1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2019 */
6 /* Copyright (c) The Exim Maintainers 2020 - 2021 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Portions Copyright (c) The OpenSSL Project 1999 */
11 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
12 library. It is #included into the tls.c file when that library is used. The
13 code herein is based on a patch that was originally contributed by Steve
14 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
16 No cryptographic code is included in Exim. All this module does is to call
17 functions from the OpenSSL library. */
22 #include <openssl/lhash.h>
23 #include <openssl/ssl.h>
24 #include <openssl/err.h>
25 #include <openssl/rand.h>
26 #ifndef OPENSSL_NO_ECDH
27 # include <openssl/ec.h>
30 # include <openssl/ocsp.h>
38 # define EXIM_OCSP_SKEW_SECONDS (300L)
39 # define EXIM_OCSP_MAX_AGE (-1L)
42 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
43 # define EXIM_HAVE_OPENSSL_TLSEXT
45 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
46 # define EXIM_HAVE_RSA_GENKEY_EX
48 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
49 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define OPENSSL_AUTO_SHA256
52 # define EXIM_HAVE_EPHEM_RSA_KEX
53 # define EXIM_HAVE_RAND_PSEUDO
55 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
56 # define EXIM_HAVE_SHA256
59 /* X509_check_host provides sane certificate hostname checking, but was added
60 to OpenSSL late, after other projects forked off the code-base. So in
61 addition to guarding against the base version number, beware that LibreSSL
62 does not (at this time) support this function.
64 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
65 opt to disentangle and ask a LibreSSL user to provide glue for a third
66 crypto provider for libtls instead of continuing to tie the OpenSSL glue
67 into even twistier knots. If LibreSSL gains the same API, we can just
68 change this guard and punt the issue for a while longer. */
70 #ifndef LIBRESSL_VERSION_NUMBER
71 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
72 # define EXIM_HAVE_OPENSSL_CHECKHOST
73 # define EXIM_HAVE_OPENSSL_DH_BITS
74 # define EXIM_HAVE_OPENSSL_TLS_METHOD
75 # define EXIM_HAVE_OPENSSL_KEYLOG
76 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
77 # define EXIM_HAVE_SESSION_TICKET
78 # define EXIM_HAVE_OPESSL_TRACE
79 # define EXIM_HAVE_OPESSL_GET0_SERIAL
81 # define EXIM_HAVE_OCSP
83 # define EXIM_HAVE_ALPN /* fail ret from hshake-cb is ignored by LibreSSL */
85 # define EXIM_NEED_OPENSSL_INIT
87 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
88 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
89 # define EXIM_HAVE_OPENSSL_CHECKHOST
93 #if LIBRESSL_VERSION_NUMBER >= 0x3040000fL
94 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
97 #if !defined(LIBRESSL_VERSION_NUMBER) \
98 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
99 # if !defined(OPENSSL_NO_ECDH)
100 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
101 # define EXIM_HAVE_ECDH
103 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
104 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
109 #ifndef LIBRESSL_VERSION_NUMBER
110 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
111 # define OPENSSL_HAVE_KEYLOG_CB
112 # define OPENSSL_HAVE_NUM_TICKETS
113 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
115 # define OPENSSL_BAD_SRVR_OURCERT
119 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
120 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
121 # define DISABLE_OCSP
124 #ifndef DISABLE_TLS_RESUME
125 # if OPENSSL_VERSION_NUMBER < 0x0101010L
126 # error OpenSSL version too old for session-resumption
130 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
131 # include <openssl/x509v3.h>
134 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
135 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
136 # define SSL_CIPHER_get_id(c) (c->id)
138 # ifndef MACRO_PREDEF
139 # include "tls-cipher-stdname.c"
143 /*************************************************
144 * OpenSSL option parse *
145 *************************************************/
147 typedef struct exim_openssl_option {
150 } exim_openssl_option;
151 /* We could use a macro to expand, but we need the ifdef and not all the
152 options document which version they were introduced in. Policylet: include
153 all options unless explicitly for DTLS, let the administrator choose which
156 This list is current as of:
159 XXX could we autobuild this list, as with predefined-macros?
160 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
161 Also allow a numeric literal?
163 static exim_openssl_option exim_openssl_options[] = {
164 /* KEEP SORTED ALPHABETICALLY! */
166 { US"all", (long) SSL_OP_ALL },
168 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
169 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
171 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
172 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
174 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
175 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
177 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
178 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
180 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
181 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
183 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
184 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
186 #ifdef SSL_OP_EPHEMERAL_RSA
187 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
189 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
190 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
192 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
193 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
195 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
196 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
198 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
199 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
201 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
202 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
204 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
205 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
207 #ifdef SSL_OP_NO_ANTI_REPLAY
208 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
210 #ifdef SSL_OP_NO_COMPRESSION
211 { US"no_compression", SSL_OP_NO_COMPRESSION },
213 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
214 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
216 #ifdef SSL_OP_NO_RENEGOTIATION
217 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
219 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
220 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
222 #ifdef SSL_OP_NO_SSLv2
223 { US"no_sslv2", SSL_OP_NO_SSLv2 },
225 #ifdef SSL_OP_NO_SSLv3
226 { US"no_sslv3", SSL_OP_NO_SSLv3 },
228 #ifdef SSL_OP_NO_TICKET
229 { US"no_ticket", SSL_OP_NO_TICKET },
231 #ifdef SSL_OP_NO_TLSv1
232 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
234 #ifdef SSL_OP_NO_TLSv1_1
235 # if OPENSSL_VERSION_NUMBER < 0x30000000L
236 # if SSL_OP_NO_TLSv1_1 == 0x00000400L
237 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
238 # warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
239 # define NO_SSL_OP_NO_TLSv1_1
242 # ifndef NO_SSL_OP_NO_TLSv1_1
243 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
246 #ifdef SSL_OP_NO_TLSv1_2
247 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
249 #ifdef SSL_OP_NO_TLSv1_3
250 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
252 #ifdef SSL_OP_PRIORITIZE_CHACHA
253 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
255 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
256 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
258 #ifdef SSL_OP_SINGLE_DH_USE
259 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
261 #ifdef SSL_OP_SINGLE_ECDH_USE
262 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
264 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
265 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
267 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
268 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
270 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
271 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
273 #ifdef SSL_OP_TLS_D5_BUG
274 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
276 #ifdef SSL_OP_TLS_ROLLBACK_BUG
277 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
279 #ifdef SSL_OP_TLSEXT_PADDING
280 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
285 static int exim_openssl_options_size = nelem(exim_openssl_options);
286 static long init_options = 0;
295 for (struct exim_openssl_option * o = exim_openssl_options;
296 o < exim_openssl_options + nelem(exim_openssl_options); o++)
298 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
299 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
301 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
302 builtin_macro_create(buf);
305 # ifndef DISABLE_TLS_RESUME
306 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
308 # ifdef SSL_OP_NO_TLSv1_3
309 builtin_macro_create(US"_HAVE_TLS1_3");
311 # ifdef OPENSSL_BAD_SRVR_OURCERT
312 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
314 # ifdef EXIM_HAVE_OCSP
315 builtin_macro_create(US"_HAVE_TLS_OCSP");
316 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
318 # ifdef EXIM_HAVE_ALPN
319 builtin_macro_create(US"_HAVE_TLS_ALPN");
324 /******************************************************************************/
326 /* Structure for collecting random data for seeding. */
328 typedef struct randstuff {
333 /* Local static variables */
335 static BOOL client_verify_callback_called = FALSE;
336 static BOOL server_verify_callback_called = FALSE;
337 static const uschar *sid_ctx = US"exim";
339 /* We have three different contexts to care about.
341 Simple case: client, `client_ctx`
342 As a client, we can be doing a callout or cut-through delivery while receiving
343 a message. So we have a client context, which should have options initialised
344 from the SMTP Transport. We may also concurrently want to make TLS connections
345 to utility daemons, so client-contexts are allocated and passed around in call
346 args rather than using a gobal.
349 There are two cases: with and without ServerNameIndication from the client.
350 Given TLS SNI, we can be using different keys, certs and various other
351 configuration settings, because they're re-expanded with $tls_sni set. This
352 allows vhosting with TLS. This SNI is sent in the handshake.
353 A client might not send SNI, so we need a fallback, and an initial setup too.
354 So as a server, we start out using `server_ctx`.
355 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
356 `server_sni` from `server_ctx` and then initialise settings by re-expanding
364 } exim_openssl_client_tls_ctx;
367 /* static SSL_CTX *server_ctx = NULL; */
368 /* static SSL *server_ssl = NULL; */
370 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
371 static SSL_CTX *server_sni = NULL;
373 #ifdef EXIM_HAVE_ALPN
374 static BOOL server_seen_alpn = FALSE;
377 static char ssl_errstring[256];
379 static int ssl_session_timeout = 7200; /* Two hours */
380 static BOOL client_verify_optional = FALSE;
381 static BOOL server_verify_optional = FALSE;
383 static BOOL reexpand_tls_files_for_sni = FALSE;
386 typedef struct ocsp_resp {
387 struct ocsp_resp * next;
388 OCSP_RESPONSE * resp;
391 typedef struct exim_openssl_state {
392 exim_tlslib_state lib_state;
393 #define lib_ctx libdata0
394 #define lib_ssl libdata1
397 uschar * certificate;
401 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
405 const uschar *file_expanded;
406 ocsp_resplist *olist;
409 X509_STORE *verify_store; /* non-null if status requested */
410 BOOL verify_required;
415 /* these are cached from first expand */
416 uschar * server_cipher_list;
417 /* only passed down to tls_error: */
419 const uschar * verify_cert_hostnames;
420 #ifndef DISABLE_EVENT
421 uschar * event_action;
423 } exim_openssl_state_st;
425 /* should figure out a cleanup of API to handle state preserved per
426 implementation, for various reasons, which can be void * in the APIs.
427 For now, we hack around it. */
428 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
429 exim_openssl_state_st state_server = {.is_server = TRUE};
432 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
437 static int tls_server_stapling_cb(SSL *s, void *arg);
442 /* Daemon-called, before every connection, key create/rotate */
443 #ifndef DISABLE_TLS_RESUME
444 static void tk_init(void);
445 static int tls_exdata_idx = -1;
449 tls_per_lib_daemon_tick(void)
451 #ifndef DISABLE_TLS_RESUME
456 /* Called once at daemon startup */
459 tls_per_lib_daemon_init(void)
461 tls_daemon_creds_reload();
465 /*************************************************
467 *************************************************/
469 /* Called from lots of places when errors occur before actually starting to do
470 the TLS handshake, that is, while the session is still in clear. Always returns
471 DEFER for a server and FAIL for a client so that most calls can use "return
472 tls_error(...)" to do this processing and then give an appropriate return. A
473 single function is used for both server and client, because it is called from
474 some shared functions.
477 prefix text to include in the logged error
478 host NULL if setting up a server;
479 the connected host if setting up a client
480 msg error message or NULL if we should ask OpenSSL
481 errstr pointer to output error message
483 Returns: OK/DEFER/FAIL
487 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
491 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
492 msg = US ssl_errstring;
495 msg = string_sprintf("(%s): %s", prefix, msg);
496 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
497 if (errstr) *errstr = msg;
498 return host ? FAIL : DEFER;
503 /**************************************************
504 * General library initalisation *
505 **************************************************/
508 lib_rand_init(void * addr)
511 if (!RAND_status()) return TRUE;
513 gettimeofday(&r.tv, NULL);
515 RAND_seed(US (&r), sizeof(r));
516 RAND_seed(US big_buffer, big_buffer_size);
517 if (addr) RAND_seed(US addr, sizeof(addr));
519 return RAND_status();
524 tls_openssl_init(void)
526 static BOOL once = FALSE;
530 #ifdef EXIM_NEED_OPENSSL_INIT
531 SSL_load_error_strings(); /* basic set up */
532 OpenSSL_add_ssl_algorithms();
535 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
536 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
537 list of available digests. */
538 EVP_add_digest(EVP_sha256());
541 (void) lib_rand_init(NULL);
542 (void) tls_openssl_options_parse(openssl_options, &init_options);
547 /*************************************************
548 * Initialize for DH *
549 *************************************************/
551 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
555 sctx The current SSL CTX (inbound or outbound)
556 dhparam DH parameter file or fixed parameter identity string
557 errstr error string pointer
559 Returns: TRUE if OK (nothing to set up, or setup worked)
563 init_dh(SSL_CTX * sctx, uschar * dhparam, uschar ** errstr)
566 #if OPENSSL_VERSION_NUMBER < 0x30000000L
575 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
578 if (!dhexpanded || !*dhexpanded)
579 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
580 else if (dhexpanded[0] == '/')
582 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
584 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
585 NULL, US strerror(errno), errstr);
591 if (Ustrcmp(dhexpanded, "none") == 0)
593 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
597 if (!(pem = std_dh_prime_named(dhexpanded)))
599 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
600 NULL, US strerror(errno), errstr);
603 bio = BIO_new_mem_buf(CS pem, -1);
607 #if OPENSSL_VERSION_NUMBER < 0x30000000L
608 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)
610 pkey = PEM_read_bio_Parameters_ex(bio, NULL, NULL, NULL)
615 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
620 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
621 an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with 2236.
622 But older OpenSSL can only report in bytes (octets), not bits. If someone wants
623 to dance at the edge, then they can raise the limit or use current libraries. */
625 #if OPENSSL_VERSION_NUMBER < 0x30000000L
626 # ifdef EXIM_HAVE_OPENSSL_DH_BITS
627 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
628 This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
629 dh_bitsize = DH_bits(dh);
631 dh_bitsize = 8 * DH_size(dh);
634 dh_bitsize = EVP_PKEY_get_bits(pkey);
637 /* Even if it is larger, we silently return success rather than cause things to
638 fail out, so that a too-large DH will not knock out all TLS; it's a debatable
639 choice. Likewise for a failing attempt to set one. */
641 if (dh_bitsize <= tls_dh_max_bits)
644 #if OPENSSL_VERSION_NUMBER < 0x30000000L
645 SSL_CTX_set_tmp_dh(sctx, dh)
647 SSL_CTX_set0_tmp_dh_pkey(sctx, pkey)
651 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
652 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (D-H param setting '%s'): %s",
653 dhexpanded ? dhexpanded : US"default", ssl_errstring);
654 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
655 /* EVP_PKEY_free(pkey); crashes */
660 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
661 dhexpanded ? dhexpanded : US"default", dh_bitsize);
665 debug_printf("dhparams '%s' %d bits, is > tls_dh_max_bits limit of %d\n",
666 dhexpanded ? dhexpanded : US"default", dh_bitsize, tls_dh_max_bits);
668 #if OPENSSL_VERSION_NUMBER < 0x30000000L
671 /* The EVP_PKEY ownership stays with the ctx; do not free it */
680 /*************************************************
681 * Initialize for ECDH *
682 *************************************************/
684 /* Load parameters for ECDH encryption. Server only.
686 For now, we stick to NIST P-256 because: it's simple and easy to configure;
687 it avoids any patent issues that might bite redistributors; despite events in
688 the news and concerns over curve choices, we're not cryptographers, we're not
689 pretending to be, and this is "good enough" to be better than no support,
690 protecting against most adversaries. Given another year or two, there might
691 be sufficient clarity about a "right" way forward to let us make an informed
692 decision, instead of a knee-jerk reaction.
694 Longer-term, we should look at supporting both various named curves and
695 external files generated with "openssl ecparam", much as we do for init_dh().
696 We should also support "none" as a value, to explicitly avoid initialisation.
701 sctx The current SSL CTX (inbound or outbound)
702 errstr error string pointer
704 Returns: TRUE if OK (nothing to set up, or setup worked)
708 init_ecdh(SSL_CTX * sctx, uschar ** errstr)
710 #ifdef OPENSSL_NO_ECDH
718 # ifndef EXIM_HAVE_ECDH
720 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
724 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
726 if (!exp_curve || !*exp_curve)
729 /* "auto" needs to be handled carefully.
730 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
731 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
732 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
733 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
734 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
736 if (Ustrcmp(exp_curve, "auto") == 0)
738 #if OPENSSL_VERSION_NUMBER < 0x10002000L
739 DEBUG(D_tls) debug_printf(
740 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
741 exp_curve = US"prime256v1";
743 # if defined SSL_CTRL_SET_ECDH_AUTO
744 DEBUG(D_tls) debug_printf(
745 "ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n");
746 SSL_CTX_set_ecdh_auto(sctx, 1);
749 DEBUG(D_tls) debug_printf(
750 "ECDH OpenSSL 1.1.0+: temp key parameter settings: default selection\n");
756 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
757 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
758 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
759 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
763 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
768 # if OPENSSL_VERSION_NUMBER < 0x30000000L
771 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
773 tls_error(US"Unable to create ec curve", NULL, NULL, errstr);
777 /* The "tmp" in the name here refers to setting a temporary key
778 not to the stability of the interface. */
780 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
781 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), NULL, NULL, errstr);
783 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
787 #else /* v 3.0.0 + */
789 if ((rv = SSL_CTX_set1_groups(sctx, &nid, 1)) == 0)
790 tls_error(string_sprintf("Error enabling '%s' group", exp_curve), NULL, NULL, errstr);
792 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' group\n", exp_curve);
798 # endif /*EXIM_HAVE_ECDH*/
799 #endif /*OPENSSL_NO_ECDH*/
804 /*************************************************
805 * Expand key and cert file specs *
806 *************************************************/
810 s SSL connection (not used)
814 Returns: pointer to generated key
818 rsa_callback(SSL *s, int export, int keylength)
821 #ifdef EXIM_HAVE_RSA_GENKEY_EX
822 BIGNUM *bn = BN_new();
825 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
827 #ifdef EXIM_HAVE_RSA_GENKEY_EX
828 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
829 || !(rsa_key = RSA_new())
830 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
833 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
837 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
838 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
847 /* Create and install a selfsigned certificate, for use in server mode */
848 /*XXX we could arrange to call this during prelo for a null tls_certificate option.
849 The normal cache inval + relo will suffice.
850 Just need a timer for inval. */
853 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
861 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
862 where = US"allocating pkey";
863 if (!(pkey = EVP_PKEY_new()))
866 where = US"allocating cert";
867 if (!(x509 = X509_new()))
870 where = US"generating pkey";
871 if (!(rsa = rsa_callback(NULL, 0, 2048)))
874 where = US"assigning pkey";
875 if (!EVP_PKEY_assign_RSA(pkey, rsa))
878 X509_set_version(x509, 2); /* N+1 - version 3 */
879 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
880 X509_gmtime_adj(X509_get_notBefore(x509), 0);
881 X509_gmtime_adj(X509_get_notAfter(x509), (long)2 * 60 * 60); /* 2 hour */
882 X509_set_pubkey(x509, pkey);
884 name = X509_get_subject_name(x509);
885 X509_NAME_add_entry_by_txt(name, "C",
886 MBSTRING_ASC, CUS "UK", -1, -1, 0);
887 X509_NAME_add_entry_by_txt(name, "O",
888 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
889 X509_NAME_add_entry_by_txt(name, "CN",
890 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
891 X509_set_issuer_name(x509, name);
893 where = US"signing cert";
894 if (!X509_sign(x509, pkey, EVP_md5()))
897 where = US"installing selfsign cert";
898 if (!SSL_CTX_use_certificate(sctx, x509))
901 where = US"installing selfsign key";
902 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
908 (void) tls_error(where, NULL, NULL, errstr);
909 if (x509) X509_free(x509);
910 if (pkey) EVP_PKEY_free(pkey);
920 /*************************************************
921 * Information callback *
922 *************************************************/
924 /* The SSL library functions call this from time to time to indicate what they
925 are doing. We copy the string to the debugging output when TLS debugging has
937 info_callback(SSL *s, int where, int ret)
943 if (where & SSL_ST_CONNECT)
944 str = US"SSL_connect";
945 else if (where & SSL_ST_ACCEPT)
946 str = US"SSL_accept";
948 str = US"SSL info (undefined)";
950 if (where & SSL_CB_LOOP)
951 debug_printf("%s: %s\n", str, SSL_state_string_long(s));
952 else if (where & SSL_CB_ALERT)
953 debug_printf("SSL3 alert %s:%s:%s\n",
954 str = where & SSL_CB_READ ? US"read" : US"write",
955 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
956 else if (where & SSL_CB_EXIT)
959 debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
961 debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
963 else if (where & SSL_CB_HANDSHAKE_START)
964 debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
965 else if (where & SSL_CB_HANDSHAKE_DONE)
966 debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s));
970 #ifdef OPENSSL_HAVE_KEYLOG_CB
972 keylog_callback(const SSL *ssl, const char *line)
976 DEBUG(D_tls) debug_printf("%.200s\n", line);
977 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
978 if (!(fp = fopen(filename, "a"))) return;
979 fprintf(fp, "%s\n", line);
988 #ifndef DISABLE_EVENT
990 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
991 BOOL *calledp, const BOOL *optionalp, const uschar * what)
997 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
1000 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
1001 old_cert = tlsp->peercert;
1002 tlsp->peercert = X509_dup(cert);
1003 /* NB we do not bother setting peerdn */
1004 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
1006 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
1007 "depth=%d cert=%s: %s",
1008 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1009 what, depth, dn, yield);
1013 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
1014 return 1; /* reject (leaving peercert set) */
1016 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
1017 "(host in tls_try_verify_hosts)\n");
1018 tlsp->verify_override = TRUE;
1020 X509_free(tlsp->peercert);
1021 tlsp->peercert = old_cert;
1027 /*************************************************
1028 * Callback for verification *
1029 *************************************************/
1031 /* The SSL library does certificate verification if set up to do so. This
1032 callback has the current yes/no state is in "state". If verification succeeded,
1033 we set the certificate-verified flag. If verification failed, what happens
1034 depends on whether the client is required to present a verifiable certificate
1037 If verification is optional, we change the state to yes, but still log the
1038 verification error. For some reason (it really would help to have proper
1039 documentation of OpenSSL), this callback function then gets called again, this
1040 time with state = 1. We must take care not to set the private verified flag on
1041 the second time through.
1043 Note: this function is not called if the client fails to present a certificate
1044 when asked. We get here only if a certificate has been received. Handling of
1045 optional verification for this case is done when requesting SSL to verify, by
1046 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
1048 May be called multiple times for different issues with a certificate, even
1049 for a given "depth" in the certificate chain.
1052 preverify_ok current yes/no state as 1/0
1053 x509ctx certificate information.
1054 tlsp per-direction (client vs. server) support data
1055 calledp has-been-called flag
1056 optionalp verification-is-optional flag
1058 Returns: 0 if verification should fail, otherwise 1
1062 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1063 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1065 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1066 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1069 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1071 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1072 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1073 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1076 dn[sizeof(dn)-1] = '\0';
1078 tlsp->verify_override = FALSE;
1079 if (preverify_ok == 0)
1081 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1082 *verify_mode, sender_host_address)
1084 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1085 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1087 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1091 if (!tlsp->peercert)
1092 tlsp->peercert = X509_dup(cert); /* record failing cert */
1093 return 0; /* reject */
1095 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1096 "tls_try_verify_hosts)\n");
1097 tlsp->verify_override = TRUE;
1100 else if (depth != 0)
1102 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1103 #ifndef DISABLE_OCSP
1104 if (tlsp == &tls_out && client_static_state->u_ocsp.client.verify_store)
1105 { /* client, wanting stapling */
1106 /* Add the server cert's signing chain as the one
1107 for the verification of the OCSP stapled information. */
1109 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1112 sk_X509_push(client_static_state->verify_stack, cert);
1115 #ifndef DISABLE_EVENT
1116 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1117 return 0; /* reject, with peercert set */
1122 const uschar * verify_cert_hostnames;
1124 if ( tlsp == &tls_out
1125 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1126 /* client, wanting hostname check */
1129 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1130 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1131 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1133 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1134 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1137 const uschar * list = verify_cert_hostnames;
1140 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1141 if ((rc = X509_check_host(cert, CCS name, 0,
1142 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1143 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1148 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1149 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1156 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1159 uschar * extra = verify_mode
1160 ? string_sprintf(" (during %c-verify for [%s])",
1161 *verify_mode, sender_host_address)
1163 log_write(0, LOG_MAIN,
1164 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1165 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1166 extra, dn, verify_cert_hostnames);
1170 if (!tlsp->peercert)
1171 tlsp->peercert = X509_dup(cert); /* record failing cert */
1172 return 0; /* reject */
1174 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1175 "tls_try_verify_hosts)\n");
1176 tlsp->verify_override = TRUE;
1180 #ifndef DISABLE_EVENT
1181 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1182 return 0; /* reject, with peercert set */
1185 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1186 *calledp ? "" : " authenticated", dn);
1190 return 1; /* accept, at least for this level */
1194 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1196 return verify_callback(preverify_ok, x509ctx, &tls_out,
1197 &client_verify_callback_called, &client_verify_optional);
1201 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1203 return verify_callback(preverify_ok, x509ctx, &tls_in,
1204 &server_verify_callback_called, &server_verify_optional);
1210 /* This gets called *by* the dane library verify callback, which interposes
1214 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1216 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1218 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1219 #ifndef DISABLE_EVENT
1220 BOOL dummy_called, optional = FALSE;
1223 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1225 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1226 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1227 deliver_host_address);
1230 dn[sizeof(dn)-1] = '\0';
1232 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1233 preverify_ok ? "ok":"BAD", depth, dn);
1235 #ifndef DISABLE_EVENT
1236 if (verify_event(&tls_out, cert, depth, dn,
1237 &dummy_called, &optional, US"DANE"))
1238 return 0; /* reject, with peercert set */
1241 if (preverify_ok == 1)
1243 tls_out.dane_verified = TRUE;
1244 #ifndef DISABLE_OCSP
1245 if (client_static_state->u_ocsp.client.verify_store)
1246 { /* client, wanting stapling */
1247 /* Add the server cert's signing chain as the one
1248 for the verification of the OCSP stapled information. */
1250 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1253 sk_X509_push(client_static_state->verify_stack, cert);
1259 int err = X509_STORE_CTX_get_error(x509ctx);
1261 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1262 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1265 return preverify_ok;
1268 #endif /*SUPPORT_DANE*/
1271 #ifndef DISABLE_OCSP
1272 /*************************************************
1273 * Load OCSP information into state *
1274 *************************************************/
1275 /* Called to load the server OCSP response from the given file into memory, once
1276 caller has determined this is needed. Checks validity. Debugs a message
1279 ASSUMES: single response, for single cert.
1282 state various parts of session state
1283 filename the filename putatively holding an OCSP response
1284 is_pem file is PEM format; otherwise is DER
1288 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1292 OCSP_RESPONSE * resp;
1293 OCSP_BASICRESP * basic_response;
1294 OCSP_SINGLERESP * single_response;
1295 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1296 STACK_OF(X509) * sk;
1297 unsigned long verify_flags;
1298 int status, reason, i;
1301 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1303 if (!filename || !*filename) return;
1306 if (!(bio = BIO_new_file(CS filename, "rb")))
1308 log_write(0, LOG_MAIN|LOG_PANIC,
1309 "Failed to open OCSP response file \"%s\": %.100s",
1310 filename, ERR_reason_error_string(ERR_get_error()));
1316 uschar * data, * freep;
1319 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1321 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
1322 filename, ERR_reason_error_string(ERR_get_error()));
1326 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1327 OPENSSL_free(freep);
1330 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1335 log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
1336 filename, ERR_reason_error_string(ERR_get_error()));
1340 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1342 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1343 OCSP_response_status_str(status), status);
1349 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1350 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1355 if (!(basic_response = OCSP_response_get1_basic(resp)))
1358 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1362 sk = state->verify_stack;
1363 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1365 /* May need to expose ability to adjust those flags?
1366 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1367 OCSP_TRUSTOTHER OCSP_NOINTERN */
1369 /* This does a full verify on the OCSP proof before we load it for serving
1370 up; possibly overkill - just date-checks might be nice enough.
1372 OCSP_basic_verify takes a "store" arg, but does not
1373 use it for the chain verification, which is all we do
1374 when OCSP_NOVERIFY is set. The content from the wire
1375 "basic_response" and a cert-stack "sk" are all that is used.
1377 We have a stack, loaded in setup_certs() if tls_verify_certificates
1378 was a file (not a directory, or "system"). It is unfortunate we
1379 cannot used the connection context store, as that would neatly
1380 handle the "system" case too, but there seems to be no library
1381 function for getting a stack from a store.
1382 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1383 We do not free the stack since it could be needed a second time for
1386 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1387 be a public interface into the OpenSSL library (there's no manual entry) -
1388 But what with? We also use OCSP_basic_verify in the client stapling callback.
1389 And there we NEED it; we must verify that status... unless the
1390 library does it for us anyway? */
1392 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
1396 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1397 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
1402 /* Here's the simplifying assumption: there's only one response, for the
1403 one certificate we use, and nothing for anything else in a chain. If this
1404 proves false, we need to extract a cert id from our issued cert
1405 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1406 right cert in the stack and then calls OCSP_single_get0_status()).
1408 I'm hoping to avoid reworking a bunch more of how we handle state here.
1410 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1413 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1416 debug_printf("Unable to get first response from OCSP basic response.\n");
1420 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1421 if (status != V_OCSP_CERTSTATUS_GOOD)
1423 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1424 OCSP_cert_status_str(status), status,
1425 OCSP_crl_reason_str(reason), reason);
1429 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1431 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
1436 /* Add the resp to the list used by tls_server_stapling_cb() */
1438 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1439 while (oentry = *op)
1441 *op = oentry = store_get(sizeof(ocsp_resplist), FALSE);
1442 oentry->next = NULL;
1443 oentry->resp = resp;
1448 if (f.running_in_test_harness)
1450 extern char ** environ;
1451 if (environ) for (uschar ** p = USS environ; *p; p++)
1452 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1454 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1455 goto supply_response;
1463 ocsp_free_response_list(exim_openssl_state_st * cbinfo)
1465 for (ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; olist;
1466 olist = olist->next)
1467 OCSP_RESPONSE_free(olist->resp);
1468 cbinfo->u_ocsp.server.olist = NULL;
1470 #endif /*!DISABLE_OCSP*/
1477 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1480 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1481 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1482 return tls_error(string_sprintf(
1483 "SSL_CTX_use_certificate_chain_file file=%s", file),
1484 cbinfo->host, NULL, errstr);
1489 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1492 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1493 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1494 return tls_error(string_sprintf(
1495 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1502 /* Called once during tls_init and possibly again during TLS setup, for a
1503 new context, if Server Name Indication was used and tls_sni was seen in
1504 the certificate string.
1507 sctx the SSL_CTX* to update
1508 state various parts of session state
1509 errstr error string pointer
1511 Returns: OK/DEFER/FAIL
1515 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1520 if (!state->certificate)
1522 if (!state->is_server) /* client */
1525 if (tls_install_selfsign(sctx, errstr) != OK)
1532 if ( !reexpand_tls_files_for_sni
1533 && ( Ustrstr(state->certificate, US"tls_sni")
1534 || Ustrstr(state->certificate, US"tls_in_sni")
1535 || Ustrstr(state->certificate, US"tls_out_sni")
1537 reexpand_tls_files_for_sni = TRUE;
1539 if (!expand_check(state->certificate, US"tls_certificate", &expanded, errstr))
1543 if (state->is_server)
1545 const uschar * file_list = expanded;
1548 #ifndef DISABLE_OCSP
1549 const uschar * olist = state->u_ocsp.server.file;
1552 BOOL fmt_pem = FALSE;
1555 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1557 if (olist && !*olist)
1560 if ( state->u_ocsp.server.file_expanded && olist
1561 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1563 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1568 ocsp_free_response_list(state);
1569 state->u_ocsp.server.file_expanded = olist;
1573 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1575 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1578 #ifndef DISABLE_OCSP
1580 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1582 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1587 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1592 ocsp_load_response(state, ofile, fmt_pem);
1595 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1599 else /* would there ever be a need for multiple client certs? */
1600 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1603 if ( state->privatekey
1604 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr))
1607 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1608 of the expansion is an empty string, ignore it also, and assume the private
1609 key is in the same file as the certificate. */
1611 if (expanded && *expanded)
1612 if (state->is_server)
1614 const uschar * file_list = expanded;
1618 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1619 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1622 else /* would there ever be a need for multiple client certs? */
1623 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1633 /**************************************************
1634 * One-time init credentials for server and client *
1635 **************************************************/
1638 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1639 uschar * ciphers, uschar ** errstr)
1641 for (uschar * s = ciphers; *s; s++ ) if (*s == '_') *s = '-';
1642 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1643 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1644 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1645 state->server_cipher_list = ciphers;
1652 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1655 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1656 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1658 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1660 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1662 /* Set up the information callback, which outputs if debugging is at a suitable
1667 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1668 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1669 /* this needs a debug build of OpenSSL */
1670 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
1672 #ifdef OPENSSL_HAVE_KEYLOG_CB
1673 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
1677 /* Automatically re-try reads/writes after renegotiation. */
1678 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1685 tls_server_creds_init(void)
1688 uschar * dummy_errstr;
1689 unsigned lifetime = 0;
1693 state_server.lib_state = null_tls_preload;
1695 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1697 state_server.lib_state.lib_ctx = ctx;
1699 /* Preload DH params and EC curve */
1701 if (opt_unset_or_noexpand(tls_dhparam))
1703 DEBUG(D_tls) debug_printf("TLS: preloading DH params for server\n");
1704 if (init_dh(ctx, tls_dhparam, &dummy_errstr))
1705 state_server.lib_state.dh = TRUE;
1708 DEBUG(D_tls) debug_printf("TLS: not preloading DH params for server\n");
1709 if (opt_unset_or_noexpand(tls_eccurve))
1711 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for server\n");
1712 if (init_ecdh(ctx, &dummy_errstr))
1713 state_server.lib_state.ecdh = TRUE;
1716 DEBUG(D_tls) debug_printf("TLS: not preloading ECDH curve for server\n");
1718 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1719 /* If we can, preload the server-side cert, key and ocsp */
1721 if ( opt_set_and_noexpand(tls_certificate)
1722 # ifndef DISABLE_OCSP
1723 && opt_unset_or_noexpand(tls_ocsp_file)
1725 && opt_unset_or_noexpand(tls_privatekey))
1727 /* Set watches on the filenames. The implementation does de-duplication
1728 so we can just blindly do them all. */
1730 if ( tls_set_watch(tls_certificate, TRUE)
1731 # ifndef DISABLE_OCSP
1732 && tls_set_watch(tls_ocsp_file, TRUE)
1734 && tls_set_watch(tls_privatekey, TRUE))
1736 state_server.certificate = tls_certificate;
1737 state_server.privatekey = tls_privatekey;
1738 #ifndef DISABLE_OCSP
1739 state_server.u_ocsp.server.file = tls_ocsp_file;
1742 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1743 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1744 state_server.lib_state.conn_certs = TRUE;
1747 else if ( !tls_certificate && !tls_privatekey
1748 # ifndef DISABLE_OCSP
1752 { /* Generate & preload a selfsigned cert. No files to watch. */
1753 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1755 state_server.lib_state.conn_certs = TRUE;
1756 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1760 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1763 /* If we can, preload the Authorities for checking client certs against.
1764 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1765 at TLS conn startup */
1767 if ( opt_set_and_noexpand(tls_verify_certificates)
1768 && opt_unset_or_noexpand(tls_crl))
1770 /* Watch the default dir also as they are always included */
1772 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1773 && tls_set_watch(tls_verify_certificates, FALSE)
1774 && tls_set_watch(tls_crl, FALSE))
1776 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1778 if (setup_certs(ctx, tls_verify_certificates, tls_crl, NULL, &dummy_errstr)
1780 state_server.lib_state.cabundle = TRUE;
1784 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1785 #endif /* EXIM_HAVE_INOTIFY */
1788 /* If we can, preload the ciphers control string */
1790 if (opt_set_and_noexpand(tls_require_ciphers))
1792 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1793 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1794 &dummy_errstr) == OK)
1795 state_server.lib_state.pri_string = TRUE;
1798 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1805 /* Preload whatever creds are static, onto a transport. The client can then
1806 just copy the pointer as it starts up.
1807 Called from the daemon after a cache-invalidate with watch set; called from
1808 a queue-run startup with watch clear. */
1811 tls_client_creds_init(transport_instance * t, BOOL watch)
1813 smtp_transport_options_block * ob = t->options_block;
1814 exim_openssl_state_st tpt_dummy_state;
1815 host_item * dummy_host = (host_item *)1;
1816 uschar * dummy_errstr;
1821 ob->tls_preload = null_tls_preload;
1822 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1824 ob->tls_preload.lib_ctx = ctx;
1826 tpt_dummy_state.lib_state = ob->tls_preload;
1828 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1829 if ( opt_set_and_noexpand(ob->tls_certificate)
1830 && opt_unset_or_noexpand(ob->tls_privatekey))
1833 || ( tls_set_watch(ob->tls_certificate, FALSE)
1834 && tls_set_watch(ob->tls_privatekey, FALSE)
1837 uschar * pkey = ob->tls_privatekey;
1840 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1842 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1844 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1845 pkey ? pkey : ob->tls_certificate,
1848 ob->tls_preload.conn_certs = TRUE;
1853 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1856 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1857 && opt_unset_or_noexpand(ob->tls_crl))
1860 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1861 && tls_set_watch(ob->tls_verify_certificates, FALSE)
1862 && tls_set_watch(ob->tls_crl, FALSE)
1866 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1868 if (setup_certs(ctx, ob->tls_verify_certificates,
1869 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
1870 ob->tls_preload.cabundle = TRUE;
1875 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1877 #endif /*EXIM_HAVE_INOTIFY*/
1881 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1882 /* Invalidate the creds cached, by dropping the current ones.
1883 Call when we notice one of the source files has changed. */
1886 tls_server_creds_invalidate(void)
1888 SSL_CTX_free(state_server.lib_state.lib_ctx);
1889 state_server.lib_state = null_tls_preload;
1894 tls_client_creds_invalidate(transport_instance * t)
1896 smtp_transport_options_block * ob = t->options_block;
1897 SSL_CTX_free(ob->tls_preload.lib_ctx);
1898 ob->tls_preload = null_tls_preload;
1904 tls_server_creds_invalidate(void)
1908 tls_client_creds_invalidate(transport_instance * t)
1911 #endif /*EXIM_HAVE_INOTIFY*/
1915 #ifndef DISABLE_OCSP
1917 x509_store_dump_cert_s_names(X509_STORE * store)
1919 STACK_OF(X509_OBJECT) * roots= store->objs;
1920 static uschar name[256];
1922 for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
1924 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
1925 if(tmp_obj->type == X509_LU_X509)
1927 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
1928 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
1930 name[sizeof(name)-1] = '\0';
1931 debug_printf(" %s\n", name);
1940 #ifndef DISABLE_TLS_RESUME
1941 /* Manage the keysets used for encrypting the session tickets, on the server. */
1943 typedef struct { /* Session ticket encryption key */
1946 const EVP_CIPHER * aes_cipher;
1947 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
1948 const EVP_MD * hmac_hash;
1949 uschar hmac_key[16];
1954 static exim_stek exim_tk; /* current key */
1955 static exim_stek exim_tk_old; /* previous key */
1960 time_t t = time(NULL);
1962 if (exim_tk.name[0])
1964 if (exim_tk.renew >= t) return;
1965 exim_tk_old = exim_tk;
1968 if (f.running_in_test_harness) ssl_session_timeout = 6;
1970 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
1971 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
1972 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
1973 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
1975 exim_tk.name[0] = 'E';
1976 exim_tk.aes_cipher = EVP_aes_256_cbc();
1977 exim_tk.hmac_hash = EVP_sha256();
1978 exim_tk.expire = t + ssl_session_timeout;
1979 exim_tk.renew = t + ssl_session_timeout/2;
1985 if (!exim_tk.name[0]) return NULL;
1990 tk_find(const uschar * name)
1992 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
1993 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
1997 /* Callback for session tickets, on server */
1999 ticket_key_callback(SSL * ssl, uschar key_name[16],
2000 uschar * iv, EVP_CIPHER_CTX * c_ctx, HMAC_CTX * hctx, int enc)
2002 tls_support * tlsp = state_server.tlsp;
2007 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
2008 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2010 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
2011 return -1; /* insufficient random */
2013 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
2014 return 0; /* key couldn't be created */
2015 memcpy(key_name, key->name, 16);
2016 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
2018 /*XXX will want these dependent on the ssl session strength */
2019 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2020 key->hmac_hash, NULL);
2021 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2023 DEBUG(D_tls) debug_printf("ticket created\n");
2028 time_t now = time(NULL);
2030 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
2031 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2033 if (!(key = tk_find(key_name)) || key->expire < now)
2037 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
2038 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
2043 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2044 key->hmac_hash, NULL);
2045 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2047 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2049 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2050 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2051 be better. To do that we'd have to encode ticket lifetime in the name as
2052 we don't yet see the restored session. Could check posthandshake for TLS1.3
2053 and trigger a new ticket then, but cannot do that for TLS1.2 */
2054 return key->renew < now ? 2 : 1;
2062 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2063 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2065 /* If verification is optional, don't fail if no certificate */
2067 SSL_CTX_set_verify(ctx,
2068 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2073 /*************************************************
2074 * Callback to handle SNI *
2075 *************************************************/
2077 /* Called when acting as server during the TLS session setup if a Server Name
2078 Indication extension was sent by the client.
2080 API documentation is OpenSSL s_server.c implementation.
2083 s SSL* of the current session
2084 ad unknown (part of OpenSSL API) (unused)
2085 arg Callback of "our" registered data
2087 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2089 XXX might need to change to using ClientHello callback,
2090 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2093 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2095 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
2097 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2098 exim_openssl_state_st *state = (exim_openssl_state_st *) arg;
2100 int old_pool = store_pool;
2101 uschar * dummy_errstr;
2104 return SSL_TLSEXT_ERR_OK;
2106 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2107 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2109 /* Make the extension value available for expansion */
2110 store_pool = POOL_PERM;
2111 tls_in.sni = string_copy_taint(US servername, TRUE);
2112 store_pool = old_pool;
2114 if (!reexpand_tls_files_for_sni)
2115 return SSL_TLSEXT_ERR_OK;
2117 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2118 not confident that memcpy wouldn't break some internal reference counting.
2119 Especially since there's a references struct member, which would be off. */
2121 if (lib_ctx_new(&server_sni, NULL, &dummy_errstr) != OK)
2124 /* Not sure how many of these are actually needed, since SSL object
2125 already exists. Might even need this selfsame callback, for reneg? */
2128 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2129 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2130 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2131 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2132 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2133 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2134 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2137 if ( !init_dh(server_sni, state->dhparam, &dummy_errstr)
2138 || !init_ecdh(server_sni, &dummy_errstr)
2142 if ( state->server_cipher_list
2143 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2146 #ifndef DISABLE_OCSP
2147 if (state->u_ocsp.server.file)
2149 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2150 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2156 if ( !expand_check(tls_verify_certificates, US"tls_verify_certificates",
2157 &expcerts, &dummy_errstr)
2158 || (rc = setup_certs(server_sni, expcerts, tls_crl, NULL,
2159 &dummy_errstr)) != OK)
2162 if (expcerts && *expcerts)
2163 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2166 /* do this after setup_certs, because this can require the certs for verifying
2167 OCSP information. */
2168 if ((rc = tls_expand_session_files(server_sni, state, &dummy_errstr)) != OK)
2171 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2172 SSL_set_SSL_CTX(s, server_sni);
2173 return SSL_TLSEXT_ERR_OK;
2175 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
2177 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2182 #ifdef EXIM_HAVE_ALPN
2183 /*************************************************
2184 * Callback to handle ALPN *
2185 *************************************************/
2187 /* Called on server if tls_alpn nonblank after expansion,
2188 when client offers ALPN, after the SNI callback.
2189 If set and not matching the list then we dump the connection */
2192 tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen,
2193 const uschar * in, unsigned int inlen, void * arg)
2195 server_seen_alpn = TRUE;
2198 debug_printf("Received TLS ALPN offer:");
2199 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2202 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2203 debug_printf(" '%.*s'", siz, in + pos + 1);
2205 debug_printf(". Our list: '%s'\n", tls_alpn);
2208 /* Look for an acceptable ALPN */
2210 if ( inlen > 1 /* at least one name */
2211 && in[0]+1 == inlen /* filling the vector, so exactly one name */
2214 const uschar * list = tls_alpn;
2216 for (uschar * name; name = string_nextinlist(&list, &sep, NULL, 0); )
2217 if (Ustrncmp(in+1, name, in[0]) == 0)
2219 *out = in+1; /* we checked for exactly one, so can just point to it */
2221 return SSL_TLSEXT_ERR_OK; /* use ALPN */
2225 /* More than one name from clilent, or name did not match our list. */
2227 /* This will be fatal to the TLS conn; would be nice to kill TCP also.
2228 Maybe as an option in future; for now leave control to the config (must-tls). */
2230 DEBUG(D_tls) debug_printf("TLS ALPN rejected\n");
2231 return SSL_TLSEXT_ERR_ALERT_FATAL;
2233 #endif /* EXIM_HAVE_ALPN */
2237 #ifndef DISABLE_OCSP
2239 /*************************************************
2240 * Callback to handle OCSP Stapling *
2241 *************************************************/
2243 /* Called when acting as server during the TLS session setup if the client
2244 requests OCSP information with a Certificate Status Request.
2246 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2252 tls_server_stapling_cb(SSL *s, void *arg)
2254 const exim_openssl_state_st * state = arg;
2255 ocsp_resplist * olist = state->u_ocsp.server.olist;
2256 uschar * response_der; /*XXX blob */
2257 int response_der_len;
2260 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2261 olist ? "have" : "lack");
2263 tls_in.ocsp = OCSP_NOT_RESP;
2265 return SSL_TLSEXT_ERR_NOACK;
2267 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
2269 const X509 * cert_sent = SSL_get_certificate(s);
2270 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2271 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2273 for (; olist; olist = olist->next)
2275 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2276 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2277 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2278 ASN1_INTEGER * res_cert_serial;
2279 const BIGNUM * resp_bn;
2280 ASN1_OCTET_STRING * res_cert_iNameHash;
2283 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2284 (OCSP_CERTID *) cid);
2285 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2289 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2290 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2293 if (BN_cmp(cert_bn, resp_bn) == 0)
2295 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2297 /*XXX TODO: check the rest of the list for duplicate matches.
2298 If any, need to also check the Issuer Name hash.
2299 Without this, we will provide the wrong status in the case of
2304 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2308 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2309 return SSL_TLSEXT_ERR_NOACK;
2315 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2316 return SSL_TLSEXT_ERR_NOACK;
2320 /*XXX could we do the i2d earlier, rather than during the callback? */
2321 response_der = NULL;
2322 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2323 if (response_der_len <= 0)
2324 return SSL_TLSEXT_ERR_NOACK;
2326 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2327 response_der, response_der_len);
2328 tls_in.ocsp = OCSP_VFIED;
2329 return SSL_TLSEXT_ERR_OK;
2334 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
2336 BIO_printf(bp, "\t%s: ", str);
2337 ASN1_GENERALIZEDTIME_print(bp, time);
2342 tls_client_stapling_cb(SSL *s, void *arg)
2344 exim_openssl_state_st * cbinfo = arg;
2345 const unsigned char * p;
2347 OCSP_RESPONSE * rsp;
2348 OCSP_BASICRESP * bs;
2351 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2352 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
2355 /* Expect this when we requested ocsp but got none */
2356 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2357 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2359 DEBUG(D_tls) debug_printf(" null\n");
2360 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2363 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2365 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2366 if (LOGGING(tls_cipher))
2367 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2369 DEBUG(D_tls) debug_printf(" parse error\n");
2373 if (!(bs = OCSP_response_get1_basic(rsp)))
2375 tls_out.ocsp = OCSP_FAILED;
2376 if (LOGGING(tls_cipher))
2377 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2379 DEBUG(D_tls) debug_printf(" error parsing response\n");
2380 OCSP_RESPONSE_free(rsp);
2384 /* We'd check the nonce here if we'd put one in the request. */
2385 /* However that would defeat cacheability on the server so we don't. */
2387 /* This section of code reworked from OpenSSL apps source;
2388 The OpenSSL Project retains copyright:
2389 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2393 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2394 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2397 DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
2399 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2401 /* Use the chain that verified the server cert to verify the stapled info */
2402 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
2404 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
2405 cbinfo->u_ocsp.client.verify_store, OCSP_NOEXPLICIT)) <= 0)
2406 if (ERR_peek_error())
2408 tls_out.ocsp = OCSP_FAILED;
2409 if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
2410 "Received TLS cert status response, itself unverifiable: %s",
2411 ERR_reason_error_string(ERR_peek_error()));
2412 BIO_printf(bp, "OCSP response verify failure\n");
2413 ERR_print_errors(bp);
2414 OCSP_RESPONSE_print(bp, rsp, 0);
2418 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2419 " in the root CA certificate; ignoring\n");
2421 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2423 /*XXX So we have a good stapled OCSP status. How do we know
2424 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2425 OCSP_resp_find_status() which matches on a cert id, which presumably
2426 we should use. Making an id needs OCSP_cert_id_new(), which takes
2427 issuerName, issuerKey, serialNumber. Are they all in the cert?
2429 For now, carry on blindly accepting the resp. */
2432 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2433 OCSP_resp_count(bs) - 1;
2435 sk_OCSP_SINGLERESP_num(sresp) - 1;
2439 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2441 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2443 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2444 - but what happens with a GnuTLS-style input?
2446 we could do with a debug label for each singleresp
2447 - it has a certID with a serialNumber, but I see no API to get that
2449 status = OCSP_single_get0_status(single, &reason, &rev,
2450 &thisupd, &nextupd);
2452 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
2453 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
2454 if (!OCSP_check_validity(thisupd, nextupd,
2455 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2457 tls_out.ocsp = OCSP_FAILED;
2458 DEBUG(D_tls) ERR_print_errors(bp);
2459 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
2463 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2464 OCSP_cert_status_str(status));
2467 case V_OCSP_CERTSTATUS_GOOD:
2468 continue; /* the idx loop */
2469 case V_OCSP_CERTSTATUS_REVOKED:
2470 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2471 reason != -1 ? "; reason: " : "",
2472 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2473 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2476 log_write(0, LOG_MAIN,
2477 "Server certificate status unknown, in OCSP stapling");
2485 tls_out.ocsp = OCSP_VFIED;
2489 tls_out.ocsp = OCSP_FAILED;
2490 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2495 OCSP_RESPONSE_free(rsp);
2498 #endif /*!DISABLE_OCSP*/
2501 /*************************************************
2502 * Initialize for TLS *
2503 *************************************************/
2504 /* Called from both server and client code, to do preliminary initialization
2505 of the library. We allocate and return a context structure.
2508 host connected host, if client; NULL if server
2509 ob transport options block, if client; NULL if server
2510 ocsp_file file of stapling info (server); flag for require ocsp (client)
2511 addr address if client; NULL if server (for some randomness)
2512 caller_state place to put pointer to allocated state-struct
2513 errstr error string pointer
2515 Returns: OK/DEFER/FAIL
2519 tls_init(host_item * host, smtp_transport_options_block * ob,
2520 #ifndef DISABLE_OCSP
2523 address_item *addr, exim_openssl_state_st ** caller_state,
2528 exim_openssl_state_st * state;
2531 if (host) /* client */
2533 state = store_malloc(sizeof(exim_openssl_state_st));
2534 memset(state, 0, sizeof(*state));
2535 state->certificate = ob->tls_certificate;
2536 state->privatekey = ob->tls_privatekey;
2537 state->is_server = FALSE;
2538 state->dhparam = NULL;
2539 state->lib_state = ob->tls_preload;
2543 state = &state_server;
2544 state->certificate = tls_certificate;
2545 state->privatekey = tls_privatekey;
2546 state->is_server = TRUE;
2547 state->dhparam = tls_dhparam;
2548 state->lib_state = state_server.lib_state;
2554 if (!state->lib_state.pri_string)
2555 state->server_cipher_list = NULL;
2557 #ifndef DISABLE_EVENT
2558 state->event_action = NULL;
2563 /* It turns out that we need to seed the random number generator this early in
2564 order to get the full complement of ciphers to work. It took me roughly a day
2565 of work to discover this by experiment.
2567 On systems that have /dev/urandom, SSL may automatically seed itself from
2568 there. Otherwise, we have to make something up as best we can. Double check
2571 Although we likely called this before, at daemon startup, this is a chance
2572 to mix in further variable info (time, pid) if needed. */
2574 if (!lib_rand_init(addr))
2575 return tls_error(US"RAND_status", host,
2576 US"unable to seed random number generator", errstr);
2578 /* Apply administrator-supplied work-arounds.
2579 Historically we applied just one requested option,
2580 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2581 moved to an administrator-controlled list of options to specify and
2582 grandfathered in the first one as the default value for "openssl_options".
2584 No OpenSSL version number checks: the options we accept depend upon the
2585 availability of the option value macros from OpenSSL. */
2588 if (!tls_openssl_options_parse(openssl_options, &init_options))
2589 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2591 /* Create a context.
2592 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2593 negotiation in the different methods; as far as I can tell, the only
2594 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2595 when OpenSSL is built without SSLv2 support.
2596 By disabling with openssl_options, we can let admins re-enable with the
2599 if (!(ctx = state->lib_state.lib_ctx))
2601 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2603 state->lib_state.lib_ctx = ctx;
2606 #ifndef DISABLE_TLS_RESUME
2607 tlsp->resumption = RESUME_SUPPORTED;
2611 #ifndef DISABLE_TLS_RESUME
2612 /* Should the server offer session resumption? */
2613 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2615 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2616 init_options &= ~SSL_OP_NO_TICKET;
2617 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2618 tlsp->host_resumable = TRUE;
2622 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
2623 if (!(SSL_CTX_set_options(ctx, init_options)))
2624 return tls_error(string_sprintf(
2625 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2628 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2630 /* We'd like to disable session cache unconditionally, but foolish Outlook
2631 Express clients then give up the first TLS connection and make a second one
2632 (which works). Only when there is an IMAP service on the same machine.
2633 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2634 now, until we work out a decent way of presenting control to the config. It
2635 will never be used because we use a new context every time. */
2637 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2640 /* Initialize with DH parameters if supplied */
2641 /* Initialize ECDH temp key parameter selection */
2645 if (state->lib_state.dh)
2646 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2648 if (!init_dh(ctx, state->dhparam, errstr)) return DEFER;
2650 if (state->lib_state.ecdh)
2651 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
2653 if (!init_ecdh(ctx, errstr)) return DEFER;
2656 /* Set up certificate and key (and perhaps OCSP info) */
2658 if (state->lib_state.conn_certs)
2661 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
2665 #ifndef DISABLE_OCSP
2668 state->u_ocsp.server.file = ocsp_file;
2669 state->u_ocsp.server.file_expanded = NULL;
2670 state->u_ocsp.server.olist = NULL;
2673 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
2676 /* If we need to handle SNI or OCSP, do so */
2678 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2679 # ifndef DISABLE_OCSP
2680 if (!(state->verify_stack = sk_X509_new_null()))
2682 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2687 if (!host) /* server */
2689 # ifndef DISABLE_OCSP
2690 /* We check u_ocsp.server.file, not server.olist, because we care about if
2691 the option exists, not what the current expansion might be, as SNI might
2692 change the certificate and OCSP file in use between now and the time the
2693 callback is invoked. */
2694 if (state->u_ocsp.server.file)
2696 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2697 SSL_CTX_set_tlsext_status_arg(ctx, state);
2700 /* We always do this, so that $tls_sni is available even if not used in
2702 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2703 SSL_CTX_set_tlsext_servername_arg(ctx, state);
2705 # ifdef EXIM_HAVE_ALPN
2706 if (tls_alpn && *tls_alpn)
2709 if ( expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr)
2710 && *exp_alpn && !isblank(*exp_alpn))
2712 tls_alpn = exp_alpn; /* subprocess so ok to overwrite */
2713 SSL_CTX_set_alpn_select_cb(ctx, tls_server_alpn_cb, state);
2720 # ifndef DISABLE_OCSP
2722 if(ocsp_file) /* wanting stapling */
2724 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
2726 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2729 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2730 SSL_CTX_set_tlsext_status_arg(ctx, state);
2735 state->verify_cert_hostnames = NULL;
2737 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
2738 /* Set up the RSA callback */
2739 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
2742 /* Finally, set the session cache timeout, and we are done.
2743 The period appears to be also used for (server-generated) session tickets */
2745 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
2746 DEBUG(D_tls) debug_printf("Initialized TLS\n");
2748 *caller_state = state;
2756 /*************************************************
2757 * Get name of cipher in use *
2758 *************************************************/
2761 Argument: pointer to an SSL structure for the connection
2762 pointer to number of bits for cipher
2763 Returns: pointer to allocated string in perm-pool
2767 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
2769 int pool = store_pool;
2770 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
2771 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2772 the accessor functions use const in the prototype. */
2774 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
2777 SSL_CIPHER_get_bits(c, bits);
2779 store_pool = POOL_PERM;
2780 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2782 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2787 /* Get IETF-standard name for ciphersuite.
2788 Argument: pointer to an SSL structure for the connection
2789 Returns: pointer to string
2792 static const uschar *
2793 cipher_stdname_ssl(SSL * ssl)
2795 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2796 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2798 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2799 return cipher_stdname(id >> 8, id & 0xff);
2804 static const uschar *
2805 tlsver_name(SSL * ssl)
2808 int pool = store_pool;
2810 store_pool = POOL_PERM;
2811 s = string_copy(US SSL_get_version(ssl));
2813 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
2814 for (;; p++) if (!(*p = p[1])) break;
2820 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
2822 /*XXX we might consider a list-of-certs variable for the cert chain.
2823 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2824 in list-handling functions, also consider the difference between the entire
2825 chain and the elements sent by the peer. */
2827 tlsp->peerdn = NULL;
2829 /* Will have already noted peercert on a verify fail; possibly not the leaf */
2830 if (!tlsp->peercert)
2831 tlsp->peercert = SSL_get_peer_certificate(ssl);
2832 /* Beware anonymous ciphers which lead to server_cert being NULL */
2834 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2835 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2838 int oldpool = store_pool;
2840 peerdn[siz-1] = '\0'; /* paranoia */
2841 store_pool = POOL_PERM;
2842 tlsp->peerdn = string_copy(peerdn);
2843 store_pool = oldpool;
2845 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2846 but they don't get called on session-resumption. So use the official
2847 interface, which uses the resumed value. Unfortunately this claims verified
2848 when it actually failed but we're in try-verify mode, due to us wanting the
2849 knowlege that it failed so needing to have the callback and forcing a
2850 permissive return. If we don't force it, the TLS startup is failed.
2851 The extra bit of information is set in verify_override in the cb, stashed
2852 for resumption next to the TLS session, and used here. */
2854 if (!tlsp->verify_override)
2855 tlsp->certificate_verified =
2857 tlsp->dane_verified ||
2859 SSL_get_verify_result(ssl) == X509_V_OK;
2867 /*************************************************
2868 * Set up for verifying certificates *
2869 *************************************************/
2871 #ifndef DISABLE_OCSP
2872 /* Load certs from file, return TRUE on success */
2875 chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
2878 STACK_OF(X509) * verify_stack = *vp;
2881 while (sk_X509_num(verify_stack) > 0)
2882 X509_free(sk_X509_pop(verify_stack));
2884 verify_stack = sk_X509_new_null();
2886 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
2887 for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
2888 sk_X509_push(verify_stack, x);
2897 /* Called by both client and server startup; on the server possibly
2898 repeated after a Server Name Indication.
2901 sctx SSL_CTX* to initialise
2902 certs certs file, expanded
2903 crl CRL file or NULL
2904 host NULL in a server; the remote host in a client
2905 errstr error string pointer
2907 Returns: OK/DEFER/FAIL
2911 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
2914 uschar *expcerts, *expcrl;
2916 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
2918 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
2920 if (expcerts && *expcerts)
2922 /* Tell the library to use its compiled-in location for the system default
2923 CA bundle. Then add the ones specified in the config, if any. */
2925 if (!SSL_CTX_set_default_verify_paths(sctx))
2926 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
2928 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
2930 struct stat statbuf;
2932 if (Ustat(expcerts, &statbuf) < 0)
2934 log_write(0, LOG_MAIN|LOG_PANIC,
2935 "failed to stat %s for certificates", expcerts);
2941 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
2942 { file = NULL; dir = expcerts; }
2945 STACK_OF(X509) * verify_stack =
2946 #ifndef DISABLE_OCSP
2947 !host ? state_server.verify_stack :
2950 STACK_OF(X509) ** vp = &verify_stack;
2952 file = expcerts; dir = NULL;
2953 #ifndef DISABLE_OCSP
2954 /* In the server if we will be offering an OCSP proof, load chain from
2955 file for verifying the OCSP proof at load time. */
2957 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
2958 This is inconsistent with the need to verify the OCSP proof of the server cert.
2961 && statbuf.st_size > 0
2962 && state_server.u_ocsp.server.file
2963 && !chain_from_pem_file(file, vp)
2966 log_write(0, LOG_MAIN|LOG_PANIC,
2967 "failed to load cert chain from %s", file);
2973 /* If a certificate file is empty, the load function fails with an
2974 unhelpful error message. If we skip it, we get the correct behaviour (no
2975 certificates are recognized, but the error message is still misleading (it
2976 says no certificate was supplied). But this is better. */
2978 if ( (!file || statbuf.st_size > 0)
2979 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
2980 return tls_error(US"SSL_CTX_load_verify_locations",
2981 host, NULL, errstr);
2983 /* On the server load the list of CAs for which we will accept certs, for
2984 sending to the client. This is only for the one-file
2985 tls_verify_certificates variant.
2986 If a list isn't loaded into the server, but some verify locations are set,
2987 the server end appears to make a wildcard request for client certs.
2988 Meanwhile, the client library as default behaviour *ignores* the list
2989 we send over the wire - see man SSL_CTX_set_client_cert_cb.
2990 Because of this, and that the dir variant is likely only used for
2991 the public-CA bundle (not for a private CA), not worth fixing. */
2995 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
2996 int i = sk_X509_NAME_num(names);
2998 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
2999 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
3000 i, i>1 ? "ies":"y");
3004 debug_printf("Added dir for additional certificate authorities\n");
3008 /* Handle a certificate revocation list. */
3010 #if OPENSSL_VERSION_NUMBER > 0x00907000L
3012 /* This bit of code is now the version supplied by Lars Mainka. (I have
3013 merely reformatted it into the Exim code style.)
3015 "From here I changed the code to add support for multiple crl's
3016 in pem format in one file or to support hashed directory entries in
3017 pem format instead of a file. This method now uses the library function
3018 X509_STORE_load_locations to add the CRL location to the SSL context.
3019 OpenSSL will then handle the verify against CA certs and CRLs by
3020 itself in the verify callback." */
3022 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
3023 if (expcrl && *expcrl)
3025 struct stat statbufcrl;
3026 if (Ustat(expcrl, &statbufcrl) < 0)
3028 log_write(0, LOG_MAIN|LOG_PANIC,
3029 "failed to stat %s for certificates revocation lists", expcrl);
3034 /* is it a file or directory? */
3036 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
3037 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
3041 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
3047 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
3049 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
3050 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
3052 /* setting the flags to check against the complete crl chain */
3054 X509_STORE_set_flags(cvstore,
3055 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
3059 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3067 /*************************************************
3068 * Start a TLS session in a server *
3069 *************************************************/
3070 /* This is called when Exim is running as a server, after having received
3071 the STARTTLS command. It must respond to that command, and then negotiate
3075 errstr pointer to error message
3077 Returns: OK on success
3078 DEFER for errors before the start of the negotiation
3079 FAIL for errors during the negotiation; the server can't
3084 tls_server_start(uschar ** errstr)
3087 uschar * expciphers;
3088 exim_openssl_state_st * dummy_statep;
3091 static uschar peerdn[256];
3093 /* Check for previous activation */
3095 if (tls_in.active.sock >= 0)
3097 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3098 smtp_printf("554 Already in TLS\r\n", FALSE);
3102 /* Initialize the SSL library. If it fails, it will already have logged
3105 rc = tls_init(NULL, NULL,
3106 #ifndef DISABLE_OCSP
3109 NULL, &dummy_statep, &tls_in, errstr);
3110 if (rc != OK) return rc;
3111 ctx = state_server.lib_state.lib_ctx;
3113 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3114 were historically separated by underscores. So that I can use either form in my
3115 tests, and also for general convenience, we turn underscores into hyphens here.
3117 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3118 for TLS 1.3 . Since we do not call it at present we get the default list:
3119 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3122 if (state_server.lib_state.pri_string)
3123 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3126 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3130 && (rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3134 /* If this is a host for which certificate verification is mandatory or
3135 optional, set up appropriately. */
3137 tls_in.certificate_verified = FALSE;
3139 tls_in.dane_verified = FALSE;
3141 server_verify_callback_called = FALSE;
3143 if (verify_check_host(&tls_verify_hosts) == OK)
3144 server_verify_optional = FALSE;
3145 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3146 server_verify_optional = TRUE;
3152 if (!expand_check(tls_verify_certificates, US"tls_verify_certificates",
3155 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3157 if (state_server.lib_state.cabundle)
3158 { DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n"); }
3160 if ((rc = setup_certs(ctx, expcerts, tls_crl, NULL, errstr)) != OK)
3163 if (expcerts && *expcerts)
3164 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3168 #ifndef DISABLE_TLS_RESUME
3169 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3170 /* despite working, appears to always return failure, so ignoring */
3172 #ifdef OPENSSL_HAVE_NUM_TICKETS
3173 # ifndef DISABLE_TLS_RESUME
3174 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3176 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3181 /* Prepare for new connection */
3183 if (!(ssl = SSL_new(ctx)))
3184 return tls_error(US"SSL_new", NULL, NULL, errstr);
3185 state_server.lib_state.lib_ssl = ssl;
3187 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3189 * With the SSL_clear(), we get strange interoperability bugs with
3190 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3191 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3193 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3194 * session shutdown. In this case, we have a brand new object and there's no
3195 * obvious reason to immediately clear it. I'm guessing that this was
3196 * originally added because of incomplete initialisation which the clear fixed,
3197 * in some historic release.
3200 /* Set context and tell client to go ahead, except in the case of TLS startup
3201 on connection, where outputting anything now upsets the clients and tends to
3202 make them disconnect. We need to have an explicit fflush() here, to force out
3203 the response. Other smtp_printf() calls do not need it, because in non-TLS
3204 mode, the fflush() happens when smtp_getc() is called. */
3206 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3207 if (!tls_in.on_connect)
3209 smtp_printf("220 TLS go ahead\r\n", FALSE);
3213 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3214 that the OpenSSL library doesn't. */
3216 SSL_set_wfd(ssl, fileno(smtp_out));
3217 SSL_set_rfd(ssl, fileno(smtp_in));
3218 SSL_set_accept_state(ssl);
3220 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3223 sigalrm_seen = FALSE;
3224 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3225 rc = SSL_accept(ssl);
3230 int error = SSL_get_error(ssl, rc);
3233 case SSL_ERROR_NONE:
3236 case SSL_ERROR_ZERO_RETURN:
3237 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3238 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3240 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3243 tls_close(NULL, TLS_NO_SHUTDOWN);
3246 /* Handle genuine errors */
3250 int r = ERR_GET_REASON(ERR_peek_error());
3251 if ( r == SSL_R_WRONG_VERSION_NUMBER
3252 #ifdef SSL_R_VERSION_TOO_LOW
3253 || r == SSL_R_VERSION_TOO_LOW
3255 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3256 s = string_sprintf("%s (%s)", s, SSL_get_version(ssl));
3257 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
3262 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3263 if (error == SSL_ERROR_SYSCALL)
3267 *errstr = US"SSL_accept: TCP connection closed by peer";
3270 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3272 (void) tls_error(US"SSL_accept", NULL,
3273 sigalrm_seen ? US"timed out"
3274 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3280 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3281 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3282 anon-authentication ciphersuite negotiated. */
3284 #ifndef DISABLE_TLS_RESUME
3285 if (SSL_session_reused(ssl))
3287 tls_in.resumption |= RESUME_USED;
3288 DEBUG(D_tls) debug_printf("Session reused\n");
3292 #ifdef EXIM_HAVE_ALPN
3293 /* If require-alpn, check server_seen_alpn here. Else abort TLS */
3294 if (!tls_alpn || !*tls_alpn)
3295 { DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n"); }
3296 else if (!server_seen_alpn)
3297 if (verify_check_host(&hosts_require_alpn) == OK)
3299 /* We'd like to send a definitive Alert but OpenSSL provides no facility */
3301 tls_error(US"handshake", NULL, US"ALPN required but not negotiated", errstr);
3305 { DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n"); }
3308 const uschar * name;
3310 SSL_get0_alpn_selected(ssl, &name, &len);
3312 debug_printf("ALPN negotiated: '%.*s'\n", (int)*name, name+1);
3314 debug_printf("ALPN: no protocol negotiated\n");
3319 /* TLS has been set up. Record data for the connection,
3320 adjust the input functions to read via TLS, and initialize things. */
3322 #ifdef SSL_get_extms_support
3323 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3325 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3327 tls_in.ver = tlsver_name(ssl);
3328 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3329 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3334 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3335 debug_printf("Shared ciphers: %s\n", buf);
3337 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3339 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
3340 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3345 #ifdef EXIM_HAVE_SESSION_TICKET
3347 SSL_SESSION * ss = SSL_get_session(ssl);
3348 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3349 debug_printf("The session has a ticket, life %lu seconds\n",
3350 SSL_SESSION_get_ticket_lifetime_hint(ss));
3355 /* Record the certificate we presented */
3357 X509 * crt = SSL_get_certificate(ssl);
3358 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3361 /* Channel-binding info for authenticators
3362 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/ */
3365 size_t len = SSL_get_peer_finished(ssl, &c, 0);
3366 int old_pool = store_pool;
3368 SSL_get_peer_finished(ssl, s = store_get((int)len, FALSE), len);
3369 store_pool = POOL_PERM;
3370 tls_in.channelbinding = b64encode_taint(CUS s, (int)len, FALSE);
3371 store_pool = old_pool;
3372 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p\n", tls_in.channelbinding);
3375 /* Only used by the server-side tls (tls_in), including tls_getc.
3376 Client-side (tls_out) reads (seem to?) go via
3377 smtp_read_response()/ip_recv().
3378 Hence no need to duplicate for _in and _out.
3380 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3381 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3382 ssl_xfer_eof = ssl_xfer_error = FALSE;
3384 receive_getc = tls_getc;
3385 receive_getbuf = tls_getbuf;
3386 receive_get_cache = tls_get_cache;
3387 receive_hasc = tls_hasc;
3388 receive_ungetc = tls_ungetc;
3389 receive_feof = tls_feof;
3390 receive_ferror = tls_ferror;
3392 tls_in.active.sock = fileno(smtp_out);
3393 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3401 tls_client_basic_ctx_init(SSL_CTX * ctx,
3402 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3407 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3408 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3409 host patterns if one of them is set with content. */
3411 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3412 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3414 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3415 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3418 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3420 client_verify_optional = FALSE;
3421 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3422 client_verify_optional = TRUE;
3428 if (!expand_check(ob->tls_verify_certificates, US"tls_verify_certificates",
3431 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3433 if (state->lib_state.cabundle)
3434 { DEBUG(D_tls) debug_printf("TLS: CA bundle was preloaded\n"); }
3436 if ((rc = setup_certs(ctx, expcerts, ob->tls_crl, host, errstr)) != OK)
3439 if (expcerts && *expcerts)
3440 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3443 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3445 state->verify_cert_hostnames =
3447 string_domain_utf8_to_alabel(host->certname, NULL);
3451 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3452 state->verify_cert_hostnames);
3460 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3463 const char * hostnames[2] = { CS host->name, NULL };
3466 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3467 return tls_error(US"hostnames load", host, NULL, errstr);
3469 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3470 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3471 ) if (rr->type == T_TLSA && rr->size > 3)
3473 const uschar * p = rr->data;
3474 uint8_t usage, selector, mtype;
3475 const char * mdname;
3479 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3480 if (usage != 2 && usage != 3) continue;
3487 default: continue; /* Only match-types 0, 1, 2 are supported */
3488 case 0: mdname = NULL; break;
3489 case 1: mdname = "sha256"; break;
3490 case 2: mdname = "sha512"; break;
3494 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3497 return tls_error(US"tlsa load", host, NULL, errstr);
3498 case 0: /* action not taken */
3502 tls_out.tlsa_usage |= 1<<usage;
3508 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3511 #endif /*SUPPORT_DANE*/
3515 #ifndef DISABLE_TLS_RESUME
3516 /* On the client, get any stashed session for the given IP from hints db
3517 and apply it to the ssl-connection for attempted resumption. */
3520 tls_retrieve_session(tls_support * tlsp, SSL * ssl, const uschar * key)
3522 tlsp->resumption |= RESUME_SUPPORTED;
3523 if (tlsp->host_resumable)
3525 dbdata_tls_session * dt;
3527 open_db dbblock, * dbm_file;
3529 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3530 DEBUG(D_tls) debug_printf("checking for resumable session for %s\n", key);
3531 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3533 /* key for the db is the IP */
3534 if ((dt = dbfn_read_with_length(dbm_file, key, &len)))
3536 SSL_SESSION * ss = NULL;
3537 const uschar * sess_asn1 = dt->session;
3539 len -= sizeof(dbdata_tls_session);
3540 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3544 ERR_error_string_n(ERR_get_error(),
3545 ssl_errstring, sizeof(ssl_errstring));
3546 debug_printf("decoding session: %s\n", ssl_errstring);
3551 unsigned long lifetime =
3552 #ifdef EXIM_HAVE_SESSION_TICKET
3553 SSL_SESSION_get_ticket_lifetime_hint(ss);
3554 #else /* Use, fairly arbitrilarily, what we as server would */
3555 f.running_in_test_harness ? 6 : ssl_session_timeout;
3557 if (lifetime + dt->time_stamp < time(NULL))
3559 DEBUG(D_tls) debug_printf("session expired\n");
3560 dbfn_delete(dbm_file, key);
3562 else if (!SSL_set_session(ssl, ss))
3566 ERR_error_string_n(ERR_get_error(),
3567 ssl_errstring, sizeof(ssl_errstring));
3568 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3573 DEBUG(D_tls) debug_printf("good session\n");
3574 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3575 tlsp->verify_override = dt->verify_override;
3576 tlsp->ocsp = dt->ocsp;
3581 DEBUG(D_tls) debug_printf("no session record\n");
3582 dbfn_close(dbm_file);
3588 /* On the client, save the session for later resumption */
3591 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3593 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3596 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3598 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3600 # ifdef OPENSSL_HAVE_NUM_TICKETS
3601 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3604 int len = i2d_SSL_SESSION(ss, NULL);
3605 int dlen = sizeof(dbdata_tls_session) + len;
3606 dbdata_tls_session * dt = store_get(dlen, TRUE);
3607 uschar * s = dt->session;
3608 open_db dbblock, * dbm_file;
3610 DEBUG(D_tls) debug_printf("session is resumable\n");
3611 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3613 dt->verify_override = tlsp->verify_override;
3614 dt->ocsp = tlsp->ocsp;
3615 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3617 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3619 const uschar * key = cbinfo->host->address;
3620 dbfn_delete(dbm_file, key);
3621 dbfn_write(dbm_file, key, dt, dlen);
3622 dbfn_close(dbm_file);
3623 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3632 tls_client_ctx_resume_prehandshake(
3633 exim_openssl_client_tls_ctx * exim_client_ctx, tls_support * tlsp,
3634 smtp_transport_options_block * ob, host_item * host)
3636 /* Should the client request a session resumption ticket? */
3637 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3639 tlsp->host_resumable = TRUE;
3641 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3642 SSL_SESS_CACHE_CLIENT
3643 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3644 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3649 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3650 host_item * host, uschar ** errstr)
3652 if (tlsp->host_resumable)
3655 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3656 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3658 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3659 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
3661 tls_error(US"set ex_data", host, NULL, errstr);
3664 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state);
3667 tlsp->resumption = RESUME_SUPPORTED;
3668 /* Pick up a previous session, saved on an old ticket */
3669 tls_retrieve_session(tlsp, ssl, host->address);
3674 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
3677 if (SSL_session_reused(exim_client_ctx->ssl))
3679 DEBUG(D_tls) debug_printf("The session was reused\n");
3680 tlsp->resumption |= RESUME_USED;
3683 #endif /* !DISABLE_TLS_RESUME */
3686 #ifdef EXIM_HAVE_ALPN
3687 /* Expand and convert an Exim list to an ALPN list. False return for fail.
3688 NULL plist return for silent no-ALPN.
3692 tls_alpn_plist(const uschar * tls_alpn, const uschar ** plist, unsigned * plen,
3697 if (!expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr))
3702 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
3707 /* The server implementation only accepts exactly one protocol name
3708 but it's little extra code complexity in the client. */
3710 const uschar * list = exp_alpn;
3711 uschar * p = store_get(Ustrlen(exp_alpn), is_tainted(exp_alpn)), * s, * t;
3715 for (t = p; s = string_nextinlist(&list, &sep, NULL, 0); t += len)
3717 *t++ = len = (uschar) Ustrlen(s);
3720 *plist = (*plen = t - p) ? p : NULL;
3724 #endif /* EXIM_HAVE_ALPN */
3727 /*************************************************
3728 * Start a TLS session in a client *
3729 *************************************************/
3731 /* Called from the smtp transport after STARTTLS has been accepted.
3734 cctx connection context
3735 conn_args connection details
3736 cookie datum for randomness; can be NULL
3737 tlsp record details of TLS channel configuration here; must be non-NULL
3738 errstr error string pointer
3740 Returns: TRUE for success with TLS session context set in connection context,
3745 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3746 void * cookie, tls_support * tlsp, uschar ** errstr)
3748 host_item * host = conn_args->host; /* for msgs and option-tests */
3749 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3750 smtp_transport_options_block * ob = tb
3751 ? (smtp_transport_options_block *)tb->options_block
3752 : &smtp_transport_option_defaults;
3753 exim_openssl_client_tls_ctx * exim_client_ctx;
3754 uschar * expciphers;
3756 static uschar peerdn[256];
3758 #ifndef DISABLE_OCSP
3759 BOOL request_ocsp = FALSE;
3760 BOOL require_ocsp = FALSE;
3764 store_pool = POOL_PERM;
3765 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), FALSE);
3766 exim_client_ctx->corked = NULL;
3770 tlsp->tlsa_usage = 0;
3773 #ifndef DISABLE_OCSP
3775 # ifdef SUPPORT_DANE
3776 /*XXX this should be moved to caller, to be common across gnutls/openssl */
3777 if ( conn_args->dane
3778 && ob->hosts_request_ocsp[0] == '*'
3779 && ob->hosts_request_ocsp[1] == '\0'
3782 /* Unchanged from default. Use a safer one under DANE */
3783 request_ocsp = TRUE;
3784 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3785 " {= {4}{$tls_out_tlsa_usage}} } "
3791 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
3792 request_ocsp = TRUE;
3794 # ifdef SUPPORT_DANE
3798 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3802 rc = tls_init(host, ob,
3803 #ifndef DISABLE_OCSP
3804 (void *)(long)request_ocsp,
3806 cookie, &client_static_state, tlsp, errstr);
3807 if (rc != OK) return FALSE;
3809 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
3811 tlsp->certificate_verified = FALSE;
3812 client_verify_callback_called = FALSE;
3816 if (conn_args->dane)
3818 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3819 other failures should be treated as problems. */
3820 if (ob->dane_require_tls_ciphers &&
3821 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3822 &expciphers, errstr))
3824 if (expciphers && *expciphers == '\0')
3829 !expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
3830 &expciphers, errstr))
3833 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3834 are separated by underscores. So that I can use either form in my tests, and
3835 also for general convenience, we turn underscores into hyphens here. */
3839 uschar *s = expciphers;
3840 while (*s) { if (*s == '_') *s = '-'; s++; }
3841 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
3842 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
3844 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
3850 if (conn_args->dane)
3852 SSL_CTX_set_verify(exim_client_ctx->ctx,
3853 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
3854 verify_callback_client_dane);
3856 if (!DANESSL_library_init())
3858 tls_error(US"library init", host, NULL, errstr);
3861 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
3863 tls_error(US"context init", host, NULL, errstr);
3871 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
3872 client_static_state, errstr) != OK)
3875 #ifndef DISABLE_TLS_RESUME
3876 tls_client_ctx_resume_prehandshake(exim_client_ctx, tlsp, ob, host);
3880 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
3882 tls_error(US"SSL_new", host, NULL, errstr);
3885 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
3887 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
3888 SSL_set_connect_state(exim_client_ctx->ssl);
3892 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
3896 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
3898 else if (!Ustrlen(tlsp->sni))
3902 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
3903 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
3904 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
3906 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
3913 #ifdef EXIM_HAVE_ALPN
3915 const uschar * plist;
3918 if (!tls_alpn_plist(ob->tls_alpn, &plist, &plen, errstr))
3921 if (SSL_set_alpn_protos(exim_client_ctx->ssl, plist, plen) != 0)
3923 tls_error(US"alpn init", host, NULL, errstr);
3927 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
3930 log_write(0, LOG_MAIN, "ALPN unusable with this OpenSSL library version; ignoring \"%s\"\n",
3935 if (conn_args->dane)
3936 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
3940 #ifndef DISABLE_OCSP
3941 /* Request certificate status at connection-time. If the server
3942 does OCSP stapling we will get the callback (set in tls_init()) */
3943 # ifdef SUPPORT_DANE
3947 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3948 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3950 { /* Re-eval now $tls_out_tlsa_usage is populated. If
3951 this means we avoid the OCSP request, we wasted the setup
3952 cost in tls_init(). */
3953 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3954 request_ocsp = require_ocsp
3955 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3962 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
3963 client_static_state->u_ocsp.client.verify_required = require_ocsp;
3964 tlsp->ocsp = OCSP_NOT_RESP;
3968 #ifndef DISABLE_TLS_RESUME
3969 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
3974 #ifndef DISABLE_EVENT
3975 client_static_state->event_action = tb ? tb->event_action : NULL;
3978 /* There doesn't seem to be a built-in timeout on connection. */
3980 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
3981 sigalrm_seen = FALSE;
3982 ALARM(ob->command_timeout);
3983 rc = SSL_connect(exim_client_ctx->ssl);
3987 if (conn_args->dane)
3988 DANESSL_cleanup(exim_client_ctx->ssl);
3993 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
3999 debug_printf("SSL_connect succeeded\n");
4000 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
4002 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
4003 SSL_SESSION_print_keylog(bp, SSL_get_session(exim_client_ctx->ssl));
4009 #ifndef DISABLE_TLS_RESUME
4010 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
4013 #ifdef EXIM_HAVE_ALPN
4014 if (ob->tls_alpn) /* We requested. See what was negotiated. */
4016 const uschar * name;
4019 SSL_get0_alpn_selected(exim_client_ctx->ssl, &name, &len);
4021 { DEBUG(D_tls) debug_printf("ALPN negotiated %u: '%.*s'\n", len, (int)*name, name+1); }
4022 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
4024 /* Would like to send a relevant fatal Alert, but OpenSSL has no API */
4025 tls_error(US"handshake", host, US"ALPN required but not negotiated", errstr);
4031 #ifdef SSL_get_extms_support
4032 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
4034 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
4036 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
4037 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
4038 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
4040 /* Record the certificate we presented */
4042 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
4043 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
4046 /*XXX will this work with continued-TLS? */
4047 /* Channel-binding info for authenticators */
4050 size_t len = SSL_get_finished(exim_client_ctx->ssl, &c, 0);
4051 int old_pool = store_pool;
4053 SSL_get_finished(exim_client_ctx->ssl, s = store_get((int)len, TRUE), len);
4054 store_pool = POOL_PERM;
4055 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, TRUE);
4056 store_pool = old_pool;
4057 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
4060 tlsp->active.sock = cctx->sock;
4061 tlsp->active.tls_ctx = exim_client_ctx;
4062 cctx->tls_ctx = exim_client_ctx;
4071 tls_refill(unsigned lim)
4073 SSL * ssl = state_server.lib_state.lib_ssl;
4077 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4078 ssl_xfer_buffer, ssl_xfer_buffer_size);
4081 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4082 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
4083 MIN(ssl_xfer_buffer_size, lim));
4084 error = SSL_get_error(ssl, inbytes);
4085 if (smtp_receive_timeout > 0) ALARM_CLR(0);
4087 if (had_command_timeout) /* set by signal handler */
4088 smtp_command_timeout_exit(); /* does not return */
4089 if (had_command_sigterm)
4090 smtp_command_sigterm_exit();
4091 if (had_data_timeout)
4092 smtp_data_timeout_exit();
4093 if (had_data_sigint)
4094 smtp_data_sigint_exit();
4096 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
4097 closed down, not that the socket itself has been closed down. Revert to
4098 non-SSL handling. */
4102 case SSL_ERROR_NONE:
4105 case SSL_ERROR_ZERO_RETURN:
4106 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4108 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
4111 tls_close(NULL, TLS_NO_SHUTDOWN);
4114 /* Handle genuine errors */
4116 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4117 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
4118 ssl_xfer_error = TRUE;
4122 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
4123 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
4124 debug_printf(" - syscall %s\n", strerror(errno));
4125 ssl_xfer_error = TRUE;
4129 #ifndef DISABLE_DKIM
4130 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
4132 ssl_xfer_buffer_hwm = inbytes;
4133 ssl_xfer_buffer_lwm = 0;
4138 /*************************************************
4139 * TLS version of getc *
4140 *************************************************/
4142 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
4143 it refills the buffer via the SSL reading function.
4145 Arguments: lim Maximum amount to read/buffer
4146 Returns: the next character or EOF
4148 Only used by the server-side TLS.
4152 tls_getc(unsigned lim)
4154 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4155 if (!tls_refill(lim))
4156 return ssl_xfer_error ? EOF : smtp_getc(lim);
4158 /* Something in the buffer; return next uschar */
4160 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
4166 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm;
4170 tls_getbuf(unsigned * len)
4175 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4176 if (!tls_refill(*len))
4178 if (!ssl_xfer_error) return smtp_getbuf(len);
4183 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4185 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4186 ssl_xfer_buffer_lwm += size;
4193 tls_get_cache(unsigned lim)
4195 #ifndef DISABLE_DKIM
4196 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4197 debug_printf("tls_get_cache\n");
4201 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4207 tls_could_getc(void)
4209 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4210 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4214 /*************************************************
4215 * Read bytes from TLS channel *
4216 *************************************************/
4220 ct_ctx client context pointer, or NULL for the one global server context
4224 Returns: the number of bytes read
4225 -1 after a failed read, including EOF
4227 Only used by the client-side TLS.
4231 tls_read(void * ct_ctx, uschar *buff, size_t len)
4233 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4234 : state_server.lib_state.lib_ssl;
4238 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4239 buff, (unsigned int)len);
4242 inbytes = SSL_read(ssl, CS buff, len);
4243 error = SSL_get_error(ssl, inbytes);
4245 if (error == SSL_ERROR_ZERO_RETURN)
4247 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4250 else if (error != SSL_ERROR_NONE)
4260 /*************************************************
4261 * Write bytes down TLS channel *
4262 *************************************************/
4266 ct_ctx client context pointer, or NULL for the one global server context
4269 more further data expected soon
4271 Returns: the number of bytes after a successful write,
4272 -1 after a failed write
4274 Used by both server-side and client-side TLS. Calling with len zero and more unset
4275 will flush buffered writes; buff can be null for this case.
4279 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4282 int outbytes, error;
4284 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4285 : state_server.lib_state.lib_ssl;
4286 static gstring * server_corked = NULL;
4287 gstring ** corkedp = ct_ctx
4288 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4289 gstring * corked = *corkedp;
4291 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4292 buff, (unsigned long)len, more ? ", more" : "");
4294 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4295 "more" is notified. This hack is only ok if small amounts are involved AND only
4296 one stream does it, in one context (i.e. no store reset). Currently it is used
4297 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4298 We support callouts done by the server process by using a separate client
4299 context for the stashed information. */
4300 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4301 a store reset there, so use POOL_PERM. */
4302 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4306 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4308 int save_pool = store_pool;
4309 store_pool = POOL_PERM;
4311 corked = string_catn(corked, buff, len);
4313 store_pool = save_pool;
4320 buff = CUS corked->s;
4325 for (int left = len; left > 0;)
4327 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4329 outbytes = SSL_write(ssl, CS buff, left);
4330 error = SSL_get_error(ssl, outbytes);
4331 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4334 case SSL_ERROR_NONE: /* the usual case */
4340 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4341 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4344 case SSL_ERROR_ZERO_RETURN:
4345 log_write(0, LOG_MAIN, "SSL channel closed on write");
4348 case SSL_ERROR_SYSCALL:
4349 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4350 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4351 sender_fullhost ? sender_fullhost : US"<unknown>",
4353 else if (LOGGING(protocol_detail))
4354 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4355 " SMTP response and TLS close\n", sender_host_address);
4357 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4358 " client reset TCP before TLS close\n", sender_host_address);
4362 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4373 ct_ctx client TLS context pointer, or NULL for the one global server context
4377 tls_shutdown_wr(void * ct_ctx)
4379 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4380 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4381 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4384 if (*fdp < 0) return; /* TLS was not active */
4386 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4388 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
4389 rc = SSL_shutdown(*sslp);
4390 if (rc < 0) DEBUG(D_tls)
4392 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4393 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4397 /*************************************************
4398 * Close down a TLS session *
4399 *************************************************/
4401 /* This is also called from within a delivery subprocess forked from the
4402 daemon, to shut down the TLS library, without actually doing a shutdown (which
4403 would tamper with the SSL session in the parent process).
4406 ct_ctx client TLS context pointer, or NULL for the one global server context
4407 do_shutdown 0 no data-flush or TLS close-alert
4408 1 if TLS close-alert is to be sent,
4409 2 if also response to be waited for
4413 Used by both server-side and client-side TLS.
4417 tls_close(void * ct_ctx, int do_shutdown)
4419 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4420 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4421 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4423 if (*fdp < 0) return; /* TLS was not active */
4428 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4429 do_shutdown > 1 ? " (with response-wait)" : "");
4431 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4433 if ( (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4437 rc = SSL_shutdown(*sslp); /* wait for response */
4441 if (rc < 0) DEBUG(D_tls)
4443 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4444 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4448 if (!o_ctx) /* server side */
4450 #ifndef DISABLE_OCSP
4451 sk_X509_pop_free(state_server.verify_stack, X509_free);
4452 state_server.verify_stack = NULL;
4455 receive_getc = smtp_getc;
4456 receive_getbuf = smtp_getbuf;
4457 receive_get_cache = smtp_get_cache;
4458 receive_hasc = smtp_hasc;
4459 receive_ungetc = smtp_ungetc;
4460 receive_feof = smtp_feof;
4461 receive_ferror = smtp_ferror;
4462 tls_in.active.tls_ctx = NULL;
4464 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4475 /*************************************************
4476 * Let tls_require_ciphers be checked at startup *
4477 *************************************************/
4479 /* The tls_require_ciphers option, if set, must be something which the
4482 Returns: NULL on success, or error message
4486 tls_validate_require_cipher(void)
4489 uschar *s, *expciphers, *err;
4493 if (!(tls_require_ciphers && *tls_require_ciphers))
4496 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4498 return US"failed to expand tls_require_ciphers";
4500 if (!(expciphers && *expciphers))
4503 /* normalisation ripped from above */
4505 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
4509 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4512 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4514 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4516 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4517 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4518 expciphers, ssl_errstring);
4529 /*************************************************
4530 * Report the library versions. *
4531 *************************************************/
4533 /* There have historically been some issues with binary compatibility in
4534 OpenSSL libraries; if Exim (like many other applications) is built against
4535 one version of OpenSSL but the run-time linker picks up another version,
4536 it can result in serious failures, including crashing with a SIGSEGV. So
4537 report the version found by the compiler and the run-time version.
4539 Note: some OS vendors backport security fixes without changing the version
4540 number/string, and the version date remains unchanged. The _build_ date
4541 will change, so we can more usefully assist with version diagnosis by also
4542 reporting the build date.
4544 Arguments: a FILE* to print the results to
4549 tls_version_report(FILE *f)
4551 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
4554 OPENSSL_VERSION_TEXT,
4555 SSLeay_version(SSLEAY_VERSION),
4556 SSLeay_version(SSLEAY_BUILT_ON));
4557 /* third line is 38 characters for the %s and the line is 73 chars long;
4558 the OpenSSL output includes a "built on: " prefix already. */
4564 /*************************************************
4565 * Random number generation *
4566 *************************************************/
4568 /* Pseudo-random number generation. The result is not expected to be
4569 cryptographically strong but not so weak that someone will shoot themselves
4570 in the foot using it as a nonce in input in some email header scheme or
4571 whatever weirdness they'll twist this into. The result should handle fork()
4572 and avoid repeating sequences. OpenSSL handles that for us.
4576 Returns a random number in range [0, max-1]
4580 vaguely_random_number(int max)
4584 static pid_t pidlast = 0;
4586 uschar smallbuf[sizeof(r)];
4592 if (pidnow != pidlast)
4594 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
4595 is unique for each thread", this doesn't apparently apply across processes,
4596 so our own warning from vaguely_random_number_fallback() applies here too.
4597 Fix per PostgreSQL. */
4603 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
4607 gettimeofday(&r.tv, NULL);
4610 RAND_seed(US (&r), sizeof(r));
4612 /* We're after pseudo-random, not random; if we still don't have enough data
4613 in the internal PRNG then our options are limited. We could sleep and hope
4614 for entropy to come along (prayer technique) but if the system is so depleted
4615 in the first place then something is likely to just keep taking it. Instead,
4616 we'll just take whatever little bit of pseudo-random we can still manage to
4619 needed_len = sizeof(r);
4620 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4621 asked for a number less than 10. */
4622 for (r = max, i = 0; r; ++i)
4628 #ifdef EXIM_HAVE_RAND_PSEUDO
4629 /* We do not care if crypto-strong */
4630 i = RAND_pseudo_bytes(smallbuf, needed_len);
4632 i = RAND_bytes(smallbuf, needed_len);
4638 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
4639 return vaguely_random_number_fallback(max);
4643 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4646 /* We don't particularly care about weighted results; if someone wants
4647 smooth distribution and cares enough then they should submit a patch then. */
4654 /*************************************************
4655 * OpenSSL option parse *
4656 *************************************************/
4658 /* Parse one option for tls_openssl_options_parse below
4661 name one option name
4662 value place to store a value for it
4663 Returns success or failure in parsing
4669 tls_openssl_one_option_parse(uschar *name, long *value)
4672 int last = exim_openssl_options_size;
4673 while (last > first)
4675 int middle = (first + last)/2;
4676 int c = Ustrcmp(name, exim_openssl_options[middle].name);
4679 *value = exim_openssl_options[middle].value;
4693 /*************************************************
4694 * OpenSSL option parsing logic *
4695 *************************************************/
4697 /* OpenSSL has a number of compatibility options which an administrator might
4698 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
4699 we look like log_selector.
4702 option_spec the administrator-supplied string of options
4703 results ptr to long storage for the options bitmap
4704 Returns success or failure
4708 tls_openssl_options_parse(uschar *option_spec, long *results)
4711 uschar * exp, * end;
4712 BOOL adding, item_parsed;
4714 /* Server: send no (<= TLS1.2) session tickets */
4715 result = SSL_OP_NO_TICKET;
4717 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
4718 from default because it increases BEAST susceptibility. */
4719 #ifdef SSL_OP_NO_SSLv2
4720 result |= SSL_OP_NO_SSLv2;
4722 #ifdef SSL_OP_NO_SSLv3
4723 result |= SSL_OP_NO_SSLv3;
4725 #ifdef SSL_OP_SINGLE_DH_USE
4726 result |= SSL_OP_SINGLE_DH_USE;
4728 #ifdef SSL_OP_NO_RENEGOTIATION
4729 result |= SSL_OP_NO_RENEGOTIATION;
4738 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
4741 for (uschar * s = exp; *s; /**/)
4743 while (isspace(*s)) ++s;
4746 if (*s != '+' && *s != '-')
4748 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
4749 "+ or - expected but found \"%s\"\n", s);
4752 adding = *s++ == '+';
4753 for (end = s; *end && !isspace(*end); ) end++;
4754 item_parsed = tls_openssl_one_option_parse(string_copyn(s, end-s), &item);
4757 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
4760 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
4761 adding ? "adding to " : "removing from", result, item, s);
4773 #endif /*!MACRO_PREDEF*/
4776 /* End of tls-openssl.c */