* to initialise
3024 certs certs file, expanded
3025 crl CRL file or NULL
3026 host NULL in a server; the remote host in a client
3027 errstr error string pointer
3029 Returns: OK/DEFER/FAIL
3033 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
3036 uschar *expcerts, *expcrl;
3038 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
3040 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3042 if (expcerts && *expcerts)
3044 /* Tell the library to use its compiled-in location for the system default
3045 CA bundle. Then add the ones specified in the config, if any. */
3047 if (!SSL_CTX_set_default_verify_paths(sctx))
3048 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
3050 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
3052 struct stat statbuf;
3054 if (Ustat(expcerts, &statbuf) < 0)
3056 log_write(0, LOG_MAIN|LOG_PANIC,
3057 "failed to stat %s for certificates", expcerts);
3063 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
3064 { file = NULL; dir = expcerts; }
3067 STACK_OF(X509) * verify_stack =
3068 #ifndef DISABLE_OCSP
3069 !host ? state_server.verify_stack :
3072 STACK_OF(X509) ** vp = &verify_stack;
3074 file = expcerts; dir = NULL;
3075 #ifndef DISABLE_OCSP
3076 /* In the server if we will be offering an OCSP proof, load chain from
3077 file for verifying the OCSP proof at load time. */
3079 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
3080 This is inconsistent with the need to verify the OCSP proof of the server cert.
3083 && statbuf.st_size > 0
3084 && state_server.u_ocsp.server.file
3085 && !chain_from_pem_file(file, vp)
3088 log_write(0, LOG_MAIN|LOG_PANIC,
3089 "failed to load cert chain from %s", file);
3095 /* If a certificate file is empty, the load function fails with an
3096 unhelpful error message. If we skip it, we get the correct behaviour (no
3097 certificates are recognized, but the error message is still misleading (it
3098 says no certificate was supplied). But this is better. */
3100 if ( (!file || statbuf.st_size > 0)
3101 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
3102 return tls_error(US"SSL_CTX_load_verify_locations",
3103 host, NULL, errstr);
3105 /* On the server load the list of CAs for which we will accept certs, for
3106 sending to the client. This is only for the one-file
3107 tls_verify_certificates variant.
3108 If a list isn't loaded into the server, but some verify locations are set,
3109 the server end appears to make a wildcard request for client certs.
3110 Meanwhile, the client library as default behaviour *ignores* the list
3111 we send over the wire - see man SSL_CTX_set_client_cert_cb.
3112 Because of this, and that the dir variant is likely only used for
3113 the public-CA bundle (not for a private CA), not worth fixing. */
3117 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
3118 int i = sk_X509_NAME_num(names);
3120 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
3121 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
3122 i, i>1 ? "ies":"y");
3126 debug_printf("Added dir for additional certificate authorities\n");
3130 /* Handle a certificate revocation list. */
3132 #if OPENSSL_VERSION_NUMBER > 0x00907000L
3134 /* This bit of code is now the version supplied by Lars Mainka. (I have
3135 merely reformatted it into the Exim code style.)
3137 "From here I changed the code to add support for multiple crl's
3138 in pem format in one file or to support hashed directory entries in
3139 pem format instead of a file. This method now uses the library function
3140 X509_STORE_load_locations to add the CRL location to the SSL context.
3141 OpenSSL will then handle the verify against CA certs and CRLs by
3142 itself in the verify callback." */
3144 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
3145 if (expcrl && *expcrl)
3147 struct stat statbufcrl;
3148 if (Ustat(expcrl, &statbufcrl) < 0)
3150 log_write(0, LOG_MAIN|LOG_PANIC,
3151 "failed to stat %s for certificates revocation lists", expcrl);
3156 /* is it a file or directory? */
3158 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
3159 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
3163 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
3169 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
3171 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
3172 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
3174 /* setting the flags to check against the complete crl chain */
3176 X509_STORE_set_flags(cvstore,
3177 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
3181 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3190 tls_dump_keylog(SSL * ssl)
3192 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3193 BIO * bp = BIO_new(BIO_s_mem());
3196 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3197 len = (int) BIO_get_mem_data(bp, CSS &s);
3198 if (len > 0) debug_printf("%.*s", len, s);
3204 /* Channel-binding info for authenticators
3205 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/
3210 tls_get_channel_binding(SSL * ssl, tls_support * tlsp, const void * taintval)
3215 #ifdef EXIM_HAVE_EXPORT_CHNL_BNGNG
3216 if (SSL_version(ssl) > TLS1_2_VERSION)
3218 /* It's not documented by OpenSSL how big the output buffer must be.
3219 The OpenSSL testcases use 80 bytes but don't say why. The GnuTLS impl only
3220 serves out 32B. RFC 9266 says it is 32B.
3221 Interop fails unless we use the same each end. */
3224 tlsp->channelbind_exporter = TRUE;
3225 taintval = GET_UNTAINTED;
3226 if (SSL_export_keying_material(ssl,
3227 s = store_get((int)len, taintval), len,
3228 "EXPORTER-Channel-Binding", (size_t) 24,
3235 len = SSL_get_peer_finished(ssl, &c, 0);
3236 len = SSL_get_peer_finished(ssl, s = store_get((int)len, taintval), len);
3241 int old_pool = store_pool;
3242 store_pool = POOL_PERM;
3243 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, taintval);
3244 store_pool = old_pool;
3245 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
3250 /*************************************************
3251 * Start a TLS session in a server *
3252 *************************************************/
3253 /* This is called when Exim is running as a server, after having received
3254 the STARTTLS command. It must respond to that command, and then negotiate
3258 errstr pointer to error message
3260 Returns: OK on success
3261 DEFER for errors before the start of the negotiation
3262 FAIL for errors during the negotiation; the server can't
3267 tls_server_start(uschar ** errstr)
3270 uschar * expciphers;
3271 exim_openssl_state_st * dummy_statep;
3274 static uschar peerdn[256];
3276 /* Check for previous activation */
3278 if (tls_in.active.sock >= 0)
3280 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3281 smtp_printf("554 Already in TLS\r\n", FALSE);
3285 /* Initialize the SSL library. If it fails, it will already have logged
3288 rc = tls_init(NULL, NULL,
3289 #ifndef DISABLE_OCSP
3292 NULL, &dummy_statep, &tls_in, errstr);
3293 if (rc != OK) return rc;
3294 ctx = state_server.lib_state.lib_ctx;
3296 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3297 were historically separated by underscores. So that I can use either form in my
3298 tests, and also for general convenience, we turn underscores into hyphens here.
3300 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3301 for TLS 1.3 . Since we do not call it at present we get the default list:
3302 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3305 if (state_server.lib_state.pri_string)
3306 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3309 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3314 normalise_ciphers(&expciphers, tls_require_ciphers);
3315 if ((rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3320 /* If this is a host for which certificate verification is mandatory or
3321 optional, set up appropriately. */
3323 tls_in.certificate_verified = FALSE;
3325 tls_in.dane_verified = FALSE;
3327 server_verify_callback_called = FALSE;
3329 if (verify_check_host(&tls_verify_hosts) == OK)
3330 server_verify_optional = FALSE;
3331 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3332 server_verify_optional = TRUE;
3338 if (!expand_check(tls_verify_certificates, US"tls_verify_certificates",
3341 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3343 if (state_server.lib_state.cabundle)
3344 { DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n"); }
3346 if ((rc = setup_certs(ctx, expcerts, tls_crl, NULL, errstr)) != OK)
3349 if (expcerts && *expcerts)
3350 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3354 #ifndef DISABLE_TLS_RESUME
3355 # if OPENSSL_VERSION_NUMBER < 0x30000000L
3356 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3357 /* despite working, appears to always return failure, so ignoring */
3359 SSL_CTX_set_tlsext_ticket_key_evp_cb(ctx, ticket_key_callback);
3360 /* despite working, appears to always return failure, so ignoring */
3364 #ifdef OPENSSL_HAVE_NUM_TICKETS
3365 # ifndef DISABLE_TLS_RESUME
3366 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3368 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3373 /* Prepare for new connection */
3375 if (!(ssl = SSL_new(ctx)))
3376 return tls_error(US"SSL_new", NULL, NULL, errstr);
3377 state_server.lib_state.lib_ssl = ssl;
3379 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3381 * With the SSL_clear(), we get strange interoperability bugs with
3382 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3383 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3385 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3386 * session shutdown. In this case, we have a brand new object and there's no
3387 * obvious reason to immediately clear it. I'm guessing that this was
3388 * originally added because of incomplete initialisation which the clear fixed,
3389 * in some historic release.
3392 /* Set context and tell client to go ahead, except in the case of TLS startup
3393 on connection, where outputting anything now upsets the clients and tends to
3394 make them disconnect. We need to have an explicit fflush() here, to force out
3395 the response. Other smtp_printf() calls do not need it, because in non-TLS
3396 mode, the fflush() happens when smtp_getc() is called. */
3398 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3399 if (!tls_in.on_connect)
3401 smtp_printf("220 TLS go ahead\r\n", FALSE);
3405 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3406 that the OpenSSL library doesn't. */
3408 SSL_set_wfd(ssl, fileno(smtp_out));
3409 SSL_set_rfd(ssl, fileno(smtp_in));
3410 SSL_set_accept_state(ssl);
3412 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3415 sigalrm_seen = FALSE;
3416 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3417 rc = SSL_accept(ssl);
3422 int error = SSL_get_error(ssl, rc);
3425 case SSL_ERROR_NONE:
3428 case SSL_ERROR_ZERO_RETURN:
3429 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3430 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3431 #ifndef DISABLE_EVENT
3432 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3434 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3437 tls_close(NULL, TLS_NO_SHUTDOWN);
3440 /* Handle genuine errors */
3444 int r = ERR_GET_REASON(ERR_peek_error());
3445 if ( r == SSL_R_WRONG_VERSION_NUMBER
3446 #ifdef SSL_R_VERSION_TOO_LOW
3447 || r == SSL_R_VERSION_TOO_LOW
3449 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3450 s = string_sprintf("(%s)", SSL_get_version(ssl));
3451 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
3452 #ifndef DISABLE_EVENT
3453 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3459 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3460 if (error == SSL_ERROR_SYSCALL)
3464 *errstr = US"SSL_accept: TCP connection closed by peer";
3465 #ifndef DISABLE_EVENT
3466 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3470 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3472 (void) tls_error(US"SSL_accept", NULL,
3473 sigalrm_seen ? US"timed out"
3474 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3476 #ifndef DISABLE_EVENT
3477 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3483 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3484 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3485 anon-authentication ciphersuite negotiated. */
3487 #ifndef DISABLE_TLS_RESUME
3488 if (SSL_session_reused(ssl))
3490 tls_in.resumption |= RESUME_USED;
3491 DEBUG(D_tls) debug_printf("Session reused\n");
3495 #ifdef EXIM_HAVE_ALPN
3496 /* If require-alpn, check server_seen_alpn here. Else abort TLS */
3497 if (!tls_alpn || !*tls_alpn)
3498 { DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n"); }
3499 else if (!server_seen_alpn)
3500 if (verify_check_host(&hosts_require_alpn) == OK)
3502 /* We'd like to send a definitive Alert but OpenSSL provides no facility */
3504 tls_error(US"handshake", NULL, US"ALPN required but not negotiated", errstr);
3508 { DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n"); }
3511 const uschar * name;
3513 SSL_get0_alpn_selected(ssl, &name, &len);
3515 debug_printf("ALPN negotiated: '%.*s'\n", (int)*name, name+1);
3517 debug_printf("ALPN: no protocol negotiated\n");
3522 /* TLS has been set up. Record data for the connection,
3523 adjust the input functions to read via TLS, and initialize things. */
3525 #ifdef SSL_get_extms_support
3526 /*XXX what does this return for tls1.3 ? */
3527 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3529 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3531 tls_in.ver = tlsver_name(ssl);
3532 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3533 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3538 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3539 debug_printf("Shared ciphers: %s\n", buf);
3541 tls_dump_keylog(ssl);
3543 #ifdef EXIM_HAVE_SESSION_TICKET
3545 SSL_SESSION * ss = SSL_get_session(ssl);
3546 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3547 debug_printf("The session has a ticket, life %lu seconds\n",
3548 SSL_SESSION_get_ticket_lifetime_hint(ss));
3553 /* Record the certificate we presented */
3555 X509 * crt = SSL_get_certificate(ssl);
3556 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3559 tls_get_channel_binding(ssl, &tls_in, GET_UNTAINTED);
3561 /* Only used by the server-side tls (tls_in), including tls_getc.
3562 Client-side (tls_out) reads (seem to?) go via
3563 smtp_read_response()/ip_recv().
3564 Hence no need to duplicate for _in and _out.
3566 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3567 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3568 ssl_xfer_eof = ssl_xfer_error = FALSE;
3570 receive_getc = tls_getc;
3571 receive_getbuf = tls_getbuf;
3572 receive_get_cache = tls_get_cache;
3573 receive_hasc = tls_hasc;
3574 receive_ungetc = tls_ungetc;
3575 receive_feof = tls_feof;
3576 receive_ferror = tls_ferror;
3578 tls_in.active.sock = fileno(smtp_out);
3579 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3587 tls_client_basic_ctx_init(SSL_CTX * ctx,
3588 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3593 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3594 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3595 host patterns if one of them is set with content. */
3597 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3598 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3600 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3601 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3604 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3606 client_verify_optional = FALSE;
3607 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3608 client_verify_optional = TRUE;
3614 if (!expand_check(ob->tls_verify_certificates, US"tls_verify_certificates",
3617 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3619 if (state->lib_state.cabundle)
3620 { DEBUG(D_tls) debug_printf("TLS: CA bundle was preloaded\n"); }
3622 if ((rc = setup_certs(ctx, expcerts, ob->tls_crl, host, errstr)) != OK)
3625 if (expcerts && *expcerts)
3626 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3629 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3631 state->verify_cert_hostnames =
3633 string_domain_utf8_to_alabel(host->certname, NULL);
3637 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3638 state->verify_cert_hostnames);
3646 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3649 const char * hostnames[2] = { CS host->name, NULL };
3652 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3653 return tls_error(US"hostnames load", host, NULL, errstr);
3655 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3656 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3657 ) if (rr->type == T_TLSA && rr->size > 3)
3659 const uschar * p = rr->data;
3660 uint8_t usage, selector, mtype;
3661 const char * mdname;
3665 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3666 if (usage != 2 && usage != 3) continue;
3673 default: continue; /* Only match-types 0, 1, 2 are supported */
3674 case 0: mdname = NULL; break;
3675 case 1: mdname = "sha256"; break;
3676 case 2: mdname = "sha512"; break;
3680 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3683 return tls_error(US"tlsa load", host, NULL, errstr);
3684 case 0: /* action not taken */
3688 tls_out.tlsa_usage |= 1<<usage;
3694 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3697 #endif /*SUPPORT_DANE*/
3701 #ifndef DISABLE_TLS_RESUME
3702 /* On the client, get any stashed session for the given IP from hints db
3703 and apply it to the ssl-connection for attempted resumption. */
3706 tls_retrieve_session(tls_support * tlsp, SSL * ssl)
3708 if (tlsp->host_resumable)
3710 const uschar * key = tlsp->resume_index;
3711 dbdata_tls_session * dt;
3713 open_db dbblock, * dbm_file;
3715 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3717 debug_printf("checking for resumable session for %s\n", tlsp->resume_index);
3718 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3720 if ((dt = dbfn_read_with_length(dbm_file, tlsp->resume_index, &len)))
3722 SSL_SESSION * ss = NULL;
3723 const uschar * sess_asn1 = dt->session;
3725 len -= sizeof(dbdata_tls_session);
3726 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3730 ERR_error_string_n(ERR_get_error(),
3731 ssl_errstring, sizeof(ssl_errstring));
3732 debug_printf("decoding session: %s\n", ssl_errstring);
3737 unsigned long lifetime =
3738 #ifdef EXIM_HAVE_SESSION_TICKET
3739 SSL_SESSION_get_ticket_lifetime_hint(ss);
3740 #else /* Use, fairly arbitrilarily, what we as server would */
3741 f.running_in_test_harness ? 6 : ssl_session_timeout;
3743 if (lifetime + dt->time_stamp < time(NULL))
3745 DEBUG(D_tls) debug_printf("session expired\n");
3746 dbfn_delete(dbm_file, tlsp->resume_index);
3748 else if (SSL_set_session(ssl, ss))
3750 DEBUG(D_tls) debug_printf("good session\n");
3751 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3752 tlsp->verify_override = dt->verify_override;
3753 tlsp->ocsp = dt->ocsp;
3757 ERR_error_string_n(ERR_get_error(),
3758 ssl_errstring, sizeof(ssl_errstring));
3759 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3764 DEBUG(D_tls) debug_printf("no session record\n");
3765 dbfn_close(dbm_file);
3771 /* On the client, save the session for later resumption */
3774 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3776 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3779 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3781 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3783 # ifdef OPENSSL_HAVE_NUM_TICKETS
3784 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3787 int len = i2d_SSL_SESSION(ss, NULL);
3788 int dlen = sizeof(dbdata_tls_session) + len;
3789 dbdata_tls_session * dt = store_get(dlen, GET_TAINTED);
3790 uschar * s = dt->session;
3791 open_db dbblock, * dbm_file;
3793 DEBUG(D_tls) debug_printf("session is resumable\n");
3794 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3796 dt->verify_override = tlsp->verify_override;
3797 dt->ocsp = tlsp->ocsp;
3798 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3800 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3802 dbfn_write(dbm_file, tlsp->resume_index, dt, dlen);
3803 dbfn_close(dbm_file);
3804 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3812 /* Construct a key for session DB lookup, and setup the SSL_CTX for resumption */
3815 tls_client_ctx_resume_prehandshake(
3816 exim_openssl_client_tls_ctx * exim_client_ctx, smtp_connect_args * conn_args,
3817 tls_support * tlsp, smtp_transport_options_block * ob)
3819 tlsp->host_resumable = TRUE;
3820 tls_client_resmption_key(tlsp, conn_args, ob);
3822 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3823 SSL_SESS_CACHE_CLIENT
3824 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3825 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3829 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3830 host_item * host, uschar ** errstr)
3832 if (tlsp->host_resumable)
3835 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3836 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3838 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3839 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
3841 tls_error(US"set ex_data", host, NULL, errstr);
3844 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state);
3847 tlsp->resumption = RESUME_SUPPORTED;
3848 /* Pick up a previous session, saved on an old ticket */
3849 tls_retrieve_session(tlsp, ssl);
3854 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
3857 if (SSL_session_reused(exim_client_ctx->ssl))
3859 DEBUG(D_tls) debug_printf("The session was reused\n");
3860 tlsp->resumption |= RESUME_USED;
3863 #endif /* !DISABLE_TLS_RESUME */
3866 #ifdef EXIM_HAVE_ALPN
3867 /* Expand and convert an Exim list to an ALPN list. False return for fail.
3868 NULL plist return for silent no-ALPN.
3870 Overwite the passed-in list with the expanded version.
3874 tls_alpn_plist(uschar ** tls_alpn, const uschar ** plist, unsigned * plen,
3879 if (!expand_check(*tls_alpn, US"tls_alpn", &exp_alpn, errstr))
3881 *tls_alpn = exp_alpn;
3885 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
3890 /* The server implementation only accepts exactly one protocol name
3891 but it's little extra code complexity in the client. */
3893 const uschar * list = exp_alpn;
3894 uschar * p = store_get(Ustrlen(exp_alpn), exp_alpn), * s, * t;
3898 for (t = p; s = string_nextinlist(&list, &sep, NULL, 0); t += len)
3900 *t++ = len = (uschar) Ustrlen(s);
3903 *plist = (*plen = t - p) ? p : NULL;
3907 #endif /* EXIM_HAVE_ALPN */
3910 /*************************************************
3911 * Start a TLS session in a client *
3912 *************************************************/
3914 /* Called from the smtp transport after STARTTLS has been accepted.
3917 cctx connection context
3918 conn_args connection details
3919 cookie datum for randomness; can be NULL
3920 tlsp record details of TLS channel configuration here; must be non-NULL
3921 errstr error string pointer
3923 Returns: TRUE for success with TLS session context set in connection context,
3928 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3929 void * cookie, tls_support * tlsp, uschar ** errstr)
3931 host_item * host = conn_args->host; /* for msgs and option-tests */
3932 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3933 smtp_transport_options_block * ob = tb
3934 ? (smtp_transport_options_block *)tb->options_block
3935 : &smtp_transport_option_defaults;
3936 exim_openssl_client_tls_ctx * exim_client_ctx;
3937 uschar * expciphers;
3939 static uschar peerdn[256];
3941 #ifndef DISABLE_OCSP
3942 BOOL request_ocsp = FALSE;
3943 BOOL require_ocsp = FALSE;
3947 store_pool = POOL_PERM;
3948 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), GET_UNTAINTED);
3949 exim_client_ctx->corked = NULL;
3953 tlsp->tlsa_usage = 0;
3956 #ifndef DISABLE_OCSP
3958 # ifdef SUPPORT_DANE
3959 /*XXX this should be moved to caller, to be common across gnutls/openssl */
3960 if ( conn_args->dane
3961 && ob->hosts_request_ocsp[0] == '*'
3962 && ob->hosts_request_ocsp[1] == '\0'
3965 /* Unchanged from default. Use a safer one under DANE */
3966 request_ocsp = TRUE;
3967 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3968 " {= {4}{$tls_out_tlsa_usage}} } "
3974 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
3975 request_ocsp = TRUE;
3977 # ifdef SUPPORT_DANE
3981 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3985 rc = tls_init(host, ob,
3986 #ifndef DISABLE_OCSP
3987 (void *)(long)request_ocsp,
3989 cookie, &client_static_state, tlsp, errstr);
3990 if (rc != OK) return FALSE;
3992 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
3994 tlsp->certificate_verified = FALSE;
3995 client_verify_callback_called = FALSE;
3999 if (conn_args->dane)
4001 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
4002 other failures should be treated as problems. */
4003 if (ob->dane_require_tls_ciphers &&
4004 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
4005 &expciphers, errstr))
4007 if (expciphers && *expciphers == '\0')
4010 normalise_ciphers(&expciphers, ob->dane_require_tls_ciphers);
4015 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
4016 &expciphers, errstr))
4019 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
4020 are separated by underscores. So that I can use either form in my tests, and
4021 also for general convenience, we turn underscores into hyphens here. */
4023 normalise_ciphers(&expciphers, ob->tls_require_ciphers);
4028 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
4029 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
4031 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
4037 if (conn_args->dane)
4039 SSL_CTX_set_verify(exim_client_ctx->ctx,
4040 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
4041 verify_callback_client_dane);
4043 if (!DANESSL_library_init())
4045 tls_error(US"library init", host, NULL, errstr);
4048 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
4050 tls_error(US"context init", host, NULL, errstr);
4058 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
4059 client_static_state, errstr) != OK)
4064 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
4067 { DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n"); }
4068 else if (!Ustrlen(tlsp->sni))
4072 #ifndef EXIM_HAVE_OPENSSL_TLSEXT
4073 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
4081 #ifdef EXIM_HAVE_ALPN
4083 const uschar * plist;
4086 if (!tls_alpn_plist(&ob->tls_alpn, &plist, &plen, errstr))
4089 if (SSL_CTX_set_alpn_protos(exim_client_ctx->ctx, plist, plen) != 0)
4091 tls_error(US"alpn init", host, NULL, errstr);
4095 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
4098 log_write(0, LOG_MAIN, "ALPN unusable with this OpenSSL library version; ignoring \"%s\"\n",
4102 #ifndef DISABLE_TLS_RESUME
4103 /*XXX have_lbserver: another cmdline arg possibly, for continued-conn, but use
4104 will be very low. */
4106 if (!conn_args->have_lbserver) /* wanted for tls_client_resmption_key() */
4107 { DEBUG(D_tls) debug_printf("resumption not supported on continued-connection\n"); }
4108 else if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
4109 tls_client_ctx_resume_prehandshake(exim_client_ctx, conn_args, tlsp, ob);
4113 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
4115 tls_error(US"SSL_new", host, NULL, errstr);
4118 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
4119 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
4120 SSL_set_connect_state(exim_client_ctx->ssl);
4122 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
4125 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
4126 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
4131 if (conn_args->dane)
4132 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
4136 #ifndef DISABLE_OCSP
4137 /* Request certificate status at connection-time. If the server
4138 does OCSP stapling we will get the callback (set in tls_init()) */
4139 # ifdef SUPPORT_DANE
4143 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4144 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4146 { /* Re-eval now $tls_out_tlsa_usage is populated. If
4147 this means we avoid the OCSP request, we wasted the setup
4148 cost in tls_init(). */
4149 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
4150 request_ocsp = require_ocsp
4151 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4158 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
4159 client_static_state->u_ocsp.client.verify_required = require_ocsp;
4160 tlsp->ocsp = OCSP_NOT_RESP;
4164 #ifndef DISABLE_TLS_RESUME
4165 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
4170 #ifndef DISABLE_EVENT
4171 client_static_state->event_action = tb ? tb->event_action : NULL;
4174 /* There doesn't seem to be a built-in timeout on connection. */
4176 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
4177 sigalrm_seen = FALSE;
4178 ALARM(ob->command_timeout);
4179 rc = SSL_connect(exim_client_ctx->ssl);
4183 if (conn_args->dane)
4184 DANESSL_cleanup(exim_client_ctx->ssl);
4189 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
4195 debug_printf("SSL_connect succeeded\n");
4196 tls_dump_keylog(exim_client_ctx->ssl);
4199 #ifndef DISABLE_TLS_RESUME
4200 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
4203 #ifdef EXIM_HAVE_ALPN
4204 if (ob->tls_alpn) /* We requested. See what was negotiated. */
4206 const uschar * name;
4209 SSL_get0_alpn_selected(exim_client_ctx->ssl, &name, &len);
4211 { DEBUG(D_tls) debug_printf("ALPN negotiated %u: '%.*s'\n", len, (int)*name, name+1); }
4212 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
4214 /* Would like to send a relevant fatal Alert, but OpenSSL has no API */
4215 tls_error(US"handshake", host, US"ALPN required but not negotiated", errstr);
4221 #ifdef SSL_get_extms_support
4222 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
4224 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
4226 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
4227 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
4228 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
4230 /* Record the certificate we presented */
4232 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
4233 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
4236 /*XXX will this work with continued-TLS? */
4237 tls_get_channel_binding(exim_client_ctx->ssl, tlsp, GET_TAINTED);
4239 tlsp->active.sock = cctx->sock;
4240 tlsp->active.tls_ctx = exim_client_ctx;
4241 cctx->tls_ctx = exim_client_ctx;
4250 tls_refill(unsigned lim)
4252 SSL * ssl = state_server.lib_state.lib_ssl;
4256 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4257 ssl_xfer_buffer, ssl_xfer_buffer_size);
4260 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4261 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
4262 MIN(ssl_xfer_buffer_size, lim));
4263 error = SSL_get_error(ssl, inbytes);
4264 if (smtp_receive_timeout > 0) ALARM_CLR(0);
4266 if (had_command_timeout) /* set by signal handler */
4267 smtp_command_timeout_exit(); /* does not return */
4268 if (had_command_sigterm)
4269 smtp_command_sigterm_exit();
4270 if (had_data_timeout)
4271 smtp_data_timeout_exit();
4272 if (had_data_sigint)
4273 smtp_data_sigint_exit();
4275 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
4276 closed down, not that the socket itself has been closed down. Revert to
4277 non-SSL handling. */
4281 case SSL_ERROR_NONE:
4284 case SSL_ERROR_ZERO_RETURN:
4285 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4287 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
4290 tls_close(NULL, TLS_NO_SHUTDOWN);
4293 /* Handle genuine errors */
4295 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4296 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
4297 ssl_xfer_error = TRUE;
4301 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
4302 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
4303 debug_printf(" - syscall %s\n", strerror(errno));
4304 ssl_xfer_error = TRUE;
4308 #ifndef DISABLE_DKIM
4309 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
4311 ssl_xfer_buffer_hwm = inbytes;
4312 ssl_xfer_buffer_lwm = 0;
4317 /*************************************************
4318 * TLS version of getc *
4319 *************************************************/
4321 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
4322 it refills the buffer via the SSL reading function.
4324 Arguments: lim Maximum amount to read/buffer
4325 Returns: the next character or EOF
4327 Only used by the server-side TLS.
4331 tls_getc(unsigned lim)
4333 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4334 if (!tls_refill(lim))
4335 return ssl_xfer_error ? EOF : smtp_getc(lim);
4337 /* Something in the buffer; return next uschar */
4339 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
4345 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm;
4349 tls_getbuf(unsigned * len)
4354 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4355 if (!tls_refill(*len))
4357 if (!ssl_xfer_error) return smtp_getbuf(len);
4362 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4364 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4365 ssl_xfer_buffer_lwm += size;
4372 tls_get_cache(unsigned lim)
4374 #ifndef DISABLE_DKIM
4375 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4376 debug_printf("tls_get_cache\n");
4380 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4386 tls_could_getc(void)
4388 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4389 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4393 /*************************************************
4394 * Read bytes from TLS channel *
4395 *************************************************/
4399 ct_ctx client context pointer, or NULL for the one global server context
4403 Returns: the number of bytes read
4404 -1 after a failed read, including EOF
4406 Only used by the client-side TLS.
4410 tls_read(void * ct_ctx, uschar *buff, size_t len)
4412 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4413 : state_server.lib_state.lib_ssl;
4417 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4418 buff, (unsigned int)len);
4421 inbytes = SSL_read(ssl, CS buff, len);
4422 error = SSL_get_error(ssl, inbytes);
4424 if (error == SSL_ERROR_ZERO_RETURN)
4426 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4429 else if (error != SSL_ERROR_NONE)
4439 /*************************************************
4440 * Write bytes down TLS channel *
4441 *************************************************/
4445 ct_ctx client context pointer, or NULL for the one global server context
4448 more further data expected soon
4450 Returns: the number of bytes after a successful write,
4451 -1 after a failed write
4453 Used by both server-side and client-side TLS. Calling with len zero and more unset
4454 will flush buffered writes; buff can be null for this case.
4458 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4461 int outbytes, error;
4463 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4464 : state_server.lib_state.lib_ssl;
4465 static gstring * server_corked = NULL;
4466 gstring ** corkedp = ct_ctx
4467 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4468 gstring * corked = *corkedp;
4470 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4471 buff, (unsigned long)len, more ? ", more" : "");
4473 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4474 "more" is notified. This hack is only ok if small amounts are involved AND only
4475 one stream does it, in one context (i.e. no store reset). Currently it is used
4476 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4477 We support callouts done by the server process by using a separate client
4478 context for the stashed information. */
4479 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4480 a store reset there, so use POOL_PERM. */
4481 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4485 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4487 int save_pool = store_pool;
4488 store_pool = POOL_PERM;
4490 corked = string_catn(corked, buff, len);
4492 store_pool = save_pool;
4499 buff = CUS corked->s;
4504 for (int left = len; left > 0;)
4506 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4508 outbytes = SSL_write(ssl, CS buff, left);
4509 error = SSL_get_error(ssl, outbytes);
4510 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4513 case SSL_ERROR_NONE: /* the usual case */
4519 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4520 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4523 case SSL_ERROR_ZERO_RETURN:
4524 log_write(0, LOG_MAIN, "SSL channel closed on write");
4527 case SSL_ERROR_SYSCALL:
4528 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4529 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4530 sender_fullhost ? sender_fullhost : US"<unknown>",
4532 else if (LOGGING(protocol_detail))
4533 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4534 " SMTP response and TLS close\n", sender_host_address);
4536 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4537 " client reset TCP before TLS close\n", sender_host_address);
4541 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4552 ct_ctx client TLS context pointer, or NULL for the one global server context
4556 tls_shutdown_wr(void * ct_ctx)
4558 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4559 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4560 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4563 if (*fdp < 0) return; /* TLS was not active */
4565 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4567 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
4568 rc = SSL_shutdown(*sslp);
4569 if (rc < 0) DEBUG(D_tls)
4571 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4572 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4576 /*************************************************
4577 * Close down a TLS session *
4578 *************************************************/
4580 /* This is also called from within a delivery subprocess forked from the
4581 daemon, to shut down the TLS library, without actually doing a shutdown (which
4582 would tamper with the SSL session in the parent process).
4585 ct_ctx client TLS context pointer, or NULL for the one global server context
4586 do_shutdown 0 no data-flush or TLS close-alert
4587 1 if TLS close-alert is to be sent,
4588 2 if also response to be waited for
4592 Used by both server-side and client-side TLS.
4596 tls_close(void * ct_ctx, int do_shutdown)
4598 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4599 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4600 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4602 if (*fdp < 0) return; /* TLS was not active */
4604 if (do_shutdown > TLS_NO_SHUTDOWN)
4607 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4608 do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
4610 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4612 if ( ( do_shutdown >= TLS_SHUTDOWN_WONLY
4613 || (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4615 && do_shutdown > TLS_SHUTDOWN_NOWAIT
4618 #ifdef EXIM_TCP_CORK
4619 (void) setsockopt(*fdp, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
4622 rc = SSL_shutdown(*sslp); /* wait for response */
4626 if (rc < 0) DEBUG(D_tls)
4628 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4629 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4633 if (!o_ctx) /* server side */
4635 #ifndef DISABLE_OCSP
4636 sk_X509_pop_free(state_server.verify_stack, X509_free);
4637 state_server.verify_stack = NULL;
4640 receive_getc = smtp_getc;
4641 receive_getbuf = smtp_getbuf;
4642 receive_get_cache = smtp_get_cache;
4643 receive_hasc = smtp_hasc;
4644 receive_ungetc = smtp_ungetc;
4645 receive_feof = smtp_feof;
4646 receive_ferror = smtp_ferror;
4647 tls_in.active.tls_ctx = NULL;
4649 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4660 /*************************************************
4661 * Let tls_require_ciphers be checked at startup *
4662 *************************************************/
4664 /* The tls_require_ciphers option, if set, must be something which the
4667 Returns: NULL on success, or error message
4671 tls_validate_require_cipher(void)
4674 uschar * expciphers, * err;
4678 if (!(tls_require_ciphers && *tls_require_ciphers))
4681 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4683 return US"failed to expand tls_require_ciphers";
4685 if (!(expciphers && *expciphers))
4688 normalise_ciphers(&expciphers, tls_require_ciphers);
4691 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4694 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4696 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4698 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4699 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4700 expciphers, ssl_errstring);
4711 /*************************************************
4712 * Report the library versions. *
4713 *************************************************/
4715 /* There have historically been some issues with binary compatibility in
4716 OpenSSL libraries; if Exim (like many other applications) is built against
4717 one version of OpenSSL but the run-time linker picks up another version,
4718 it can result in serious failures, including crashing with a SIGSEGV. So
4719 report the version found by the compiler and the run-time version.
4721 Note: some OS vendors backport security fixes without changing the version
4722 number/string, and the version date remains unchanged. The _build_ date
4723 will change, so we can more usefully assist with version diagnosis by also
4724 reporting the build date.
4726 Arguments: string to append to
4731 tls_version_report(gstring * g)
4733 return string_fmt_append(g,
4734 "Library version: OpenSSL: Compile: %s\n"
4737 OPENSSL_VERSION_TEXT,
4738 SSLeay_version(SSLEAY_VERSION),
4739 SSLeay_version(SSLEAY_BUILT_ON));
4740 /* third line is 38 characters for the %s and the line is 73 chars long;
4741 the OpenSSL output includes a "built on: " prefix already. */
4747 /*************************************************
4748 * Random number generation *
4749 *************************************************/
4751 /* Pseudo-random number generation. The result is not expected to be
4752 cryptographically strong but not so weak that someone will shoot themselves
4753 in the foot using it as a nonce in input in some email header scheme or
4754 whatever weirdness they'll twist this into. The result should handle fork()
4755 and avoid repeating sequences. OpenSSL handles that for us.
4759 Returns a random number in range [0, max-1]
4763 vaguely_random_number(int max)
4767 static pid_t pidlast = 0;
4769 uschar smallbuf[sizeof(r)];
4775 if (pidnow != pidlast)
4777 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
4778 is unique for each thread", this doesn't apparently apply across processes,
4779 so our own warning from vaguely_random_number_fallback() applies here too.
4780 Fix per PostgreSQL. */
4786 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
4790 gettimeofday(&r.tv, NULL);
4793 RAND_seed(US (&r), sizeof(r));
4795 /* We're after pseudo-random, not random; if we still don't have enough data
4796 in the internal PRNG then our options are limited. We could sleep and hope
4797 for entropy to come along (prayer technique) but if the system is so depleted
4798 in the first place then something is likely to just keep taking it. Instead,
4799 we'll just take whatever little bit of pseudo-random we can still manage to
4802 needed_len = sizeof(r);
4803 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4804 asked for a number less than 10. */
4805 for (r = max, i = 0; r; ++i)
4811 #ifdef EXIM_HAVE_RAND_PSEUDO
4812 /* We do not care if crypto-strong */
4813 i = RAND_pseudo_bytes(smallbuf, needed_len);
4815 i = RAND_bytes(smallbuf, needed_len);
4821 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
4822 return vaguely_random_number_fallback(max);
4826 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4829 /* We don't particularly care about weighted results; if someone wants
4830 smooth distribution and cares enough then they should submit a patch then. */
4837 /*************************************************
4838 * OpenSSL option parse *
4839 *************************************************/
4841 /* Parse one option for tls_openssl_options_parse below
4844 name one option name
4845 value place to store a value for it
4846 Returns success or failure in parsing
4852 tls_openssl_one_option_parse(uschar *name, long *value)
4855 int last = exim_openssl_options_size;
4856 while (last > first)
4858 int middle = (first + last)/2;
4859 int c = Ustrcmp(name, exim_openssl_options[middle].name);
4862 *value = exim_openssl_options[middle].value;
4876 /*************************************************
4877 * OpenSSL option parsing logic *
4878 *************************************************/
4880 /* OpenSSL has a number of compatibility options which an administrator might
4881 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
4882 we look like log_selector.
4885 option_spec the administrator-supplied string of options
4886 results ptr to long storage for the options bitmap
4887 Returns success or failure
4891 tls_openssl_options_parse(uschar *option_spec, long *results)
4894 uschar * exp, * end;
4895 BOOL adding, item_parsed;
4897 /* Server: send no (<= TLS1.2) session tickets */
4898 result = SSL_OP_NO_TICKET;
4900 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
4901 from default because it increases BEAST susceptibility. */
4902 #ifdef SSL_OP_NO_SSLv2
4903 result |= SSL_OP_NO_SSLv2;
4905 #ifdef SSL_OP_NO_SSLv3
4906 result |= SSL_OP_NO_SSLv3;
4908 #ifdef SSL_OP_SINGLE_DH_USE
4909 result |= SSL_OP_SINGLE_DH_USE;
4911 #ifdef SSL_OP_NO_RENEGOTIATION
4912 result |= SSL_OP_NO_RENEGOTIATION;
4921 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
4924 for (uschar * s = exp; *s; /**/)
4926 while (isspace(*s)) ++s;
4929 if (*s != '+' && *s != '-')
4931 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
4932 "+ or - expected but found \"%s\"\n", s);
4935 adding = *s++ == '+';
4936 for (end = s; *end && !isspace(*end); ) end++;
4937 item_parsed = tls_openssl_one_option_parse(string_copyn(s, end-s), &item);
4940 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
4943 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
4944 adding ? "adding to " : "removing from", result, item, s);
4956 #endif /*!MACRO_PREDEF*/
4959 /* End of tls-openssl.c */