1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2019 */
7 /* See the file NOTICE for conditions of use and distribution. */
8 /* SPDX-License-Identifier: GPL-2.0-or-later */
10 /* Portions Copyright (c) The OpenSSL Project 1999 */
12 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
13 library. It is #included into the tls.c file when that library is used. The
14 code herein is based on a patch that was originally contributed by Steve
15 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
17 No cryptographic code is included in Exim. All this module does is to call
18 functions from the OpenSSL library. */
23 #include <openssl/lhash.h>
24 #include <openssl/ssl.h>
25 #include <openssl/err.h>
26 #include <openssl/rand.h>
27 #ifndef OPENSSL_NO_ECDH
28 # include <openssl/ec.h>
31 # include <openssl/ocsp.h>
39 # define EXIM_OCSP_SKEW_SECONDS (300L)
40 # define EXIM_OCSP_MAX_AGE (-1L)
43 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
44 # define EXIM_HAVE_OPENSSL_TLSEXT
46 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
47 # define EXIM_HAVE_RSA_GENKEY_EX
49 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
50 # define EXIM_HAVE_OCSP_RESP_COUNT
51 # define OPENSSL_AUTO_SHA256
52 # define OPENSSL_MIN_PROTO_VERSION
54 # define EXIM_HAVE_EPHEM_RSA_KEX
55 # define EXIM_HAVE_RAND_PSEUDO
57 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
58 # define EXIM_HAVE_SHA256
61 /* X509_check_host provides sane certificate hostname checking, but was added
62 to OpenSSL late, after other projects forked off the code-base. So in
63 addition to guarding against the base version number, beware that LibreSSL
64 does not (at this time) support this function.
66 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
67 opt to disentangle and ask a LibreSSL user to provide glue for a third
68 crypto provider for libtls instead of continuing to tie the OpenSSL glue
69 into even twistier knots. If LibreSSL gains the same API, we can just
70 change this guard and punt the issue for a while longer. */
72 #ifndef LIBRESSL_VERSION_NUMBER
73 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
74 # define EXIM_HAVE_OPENSSL_CHECKHOST
75 # define EXIM_HAVE_OPENSSL_DH_BITS
76 # define EXIM_HAVE_OPENSSL_TLS_METHOD
77 # define EXIM_HAVE_OPENSSL_KEYLOG
78 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
79 # define EXIM_HAVE_SESSION_TICKET
80 # define EXIM_HAVE_OPESSL_TRACE
81 # define EXIM_HAVE_OPESSL_GET0_SERIAL
82 # define EXIM_HAVE_OPESSL_OCSP_RESP_GET0_CERTS
83 # define EXIM_HAVE_SSL_GET0_VERIFIED_CHAIN
85 # define EXIM_HAVE_OCSP
87 # define EXIM_HAVE_ALPN /* fail ret from hshake-cb is ignored by LibreSSL */
89 # define EXIM_NEED_OPENSSL_INIT
91 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
92 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
93 # define EXIM_HAVE_OPENSSL_CHECKHOST
97 #if LIBRESSL_VERSION_NUMBER >= 0x3040000fL
98 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
101 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x030000000L)
102 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
103 # define EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
106 #if !defined(LIBRESSL_VERSION_NUMBER) \
107 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
108 # if !defined(OPENSSL_NO_ECDH)
109 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
110 # define EXIM_HAVE_ECDH
112 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
113 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
118 #ifndef LIBRESSL_VERSION_NUMBER
119 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
120 # define OPENSSL_HAVE_KEYLOG_CB
121 # define OPENSSL_HAVE_NUM_TICKETS
122 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
123 # define EXIM_HAVE_EXP_CHNL_BNGNG
124 # define EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER
126 # define OPENSSL_BAD_SRVR_OURCERT
130 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x010002000L)
131 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
134 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
135 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
136 # define DISABLE_OCSP
139 #ifndef DISABLE_TLS_RESUME
140 # if OPENSSL_VERSION_NUMBER < 0x0101010L
141 # error OpenSSL version too old for session-resumption
145 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
146 # include <openssl/x509v3.h>
149 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
150 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
151 # define SSL_CIPHER_get_id(c) (c->id)
153 # ifndef MACRO_PREDEF
154 # include "tls-cipher-stdname.c"
158 #define TESTSUITE_TICKET_LIFE 10 /* seconds */
159 /*************************************************
160 * OpenSSL option parse *
161 *************************************************/
163 typedef struct exim_openssl_option {
166 } exim_openssl_option;
167 /* We could use a macro to expand, but we need the ifdef and not all the
168 options document which version they were introduced in. Policylet: include
169 all options unless explicitly for DTLS, let the administrator choose which
172 This list is current as of:
175 XXX could we autobuild this list, as with predefined-macros?
176 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
177 Also allow a numeric literal?
179 static exim_openssl_option exim_openssl_options[] = {
180 /* KEEP SORTED ALPHABETICALLY! */
182 { US"all", (long) SSL_OP_ALL },
184 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
185 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
187 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
188 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
190 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
191 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
193 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
194 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
196 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
197 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
199 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
200 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
202 #ifdef SSL_OP_EPHEMERAL_RSA
203 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
205 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
206 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
208 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
209 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
211 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
212 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
214 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
215 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
217 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
218 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
220 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
221 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
223 #ifdef SSL_OP_NO_ANTI_REPLAY
224 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
226 #ifdef SSL_OP_NO_COMPRESSION
227 { US"no_compression", SSL_OP_NO_COMPRESSION },
229 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
230 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
232 #ifdef SSL_OP_NO_RENEGOTIATION
233 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
235 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
236 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
238 #ifdef SSL_OP_NO_SSLv2
239 { US"no_sslv2", SSL_OP_NO_SSLv2 },
241 #ifdef SSL_OP_NO_SSLv3
242 { US"no_sslv3", SSL_OP_NO_SSLv3 },
244 #ifdef SSL_OP_NO_TICKET
245 { US"no_ticket", SSL_OP_NO_TICKET },
247 #ifdef SSL_OP_NO_TLSv1
248 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
250 #ifdef SSL_OP_NO_TLSv1_1
251 # if OPENSSL_VERSION_NUMBER < 0x30000000L
252 # if SSL_OP_NO_TLSv1_1 == 0x00000400L
253 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
254 # warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
255 # define NO_SSL_OP_NO_TLSv1_1
258 # ifndef NO_SSL_OP_NO_TLSv1_1
259 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
262 #ifdef SSL_OP_NO_TLSv1_2
263 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
265 #ifdef SSL_OP_NO_TLSv1_3
266 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
268 #ifdef SSL_OP_PRIORITIZE_CHACHA
269 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
271 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
272 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
274 #ifdef SSL_OP_SINGLE_DH_USE
275 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
277 #ifdef SSL_OP_SINGLE_ECDH_USE
278 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
280 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
281 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
283 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
284 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
286 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
287 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
289 #ifdef SSL_OP_TLS_D5_BUG
290 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
292 #ifdef SSL_OP_TLS_ROLLBACK_BUG
293 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
295 #ifdef SSL_OP_TLSEXT_PADDING
296 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
301 static int exim_openssl_options_size = nelem(exim_openssl_options);
302 static long init_options = 0;
311 for (struct exim_openssl_option * o = exim_openssl_options;
312 o < exim_openssl_options + nelem(exim_openssl_options); o++)
314 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
315 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
317 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
318 builtin_macro_create(buf);
321 # ifndef DISABLE_TLS_RESUME
322 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
324 # ifdef SSL_OP_NO_TLSv1_3
325 builtin_macro_create(US"_HAVE_TLS1_3");
327 # ifdef OPENSSL_BAD_SRVR_OURCERT
328 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
330 # ifdef EXIM_HAVE_OCSP
331 builtin_macro_create(US"_HAVE_TLS_OCSP");
332 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
334 # ifdef EXIM_HAVE_ALPN
335 builtin_macro_create(US"_HAVE_TLS_ALPN");
340 /******************************************************************************/
342 /* Structure for collecting random data for seeding. */
344 typedef struct randstuff {
349 /* Local static variables */
351 static BOOL client_verify_callback_called = FALSE;
352 static BOOL server_verify_callback_called = FALSE;
353 static const uschar *sid_ctx = US"exim";
355 /* We have three different contexts to care about.
357 Simple case: client, `client_ctx`
358 As a client, we can be doing a callout or cut-through delivery while receiving
359 a message. So we have a client context, which should have options initialised
360 from the SMTP Transport. We may also concurrently want to make TLS connections
361 to utility daemons, so client-contexts are allocated and passed around in call
362 args rather than using a gobal.
365 There are two cases: with and without ServerNameIndication from the client.
366 Given TLS SNI, we can be using different keys, certs and various other
367 configuration settings, because they're re-expanded with $tls_sni set. This
368 allows vhosting with TLS. This SNI is sent in the handshake.
369 A client might not send SNI, so we need a fallback, and an initial setup too.
370 So as a server, we start out using `server_ctx`.
371 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
372 `server_sni` from `server_ctx` and then initialise settings by re-expanding
380 } exim_openssl_client_tls_ctx;
383 /* static SSL_CTX *server_ctx = NULL; */
384 /* static SSL *server_ssl = NULL; */
386 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
387 static SSL_CTX *server_sni = NULL;
389 #ifdef EXIM_HAVE_ALPN
390 static BOOL server_seen_alpn = FALSE;
393 static char ssl_errstring[256];
395 static int ssl_session_timeout = 7200; /* Two hours */
396 static BOOL client_verify_optional = FALSE;
397 static BOOL server_verify_optional = FALSE;
399 static BOOL reexpand_tls_files_for_sni = FALSE;
402 typedef struct ocsp_resp {
403 struct ocsp_resp * next;
404 OCSP_RESPONSE * resp;
407 typedef struct exim_openssl_state {
408 exim_tlslib_state lib_state;
409 #define lib_ctx libdata0
410 #define lib_ssl libdata1
413 uschar * certificate;
420 const uschar *file_expanded;
421 ocsp_resplist *olist;
422 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
425 X509_STORE *verify_store; /* non-null if status requested */
426 uschar *verify_errstr; /* only if _required */
427 BOOL verify_required;
432 /* these are cached from first expand */
433 uschar * server_cipher_list;
434 /* only passed down to tls_error: */
436 const uschar * verify_cert_hostnames;
437 #ifndef DISABLE_EVENT
438 uschar * event_action;
440 } exim_openssl_state_st;
442 /* should figure out a cleanup of API to handle state preserved per
443 implementation, for various reasons, which can be void * in the APIs.
444 For now, we hack around it. */
445 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
446 exim_openssl_state_st state_server = {.is_server = TRUE};
449 setup_certs(SSL_CTX * sctx, uschar ** certs, uschar * crl, host_item * host,
454 static int tls_server_stapling_cb(SSL *s, void *arg);
455 static void x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk);
456 static void x509_store_dump_cert_s_names(X509_STORE * store);
461 /* Daemon-called, before every connection, key create/rotate */
462 #ifndef DISABLE_TLS_RESUME
463 static void tk_init(void);
464 static int tls_exdata_idx = -1;
468 tls_per_lib_daemon_tick(void)
470 #ifndef DISABLE_TLS_RESUME
475 /* Called once at daemon startup */
478 tls_per_lib_daemon_init(void)
480 tls_daemon_creds_reload();
484 /*************************************************
486 *************************************************/
488 /* Called from lots of places when errors occur before actually starting to do
489 the TLS handshake, that is, while the session is still in clear. Always returns
490 DEFER for a server and FAIL for a client so that most calls can use "return
491 tls_error(...)" to do this processing and then give an appropriate return. A
492 single function is used for both server and client, because it is called from
493 some shared functions.
496 prefix text to include in the logged error
497 host NULL if setting up a server;
498 the connected host if setting up a client
499 msg error message or NULL if we should ask OpenSSL
500 errstr pointer to output error message
502 Returns: OK/DEFER/FAIL
506 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
510 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
511 msg = US ssl_errstring;
514 msg = string_sprintf("(%s): %s", prefix, msg);
515 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
516 if (errstr) *errstr = msg;
517 return host ? FAIL : DEFER;
522 /**************************************************
523 * General library initalisation *
524 **************************************************/
527 lib_rand_init(void * addr)
530 if (!RAND_status()) return TRUE;
532 gettimeofday(&r.tv, NULL);
534 RAND_seed(US (&r), sizeof(r));
535 RAND_seed(US big_buffer, big_buffer_size);
536 if (addr) RAND_seed(US addr, sizeof(addr));
538 return RAND_status();
543 tls_openssl_init(void)
545 static BOOL once = FALSE;
549 #ifdef EXIM_NEED_OPENSSL_INIT
550 SSL_load_error_strings(); /* basic set up */
551 OpenSSL_add_ssl_algorithms();
554 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
555 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
556 list of available digests. */
557 EVP_add_digest(EVP_sha256());
560 (void) lib_rand_init(NULL);
561 (void) tls_openssl_options_parse(openssl_options, &init_options);
566 /*************************************************
567 * Initialize for DH *
568 *************************************************/
570 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
574 sctx The current SSL CTX (inbound or outbound)
575 dhparam DH parameter file or fixed parameter identity string
576 errstr error string pointer
578 Returns: TRUE if OK (nothing to set up, or setup worked)
582 init_dh(SSL_CTX * sctx, uschar * dhparam, uschar ** errstr)
585 #if OPENSSL_VERSION_NUMBER < 0x30000000L
594 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
597 if (!dhexpanded || !*dhexpanded)
598 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
599 else if (dhexpanded[0] == '/')
601 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
603 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
604 NULL, US strerror(errno), errstr);
610 if (Ustrcmp(dhexpanded, "none") == 0)
612 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
616 if (!(pem = std_dh_prime_named(dhexpanded)))
618 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
619 NULL, US strerror(errno), errstr);
622 bio = BIO_new_mem_buf(CS pem, -1);
626 #if OPENSSL_VERSION_NUMBER < 0x30000000L
627 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)
629 pkey = PEM_read_bio_Parameters_ex(bio, NULL, NULL, NULL)
634 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
639 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
640 an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with 2236.
641 But older OpenSSL can only report in bytes (octets), not bits. If someone wants
642 to dance at the edge, then they can raise the limit or use current libraries. */
644 #if OPENSSL_VERSION_NUMBER < 0x30000000L
645 # ifdef EXIM_HAVE_OPENSSL_DH_BITS
646 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
647 This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
648 dh_bitsize = DH_bits(dh);
650 dh_bitsize = 8 * DH_size(dh);
653 dh_bitsize = EVP_PKEY_get_bits(pkey);
656 /* Even if it is larger, we silently return success rather than cause things to
657 fail out, so that a too-large DH will not knock out all TLS; it's a debatable
658 choice. Likewise for a failing attempt to set one. */
660 if (dh_bitsize <= tls_dh_max_bits)
663 #if OPENSSL_VERSION_NUMBER < 0x30000000L
664 SSL_CTX_set_tmp_dh(sctx, dh)
666 SSL_CTX_set0_tmp_dh_pkey(sctx, pkey)
670 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
671 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (D-H param setting '%s'): %s",
672 dhexpanded ? dhexpanded : US"default", ssl_errstring);
673 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
674 /* EVP_PKEY_free(pkey); crashes */
679 debug_printf(" Diffie-Hellman initialized from %s with %d-bit prime\n",
680 dhexpanded ? dhexpanded : US"default", dh_bitsize);
684 debug_printf(" dhparams '%s' %d bits, is > tls_dh_max_bits limit of %d\n",
685 dhexpanded ? dhexpanded : US"default", dh_bitsize, tls_dh_max_bits);
687 #if OPENSSL_VERSION_NUMBER < 0x30000000L
690 /* The EVP_PKEY ownership stays with the ctx; do not free it */
699 /*************************************************
700 * Initialize for ECDH *
701 *************************************************/
703 /* Load parameters for ECDH encryption. Server only.
705 For now, we stick to NIST P-256 because: it's simple and easy to configure;
706 it avoids any patent issues that might bite redistributors; despite events in
707 the news and concerns over curve choices, we're not cryptographers, we're not
708 pretending to be, and this is "good enough" to be better than no support,
709 protecting against most adversaries. Given another year or two, there might
710 be sufficient clarity about a "right" way forward to let us make an informed
711 decision, instead of a knee-jerk reaction.
713 Longer-term, we should look at supporting both various named curves and
714 external files generated with "openssl ecparam", much as we do for init_dh().
715 We should also support "none" as a value, to explicitly avoid initialisation.
720 sctx The current SSL CTX (inbound or outbound)
721 errstr error string pointer
723 Returns: TRUE if OK (nothing to set up, or setup worked)
727 init_ecdh(SSL_CTX * sctx, uschar ** errstr)
729 #ifdef OPENSSL_NO_ECDH
736 # ifndef EXIM_HAVE_ECDH
738 debug_printf(" No OpenSSL API to define ECDH parameters, skipping\n");
742 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
745 /* Is the option deliberately empty? */
747 if (!exp_curve || !*exp_curve)
749 #if OPENSSL_VERSION_NUMBER >= 0x10002000L
750 DEBUG(D_tls) debug_printf( " ECDH OpenSSL 1.0.2+: clearing curves list\n");
751 (void) SSL_CTX_set1_curves(sctx, &nid, 0);
756 /* "auto" needs to be handled carefully.
757 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
758 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
759 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
760 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
761 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
763 if (Ustrcmp(exp_curve, "auto") == 0)
765 #if OPENSSL_VERSION_NUMBER < 0x10002000L
766 DEBUG(D_tls) debug_printf(
767 " ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
768 exp_curve = US"prime256v1";
770 # if defined SSL_CTRL_SET_ECDH_AUTO
771 DEBUG(D_tls) debug_printf(
772 " ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n");
773 SSL_CTX_set_ecdh_auto(sctx, 1);
776 DEBUG(D_tls) debug_printf(
777 " ECDH OpenSSL 1.1.0+: temp key parameter settings: library default selection\n");
783 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
784 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
785 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
789 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
794 # if OPENSSL_VERSION_NUMBER < 0x30000000L
797 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
799 tls_error(US"Unable to create ec curve", NULL, NULL, errstr);
803 /* The "tmp" in the name here refers to setting a temporary key
804 not to the stability of the interface. */
806 if ((rc = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
807 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), NULL, NULL, errstr);
809 DEBUG(D_tls) debug_printf(" ECDH: enabled '%s' curve\n", exp_curve);
813 #else /* v 3.0.0 + */
815 if ((rc = SSL_CTX_set1_groups(sctx, &nid, 1)) == 0)
816 tls_error(string_sprintf("Error enabling '%s' group", exp_curve), NULL, NULL, errstr);
818 DEBUG(D_tls) debug_printf(" ECDH: enabled '%s' group\n", exp_curve);
824 # endif /*EXIM_HAVE_ECDH*/
825 #endif /*OPENSSL_NO_ECDH*/
830 /*************************************************
831 * Expand key and cert file specs *
832 *************************************************/
834 #if OPENSSL_VERSION_NUMBER < 0x30000000L
837 s SSL connection (not used)
841 Returns: pointer to generated key
845 rsa_callback(SSL *s, int export, int keylength)
848 #ifdef EXIM_HAVE_RSA_GENKEY_EX
849 BIGNUM *bn = BN_new();
852 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
854 # ifdef EXIM_HAVE_RSA_GENKEY_EX
855 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
856 || !(rsa_key = RSA_new())
857 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
860 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
864 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
865 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
871 #endif /* pre-3.0.0 */
875 /* Create and install a selfsigned certificate, for use in server mode */
876 /*XXX we could arrange to call this during prelo for a null tls_certificate option.
877 The normal cache inval + relo will suffice.
878 Just need a timer for inval. */
881 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
888 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
889 where = US"allocating pkey";
890 if (!(pkey = EVP_PKEY_new()))
893 where = US"allocating cert";
894 if (!(x509 = X509_new()))
897 where = US"generating pkey";
898 #if OPENSSL_VERSION_NUMBER < 0x30000000L
901 if (!(rsa = rsa_callback(NULL, 0, 2048)))
904 where = US"assigning pkey";
905 if (!EVP_PKEY_assign_RSA(pkey, rsa))
909 pkey = EVP_RSA_gen(2048);
912 X509_set_version(x509, 2); /* N+1 - version 3 */
913 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
914 X509_gmtime_adj(X509_get_notBefore(x509), 0);
915 X509_gmtime_adj(X509_get_notAfter(x509), (long)2 * 60 * 60); /* 2 hour */
916 X509_set_pubkey(x509, pkey);
918 name = X509_get_subject_name(x509);
919 X509_NAME_add_entry_by_txt(name, "C",
920 MBSTRING_ASC, CUS "UK", -1, -1, 0);
921 X509_NAME_add_entry_by_txt(name, "O",
922 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
923 X509_NAME_add_entry_by_txt(name, "CN",
924 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
925 X509_set_issuer_name(x509, name);
927 where = US"signing cert";
928 if (!X509_sign(x509, pkey, EVP_md5()))
931 where = US"installing selfsign cert";
932 if (!SSL_CTX_use_certificate(sctx, x509))
935 where = US"installing selfsign key";
936 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
942 (void) tls_error(where, NULL, NULL, errstr);
943 if (x509) X509_free(x509);
944 if (pkey) EVP_PKEY_free(pkey);
954 /*************************************************
955 * Information callback *
956 *************************************************/
958 /* The SSL library functions call this from time to time to indicate what they
959 are doing. We copy the string to the debugging output when TLS debugging has
971 info_callback(SSL * s, int where, int ret)
977 if (where & SSL_ST_CONNECT) g = string_append_listele(g, ',', US"SSL_connect");
978 if (where & SSL_ST_ACCEPT) g = string_append_listele(g, ',', US"SSL_accept");
979 if (where & SSL_CB_LOOP) g = string_append_listele(g, ',', US"state_chg");
980 if (where & SSL_CB_EXIT) g = string_append_listele(g, ',', US"hshake_exit");
981 if (where & SSL_CB_READ) g = string_append_listele(g, ',', US"read");
982 if (where & SSL_CB_WRITE) g = string_append_listele(g, ',', US"write");
983 if (where & SSL_CB_ALERT) g = string_append_listele(g, ',', US"alert");
984 if (where & SSL_CB_HANDSHAKE_START) g = string_append_listele(g, ',', US"hshake_start");
985 if (where & SSL_CB_HANDSHAKE_DONE) g = string_append_listele(g, ',', US"hshake_done");
987 if (where & SSL_CB_LOOP)
988 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
989 else if (where & SSL_CB_ALERT)
990 debug_printf("SSL %s %s:%s\n", g->s,
991 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
992 else if (where & SSL_CB_EXIT)
995 debug_printf("SSL %s: %s in %s\n", g->s,
996 ret == 0 ? "failed" : "error", SSL_state_string_long(s));
998 else if (where & (SSL_CB_HANDSHAKE_START | SSL_CB_HANDSHAKE_DONE))
999 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
1003 #ifdef OPENSSL_HAVE_KEYLOG_CB
1005 keylog_callback(const SSL *ssl, const char *line)
1009 DEBUG(D_tls) debug_printf("%.200s\n", line);
1010 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
1011 if (!(fp = fopen(filename, "a"))) return;
1012 fprintf(fp, "%s\n", line);
1021 #ifndef DISABLE_EVENT
1023 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
1024 BOOL *calledp, const BOOL *optionalp, const uschar * what)
1030 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
1033 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
1034 old_cert = tlsp->peercert;
1035 tlsp->peercert = X509_dup(cert);
1036 /* NB we do not bother setting peerdn */
1037 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth), &errno)))
1039 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
1040 "depth=%d cert=%s: %s",
1041 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1042 what, depth, dn, yield);
1046 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
1047 return 1; /* reject (leaving peercert set) */
1049 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
1050 "(host in tls_try_verify_hosts)\n");
1051 tlsp->verify_override = TRUE;
1053 X509_free(tlsp->peercert);
1054 tlsp->peercert = old_cert;
1060 /*************************************************
1061 * Callback for verification *
1062 *************************************************/
1064 /* The SSL library does certificate verification if set up to do so. This
1065 callback has the current yes/no state is in "state". If verification succeeded,
1066 we set the certificate-verified flag. If verification failed, what happens
1067 depends on whether the client is required to present a verifiable certificate
1070 If verification is optional, we change the state to yes, but still log the
1071 verification error. For some reason (it really would help to have proper
1072 documentation of OpenSSL), this callback function then gets called again, this
1073 time with state = 1. We must take care not to set the private verified flag on
1074 the second time through.
1076 Note: this function is not called if the client fails to present a certificate
1077 when asked. We get here only if a certificate has been received. Handling of
1078 optional verification for this case is done when requesting SSL to verify, by
1079 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
1081 May be called multiple times for different issues with a certificate, even
1082 for a given "depth" in the certificate chain.
1085 preverify_ok current yes/no state as 1/0
1086 x509ctx certificate information.
1087 tlsp per-direction (client vs. server) support data
1088 calledp has-been-called flag
1089 optionalp verification-is-optional flag
1091 Returns: 0 if verification should fail, otherwise 1
1095 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1096 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1098 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1099 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1102 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1104 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1105 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1106 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1109 dn[sizeof(dn)-1] = '\0';
1111 tlsp->verify_override = FALSE;
1112 if (preverify_ok == 0)
1114 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1115 *verify_mode, sender_host_address)
1117 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1118 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1120 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1124 if (!tlsp->peercert)
1125 tlsp->peercert = X509_dup(cert); /* record failing cert */
1126 return 0; /* reject */
1128 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1129 "tls_try_verify_hosts)\n");
1130 tlsp->verify_override = TRUE;
1133 else if (depth != 0)
1135 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1136 #ifndef DISABLE_EVENT
1137 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1138 return 0; /* reject, with peercert set */
1143 const uschar * verify_cert_hostnames;
1145 if ( tlsp == &tls_out
1146 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1147 /* client, wanting hostname check */
1150 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1151 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1152 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1154 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1155 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1158 const uschar * list = verify_cert_hostnames;
1161 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1162 if ((rc = X509_check_host(cert, CCS name, 0,
1163 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1164 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1169 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1170 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1177 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1180 uschar * extra = verify_mode
1181 ? string_sprintf(" (during %c-verify for [%s])",
1182 *verify_mode, sender_host_address)
1184 log_write(0, LOG_MAIN,
1185 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1186 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1187 extra, dn, verify_cert_hostnames);
1191 if (!tlsp->peercert)
1192 tlsp->peercert = X509_dup(cert); /* record failing cert */
1193 return 0; /* reject */
1195 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1196 "tls_try_verify_hosts)\n");
1197 tlsp->verify_override = TRUE;
1201 #ifndef DISABLE_EVENT
1202 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1203 return 0; /* reject, with peercert set */
1206 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1207 *calledp ? "" : " authenticated", dn);
1211 return 1; /* accept, at least for this level */
1215 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1217 return verify_callback(preverify_ok, x509ctx, &tls_out,
1218 &client_verify_callback_called, &client_verify_optional);
1222 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1224 return verify_callback(preverify_ok, x509ctx, &tls_in,
1225 &server_verify_callback_called, &server_verify_optional);
1231 /* This gets called *by* the dane library verify callback, which interposes
1235 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1237 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1239 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1240 #ifndef DISABLE_EVENT
1241 BOOL dummy_called, optional = FALSE;
1244 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1246 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1247 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1248 deliver_host_address);
1251 dn[sizeof(dn)-1] = '\0';
1253 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1254 preverify_ok ? "ok":"BAD", depth, dn);
1256 #ifndef DISABLE_EVENT
1257 if (verify_event(&tls_out, cert, depth, dn,
1258 &dummy_called, &optional, US"DANE"))
1259 return 0; /* reject, with peercert set */
1262 if (preverify_ok == 1)
1263 tls_out.dane_verified = TRUE;
1266 int err = X509_STORE_CTX_get_error(x509ctx);
1268 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1269 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1272 return preverify_ok;
1275 #endif /*SUPPORT_DANE*/
1278 #ifndef DISABLE_OCSP
1280 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1282 BIO_printf(bp, "\t%s: ", str);
1283 ASN1_GENERALIZEDTIME_print(bp, time);
1287 /*************************************************
1288 * Load OCSP information into state *
1289 *************************************************/
1290 /* Called to load the server OCSP response from the given file into memory, once
1291 caller has determined this is needed. Checks validity. Debugs a message
1294 ASSUMES: single response, for single cert.
1297 state various parts of session state
1298 filename the filename putatively holding an OCSP response
1299 is_pem file is PEM format; otherwise is DER
1303 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1307 OCSP_RESPONSE * resp;
1308 OCSP_BASICRESP * basic_response;
1309 OCSP_SINGLERESP * single_response;
1310 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1311 STACK_OF(X509) * sk;
1312 int status, reason, i;
1315 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1317 if (!filename || !*filename) return;
1320 if (!(bio = BIO_new_file(CS filename, "rb")))
1322 log_write(0, LOG_MAIN|LOG_PANIC,
1323 "Failed to open OCSP response file \"%s\": %.100s",
1324 filename, ERR_reason_error_string(ERR_get_error()));
1330 uschar * data, * freep;
1333 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1335 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
1336 filename, ERR_reason_error_string(ERR_get_error()));
1340 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1341 OPENSSL_free(freep);
1344 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1349 log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
1350 filename, ERR_reason_error_string(ERR_get_error()));
1354 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1356 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1357 OCSP_response_status_str(status), status);
1363 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1364 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1369 if (!(basic_response = OCSP_response_get1_basic(resp)))
1372 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1376 sk = state->u_ocsp.server.verify_stack; /* set by setup_certs() / chain_from_pem_file() */
1378 /* May need to expose ability to adjust those flags?
1379 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1380 OCSP_TRUSTOTHER OCSP_NOINTERN */
1382 /* This does a partial verify (only the signer link, not the whole chain-to-CA)
1383 on the OCSP proof before we load it for serving up; possibly overkill -
1384 just date-checks might be nice enough.
1386 OCSP_basic_verify takes a "store" arg, but does not
1387 use it for the chain verification, when OCSP_NOVERIFY is set.
1388 The content from the wire "basic_response" and a cert-stack "sk" are all
1391 We have a stack, loaded in setup_certs() if tls_verify_certificates
1392 was a file (not a directory, or "system"). It is unfortunate we
1393 cannot used the connection context store, as that would neatly
1394 handle the "system" case too, but there seems to be no library
1395 function for getting a stack from a store.
1396 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1397 [ 3.0.0 - sk = X509_STORE_get1_all_certs(store) ]
1398 We do not free the stack since it could be needed a second time for
1401 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1402 be a public interface into the OpenSSL library (there's no manual entry) -
1403 (in 3.0.0 + is is public)
1404 But what with? We also use OCSP_basic_verify in the client stapling callback.
1405 And there we NEED it; we must verify that status... unless the
1406 library does it for us anyway? */
1408 if ((i = OCSP_basic_verify(basic_response, sk, NULL, OCSP_NOVERIFY)) < 0)
1412 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1413 debug_printf("OCSP response has bad signature: %s\n", US ssl_errstring);
1418 /* Here's the simplifying assumption: there's only one response, for the
1419 one certificate we use, and nothing for anything else in a chain. If this
1420 proves false, we need to extract a cert id from our issued cert
1421 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1422 right cert in the stack and then calls OCSP_single_get0_status()).
1424 I'm hoping to avoid reworking a bunch more of how we handle state here.
1426 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1429 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1432 debug_printf("Unable to get first response from OCSP basic response.\n");
1436 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1437 if (status != V_OCSP_CERTSTATUS_GOOD)
1439 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1440 OCSP_cert_status_str(status), status,
1441 OCSP_crl_reason_str(reason), reason);
1445 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1449 BIO * bp = BIO_new(BIO_s_mem());
1452 time_print(bp, "This OCSP Update", thisupd);
1453 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
1454 if ((len = (int) BIO_get_mem_data(bp, CSS &s)) > 0) debug_printf("%.*s", len, s);
1455 debug_printf("OCSP status invalid times.\n");
1461 /* Add the resp to the list used by tls_server_stapling_cb() */
1463 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1464 while (oentry = *op)
1466 *op = oentry = store_get(sizeof(ocsp_resplist), GET_UNTAINTED);
1467 oentry->next = NULL;
1468 oentry->resp = resp;
1473 if (f.running_in_test_harness)
1475 extern char ** environ;
1476 if (environ) for (uschar ** p = USS environ; *p; p++)
1477 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1479 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1480 goto supply_response;
1488 ocsp_free_response_list(exim_openssl_state_st * state)
1490 for (ocsp_resplist * olist = state->u_ocsp.server.olist; olist;
1491 olist = olist->next)
1492 OCSP_RESPONSE_free(olist->resp);
1493 state->u_ocsp.server.olist = NULL;
1495 #endif /*!DISABLE_OCSP*/
1502 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1505 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1506 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1507 return tls_error(string_sprintf(
1508 "SSL_CTX_use_certificate_chain_file file=%s", file),
1509 cbinfo->host, NULL, errstr);
1514 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1517 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1518 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1519 return tls_error(string_sprintf(
1520 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1527 /* Called once during tls_init and possibly again during TLS setup, for a
1528 new context, if Server Name Indication was used and tls_sni was seen in
1529 the certificate string.
1532 sctx the SSL_CTX* to update
1533 state various parts of session state
1534 errstr error string pointer
1536 Returns: OK/DEFER/FAIL
1540 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1545 if (!state->certificate)
1547 if (!state->is_server) /* client */
1550 if (tls_install_selfsign(sctx, errstr) != OK)
1557 if ( !reexpand_tls_files_for_sni
1558 && ( Ustrstr(state->certificate, US"tls_sni")
1559 || Ustrstr(state->certificate, US"tls_in_sni")
1560 || Ustrstr(state->certificate, US"tls_out_sni")
1562 reexpand_tls_files_for_sni = TRUE;
1564 if ( !expand_check(state->certificate, US"tls_certificate", &expanded, errstr)
1565 || f.expand_string_forcedfail)
1567 if (f.expand_string_forcedfail)
1568 *errstr = US"expansion of tls_certificate failed";
1573 if (state->is_server)
1575 const uschar * file_list = expanded;
1578 #ifndef DISABLE_OCSP
1579 const uschar * olist = state->u_ocsp.server.file;
1582 BOOL fmt_pem = FALSE;
1585 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1587 if (olist && !*olist)
1590 /* If doing a re-expand after SNI, avoid reloading the OCSP
1591 responses when the list of filenames has not changed.
1592 The creds-invali on content change wipes file_expanded, so that
1593 always reloads here. */
1595 if ( state->u_ocsp.server.file_expanded && olist
1596 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1598 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1603 ocsp_free_response_list(state);
1604 state->u_ocsp.server.file_expanded = olist;
1608 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1610 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1613 #ifndef DISABLE_OCSP
1615 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1617 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1622 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1627 ocsp_load_response(state, ofile, fmt_pem);
1630 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1634 else /* would there ever be a need for multiple client certs? */
1635 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1638 if ( state->privatekey
1639 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr)
1640 || f.expand_string_forcedfail)
1642 if (f.expand_string_forcedfail)
1643 *errstr = US"expansion of tls_privatekey failed";
1647 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1648 of the expansion is an empty string, ignore it also, and assume the private
1649 key is in the same file as the certificate. */
1651 if (expanded && *expanded)
1652 if (state->is_server)
1654 const uschar * file_list = expanded;
1658 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1659 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1662 else /* would there ever be a need for multiple client certs? */
1663 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1673 /**************************************************
1674 * One-time init credentials for server and client *
1675 **************************************************/
1678 normalise_ciphers(uschar ** ciphers, const uschar * pre_expansion_ciphers)
1680 uschar * s = *ciphers;
1682 if (!s || !Ustrchr(s, '_')) return; /* no change needed */
1684 if (s == pre_expansion_ciphers)
1685 s = string_copy(s); /* get writable copy */
1687 for (uschar * t = s; *t; t++) if (*t == '_') *t = '-';
1692 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1693 uschar * ciphers, uschar ** errstr)
1695 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1696 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1697 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1698 state->server_cipher_list = ciphers;
1705 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1708 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1709 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1711 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1713 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1715 /* Set up the information callback, which outputs if debugging is at a suitable
1720 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1721 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1722 /* this needs a debug build of OpenSSL */
1723 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
1725 #ifdef OPENSSL_HAVE_KEYLOG_CB
1726 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
1730 /* Automatically re-try reads/writes after renegotiation. */
1731 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1738 tls_server_creds_init(void)
1741 uschar * dummy_errstr;
1742 unsigned lifetime = 0;
1746 state_server.lib_state = null_tls_preload;
1748 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1750 state_server.lib_state.lib_ctx = ctx;
1752 /* Preload DH params and EC curve */
1754 if (opt_unset_or_noexpand(tls_dhparam))
1756 DEBUG(D_tls) debug_printf("TLS: preloading DH params '%s' for server\n", tls_dhparam);
1757 if (init_dh(ctx, tls_dhparam, &dummy_errstr))
1758 state_server.lib_state.dh = TRUE;
1761 DEBUG(D_tls) debug_printf("TLS: not preloading DH params for server\n");
1762 if (opt_unset_or_noexpand(tls_eccurve))
1764 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve '%s' for server\n", tls_eccurve);
1765 if (init_ecdh(ctx, &dummy_errstr))
1766 state_server.lib_state.ecdh = TRUE;
1769 DEBUG(D_tls) debug_printf("TLS: not preloading ECDH curve for server\n");
1771 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1772 /* If we can, preload the Authorities for checking client certs against.
1773 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1774 at TLS conn startup.
1775 Do this before the server ocsp so that its info can verify the ocsp. */
1777 if ( opt_set_and_noexpand(tls_verify_certificates)
1778 && opt_unset_or_noexpand(tls_crl))
1780 /* Watch the default dir also as they are always included */
1782 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1783 && tls_set_watch(tls_verify_certificates, FALSE)
1784 && tls_set_watch(tls_crl, FALSE))
1786 uschar * v_certs = tls_verify_certificates;
1787 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1789 if (setup_certs(ctx, &v_certs, tls_crl, NULL, &dummy_errstr) == OK)
1790 state_server.lib_state.cabundle = TRUE;
1792 /* If we can, preload the server-side cert, key and ocsp */
1794 if ( opt_set_and_noexpand(tls_certificate)
1795 # ifndef DISABLE_OCSP
1796 && opt_unset_or_noexpand(tls_ocsp_file)
1798 && opt_unset_or_noexpand(tls_privatekey))
1800 /* Set watches on the filenames. The implementation does de-duplication
1801 so we can just blindly do them all. */
1803 if ( tls_set_watch(tls_certificate, TRUE)
1804 # ifndef DISABLE_OCSP
1805 && tls_set_watch(tls_ocsp_file, TRUE)
1807 && tls_set_watch(tls_privatekey, TRUE))
1809 state_server.certificate = tls_certificate;
1810 state_server.privatekey = tls_privatekey;
1811 #ifndef DISABLE_OCSP
1812 state_server.u_ocsp.server.file = tls_ocsp_file;
1815 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1816 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1817 state_server.lib_state.conn_certs = TRUE;
1820 else if ( !tls_certificate && !tls_privatekey
1821 # ifndef DISABLE_OCSP
1825 { /* Generate & preload a selfsigned cert. No files to watch. */
1826 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1828 state_server.lib_state.conn_certs = TRUE;
1829 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1833 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1837 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1840 #endif /* EXIM_HAVE_INOTIFY */
1843 /* If we can, preload the ciphers control string */
1845 if (opt_set_and_noexpand(tls_require_ciphers))
1847 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1848 normalise_ciphers(&tls_require_ciphers, tls_require_ciphers);
1849 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1850 &dummy_errstr) == OK)
1851 state_server.lib_state.pri_string = TRUE;
1854 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1861 /* Preload whatever creds are static, onto a transport. The client can then
1862 just copy the pointer as it starts up.
1863 Called from the daemon after a cache-invalidate with watch set; called from
1864 a queue-run startup with watch clear. */
1867 tls_client_creds_init(transport_instance * t, BOOL watch)
1869 smtp_transport_options_block * ob = t->options_block;
1870 exim_openssl_state_st tpt_dummy_state;
1871 host_item * dummy_host = (host_item *)1;
1872 uschar * dummy_errstr;
1877 ob->tls_preload = null_tls_preload;
1878 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1880 ob->tls_preload.lib_ctx = ctx;
1882 tpt_dummy_state.lib_state = ob->tls_preload;
1884 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1885 if ( opt_set_and_noexpand(ob->tls_certificate)
1886 && opt_unset_or_noexpand(ob->tls_privatekey))
1889 || ( tls_set_watch(ob->tls_certificate, FALSE)
1890 && tls_set_watch(ob->tls_privatekey, FALSE)
1893 uschar * pkey = ob->tls_privatekey;
1896 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1898 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1900 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1901 pkey ? pkey : ob->tls_certificate,
1904 ob->tls_preload.conn_certs = TRUE;
1909 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1912 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1913 && opt_unset_or_noexpand(ob->tls_crl))
1916 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1917 && tls_set_watch(ob->tls_verify_certificates, FALSE)
1918 && tls_set_watch(ob->tls_crl, FALSE)
1921 uschar * v_certs = ob->tls_verify_certificates;
1923 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1925 if (setup_certs(ctx, &v_certs,
1926 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
1927 ob->tls_preload.cabundle = TRUE;
1932 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1934 #endif /*EXIM_HAVE_INOTIFY*/
1938 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1939 /* Invalidate the creds cached, by dropping the current ones.
1940 Call when we notice one of the source files has changed. */
1943 tls_server_creds_invalidate(void)
1945 SSL_CTX_free(state_server.lib_state.lib_ctx);
1946 state_server.lib_state = null_tls_preload;
1947 #ifndef DISABLE_OCSP
1948 state_server.u_ocsp.server.file_expanded = NULL;
1954 tls_client_creds_invalidate(transport_instance * t)
1956 smtp_transport_options_block * ob = t->options_block;
1957 SSL_CTX_free(ob->tls_preload.lib_ctx);
1958 ob->tls_preload = null_tls_preload;
1964 tls_server_creds_invalidate(void)
1968 tls_client_creds_invalidate(transport_instance * t)
1971 #endif /*EXIM_HAVE_INOTIFY*/
1976 #ifndef DISABLE_OCSP
1978 debug_print_sn(const X509 * cert)
1980 X509_NAME * sn = X509_get_subject_name((X509 *)cert);
1981 static uschar name[256];
1982 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
1984 name[sizeof(name)-1] = '\0';
1985 debug_printf(" %s\n", name);
1990 x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk)
1993 debug_printf(" (null)\n");
1996 int idx = sk_X509_num(sk);
1998 debug_printf(" (empty)\n");
2000 while (--idx >= 0) debug_print_sn(sk_X509_value(sk, idx));
2005 x509_store_dump_cert_s_names(X509_STORE * store)
2007 # ifdef EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
2009 debug_printf(" (no store)\n");
2012 STACK_OF(X509) * sk = X509_STORE_get1_all_certs(store);
2013 x509_stack_dump_cert_s_names(sk);
2014 sk_X509_pop_free(sk, X509_free);
2018 #endif /*!DISABLE_OCSP*/
2023 #ifndef DISABLE_TLS_RESUME
2024 /* Manage the keysets used for encrypting the session tickets, on the server. */
2026 typedef struct { /* Session ticket encryption key */
2029 const EVP_CIPHER * aes_cipher;
2030 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
2031 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2032 const EVP_MD * hmac_hash;
2034 const uschar * hmac_hashname;
2036 uschar hmac_key[16];
2041 static exim_stek exim_tk; /* current key */
2042 static exim_stek exim_tk_old; /* previous key */
2047 time_t t = time(NULL);
2049 if (exim_tk.name[0])
2051 if (exim_tk.renew >= t) return;
2052 exim_tk_old = exim_tk;
2055 if (f.running_in_test_harness) ssl_session_timeout = TESTSUITE_TICKET_LIFE;
2057 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
2058 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
2059 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
2060 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
2062 exim_tk.name[0] = 'E';
2063 exim_tk.aes_cipher = EVP_aes_256_cbc();
2064 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2065 exim_tk.hmac_hash = EVP_sha256();
2067 exim_tk.hmac_hashname = US "sha256";
2069 exim_tk.expire = t + ssl_session_timeout;
2070 exim_tk.renew = t + ssl_session_timeout/2;
2076 if (!exim_tk.name[0]) return NULL;
2081 tk_find(const uschar * name)
2083 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
2084 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
2091 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2099 /*XXX will want these dependent on the ssl session strength */
2100 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2101 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2102 key->hmac_hash, NULL);
2105 OSSL_PARAM params[3];
2106 uschar * hk = string_copy(key->hmac_hashname); /* need nonconst */
2107 params[0] = OSSL_PARAM_construct_octet_string("key", key->hmac_key, sizeof(key->hmac_key));
2108 params[1] = OSSL_PARAM_construct_utf8_string("digest", CS hk, 0);
2109 params[2] = OSSL_PARAM_construct_end();
2110 if (EVP_MAC_CTX_set_params(hctx, params) == 0)
2112 DEBUG(D_tls) debug_printf("EVP_MAC_CTX_set_params: %s\n",
2113 ERR_reason_error_string(ERR_get_error()));
2114 return 0; /* error in mac initialisation */
2121 /* Callback for session tickets, on server */
2123 ticket_key_callback(SSL * ssl, uschar key_name[16],
2124 uschar * iv, EVP_CIPHER_CTX * c_ctx,
2125 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2132 tls_support * tlsp = state_server.tlsp;
2137 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
2138 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2140 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
2141 return -1; /* insufficient random */
2143 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
2144 return 0; /* key couldn't be created */
2145 memcpy(key_name, key->name, 16);
2146 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
2148 if (tk_hmac_init(hctx, key) == 0) return 0;
2149 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2151 DEBUG(D_tls) debug_printf("ticket created\n");
2156 time_t now = time(NULL);
2158 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
2159 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2161 if (!(key = tk_find(key_name)) || key->expire < now)
2165 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
2166 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
2171 if (tk_hmac_init(hctx, key) == 0) return 0;
2172 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2174 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2176 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2177 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2178 be better. To do that we'd have to encode ticket lifetime in the name as
2179 we don't yet see the restored session. Could check posthandshake for TLS1.3
2180 and trigger a new ticket then, but cannot do that for TLS1.2 */
2181 return key->renew < now ? 2 : 1;
2184 #endif /* !DISABLE_TLS_RESUME */
2189 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2190 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2192 /* If verification is optional, don't fail if no certificate */
2194 SSL_CTX_set_verify(ctx,
2195 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2200 /*************************************************
2201 * Callback to handle SNI *
2202 *************************************************/
2204 /* Called when acting as server during the TLS session setup if a Server Name
2205 Indication extension was sent by the client.
2207 API documentation is OpenSSL s_server.c implementation.
2210 s SSL* of the current session
2211 ad unknown (part of OpenSSL API) (unused)
2212 arg Callback of "our" registered data
2214 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2216 XXX might need to change to using ClientHello callback,
2217 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2220 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2222 tls_servername_cb(SSL * s, int * ad ARG_UNUSED, void * arg)
2224 const char * servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2225 exim_openssl_state_st * state = (exim_openssl_state_st *) arg;
2227 int old_pool = store_pool;
2231 return SSL_TLSEXT_ERR_OK;
2233 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2234 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2236 /* Make the extension value available for expansion */
2237 store_pool = POOL_PERM;
2238 tls_in.sni = string_copy_taint(US servername, GET_TAINTED);
2239 store_pool = old_pool;
2241 if (!reexpand_tls_files_for_sni)
2242 return SSL_TLSEXT_ERR_OK;
2244 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2245 not confident that memcpy wouldn't break some internal reference counting.
2246 Especially since there's a references struct member, which would be off. */
2248 if (lib_ctx_new(&server_sni, NULL, &errstr) != OK)
2251 /* Not sure how many of these are actually needed, since SSL object
2252 already exists. Might even need this selfsame callback, for reneg? */
2255 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2256 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2257 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2258 #ifdef OPENSSL_MIN_PROTO_VERSION
2259 SSL_CTX_set_min_proto_version(server_sni, SSL3_VERSION);
2261 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2262 SSL_CTX_clear_options(server_sni, ~SSL_CTX_get_options(ctx));
2263 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2264 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2265 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2268 if ( !init_dh(server_sni, state->dhparam, &errstr)
2269 || !init_ecdh(server_sni, &errstr)
2273 if ( state->server_cipher_list
2274 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2277 #ifndef DISABLE_OCSP
2278 if (state->u_ocsp.server.file)
2280 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2281 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2286 uschar * v_certs = tls_verify_certificates;
2287 if ((rc = setup_certs(server_sni, &v_certs, tls_crl, NULL,
2291 if (v_certs && *v_certs)
2292 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2295 /* do this after setup_certs, because this can require the certs for verifying
2296 OCSP information. */
2297 if ((rc = tls_expand_session_files(server_sni, state, &errstr)) != OK)
2300 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2301 SSL_set_SSL_CTX(s, server_sni);
2302 return SSL_TLSEXT_ERR_OK;
2305 log_write(0, LOG_MAIN|LOG_PANIC, "%s", errstr);
2306 return SSL_TLSEXT_ERR_ALERT_FATAL;
2308 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2313 #ifdef EXIM_HAVE_ALPN
2314 /*************************************************
2315 * Callback to handle ALPN *
2316 *************************************************/
2318 /* Called on server if tls_alpn nonblank after expansion,
2319 when client offers ALPN, after the SNI callback.
2320 If set and not matching the list then we dump the connection */
2323 tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen,
2324 const uschar * in, unsigned int inlen, void * arg)
2326 server_seen_alpn = TRUE;
2329 debug_printf("Received TLS ALPN offer:");
2330 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2333 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2334 debug_printf(" '%.*s'", siz, in + pos + 1);
2336 debug_printf(". Our list: '%s'\n", tls_alpn);
2339 /* Look for an acceptable ALPN */
2341 if ( inlen > 1 /* at least one name */
2342 && in[0]+1 == inlen /* filling the vector, so exactly one name */
2345 const uschar * list = tls_alpn;
2347 for (uschar * name; name = string_nextinlist(&list, &sep, NULL, 0); )
2348 if (Ustrncmp(in+1, name, in[0]) == 0)
2350 *out = in+1; /* we checked for exactly one, so can just point to it */
2352 return SSL_TLSEXT_ERR_OK; /* use ALPN */
2356 /* More than one name from clilent, or name did not match our list. */
2358 /* This will be fatal to the TLS conn; would be nice to kill TCP also.
2359 Maybe as an option in future; for now leave control to the config (must-tls). */
2361 DEBUG(D_tls) debug_printf("TLS ALPN rejected\n");
2362 return SSL_TLSEXT_ERR_ALERT_FATAL;
2364 #endif /* EXIM_HAVE_ALPN */
2368 #ifndef DISABLE_OCSP
2370 /*************************************************
2371 * Callback to handle OCSP Stapling *
2372 *************************************************/
2374 /* Called when acting as server during the TLS session setup if the client
2375 requests OCSP information with a Certificate Status Request.
2377 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2383 tls_server_stapling_cb(SSL *s, void *arg)
2385 const exim_openssl_state_st * state = arg;
2386 ocsp_resplist * olist = state->u_ocsp.server.olist;
2387 uschar * response_der; /*XXX blob */
2388 int response_der_len;
2391 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2392 olist ? "have" : "lack");
2394 tls_in.ocsp = OCSP_NOT_RESP;
2396 return SSL_TLSEXT_ERR_NOACK;
2398 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
2400 const X509 * cert_sent = SSL_get_certificate(s);
2401 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2402 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2404 for (; olist; olist = olist->next)
2406 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2407 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2408 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2409 ASN1_INTEGER * res_cert_serial;
2410 const BIGNUM * resp_bn;
2411 ASN1_OCTET_STRING * res_cert_iNameHash;
2414 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2415 (OCSP_CERTID *) cid);
2416 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2420 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2421 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2424 if (BN_cmp(cert_bn, resp_bn) == 0)
2426 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2428 /*XXX TODO: check the rest of the list for duplicate matches.
2429 If any, need to also check the Issuer Name hash.
2430 Without this, we will provide the wrong status in the case of
2435 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2439 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2440 return SSL_TLSEXT_ERR_NOACK;
2446 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2447 return SSL_TLSEXT_ERR_NOACK;
2451 /*XXX could we do the i2d earlier, rather than during the callback? */
2452 response_der = NULL;
2453 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2454 if (response_der_len <= 0)
2455 return SSL_TLSEXT_ERR_NOACK;
2457 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2458 response_der, response_der_len);
2459 tls_in.ocsp = OCSP_VFIED;
2460 return SSL_TLSEXT_ERR_OK;
2465 add_chain_to_store(X509_STORE * store, STACK_OF(X509) * sk,
2466 const char * debug_text)
2472 debug_printf("chain for %s:\n", debug_text);
2473 x509_stack_dump_cert_s_names(sk);
2476 if ((idx = sk_X509_num(sk)) > 0)
2478 X509_STORE_add_cert(store, sk_X509_value(sk, idx));
2483 tls_client_stapling_cb(SSL * ssl, void * arg)
2485 exim_openssl_state_st * cbinfo = arg;
2486 const unsigned char * p;
2488 OCSP_RESPONSE * rsp;
2489 OCSP_BASICRESP * bs;
2492 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2493 len = SSL_get_tlsext_status_ocsp_resp(ssl, &p);
2495 { /* Expect this when we requested ocsp but got none */
2496 if (SSL_session_reused(ssl) && tls_out.ocsp == OCSP_VFIED)
2498 DEBUG(D_tls) debug_printf(" null, but resumed; ocsp vfy stored with session is good\n");
2502 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2503 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2505 DEBUG(D_tls) debug_printf(" null\n");
2507 if (!cbinfo->u_ocsp.client.verify_required)
2509 cbinfo->u_ocsp.client.verify_errstr =
2510 US"(SSL_connect) Required TLS certificate status not received";
2514 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2516 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2517 if (LOGGING(tls_cipher))
2518 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2520 DEBUG(D_tls) debug_printf(" parse error\n");
2524 if (!(bs = OCSP_response_get1_basic(rsp)))
2526 tls_out.ocsp = OCSP_FAILED;
2527 if (LOGGING(tls_cipher))
2528 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2530 DEBUG(D_tls) debug_printf(" error parsing response\n");
2531 OCSP_RESPONSE_free(rsp);
2535 /* We'd check the nonce here if we'd put one in the request. */
2536 /* However that would defeat cacheability on the server so we don't. */
2538 /* This section of code reworked from OpenSSL apps source;
2539 The OpenSSL Project retains copyright:
2540 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2544 X509_STORE * verify_store = NULL;
2545 BOOL have_verified_OCSP_signer = FALSE;
2546 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2547 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2550 DEBUG(D_tls) bp = BIO_new(BIO_s_mem());
2552 /* Use the CA & chain that verified the server cert to verify the stapled info */
2553 /*XXX could we do an event here, for observability of ocsp? What reasonable data could we give access to? */
2554 /* Dates would be a start. Do we need another opaque variable type, as for certs, plus an extract expansion? */
2557 /* If this routine is not available, we've avoided [in tls_client_start()]
2558 asking for certificate-status under DANE, so this callback won't run for
2559 that combination. It still will for non-DANE. */
2561 #ifdef EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER
2564 if ( tls_out.dane_verified
2565 && (have_verified_OCSP_signer =
2566 OCSP_resp_get0_signer(bs, &signer, SSL_get0_verified_chain(ssl)) == 1))
2569 debug_printf("signer for OCSP basicres is in the verified chain;"
2570 " shortcut its verification\n");
2575 STACK_OF(X509) * verified_chain;
2577 verify_store = X509_STORE_new();
2579 SSL_get0_chain_certs(ssl, &verified_chain);
2580 add_chain_to_store(verify_store, verified_chain,
2581 "'current cert' per SSL_get0_chain_certs()");
2582 #ifdef EXIM_HAVE_SSL_GET0_VERIFIED_CHAIN
2583 verified_chain = SSL_get0_verified_chain(ssl);
2584 add_chain_to_store(verify_store, verified_chain,
2585 "SSL_get0_verified_chain()");
2592 debug_printf("Untrusted intermediate cert stack (from SSL_get_peer_cert_chain()):\n");
2593 x509_stack_dump_cert_s_names(SSL_get_peer_cert_chain(ssl));
2595 debug_printf("will use this CA store for verifying basicresp:\n");
2596 x509_store_dump_cert_s_names(verify_store);
2598 /* OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2600 debug_printf("certs contained in basicresp:\n");
2601 x509_stack_dump_cert_s_names(
2602 #ifdef EXIM_HAVE_OPESSL_OCSP_RESP_GET0_CERTS
2603 OCSP_resp_get0_certs(bs)
2609 #ifdef EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
2610 /* could do via X509_STORE_get0_objects(); not worth it just for debug info */
2613 if (OCSP_resp_get0_signer(bs, &signer, X509_STORE_get1_all_certs(verify_store)) == 1)
2615 debug_printf("found signer for basicres:\n");
2616 debug_print_sn(signer);
2620 debug_printf("failed to find signer for basicres:\n");
2621 ERR_print_errors(bp);
2630 /* Under DANE the trust-anchor (at least in TA mode) is indicated by the TLSA
2631 record in DNS, and probably is not the root of the chain of certificates. So
2632 accept a partial chain for that case (and hope that anchor is visible for
2633 verifying the OCSP stapling).
2634 XXX for EE mode it won't even be that. Does that make OCSP useless for EE?
2636 Worse, for LetsEncrypt-mode (ocsp signer is leaf-signer) under DANE, the
2637 data used within OpenSSL for the signer has nil pointers for signing
2638 algorithms - and a crash results. Avoid this by shortcutting verification,
2639 having determined that the OCSP signer is in the (DANE-)validated set.
2642 #ifndef OCSP_PARTIAL_CHAIN /* defined for 3.0.0 onwards */
2643 # define OCSP_PARTIAL_CHAIN 0
2646 if ((i = OCSP_basic_verify(bs, SSL_get_peer_cert_chain(ssl),
2649 tls_out.dane_verified
2650 ? have_verified_OCSP_signer
2651 ? OCSP_NOVERIFY | OCSP_NOEXPLICIT
2652 : OCSP_PARTIAL_CHAIN | OCSP_NOEXPLICIT
2655 OCSP_NOEXPLICIT)) <= 0)
2657 DEBUG(D_tls) debug_printf("OCSP_basic_verify() fail: returned %d\n", i);
2658 if (ERR_peek_error())
2660 tls_out.ocsp = OCSP_FAILED;
2661 if (LOGGING(tls_cipher))
2663 static uschar peerdn[256];
2664 const uschar * errstr;;
2666 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
2667 ERR_peek_error_all(NULL, NULL, NULL, CCSS &errstr, NULL);
2670 errstr = CUS ERR_reason_error_string(ERR_peek_error());
2672 X509_NAME_oneline(X509_get_subject_name(SSL_get_peer_certificate(ssl)),
2673 CS peerdn, sizeof(peerdn));
2674 log_write(0, LOG_MAIN,
2675 "[%s] %s Received TLS cert (DN: '%.*s') status response, "
2676 "itself unverifiable: %s",
2677 deliver_host_address, deliver_host,
2678 (int)sizeof(peerdn), peerdn, errstr);
2682 BIO_printf(bp, "OCSP response verify failure\n");
2683 ERR_print_errors(bp);
2686 int len = (int) BIO_get_mem_data(bp, CSS &s);
2687 if (len > 0) debug_printf("%.*s", len, s);
2690 OCSP_RESPONSE_print(bp, rsp, 0);
2695 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2696 " in the root CA certificate; ignoring\n");
2699 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2701 /*XXX So we have a good stapled OCSP status. How do we know
2702 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2703 OCSP_resp_find_status() which matches on a cert id, which presumably
2704 we should use. Making an id needs OCSP_cert_id_new(), which takes
2705 issuerName, issuerKey, serialNumber. Are they all in the cert?
2707 For now, carry on blindly accepting the resp. */
2710 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2711 OCSP_resp_count(bs) - 1;
2713 sk_OCSP_SINGLERESP_num(sresp) - 1;
2717 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2719 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2721 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2722 - but what happens with a GnuTLS-style input?
2724 we could do with a debug label for each singleresp
2725 - it has a certID with a serialNumber, but I see no API to get that
2727 status = OCSP_single_get0_status(single, &reason, &rev,
2728 &thisupd, &nextupd);
2732 time_print(bp, "This OCSP Update", thisupd);
2733 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
2735 if (!OCSP_check_validity(thisupd, nextupd,
2736 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2738 tls_out.ocsp = OCSP_FAILED;
2739 DEBUG(D_tls) ERR_print_errors(bp);
2740 cbinfo->u_ocsp.client.verify_errstr =
2741 US"(SSL_connect) Server certificate status is out-of-date";
2742 log_write(0, LOG_MAIN, "OCSP dates invalid");
2746 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2747 OCSP_cert_status_str(status));
2750 case V_OCSP_CERTSTATUS_GOOD:
2751 continue; /* the idx loop */
2752 case V_OCSP_CERTSTATUS_REVOKED:
2753 cbinfo->u_ocsp.client.verify_errstr =
2754 US"(SSL_connect) Server certificate revoked";
2755 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2756 reason != -1 ? "; reason: " : "",
2757 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2758 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2761 cbinfo->u_ocsp.client.verify_errstr =
2762 US"(SSL_connect) Server certificate has unknown status";
2763 log_write(0, LOG_MAIN,
2764 "Server certificate status unknown, in OCSP stapling");
2772 tls_out.ocsp = OCSP_VFIED;
2776 tls_out.ocsp = OCSP_FAILED;
2777 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2781 int len = (int) BIO_get_mem_data(bp, CSS &s);
2782 if (len > 0) debug_printf("%.*s", len, s);
2787 OCSP_RESPONSE_free(rsp);
2790 #endif /*!DISABLE_OCSP*/
2793 /*************************************************
2794 * Initialize for TLS *
2795 *************************************************/
2796 /* Called from both server and client code, to do preliminary initialization
2797 of the library. We allocate and return a context structure.
2800 host connected host, if client; NULL if server
2801 ob transport options block, if client; NULL if server
2802 ocsp_file file of stapling info (server); flag for require ocsp (client)
2803 addr address if client; NULL if server (for some randomness)
2804 caller_state place to put pointer to allocated state-struct
2805 errstr error string pointer
2807 Returns: OK/DEFER/FAIL
2811 tls_init(host_item * host, smtp_transport_options_block * ob,
2812 #ifndef DISABLE_OCSP
2815 address_item *addr, exim_openssl_state_st ** caller_state,
2816 tls_support * tlsp, uschar ** errstr)
2819 exim_openssl_state_st * state;
2822 if (host) /* client */
2824 state = store_malloc(sizeof(exim_openssl_state_st));
2825 memset(state, 0, sizeof(*state));
2826 state->certificate = ob->tls_certificate;
2827 state->privatekey = ob->tls_privatekey;
2828 state->is_server = FALSE;
2829 state->dhparam = NULL;
2830 state->lib_state = ob->tls_preload;
2834 state = &state_server;
2835 state->certificate = tls_certificate;
2836 state->privatekey = tls_privatekey;
2837 state->is_server = TRUE;
2838 state->dhparam = tls_dhparam;
2839 state->lib_state = state_server.lib_state;
2845 if (!state->lib_state.pri_string)
2846 state->server_cipher_list = NULL;
2848 #ifndef DISABLE_EVENT
2849 state->event_action = NULL;
2854 /* It turns out that we need to seed the random number generator this early in
2855 order to get the full complement of ciphers to work. It took me roughly a day
2856 of work to discover this by experiment.
2858 On systems that have /dev/urandom, SSL may automatically seed itself from
2859 there. Otherwise, we have to make something up as best we can. Double check
2862 Although we likely called this before, at daemon startup, this is a chance
2863 to mix in further variable info (time, pid) if needed. */
2865 if (!lib_rand_init(addr))
2866 return tls_error(US"RAND_status", host,
2867 US"unable to seed random number generator", errstr);
2869 /* Apply administrator-supplied work-arounds.
2870 Historically we applied just one requested option,
2871 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2872 moved to an administrator-controlled list of options to specify and
2873 grandfathered in the first one as the default value for "openssl_options".
2875 No OpenSSL version number checks: the options we accept depend upon the
2876 availability of the option value macros from OpenSSL. */
2879 if (!tls_openssl_options_parse(openssl_options, &init_options))
2880 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2882 /* Create a context.
2883 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2884 negotiation in the different methods; as far as I can tell, the only
2885 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2886 when OpenSSL is built without SSLv2 support.
2887 By disabling with openssl_options, we can let admins re-enable with the
2890 if (!(ctx = state->lib_state.lib_ctx))
2892 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2894 state->lib_state.lib_ctx = ctx;
2897 #ifndef DISABLE_TLS_RESUME
2898 tlsp->resumption = RESUME_SUPPORTED;
2902 #ifndef DISABLE_TLS_RESUME
2903 /* Should the server offer session resumption? */
2904 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2906 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2907 init_options &= ~SSL_OP_NO_TICKET;
2908 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2909 tlsp->host_resumable = TRUE;
2913 #ifdef OPENSSL_MIN_PROTO_VERSION
2914 SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
2916 DEBUG(D_tls) debug_printf("setting SSL CTX options: %016lx\n", init_options);
2917 SSL_CTX_set_options(ctx, init_options);
2919 uint64_t readback = SSL_CTX_clear_options(ctx, ~init_options);
2920 if (readback != init_options)
2921 return tls_error(string_sprintf(
2922 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2926 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2928 /* We'd like to disable session cache unconditionally, but foolish Outlook
2929 Express clients then give up the first TLS connection and make a second one
2930 (which works). Only when there is an IMAP service on the same machine.
2931 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2932 now, until we work out a decent way of presenting control to the config. It
2933 will never be used because we use a new context every time. */
2935 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2938 /* Initialize with DH parameters if supplied */
2939 /* Initialize ECDH temp key parameter selection */
2943 if (state->lib_state.dh)
2944 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2946 if (!init_dh(ctx, state->dhparam, errstr)) return DEFER;
2948 if (state->lib_state.ecdh)
2949 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
2951 if (!init_ecdh(ctx, errstr)) return DEFER;
2954 /* Set up certificate and key (and perhaps OCSP info) */
2956 if (state->lib_state.conn_certs)
2959 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
2963 #ifndef DISABLE_OCSP
2964 if (!host) /* server */
2966 state->u_ocsp.server.file = ocsp_file;
2967 state->u_ocsp.server.file_expanded = NULL;
2968 state->u_ocsp.server.olist = NULL;
2971 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
2974 /* If we need to handle SNI or OCSP, do so */
2976 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2977 # ifndef DISABLE_OCSP
2978 if (!host && !(state->u_ocsp.server.verify_stack = sk_X509_new_null()))
2980 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2985 if (!host) /* server */
2987 # ifndef DISABLE_OCSP
2988 /* We check u_ocsp.server.file, not server.olist, because we care about if
2989 the option exists, not what the current expansion might be, as SNI might
2990 change the certificate and OCSP file in use between now and the time the
2991 callback is invoked. */
2992 if (state->u_ocsp.server.file)
2994 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2995 SSL_CTX_set_tlsext_status_arg(ctx, state);
2998 /* We always do this, so that $tls_sni is available even if not used in
3000 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
3001 SSL_CTX_set_tlsext_servername_arg(ctx, state);
3003 # ifdef EXIM_HAVE_ALPN
3004 if (tls_alpn && *tls_alpn)
3007 if ( expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr)
3008 && *exp_alpn && !isblank(*exp_alpn))
3010 tls_alpn = exp_alpn; /* subprocess so ok to overwrite */
3011 SSL_CTX_set_alpn_select_cb(ctx, tls_server_alpn_cb, state);
3018 # ifndef DISABLE_OCSP
3020 if(ocsp_file) /* wanting stapling */
3022 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
3024 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
3028 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
3029 SSL_CTX_set_tlsext_status_arg(ctx, state);
3032 #endif /*EXIM_HAVE_OPENSSL_TLSEXT*/
3034 state->verify_cert_hostnames = NULL;
3036 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
3037 /* Set up the RSA callback */
3038 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
3041 /* Finally, set the session cache timeout, and we are done.
3042 The period appears to be also used for (server-generated) session tickets */
3044 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
3045 DEBUG(D_tls) debug_printf("Initialized TLS\n");
3047 *caller_state = state;
3055 /*************************************************
3056 * Get name of cipher in use *
3057 *************************************************/
3060 Argument: pointer to an SSL structure for the connection
3061 pointer to number of bits for cipher
3062 Returns: pointer to allocated string in perm-pool
3066 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
3068 int pool = store_pool;
3069 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
3070 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
3071 the accessor functions use const in the prototype. */
3073 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
3076 SSL_CIPHER_get_bits(c, bits);
3078 store_pool = POOL_PERM;
3079 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
3081 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
3086 /* Get IETF-standard name for ciphersuite.
3087 Argument: pointer to an SSL structure for the connection
3088 Returns: pointer to string
3091 static const uschar *
3092 cipher_stdname_ssl(SSL * ssl)
3094 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
3095 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
3097 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
3098 return cipher_stdname(id >> 8, id & 0xff);
3103 static const uschar *
3104 tlsver_name(SSL * ssl)
3107 int pool = store_pool;
3109 store_pool = POOL_PERM;
3110 s = string_copy(US SSL_get_version(ssl));
3112 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
3113 for (;; p++) if (!(*p = p[1])) break;
3119 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
3121 /*XXX we might consider a list-of-certs variable for the cert chain.
3122 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
3123 in list-handling functions, also consider the difference between the entire
3124 chain and the elements sent by the peer. */
3126 tlsp->peerdn = NULL;
3128 /* Will have already noted peercert on a verify fail; possibly not the leaf */
3129 if (!tlsp->peercert)
3130 tlsp->peercert = SSL_get_peer_certificate(ssl);
3131 /* Beware anonymous ciphers which lead to server_cert being NULL */
3133 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
3134 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
3137 int oldpool = store_pool;
3139 peerdn[siz-1] = '\0'; /* paranoia */
3140 store_pool = POOL_PERM;
3141 tlsp->peerdn = string_copy(peerdn);
3142 store_pool = oldpool;
3144 /* We used to set CV in the cert-verify callbacks (either plain or dane)
3145 but they don't get called on session-resumption. So use the official
3146 interface, which uses the resumed value. Unfortunately this claims verified
3147 when it actually failed but we're in try-verify mode, due to us wanting the
3148 knowlege that it failed so needing to have the callback and forcing a
3149 permissive return. If we don't force it, the TLS startup is failed.
3150 The extra bit of information is set in verify_override in the cb, stashed
3151 for resumption next to the TLS session, and used here. */
3153 if (!tlsp->verify_override)
3154 tlsp->certificate_verified =
3156 tlsp->dane_verified ||
3158 SSL_get_verify_result(ssl) == X509_V_OK;
3166 /*************************************************
3167 * Set up for verifying certificates *
3168 *************************************************/
3170 #ifndef DISABLE_OCSP
3171 /* In the server, load certs from file, return TRUE on success */
3174 chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
3177 STACK_OF(X509) * verify_stack = *vp;
3180 while (sk_X509_num(verify_stack) > 0)
3181 X509_free(sk_X509_pop(verify_stack));
3183 verify_stack = sk_X509_new_null();
3185 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
3186 for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
3187 sk_X509_push(verify_stack, x);
3196 /* Called by both client and server startup; on the server possibly
3197 repeated after a Server Name Indication.
3200 sctx SSL_CTX* to initialise
3201 certsp certs file, returned expanded
3202 crl CRL file or NULL
3203 host NULL in a server; the remote host in a client
3204 errstr error string pointer
3206 Returns: OK/DEFER/FAIL
3210 setup_certs(SSL_CTX * sctx, uschar ** certsp, uschar * crl, host_item * host,
3213 uschar * expcerts, * expcrl;
3215 if (!expand_check(*certsp, US"tls_verify_certificates", &expcerts, errstr))
3217 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3220 if (expcerts && *expcerts)
3222 /* Tell the library to use its compiled-in location for the system default
3223 CA bundle. Then add the ones specified in the config, if any. */
3225 if (!SSL_CTX_set_default_verify_paths(sctx))
3226 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
3228 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
3230 struct stat statbuf;
3232 if (Ustat(expcerts, &statbuf) < 0)
3234 log_write(0, LOG_MAIN|LOG_PANIC,
3235 "failed to stat %s for certificates", expcerts);
3241 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
3242 { file = NULL; dir = expcerts; }
3245 STACK_OF(X509) * verify_stack =
3246 #ifndef DISABLE_OCSP
3247 !host ? state_server.u_ocsp.server.verify_stack :
3250 STACK_OF(X509) ** vp = &verify_stack;
3252 file = expcerts; dir = NULL;
3253 #ifndef DISABLE_OCSP
3254 /* In the server if we will be offering an OCSP proof; load chain from
3255 file for verifying the OCSP proof at load time. */
3257 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
3258 This is inconsistent with the need to verify the OCSP proof of the server cert.
3260 /* *debug_printf("file for checking server ocsp stapling is: %s\n", file); */
3262 && statbuf.st_size > 0
3263 && state_server.u_ocsp.server.file
3264 && !chain_from_pem_file(file, vp)
3267 log_write(0, LOG_MAIN|LOG_PANIC,
3268 "failed to load cert chain from %s", file);
3274 /* If a certificate file is empty, the load function fails with an
3275 unhelpful error message. If we skip it, we get the correct behaviour (no
3276 certificates are recognized, but the error message is still misleading (it
3277 says no certificate was supplied). But this is better. */
3279 if ( (!file || statbuf.st_size > 0)
3280 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
3281 return tls_error(US"SSL_CTX_load_verify_locations",
3282 host, NULL, errstr);
3284 /* On the server load the list of CAs for which we will accept certs, for
3285 sending to the client. This is only for the one-file
3286 tls_verify_certificates variant.
3287 If a list isn't loaded into the server, but some verify locations are set,
3288 the server end appears to make a wildcard request for client certs.
3289 Meanwhile, the client library as default behaviour *ignores* the list
3290 we send over the wire - see man SSL_CTX_set_client_cert_cb.
3291 Because of this, and that the dir variant is likely only used for
3292 the public-CA bundle (not for a private CA), not worth fixing. */
3296 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
3297 int i = sk_X509_NAME_num(names);
3299 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
3300 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
3301 i, i>1 ? "ies":"y");
3305 debug_printf("Added dir for additional certificate authorities\n");
3309 /* Handle a certificate revocation list. */
3311 #if OPENSSL_VERSION_NUMBER > 0x00907000L
3313 /* This bit of code is now the version supplied by Lars Mainka. (I have
3314 merely reformatted it into the Exim code style.)
3316 "From here I changed the code to add support for multiple crl's
3317 in pem format in one file or to support hashed directory entries in
3318 pem format instead of a file. This method now uses the library function
3319 X509_STORE_load_locations to add the CRL location to the SSL context.
3320 OpenSSL will then handle the verify against CA certs and CRLs by
3321 itself in the verify callback." */
3323 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
3324 if (expcrl && *expcrl)
3326 struct stat statbufcrl;
3327 if (Ustat(expcrl, &statbufcrl) < 0)
3329 log_write(0, LOG_MAIN|LOG_PANIC,
3330 "failed to stat %s for certificates revocation lists", expcrl);
3335 /* is it a file or directory? */
3337 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
3338 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
3342 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
3348 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
3350 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
3351 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
3353 /* setting the flags to check against the complete crl chain */
3355 X509_STORE_set_flags(cvstore,
3356 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
3360 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3369 tls_dump_keylog(SSL * ssl)
3371 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3372 BIO * bp = BIO_new(BIO_s_mem());
3375 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3376 len = (int) BIO_get_mem_data(bp, CSS &s);
3377 if (len > 0) debug_printf("%.*s", len, s);
3383 /* Channel-binding info for authenticators
3384 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/
3389 tls_get_channel_binding(SSL * ssl, tls_support * tlsp, const void * taintval)
3394 #ifdef EXIM_HAVE_EXPORT_CHNL_BNGNG
3395 if (SSL_version(ssl) > TLS1_2_VERSION)
3397 /* It's not documented by OpenSSL how big the output buffer must be.
3398 The OpenSSL testcases use 80 bytes but don't say why. The GnuTLS impl only
3399 serves out 32B. RFC 9266 says it is 32B.
3400 Interop fails unless we use the same each end. */
3403 tlsp->channelbind_exporter = TRUE;
3404 taintval = GET_UNTAINTED;
3405 if (SSL_export_keying_material(ssl,
3406 s = store_get((int)len, taintval), len,
3407 "EXPORTER-Channel-Binding", (size_t) 24,
3414 len = SSL_get_peer_finished(ssl, &c, 0);
3415 len = SSL_get_peer_finished(ssl, s = store_get((int)len, taintval), len);
3420 int old_pool = store_pool;
3421 store_pool = POOL_PERM;
3422 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, taintval);
3423 store_pool = old_pool;
3424 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
3429 /*************************************************
3430 * Start a TLS session in a server *
3431 *************************************************/
3432 /* This is called when Exim is running as a server, after having received
3433 the STARTTLS command. It must respond to that command, and then negotiate
3437 errstr pointer to error message
3439 Returns: OK on success
3440 DEFER for errors before the start of the negotiation
3441 FAIL for errors during the negotiation; the server can't
3446 tls_server_start(uschar ** errstr)
3449 uschar * expciphers;
3450 exim_openssl_state_st * dummy_statep;
3453 static uschar peerdn[256];
3455 /* Check for previous activation */
3457 if (tls_in.active.sock >= 0)
3459 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3460 smtp_printf("554 Already in TLS\r\n", FALSE);
3464 /* Initialize the SSL library. If it fails, it will already have logged
3467 rc = tls_init(NULL, NULL,
3468 #ifndef DISABLE_OCSP
3471 NULL, &dummy_statep, &tls_in, errstr);
3472 if (rc != OK) return rc;
3473 ctx = state_server.lib_state.lib_ctx;
3475 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3476 were historically separated by underscores. So that I can use either form in my
3477 tests, and also for general convenience, we turn underscores into hyphens here.
3479 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3480 for TLS 1.3 . Since we do not call it at present we get the default list:
3481 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3484 if (state_server.lib_state.pri_string)
3485 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3488 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3493 normalise_ciphers(&expciphers, tls_require_ciphers);
3494 if ((rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3499 /* If this is a host for which certificate verification is mandatory or
3500 optional, set up appropriately. */
3502 tls_in.certificate_verified = FALSE;
3504 tls_in.dane_verified = FALSE;
3506 server_verify_callback_called = FALSE;
3508 if (verify_check_host(&tls_verify_hosts) == OK)
3509 server_verify_optional = FALSE;
3510 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3511 server_verify_optional = TRUE;
3516 uschar * v_certs = tls_verify_certificates;
3518 if (state_server.lib_state.cabundle)
3520 DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n");
3521 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3525 if ((rc = setup_certs(ctx, &v_certs, tls_crl, NULL, errstr)) != OK)
3527 if (v_certs && *v_certs)
3528 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3533 #ifndef DISABLE_TLS_RESUME
3534 # if OPENSSL_VERSION_NUMBER < 0x30000000L
3535 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3536 /* despite working, appears to always return failure, so ignoring */
3538 SSL_CTX_set_tlsext_ticket_key_evp_cb(ctx, ticket_key_callback);
3539 /* despite working, appears to always return failure, so ignoring */
3543 #ifdef OPENSSL_HAVE_NUM_TICKETS
3544 # ifndef DISABLE_TLS_RESUME
3545 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3547 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3552 /* Prepare for new connection */
3554 if (!(ssl = SSL_new(ctx)))
3555 return tls_error(US"SSL_new", NULL, NULL, errstr);
3556 state_server.lib_state.lib_ssl = ssl;
3558 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3560 * With the SSL_clear(), we get strange interoperability bugs with
3561 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3562 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3564 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3565 * session shutdown. In this case, we have a brand new object and there's no
3566 * obvious reason to immediately clear it. I'm guessing that this was
3567 * originally added because of incomplete initialisation which the clear fixed,
3568 * in some historic release.
3571 /* Set context and tell client to go ahead, except in the case of TLS startup
3572 on connection, where outputting anything now upsets the clients and tends to
3573 make them disconnect. We need to have an explicit fflush() here, to force out
3574 the response. Other smtp_printf() calls do not need it, because in non-TLS
3575 mode, the fflush() happens when smtp_getc() is called. */
3577 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3578 if (!tls_in.on_connect)
3580 smtp_printf("220 TLS go ahead\r\n", FALSE);
3584 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3585 that the OpenSSL library doesn't. */
3587 SSL_set_wfd(ssl, fileno(smtp_out));
3588 SSL_set_rfd(ssl, fileno(smtp_in));
3589 SSL_set_accept_state(ssl);
3591 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3594 sigalrm_seen = FALSE;
3595 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3596 rc = SSL_accept(ssl);
3601 int error = SSL_get_error(ssl, rc);
3604 case SSL_ERROR_NONE:
3607 case SSL_ERROR_ZERO_RETURN:
3608 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3609 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3610 #ifndef DISABLE_EVENT
3611 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3613 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3616 tls_close(NULL, TLS_NO_SHUTDOWN);
3619 /* Handle genuine errors */
3623 int r = ERR_GET_REASON(ERR_peek_error());
3624 if ( r == SSL_R_WRONG_VERSION_NUMBER
3625 #ifdef SSL_R_VERSION_TOO_LOW
3626 || r == SSL_R_VERSION_TOO_LOW
3628 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3629 s = string_sprintf("(%s)", SSL_get_version(ssl));
3630 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
3631 #ifndef DISABLE_EVENT
3632 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3638 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3639 if (error == SSL_ERROR_SYSCALL)
3643 *errstr = US"SSL_accept: TCP connection closed by peer";
3644 #ifndef DISABLE_EVENT
3645 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3649 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3651 (void) tls_error(US"SSL_accept", NULL,
3652 sigalrm_seen ? US"timed out"
3653 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3655 #ifndef DISABLE_EVENT
3656 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3662 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3663 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3664 anon-authentication ciphersuite negotiated. */
3666 #ifndef DISABLE_TLS_RESUME
3667 if (SSL_session_reused(ssl))
3669 tls_in.resumption |= RESUME_USED;
3670 DEBUG(D_tls) debug_printf("Session reused\n");
3674 #ifdef EXIM_HAVE_ALPN
3675 /* If require-alpn, check server_seen_alpn here. Else abort TLS */
3676 if (!tls_alpn || !*tls_alpn)
3677 { DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n"); }
3678 else if (!server_seen_alpn)
3679 if (verify_check_host(&hosts_require_alpn) == OK)
3681 /* We'd like to send a definitive Alert but OpenSSL provides no facility */
3683 tls_error(US"handshake", NULL, US"ALPN required but not negotiated", errstr);
3687 { DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n"); }
3690 const uschar * name;
3692 SSL_get0_alpn_selected(ssl, &name, &len);
3694 debug_printf("ALPN negotiated: '%.*s'\n", (int)*name, name+1);
3696 debug_printf("ALPN: no protocol negotiated\n");
3701 /* TLS has been set up. Record data for the connection,
3702 adjust the input functions to read via TLS, and initialize things. */
3704 #ifdef SSL_get_extms_support
3705 /*XXX what does this return for tls1.3 ? */
3706 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3708 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3710 tls_in.ver = tlsver_name(ssl);
3711 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3712 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3717 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3718 debug_printf("Shared ciphers: %s\n", buf);
3720 tls_dump_keylog(ssl);
3722 #ifdef EXIM_HAVE_SESSION_TICKET
3724 SSL_SESSION * ss = SSL_get_session(ssl);
3725 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3726 debug_printf("The session has a ticket, life %lu seconds\n",
3727 SSL_SESSION_get_ticket_lifetime_hint(ss));
3732 /* Record the certificate we presented */
3734 X509 * crt = SSL_get_certificate(ssl);
3735 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3738 tls_get_channel_binding(ssl, &tls_in, GET_UNTAINTED);
3740 /* Only used by the server-side tls (tls_in), including tls_getc.
3741 Client-side (tls_out) reads (seem to?) go via
3742 smtp_read_response()/ip_recv().
3743 Hence no need to duplicate for _in and _out.
3745 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3746 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3747 ssl_xfer_eof = ssl_xfer_error = FALSE;
3749 receive_getc = tls_getc;
3750 receive_getbuf = tls_getbuf;
3751 receive_get_cache = tls_get_cache;
3752 receive_hasc = tls_hasc;
3753 receive_ungetc = tls_ungetc;
3754 receive_feof = tls_feof;
3755 receive_ferror = tls_ferror;
3757 tls_in.active.sock = fileno(smtp_out);
3758 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3766 tls_client_basic_ctx_init(SSL_CTX * ctx,
3767 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3772 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3773 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3774 host patterns if one of them is set with content. */
3776 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3777 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3779 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3780 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3783 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3785 client_verify_optional = FALSE;
3786 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3787 client_verify_optional = TRUE;
3792 uschar * v_certs = ob->tls_verify_certificates;
3794 if (state->lib_state.cabundle)
3796 DEBUG(D_tls) debug_printf("TLS: CA bundle for tpt was preloaded\n");
3797 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3801 if ((rc = setup_certs(ctx, &v_certs, ob->tls_crl, host, errstr)) != OK)
3803 if (v_certs && *v_certs)
3804 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3808 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3810 state->verify_cert_hostnames =
3812 string_domain_utf8_to_alabel(host->certname, NULL);
3816 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3817 state->verify_cert_hostnames);
3825 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3828 const char * hostnames[2] = { CS host->name, NULL };
3831 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3832 return tls_error(US"hostnames load", host, NULL, errstr);
3834 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3835 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3836 ) if (rr->type == T_TLSA && rr->size > 3)
3838 const uschar * p = rr->data;
3839 uint8_t usage, selector, mtype;
3840 const char * mdname;
3844 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3845 if (usage != 2 && usage != 3) continue;
3852 default: continue; /* Only match-types 0, 1, 2 are supported */
3853 case 0: mdname = NULL; break;
3854 case 1: mdname = "sha256"; break;
3855 case 2: mdname = "sha512"; break;
3859 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3862 return tls_error(US"tlsa load", host, NULL, errstr);
3863 case 0: /* action not taken */
3867 tls_out.tlsa_usage |= 1<<usage;
3873 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3876 #endif /*SUPPORT_DANE*/
3880 #ifndef DISABLE_TLS_RESUME
3881 /* On the client, get any stashed session for the given IP from hints db
3882 and apply it to the ssl-connection for attempted resumption. */
3885 tls_retrieve_session(tls_support * tlsp, SSL * ssl)
3887 if (tlsp->host_resumable)
3889 dbdata_tls_session * dt;
3891 open_db dbblock, * dbm_file;
3893 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3895 debug_printf("checking for resumable session for %s\n", tlsp->resume_index);
3896 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3898 if ((dt = dbfn_read_with_length(dbm_file, tlsp->resume_index, &len)))
3900 SSL_SESSION * ss = NULL;
3901 const uschar * sess_asn1 = dt->session;
3903 len -= sizeof(dbdata_tls_session);
3904 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3908 ERR_error_string_n(ERR_get_error(),
3909 ssl_errstring, sizeof(ssl_errstring));
3910 debug_printf("decoding session: %s\n", ssl_errstring);
3915 unsigned long lifetime =
3916 #ifdef EXIM_HAVE_SESSION_TICKET
3917 SSL_SESSION_get_ticket_lifetime_hint(ss);
3918 #else /* Use, fairly arbitrilarily, what we as server would */
3919 f.running_in_test_harness ? TESTSUITE_TICKET_LIFE : ssl_session_timeout;
3921 time_t now = time(NULL), expires = lifetime + dt->time_stamp;
3924 DEBUG(D_tls) debug_printf("session expired (by " TIME_T_FMT "s from %lus)\n", now - expires, lifetime);
3925 dbfn_delete(dbm_file, tlsp->resume_index);
3927 else if (SSL_set_session(ssl, ss))
3929 DEBUG(D_tls) debug_printf("good session (" TIME_T_FMT "s left of %lus)\n", expires - now, lifetime);
3930 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3931 tlsp->verify_override = dt->verify_override;
3932 tlsp->ocsp = dt->ocsp;
3936 ERR_error_string_n(ERR_get_error(),
3937 ssl_errstring, sizeof(ssl_errstring));
3938 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3943 DEBUG(D_tls) debug_printf("no session record\n");
3944 dbfn_close(dbm_file);
3950 /* On the client, save the session for later resumption */
3953 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3955 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3958 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3960 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3962 # ifdef OPENSSL_HAVE_NUM_TICKETS
3963 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3966 int len = i2d_SSL_SESSION(ss, NULL);
3967 int dlen = sizeof(dbdata_tls_session) + len;
3968 dbdata_tls_session * dt = store_get(dlen, GET_TAINTED);
3969 uschar * s = dt->session;
3970 open_db dbblock, * dbm_file;
3972 DEBUG(D_tls) debug_printf("session is resumable\n");
3973 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3975 dt->verify_override = tlsp->verify_override;
3976 dt->ocsp = tlsp->ocsp;
3977 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3979 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3981 dbfn_write(dbm_file, tlsp->resume_index, dt, dlen);
3982 dbfn_close(dbm_file);
3983 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3991 /* Construct a key for session DB lookup, and setup the SSL_CTX for resumption */
3994 tls_client_ctx_resume_prehandshake(
3995 exim_openssl_client_tls_ctx * exim_client_ctx, smtp_connect_args * conn_args,
3996 tls_support * tlsp, smtp_transport_options_block * ob)
3998 tlsp->host_resumable = TRUE;
3999 tls_client_resmption_key(tlsp, conn_args, ob);
4001 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
4002 SSL_SESS_CACHE_CLIENT
4003 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
4004 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
4008 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
4009 host_item * host, uschar ** errstr)
4011 if (tlsp->host_resumable)
4014 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
4015 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
4017 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
4018 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
4020 tls_error(US"set ex_data", host, NULL, errstr);
4023 /* debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state); */
4026 tlsp->resumption = RESUME_SUPPORTED;
4027 /* Pick up a previous session, saved on an old ticket */
4028 tls_retrieve_session(tlsp, ssl);
4033 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
4036 if (SSL_session_reused(exim_client_ctx->ssl))
4038 DEBUG(D_tls) debug_printf("The session was reused\n");
4039 tlsp->resumption |= RESUME_USED;
4042 #endif /* !DISABLE_TLS_RESUME */
4045 #ifdef EXIM_HAVE_ALPN
4046 /* Expand and convert an Exim list to an ALPN list. False return for fail.
4047 NULL plist return for silent no-ALPN.
4049 Overwite the passed-in list with the expanded version.
4053 tls_alpn_plist(uschar ** tls_alpn, const uschar ** plist, unsigned * plen,
4058 if (!expand_check(*tls_alpn, US"tls_alpn", &exp_alpn, errstr))
4060 *tls_alpn = exp_alpn;
4064 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
4069 /* The server implementation only accepts exactly one protocol name
4070 but it's little extra code complexity in the client. */
4072 const uschar * list = exp_alpn;
4073 uschar * p = store_get(Ustrlen(exp_alpn), exp_alpn), * s, * t;
4077 for (t = p; s = string_nextinlist(&list, &sep, NULL, 0); t += len)
4079 *t++ = len = (uschar) Ustrlen(s);
4082 *plist = (*plen = t - p) ? p : NULL;
4086 #endif /* EXIM_HAVE_ALPN */
4089 /*************************************************
4090 * Start a TLS session in a client *
4091 *************************************************/
4093 /* Called from the smtp transport after STARTTLS has been accepted.
4096 cctx connection context
4097 conn_args connection details
4098 cookie datum for randomness; can be NULL
4099 tlsp record details of TLS channel configuration here; must be non-NULL
4100 errstr error string pointer
4102 Returns: TRUE for success with TLS session context set in connection context,
4107 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
4108 void * cookie, tls_support * tlsp, uschar ** errstr)
4110 host_item * host = conn_args->host; /* for msgs and option-tests */
4111 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
4112 smtp_transport_options_block * ob = tb
4113 ? (smtp_transport_options_block *)tb->options_block
4114 : &smtp_transport_option_defaults;
4115 exim_openssl_client_tls_ctx * exim_client_ctx;
4116 uschar * expciphers;
4118 static uschar peerdn[256];
4120 #ifndef DISABLE_OCSP
4121 BOOL request_ocsp = FALSE;
4122 BOOL require_ocsp = FALSE;
4126 store_pool = POOL_PERM;
4127 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), GET_UNTAINTED);
4128 exim_client_ctx->corked = NULL;
4132 tlsp->tlsa_usage = 0;
4135 #ifndef DISABLE_OCSP
4137 # ifdef SUPPORT_DANE
4138 if ( conn_args->dane
4139 && ob->hosts_request_ocsp[0] == '*'
4140 && ob->hosts_request_ocsp[1] == '\0'
4143 /* Unchanged from default. Use a safer one under DANE */
4144 request_ocsp = TRUE;
4145 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
4146 " {= {4}{$tls_out_tlsa_usage}} } "
4152 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
4153 request_ocsp = TRUE;
4155 # ifdef SUPPORT_DANE
4159 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4161 # if defined(SUPPORT_DANE) && !defined(EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER)
4162 if (conn_args->dane && (require_ocsp || request_ocsp))
4164 DEBUG(D_tls) debug_printf("OpenSSL version to early to combine OCSP"
4165 " and DANE; disabling OCSP\n");
4166 require_ocsp = request_ocsp = FALSE;
4172 rc = tls_init(host, ob,
4173 #ifndef DISABLE_OCSP
4174 (void *)(long)request_ocsp,
4176 cookie, &client_static_state, tlsp, errstr);
4177 if (rc != OK) return FALSE;
4179 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
4181 tlsp->certificate_verified = FALSE;
4182 client_verify_callback_called = FALSE;
4186 if (conn_args->dane)
4188 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
4189 other failures should be treated as problems. */
4190 if (ob->dane_require_tls_ciphers &&
4191 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
4192 &expciphers, errstr))
4194 if (expciphers && *expciphers == '\0')
4197 normalise_ciphers(&expciphers, ob->dane_require_tls_ciphers);
4202 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
4203 &expciphers, errstr))
4206 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
4207 are separated by underscores. So that I can use either form in my tests, and
4208 also for general convenience, we turn underscores into hyphens here. */
4210 normalise_ciphers(&expciphers, ob->tls_require_ciphers);
4215 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
4216 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
4218 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
4224 if (conn_args->dane)
4226 SSL_CTX_set_verify(exim_client_ctx->ctx,
4227 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
4228 verify_callback_client_dane);
4230 if (!DANESSL_library_init())
4232 tls_error(US"library init", host, NULL, errstr);
4235 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
4237 tls_error(US"context init", host, NULL, errstr);
4240 DEBUG(D_tls) debug_printf("since dane-mode conn, not loading the usual CA bundle\n");
4246 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
4247 client_static_state, errstr) != OK)
4252 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
4255 { DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n"); }
4256 else if (!Ustrlen(tlsp->sni))
4260 #ifndef EXIM_HAVE_OPENSSL_TLSEXT
4261 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
4269 #ifdef EXIM_HAVE_ALPN
4271 const uschar * plist;
4274 if (!tls_alpn_plist(&ob->tls_alpn, &plist, &plen, errstr))
4277 if (SSL_CTX_set_alpn_protos(exim_client_ctx->ctx, plist, plen) != 0)
4279 tls_error(US"alpn init", host, NULL, errstr);
4283 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
4286 log_write(0, LOG_MAIN, "ALPN unusable with this OpenSSL library version; ignoring \"%s\"\n",
4290 #ifndef DISABLE_TLS_RESUME
4291 /*XXX have_lbserver: another cmdline arg possibly, for continued-conn, but use
4292 will be very low. */
4294 if (!conn_args->have_lbserver) /* wanted for tls_client_resmption_key() */
4295 { DEBUG(D_tls) debug_printf("resumption not supported on continued-connection\n"); }
4296 else if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
4297 tls_client_ctx_resume_prehandshake(exim_client_ctx, conn_args, tlsp, ob);
4301 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
4303 tls_error(US"SSL_new", host, NULL, errstr);
4306 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
4307 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
4308 SSL_set_connect_state(exim_client_ctx->ssl);
4310 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
4313 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
4314 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
4319 if (conn_args->dane)
4320 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
4324 #ifndef DISABLE_OCSP
4325 /* Request certificate status at connection-time. If the server
4326 does OCSP stapling we will get the callback (set in tls_init()) */
4327 # ifdef SUPPORT_DANE
4331 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4332 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4334 { /* Re-eval now $tls_out_tlsa_usage is populated. If
4335 this means we avoid the OCSP request, we wasted the setup
4336 cost in tls_init(). */
4337 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
4338 request_ocsp = require_ocsp
4339 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4346 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
4347 client_static_state->u_ocsp.client.verify_required = require_ocsp;
4348 tlsp->ocsp = OCSP_NOT_RESP;
4352 #ifndef DISABLE_TLS_RESUME
4353 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
4358 #ifndef DISABLE_EVENT
4359 client_static_state->event_action = tb ? tb->event_action : NULL;
4362 /* There doesn't seem to be a built-in timeout on connection. */
4364 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
4365 sigalrm_seen = FALSE;
4366 ALARM(ob->command_timeout);
4367 rc = SSL_connect(exim_client_ctx->ssl);
4371 if (conn_args->dane)
4372 DANESSL_cleanup(exim_client_ctx->ssl);
4377 #ifndef DISABLE_OCSP
4378 if (client_static_state->u_ocsp.client.verify_errstr)
4379 { if (errstr) *errstr = client_static_state->u_ocsp.client.verify_errstr; }
4382 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
4388 debug_printf("SSL_connect succeeded\n");
4389 tls_dump_keylog(exim_client_ctx->ssl);
4392 #ifndef DISABLE_TLS_RESUME
4393 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
4396 #ifdef EXIM_HAVE_ALPN
4397 if (ob->tls_alpn) /* We requested. See what was negotiated. */
4399 const uschar * name;
4402 SSL_get0_alpn_selected(exim_client_ctx->ssl, &name, &len);
4404 { DEBUG(D_tls) debug_printf("ALPN negotiated %u: '%.*s'\n", len, (int)*name, name+1); }
4405 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
4407 /* Would like to send a relevant fatal Alert, but OpenSSL has no API */
4408 tls_error(US"handshake", host, US"ALPN required but not negotiated", errstr);
4414 #ifdef SSL_get_extms_support
4415 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
4417 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
4419 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
4420 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
4421 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
4423 /* Record the certificate we presented */
4425 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
4426 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
4429 /*XXX will this work with continued-TLS? */
4430 tls_get_channel_binding(exim_client_ctx->ssl, tlsp, GET_TAINTED);
4432 tlsp->active.sock = cctx->sock;
4433 tlsp->active.tls_ctx = exim_client_ctx;
4434 cctx->tls_ctx = exim_client_ctx;
4443 tls_refill(unsigned lim)
4445 SSL * ssl = state_server.lib_state.lib_ssl;
4449 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4450 ssl_xfer_buffer, ssl_xfer_buffer_size);
4453 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4454 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
4455 MIN(ssl_xfer_buffer_size, lim));
4456 error = SSL_get_error(ssl, inbytes);
4457 if (smtp_receive_timeout > 0) ALARM_CLR(0);
4459 if (had_command_timeout) /* set by signal handler */
4460 smtp_command_timeout_exit(); /* does not return */
4461 if (had_command_sigterm)
4462 smtp_command_sigterm_exit();
4463 if (had_data_timeout)
4464 smtp_data_timeout_exit();
4465 if (had_data_sigint)
4466 smtp_data_sigint_exit();
4468 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
4469 closed down, not that the socket itself has been closed down. Revert to
4470 non-SSL handling. */
4474 case SSL_ERROR_NONE:
4477 case SSL_ERROR_ZERO_RETURN:
4478 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4480 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
4483 tls_close(NULL, TLS_NO_SHUTDOWN);
4486 /* Handle genuine errors */
4488 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4489 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
4490 ssl_xfer_error = TRUE;
4494 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
4495 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
4496 debug_printf(" - syscall %s\n", strerror(errno));
4497 ssl_xfer_error = TRUE;
4501 #ifndef DISABLE_DKIM
4502 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
4504 ssl_xfer_buffer_hwm = inbytes;
4505 ssl_xfer_buffer_lwm = 0;
4510 /*************************************************
4511 * TLS version of getc *
4512 *************************************************/
4514 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
4515 it refills the buffer via the SSL reading function.
4517 Arguments: lim Maximum amount to read/buffer
4518 Returns: the next character or EOF
4520 Only used by the server-side TLS.
4524 tls_getc(unsigned lim)
4526 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4527 if (!tls_refill(lim))
4528 return ssl_xfer_error ? EOF : smtp_getc(lim);
4530 /* Something in the buffer; return next uschar */
4532 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
4538 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm;
4542 tls_getbuf(unsigned * len)
4547 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4548 if (!tls_refill(*len))
4550 if (!ssl_xfer_error) return smtp_getbuf(len);
4555 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4557 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4558 ssl_xfer_buffer_lwm += size;
4565 tls_get_cache(unsigned lim)
4567 #ifndef DISABLE_DKIM
4568 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4572 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4578 tls_could_getc(void)
4580 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4581 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4585 /*************************************************
4586 * Read bytes from TLS channel *
4587 *************************************************/
4591 ct_ctx client context pointer, or NULL for the one global server context
4595 Returns: the number of bytes read
4596 -1 after a failed read, including EOF
4598 Only used by the client-side TLS.
4602 tls_read(void * ct_ctx, uschar *buff, size_t len)
4604 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4605 : state_server.lib_state.lib_ssl;
4609 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4610 buff, (unsigned int)len);
4613 inbytes = SSL_read(ssl, CS buff, len);
4614 error = SSL_get_error(ssl, inbytes);
4616 if (error == SSL_ERROR_ZERO_RETURN)
4618 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4621 else if (error != SSL_ERROR_NONE)
4631 /*************************************************
4632 * Write bytes down TLS channel *
4633 *************************************************/
4637 ct_ctx client context pointer, or NULL for the one global server context
4640 more further data expected soon
4642 Returns: the number of bytes after a successful write,
4643 -1 after a failed write
4645 Used by both server-side and client-side TLS. Calling with len zero and more unset
4646 will flush buffered writes; buff can be null for this case.
4650 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4653 int outbytes, error;
4655 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4656 : state_server.lib_state.lib_ssl;
4657 static gstring * server_corked = NULL;
4658 gstring ** corkedp = ct_ctx
4659 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4660 gstring * corked = *corkedp;
4662 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4663 buff, (unsigned long)len, more ? ", more" : "");
4665 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4666 "more" is notified. This hack is only ok if small amounts are involved AND only
4667 one stream does it, in one context (i.e. no store reset). Currently it is used
4668 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4669 We support callouts done by the server process by using a separate client
4670 context for the stashed information. */
4671 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4672 a store reset there, so use POOL_PERM. */
4673 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4677 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4679 int save_pool = store_pool;
4680 store_pool = POOL_PERM;
4682 corked = string_catn(corked, buff, len);
4684 store_pool = save_pool;
4691 buff = CUS corked->s;
4696 for (int left = len; left > 0;)
4698 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4700 outbytes = SSL_write(ssl, CS buff, left);
4701 error = SSL_get_error(ssl, outbytes);
4702 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4705 case SSL_ERROR_NONE: /* the usual case */
4711 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4712 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4715 case SSL_ERROR_ZERO_RETURN:
4716 log_write(0, LOG_MAIN, "SSL channel closed on write");
4719 case SSL_ERROR_SYSCALL:
4720 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4721 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4722 sender_fullhost ? sender_fullhost : US"<unknown>",
4724 else if (LOGGING(protocol_detail))
4725 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4726 " SMTP response and TLS close\n", sender_host_address);
4728 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4729 " client reset TCP before TLS close\n", sender_host_address);
4733 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4744 ct_ctx client TLS context pointer, or NULL for the one global server context
4748 tls_shutdown_wr(void * ct_ctx)
4750 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4751 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4752 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4755 if (*fdp < 0) return; /* TLS was not active */
4757 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4759 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
4760 rc = SSL_shutdown(*sslp);
4761 if (rc < 0) DEBUG(D_tls)
4763 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4764 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4768 /*************************************************
4769 * Close down a TLS session *
4770 *************************************************/
4772 /* This is also called from within a delivery subprocess forked from the
4773 daemon, to shut down the TLS library, without actually doing a shutdown (which
4774 would tamper with the SSL session in the parent process).
4777 ct_ctx client TLS context pointer, or NULL for the one global server context
4778 do_shutdown 0 no data-flush or TLS close-alert
4779 1 if TLS close-alert is to be sent,
4780 2 if also response to be waited for
4784 Used by both server-side and client-side TLS.
4788 tls_close(void * ct_ctx, int do_shutdown)
4790 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4791 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4792 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4794 if (*fdp < 0) return; /* TLS was not active */
4796 if (do_shutdown > TLS_NO_SHUTDOWN)
4799 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4800 do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
4802 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4804 if ( ( do_shutdown >= TLS_SHUTDOWN_WONLY
4805 || (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4807 && do_shutdown > TLS_SHUTDOWN_NOWAIT
4810 #ifdef EXIM_TCP_CORK
4811 (void) setsockopt(*fdp, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
4814 rc = SSL_shutdown(*sslp); /* wait for response */
4818 if (rc < 0) DEBUG(D_tls)
4820 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4821 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4825 if (!o_ctx) /* server side */
4827 #ifndef DISABLE_OCSP
4828 sk_X509_pop_free(state_server.u_ocsp.server.verify_stack, X509_free);
4829 state_server.u_ocsp.server.verify_stack = NULL;
4832 receive_getc = smtp_getc;
4833 receive_getbuf = smtp_getbuf;
4834 receive_get_cache = smtp_get_cache;
4835 receive_hasc = smtp_hasc;
4836 receive_ungetc = smtp_ungetc;
4837 receive_feof = smtp_feof;
4838 receive_ferror = smtp_ferror;
4839 tls_in.active.tls_ctx = NULL;
4841 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4852 /*************************************************
4853 * Let tls_require_ciphers be checked at startup *
4854 *************************************************/
4856 /* The tls_require_ciphers option, if set, must be something which the
4859 Returns: NULL on success, or error message
4863 tls_validate_require_cipher(void)
4866 uschar * expciphers, * err;
4870 if (!(tls_require_ciphers && *tls_require_ciphers))
4873 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4875 return US"failed to expand tls_require_ciphers";
4877 if (!(expciphers && *expciphers))
4880 normalise_ciphers(&expciphers, tls_require_ciphers);
4883 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4886 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4888 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4890 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4891 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4892 expciphers, ssl_errstring);
4903 /*************************************************
4904 * Report the library versions. *
4905 *************************************************/
4907 /* There have historically been some issues with binary compatibility in
4908 OpenSSL libraries; if Exim (like many other applications) is built against
4909 one version of OpenSSL but the run-time linker picks up another version,
4910 it can result in serious failures, including crashing with a SIGSEGV. So
4911 report the version found by the compiler and the run-time version.
4913 Note: some OS vendors backport security fixes without changing the version
4914 number/string, and the version date remains unchanged. The _build_ date
4915 will change, so we can more usefully assist with version diagnosis by also
4916 reporting the build date.
4918 Arguments: string to append to
4923 tls_version_report(gstring * g)
4925 return string_fmt_append(g,
4926 "Library version: OpenSSL: Compile: %s\n"
4929 OPENSSL_VERSION_TEXT,
4930 SSLeay_version(SSLEAY_VERSION),
4931 SSLeay_version(SSLEAY_BUILT_ON));
4932 /* third line is 38 characters for the %s and the line is 73 chars long;
4933 the OpenSSL output includes a "built on: " prefix already. */
4939 /*************************************************
4940 * Random number generation *
4941 *************************************************/
4943 /* Pseudo-random number generation. The result is not expected to be
4944 cryptographically strong but not so weak that someone will shoot themselves
4945 in the foot using it as a nonce in input in some email header scheme or
4946 whatever weirdness they'll twist this into. The result should handle fork()
4947 and avoid repeating sequences. OpenSSL handles that for us.
4951 Returns a random number in range [0, max-1]
4955 vaguely_random_number(int max)
4959 static pid_t pidlast = 0;
4961 uschar smallbuf[sizeof(r)];
4967 if (pidnow != pidlast)
4969 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
4970 is unique for each thread", this doesn't apparently apply across processes,
4971 so our own warning from vaguely_random_number_fallback() applies here too.
4972 Fix per PostgreSQL. */
4978 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
4982 gettimeofday(&r.tv, NULL);
4985 RAND_seed(US (&r), sizeof(r));
4987 /* We're after pseudo-random, not random; if we still don't have enough data
4988 in the internal PRNG then our options are limited. We could sleep and hope
4989 for entropy to come along (prayer technique) but if the system is so depleted
4990 in the first place then something is likely to just keep taking it. Instead,
4991 we'll just take whatever little bit of pseudo-random we can still manage to
4994 needed_len = sizeof(r);
4995 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4996 asked for a number less than 10. */
4997 for (r = max, i = 0; r; ++i)
5003 #ifdef EXIM_HAVE_RAND_PSEUDO
5004 /* We do not care if crypto-strong */
5005 i = RAND_pseudo_bytes(smallbuf, needed_len);
5007 i = RAND_bytes(smallbuf, needed_len);
5013 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
5014 return vaguely_random_number_fallback(max);
5018 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
5021 /* We don't particularly care about weighted results; if someone wants
5022 smooth distribution and cares enough then they should submit a patch then. */
5029 /*************************************************
5030 * OpenSSL option parse *
5031 *************************************************/
5033 /* Parse one option for tls_openssl_options_parse below
5036 name one option name
5037 value place to store a value for it
5038 Returns success or failure in parsing
5044 tls_openssl_one_option_parse(uschar *name, long *value)
5047 int last = exim_openssl_options_size;
5048 while (last > first)
5050 int middle = (first + last)/2;
5051 int c = Ustrcmp(name, exim_openssl_options[middle].name);
5054 *value = exim_openssl_options[middle].value;
5068 /*************************************************
5069 * OpenSSL option parsing logic *
5070 *************************************************/
5072 /* OpenSSL has a number of compatibility options which an administrator might
5073 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
5074 we look like log_selector.
5077 option_spec the administrator-supplied string of options
5078 results ptr to long storage for the options bitmap
5079 Returns success or failure
5083 tls_openssl_options_parse(uschar *option_spec, long *results)
5086 uschar * exp, * end;
5087 BOOL adding, item_parsed;
5089 /* Server: send no (<= TLS1.2) session tickets */
5090 result = SSL_OP_NO_TICKET;
5092 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
5093 from default because it increases BEAST susceptibility. */
5094 #ifdef SSL_OP_NO_SSLv2
5095 result |= SSL_OP_NO_SSLv2;
5097 #ifdef SSL_OP_NO_SSLv3
5098 result |= SSL_OP_NO_SSLv3;
5100 #ifdef SSL_OP_SINGLE_DH_USE
5101 result |= SSL_OP_SINGLE_DH_USE;
5103 #ifdef SSL_OP_NO_RENEGOTIATION
5104 result |= SSL_OP_NO_RENEGOTIATION;
5113 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
5116 for (uschar * s = exp; *s; /**/)
5118 while (isspace(*s)) ++s;
5121 if (*s != '+' && *s != '-')
5123 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
5124 "+ or - expected but found \"%s\"\n", s);
5127 adding = *s++ == '+';
5128 for (end = s; *end && !isspace(*end); ) end++;
5129 item_parsed = tls_openssl_one_option_parse(string_copyn(s, end-s), &item);
5132 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
5135 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
5136 adding ? "adding to " : "removing from", result, item, s);
5148 #endif /*!MACRO_PREDEF*/
5151 /* End of tls-openssl.c */