1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2019 */
6 /* Copyright (c) The Exim Maintainers 2020 - 2021 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Portions Copyright (c) The OpenSSL Project 1999 */
11 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
12 library. It is #included into the tls.c file when that library is used. The
13 code herein is based on a patch that was originally contributed by Steve
14 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
16 No cryptographic code is included in Exim. All this module does is to call
17 functions from the OpenSSL library. */
22 #include <openssl/lhash.h>
23 #include <openssl/ssl.h>
24 #include <openssl/err.h>
25 #include <openssl/rand.h>
26 #ifndef OPENSSL_NO_ECDH
27 # include <openssl/ec.h>
30 # include <openssl/ocsp.h>
38 # define EXIM_OCSP_SKEW_SECONDS (300L)
39 # define EXIM_OCSP_MAX_AGE (-1L)
42 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
43 # define EXIM_HAVE_OPENSSL_TLSEXT
45 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
46 # define EXIM_HAVE_RSA_GENKEY_EX
48 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
49 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define OPENSSL_AUTO_SHA256
52 # define EXIM_HAVE_EPHEM_RSA_KEX
53 # define EXIM_HAVE_RAND_PSEUDO
55 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
56 # define EXIM_HAVE_SHA256
59 /* X509_check_host provides sane certificate hostname checking, but was added
60 to OpenSSL late, after other projects forked off the code-base. So in
61 addition to guarding against the base version number, beware that LibreSSL
62 does not (at this time) support this function.
64 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
65 opt to disentangle and ask a LibreSSL user to provide glue for a third
66 crypto provider for libtls instead of continuing to tie the OpenSSL glue
67 into even twistier knots. If LibreSSL gains the same API, we can just
68 change this guard and punt the issue for a while longer. */
70 #ifndef LIBRESSL_VERSION_NUMBER
71 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
72 # define EXIM_HAVE_OPENSSL_CHECKHOST
73 # define EXIM_HAVE_OPENSSL_DH_BITS
74 # define EXIM_HAVE_OPENSSL_TLS_METHOD
75 # define EXIM_HAVE_OPENSSL_KEYLOG
76 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
77 # define EXIM_HAVE_SESSION_TICKET
78 # define EXIM_HAVE_OPESSL_TRACE
79 # define EXIM_HAVE_OPESSL_GET0_SERIAL
81 # define EXIM_HAVE_OCSP
83 # define EXIM_HAVE_ALPN /* fail ret from hshake-cb is ignored by LibreSSL */
85 # define EXIM_NEED_OPENSSL_INIT
87 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
88 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
89 # define EXIM_HAVE_OPENSSL_CHECKHOST
93 #if LIBRESSL_VERSION_NUMBER >= 0x3040000fL
94 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
97 #if !defined(LIBRESSL_VERSION_NUMBER) \
98 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
99 # if !defined(OPENSSL_NO_ECDH)
100 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
101 # define EXIM_HAVE_ECDH
103 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
104 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
109 #ifndef LIBRESSL_VERSION_NUMBER
110 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
111 # define OPENSSL_HAVE_KEYLOG_CB
112 # define OPENSSL_HAVE_NUM_TICKETS
113 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
115 # define OPENSSL_BAD_SRVR_OURCERT
119 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
120 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
121 # define DISABLE_OCSP
124 #ifndef DISABLE_TLS_RESUME
125 # if OPENSSL_VERSION_NUMBER < 0x0101010L
126 # error OpenSSL version too old for session-resumption
130 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
131 # include <openssl/x509v3.h>
134 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
135 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
136 # define SSL_CIPHER_get_id(c) (c->id)
138 # ifndef MACRO_PREDEF
139 # include "tls-cipher-stdname.c"
143 /*************************************************
144 * OpenSSL option parse *
145 *************************************************/
147 typedef struct exim_openssl_option {
150 } exim_openssl_option;
151 /* We could use a macro to expand, but we need the ifdef and not all the
152 options document which version they were introduced in. Policylet: include
153 all options unless explicitly for DTLS, let the administrator choose which
156 This list is current as of:
159 XXX could we autobuild this list, as with predefined-macros?
160 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
161 Also allow a numeric literal?
163 static exim_openssl_option exim_openssl_options[] = {
164 /* KEEP SORTED ALPHABETICALLY! */
166 { US"all", (long) SSL_OP_ALL },
168 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
169 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
171 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
172 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
174 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
175 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
177 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
178 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
180 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
181 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
183 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
184 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
186 #ifdef SSL_OP_EPHEMERAL_RSA
187 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
189 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
190 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
192 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
193 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
195 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
196 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
198 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
199 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
201 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
202 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
204 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
205 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
207 #ifdef SSL_OP_NO_ANTI_REPLAY
208 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
210 #ifdef SSL_OP_NO_COMPRESSION
211 { US"no_compression", SSL_OP_NO_COMPRESSION },
213 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
214 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
216 #ifdef SSL_OP_NO_RENEGOTIATION
217 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
219 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
220 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
222 #ifdef SSL_OP_NO_SSLv2
223 { US"no_sslv2", SSL_OP_NO_SSLv2 },
225 #ifdef SSL_OP_NO_SSLv3
226 { US"no_sslv3", SSL_OP_NO_SSLv3 },
228 #ifdef SSL_OP_NO_TICKET
229 { US"no_ticket", SSL_OP_NO_TICKET },
231 #ifdef SSL_OP_NO_TLSv1
232 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
234 #ifdef SSL_OP_NO_TLSv1_1
235 # if OPENSSL_VERSION_NUMBER < 0x30000000L
236 # if SSL_OP_NO_TLSv1_1 == 0x00000400L
237 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
238 # warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
239 # define NO_SSL_OP_NO_TLSv1_1
242 # ifndef NO_SSL_OP_NO_TLSv1_1
243 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
246 #ifdef SSL_OP_NO_TLSv1_2
247 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
249 #ifdef SSL_OP_NO_TLSv1_3
250 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
252 #ifdef SSL_OP_PRIORITIZE_CHACHA
253 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
255 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
256 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
258 #ifdef SSL_OP_SINGLE_DH_USE
259 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
261 #ifdef SSL_OP_SINGLE_ECDH_USE
262 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
264 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
265 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
267 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
268 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
270 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
271 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
273 #ifdef SSL_OP_TLS_D5_BUG
274 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
276 #ifdef SSL_OP_TLS_ROLLBACK_BUG
277 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
279 #ifdef SSL_OP_TLSEXT_PADDING
280 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
285 static int exim_openssl_options_size = nelem(exim_openssl_options);
286 static long init_options = 0;
295 for (struct exim_openssl_option * o = exim_openssl_options;
296 o < exim_openssl_options + nelem(exim_openssl_options); o++)
298 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
299 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
301 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
302 builtin_macro_create(buf);
305 # ifndef DISABLE_TLS_RESUME
306 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
308 # ifdef SSL_OP_NO_TLSv1_3
309 builtin_macro_create(US"_HAVE_TLS1_3");
311 # ifdef OPENSSL_BAD_SRVR_OURCERT
312 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
314 # ifdef EXIM_HAVE_OCSP
315 builtin_macro_create(US"_HAVE_TLS_OCSP");
316 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
318 # ifdef EXIM_HAVE_ALPN
319 builtin_macro_create(US"_HAVE_TLS_ALPN");
324 /******************************************************************************/
326 /* Structure for collecting random data for seeding. */
328 typedef struct randstuff {
333 /* Local static variables */
335 static BOOL client_verify_callback_called = FALSE;
336 static BOOL server_verify_callback_called = FALSE;
337 static const uschar *sid_ctx = US"exim";
339 /* We have three different contexts to care about.
341 Simple case: client, `client_ctx`
342 As a client, we can be doing a callout or cut-through delivery while receiving
343 a message. So we have a client context, which should have options initialised
344 from the SMTP Transport. We may also concurrently want to make TLS connections
345 to utility daemons, so client-contexts are allocated and passed around in call
346 args rather than using a gobal.
349 There are two cases: with and without ServerNameIndication from the client.
350 Given TLS SNI, we can be using different keys, certs and various other
351 configuration settings, because they're re-expanded with $tls_sni set. This
352 allows vhosting with TLS. This SNI is sent in the handshake.
353 A client might not send SNI, so we need a fallback, and an initial setup too.
354 So as a server, we start out using `server_ctx`.
355 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
356 `server_sni` from `server_ctx` and then initialise settings by re-expanding
364 } exim_openssl_client_tls_ctx;
367 /* static SSL_CTX *server_ctx = NULL; */
368 /* static SSL *server_ssl = NULL; */
370 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
371 static SSL_CTX *server_sni = NULL;
373 #ifdef EXIM_HAVE_ALPN
374 static BOOL server_seen_alpn = FALSE;
377 static char ssl_errstring[256];
379 static int ssl_session_timeout = 7200; /* Two hours */
380 static BOOL client_verify_optional = FALSE;
381 static BOOL server_verify_optional = FALSE;
383 static BOOL reexpand_tls_files_for_sni = FALSE;
386 typedef struct ocsp_resp {
387 struct ocsp_resp * next;
388 OCSP_RESPONSE * resp;
391 typedef struct exim_openssl_state {
392 exim_tlslib_state lib_state;
393 #define lib_ctx libdata0
394 #define lib_ssl libdata1
397 uschar * certificate;
401 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
405 const uschar *file_expanded;
406 ocsp_resplist *olist;
409 X509_STORE *verify_store; /* non-null if status requested */
410 BOOL verify_required;
415 /* these are cached from first expand */
416 uschar * server_cipher_list;
417 /* only passed down to tls_error: */
419 const uschar * verify_cert_hostnames;
420 #ifndef DISABLE_EVENT
421 uschar * event_action;
423 } exim_openssl_state_st;
425 /* should figure out a cleanup of API to handle state preserved per
426 implementation, for various reasons, which can be void * in the APIs.
427 For now, we hack around it. */
428 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
429 exim_openssl_state_st state_server = {.is_server = TRUE};
432 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
437 static int tls_server_stapling_cb(SSL *s, void *arg);
442 /* Daemon-called, before every connection, key create/rotate */
443 #ifndef DISABLE_TLS_RESUME
444 static void tk_init(void);
445 static int tls_exdata_idx = -1;
449 tls_per_lib_daemon_tick(void)
451 #ifndef DISABLE_TLS_RESUME
456 /* Called once at daemon startup */
459 tls_per_lib_daemon_init(void)
461 tls_daemon_creds_reload();
465 /*************************************************
467 *************************************************/
469 /* Called from lots of places when errors occur before actually starting to do
470 the TLS handshake, that is, while the session is still in clear. Always returns
471 DEFER for a server and FAIL for a client so that most calls can use "return
472 tls_error(...)" to do this processing and then give an appropriate return. A
473 single function is used for both server and client, because it is called from
474 some shared functions.
477 prefix text to include in the logged error
478 host NULL if setting up a server;
479 the connected host if setting up a client
480 msg error message or NULL if we should ask OpenSSL
481 errstr pointer to output error message
483 Returns: OK/DEFER/FAIL
487 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
491 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
492 msg = US ssl_errstring;
495 msg = string_sprintf("(%s): %s", prefix, msg);
496 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
497 if (errstr) *errstr = msg;
498 return host ? FAIL : DEFER;
503 /**************************************************
504 * General library initalisation *
505 **************************************************/
508 lib_rand_init(void * addr)
511 if (!RAND_status()) return TRUE;
513 gettimeofday(&r.tv, NULL);
515 RAND_seed(US (&r), sizeof(r));
516 RAND_seed(US big_buffer, big_buffer_size);
517 if (addr) RAND_seed(US addr, sizeof(addr));
519 return RAND_status();
524 tls_openssl_init(void)
526 static BOOL once = FALSE;
530 #ifdef EXIM_NEED_OPENSSL_INIT
531 SSL_load_error_strings(); /* basic set up */
532 OpenSSL_add_ssl_algorithms();
535 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
536 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
537 list of available digests. */
538 EVP_add_digest(EVP_sha256());
541 (void) lib_rand_init(NULL);
542 (void) tls_openssl_options_parse(openssl_options, &init_options);
547 /*************************************************
548 * Initialize for DH *
549 *************************************************/
551 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
554 sctx The current SSL CTX (inbound or outbound)
555 dhparam DH parameter file or fixed parameter identity string
556 host connected host, if client; NULL if server
557 errstr error string pointer
559 Returns: TRUE if OK (nothing to set up, or setup worked)
563 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host, uschar ** errstr)
571 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
574 if (!dhexpanded || !*dhexpanded)
575 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
576 else if (dhexpanded[0] == '/')
578 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
580 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
581 host, US strerror(errno), errstr);
587 if (Ustrcmp(dhexpanded, "none") == 0)
589 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
593 if (!(pem = std_dh_prime_named(dhexpanded)))
595 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
596 host, US strerror(errno), errstr);
599 bio = BIO_new_mem_buf(CS pem, -1);
602 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
605 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
610 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
611 an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with 2236.
612 But older OpenSSL can only report in bytes (octets), not bits. If someone wants
613 to dance at the edge, then they can raise the limit or use current libraries. */
615 #ifdef EXIM_HAVE_OPENSSL_DH_BITS
616 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
617 This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
618 dh_bitsize = DH_bits(dh);
620 dh_bitsize = 8 * DH_size(dh);
623 /* Even if it is larger, we silently return success rather than cause things to
624 fail out, so that a too-large DH will not knock out all TLS; it's a debatable
627 if (dh_bitsize <= tls_dh_max_bits)
629 SSL_CTX_set_tmp_dh(sctx, dh);
631 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
632 dhexpanded ? dhexpanded : US"default", dh_bitsize);
636 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d\n",
637 dh_bitsize, tls_dh_max_bits);
648 /*************************************************
649 * Initialize for ECDH *
650 *************************************************/
652 /* Load parameters for ECDH encryption.
654 For now, we stick to NIST P-256 because: it's simple and easy to configure;
655 it avoids any patent issues that might bite redistributors; despite events in
656 the news and concerns over curve choices, we're not cryptographers, we're not
657 pretending to be, and this is "good enough" to be better than no support,
658 protecting against most adversaries. Given another year or two, there might
659 be sufficient clarity about a "right" way forward to let us make an informed
660 decision, instead of a knee-jerk reaction.
662 Longer-term, we should look at supporting both various named curves and
663 external files generated with "openssl ecparam", much as we do for init_dh().
664 We should also support "none" as a value, to explicitly avoid initialisation.
669 sctx The current SSL CTX (inbound or outbound)
670 host connected host, if client; NULL if server
671 errstr error string pointer
673 Returns: TRUE if OK (nothing to set up, or setup worked)
677 init_ecdh(SSL_CTX * sctx, host_item * host, uschar ** errstr)
679 #ifdef OPENSSL_NO_ECDH
687 if (host) /* No ECDH setup for clients, only for servers */
690 # ifndef EXIM_HAVE_ECDH
692 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
696 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
698 if (!exp_curve || !*exp_curve)
701 /* "auto" needs to be handled carefully.
702 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
703 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
704 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
705 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
706 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
708 if (Ustrcmp(exp_curve, "auto") == 0)
710 #if OPENSSL_VERSION_NUMBER < 0x10002000L
711 DEBUG(D_tls) debug_printf(
712 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
713 exp_curve = US"prime256v1";
715 # if defined SSL_CTRL_SET_ECDH_AUTO
716 DEBUG(D_tls) debug_printf(
717 "ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n");
718 SSL_CTX_set_ecdh_auto(sctx, 1);
721 DEBUG(D_tls) debug_printf(
722 "ECDH OpenSSL 1.1.0+: temp key parameter settings: default selection\n");
728 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
729 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
730 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
731 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
735 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
740 # if OPENSSL_VERSION_NUMBER < 0x30000000L
743 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
745 tls_error(US"Unable to create ec curve", host, NULL, errstr);
749 /* The "tmp" in the name here refers to setting a temporary key
750 not to the stability of the interface. */
752 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
753 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL, errstr);
755 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
759 #else /* v 3.0.0 + */
761 if ((rv = SSL_CTX_set1_groups(sctx, &nid, 1)) == 0)
762 tls_error(string_sprintf("Error enabling '%s' group", exp_curve), host, NULL, errstr);
764 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' group\n", exp_curve);
770 # endif /*EXIM_HAVE_ECDH*/
771 #endif /*OPENSSL_NO_ECDH*/
776 /*************************************************
777 * Expand key and cert file specs *
778 *************************************************/
782 s SSL connection (not used)
786 Returns: pointer to generated key
790 rsa_callback(SSL *s, int export, int keylength)
793 #ifdef EXIM_HAVE_RSA_GENKEY_EX
794 BIGNUM *bn = BN_new();
797 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
799 #ifdef EXIM_HAVE_RSA_GENKEY_EX
800 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
801 || !(rsa_key = RSA_new())
802 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
805 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
809 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
810 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
819 /* Create and install a selfsigned certificate, for use in server mode */
820 /*XXX we could arrange to call this during prelo for a null tls_certificate option.
821 The normal cache inval + relo will suffice.
822 Just need a timer for inval. */
825 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
833 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
834 where = US"allocating pkey";
835 if (!(pkey = EVP_PKEY_new()))
838 where = US"allocating cert";
839 if (!(x509 = X509_new()))
842 where = US"generating pkey";
843 if (!(rsa = rsa_callback(NULL, 0, 2048)))
846 where = US"assigning pkey";
847 if (!EVP_PKEY_assign_RSA(pkey, rsa))
850 X509_set_version(x509, 2); /* N+1 - version 3 */
851 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
852 X509_gmtime_adj(X509_get_notBefore(x509), 0);
853 X509_gmtime_adj(X509_get_notAfter(x509), (long)2 * 60 * 60); /* 2 hour */
854 X509_set_pubkey(x509, pkey);
856 name = X509_get_subject_name(x509);
857 X509_NAME_add_entry_by_txt(name, "C",
858 MBSTRING_ASC, CUS "UK", -1, -1, 0);
859 X509_NAME_add_entry_by_txt(name, "O",
860 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
861 X509_NAME_add_entry_by_txt(name, "CN",
862 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
863 X509_set_issuer_name(x509, name);
865 where = US"signing cert";
866 if (!X509_sign(x509, pkey, EVP_md5()))
869 where = US"installing selfsign cert";
870 if (!SSL_CTX_use_certificate(sctx, x509))
873 where = US"installing selfsign key";
874 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
880 (void) tls_error(where, NULL, NULL, errstr);
881 if (x509) X509_free(x509);
882 if (pkey) EVP_PKEY_free(pkey);
892 /*************************************************
893 * Information callback *
894 *************************************************/
896 /* The SSL library functions call this from time to time to indicate what they
897 are doing. We copy the string to the debugging output when TLS debugging has
909 info_callback(SSL *s, int where, int ret)
915 if (where & SSL_ST_CONNECT)
916 str = US"SSL_connect";
917 else if (where & SSL_ST_ACCEPT)
918 str = US"SSL_accept";
920 str = US"SSL info (undefined)";
922 if (where & SSL_CB_LOOP)
923 debug_printf("%s: %s\n", str, SSL_state_string_long(s));
924 else if (where & SSL_CB_ALERT)
925 debug_printf("SSL3 alert %s:%s:%s\n",
926 str = where & SSL_CB_READ ? US"read" : US"write",
927 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
928 else if (where & SSL_CB_EXIT)
931 debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
933 debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
935 else if (where & SSL_CB_HANDSHAKE_START)
936 debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
937 else if (where & SSL_CB_HANDSHAKE_DONE)
938 debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s));
942 #ifdef OPENSSL_HAVE_KEYLOG_CB
944 keylog_callback(const SSL *ssl, const char *line)
948 DEBUG(D_tls) debug_printf("%.200s\n", line);
949 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
950 if (!(fp = fopen(filename, "a"))) return;
951 fprintf(fp, "%s\n", line);
960 #ifndef DISABLE_EVENT
962 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
963 BOOL *calledp, const BOOL *optionalp, const uschar * what)
969 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
972 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
973 old_cert = tlsp->peercert;
974 tlsp->peercert = X509_dup(cert);
975 /* NB we do not bother setting peerdn */
976 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
978 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
979 "depth=%d cert=%s: %s",
980 tlsp == &tls_out ? deliver_host_address : sender_host_address,
981 what, depth, dn, yield);
985 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
986 return 1; /* reject (leaving peercert set) */
988 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
989 "(host in tls_try_verify_hosts)\n");
990 tlsp->verify_override = TRUE;
992 X509_free(tlsp->peercert);
993 tlsp->peercert = old_cert;
999 /*************************************************
1000 * Callback for verification *
1001 *************************************************/
1003 /* The SSL library does certificate verification if set up to do so. This
1004 callback has the current yes/no state is in "state". If verification succeeded,
1005 we set the certificate-verified flag. If verification failed, what happens
1006 depends on whether the client is required to present a verifiable certificate
1009 If verification is optional, we change the state to yes, but still log the
1010 verification error. For some reason (it really would help to have proper
1011 documentation of OpenSSL), this callback function then gets called again, this
1012 time with state = 1. We must take care not to set the private verified flag on
1013 the second time through.
1015 Note: this function is not called if the client fails to present a certificate
1016 when asked. We get here only if a certificate has been received. Handling of
1017 optional verification for this case is done when requesting SSL to verify, by
1018 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
1020 May be called multiple times for different issues with a certificate, even
1021 for a given "depth" in the certificate chain.
1024 preverify_ok current yes/no state as 1/0
1025 x509ctx certificate information.
1026 tlsp per-direction (client vs. server) support data
1027 calledp has-been-called flag
1028 optionalp verification-is-optional flag
1030 Returns: 0 if verification should fail, otherwise 1
1034 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1035 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1037 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1038 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1041 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1043 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1044 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1045 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1048 dn[sizeof(dn)-1] = '\0';
1050 tlsp->verify_override = FALSE;
1051 if (preverify_ok == 0)
1053 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1054 *verify_mode, sender_host_address)
1056 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1057 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1059 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1063 if (!tlsp->peercert)
1064 tlsp->peercert = X509_dup(cert); /* record failing cert */
1065 return 0; /* reject */
1067 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1068 "tls_try_verify_hosts)\n");
1069 tlsp->verify_override = TRUE;
1072 else if (depth != 0)
1074 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1075 #ifndef DISABLE_OCSP
1076 if (tlsp == &tls_out && client_static_state->u_ocsp.client.verify_store)
1077 { /* client, wanting stapling */
1078 /* Add the server cert's signing chain as the one
1079 for the verification of the OCSP stapled information. */
1081 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1084 sk_X509_push(client_static_state->verify_stack, cert);
1087 #ifndef DISABLE_EVENT
1088 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1089 return 0; /* reject, with peercert set */
1094 const uschar * verify_cert_hostnames;
1096 if ( tlsp == &tls_out
1097 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1098 /* client, wanting hostname check */
1101 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1102 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1103 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1105 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1106 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1109 const uschar * list = verify_cert_hostnames;
1112 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1113 if ((rc = X509_check_host(cert, CCS name, 0,
1114 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1115 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1120 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1121 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1128 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1131 uschar * extra = verify_mode
1132 ? string_sprintf(" (during %c-verify for [%s])",
1133 *verify_mode, sender_host_address)
1135 log_write(0, LOG_MAIN,
1136 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1137 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1138 extra, dn, verify_cert_hostnames);
1142 if (!tlsp->peercert)
1143 tlsp->peercert = X509_dup(cert); /* record failing cert */
1144 return 0; /* reject */
1146 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1147 "tls_try_verify_hosts)\n");
1148 tlsp->verify_override = TRUE;
1152 #ifndef DISABLE_EVENT
1153 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1154 return 0; /* reject, with peercert set */
1157 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1158 *calledp ? "" : " authenticated", dn);
1162 return 1; /* accept, at least for this level */
1166 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1168 return verify_callback(preverify_ok, x509ctx, &tls_out,
1169 &client_verify_callback_called, &client_verify_optional);
1173 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1175 return verify_callback(preverify_ok, x509ctx, &tls_in,
1176 &server_verify_callback_called, &server_verify_optional);
1182 /* This gets called *by* the dane library verify callback, which interposes
1186 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1188 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1190 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1191 #ifndef DISABLE_EVENT
1192 BOOL dummy_called, optional = FALSE;
1195 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1197 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1198 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1199 deliver_host_address);
1202 dn[sizeof(dn)-1] = '\0';
1204 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1205 preverify_ok ? "ok":"BAD", depth, dn);
1207 #ifndef DISABLE_EVENT
1208 if (verify_event(&tls_out, cert, depth, dn,
1209 &dummy_called, &optional, US"DANE"))
1210 return 0; /* reject, with peercert set */
1213 if (preverify_ok == 1)
1215 tls_out.dane_verified = TRUE;
1216 #ifndef DISABLE_OCSP
1217 if (client_static_state->u_ocsp.client.verify_store)
1218 { /* client, wanting stapling */
1219 /* Add the server cert's signing chain as the one
1220 for the verification of the OCSP stapled information. */
1222 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1225 sk_X509_push(client_static_state->verify_stack, cert);
1231 int err = X509_STORE_CTX_get_error(x509ctx);
1233 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1234 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1237 return preverify_ok;
1240 #endif /*SUPPORT_DANE*/
1243 #ifndef DISABLE_OCSP
1244 /*************************************************
1245 * Load OCSP information into state *
1246 *************************************************/
1247 /* Called to load the server OCSP response from the given file into memory, once
1248 caller has determined this is needed. Checks validity. Debugs a message
1251 ASSUMES: single response, for single cert.
1254 state various parts of session state
1255 filename the filename putatively holding an OCSP response
1256 is_pem file is PEM format; otherwise is DER
1260 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1264 OCSP_RESPONSE * resp;
1265 OCSP_BASICRESP * basic_response;
1266 OCSP_SINGLERESP * single_response;
1267 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1268 STACK_OF(X509) * sk;
1269 unsigned long verify_flags;
1270 int status, reason, i;
1273 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1275 if (!filename || !*filename) return;
1278 if (!(bio = BIO_new_file(CS filename, "rb")))
1280 log_write(0, LOG_MAIN|LOG_PANIC,
1281 "Failed to open OCSP response file \"%s\": %.100s",
1282 filename, ERR_reason_error_string(ERR_get_error()));
1288 uschar * data, * freep;
1291 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1293 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
1294 filename, ERR_reason_error_string(ERR_get_error()));
1298 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1299 OPENSSL_free(freep);
1302 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1307 log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
1308 filename, ERR_reason_error_string(ERR_get_error()));
1312 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1314 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1315 OCSP_response_status_str(status), status);
1321 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1322 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1327 if (!(basic_response = OCSP_response_get1_basic(resp)))
1330 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1334 sk = state->verify_stack;
1335 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1337 /* May need to expose ability to adjust those flags?
1338 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1339 OCSP_TRUSTOTHER OCSP_NOINTERN */
1341 /* This does a full verify on the OCSP proof before we load it for serving
1342 up; possibly overkill - just date-checks might be nice enough.
1344 OCSP_basic_verify takes a "store" arg, but does not
1345 use it for the chain verification, which is all we do
1346 when OCSP_NOVERIFY is set. The content from the wire
1347 "basic_response" and a cert-stack "sk" are all that is used.
1349 We have a stack, loaded in setup_certs() if tls_verify_certificates
1350 was a file (not a directory, or "system"). It is unfortunate we
1351 cannot used the connection context store, as that would neatly
1352 handle the "system" case too, but there seems to be no library
1353 function for getting a stack from a store.
1354 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1355 We do not free the stack since it could be needed a second time for
1358 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1359 be a public interface into the OpenSSL library (there's no manual entry) -
1360 But what with? We also use OCSP_basic_verify in the client stapling callback.
1361 And there we NEED it; we must verify that status... unless the
1362 library does it for us anyway? */
1364 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
1368 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1369 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
1374 /* Here's the simplifying assumption: there's only one response, for the
1375 one certificate we use, and nothing for anything else in a chain. If this
1376 proves false, we need to extract a cert id from our issued cert
1377 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1378 right cert in the stack and then calls OCSP_single_get0_status()).
1380 I'm hoping to avoid reworking a bunch more of how we handle state here.
1382 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1385 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1388 debug_printf("Unable to get first response from OCSP basic response.\n");
1392 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1393 if (status != V_OCSP_CERTSTATUS_GOOD)
1395 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1396 OCSP_cert_status_str(status), status,
1397 OCSP_crl_reason_str(reason), reason);
1401 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1403 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
1408 /* Add the resp to the list used by tls_server_stapling_cb() */
1410 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1411 while (oentry = *op)
1413 *op = oentry = store_get(sizeof(ocsp_resplist), FALSE);
1414 oentry->next = NULL;
1415 oentry->resp = resp;
1420 if (f.running_in_test_harness)
1422 extern char ** environ;
1423 if (environ) for (uschar ** p = USS environ; *p; p++)
1424 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1426 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1427 goto supply_response;
1435 ocsp_free_response_list(exim_openssl_state_st * cbinfo)
1437 for (ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; olist;
1438 olist = olist->next)
1439 OCSP_RESPONSE_free(olist->resp);
1440 cbinfo->u_ocsp.server.olist = NULL;
1442 #endif /*!DISABLE_OCSP*/
1449 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1452 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1453 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1454 return tls_error(string_sprintf(
1455 "SSL_CTX_use_certificate_chain_file file=%s", file),
1456 cbinfo->host, NULL, errstr);
1461 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1464 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1465 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1466 return tls_error(string_sprintf(
1467 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1474 /* Called once during tls_init and possibly again during TLS setup, for a
1475 new context, if Server Name Indication was used and tls_sni was seen in
1476 the certificate string.
1479 sctx the SSL_CTX* to update
1480 state various parts of session state
1481 errstr error string pointer
1483 Returns: OK/DEFER/FAIL
1487 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1492 if (!state->certificate)
1494 if (!state->is_server) /* client */
1497 if (tls_install_selfsign(sctx, errstr) != OK)
1504 if ( !reexpand_tls_files_for_sni
1505 && ( Ustrstr(state->certificate, US"tls_sni")
1506 || Ustrstr(state->certificate, US"tls_in_sni")
1507 || Ustrstr(state->certificate, US"tls_out_sni")
1509 reexpand_tls_files_for_sni = TRUE;
1511 if (!expand_check(state->certificate, US"tls_certificate", &expanded, errstr))
1515 if (state->is_server)
1517 const uschar * file_list = expanded;
1520 #ifndef DISABLE_OCSP
1521 const uschar * olist = state->u_ocsp.server.file;
1524 BOOL fmt_pem = FALSE;
1527 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1529 if (olist && !*olist)
1532 if ( state->u_ocsp.server.file_expanded && olist
1533 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1535 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1540 ocsp_free_response_list(state);
1541 state->u_ocsp.server.file_expanded = olist;
1545 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1547 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1550 #ifndef DISABLE_OCSP
1552 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1554 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1559 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1564 ocsp_load_response(state, ofile, fmt_pem);
1567 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1571 else /* would there ever be a need for multiple client certs? */
1572 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1575 if ( state->privatekey
1576 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr))
1579 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1580 of the expansion is an empty string, ignore it also, and assume the private
1581 key is in the same file as the certificate. */
1583 if (expanded && *expanded)
1584 if (state->is_server)
1586 const uschar * file_list = expanded;
1590 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1591 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1594 else /* would there ever be a need for multiple client certs? */
1595 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1605 /**************************************************
1606 * One-time init credentials for server and client *
1607 **************************************************/
1610 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1611 uschar * ciphers, uschar ** errstr)
1613 for (uschar * s = ciphers; *s; s++ ) if (*s == '_') *s = '-';
1614 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1615 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1616 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1617 state->server_cipher_list = ciphers;
1624 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1627 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1628 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1630 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1632 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1634 /* Set up the information callback, which outputs if debugging is at a suitable
1639 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1640 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1641 /* this needs a debug build of OpenSSL */
1642 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
1644 #ifdef OPENSSL_HAVE_KEYLOG_CB
1645 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
1649 /* Automatically re-try reads/writes after renegotiation. */
1650 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1657 tls_server_creds_init(void)
1660 uschar * dummy_errstr;
1661 unsigned lifetime = 0;
1665 state_server.lib_state = null_tls_preload;
1667 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1669 state_server.lib_state.lib_ctx = ctx;
1671 /* Preload DH params and EC curve */
1673 if (opt_unset_or_noexpand(tls_dhparam))
1675 DEBUG(D_tls) debug_printf("TLS: preloading DH params for server\n");
1676 if (init_dh(ctx, tls_dhparam, NULL, &dummy_errstr))
1677 state_server.lib_state.dh = TRUE;
1679 if (opt_unset_or_noexpand(tls_eccurve))
1681 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for server\n");
1682 if (init_ecdh(ctx, NULL, &dummy_errstr))
1683 state_server.lib_state.ecdh = TRUE;
1686 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1687 /* If we can, preload the server-side cert, key and ocsp */
1689 if ( opt_set_and_noexpand(tls_certificate)
1690 # ifndef DISABLE_OCSP
1691 && opt_unset_or_noexpand(tls_ocsp_file)
1693 && opt_unset_or_noexpand(tls_privatekey))
1695 /* Set watches on the filenames. The implementation does de-duplication
1696 so we can just blindly do them all. */
1698 if ( tls_set_watch(tls_certificate, TRUE)
1699 # ifndef DISABLE_OCSP
1700 && tls_set_watch(tls_ocsp_file, TRUE)
1702 && tls_set_watch(tls_privatekey, TRUE))
1704 state_server.certificate = tls_certificate;
1705 state_server.privatekey = tls_privatekey;
1706 #ifndef DISABLE_OCSP
1707 state_server.u_ocsp.server.file = tls_ocsp_file;
1710 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1711 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1712 state_server.lib_state.conn_certs = TRUE;
1715 else if ( !tls_certificate && !tls_privatekey
1716 # ifndef DISABLE_OCSP
1720 { /* Generate & preload a selfsigned cert. No files to watch. */
1721 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1723 state_server.lib_state.conn_certs = TRUE;
1724 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1728 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1731 /* If we can, preload the Authorities for checking client certs against.
1732 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1733 at TLS conn startup */
1735 if ( opt_set_and_noexpand(tls_verify_certificates)
1736 && opt_unset_or_noexpand(tls_crl))
1738 /* Watch the default dir also as they are always included */
1740 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1741 && tls_set_watch(tls_verify_certificates, FALSE)
1742 && tls_set_watch(tls_crl, FALSE))
1744 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1746 if (setup_certs(ctx, tls_verify_certificates, tls_crl, NULL, &dummy_errstr)
1748 state_server.lib_state.cabundle = TRUE;
1752 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1753 #endif /* EXIM_HAVE_INOTIFY */
1756 /* If we can, preload the ciphers control string */
1758 if (opt_set_and_noexpand(tls_require_ciphers))
1760 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1761 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1762 &dummy_errstr) == OK)
1763 state_server.lib_state.pri_string = TRUE;
1766 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1773 /* Preload whatever creds are static, onto a transport. The client can then
1774 just copy the pointer as it starts up.
1775 Called from the daemon after a cache-invalidate with watch set; called from
1776 a queue-run startup with watch clear. */
1779 tls_client_creds_init(transport_instance * t, BOOL watch)
1781 smtp_transport_options_block * ob = t->options_block;
1782 exim_openssl_state_st tpt_dummy_state;
1783 host_item * dummy_host = (host_item *)1;
1784 uschar * dummy_errstr;
1789 ob->tls_preload = null_tls_preload;
1790 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1792 ob->tls_preload.lib_ctx = ctx;
1794 tpt_dummy_state.lib_state = ob->tls_preload;
1796 if (opt_unset_or_noexpand(tls_dhparam))
1798 DEBUG(D_tls) debug_printf("TLS: preloading DH params for transport '%s'\n", t->name);
1799 if (init_dh(ctx, tls_dhparam, NULL, &dummy_errstr))
1800 ob->tls_preload.dh = TRUE;
1802 if (opt_unset_or_noexpand(tls_eccurve))
1804 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for transport '%s'\n", t->name);
1805 if (init_ecdh(ctx, NULL, &dummy_errstr))
1806 ob->tls_preload.ecdh = TRUE;
1809 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1810 if ( opt_set_and_noexpand(ob->tls_certificate)
1811 && opt_unset_or_noexpand(ob->tls_privatekey))
1814 || ( tls_set_watch(ob->tls_certificate, FALSE)
1815 && tls_set_watch(ob->tls_privatekey, FALSE)
1818 uschar * pkey = ob->tls_privatekey;
1821 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1823 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1825 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1826 pkey ? pkey : ob->tls_certificate,
1829 ob->tls_preload.conn_certs = TRUE;
1834 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1837 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1838 && opt_unset_or_noexpand(ob->tls_crl))
1841 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1842 && tls_set_watch(ob->tls_verify_certificates, FALSE)
1843 && tls_set_watch(ob->tls_crl, FALSE)
1847 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1849 if (setup_certs(ctx, ob->tls_verify_certificates,
1850 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
1851 ob->tls_preload.cabundle = TRUE;
1856 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1858 #endif /*EXIM_HAVE_INOTIFY*/
1862 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1863 /* Invalidate the creds cached, by dropping the current ones.
1864 Call when we notice one of the source files has changed. */
1867 tls_server_creds_invalidate(void)
1869 SSL_CTX_free(state_server.lib_state.lib_ctx);
1870 state_server.lib_state = null_tls_preload;
1875 tls_client_creds_invalidate(transport_instance * t)
1877 smtp_transport_options_block * ob = t->options_block;
1878 SSL_CTX_free(ob->tls_preload.lib_ctx);
1879 ob->tls_preload = null_tls_preload;
1885 tls_server_creds_invalidate(void)
1889 tls_client_creds_invalidate(transport_instance * t)
1892 #endif /*EXIM_HAVE_INOTIFY*/
1896 #ifndef DISABLE_OCSP
1898 x509_store_dump_cert_s_names(X509_STORE * store)
1900 STACK_OF(X509_OBJECT) * roots= store->objs;
1901 static uschar name[256];
1903 for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
1905 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
1906 if(tmp_obj->type == X509_LU_X509)
1908 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
1909 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
1911 name[sizeof(name)-1] = '\0';
1912 debug_printf(" %s\n", name);
1921 #ifndef DISABLE_TLS_RESUME
1922 /* Manage the keysets used for encrypting the session tickets, on the server. */
1924 typedef struct { /* Session ticket encryption key */
1927 const EVP_CIPHER * aes_cipher;
1928 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
1929 const EVP_MD * hmac_hash;
1930 uschar hmac_key[16];
1935 static exim_stek exim_tk; /* current key */
1936 static exim_stek exim_tk_old; /* previous key */
1941 time_t t = time(NULL);
1943 if (exim_tk.name[0])
1945 if (exim_tk.renew >= t) return;
1946 exim_tk_old = exim_tk;
1949 if (f.running_in_test_harness) ssl_session_timeout = 6;
1951 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
1952 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
1953 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
1954 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
1956 exim_tk.name[0] = 'E';
1957 exim_tk.aes_cipher = EVP_aes_256_cbc();
1958 exim_tk.hmac_hash = EVP_sha256();
1959 exim_tk.expire = t + ssl_session_timeout;
1960 exim_tk.renew = t + ssl_session_timeout/2;
1966 if (!exim_tk.name[0]) return NULL;
1971 tk_find(const uschar * name)
1973 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
1974 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
1978 /* Callback for session tickets, on server */
1980 ticket_key_callback(SSL * ssl, uschar key_name[16],
1981 uschar * iv, EVP_CIPHER_CTX * c_ctx, HMAC_CTX * hctx, int enc)
1983 tls_support * tlsp = state_server.tlsp;
1988 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
1989 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
1991 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
1992 return -1; /* insufficient random */
1994 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
1995 return 0; /* key couldn't be created */
1996 memcpy(key_name, key->name, 16);
1997 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
1999 /*XXX will want these dependent on the ssl session strength */
2000 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2001 key->hmac_hash, NULL);
2002 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2004 DEBUG(D_tls) debug_printf("ticket created\n");
2009 time_t now = time(NULL);
2011 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
2012 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2014 if (!(key = tk_find(key_name)) || key->expire < now)
2018 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
2019 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
2024 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2025 key->hmac_hash, NULL);
2026 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2028 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2030 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2031 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2032 be better. To do that we'd have to encode ticket lifetime in the name as
2033 we don't yet see the restored session. Could check posthandshake for TLS1.3
2034 and trigger a new ticket then, but cannot do that for TLS1.2 */
2035 return key->renew < now ? 2 : 1;
2043 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2044 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2046 /* If verification is optional, don't fail if no certificate */
2048 SSL_CTX_set_verify(ctx,
2049 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2054 /*************************************************
2055 * Callback to handle SNI *
2056 *************************************************/
2058 /* Called when acting as server during the TLS session setup if a Server Name
2059 Indication extension was sent by the client.
2061 API documentation is OpenSSL s_server.c implementation.
2064 s SSL* of the current session
2065 ad unknown (part of OpenSSL API) (unused)
2066 arg Callback of "our" registered data
2068 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2070 XXX might need to change to using ClientHello callback,
2071 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2074 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2076 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
2078 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2079 exim_openssl_state_st *state = (exim_openssl_state_st *) arg;
2081 int old_pool = store_pool;
2082 uschar * dummy_errstr;
2085 return SSL_TLSEXT_ERR_OK;
2087 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2088 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2090 /* Make the extension value available for expansion */
2091 store_pool = POOL_PERM;
2092 tls_in.sni = string_copy_taint(US servername, TRUE);
2093 store_pool = old_pool;
2095 if (!reexpand_tls_files_for_sni)
2096 return SSL_TLSEXT_ERR_OK;
2098 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2099 not confident that memcpy wouldn't break some internal reference counting.
2100 Especially since there's a references struct member, which would be off. */
2102 if (lib_ctx_new(&server_sni, NULL, &dummy_errstr) != OK)
2105 /* Not sure how many of these are actually needed, since SSL object
2106 already exists. Might even need this selfsame callback, for reneg? */
2109 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2110 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2111 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2112 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2113 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2114 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2115 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2118 if ( !init_dh(server_sni, state->dhparam, NULL, &dummy_errstr)
2119 || !init_ecdh(server_sni, NULL, &dummy_errstr)
2123 if ( state->server_cipher_list
2124 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2127 #ifndef DISABLE_OCSP
2128 if (state->u_ocsp.server.file)
2130 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2131 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2137 if ( !expand_check(tls_verify_certificates, US"tls_verify_certificates",
2138 &expcerts, &dummy_errstr)
2139 || (rc = setup_certs(server_sni, expcerts, tls_crl, NULL,
2140 &dummy_errstr)) != OK)
2143 if (expcerts && *expcerts)
2144 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2147 /* do this after setup_certs, because this can require the certs for verifying
2148 OCSP information. */
2149 if ((rc = tls_expand_session_files(server_sni, state, &dummy_errstr)) != OK)
2152 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2153 SSL_set_SSL_CTX(s, server_sni);
2154 return SSL_TLSEXT_ERR_OK;
2156 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
2158 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2163 #ifdef EXIM_HAVE_ALPN
2164 /*************************************************
2165 * Callback to handle ALPN *
2166 *************************************************/
2168 /* Called on server if tls_alpn nonblank after expansion,
2169 when client offers ALPN, after the SNI callback.
2170 If set and not matching the list then we dump the connection */
2173 tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen,
2174 const uschar * in, unsigned int inlen, void * arg)
2176 server_seen_alpn = TRUE;
2179 debug_printf("Received TLS ALPN offer:");
2180 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2183 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2184 debug_printf(" '%.*s'", siz, in + pos + 1);
2186 debug_printf(". Our list: '%s'\n", tls_alpn);
2189 /* Look for an acceptable ALPN */
2191 if ( inlen > 1 /* at least one name */
2192 && in[0]+1 == inlen /* filling the vector, so exactly one name */
2195 const uschar * list = tls_alpn;
2197 for (uschar * name; name = string_nextinlist(&list, &sep, NULL, 0); )
2198 if (Ustrncmp(in+1, name, in[0]) == 0)
2200 *out = in+1; /* we checked for exactly one, so can just point to it */
2202 return SSL_TLSEXT_ERR_OK; /* use ALPN */
2206 /* More than one name from clilent, or name did not match our list. */
2208 /* This will be fatal to the TLS conn; would be nice to kill TCP also.
2209 Maybe as an option in future; for now leave control to the config (must-tls). */
2211 DEBUG(D_tls) debug_printf("TLS ALPN rejected\n");
2212 return SSL_TLSEXT_ERR_ALERT_FATAL;
2214 #endif /* EXIM_HAVE_ALPN */
2218 #ifndef DISABLE_OCSP
2220 /*************************************************
2221 * Callback to handle OCSP Stapling *
2222 *************************************************/
2224 /* Called when acting as server during the TLS session setup if the client
2225 requests OCSP information with a Certificate Status Request.
2227 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2233 tls_server_stapling_cb(SSL *s, void *arg)
2235 const exim_openssl_state_st * state = arg;
2236 ocsp_resplist * olist = state->u_ocsp.server.olist;
2237 uschar * response_der; /*XXX blob */
2238 int response_der_len;
2241 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2242 olist ? "have" : "lack");
2244 tls_in.ocsp = OCSP_NOT_RESP;
2246 return SSL_TLSEXT_ERR_NOACK;
2248 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
2250 const X509 * cert_sent = SSL_get_certificate(s);
2251 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2252 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2254 for (; olist; olist = olist->next)
2256 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2257 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2258 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2259 ASN1_INTEGER * res_cert_serial;
2260 const BIGNUM * resp_bn;
2261 ASN1_OCTET_STRING * res_cert_iNameHash;
2264 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2265 (OCSP_CERTID *) cid);
2266 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2270 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2271 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2274 if (BN_cmp(cert_bn, resp_bn) == 0)
2276 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2278 /*XXX TODO: check the rest of the list for duplicate matches.
2279 If any, need to also check the Issuer Name hash.
2280 Without this, we will provide the wrong status in the case of
2285 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2289 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2290 return SSL_TLSEXT_ERR_NOACK;
2296 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2297 return SSL_TLSEXT_ERR_NOACK;
2301 /*XXX could we do the i2d earlier, rather than during the callback? */
2302 response_der = NULL;
2303 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2304 if (response_der_len <= 0)
2305 return SSL_TLSEXT_ERR_NOACK;
2307 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2308 response_der, response_der_len);
2309 tls_in.ocsp = OCSP_VFIED;
2310 return SSL_TLSEXT_ERR_OK;
2315 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
2317 BIO_printf(bp, "\t%s: ", str);
2318 ASN1_GENERALIZEDTIME_print(bp, time);
2323 tls_client_stapling_cb(SSL *s, void *arg)
2325 exim_openssl_state_st * cbinfo = arg;
2326 const unsigned char * p;
2328 OCSP_RESPONSE * rsp;
2329 OCSP_BASICRESP * bs;
2332 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2333 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
2336 /* Expect this when we requested ocsp but got none */
2337 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2338 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2340 DEBUG(D_tls) debug_printf(" null\n");
2341 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2344 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2346 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2347 if (LOGGING(tls_cipher))
2348 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2350 DEBUG(D_tls) debug_printf(" parse error\n");
2354 if (!(bs = OCSP_response_get1_basic(rsp)))
2356 tls_out.ocsp = OCSP_FAILED;
2357 if (LOGGING(tls_cipher))
2358 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2360 DEBUG(D_tls) debug_printf(" error parsing response\n");
2361 OCSP_RESPONSE_free(rsp);
2365 /* We'd check the nonce here if we'd put one in the request. */
2366 /* However that would defeat cacheability on the server so we don't. */
2368 /* This section of code reworked from OpenSSL apps source;
2369 The OpenSSL Project retains copyright:
2370 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2374 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2375 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2378 DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
2380 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2382 /* Use the chain that verified the server cert to verify the stapled info */
2383 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
2385 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
2386 cbinfo->u_ocsp.client.verify_store, OCSP_NOEXPLICIT)) <= 0)
2387 if (ERR_peek_error())
2389 tls_out.ocsp = OCSP_FAILED;
2390 if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
2391 "Received TLS cert status response, itself unverifiable: %s",
2392 ERR_reason_error_string(ERR_peek_error()));
2393 BIO_printf(bp, "OCSP response verify failure\n");
2394 ERR_print_errors(bp);
2395 OCSP_RESPONSE_print(bp, rsp, 0);
2399 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2400 " in the root CA certificate; ignoring\n");
2402 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2404 /*XXX So we have a good stapled OCSP status. How do we know
2405 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2406 OCSP_resp_find_status() which matches on a cert id, which presumably
2407 we should use. Making an id needs OCSP_cert_id_new(), which takes
2408 issuerName, issuerKey, serialNumber. Are they all in the cert?
2410 For now, carry on blindly accepting the resp. */
2413 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2414 OCSP_resp_count(bs) - 1;
2416 sk_OCSP_SINGLERESP_num(sresp) - 1;
2420 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2422 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2424 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2425 - but what happens with a GnuTLS-style input?
2427 we could do with a debug label for each singleresp
2428 - it has a certID with a serialNumber, but I see no API to get that
2430 status = OCSP_single_get0_status(single, &reason, &rev,
2431 &thisupd, &nextupd);
2433 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
2434 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
2435 if (!OCSP_check_validity(thisupd, nextupd,
2436 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2438 tls_out.ocsp = OCSP_FAILED;
2439 DEBUG(D_tls) ERR_print_errors(bp);
2440 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
2444 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2445 OCSP_cert_status_str(status));
2448 case V_OCSP_CERTSTATUS_GOOD:
2449 continue; /* the idx loop */
2450 case V_OCSP_CERTSTATUS_REVOKED:
2451 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2452 reason != -1 ? "; reason: " : "",
2453 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2454 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2457 log_write(0, LOG_MAIN,
2458 "Server certificate status unknown, in OCSP stapling");
2466 tls_out.ocsp = OCSP_VFIED;
2470 tls_out.ocsp = OCSP_FAILED;
2471 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2476 OCSP_RESPONSE_free(rsp);
2479 #endif /*!DISABLE_OCSP*/
2482 /*************************************************
2483 * Initialize for TLS *
2484 *************************************************/
2485 /* Called from both server and client code, to do preliminary initialization
2486 of the library. We allocate and return a context structure.
2489 host connected host, if client; NULL if server
2490 ob transport options block, if client; NULL if server
2491 ocsp_file file of stapling info (server); flag for require ocsp (client)
2492 addr address if client; NULL if server (for some randomness)
2493 caller_state place to put pointer to allocated state-struct
2494 errstr error string pointer
2496 Returns: OK/DEFER/FAIL
2500 tls_init(host_item * host, smtp_transport_options_block * ob,
2501 #ifndef DISABLE_OCSP
2504 address_item *addr, exim_openssl_state_st ** caller_state,
2509 exim_openssl_state_st * state;
2512 if (host) /* client */
2514 state = store_malloc(sizeof(exim_openssl_state_st));
2515 memset(state, 0, sizeof(*state));
2516 state->certificate = ob->tls_certificate;
2517 state->privatekey = ob->tls_privatekey;
2518 state->is_server = FALSE;
2519 state->dhparam = NULL;
2520 state->lib_state = ob->tls_preload;
2524 state = &state_server;
2525 state->certificate = tls_certificate;
2526 state->privatekey = tls_privatekey;
2527 state->is_server = TRUE;
2528 state->dhparam = tls_dhparam;
2529 state->lib_state = state_server.lib_state;
2535 if (!state->lib_state.pri_string)
2536 state->server_cipher_list = NULL;
2538 #ifndef DISABLE_EVENT
2539 state->event_action = NULL;
2544 /* It turns out that we need to seed the random number generator this early in
2545 order to get the full complement of ciphers to work. It took me roughly a day
2546 of work to discover this by experiment.
2548 On systems that have /dev/urandom, SSL may automatically seed itself from
2549 there. Otherwise, we have to make something up as best we can. Double check
2552 Although we likely called this before, at daemon startup, this is a chance
2553 to mix in further variable info (time, pid) if needed. */
2555 if (!lib_rand_init(addr))
2556 return tls_error(US"RAND_status", host,
2557 US"unable to seed random number generator", errstr);
2559 /* Apply administrator-supplied work-arounds.
2560 Historically we applied just one requested option,
2561 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2562 moved to an administrator-controlled list of options to specify and
2563 grandfathered in the first one as the default value for "openssl_options".
2565 No OpenSSL version number checks: the options we accept depend upon the
2566 availability of the option value macros from OpenSSL. */
2569 if (!tls_openssl_options_parse(openssl_options, &init_options))
2570 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2572 /* Create a context.
2573 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2574 negotiation in the different methods; as far as I can tell, the only
2575 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2576 when OpenSSL is built without SSLv2 support.
2577 By disabling with openssl_options, we can let admins re-enable with the
2580 if (!(ctx = state->lib_state.lib_ctx))
2582 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2584 state->lib_state.lib_ctx = ctx;
2587 #ifndef DISABLE_TLS_RESUME
2588 tlsp->resumption = RESUME_SUPPORTED;
2592 #ifndef DISABLE_TLS_RESUME
2593 /* Should the server offer session resumption? */
2594 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2596 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2597 init_options &= ~SSL_OP_NO_TICKET;
2598 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2599 tlsp->host_resumable = TRUE;
2603 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
2604 if (!(SSL_CTX_set_options(ctx, init_options)))
2605 return tls_error(string_sprintf(
2606 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2609 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2611 /* We'd like to disable session cache unconditionally, but foolish Outlook
2612 Express clients then give up the first TLS connection and make a second one
2613 (which works). Only when there is an IMAP service on the same machine.
2614 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2615 now, until we work out a decent way of presenting control to the config. It
2616 will never be used because we use a new context every time. */
2618 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2621 /* Initialize with DH parameters if supplied */
2622 /* Initialize ECDH temp key parameter selection */
2624 if (state->lib_state.dh)
2625 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2627 if (!init_dh(ctx, state->dhparam, host, errstr)) return DEFER;
2629 if (state->lib_state.ecdh)
2630 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
2632 if (!init_ecdh(ctx, host, errstr)) return DEFER;
2634 /* Set up certificate and key (and perhaps OCSP info) */
2636 if (state->lib_state.conn_certs)
2639 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
2643 #ifndef DISABLE_OCSP
2646 state->u_ocsp.server.file = ocsp_file;
2647 state->u_ocsp.server.file_expanded = NULL;
2648 state->u_ocsp.server.olist = NULL;
2651 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
2654 /* If we need to handle SNI or OCSP, do so */
2656 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2657 # ifndef DISABLE_OCSP
2658 if (!(state->verify_stack = sk_X509_new_null()))
2660 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2665 if (!host) /* server */
2667 # ifndef DISABLE_OCSP
2668 /* We check u_ocsp.server.file, not server.olist, because we care about if
2669 the option exists, not what the current expansion might be, as SNI might
2670 change the certificate and OCSP file in use between now and the time the
2671 callback is invoked. */
2672 if (state->u_ocsp.server.file)
2674 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2675 SSL_CTX_set_tlsext_status_arg(ctx, state);
2678 /* We always do this, so that $tls_sni is available even if not used in
2680 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2681 SSL_CTX_set_tlsext_servername_arg(ctx, state);
2683 # ifdef EXIM_HAVE_ALPN
2684 if (tls_alpn && *tls_alpn)
2687 if ( expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr)
2688 && *exp_alpn && !isblank(*exp_alpn))
2690 tls_alpn = exp_alpn; /* subprocess so ok to overwrite */
2691 SSL_CTX_set_alpn_select_cb(ctx, tls_server_alpn_cb, state);
2698 # ifndef DISABLE_OCSP
2700 if(ocsp_file) /* wanting stapling */
2702 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
2704 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2707 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2708 SSL_CTX_set_tlsext_status_arg(ctx, state);
2713 state->verify_cert_hostnames = NULL;
2715 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
2716 /* Set up the RSA callback */
2717 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
2720 /* Finally, set the session cache timeout, and we are done.
2721 The period appears to be also used for (server-generated) session tickets */
2723 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
2724 DEBUG(D_tls) debug_printf("Initialized TLS\n");
2726 *caller_state = state;
2734 /*************************************************
2735 * Get name of cipher in use *
2736 *************************************************/
2739 Argument: pointer to an SSL structure for the connection
2740 pointer to number of bits for cipher
2741 Returns: pointer to allocated string in perm-pool
2745 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
2747 int pool = store_pool;
2748 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
2749 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2750 the accessor functions use const in the prototype. */
2752 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
2755 SSL_CIPHER_get_bits(c, bits);
2757 store_pool = POOL_PERM;
2758 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2760 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2765 /* Get IETF-standard name for ciphersuite.
2766 Argument: pointer to an SSL structure for the connection
2767 Returns: pointer to string
2770 static const uschar *
2771 cipher_stdname_ssl(SSL * ssl)
2773 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2774 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2776 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2777 return cipher_stdname(id >> 8, id & 0xff);
2782 static const uschar *
2783 tlsver_name(SSL * ssl)
2786 int pool = store_pool;
2788 store_pool = POOL_PERM;
2789 s = string_copy(US SSL_get_version(ssl));
2791 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
2792 for (;; p++) if (!(*p = p[1])) break;
2798 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
2800 /*XXX we might consider a list-of-certs variable for the cert chain.
2801 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2802 in list-handling functions, also consider the difference between the entire
2803 chain and the elements sent by the peer. */
2805 tlsp->peerdn = NULL;
2807 /* Will have already noted peercert on a verify fail; possibly not the leaf */
2808 if (!tlsp->peercert)
2809 tlsp->peercert = SSL_get_peer_certificate(ssl);
2810 /* Beware anonymous ciphers which lead to server_cert being NULL */
2812 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2813 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2816 int oldpool = store_pool;
2818 peerdn[siz-1] = '\0'; /* paranoia */
2819 store_pool = POOL_PERM;
2820 tlsp->peerdn = string_copy(peerdn);
2821 store_pool = oldpool;
2823 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2824 but they don't get called on session-resumption. So use the official
2825 interface, which uses the resumed value. Unfortunately this claims verified
2826 when it actually failed but we're in try-verify mode, due to us wanting the
2827 knowlege that it failed so needing to have the callback and forcing a
2828 permissive return. If we don't force it, the TLS startup is failed.
2829 The extra bit of information is set in verify_override in the cb, stashed
2830 for resumption next to the TLS session, and used here. */
2832 if (!tlsp->verify_override)
2833 tlsp->certificate_verified =
2835 tlsp->dane_verified ||
2837 SSL_get_verify_result(ssl) == X509_V_OK;
2845 /*************************************************
2846 * Set up for verifying certificates *
2847 *************************************************/
2849 #ifndef DISABLE_OCSP
2850 /* Load certs from file, return TRUE on success */
2853 chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
2856 STACK_OF(X509) * verify_stack = *vp;
2859 while (sk_X509_num(verify_stack) > 0)
2860 X509_free(sk_X509_pop(verify_stack));
2862 verify_stack = sk_X509_new_null();
2864 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
2865 for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
2866 sk_X509_push(verify_stack, x);
2875 /* Called by both client and server startup; on the server possibly
2876 repeated after a Server Name Indication.
2879 sctx SSL_CTX* to initialise
2880 certs certs file, expanded
2881 crl CRL file or NULL
2882 host NULL in a server; the remote host in a client
2883 errstr error string pointer
2885 Returns: OK/DEFER/FAIL
2889 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
2892 uschar *expcerts, *expcrl;
2894 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
2896 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
2898 if (expcerts && *expcerts)
2900 /* Tell the library to use its compiled-in location for the system default
2901 CA bundle. Then add the ones specified in the config, if any. */
2903 if (!SSL_CTX_set_default_verify_paths(sctx))
2904 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
2906 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
2908 struct stat statbuf;
2910 if (Ustat(expcerts, &statbuf) < 0)
2912 log_write(0, LOG_MAIN|LOG_PANIC,
2913 "failed to stat %s for certificates", expcerts);
2919 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
2920 { file = NULL; dir = expcerts; }
2923 STACK_OF(X509) * verify_stack =
2924 #ifndef DISABLE_OCSP
2925 !host ? state_server.verify_stack :
2928 STACK_OF(X509) ** vp = &verify_stack;
2930 file = expcerts; dir = NULL;
2931 #ifndef DISABLE_OCSP
2932 /* In the server if we will be offering an OCSP proof, load chain from
2933 file for verifying the OCSP proof at load time. */
2935 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
2936 This is inconsistent with the need to verify the OCSP proof of the server cert.
2939 && statbuf.st_size > 0
2940 && state_server.u_ocsp.server.file
2941 && !chain_from_pem_file(file, vp)
2944 log_write(0, LOG_MAIN|LOG_PANIC,
2945 "failed to load cert chain from %s", file);
2951 /* If a certificate file is empty, the load function fails with an
2952 unhelpful error message. If we skip it, we get the correct behaviour (no
2953 certificates are recognized, but the error message is still misleading (it
2954 says no certificate was supplied). But this is better. */
2956 if ( (!file || statbuf.st_size > 0)
2957 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
2958 return tls_error(US"SSL_CTX_load_verify_locations",
2959 host, NULL, errstr);
2961 /* On the server load the list of CAs for which we will accept certs, for
2962 sending to the client. This is only for the one-file
2963 tls_verify_certificates variant.
2964 If a list isn't loaded into the server, but some verify locations are set,
2965 the server end appears to make a wildcard request for client certs.
2966 Meanwhile, the client library as default behaviour *ignores* the list
2967 we send over the wire - see man SSL_CTX_set_client_cert_cb.
2968 Because of this, and that the dir variant is likely only used for
2969 the public-CA bundle (not for a private CA), not worth fixing. */
2973 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
2974 int i = sk_X509_NAME_num(names);
2976 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
2977 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
2978 i, i>1 ? "ies":"y");
2982 debug_printf("Added dir for additional certificate authorities\n");
2986 /* Handle a certificate revocation list. */
2988 #if OPENSSL_VERSION_NUMBER > 0x00907000L
2990 /* This bit of code is now the version supplied by Lars Mainka. (I have
2991 merely reformatted it into the Exim code style.)
2993 "From here I changed the code to add support for multiple crl's
2994 in pem format in one file or to support hashed directory entries in
2995 pem format instead of a file. This method now uses the library function
2996 X509_STORE_load_locations to add the CRL location to the SSL context.
2997 OpenSSL will then handle the verify against CA certs and CRLs by
2998 itself in the verify callback." */
3000 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
3001 if (expcrl && *expcrl)
3003 struct stat statbufcrl;
3004 if (Ustat(expcrl, &statbufcrl) < 0)
3006 log_write(0, LOG_MAIN|LOG_PANIC,
3007 "failed to stat %s for certificates revocation lists", expcrl);
3012 /* is it a file or directory? */
3014 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
3015 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
3019 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
3025 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
3027 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
3028 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
3030 /* setting the flags to check against the complete crl chain */
3032 X509_STORE_set_flags(cvstore,
3033 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
3037 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3045 /*************************************************
3046 * Start a TLS session in a server *
3047 *************************************************/
3048 /* This is called when Exim is running as a server, after having received
3049 the STARTTLS command. It must respond to that command, and then negotiate
3053 errstr pointer to error message
3055 Returns: OK on success
3056 DEFER for errors before the start of the negotiation
3057 FAIL for errors during the negotiation; the server can't
3062 tls_server_start(uschar ** errstr)
3065 uschar * expciphers;
3066 exim_openssl_state_st * dummy_statep;
3069 static uschar peerdn[256];
3071 /* Check for previous activation */
3073 if (tls_in.active.sock >= 0)
3075 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3076 smtp_printf("554 Already in TLS\r\n", FALSE);
3080 /* Initialize the SSL library. If it fails, it will already have logged
3083 rc = tls_init(NULL, NULL,
3084 #ifndef DISABLE_OCSP
3087 NULL, &dummy_statep, &tls_in, errstr);
3088 if (rc != OK) return rc;
3089 ctx = state_server.lib_state.lib_ctx;
3091 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3092 were historically separated by underscores. So that I can use either form in my
3093 tests, and also for general convenience, we turn underscores into hyphens here.
3095 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3096 for TLS 1.3 . Since we do not call it at present we get the default list:
3097 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3100 if (state_server.lib_state.pri_string)
3101 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3104 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3108 && (rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3112 /* If this is a host for which certificate verification is mandatory or
3113 optional, set up appropriately. */
3115 tls_in.certificate_verified = FALSE;
3117 tls_in.dane_verified = FALSE;
3119 server_verify_callback_called = FALSE;
3121 if (verify_check_host(&tls_verify_hosts) == OK)
3122 server_verify_optional = FALSE;
3123 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3124 server_verify_optional = TRUE;
3130 if (!expand_check(tls_verify_certificates, US"tls_verify_certificates",
3133 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3135 if (state_server.lib_state.cabundle)
3136 { DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n"); }
3138 if ((rc = setup_certs(ctx, expcerts, tls_crl, NULL, errstr)) != OK)
3141 if (expcerts && *expcerts)
3142 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3146 #ifndef DISABLE_TLS_RESUME
3147 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3148 /* despite working, appears to always return failure, so ignoring */
3150 #ifdef OPENSSL_HAVE_NUM_TICKETS
3151 # ifndef DISABLE_TLS_RESUME
3152 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3154 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3159 /* Prepare for new connection */
3161 if (!(ssl = SSL_new(ctx)))
3162 return tls_error(US"SSL_new", NULL, NULL, errstr);
3163 state_server.lib_state.lib_ssl = ssl;
3165 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3167 * With the SSL_clear(), we get strange interoperability bugs with
3168 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3169 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3171 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3172 * session shutdown. In this case, we have a brand new object and there's no
3173 * obvious reason to immediately clear it. I'm guessing that this was
3174 * originally added because of incomplete initialisation which the clear fixed,
3175 * in some historic release.
3178 /* Set context and tell client to go ahead, except in the case of TLS startup
3179 on connection, where outputting anything now upsets the clients and tends to
3180 make them disconnect. We need to have an explicit fflush() here, to force out
3181 the response. Other smtp_printf() calls do not need it, because in non-TLS
3182 mode, the fflush() happens when smtp_getc() is called. */
3184 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3185 if (!tls_in.on_connect)
3187 smtp_printf("220 TLS go ahead\r\n", FALSE);
3191 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3192 that the OpenSSL library doesn't. */
3194 SSL_set_wfd(ssl, fileno(smtp_out));
3195 SSL_set_rfd(ssl, fileno(smtp_in));
3196 SSL_set_accept_state(ssl);
3198 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3201 sigalrm_seen = FALSE;
3202 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3203 rc = SSL_accept(ssl);
3208 int error = SSL_get_error(ssl, rc);
3211 case SSL_ERROR_NONE:
3214 case SSL_ERROR_ZERO_RETURN:
3215 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3216 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3218 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3221 tls_close(NULL, TLS_NO_SHUTDOWN);
3224 /* Handle genuine errors */
3228 int r = ERR_GET_REASON(ERR_peek_error());
3229 if ( r == SSL_R_WRONG_VERSION_NUMBER
3230 #ifdef SSL_R_VERSION_TOO_LOW
3231 || r == SSL_R_VERSION_TOO_LOW
3233 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3234 s = string_sprintf("%s (%s)", s, SSL_get_version(ssl));
3235 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
3240 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3241 if (error == SSL_ERROR_SYSCALL)
3245 *errstr = US"SSL_accept: TCP connection closed by peer";
3248 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3250 (void) tls_error(US"SSL_accept", NULL,
3251 sigalrm_seen ? US"timed out"
3252 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3258 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3259 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3260 anon-authentication ciphersuite negotiated. */
3262 #ifndef DISABLE_TLS_RESUME
3263 if (SSL_session_reused(ssl))
3265 tls_in.resumption |= RESUME_USED;
3266 DEBUG(D_tls) debug_printf("Session reused\n");
3270 #ifdef EXIM_HAVE_ALPN
3271 /* If require-alpn, check server_seen_alpn here. Else abort TLS */
3272 if (!tls_alpn || !*tls_alpn)
3273 { DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n"); }
3274 else if (!server_seen_alpn)
3275 if (verify_check_host(&hosts_require_alpn) == OK)
3277 /* We'd like to send a definitive Alert but OpenSSL provides no facility */
3279 tls_error(US"handshake", NULL, US"ALPN required but not negotiated", errstr);
3283 { DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n"); }
3286 const uschar * name;
3288 SSL_get0_alpn_selected(ssl, &name, &len);
3290 debug_printf("ALPN negotiated: '%.*s'\n", (int)*name, name+1);
3292 debug_printf("ALPN: no protocol negotiated\n");
3297 /* TLS has been set up. Record data for the connection,
3298 adjust the input functions to read via TLS, and initialize things. */
3300 #ifdef SSL_get_extms_support
3301 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3303 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3305 tls_in.ver = tlsver_name(ssl);
3306 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3307 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3312 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3313 debug_printf("Shared ciphers: %s\n", buf);
3315 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3317 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
3318 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3323 #ifdef EXIM_HAVE_SESSION_TICKET
3325 SSL_SESSION * ss = SSL_get_session(ssl);
3326 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3327 debug_printf("The session has a ticket, life %lu seconds\n",
3328 SSL_SESSION_get_ticket_lifetime_hint(ss));
3333 /* Record the certificate we presented */
3335 X509 * crt = SSL_get_certificate(ssl);
3336 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3339 /* Channel-binding info for authenticators
3340 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/ */
3343 size_t len = SSL_get_peer_finished(ssl, &c, 0);
3344 int old_pool = store_pool;
3346 SSL_get_peer_finished(ssl, s = store_get((int)len, FALSE), len);
3347 store_pool = POOL_PERM;
3348 tls_in.channelbinding = b64encode_taint(CUS s, (int)len, FALSE);
3349 store_pool = old_pool;
3350 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p\n", tls_in.channelbinding);
3353 /* Only used by the server-side tls (tls_in), including tls_getc.
3354 Client-side (tls_out) reads (seem to?) go via
3355 smtp_read_response()/ip_recv().
3356 Hence no need to duplicate for _in and _out.
3358 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3359 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3360 ssl_xfer_eof = ssl_xfer_error = FALSE;
3362 receive_getc = tls_getc;
3363 receive_getbuf = tls_getbuf;
3364 receive_get_cache = tls_get_cache;
3365 receive_hasc = tls_hasc;
3366 receive_ungetc = tls_ungetc;
3367 receive_feof = tls_feof;
3368 receive_ferror = tls_ferror;
3370 tls_in.active.sock = fileno(smtp_out);
3371 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3379 tls_client_basic_ctx_init(SSL_CTX * ctx,
3380 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3385 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3386 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3387 host patterns if one of them is set with content. */
3389 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3390 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3392 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3393 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3396 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3398 client_verify_optional = FALSE;
3399 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3400 client_verify_optional = TRUE;
3406 if (!expand_check(ob->tls_verify_certificates, US"tls_verify_certificates",
3409 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3411 if (state->lib_state.cabundle)
3412 { DEBUG(D_tls) debug_printf("TLS: CA bundle was preloaded\n"); }
3414 if ((rc = setup_certs(ctx, expcerts, ob->tls_crl, host, errstr)) != OK)
3417 if (expcerts && *expcerts)
3418 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3421 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3423 state->verify_cert_hostnames =
3425 string_domain_utf8_to_alabel(host->certname, NULL);
3429 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3430 state->verify_cert_hostnames);
3438 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3441 const char * hostnames[2] = { CS host->name, NULL };
3444 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3445 return tls_error(US"hostnames load", host, NULL, errstr);
3447 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3448 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3449 ) if (rr->type == T_TLSA && rr->size > 3)
3451 const uschar * p = rr->data;
3452 uint8_t usage, selector, mtype;
3453 const char * mdname;
3457 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3458 if (usage != 2 && usage != 3) continue;
3465 default: continue; /* Only match-types 0, 1, 2 are supported */
3466 case 0: mdname = NULL; break;
3467 case 1: mdname = "sha256"; break;
3468 case 2: mdname = "sha512"; break;
3472 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3475 return tls_error(US"tlsa load", host, NULL, errstr);
3476 case 0: /* action not taken */
3480 tls_out.tlsa_usage |= 1<<usage;
3486 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3489 #endif /*SUPPORT_DANE*/
3493 #ifndef DISABLE_TLS_RESUME
3494 /* On the client, get any stashed session for the given IP from hints db
3495 and apply it to the ssl-connection for attempted resumption. */
3498 tls_retrieve_session(tls_support * tlsp, SSL * ssl, const uschar * key)
3500 tlsp->resumption |= RESUME_SUPPORTED;
3501 if (tlsp->host_resumable)
3503 dbdata_tls_session * dt;
3505 open_db dbblock, * dbm_file;
3507 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3508 DEBUG(D_tls) debug_printf("checking for resumable session for %s\n", key);
3509 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3511 /* key for the db is the IP */
3512 if ((dt = dbfn_read_with_length(dbm_file, key, &len)))
3514 SSL_SESSION * ss = NULL;
3515 const uschar * sess_asn1 = dt->session;
3517 len -= sizeof(dbdata_tls_session);
3518 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3522 ERR_error_string_n(ERR_get_error(),
3523 ssl_errstring, sizeof(ssl_errstring));
3524 debug_printf("decoding session: %s\n", ssl_errstring);
3529 unsigned long lifetime =
3530 #ifdef EXIM_HAVE_SESSION_TICKET
3531 SSL_SESSION_get_ticket_lifetime_hint(ss);
3532 #else /* Use, fairly arbitrilarily, what we as server would */
3533 f.running_in_test_harness ? 6 : ssl_session_timeout;
3535 if (lifetime + dt->time_stamp < time(NULL))
3537 DEBUG(D_tls) debug_printf("session expired\n");
3538 dbfn_delete(dbm_file, key);
3540 else if (!SSL_set_session(ssl, ss))
3544 ERR_error_string_n(ERR_get_error(),
3545 ssl_errstring, sizeof(ssl_errstring));
3546 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3551 DEBUG(D_tls) debug_printf("good session\n");
3552 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3553 tlsp->verify_override = dt->verify_override;
3554 tlsp->ocsp = dt->ocsp;
3559 DEBUG(D_tls) debug_printf("no session record\n");
3560 dbfn_close(dbm_file);
3566 /* On the client, save the session for later resumption */
3569 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3571 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3574 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3576 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3578 # ifdef OPENSSL_HAVE_NUM_TICKETS
3579 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3582 int len = i2d_SSL_SESSION(ss, NULL);
3583 int dlen = sizeof(dbdata_tls_session) + len;
3584 dbdata_tls_session * dt = store_get(dlen, TRUE);
3585 uschar * s = dt->session;
3586 open_db dbblock, * dbm_file;
3588 DEBUG(D_tls) debug_printf("session is resumable\n");
3589 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3591 dt->verify_override = tlsp->verify_override;
3592 dt->ocsp = tlsp->ocsp;
3593 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3595 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3597 const uschar * key = cbinfo->host->address;
3598 dbfn_delete(dbm_file, key);
3599 dbfn_write(dbm_file, key, dt, dlen);
3600 dbfn_close(dbm_file);
3601 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3610 tls_client_ctx_resume_prehandshake(
3611 exim_openssl_client_tls_ctx * exim_client_ctx, tls_support * tlsp,
3612 smtp_transport_options_block * ob, host_item * host)
3614 /* Should the client request a session resumption ticket? */
3615 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3617 tlsp->host_resumable = TRUE;
3619 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3620 SSL_SESS_CACHE_CLIENT
3621 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3622 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3627 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3628 host_item * host, uschar ** errstr)
3630 if (tlsp->host_resumable)
3633 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3634 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3636 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3637 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
3639 tls_error(US"set ex_data", host, NULL, errstr);
3642 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state);
3645 tlsp->resumption = RESUME_SUPPORTED;
3646 /* Pick up a previous session, saved on an old ticket */
3647 tls_retrieve_session(tlsp, ssl, host->address);
3652 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
3655 if (SSL_session_reused(exim_client_ctx->ssl))
3657 DEBUG(D_tls) debug_printf("The session was reused\n");
3658 tlsp->resumption |= RESUME_USED;
3661 #endif /* !DISABLE_TLS_RESUME */
3664 #ifdef EXIM_HAVE_ALPN
3665 /* Expand and convert an Exim list to an ALPN list. False return for fail.
3666 NULL plist return for silent no-ALPN.
3670 tls_alpn_plist(const uschar * tls_alpn, const uschar ** plist, unsigned * plen,
3675 if (!expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr))
3680 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
3685 /* The server implementation only accepts exactly one protocol name
3686 but it's little extra code complexity in the client. */
3688 const uschar * list = exp_alpn;
3689 uschar * p = store_get(Ustrlen(exp_alpn), is_tainted(exp_alpn)), * s, * t;
3693 for (t = p; s = string_nextinlist(&list, &sep, NULL, 0); t += len)
3695 *t++ = len = (uschar) Ustrlen(s);
3698 *plist = (*plen = t - p) ? p : NULL;
3702 #endif /* EXIM_HAVE_ALPN */
3705 /*************************************************
3706 * Start a TLS session in a client *
3707 *************************************************/
3709 /* Called from the smtp transport after STARTTLS has been accepted.
3712 cctx connection context
3713 conn_args connection details
3714 cookie datum for randomness; can be NULL
3715 tlsp record details of TLS channel configuration here; must be non-NULL
3716 errstr error string pointer
3718 Returns: TRUE for success with TLS session context set in connection context,
3723 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3724 void * cookie, tls_support * tlsp, uschar ** errstr)
3726 host_item * host = conn_args->host; /* for msgs and option-tests */
3727 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3728 smtp_transport_options_block * ob = tb
3729 ? (smtp_transport_options_block *)tb->options_block
3730 : &smtp_transport_option_defaults;
3731 exim_openssl_client_tls_ctx * exim_client_ctx;
3732 uschar * expciphers;
3734 static uschar peerdn[256];
3736 #ifndef DISABLE_OCSP
3737 BOOL request_ocsp = FALSE;
3738 BOOL require_ocsp = FALSE;
3742 store_pool = POOL_PERM;
3743 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), FALSE);
3744 exim_client_ctx->corked = NULL;
3748 tlsp->tlsa_usage = 0;
3751 #ifndef DISABLE_OCSP
3753 # ifdef SUPPORT_DANE
3754 /*XXX this should be moved to caller, to be common across gnutls/openssl */
3755 if ( conn_args->dane
3756 && ob->hosts_request_ocsp[0] == '*'
3757 && ob->hosts_request_ocsp[1] == '\0'
3760 /* Unchanged from default. Use a safer one under DANE */
3761 request_ocsp = TRUE;
3762 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3763 " {= {4}{$tls_out_tlsa_usage}} } "
3769 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
3770 request_ocsp = TRUE;
3772 # ifdef SUPPORT_DANE
3776 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3780 rc = tls_init(host, ob,
3781 #ifndef DISABLE_OCSP
3782 (void *)(long)request_ocsp,
3784 cookie, &client_static_state, tlsp, errstr);
3785 if (rc != OK) return FALSE;
3787 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
3789 tlsp->certificate_verified = FALSE;
3790 client_verify_callback_called = FALSE;
3794 if (conn_args->dane)
3796 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3797 other failures should be treated as problems. */
3798 if (ob->dane_require_tls_ciphers &&
3799 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3800 &expciphers, errstr))
3802 if (expciphers && *expciphers == '\0')
3807 !expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
3808 &expciphers, errstr))
3811 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3812 are separated by underscores. So that I can use either form in my tests, and
3813 also for general convenience, we turn underscores into hyphens here. */
3817 uschar *s = expciphers;
3818 while (*s) { if (*s == '_') *s = '-'; s++; }
3819 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
3820 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
3822 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
3828 if (conn_args->dane)
3830 SSL_CTX_set_verify(exim_client_ctx->ctx,
3831 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
3832 verify_callback_client_dane);
3834 if (!DANESSL_library_init())
3836 tls_error(US"library init", host, NULL, errstr);
3839 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
3841 tls_error(US"context init", host, NULL, errstr);
3849 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
3850 client_static_state, errstr) != OK)
3853 #ifndef DISABLE_TLS_RESUME
3854 tls_client_ctx_resume_prehandshake(exim_client_ctx, tlsp, ob, host);
3858 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
3860 tls_error(US"SSL_new", host, NULL, errstr);
3863 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
3865 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
3866 SSL_set_connect_state(exim_client_ctx->ssl);
3870 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
3874 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
3876 else if (!Ustrlen(tlsp->sni))
3880 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
3881 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
3882 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
3884 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
3891 #ifdef EXIM_HAVE_ALPN
3893 const uschar * plist;
3896 if (!tls_alpn_plist(ob->tls_alpn, &plist, &plen, errstr))
3899 if (SSL_set_alpn_protos(exim_client_ctx->ssl, plist, plen) != 0)
3901 tls_error(US"alpn init", host, NULL, errstr);
3905 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
3908 log_write(0, LOG_MAIN, "ALPN unusable with this OpenSSL library version; ignoring \"%s\"\n",
3913 if (conn_args->dane)
3914 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
3918 #ifndef DISABLE_OCSP
3919 /* Request certificate status at connection-time. If the server
3920 does OCSP stapling we will get the callback (set in tls_init()) */
3921 # ifdef SUPPORT_DANE
3925 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3926 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3928 { /* Re-eval now $tls_out_tlsa_usage is populated. If
3929 this means we avoid the OCSP request, we wasted the setup
3930 cost in tls_init(). */
3931 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3932 request_ocsp = require_ocsp
3933 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3940 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
3941 client_static_state->u_ocsp.client.verify_required = require_ocsp;
3942 tlsp->ocsp = OCSP_NOT_RESP;
3946 #ifndef DISABLE_TLS_RESUME
3947 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
3952 #ifndef DISABLE_EVENT
3953 client_static_state->event_action = tb ? tb->event_action : NULL;
3956 /* There doesn't seem to be a built-in timeout on connection. */
3958 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
3959 sigalrm_seen = FALSE;
3960 ALARM(ob->command_timeout);
3961 rc = SSL_connect(exim_client_ctx->ssl);
3965 if (conn_args->dane)
3966 DANESSL_cleanup(exim_client_ctx->ssl);
3971 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
3977 debug_printf("SSL_connect succeeded\n");
3978 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3980 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
3981 SSL_SESSION_print_keylog(bp, SSL_get_session(exim_client_ctx->ssl));
3987 #ifndef DISABLE_TLS_RESUME
3988 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
3991 #ifdef EXIM_HAVE_ALPN
3992 if (ob->tls_alpn) /* We requested. See what was negotiated. */
3994 const uschar * name;
3997 SSL_get0_alpn_selected(exim_client_ctx->ssl, &name, &len);
3999 { DEBUG(D_tls) debug_printf("ALPN negotiated %u: '%.*s'\n", len, (int)*name, name+1); }
4000 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
4002 /* Would like to send a relevant fatal Alert, but OpenSSL has no API */
4003 tls_error(US"handshake", host, US"ALPN required but not negotiated", errstr);
4009 #ifdef SSL_get_extms_support
4010 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
4012 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
4014 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
4015 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
4016 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
4018 /* Record the certificate we presented */
4020 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
4021 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
4024 /*XXX will this work with continued-TLS? */
4025 /* Channel-binding info for authenticators */
4028 size_t len = SSL_get_finished(exim_client_ctx->ssl, &c, 0);
4029 int old_pool = store_pool;
4031 SSL_get_finished(exim_client_ctx->ssl, s = store_get((int)len, TRUE), len);
4032 store_pool = POOL_PERM;
4033 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, TRUE);
4034 store_pool = old_pool;
4035 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
4038 tlsp->active.sock = cctx->sock;
4039 tlsp->active.tls_ctx = exim_client_ctx;
4040 cctx->tls_ctx = exim_client_ctx;
4049 tls_refill(unsigned lim)
4051 SSL * ssl = state_server.lib_state.lib_ssl;
4055 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4056 ssl_xfer_buffer, ssl_xfer_buffer_size);
4059 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4060 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
4061 MIN(ssl_xfer_buffer_size, lim));
4062 error = SSL_get_error(ssl, inbytes);
4063 if (smtp_receive_timeout > 0) ALARM_CLR(0);
4065 if (had_command_timeout) /* set by signal handler */
4066 smtp_command_timeout_exit(); /* does not return */
4067 if (had_command_sigterm)
4068 smtp_command_sigterm_exit();
4069 if (had_data_timeout)
4070 smtp_data_timeout_exit();
4071 if (had_data_sigint)
4072 smtp_data_sigint_exit();
4074 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
4075 closed down, not that the socket itself has been closed down. Revert to
4076 non-SSL handling. */
4080 case SSL_ERROR_NONE:
4083 case SSL_ERROR_ZERO_RETURN:
4084 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4086 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
4089 tls_close(NULL, TLS_NO_SHUTDOWN);
4092 /* Handle genuine errors */
4094 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4095 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
4096 ssl_xfer_error = TRUE;
4100 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
4101 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
4102 debug_printf(" - syscall %s\n", strerror(errno));
4103 ssl_xfer_error = TRUE;
4107 #ifndef DISABLE_DKIM
4108 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
4110 ssl_xfer_buffer_hwm = inbytes;
4111 ssl_xfer_buffer_lwm = 0;
4116 /*************************************************
4117 * TLS version of getc *
4118 *************************************************/
4120 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
4121 it refills the buffer via the SSL reading function.
4123 Arguments: lim Maximum amount to read/buffer
4124 Returns: the next character or EOF
4126 Only used by the server-side TLS.
4130 tls_getc(unsigned lim)
4132 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4133 if (!tls_refill(lim))
4134 return ssl_xfer_error ? EOF : smtp_getc(lim);
4136 /* Something in the buffer; return next uschar */
4138 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
4144 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm;
4148 tls_getbuf(unsigned * len)
4153 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4154 if (!tls_refill(*len))
4156 if (!ssl_xfer_error) return smtp_getbuf(len);
4161 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4163 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4164 ssl_xfer_buffer_lwm += size;
4171 tls_get_cache(unsigned lim)
4173 #ifndef DISABLE_DKIM
4174 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4175 debug_printf("tls_get_cache\n");
4179 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4185 tls_could_getc(void)
4187 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4188 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4192 /*************************************************
4193 * Read bytes from TLS channel *
4194 *************************************************/
4198 ct_ctx client context pointer, or NULL for the one global server context
4202 Returns: the number of bytes read
4203 -1 after a failed read, including EOF
4205 Only used by the client-side TLS.
4209 tls_read(void * ct_ctx, uschar *buff, size_t len)
4211 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4212 : state_server.lib_state.lib_ssl;
4216 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4217 buff, (unsigned int)len);
4220 inbytes = SSL_read(ssl, CS buff, len);
4221 error = SSL_get_error(ssl, inbytes);
4223 if (error == SSL_ERROR_ZERO_RETURN)
4225 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4228 else if (error != SSL_ERROR_NONE)
4238 /*************************************************
4239 * Write bytes down TLS channel *
4240 *************************************************/
4244 ct_ctx client context pointer, or NULL for the one global server context
4247 more further data expected soon
4249 Returns: the number of bytes after a successful write,
4250 -1 after a failed write
4252 Used by both server-side and client-side TLS. Calling with len zero and more unset
4253 will flush buffered writes; buff can be null for this case.
4257 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4260 int outbytes, error;
4262 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4263 : state_server.lib_state.lib_ssl;
4264 static gstring * server_corked = NULL;
4265 gstring ** corkedp = ct_ctx
4266 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4267 gstring * corked = *corkedp;
4269 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4270 buff, (unsigned long)len, more ? ", more" : "");
4272 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4273 "more" is notified. This hack is only ok if small amounts are involved AND only
4274 one stream does it, in one context (i.e. no store reset). Currently it is used
4275 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4276 We support callouts done by the server process by using a separate client
4277 context for the stashed information. */
4278 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4279 a store reset there, so use POOL_PERM. */
4280 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4284 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4286 int save_pool = store_pool;
4287 store_pool = POOL_PERM;
4289 corked = string_catn(corked, buff, len);
4291 store_pool = save_pool;
4298 buff = CUS corked->s;
4303 for (int left = len; left > 0;)
4305 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4307 outbytes = SSL_write(ssl, CS buff, left);
4308 error = SSL_get_error(ssl, outbytes);
4309 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4312 case SSL_ERROR_NONE: /* the usual case */
4318 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4319 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4322 case SSL_ERROR_ZERO_RETURN:
4323 log_write(0, LOG_MAIN, "SSL channel closed on write");
4326 case SSL_ERROR_SYSCALL:
4327 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4328 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4329 sender_fullhost ? sender_fullhost : US"<unknown>",
4331 else if (LOGGING(protocol_detail))
4332 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4333 " SMTP response and TLS close\n", sender_host_address);
4335 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4336 " client reset TCP before TLS close\n", sender_host_address);
4340 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4351 ct_ctx client TLS context pointer, or NULL for the one global server context
4355 tls_shutdown_wr(void * ct_ctx)
4357 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4358 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4359 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4362 if (*fdp < 0) return; /* TLS was not active */
4364 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4366 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
4367 rc = SSL_shutdown(*sslp);
4368 if (rc < 0) DEBUG(D_tls)
4370 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4371 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4375 /*************************************************
4376 * Close down a TLS session *
4377 *************************************************/
4379 /* This is also called from within a delivery subprocess forked from the
4380 daemon, to shut down the TLS library, without actually doing a shutdown (which
4381 would tamper with the SSL session in the parent process).
4384 ct_ctx client TLS context pointer, or NULL for the one global server context
4385 do_shutdown 0 no data-flush or TLS close-alert
4386 1 if TLS close-alert is to be sent,
4387 2 if also response to be waited for
4391 Used by both server-side and client-side TLS.
4395 tls_close(void * ct_ctx, int do_shutdown)
4397 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4398 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4399 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4401 if (*fdp < 0) return; /* TLS was not active */
4406 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4407 do_shutdown > 1 ? " (with response-wait)" : "");
4409 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4411 if ( (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4415 rc = SSL_shutdown(*sslp); /* wait for response */
4419 if (rc < 0) DEBUG(D_tls)
4421 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4422 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4426 if (!o_ctx) /* server side */
4428 #ifndef DISABLE_OCSP
4429 sk_X509_pop_free(state_server.verify_stack, X509_free);
4430 state_server.verify_stack = NULL;
4433 receive_getc = smtp_getc;
4434 receive_getbuf = smtp_getbuf;
4435 receive_get_cache = smtp_get_cache;
4436 receive_hasc = smtp_hasc;
4437 receive_ungetc = smtp_ungetc;
4438 receive_feof = smtp_feof;
4439 receive_ferror = smtp_ferror;
4440 tls_in.active.tls_ctx = NULL;
4442 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4453 /*************************************************
4454 * Let tls_require_ciphers be checked at startup *
4455 *************************************************/
4457 /* The tls_require_ciphers option, if set, must be something which the
4460 Returns: NULL on success, or error message
4464 tls_validate_require_cipher(void)
4467 uschar *s, *expciphers, *err;
4471 if (!(tls_require_ciphers && *tls_require_ciphers))
4474 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4476 return US"failed to expand tls_require_ciphers";
4478 if (!(expciphers && *expciphers))
4481 /* normalisation ripped from above */
4483 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
4487 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4490 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4492 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4494 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4495 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4496 expciphers, ssl_errstring);
4507 /*************************************************
4508 * Report the library versions. *
4509 *************************************************/
4511 /* There have historically been some issues with binary compatibility in
4512 OpenSSL libraries; if Exim (like many other applications) is built against
4513 one version of OpenSSL but the run-time linker picks up another version,
4514 it can result in serious failures, including crashing with a SIGSEGV. So
4515 report the version found by the compiler and the run-time version.
4517 Note: some OS vendors backport security fixes without changing the version
4518 number/string, and the version date remains unchanged. The _build_ date
4519 will change, so we can more usefully assist with version diagnosis by also
4520 reporting the build date.
4522 Arguments: a FILE* to print the results to
4527 tls_version_report(FILE *f)
4529 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
4532 OPENSSL_VERSION_TEXT,
4533 SSLeay_version(SSLEAY_VERSION),
4534 SSLeay_version(SSLEAY_BUILT_ON));
4535 /* third line is 38 characters for the %s and the line is 73 chars long;
4536 the OpenSSL output includes a "built on: " prefix already. */
4542 /*************************************************
4543 * Random number generation *
4544 *************************************************/
4546 /* Pseudo-random number generation. The result is not expected to be
4547 cryptographically strong but not so weak that someone will shoot themselves
4548 in the foot using it as a nonce in input in some email header scheme or
4549 whatever weirdness they'll twist this into. The result should handle fork()
4550 and avoid repeating sequences. OpenSSL handles that for us.
4554 Returns a random number in range [0, max-1]
4558 vaguely_random_number(int max)
4562 static pid_t pidlast = 0;
4564 uschar smallbuf[sizeof(r)];
4570 if (pidnow != pidlast)
4572 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
4573 is unique for each thread", this doesn't apparently apply across processes,
4574 so our own warning from vaguely_random_number_fallback() applies here too.
4575 Fix per PostgreSQL. */
4581 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
4585 gettimeofday(&r.tv, NULL);
4588 RAND_seed(US (&r), sizeof(r));
4590 /* We're after pseudo-random, not random; if we still don't have enough data
4591 in the internal PRNG then our options are limited. We could sleep and hope
4592 for entropy to come along (prayer technique) but if the system is so depleted
4593 in the first place then something is likely to just keep taking it. Instead,
4594 we'll just take whatever little bit of pseudo-random we can still manage to
4597 needed_len = sizeof(r);
4598 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4599 asked for a number less than 10. */
4600 for (r = max, i = 0; r; ++i)
4606 #ifdef EXIM_HAVE_RAND_PSEUDO
4607 /* We do not care if crypto-strong */
4608 i = RAND_pseudo_bytes(smallbuf, needed_len);
4610 i = RAND_bytes(smallbuf, needed_len);
4616 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
4617 return vaguely_random_number_fallback(max);
4621 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4624 /* We don't particularly care about weighted results; if someone wants
4625 smooth distribution and cares enough then they should submit a patch then. */
4632 /*************************************************
4633 * OpenSSL option parse *
4634 *************************************************/
4636 /* Parse one option for tls_openssl_options_parse below
4639 name one option name
4640 value place to store a value for it
4641 Returns success or failure in parsing
4647 tls_openssl_one_option_parse(uschar *name, long *value)
4650 int last = exim_openssl_options_size;
4651 while (last > first)
4653 int middle = (first + last)/2;
4654 int c = Ustrcmp(name, exim_openssl_options[middle].name);
4657 *value = exim_openssl_options[middle].value;
4671 /*************************************************
4672 * OpenSSL option parsing logic *
4673 *************************************************/
4675 /* OpenSSL has a number of compatibility options which an administrator might
4676 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
4677 we look like log_selector.
4680 option_spec the administrator-supplied string of options
4681 results ptr to long storage for the options bitmap
4682 Returns success or failure
4686 tls_openssl_options_parse(uschar *option_spec, long *results)
4689 uschar * exp, * end;
4690 BOOL adding, item_parsed;
4692 /* Server: send no (<= TLS1.2) session tickets */
4693 result = SSL_OP_NO_TICKET;
4695 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
4696 from default because it increases BEAST susceptibility. */
4697 #ifdef SSL_OP_NO_SSLv2
4698 result |= SSL_OP_NO_SSLv2;
4700 #ifdef SSL_OP_NO_SSLv3
4701 result |= SSL_OP_NO_SSLv3;
4703 #ifdef SSL_OP_SINGLE_DH_USE
4704 result |= SSL_OP_SINGLE_DH_USE;
4706 #ifdef SSL_OP_NO_RENEGOTIATION
4707 result |= SSL_OP_NO_RENEGOTIATION;
4716 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
4719 for (uschar * s = exp; *s; /**/)
4721 while (isspace(*s)) ++s;
4724 if (*s != '+' && *s != '-')
4726 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
4727 "+ or - expected but found \"%s\"\n", s);
4730 adding = *s++ == '+';
4731 for (end = s; *end && !isspace(*end); ) end++;
4732 item_parsed = tls_openssl_one_option_parse(string_copyn(s, end-s), &item);
4735 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
4738 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
4739 adding ? "adding to " : "removing from", result, item, s);
4751 #endif /*!MACRO_PREDEF*/
4754 /* End of tls-openssl.c */