1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2019 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Portions Copyright (c) The OpenSSL Project 1999 */
11 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
12 library. It is #included into the tls.c file when that library is used. The
13 code herein is based on a patch that was originally contributed by Steve
14 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
16 No cryptographic code is included in Exim. All this module does is to call
17 functions from the OpenSSL library. */
22 #include <openssl/lhash.h>
23 #include <openssl/ssl.h>
24 #include <openssl/err.h>
25 #include <openssl/rand.h>
26 #ifndef OPENSSL_NO_ECDH
27 # include <openssl/ec.h>
30 # include <openssl/ocsp.h>
38 # define EXIM_OCSP_SKEW_SECONDS (300L)
39 # define EXIM_OCSP_MAX_AGE (-1L)
42 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
43 # define EXIM_HAVE_OPENSSL_TLSEXT
45 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
46 # define EXIM_HAVE_RSA_GENKEY_EX
48 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
49 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define OPENSSL_AUTO_SHA256
52 # define EXIM_HAVE_EPHEM_RSA_KEX
53 # define EXIM_HAVE_RAND_PSEUDO
55 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
56 # define EXIM_HAVE_SHA256
59 /* X509_check_host provides sane certificate hostname checking, but was added
60 to OpenSSL late, after other projects forked off the code-base. So in
61 addition to guarding against the base version number, beware that LibreSSL
62 does not (at this time) support this function.
64 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
65 opt to disentangle and ask a LibreSSL user to provide glue for a third
66 crypto provider for libtls instead of continuing to tie the OpenSSL glue
67 into even twistier knots. If LibreSSL gains the same API, we can just
68 change this guard and punt the issue for a while longer. */
70 #ifndef LIBRESSL_VERSION_NUMBER
71 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
72 # define EXIM_HAVE_OPENSSL_CHECKHOST
73 # define EXIM_HAVE_OPENSSL_DH_BITS
74 # define EXIM_HAVE_OPENSSL_TLS_METHOD
75 # define EXIM_HAVE_OPENSSL_KEYLOG
76 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
77 # define EXIM_HAVE_SESSION_TICKET
78 # define EXIM_HAVE_OPESSL_TRACE
79 # define EXIM_HAVE_OPESSL_GET0_SERIAL
81 # define EXIM_HAVE_OCSP
83 # define EXIM_HAVE_ALPN /* fail ret from hshake-cb is ignored by LibreSSL */
85 # define EXIM_NEED_OPENSSL_INIT
87 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
88 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
89 # define EXIM_HAVE_OPENSSL_CHECKHOST
93 #if LIBRESSL_VERSION_NUMBER >= 0x3040000fL
94 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
97 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x030000000L)
98 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
101 #if !defined(LIBRESSL_VERSION_NUMBER) \
102 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
103 # if !defined(OPENSSL_NO_ECDH)
104 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
105 # define EXIM_HAVE_ECDH
107 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
108 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
113 #ifndef LIBRESSL_VERSION_NUMBER
114 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
115 # define OPENSSL_HAVE_KEYLOG_CB
116 # define OPENSSL_HAVE_NUM_TICKETS
117 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
118 # define EXIM_HAVE_EXP_CHNL_BNGNG
120 # define OPENSSL_BAD_SRVR_OURCERT
124 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x010002000L)
125 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
128 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
129 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
130 # define DISABLE_OCSP
133 #ifndef DISABLE_TLS_RESUME
134 # if OPENSSL_VERSION_NUMBER < 0x0101010L
135 # error OpenSSL version too old for session-resumption
139 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
140 # include <openssl/x509v3.h>
143 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
144 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
145 # define SSL_CIPHER_get_id(c) (c->id)
147 # ifndef MACRO_PREDEF
148 # include "tls-cipher-stdname.c"
152 /*************************************************
153 * OpenSSL option parse *
154 *************************************************/
156 typedef struct exim_openssl_option {
159 } exim_openssl_option;
160 /* We could use a macro to expand, but we need the ifdef and not all the
161 options document which version they were introduced in. Policylet: include
162 all options unless explicitly for DTLS, let the administrator choose which
165 This list is current as of:
168 XXX could we autobuild this list, as with predefined-macros?
169 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
170 Also allow a numeric literal?
172 static exim_openssl_option exim_openssl_options[] = {
173 /* KEEP SORTED ALPHABETICALLY! */
175 { US"all", (long) SSL_OP_ALL },
177 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
178 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
180 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
181 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
183 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
184 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
186 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
187 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
189 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
190 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
192 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
193 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
195 #ifdef SSL_OP_EPHEMERAL_RSA
196 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
198 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
199 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
201 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
202 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
204 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
205 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
207 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
208 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
210 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
211 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
213 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
214 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
216 #ifdef SSL_OP_NO_ANTI_REPLAY
217 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
219 #ifdef SSL_OP_NO_COMPRESSION
220 { US"no_compression", SSL_OP_NO_COMPRESSION },
222 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
223 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
225 #ifdef SSL_OP_NO_RENEGOTIATION
226 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
228 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
229 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
231 #ifdef SSL_OP_NO_SSLv2
232 { US"no_sslv2", SSL_OP_NO_SSLv2 },
234 #ifdef SSL_OP_NO_SSLv3
235 { US"no_sslv3", SSL_OP_NO_SSLv3 },
237 #ifdef SSL_OP_NO_TICKET
238 { US"no_ticket", SSL_OP_NO_TICKET },
240 #ifdef SSL_OP_NO_TLSv1
241 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
243 #ifdef SSL_OP_NO_TLSv1_1
244 # if OPENSSL_VERSION_NUMBER < 0x30000000L
245 # if SSL_OP_NO_TLSv1_1 == 0x00000400L
246 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
247 # warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
248 # define NO_SSL_OP_NO_TLSv1_1
251 # ifndef NO_SSL_OP_NO_TLSv1_1
252 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
255 #ifdef SSL_OP_NO_TLSv1_2
256 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
258 #ifdef SSL_OP_NO_TLSv1_3
259 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
261 #ifdef SSL_OP_PRIORITIZE_CHACHA
262 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
264 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
265 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
267 #ifdef SSL_OP_SINGLE_DH_USE
268 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
270 #ifdef SSL_OP_SINGLE_ECDH_USE
271 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
273 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
274 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
276 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
277 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
279 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
280 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
282 #ifdef SSL_OP_TLS_D5_BUG
283 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
285 #ifdef SSL_OP_TLS_ROLLBACK_BUG
286 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
288 #ifdef SSL_OP_TLSEXT_PADDING
289 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
294 static int exim_openssl_options_size = nelem(exim_openssl_options);
295 static long init_options = 0;
304 for (struct exim_openssl_option * o = exim_openssl_options;
305 o < exim_openssl_options + nelem(exim_openssl_options); o++)
307 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
308 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
310 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
311 builtin_macro_create(buf);
314 # ifndef DISABLE_TLS_RESUME
315 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
317 # ifdef SSL_OP_NO_TLSv1_3
318 builtin_macro_create(US"_HAVE_TLS1_3");
320 # ifdef OPENSSL_BAD_SRVR_OURCERT
321 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
323 # ifdef EXIM_HAVE_OCSP
324 builtin_macro_create(US"_HAVE_TLS_OCSP");
325 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
327 # ifdef EXIM_HAVE_ALPN
328 builtin_macro_create(US"_HAVE_TLS_ALPN");
333 /******************************************************************************/
335 /* Structure for collecting random data for seeding. */
337 typedef struct randstuff {
342 /* Local static variables */
344 static BOOL client_verify_callback_called = FALSE;
345 static BOOL server_verify_callback_called = FALSE;
346 static const uschar *sid_ctx = US"exim";
348 /* We have three different contexts to care about.
350 Simple case: client, `client_ctx`
351 As a client, we can be doing a callout or cut-through delivery while receiving
352 a message. So we have a client context, which should have options initialised
353 from the SMTP Transport. We may also concurrently want to make TLS connections
354 to utility daemons, so client-contexts are allocated and passed around in call
355 args rather than using a gobal.
358 There are two cases: with and without ServerNameIndication from the client.
359 Given TLS SNI, we can be using different keys, certs and various other
360 configuration settings, because they're re-expanded with $tls_sni set. This
361 allows vhosting with TLS. This SNI is sent in the handshake.
362 A client might not send SNI, so we need a fallback, and an initial setup too.
363 So as a server, we start out using `server_ctx`.
364 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
365 `server_sni` from `server_ctx` and then initialise settings by re-expanding
373 } exim_openssl_client_tls_ctx;
376 /* static SSL_CTX *server_ctx = NULL; */
377 /* static SSL *server_ssl = NULL; */
379 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
380 static SSL_CTX *server_sni = NULL;
382 #ifdef EXIM_HAVE_ALPN
383 static BOOL server_seen_alpn = FALSE;
386 static char ssl_errstring[256];
388 static int ssl_session_timeout = 7200; /* Two hours */
389 static BOOL client_verify_optional = FALSE;
390 static BOOL server_verify_optional = FALSE;
392 static BOOL reexpand_tls_files_for_sni = FALSE;
395 typedef struct ocsp_resp {
396 struct ocsp_resp * next;
397 OCSP_RESPONSE * resp;
400 typedef struct exim_openssl_state {
401 exim_tlslib_state lib_state;
402 #define lib_ctx libdata0
403 #define lib_ssl libdata1
406 uschar * certificate;
410 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
414 const uschar *file_expanded;
415 ocsp_resplist *olist;
418 X509_STORE *verify_store; /* non-null if status requested */
419 BOOL verify_required;
424 /* these are cached from first expand */
425 uschar * server_cipher_list;
426 /* only passed down to tls_error: */
428 const uschar * verify_cert_hostnames;
429 #ifndef DISABLE_EVENT
430 uschar * event_action;
432 } exim_openssl_state_st;
434 /* should figure out a cleanup of API to handle state preserved per
435 implementation, for various reasons, which can be void * in the APIs.
436 For now, we hack around it. */
437 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
438 exim_openssl_state_st state_server = {.is_server = TRUE};
441 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
446 static int tls_server_stapling_cb(SSL *s, void *arg);
451 /* Daemon-called, before every connection, key create/rotate */
452 #ifndef DISABLE_TLS_RESUME
453 static void tk_init(void);
454 static int tls_exdata_idx = -1;
458 tls_per_lib_daemon_tick(void)
460 #ifndef DISABLE_TLS_RESUME
465 /* Called once at daemon startup */
468 tls_per_lib_daemon_init(void)
470 tls_daemon_creds_reload();
474 /*************************************************
476 *************************************************/
478 /* Called from lots of places when errors occur before actually starting to do
479 the TLS handshake, that is, while the session is still in clear. Always returns
480 DEFER for a server and FAIL for a client so that most calls can use "return
481 tls_error(...)" to do this processing and then give an appropriate return. A
482 single function is used for both server and client, because it is called from
483 some shared functions.
486 prefix text to include in the logged error
487 host NULL if setting up a server;
488 the connected host if setting up a client
489 msg error message or NULL if we should ask OpenSSL
490 errstr pointer to output error message
492 Returns: OK/DEFER/FAIL
496 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
500 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
501 msg = US ssl_errstring;
504 msg = string_sprintf("(%s): %s", prefix, msg);
505 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
506 if (errstr) *errstr = msg;
507 return host ? FAIL : DEFER;
512 /**************************************************
513 * General library initalisation *
514 **************************************************/
517 lib_rand_init(void * addr)
520 if (!RAND_status()) return TRUE;
522 gettimeofday(&r.tv, NULL);
524 RAND_seed(US (&r), sizeof(r));
525 RAND_seed(US big_buffer, big_buffer_size);
526 if (addr) RAND_seed(US addr, sizeof(addr));
528 return RAND_status();
533 tls_openssl_init(void)
535 static BOOL once = FALSE;
539 #ifdef EXIM_NEED_OPENSSL_INIT
540 SSL_load_error_strings(); /* basic set up */
541 OpenSSL_add_ssl_algorithms();
544 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
545 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
546 list of available digests. */
547 EVP_add_digest(EVP_sha256());
550 (void) lib_rand_init(NULL);
551 (void) tls_openssl_options_parse(openssl_options, &init_options);
556 /*************************************************
557 * Initialize for DH *
558 *************************************************/
560 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
564 sctx The current SSL CTX (inbound or outbound)
565 dhparam DH parameter file or fixed parameter identity string
566 errstr error string pointer
568 Returns: TRUE if OK (nothing to set up, or setup worked)
572 init_dh(SSL_CTX * sctx, uschar * dhparam, uschar ** errstr)
575 #if OPENSSL_VERSION_NUMBER < 0x30000000L
584 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
587 if (!dhexpanded || !*dhexpanded)
588 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
589 else if (dhexpanded[0] == '/')
591 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
593 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
594 NULL, US strerror(errno), errstr);
600 if (Ustrcmp(dhexpanded, "none") == 0)
602 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
606 if (!(pem = std_dh_prime_named(dhexpanded)))
608 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
609 NULL, US strerror(errno), errstr);
612 bio = BIO_new_mem_buf(CS pem, -1);
616 #if OPENSSL_VERSION_NUMBER < 0x30000000L
617 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)
619 pkey = PEM_read_bio_Parameters_ex(bio, NULL, NULL, NULL)
624 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
629 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
630 an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with 2236.
631 But older OpenSSL can only report in bytes (octets), not bits. If someone wants
632 to dance at the edge, then they can raise the limit or use current libraries. */
634 #if OPENSSL_VERSION_NUMBER < 0x30000000L
635 # ifdef EXIM_HAVE_OPENSSL_DH_BITS
636 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
637 This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
638 dh_bitsize = DH_bits(dh);
640 dh_bitsize = 8 * DH_size(dh);
643 dh_bitsize = EVP_PKEY_get_bits(pkey);
646 /* Even if it is larger, we silently return success rather than cause things to
647 fail out, so that a too-large DH will not knock out all TLS; it's a debatable
648 choice. Likewise for a failing attempt to set one. */
650 if (dh_bitsize <= tls_dh_max_bits)
653 #if OPENSSL_VERSION_NUMBER < 0x30000000L
654 SSL_CTX_set_tmp_dh(sctx, dh)
656 SSL_CTX_set0_tmp_dh_pkey(sctx, pkey)
660 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
661 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (D-H param setting '%s'): %s",
662 dhexpanded ? dhexpanded : US"default", ssl_errstring);
663 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
664 /* EVP_PKEY_free(pkey); crashes */
669 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
670 dhexpanded ? dhexpanded : US"default", dh_bitsize);
674 debug_printf("dhparams '%s' %d bits, is > tls_dh_max_bits limit of %d\n",
675 dhexpanded ? dhexpanded : US"default", dh_bitsize, tls_dh_max_bits);
677 #if OPENSSL_VERSION_NUMBER < 0x30000000L
680 /* The EVP_PKEY ownership stays with the ctx; do not free it */
689 /*************************************************
690 * Initialize for ECDH *
691 *************************************************/
693 /* Load parameters for ECDH encryption. Server only.
695 For now, we stick to NIST P-256 because: it's simple and easy to configure;
696 it avoids any patent issues that might bite redistributors; despite events in
697 the news and concerns over curve choices, we're not cryptographers, we're not
698 pretending to be, and this is "good enough" to be better than no support,
699 protecting against most adversaries. Given another year or two, there might
700 be sufficient clarity about a "right" way forward to let us make an informed
701 decision, instead of a knee-jerk reaction.
703 Longer-term, we should look at supporting both various named curves and
704 external files generated with "openssl ecparam", much as we do for init_dh().
705 We should also support "none" as a value, to explicitly avoid initialisation.
710 sctx The current SSL CTX (inbound or outbound)
711 errstr error string pointer
713 Returns: TRUE if OK (nothing to set up, or setup worked)
717 init_ecdh(SSL_CTX * sctx, uschar ** errstr)
719 #ifdef OPENSSL_NO_ECDH
727 # ifndef EXIM_HAVE_ECDH
729 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
733 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
735 if (!exp_curve || !*exp_curve)
738 /* "auto" needs to be handled carefully.
739 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
740 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
741 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
742 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
743 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
745 if (Ustrcmp(exp_curve, "auto") == 0)
747 #if OPENSSL_VERSION_NUMBER < 0x10002000L
748 DEBUG(D_tls) debug_printf(
749 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
750 exp_curve = US"prime256v1";
752 # if defined SSL_CTRL_SET_ECDH_AUTO
753 DEBUG(D_tls) debug_printf(
754 "ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n");
755 SSL_CTX_set_ecdh_auto(sctx, 1);
758 DEBUG(D_tls) debug_printf(
759 "ECDH OpenSSL 1.1.0+: temp key parameter settings: default selection\n");
765 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
766 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
767 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
768 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
772 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
777 # if OPENSSL_VERSION_NUMBER < 0x30000000L
780 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
782 tls_error(US"Unable to create ec curve", NULL, NULL, errstr);
786 /* The "tmp" in the name here refers to setting a temporary key
787 not to the stability of the interface. */
789 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
790 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), NULL, NULL, errstr);
792 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
796 #else /* v 3.0.0 + */
798 if ((rv = SSL_CTX_set1_groups(sctx, &nid, 1)) == 0)
799 tls_error(string_sprintf("Error enabling '%s' group", exp_curve), NULL, NULL, errstr);
801 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' group\n", exp_curve);
807 # endif /*EXIM_HAVE_ECDH*/
808 #endif /*OPENSSL_NO_ECDH*/
813 /*************************************************
814 * Expand key and cert file specs *
815 *************************************************/
817 #if OPENSSL_VERSION_NUMBER < 0x30000000L
820 s SSL connection (not used)
824 Returns: pointer to generated key
828 rsa_callback(SSL *s, int export, int keylength)
831 #ifdef EXIM_HAVE_RSA_GENKEY_EX
832 BIGNUM *bn = BN_new();
835 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
837 # ifdef EXIM_HAVE_RSA_GENKEY_EX
838 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
839 || !(rsa_key = RSA_new())
840 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
843 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
847 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
848 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
854 #endif /* pre-3.0.0 */
858 /* Create and install a selfsigned certificate, for use in server mode */
859 /*XXX we could arrange to call this during prelo for a null tls_certificate option.
860 The normal cache inval + relo will suffice.
861 Just need a timer for inval. */
864 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
871 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
872 where = US"allocating pkey";
873 if (!(pkey = EVP_PKEY_new()))
876 where = US"allocating cert";
877 if (!(x509 = X509_new()))
880 where = US"generating pkey";
881 #if OPENSSL_VERSION_NUMBER < 0x30000000L
884 if (!(rsa = rsa_callback(NULL, 0, 2048)))
887 where = US"assigning pkey";
888 if (!EVP_PKEY_assign_RSA(pkey, rsa))
892 pkey = EVP_RSA_gen(2048);
895 X509_set_version(x509, 2); /* N+1 - version 3 */
896 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
897 X509_gmtime_adj(X509_get_notBefore(x509), 0);
898 X509_gmtime_adj(X509_get_notAfter(x509), (long)2 * 60 * 60); /* 2 hour */
899 X509_set_pubkey(x509, pkey);
901 name = X509_get_subject_name(x509);
902 X509_NAME_add_entry_by_txt(name, "C",
903 MBSTRING_ASC, CUS "UK", -1, -1, 0);
904 X509_NAME_add_entry_by_txt(name, "O",
905 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
906 X509_NAME_add_entry_by_txt(name, "CN",
907 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
908 X509_set_issuer_name(x509, name);
910 where = US"signing cert";
911 if (!X509_sign(x509, pkey, EVP_md5()))
914 where = US"installing selfsign cert";
915 if (!SSL_CTX_use_certificate(sctx, x509))
918 where = US"installing selfsign key";
919 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
925 (void) tls_error(where, NULL, NULL, errstr);
926 if (x509) X509_free(x509);
927 if (pkey) EVP_PKEY_free(pkey);
937 /*************************************************
938 * Information callback *
939 *************************************************/
941 /* The SSL library functions call this from time to time to indicate what they
942 are doing. We copy the string to the debugging output when TLS debugging has
954 info_callback(SSL *s, int where, int ret)
960 if (where & SSL_ST_CONNECT)
961 str = US"SSL_connect";
962 else if (where & SSL_ST_ACCEPT)
963 str = US"SSL_accept";
965 str = US"SSL info (undefined)";
967 if (where & SSL_CB_LOOP)
968 debug_printf("%s: %s\n", str, SSL_state_string_long(s));
969 else if (where & SSL_CB_ALERT)
970 debug_printf("SSL3 alert %s:%s:%s\n",
971 str = where & SSL_CB_READ ? US"read" : US"write",
972 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
973 else if (where & SSL_CB_EXIT)
976 debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
978 debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
980 else if (where & SSL_CB_HANDSHAKE_START)
981 debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
982 else if (where & SSL_CB_HANDSHAKE_DONE)
983 debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s));
987 #ifdef OPENSSL_HAVE_KEYLOG_CB
989 keylog_callback(const SSL *ssl, const char *line)
993 DEBUG(D_tls) debug_printf("%.200s\n", line);
994 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
995 if (!(fp = fopen(filename, "a"))) return;
996 fprintf(fp, "%s\n", line);
1005 #ifndef DISABLE_EVENT
1007 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
1008 BOOL *calledp, const BOOL *optionalp, const uschar * what)
1014 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
1017 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
1018 old_cert = tlsp->peercert;
1019 tlsp->peercert = X509_dup(cert);
1020 /* NB we do not bother setting peerdn */
1021 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth), &errno)))
1023 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
1024 "depth=%d cert=%s: %s",
1025 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1026 what, depth, dn, yield);
1030 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
1031 return 1; /* reject (leaving peercert set) */
1033 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
1034 "(host in tls_try_verify_hosts)\n");
1035 tlsp->verify_override = TRUE;
1037 X509_free(tlsp->peercert);
1038 tlsp->peercert = old_cert;
1044 /*************************************************
1045 * Callback for verification *
1046 *************************************************/
1048 /* The SSL library does certificate verification if set up to do so. This
1049 callback has the current yes/no state is in "state". If verification succeeded,
1050 we set the certificate-verified flag. If verification failed, what happens
1051 depends on whether the client is required to present a verifiable certificate
1054 If verification is optional, we change the state to yes, but still log the
1055 verification error. For some reason (it really would help to have proper
1056 documentation of OpenSSL), this callback function then gets called again, this
1057 time with state = 1. We must take care not to set the private verified flag on
1058 the second time through.
1060 Note: this function is not called if the client fails to present a certificate
1061 when asked. We get here only if a certificate has been received. Handling of
1062 optional verification for this case is done when requesting SSL to verify, by
1063 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
1065 May be called multiple times for different issues with a certificate, even
1066 for a given "depth" in the certificate chain.
1069 preverify_ok current yes/no state as 1/0
1070 x509ctx certificate information.
1071 tlsp per-direction (client vs. server) support data
1072 calledp has-been-called flag
1073 optionalp verification-is-optional flag
1075 Returns: 0 if verification should fail, otherwise 1
1079 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1080 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1082 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1083 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1086 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1088 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1089 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1090 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1093 dn[sizeof(dn)-1] = '\0';
1095 tlsp->verify_override = FALSE;
1096 if (preverify_ok == 0)
1098 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1099 *verify_mode, sender_host_address)
1101 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1102 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1104 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1108 if (!tlsp->peercert)
1109 tlsp->peercert = X509_dup(cert); /* record failing cert */
1110 return 0; /* reject */
1112 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1113 "tls_try_verify_hosts)\n");
1114 tlsp->verify_override = TRUE;
1117 else if (depth != 0)
1119 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1120 #ifndef DISABLE_OCSP
1121 if (tlsp == &tls_out && client_static_state->u_ocsp.client.verify_store)
1122 { /* client, wanting stapling */
1123 /* Add the server cert's signing chain as the one
1124 for the verification of the OCSP stapled information. */
1126 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1129 sk_X509_push(client_static_state->verify_stack, cert);
1132 #ifndef DISABLE_EVENT
1133 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1134 return 0; /* reject, with peercert set */
1139 const uschar * verify_cert_hostnames;
1141 if ( tlsp == &tls_out
1142 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1143 /* client, wanting hostname check */
1146 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1147 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1148 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1150 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1151 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1154 const uschar * list = verify_cert_hostnames;
1157 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1158 if ((rc = X509_check_host(cert, CCS name, 0,
1159 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1160 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1165 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1166 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1173 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1176 uschar * extra = verify_mode
1177 ? string_sprintf(" (during %c-verify for [%s])",
1178 *verify_mode, sender_host_address)
1180 log_write(0, LOG_MAIN,
1181 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1182 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1183 extra, dn, verify_cert_hostnames);
1187 if (!tlsp->peercert)
1188 tlsp->peercert = X509_dup(cert); /* record failing cert */
1189 return 0; /* reject */
1191 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1192 "tls_try_verify_hosts)\n");
1193 tlsp->verify_override = TRUE;
1197 #ifndef DISABLE_EVENT
1198 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1199 return 0; /* reject, with peercert set */
1202 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1203 *calledp ? "" : " authenticated", dn);
1207 return 1; /* accept, at least for this level */
1211 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1213 return verify_callback(preverify_ok, x509ctx, &tls_out,
1214 &client_verify_callback_called, &client_verify_optional);
1218 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1220 return verify_callback(preverify_ok, x509ctx, &tls_in,
1221 &server_verify_callback_called, &server_verify_optional);
1227 /* This gets called *by* the dane library verify callback, which interposes
1231 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1233 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1235 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1236 #ifndef DISABLE_EVENT
1237 BOOL dummy_called, optional = FALSE;
1240 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1242 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1243 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1244 deliver_host_address);
1247 dn[sizeof(dn)-1] = '\0';
1249 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1250 preverify_ok ? "ok":"BAD", depth, dn);
1252 #ifndef DISABLE_EVENT
1253 if (verify_event(&tls_out, cert, depth, dn,
1254 &dummy_called, &optional, US"DANE"))
1255 return 0; /* reject, with peercert set */
1258 if (preverify_ok == 1)
1260 tls_out.dane_verified = TRUE;
1261 #ifndef DISABLE_OCSP
1262 if (client_static_state->u_ocsp.client.verify_store)
1263 { /* client, wanting stapling */
1264 /* Add the server cert's signing chain as the one
1265 for the verification of the OCSP stapled information. */
1267 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1270 sk_X509_push(client_static_state->verify_stack, cert);
1276 int err = X509_STORE_CTX_get_error(x509ctx);
1278 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1279 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1282 return preverify_ok;
1285 #endif /*SUPPORT_DANE*/
1288 #ifndef DISABLE_OCSP
1289 /*************************************************
1290 * Load OCSP information into state *
1291 *************************************************/
1292 /* Called to load the server OCSP response from the given file into memory, once
1293 caller has determined this is needed. Checks validity. Debugs a message
1296 ASSUMES: single response, for single cert.
1299 state various parts of session state
1300 filename the filename putatively holding an OCSP response
1301 is_pem file is PEM format; otherwise is DER
1305 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1309 OCSP_RESPONSE * resp;
1310 OCSP_BASICRESP * basic_response;
1311 OCSP_SINGLERESP * single_response;
1312 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1313 STACK_OF(X509) * sk;
1314 unsigned long verify_flags;
1315 int status, reason, i;
1318 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1320 if (!filename || !*filename) return;
1323 if (!(bio = BIO_new_file(CS filename, "rb")))
1325 log_write(0, LOG_MAIN|LOG_PANIC,
1326 "Failed to open OCSP response file \"%s\": %.100s",
1327 filename, ERR_reason_error_string(ERR_get_error()));
1333 uschar * data, * freep;
1336 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1338 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
1339 filename, ERR_reason_error_string(ERR_get_error()));
1343 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1344 OPENSSL_free(freep);
1347 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1352 log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
1353 filename, ERR_reason_error_string(ERR_get_error()));
1357 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1359 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1360 OCSP_response_status_str(status), status);
1366 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1367 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1372 if (!(basic_response = OCSP_response_get1_basic(resp)))
1375 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1379 sk = state->verify_stack;
1380 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1382 /* May need to expose ability to adjust those flags?
1383 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1384 OCSP_TRUSTOTHER OCSP_NOINTERN */
1386 /* This does a full verify on the OCSP proof before we load it for serving
1387 up; possibly overkill - just date-checks might be nice enough.
1389 OCSP_basic_verify takes a "store" arg, but does not
1390 use it for the chain verification, which is all we do
1391 when OCSP_NOVERIFY is set. The content from the wire
1392 "basic_response" and a cert-stack "sk" are all that is used.
1394 We have a stack, loaded in setup_certs() if tls_verify_certificates
1395 was a file (not a directory, or "system"). It is unfortunate we
1396 cannot used the connection context store, as that would neatly
1397 handle the "system" case too, but there seems to be no library
1398 function for getting a stack from a store.
1399 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1400 We do not free the stack since it could be needed a second time for
1403 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1404 be a public interface into the OpenSSL library (there's no manual entry) -
1405 But what with? We also use OCSP_basic_verify in the client stapling callback.
1406 And there we NEED it; we must verify that status... unless the
1407 library does it for us anyway? */
1409 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
1413 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1414 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
1419 /* Here's the simplifying assumption: there's only one response, for the
1420 one certificate we use, and nothing for anything else in a chain. If this
1421 proves false, we need to extract a cert id from our issued cert
1422 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1423 right cert in the stack and then calls OCSP_single_get0_status()).
1425 I'm hoping to avoid reworking a bunch more of how we handle state here.
1427 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1430 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1433 debug_printf("Unable to get first response from OCSP basic response.\n");
1437 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1438 if (status != V_OCSP_CERTSTATUS_GOOD)
1440 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1441 OCSP_cert_status_str(status), status,
1442 OCSP_crl_reason_str(reason), reason);
1446 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1448 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
1453 /* Add the resp to the list used by tls_server_stapling_cb() */
1455 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1456 while (oentry = *op)
1458 *op = oentry = store_get(sizeof(ocsp_resplist), GET_UNTAINTED);
1459 oentry->next = NULL;
1460 oentry->resp = resp;
1465 if (f.running_in_test_harness)
1467 extern char ** environ;
1468 if (environ) for (uschar ** p = USS environ; *p; p++)
1469 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1471 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1472 goto supply_response;
1480 ocsp_free_response_list(exim_openssl_state_st * cbinfo)
1482 for (ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; olist;
1483 olist = olist->next)
1484 OCSP_RESPONSE_free(olist->resp);
1485 cbinfo->u_ocsp.server.olist = NULL;
1487 #endif /*!DISABLE_OCSP*/
1494 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1497 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1498 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1499 return tls_error(string_sprintf(
1500 "SSL_CTX_use_certificate_chain_file file=%s", file),
1501 cbinfo->host, NULL, errstr);
1506 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1509 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1510 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1511 return tls_error(string_sprintf(
1512 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1519 /* Called once during tls_init and possibly again during TLS setup, for a
1520 new context, if Server Name Indication was used and tls_sni was seen in
1521 the certificate string.
1524 sctx the SSL_CTX* to update
1525 state various parts of session state
1526 errstr error string pointer
1528 Returns: OK/DEFER/FAIL
1532 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1537 if (!state->certificate)
1539 if (!state->is_server) /* client */
1542 if (tls_install_selfsign(sctx, errstr) != OK)
1549 if ( !reexpand_tls_files_for_sni
1550 && ( Ustrstr(state->certificate, US"tls_sni")
1551 || Ustrstr(state->certificate, US"tls_in_sni")
1552 || Ustrstr(state->certificate, US"tls_out_sni")
1554 reexpand_tls_files_for_sni = TRUE;
1556 if (!expand_check(state->certificate, US"tls_certificate", &expanded, errstr))
1560 if (state->is_server)
1562 const uschar * file_list = expanded;
1565 #ifndef DISABLE_OCSP
1566 const uschar * olist = state->u_ocsp.server.file;
1569 BOOL fmt_pem = FALSE;
1572 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1574 if (olist && !*olist)
1577 if ( state->u_ocsp.server.file_expanded && olist
1578 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1580 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1585 ocsp_free_response_list(state);
1586 state->u_ocsp.server.file_expanded = olist;
1590 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1592 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1595 #ifndef DISABLE_OCSP
1597 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1599 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1604 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1609 ocsp_load_response(state, ofile, fmt_pem);
1612 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1616 else /* would there ever be a need for multiple client certs? */
1617 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1620 if ( state->privatekey
1621 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr))
1624 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1625 of the expansion is an empty string, ignore it also, and assume the private
1626 key is in the same file as the certificate. */
1628 if (expanded && *expanded)
1629 if (state->is_server)
1631 const uschar * file_list = expanded;
1635 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1636 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1639 else /* would there ever be a need for multiple client certs? */
1640 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1650 /**************************************************
1651 * One-time init credentials for server and client *
1652 **************************************************/
1655 normalise_ciphers(uschar ** ciphers, const uschar * pre_expansion_ciphers)
1657 uschar * s = *ciphers;
1659 if (!s || !Ustrchr(s, '_')) return; /* no change needed */
1661 if (s == pre_expansion_ciphers)
1662 s = string_copy(s); /* get writable copy */
1664 for (uschar * t = s; *t; t++) if (*t == '_') *t = '-';
1669 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1670 uschar * ciphers, uschar ** errstr)
1672 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1673 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1674 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1675 state->server_cipher_list = ciphers;
1682 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1685 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1686 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1688 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1690 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1692 /* Set up the information callback, which outputs if debugging is at a suitable
1697 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1698 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1699 /* this needs a debug build of OpenSSL */
1700 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
1702 #ifdef OPENSSL_HAVE_KEYLOG_CB
1703 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
1707 /* Automatically re-try reads/writes after renegotiation. */
1708 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1715 tls_server_creds_init(void)
1718 uschar * dummy_errstr;
1719 unsigned lifetime = 0;
1723 state_server.lib_state = null_tls_preload;
1725 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1727 state_server.lib_state.lib_ctx = ctx;
1729 /* Preload DH params and EC curve */
1731 if (opt_unset_or_noexpand(tls_dhparam))
1733 DEBUG(D_tls) debug_printf("TLS: preloading DH params for server\n");
1734 if (init_dh(ctx, tls_dhparam, &dummy_errstr))
1735 state_server.lib_state.dh = TRUE;
1738 DEBUG(D_tls) debug_printf("TLS: not preloading DH params for server\n");
1739 if (opt_unset_or_noexpand(tls_eccurve))
1741 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for server\n");
1742 if (init_ecdh(ctx, &dummy_errstr))
1743 state_server.lib_state.ecdh = TRUE;
1746 DEBUG(D_tls) debug_printf("TLS: not preloading ECDH curve for server\n");
1748 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1749 /* If we can, preload the server-side cert, key and ocsp */
1751 if ( opt_set_and_noexpand(tls_certificate)
1752 # ifndef DISABLE_OCSP
1753 && opt_unset_or_noexpand(tls_ocsp_file)
1755 && opt_unset_or_noexpand(tls_privatekey))
1757 /* Set watches on the filenames. The implementation does de-duplication
1758 so we can just blindly do them all. */
1760 if ( tls_set_watch(tls_certificate, TRUE)
1761 # ifndef DISABLE_OCSP
1762 && tls_set_watch(tls_ocsp_file, TRUE)
1764 && tls_set_watch(tls_privatekey, TRUE))
1766 state_server.certificate = tls_certificate;
1767 state_server.privatekey = tls_privatekey;
1768 #ifndef DISABLE_OCSP
1769 state_server.u_ocsp.server.file = tls_ocsp_file;
1772 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1773 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1774 state_server.lib_state.conn_certs = TRUE;
1777 else if ( !tls_certificate && !tls_privatekey
1778 # ifndef DISABLE_OCSP
1782 { /* Generate & preload a selfsigned cert. No files to watch. */
1783 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1785 state_server.lib_state.conn_certs = TRUE;
1786 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1790 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1793 /* If we can, preload the Authorities for checking client certs against.
1794 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1795 at TLS conn startup */
1797 if ( opt_set_and_noexpand(tls_verify_certificates)
1798 && opt_unset_or_noexpand(tls_crl))
1800 /* Watch the default dir also as they are always included */
1802 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1803 && tls_set_watch(tls_verify_certificates, FALSE)
1804 && tls_set_watch(tls_crl, FALSE))
1806 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1808 if (setup_certs(ctx, tls_verify_certificates, tls_crl, NULL, &dummy_errstr)
1810 state_server.lib_state.cabundle = TRUE;
1814 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1815 #endif /* EXIM_HAVE_INOTIFY */
1818 /* If we can, preload the ciphers control string */
1820 if (opt_set_and_noexpand(tls_require_ciphers))
1822 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1823 normalise_ciphers(&tls_require_ciphers, tls_require_ciphers);
1824 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1825 &dummy_errstr) == OK)
1826 state_server.lib_state.pri_string = TRUE;
1829 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1836 /* Preload whatever creds are static, onto a transport. The client can then
1837 just copy the pointer as it starts up.
1838 Called from the daemon after a cache-invalidate with watch set; called from
1839 a queue-run startup with watch clear. */
1842 tls_client_creds_init(transport_instance * t, BOOL watch)
1844 smtp_transport_options_block * ob = t->options_block;
1845 exim_openssl_state_st tpt_dummy_state;
1846 host_item * dummy_host = (host_item *)1;
1847 uschar * dummy_errstr;
1852 ob->tls_preload = null_tls_preload;
1853 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1855 ob->tls_preload.lib_ctx = ctx;
1857 tpt_dummy_state.lib_state = ob->tls_preload;
1859 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1860 if ( opt_set_and_noexpand(ob->tls_certificate)
1861 && opt_unset_or_noexpand(ob->tls_privatekey))
1864 || ( tls_set_watch(ob->tls_certificate, FALSE)
1865 && tls_set_watch(ob->tls_privatekey, FALSE)
1868 uschar * pkey = ob->tls_privatekey;
1871 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1873 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1875 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1876 pkey ? pkey : ob->tls_certificate,
1879 ob->tls_preload.conn_certs = TRUE;
1884 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1887 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1888 && opt_unset_or_noexpand(ob->tls_crl))
1891 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1892 && tls_set_watch(ob->tls_verify_certificates, FALSE)
1893 && tls_set_watch(ob->tls_crl, FALSE)
1897 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1899 if (setup_certs(ctx, ob->tls_verify_certificates,
1900 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
1901 ob->tls_preload.cabundle = TRUE;
1906 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1908 #endif /*EXIM_HAVE_INOTIFY*/
1912 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1913 /* Invalidate the creds cached, by dropping the current ones.
1914 Call when we notice one of the source files has changed. */
1917 tls_server_creds_invalidate(void)
1919 SSL_CTX_free(state_server.lib_state.lib_ctx);
1920 state_server.lib_state = null_tls_preload;
1925 tls_client_creds_invalidate(transport_instance * t)
1927 smtp_transport_options_block * ob = t->options_block;
1928 SSL_CTX_free(ob->tls_preload.lib_ctx);
1929 ob->tls_preload = null_tls_preload;
1935 tls_server_creds_invalidate(void)
1939 tls_client_creds_invalidate(transport_instance * t)
1942 #endif /*EXIM_HAVE_INOTIFY*/
1946 #ifndef DISABLE_OCSP
1948 x509_store_dump_cert_s_names(X509_STORE * store)
1950 STACK_OF(X509_OBJECT) * roots= store->objs;
1951 static uschar name[256];
1953 for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
1955 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
1956 if(tmp_obj->type == X509_LU_X509)
1958 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
1959 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
1961 name[sizeof(name)-1] = '\0';
1962 debug_printf(" %s\n", name);
1971 #ifndef DISABLE_TLS_RESUME
1972 /* Manage the keysets used for encrypting the session tickets, on the server. */
1974 typedef struct { /* Session ticket encryption key */
1977 const EVP_CIPHER * aes_cipher;
1978 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
1979 # if OPENSSL_VERSION_NUMBER < 0x30000000L
1980 const EVP_MD * hmac_hash;
1982 const uschar * hmac_hashname;
1984 uschar hmac_key[16];
1989 static exim_stek exim_tk; /* current key */
1990 static exim_stek exim_tk_old; /* previous key */
1995 time_t t = time(NULL);
1997 if (exim_tk.name[0])
1999 if (exim_tk.renew >= t) return;
2000 exim_tk_old = exim_tk;
2003 if (f.running_in_test_harness) ssl_session_timeout = 6;
2005 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
2006 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
2007 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
2008 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
2010 exim_tk.name[0] = 'E';
2011 exim_tk.aes_cipher = EVP_aes_256_cbc();
2012 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2013 exim_tk.hmac_hash = EVP_sha256();
2015 exim_tk.hmac_hashname = US "sha256";
2017 exim_tk.expire = t + ssl_session_timeout;
2018 exim_tk.renew = t + ssl_session_timeout/2;
2024 if (!exim_tk.name[0]) return NULL;
2029 tk_find(const uschar * name)
2031 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
2032 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
2039 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2047 /*XXX will want these dependent on the ssl session strength */
2048 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2049 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2050 key->hmac_hash, NULL);
2053 OSSL_PARAM params[3];
2054 uschar * hk = string_copy(key->hmac_hashname); /* need nonconst */
2055 params[0] = OSSL_PARAM_construct_octet_string("key", key->hmac_key, sizeof(key->hmac_key));
2056 params[1] = OSSL_PARAM_construct_utf8_string("digest", CS hk, 0);
2057 params[2] = OSSL_PARAM_construct_end();
2058 if (EVP_MAC_CTX_set_params(hctx, params) == 0)
2060 DEBUG(D_tls) debug_printf("EVP_MAC_CTX_set_params: %s\n",
2061 ERR_reason_error_string(ERR_get_error()));
2062 return 0; /* error in mac initialisation */
2069 /* Callback for session tickets, on server */
2071 ticket_key_callback(SSL * ssl, uschar key_name[16],
2072 uschar * iv, EVP_CIPHER_CTX * c_ctx,
2073 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2080 tls_support * tlsp = state_server.tlsp;
2085 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
2086 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2088 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
2089 return -1; /* insufficient random */
2091 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
2092 return 0; /* key couldn't be created */
2093 memcpy(key_name, key->name, 16);
2094 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
2096 if (tk_hmac_init(hctx, key) == 0) return 0;
2097 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2099 DEBUG(D_tls) debug_printf("ticket created\n");
2104 time_t now = time(NULL);
2106 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
2107 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2109 if (!(key = tk_find(key_name)) || key->expire < now)
2113 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
2114 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
2119 if (tk_hmac_init(hctx, key) == 0) return 0;
2120 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2122 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2124 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2125 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2126 be better. To do that we'd have to encode ticket lifetime in the name as
2127 we don't yet see the restored session. Could check posthandshake for TLS1.3
2128 and trigger a new ticket then, but cannot do that for TLS1.2 */
2129 return key->renew < now ? 2 : 1;
2132 #endif /* !DISABLE_TLS_RESUME */
2137 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2138 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2140 /* If verification is optional, don't fail if no certificate */
2142 SSL_CTX_set_verify(ctx,
2143 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2148 /*************************************************
2149 * Callback to handle SNI *
2150 *************************************************/
2152 /* Called when acting as server during the TLS session setup if a Server Name
2153 Indication extension was sent by the client.
2155 API documentation is OpenSSL s_server.c implementation.
2158 s SSL* of the current session
2159 ad unknown (part of OpenSSL API) (unused)
2160 arg Callback of "our" registered data
2162 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2164 XXX might need to change to using ClientHello callback,
2165 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2168 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2170 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
2172 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2173 exim_openssl_state_st *state = (exim_openssl_state_st *) arg;
2175 int old_pool = store_pool;
2176 uschar * dummy_errstr;
2179 return SSL_TLSEXT_ERR_OK;
2181 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2182 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2184 /* Make the extension value available for expansion */
2185 store_pool = POOL_PERM;
2186 tls_in.sni = string_copy_taint(US servername, GET_TAINTED);
2187 store_pool = old_pool;
2189 if (!reexpand_tls_files_for_sni)
2190 return SSL_TLSEXT_ERR_OK;
2192 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2193 not confident that memcpy wouldn't break some internal reference counting.
2194 Especially since there's a references struct member, which would be off. */
2196 if (lib_ctx_new(&server_sni, NULL, &dummy_errstr) != OK)
2199 /* Not sure how many of these are actually needed, since SSL object
2200 already exists. Might even need this selfsame callback, for reneg? */
2203 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2204 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2205 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2206 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2207 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2208 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2209 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2212 if ( !init_dh(server_sni, state->dhparam, &dummy_errstr)
2213 || !init_ecdh(server_sni, &dummy_errstr)
2217 if ( state->server_cipher_list
2218 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2221 #ifndef DISABLE_OCSP
2222 if (state->u_ocsp.server.file)
2224 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2225 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2231 if ( !expand_check(tls_verify_certificates, US"tls_verify_certificates",
2232 &expcerts, &dummy_errstr)
2233 || (rc = setup_certs(server_sni, expcerts, tls_crl, NULL,
2234 &dummy_errstr)) != OK)
2237 if (expcerts && *expcerts)
2238 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2241 /* do this after setup_certs, because this can require the certs for verifying
2242 OCSP information. */
2243 if ((rc = tls_expand_session_files(server_sni, state, &dummy_errstr)) != OK)
2246 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2247 SSL_set_SSL_CTX(s, server_sni);
2248 return SSL_TLSEXT_ERR_OK;
2250 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
2252 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2257 #ifdef EXIM_HAVE_ALPN
2258 /*************************************************
2259 * Callback to handle ALPN *
2260 *************************************************/
2262 /* Called on server if tls_alpn nonblank after expansion,
2263 when client offers ALPN, after the SNI callback.
2264 If set and not matching the list then we dump the connection */
2267 tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen,
2268 const uschar * in, unsigned int inlen, void * arg)
2270 server_seen_alpn = TRUE;
2273 debug_printf("Received TLS ALPN offer:");
2274 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2277 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2278 debug_printf(" '%.*s'", siz, in + pos + 1);
2280 debug_printf(". Our list: '%s'\n", tls_alpn);
2283 /* Look for an acceptable ALPN */
2285 if ( inlen > 1 /* at least one name */
2286 && in[0]+1 == inlen /* filling the vector, so exactly one name */
2289 const uschar * list = tls_alpn;
2291 for (uschar * name; name = string_nextinlist(&list, &sep, NULL, 0); )
2292 if (Ustrncmp(in+1, name, in[0]) == 0)
2294 *out = in+1; /* we checked for exactly one, so can just point to it */
2296 return SSL_TLSEXT_ERR_OK; /* use ALPN */
2300 /* More than one name from clilent, or name did not match our list. */
2302 /* This will be fatal to the TLS conn; would be nice to kill TCP also.
2303 Maybe as an option in future; for now leave control to the config (must-tls). */
2305 DEBUG(D_tls) debug_printf("TLS ALPN rejected\n");
2306 return SSL_TLSEXT_ERR_ALERT_FATAL;
2308 #endif /* EXIM_HAVE_ALPN */
2312 #ifndef DISABLE_OCSP
2314 /*************************************************
2315 * Callback to handle OCSP Stapling *
2316 *************************************************/
2318 /* Called when acting as server during the TLS session setup if the client
2319 requests OCSP information with a Certificate Status Request.
2321 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2327 tls_server_stapling_cb(SSL *s, void *arg)
2329 const exim_openssl_state_st * state = arg;
2330 ocsp_resplist * olist = state->u_ocsp.server.olist;
2331 uschar * response_der; /*XXX blob */
2332 int response_der_len;
2335 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2336 olist ? "have" : "lack");
2338 tls_in.ocsp = OCSP_NOT_RESP;
2340 return SSL_TLSEXT_ERR_NOACK;
2342 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
2344 const X509 * cert_sent = SSL_get_certificate(s);
2345 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2346 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2348 for (; olist; olist = olist->next)
2350 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2351 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2352 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2353 ASN1_INTEGER * res_cert_serial;
2354 const BIGNUM * resp_bn;
2355 ASN1_OCTET_STRING * res_cert_iNameHash;
2358 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2359 (OCSP_CERTID *) cid);
2360 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2364 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2365 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2368 if (BN_cmp(cert_bn, resp_bn) == 0)
2370 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2372 /*XXX TODO: check the rest of the list for duplicate matches.
2373 If any, need to also check the Issuer Name hash.
2374 Without this, we will provide the wrong status in the case of
2379 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2383 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2384 return SSL_TLSEXT_ERR_NOACK;
2390 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2391 return SSL_TLSEXT_ERR_NOACK;
2395 /*XXX could we do the i2d earlier, rather than during the callback? */
2396 response_der = NULL;
2397 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2398 if (response_der_len <= 0)
2399 return SSL_TLSEXT_ERR_NOACK;
2401 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2402 response_der, response_der_len);
2403 tls_in.ocsp = OCSP_VFIED;
2404 return SSL_TLSEXT_ERR_OK;
2409 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
2411 BIO_printf(bp, "\t%s: ", str);
2412 ASN1_GENERALIZEDTIME_print(bp, time);
2417 tls_client_stapling_cb(SSL * ssl, void * arg)
2419 exim_openssl_state_st * cbinfo = arg;
2420 const unsigned char * p;
2422 OCSP_RESPONSE * rsp;
2423 OCSP_BASICRESP * bs;
2426 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2427 len = SSL_get_tlsext_status_ocsp_resp(ssl, &p);
2429 { /* Expect this when we requested ocsp but got none */
2430 if (SSL_session_reused(ssl) && tls_out.ocsp == OCSP_VFIED)
2432 DEBUG(D_tls) debug_printf(" null, but resumed; ocsp vfy stored with session is good\n");
2435 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2436 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2438 DEBUG(D_tls) debug_printf(" null\n");
2439 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2442 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2444 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2445 if (LOGGING(tls_cipher))
2446 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2448 DEBUG(D_tls) debug_printf(" parse error\n");
2452 if (!(bs = OCSP_response_get1_basic(rsp)))
2454 tls_out.ocsp = OCSP_FAILED;
2455 if (LOGGING(tls_cipher))
2456 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2458 DEBUG(D_tls) debug_printf(" error parsing response\n");
2459 OCSP_RESPONSE_free(rsp);
2463 /* We'd check the nonce here if we'd put one in the request. */
2464 /* However that would defeat cacheability on the server so we don't. */
2466 /* This section of code reworked from OpenSSL apps source;
2467 The OpenSSL Project retains copyright:
2468 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2472 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2473 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2476 DEBUG(D_tls) bp = BIO_new(BIO_s_mem());
2478 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2480 /* Use the chain that verified the server cert to verify the stapled info */
2481 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
2483 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
2484 cbinfo->u_ocsp.client.verify_store, OCSP_NOEXPLICIT)) <= 0)
2485 if (ERR_peek_error())
2487 tls_out.ocsp = OCSP_FAILED;
2488 if (LOGGING(tls_cipher))
2490 const uschar * errstr = CUS ERR_reason_error_string(ERR_peek_error());
2491 static uschar peerdn[256];
2492 X509_NAME_oneline(X509_get_subject_name(SSL_get_peer_certificate(ssl)),
2493 CS peerdn, sizeof(peerdn));
2494 log_write(0, LOG_MAIN,
2495 "[%s] %s Received TLS cert (DN: '%.*s') status response, "
2496 "itself unverifiable: %s",
2497 sender_host_address, sender_host_name,
2498 (int)sizeof(peerdn), peerdn,
2503 BIO_printf(bp, "OCSP response verify failure\n");
2504 ERR_print_errors(bp);
2505 OCSP_RESPONSE_print(bp, rsp, 0);
2510 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2511 " in the root CA certificate; ignoring\n");
2513 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2515 /*XXX So we have a good stapled OCSP status. How do we know
2516 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2517 OCSP_resp_find_status() which matches on a cert id, which presumably
2518 we should use. Making an id needs OCSP_cert_id_new(), which takes
2519 issuerName, issuerKey, serialNumber. Are they all in the cert?
2521 For now, carry on blindly accepting the resp. */
2524 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2525 OCSP_resp_count(bs) - 1;
2527 sk_OCSP_SINGLERESP_num(sresp) - 1;
2531 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2533 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2535 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2536 - but what happens with a GnuTLS-style input?
2538 we could do with a debug label for each singleresp
2539 - it has a certID with a serialNumber, but I see no API to get that
2541 status = OCSP_single_get0_status(single, &reason, &rev,
2542 &thisupd, &nextupd);
2546 time_print(bp, "This OCSP Update", thisupd);
2547 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
2549 if (!OCSP_check_validity(thisupd, nextupd,
2550 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2552 tls_out.ocsp = OCSP_FAILED;
2553 DEBUG(D_tls) ERR_print_errors(bp);
2554 log_write(0, LOG_MAIN, "OCSP dates invalid");
2558 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2559 OCSP_cert_status_str(status));
2562 case V_OCSP_CERTSTATUS_GOOD:
2563 continue; /* the idx loop */
2564 case V_OCSP_CERTSTATUS_REVOKED:
2565 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2566 reason != -1 ? "; reason: " : "",
2567 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2568 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2571 log_write(0, LOG_MAIN,
2572 "Server certificate status unknown, in OCSP stapling");
2580 tls_out.ocsp = OCSP_VFIED;
2584 tls_out.ocsp = OCSP_FAILED;
2585 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2589 int len = (int) BIO_get_mem_data(bp, CSS &s);
2590 if (len > 0) debug_printf("%.*s", len, s);
2595 OCSP_RESPONSE_free(rsp);
2598 #endif /*!DISABLE_OCSP*/
2601 /*************************************************
2602 * Initialize for TLS *
2603 *************************************************/
2604 /* Called from both server and client code, to do preliminary initialization
2605 of the library. We allocate and return a context structure.
2608 host connected host, if client; NULL if server
2609 ob transport options block, if client; NULL if server
2610 ocsp_file file of stapling info (server); flag for require ocsp (client)
2611 addr address if client; NULL if server (for some randomness)
2612 caller_state place to put pointer to allocated state-struct
2613 errstr error string pointer
2615 Returns: OK/DEFER/FAIL
2619 tls_init(host_item * host, smtp_transport_options_block * ob,
2620 #ifndef DISABLE_OCSP
2623 address_item *addr, exim_openssl_state_st ** caller_state,
2628 exim_openssl_state_st * state;
2631 if (host) /* client */
2633 state = store_malloc(sizeof(exim_openssl_state_st));
2634 memset(state, 0, sizeof(*state));
2635 state->certificate = ob->tls_certificate;
2636 state->privatekey = ob->tls_privatekey;
2637 state->is_server = FALSE;
2638 state->dhparam = NULL;
2639 state->lib_state = ob->tls_preload;
2643 state = &state_server;
2644 state->certificate = tls_certificate;
2645 state->privatekey = tls_privatekey;
2646 state->is_server = TRUE;
2647 state->dhparam = tls_dhparam;
2648 state->lib_state = state_server.lib_state;
2654 if (!state->lib_state.pri_string)
2655 state->server_cipher_list = NULL;
2657 #ifndef DISABLE_EVENT
2658 state->event_action = NULL;
2663 /* It turns out that we need to seed the random number generator this early in
2664 order to get the full complement of ciphers to work. It took me roughly a day
2665 of work to discover this by experiment.
2667 On systems that have /dev/urandom, SSL may automatically seed itself from
2668 there. Otherwise, we have to make something up as best we can. Double check
2671 Although we likely called this before, at daemon startup, this is a chance
2672 to mix in further variable info (time, pid) if needed. */
2674 if (!lib_rand_init(addr))
2675 return tls_error(US"RAND_status", host,
2676 US"unable to seed random number generator", errstr);
2678 /* Apply administrator-supplied work-arounds.
2679 Historically we applied just one requested option,
2680 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2681 moved to an administrator-controlled list of options to specify and
2682 grandfathered in the first one as the default value for "openssl_options".
2684 No OpenSSL version number checks: the options we accept depend upon the
2685 availability of the option value macros from OpenSSL. */
2688 if (!tls_openssl_options_parse(openssl_options, &init_options))
2689 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2691 /* Create a context.
2692 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2693 negotiation in the different methods; as far as I can tell, the only
2694 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2695 when OpenSSL is built without SSLv2 support.
2696 By disabling with openssl_options, we can let admins re-enable with the
2699 if (!(ctx = state->lib_state.lib_ctx))
2701 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2703 state->lib_state.lib_ctx = ctx;
2706 #ifndef DISABLE_TLS_RESUME
2707 tlsp->resumption = RESUME_SUPPORTED;
2711 #ifndef DISABLE_TLS_RESUME
2712 /* Should the server offer session resumption? */
2713 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2715 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2716 init_options &= ~SSL_OP_NO_TICKET;
2717 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2718 tlsp->host_resumable = TRUE;
2722 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
2723 if (!(SSL_CTX_set_options(ctx, init_options)))
2724 return tls_error(string_sprintf(
2725 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2728 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2730 /* We'd like to disable session cache unconditionally, but foolish Outlook
2731 Express clients then give up the first TLS connection and make a second one
2732 (which works). Only when there is an IMAP service on the same machine.
2733 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2734 now, until we work out a decent way of presenting control to the config. It
2735 will never be used because we use a new context every time. */
2737 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2740 /* Initialize with DH parameters if supplied */
2741 /* Initialize ECDH temp key parameter selection */
2745 if (state->lib_state.dh)
2746 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2748 if (!init_dh(ctx, state->dhparam, errstr)) return DEFER;
2750 if (state->lib_state.ecdh)
2751 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
2753 if (!init_ecdh(ctx, errstr)) return DEFER;
2756 /* Set up certificate and key (and perhaps OCSP info) */
2758 if (state->lib_state.conn_certs)
2761 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
2765 #ifndef DISABLE_OCSP
2768 state->u_ocsp.server.file = ocsp_file;
2769 state->u_ocsp.server.file_expanded = NULL;
2770 state->u_ocsp.server.olist = NULL;
2773 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
2776 /* If we need to handle SNI or OCSP, do so */
2778 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2779 # ifndef DISABLE_OCSP
2780 if (!(state->verify_stack = sk_X509_new_null()))
2782 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2787 if (!host) /* server */
2789 # ifndef DISABLE_OCSP
2790 /* We check u_ocsp.server.file, not server.olist, because we care about if
2791 the option exists, not what the current expansion might be, as SNI might
2792 change the certificate and OCSP file in use between now and the time the
2793 callback is invoked. */
2794 if (state->u_ocsp.server.file)
2796 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2797 SSL_CTX_set_tlsext_status_arg(ctx, state);
2800 /* We always do this, so that $tls_sni is available even if not used in
2802 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2803 SSL_CTX_set_tlsext_servername_arg(ctx, state);
2805 # ifdef EXIM_HAVE_ALPN
2806 if (tls_alpn && *tls_alpn)
2809 if ( expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr)
2810 && *exp_alpn && !isblank(*exp_alpn))
2812 tls_alpn = exp_alpn; /* subprocess so ok to overwrite */
2813 SSL_CTX_set_alpn_select_cb(ctx, tls_server_alpn_cb, state);
2820 # ifndef DISABLE_OCSP
2822 if(ocsp_file) /* wanting stapling */
2824 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
2826 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2829 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2830 SSL_CTX_set_tlsext_status_arg(ctx, state);
2835 state->verify_cert_hostnames = NULL;
2837 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
2838 /* Set up the RSA callback */
2839 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
2842 /* Finally, set the session cache timeout, and we are done.
2843 The period appears to be also used for (server-generated) session tickets */
2845 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
2846 DEBUG(D_tls) debug_printf("Initialized TLS\n");
2848 *caller_state = state;
2856 /*************************************************
2857 * Get name of cipher in use *
2858 *************************************************/
2861 Argument: pointer to an SSL structure for the connection
2862 pointer to number of bits for cipher
2863 Returns: pointer to allocated string in perm-pool
2867 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
2869 int pool = store_pool;
2870 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
2871 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2872 the accessor functions use const in the prototype. */
2874 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
2877 SSL_CIPHER_get_bits(c, bits);
2879 store_pool = POOL_PERM;
2880 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2882 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2887 /* Get IETF-standard name for ciphersuite.
2888 Argument: pointer to an SSL structure for the connection
2889 Returns: pointer to string
2892 static const uschar *
2893 cipher_stdname_ssl(SSL * ssl)
2895 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2896 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2898 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2899 return cipher_stdname(id >> 8, id & 0xff);
2904 static const uschar *
2905 tlsver_name(SSL * ssl)
2908 int pool = store_pool;
2910 store_pool = POOL_PERM;
2911 s = string_copy(US SSL_get_version(ssl));
2913 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
2914 for (;; p++) if (!(*p = p[1])) break;
2920 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
2922 /*XXX we might consider a list-of-certs variable for the cert chain.
2923 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2924 in list-handling functions, also consider the difference between the entire
2925 chain and the elements sent by the peer. */
2927 tlsp->peerdn = NULL;
2929 /* Will have already noted peercert on a verify fail; possibly not the leaf */
2930 if (!tlsp->peercert)
2931 tlsp->peercert = SSL_get_peer_certificate(ssl);
2932 /* Beware anonymous ciphers which lead to server_cert being NULL */
2934 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2935 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2938 int oldpool = store_pool;
2940 peerdn[siz-1] = '\0'; /* paranoia */
2941 store_pool = POOL_PERM;
2942 tlsp->peerdn = string_copy(peerdn);
2943 store_pool = oldpool;
2945 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2946 but they don't get called on session-resumption. So use the official
2947 interface, which uses the resumed value. Unfortunately this claims verified
2948 when it actually failed but we're in try-verify mode, due to us wanting the
2949 knowlege that it failed so needing to have the callback and forcing a
2950 permissive return. If we don't force it, the TLS startup is failed.
2951 The extra bit of information is set in verify_override in the cb, stashed
2952 for resumption next to the TLS session, and used here. */
2954 if (!tlsp->verify_override)
2955 tlsp->certificate_verified =
2957 tlsp->dane_verified ||
2959 SSL_get_verify_result(ssl) == X509_V_OK;
2967 /*************************************************
2968 * Set up for verifying certificates *
2969 *************************************************/
2971 #ifndef DISABLE_OCSP
2972 /* Load certs from file, return TRUE on success */
2975 chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
2978 STACK_OF(X509) * verify_stack = *vp;
2981 while (sk_X509_num(verify_stack) > 0)
2982 X509_free(sk_X509_pop(verify_stack));
2984 verify_stack = sk_X509_new_null();
2986 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
2987 for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
2988 sk_X509_push(verify_stack, x);
2997 /* Called by both client and server startup; on the server possibly
2998 repeated after a Server Name Indication.
3001 sctx SSL_CTX* to initialise
3002 certs certs file, expanded
3003 crl CRL file or NULL
3004 host NULL in a server; the remote host in a client
3005 errstr error string pointer
3007 Returns: OK/DEFER/FAIL
3011 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
3014 uschar *expcerts, *expcrl;
3016 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
3018 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3020 if (expcerts && *expcerts)
3022 /* Tell the library to use its compiled-in location for the system default
3023 CA bundle. Then add the ones specified in the config, if any. */
3025 if (!SSL_CTX_set_default_verify_paths(sctx))
3026 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
3028 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
3030 struct stat statbuf;
3032 if (Ustat(expcerts, &statbuf) < 0)
3034 log_write(0, LOG_MAIN|LOG_PANIC,
3035 "failed to stat %s for certificates", expcerts);
3041 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
3042 { file = NULL; dir = expcerts; }
3045 STACK_OF(X509) * verify_stack =
3046 #ifndef DISABLE_OCSP
3047 !host ? state_server.verify_stack :
3050 STACK_OF(X509) ** vp = &verify_stack;
3052 file = expcerts; dir = NULL;
3053 #ifndef DISABLE_OCSP
3054 /* In the server if we will be offering an OCSP proof, load chain from
3055 file for verifying the OCSP proof at load time. */
3057 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
3058 This is inconsistent with the need to verify the OCSP proof of the server cert.
3061 && statbuf.st_size > 0
3062 && state_server.u_ocsp.server.file
3063 && !chain_from_pem_file(file, vp)
3066 log_write(0, LOG_MAIN|LOG_PANIC,
3067 "failed to load cert chain from %s", file);
3073 /* If a certificate file is empty, the load function fails with an
3074 unhelpful error message. If we skip it, we get the correct behaviour (no
3075 certificates are recognized, but the error message is still misleading (it
3076 says no certificate was supplied). But this is better. */
3078 if ( (!file || statbuf.st_size > 0)
3079 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
3080 return tls_error(US"SSL_CTX_load_verify_locations",
3081 host, NULL, errstr);
3083 /* On the server load the list of CAs for which we will accept certs, for
3084 sending to the client. This is only for the one-file
3085 tls_verify_certificates variant.
3086 If a list isn't loaded into the server, but some verify locations are set,
3087 the server end appears to make a wildcard request for client certs.
3088 Meanwhile, the client library as default behaviour *ignores* the list
3089 we send over the wire - see man SSL_CTX_set_client_cert_cb.
3090 Because of this, and that the dir variant is likely only used for
3091 the public-CA bundle (not for a private CA), not worth fixing. */
3095 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
3096 int i = sk_X509_NAME_num(names);
3098 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
3099 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
3100 i, i>1 ? "ies":"y");
3104 debug_printf("Added dir for additional certificate authorities\n");
3108 /* Handle a certificate revocation list. */
3110 #if OPENSSL_VERSION_NUMBER > 0x00907000L
3112 /* This bit of code is now the version supplied by Lars Mainka. (I have
3113 merely reformatted it into the Exim code style.)
3115 "From here I changed the code to add support for multiple crl's
3116 in pem format in one file or to support hashed directory entries in
3117 pem format instead of a file. This method now uses the library function
3118 X509_STORE_load_locations to add the CRL location to the SSL context.
3119 OpenSSL will then handle the verify against CA certs and CRLs by
3120 itself in the verify callback." */
3122 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
3123 if (expcrl && *expcrl)
3125 struct stat statbufcrl;
3126 if (Ustat(expcrl, &statbufcrl) < 0)
3128 log_write(0, LOG_MAIN|LOG_PANIC,
3129 "failed to stat %s for certificates revocation lists", expcrl);
3134 /* is it a file or directory? */
3136 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
3137 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
3141 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
3147 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
3149 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
3150 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
3152 /* setting the flags to check against the complete crl chain */
3154 X509_STORE_set_flags(cvstore,
3155 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
3159 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3168 tls_dump_keylog(SSL * ssl)
3170 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3171 BIO * bp = BIO_new(BIO_s_mem());
3174 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3175 len = (int) BIO_get_mem_data(bp, CSS &s);
3176 if (len > 0) debug_printf("%.*s", len, s);
3182 /* Channel-binding info for authenticators
3183 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/
3188 tls_get_channel_binding(SSL * ssl, tls_support * tlsp, const void * taintval)
3193 #ifdef EXIM_HAVE_EXPORT_CHNL_BNGNG
3194 if (SSL_version(ssl) >= TLS1_3_VERSION)
3196 /* It's not documented by OpenSSL how big the output buffer must be.
3197 The OpenSSL testcases use 80 bytes but don't say why. The GnuTLS impl only
3198 serves out 32B. RFC 9266 says it is 32B.
3199 Interop fails unless we use the same each end. */
3202 tlsp->channelbind_exporter = TRUE;
3203 taintval = GET_UNTAINTED;
3204 if (SSL_export_keying_material(ssl,
3205 s = store_get((int)len, taintval), len,
3206 "EXPORTER-Channel-Binding", (size_t) 24,
3213 len = SSL_get_peer_finished(ssl, &c, 0);
3214 len = SSL_get_peer_finished(ssl, s = store_get((int)len, taintval), len);
3219 int old_pool = store_pool;
3220 store_pool = POOL_PERM;
3221 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, taintval);
3222 store_pool = old_pool;
3223 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
3228 /*************************************************
3229 * Start a TLS session in a server *
3230 *************************************************/
3231 /* This is called when Exim is running as a server, after having received
3232 the STARTTLS command. It must respond to that command, and then negotiate
3236 errstr pointer to error message
3238 Returns: OK on success
3239 DEFER for errors before the start of the negotiation
3240 FAIL for errors during the negotiation; the server can't
3245 tls_server_start(uschar ** errstr)
3248 uschar * expciphers;
3249 exim_openssl_state_st * dummy_statep;
3252 static uschar peerdn[256];
3254 /* Check for previous activation */
3256 if (tls_in.active.sock >= 0)
3258 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3259 smtp_printf("554 Already in TLS\r\n", FALSE);
3263 /* Initialize the SSL library. If it fails, it will already have logged
3266 rc = tls_init(NULL, NULL,
3267 #ifndef DISABLE_OCSP
3270 NULL, &dummy_statep, &tls_in, errstr);
3271 if (rc != OK) return rc;
3272 ctx = state_server.lib_state.lib_ctx;
3274 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3275 were historically separated by underscores. So that I can use either form in my
3276 tests, and also for general convenience, we turn underscores into hyphens here.
3278 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3279 for TLS 1.3 . Since we do not call it at present we get the default list:
3280 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3283 if (state_server.lib_state.pri_string)
3284 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3287 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3292 normalise_ciphers(&expciphers, tls_require_ciphers);
3293 if ((rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3298 /* If this is a host for which certificate verification is mandatory or
3299 optional, set up appropriately. */
3301 tls_in.certificate_verified = FALSE;
3303 tls_in.dane_verified = FALSE;
3305 server_verify_callback_called = FALSE;
3307 if (verify_check_host(&tls_verify_hosts) == OK)
3308 server_verify_optional = FALSE;
3309 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3310 server_verify_optional = TRUE;
3316 if (!expand_check(tls_verify_certificates, US"tls_verify_certificates",
3319 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3321 if (state_server.lib_state.cabundle)
3322 { DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n"); }
3324 if ((rc = setup_certs(ctx, expcerts, tls_crl, NULL, errstr)) != OK)
3327 if (expcerts && *expcerts)
3328 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3332 #ifndef DISABLE_TLS_RESUME
3333 # if OPENSSL_VERSION_NUMBER < 0x30000000L
3334 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3335 /* despite working, appears to always return failure, so ignoring */
3337 SSL_CTX_set_tlsext_ticket_key_evp_cb(ctx, ticket_key_callback);
3338 /* despite working, appears to always return failure, so ignoring */
3342 #ifdef OPENSSL_HAVE_NUM_TICKETS
3343 # ifndef DISABLE_TLS_RESUME
3344 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3346 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3351 /* Prepare for new connection */
3353 if (!(ssl = SSL_new(ctx)))
3354 return tls_error(US"SSL_new", NULL, NULL, errstr);
3355 state_server.lib_state.lib_ssl = ssl;
3357 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3359 * With the SSL_clear(), we get strange interoperability bugs with
3360 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3361 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3363 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3364 * session shutdown. In this case, we have a brand new object and there's no
3365 * obvious reason to immediately clear it. I'm guessing that this was
3366 * originally added because of incomplete initialisation which the clear fixed,
3367 * in some historic release.
3370 /* Set context and tell client to go ahead, except in the case of TLS startup
3371 on connection, where outputting anything now upsets the clients and tends to
3372 make them disconnect. We need to have an explicit fflush() here, to force out
3373 the response. Other smtp_printf() calls do not need it, because in non-TLS
3374 mode, the fflush() happens when smtp_getc() is called. */
3376 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3377 if (!tls_in.on_connect)
3379 smtp_printf("220 TLS go ahead\r\n", FALSE);
3383 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3384 that the OpenSSL library doesn't. */
3386 SSL_set_wfd(ssl, fileno(smtp_out));
3387 SSL_set_rfd(ssl, fileno(smtp_in));
3388 SSL_set_accept_state(ssl);
3390 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3393 sigalrm_seen = FALSE;
3394 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3395 rc = SSL_accept(ssl);
3400 int error = SSL_get_error(ssl, rc);
3403 case SSL_ERROR_NONE:
3406 case SSL_ERROR_ZERO_RETURN:
3407 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3408 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3409 #ifndef DISABLE_EVENT
3410 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3412 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3415 tls_close(NULL, TLS_NO_SHUTDOWN);
3418 /* Handle genuine errors */
3422 int r = ERR_GET_REASON(ERR_peek_error());
3423 if ( r == SSL_R_WRONG_VERSION_NUMBER
3424 #ifdef SSL_R_VERSION_TOO_LOW
3425 || r == SSL_R_VERSION_TOO_LOW
3427 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3428 s = string_sprintf("(%s)", SSL_get_version(ssl));
3429 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
3430 #ifndef DISABLE_EVENT
3431 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3437 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3438 if (error == SSL_ERROR_SYSCALL)
3442 *errstr = US"SSL_accept: TCP connection closed by peer";
3443 #ifndef DISABLE_EVENT
3444 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3448 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3450 (void) tls_error(US"SSL_accept", NULL,
3451 sigalrm_seen ? US"timed out"
3452 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3454 #ifndef DISABLE_EVENT
3455 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3461 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3462 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3463 anon-authentication ciphersuite negotiated. */
3465 #ifndef DISABLE_TLS_RESUME
3466 if (SSL_session_reused(ssl))
3468 tls_in.resumption |= RESUME_USED;
3469 DEBUG(D_tls) debug_printf("Session reused\n");
3473 #ifdef EXIM_HAVE_ALPN
3474 /* If require-alpn, check server_seen_alpn here. Else abort TLS */
3475 if (!tls_alpn || !*tls_alpn)
3476 { DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n"); }
3477 else if (!server_seen_alpn)
3478 if (verify_check_host(&hosts_require_alpn) == OK)
3480 /* We'd like to send a definitive Alert but OpenSSL provides no facility */
3482 tls_error(US"handshake", NULL, US"ALPN required but not negotiated", errstr);
3486 { DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n"); }
3489 const uschar * name;
3491 SSL_get0_alpn_selected(ssl, &name, &len);
3493 debug_printf("ALPN negotiated: '%.*s'\n", (int)*name, name+1);
3495 debug_printf("ALPN: no protocol negotiated\n");
3500 /* TLS has been set up. Record data for the connection,
3501 adjust the input functions to read via TLS, and initialize things. */
3503 #ifdef SSL_get_extms_support
3504 /*XXX what does this return for tls1.3 ? */
3505 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3507 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3509 tls_in.ver = tlsver_name(ssl);
3510 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3511 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3516 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3517 debug_printf("Shared ciphers: %s\n", buf);
3519 tls_dump_keylog(ssl);
3521 #ifdef EXIM_HAVE_SESSION_TICKET
3523 SSL_SESSION * ss = SSL_get_session(ssl);
3524 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3525 debug_printf("The session has a ticket, life %lu seconds\n",
3526 SSL_SESSION_get_ticket_lifetime_hint(ss));
3531 /* Record the certificate we presented */
3533 X509 * crt = SSL_get_certificate(ssl);
3534 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3537 tls_get_channel_binding(ssl, &tls_in, GET_UNTAINTED);
3539 /* Only used by the server-side tls (tls_in), including tls_getc.
3540 Client-side (tls_out) reads (seem to?) go via
3541 smtp_read_response()/ip_recv().
3542 Hence no need to duplicate for _in and _out.
3544 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3545 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3546 ssl_xfer_eof = ssl_xfer_error = FALSE;
3548 receive_getc = tls_getc;
3549 receive_getbuf = tls_getbuf;
3550 receive_get_cache = tls_get_cache;
3551 receive_hasc = tls_hasc;
3552 receive_ungetc = tls_ungetc;
3553 receive_feof = tls_feof;
3554 receive_ferror = tls_ferror;
3556 tls_in.active.sock = fileno(smtp_out);
3557 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3565 tls_client_basic_ctx_init(SSL_CTX * ctx,
3566 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3571 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3572 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3573 host patterns if one of them is set with content. */
3575 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3576 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3578 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3579 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3582 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3584 client_verify_optional = FALSE;
3585 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3586 client_verify_optional = TRUE;
3592 if (!expand_check(ob->tls_verify_certificates, US"tls_verify_certificates",
3595 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3597 if (state->lib_state.cabundle)
3598 { DEBUG(D_tls) debug_printf("TLS: CA bundle was preloaded\n"); }
3600 if ((rc = setup_certs(ctx, expcerts, ob->tls_crl, host, errstr)) != OK)
3603 if (expcerts && *expcerts)
3604 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3607 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3609 state->verify_cert_hostnames =
3611 string_domain_utf8_to_alabel(host->certname, NULL);
3615 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3616 state->verify_cert_hostnames);
3624 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3627 const char * hostnames[2] = { CS host->name, NULL };
3630 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3631 return tls_error(US"hostnames load", host, NULL, errstr);
3633 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3634 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3635 ) if (rr->type == T_TLSA && rr->size > 3)
3637 const uschar * p = rr->data;
3638 uint8_t usage, selector, mtype;
3639 const char * mdname;
3643 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3644 if (usage != 2 && usage != 3) continue;
3651 default: continue; /* Only match-types 0, 1, 2 are supported */
3652 case 0: mdname = NULL; break;
3653 case 1: mdname = "sha256"; break;
3654 case 2: mdname = "sha512"; break;
3658 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3661 return tls_error(US"tlsa load", host, NULL, errstr);
3662 case 0: /* action not taken */
3666 tls_out.tlsa_usage |= 1<<usage;
3672 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3675 #endif /*SUPPORT_DANE*/
3679 #ifndef DISABLE_TLS_RESUME
3680 /* On the client, get any stashed session for the given IP from hints db
3681 and apply it to the ssl-connection for attempted resumption. */
3684 tls_retrieve_session(tls_support * tlsp, SSL * ssl)
3686 if (tlsp->host_resumable)
3688 const uschar * key = tlsp->resume_index;
3689 dbdata_tls_session * dt;
3691 open_db dbblock, * dbm_file;
3693 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3695 debug_printf("checking for resumable session for %s\n", tlsp->resume_index);
3696 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3698 if ((dt = dbfn_read_with_length(dbm_file, tlsp->resume_index, &len)))
3700 SSL_SESSION * ss = NULL;
3701 const uschar * sess_asn1 = dt->session;
3703 len -= sizeof(dbdata_tls_session);
3704 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3708 ERR_error_string_n(ERR_get_error(),
3709 ssl_errstring, sizeof(ssl_errstring));
3710 debug_printf("decoding session: %s\n", ssl_errstring);
3715 unsigned long lifetime =
3716 #ifdef EXIM_HAVE_SESSION_TICKET
3717 SSL_SESSION_get_ticket_lifetime_hint(ss);
3718 #else /* Use, fairly arbitrilarily, what we as server would */
3719 f.running_in_test_harness ? 6 : ssl_session_timeout;
3721 if (lifetime + dt->time_stamp < time(NULL))
3723 DEBUG(D_tls) debug_printf("session expired\n");
3724 dbfn_delete(dbm_file, tlsp->resume_index);
3726 else if (SSL_set_session(ssl, ss))
3728 DEBUG(D_tls) debug_printf("good session\n");
3729 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3730 tlsp->verify_override = dt->verify_override;
3731 tlsp->ocsp = dt->ocsp;
3735 ERR_error_string_n(ERR_get_error(),
3736 ssl_errstring, sizeof(ssl_errstring));
3737 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3742 DEBUG(D_tls) debug_printf("no session record\n");
3743 dbfn_close(dbm_file);
3749 /* On the client, save the session for later resumption */
3752 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3754 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3757 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3759 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3761 # ifdef OPENSSL_HAVE_NUM_TICKETS
3762 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3765 int len = i2d_SSL_SESSION(ss, NULL);
3766 int dlen = sizeof(dbdata_tls_session) + len;
3767 dbdata_tls_session * dt = store_get(dlen, GET_TAINTED);
3768 uschar * s = dt->session;
3769 open_db dbblock, * dbm_file;
3771 DEBUG(D_tls) debug_printf("session is resumable\n");
3772 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3774 dt->verify_override = tlsp->verify_override;
3775 dt->ocsp = tlsp->ocsp;
3776 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3778 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3780 dbfn_write(dbm_file, tlsp->resume_index, dt, dlen);
3781 dbfn_close(dbm_file);
3782 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3790 /* Construct a key for session DB lookup, and setup the SSL_CTX for resumption */
3793 tls_client_ctx_resume_prehandshake(
3794 exim_openssl_client_tls_ctx * exim_client_ctx, smtp_connect_args * conn_args,
3795 tls_support * tlsp, smtp_transport_options_block * ob)
3797 tlsp->host_resumable = TRUE;
3798 tls_client_resmption_key(tlsp, conn_args, ob);
3800 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3801 SSL_SESS_CACHE_CLIENT
3802 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3803 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3807 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3808 host_item * host, uschar ** errstr)
3810 if (tlsp->host_resumable)
3813 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3814 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3816 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3817 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
3819 tls_error(US"set ex_data", host, NULL, errstr);
3822 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state);
3825 tlsp->resumption = RESUME_SUPPORTED;
3826 /* Pick up a previous session, saved on an old ticket */
3827 tls_retrieve_session(tlsp, ssl);
3832 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
3835 if (SSL_session_reused(exim_client_ctx->ssl))
3837 DEBUG(D_tls) debug_printf("The session was reused\n");
3838 tlsp->resumption |= RESUME_USED;
3841 #endif /* !DISABLE_TLS_RESUME */
3844 #ifdef EXIM_HAVE_ALPN
3845 /* Expand and convert an Exim list to an ALPN list. False return for fail.
3846 NULL plist return for silent no-ALPN.
3848 Overwite the passed-in list with the expanded version.
3852 tls_alpn_plist(uschar ** tls_alpn, const uschar ** plist, unsigned * plen,
3857 if (!expand_check(*tls_alpn, US"tls_alpn", &exp_alpn, errstr))
3859 *tls_alpn = exp_alpn;
3863 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
3868 /* The server implementation only accepts exactly one protocol name
3869 but it's little extra code complexity in the client. */
3871 const uschar * list = exp_alpn;
3872 uschar * p = store_get(Ustrlen(exp_alpn), exp_alpn), * s, * t;
3876 for (t = p; s = string_nextinlist(&list, &sep, NULL, 0); t += len)
3878 *t++ = len = (uschar) Ustrlen(s);
3881 *plist = (*plen = t - p) ? p : NULL;
3885 #endif /* EXIM_HAVE_ALPN */
3888 /*************************************************
3889 * Start a TLS session in a client *
3890 *************************************************/
3892 /* Called from the smtp transport after STARTTLS has been accepted.
3895 cctx connection context
3896 conn_args connection details
3897 cookie datum for randomness; can be NULL
3898 tlsp record details of TLS channel configuration here; must be non-NULL
3899 errstr error string pointer
3901 Returns: TRUE for success with TLS session context set in connection context,
3906 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3907 void * cookie, tls_support * tlsp, uschar ** errstr)
3909 host_item * host = conn_args->host; /* for msgs and option-tests */
3910 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3911 smtp_transport_options_block * ob = tb
3912 ? (smtp_transport_options_block *)tb->options_block
3913 : &smtp_transport_option_defaults;
3914 exim_openssl_client_tls_ctx * exim_client_ctx;
3915 uschar * expciphers;
3917 static uschar peerdn[256];
3919 #ifndef DISABLE_OCSP
3920 BOOL request_ocsp = FALSE;
3921 BOOL require_ocsp = FALSE;
3925 store_pool = POOL_PERM;
3926 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), GET_UNTAINTED);
3927 exim_client_ctx->corked = NULL;
3931 tlsp->tlsa_usage = 0;
3934 #ifndef DISABLE_OCSP
3936 # ifdef SUPPORT_DANE
3937 /*XXX this should be moved to caller, to be common across gnutls/openssl */
3938 if ( conn_args->dane
3939 && ob->hosts_request_ocsp[0] == '*'
3940 && ob->hosts_request_ocsp[1] == '\0'
3943 /* Unchanged from default. Use a safer one under DANE */
3944 request_ocsp = TRUE;
3945 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3946 " {= {4}{$tls_out_tlsa_usage}} } "
3952 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
3953 request_ocsp = TRUE;
3955 # ifdef SUPPORT_DANE
3959 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3963 rc = tls_init(host, ob,
3964 #ifndef DISABLE_OCSP
3965 (void *)(long)request_ocsp,
3967 cookie, &client_static_state, tlsp, errstr);
3968 if (rc != OK) return FALSE;
3970 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
3972 tlsp->certificate_verified = FALSE;
3973 client_verify_callback_called = FALSE;
3977 if (conn_args->dane)
3979 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3980 other failures should be treated as problems. */
3981 if (ob->dane_require_tls_ciphers &&
3982 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3983 &expciphers, errstr))
3985 if (expciphers && *expciphers == '\0')
3988 normalise_ciphers(&expciphers, ob->dane_require_tls_ciphers);
3993 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
3994 &expciphers, errstr))
3997 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3998 are separated by underscores. So that I can use either form in my tests, and
3999 also for general convenience, we turn underscores into hyphens here. */
4001 normalise_ciphers(&expciphers, ob->tls_require_ciphers);
4006 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
4007 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
4009 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
4015 if (conn_args->dane)
4017 SSL_CTX_set_verify(exim_client_ctx->ctx,
4018 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
4019 verify_callback_client_dane);
4021 if (!DANESSL_library_init())
4023 tls_error(US"library init", host, NULL, errstr);
4026 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
4028 tls_error(US"context init", host, NULL, errstr);
4036 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
4037 client_static_state, errstr) != OK)
4042 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
4045 { DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n"); }
4046 else if (!Ustrlen(tlsp->sni))
4050 #ifndef EXIM_HAVE_OPENSSL_TLSEXT
4051 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
4059 #ifdef EXIM_HAVE_ALPN
4061 const uschar * plist;
4064 if (!tls_alpn_plist(&ob->tls_alpn, &plist, &plen, errstr))
4067 if (SSL_CTX_set_alpn_protos(exim_client_ctx->ctx, plist, plen) != 0)
4069 tls_error(US"alpn init", host, NULL, errstr);
4073 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
4076 log_write(0, LOG_MAIN, "ALPN unusable with this OpenSSL library version; ignoring \"%s\"\n",
4080 #ifndef DISABLE_TLS_RESUME
4081 /*XXX have_lbserver: another cmdline arg possibly, for continued-conn, but use
4082 will be very low. */
4084 if (!conn_args->have_lbserver) /* wanted for tls_client_resmption_key() */
4085 { DEBUG(D_tls) debug_printf("resumption not supported on continued-connection\n"); }
4086 else if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
4087 tls_client_ctx_resume_prehandshake(exim_client_ctx, conn_args, tlsp, ob);
4091 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
4093 tls_error(US"SSL_new", host, NULL, errstr);
4096 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
4097 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
4098 SSL_set_connect_state(exim_client_ctx->ssl);
4100 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
4103 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
4104 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
4109 if (conn_args->dane)
4110 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
4114 #ifndef DISABLE_OCSP
4115 /* Request certificate status at connection-time. If the server
4116 does OCSP stapling we will get the callback (set in tls_init()) */
4117 # ifdef SUPPORT_DANE
4121 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4122 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4124 { /* Re-eval now $tls_out_tlsa_usage is populated. If
4125 this means we avoid the OCSP request, we wasted the setup
4126 cost in tls_init(). */
4127 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
4128 request_ocsp = require_ocsp
4129 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4136 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
4137 client_static_state->u_ocsp.client.verify_required = require_ocsp;
4138 tlsp->ocsp = OCSP_NOT_RESP;
4142 #ifndef DISABLE_TLS_RESUME
4143 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
4148 #ifndef DISABLE_EVENT
4149 client_static_state->event_action = tb ? tb->event_action : NULL;
4152 /* There doesn't seem to be a built-in timeout on connection. */
4154 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
4155 sigalrm_seen = FALSE;
4156 ALARM(ob->command_timeout);
4157 rc = SSL_connect(exim_client_ctx->ssl);
4161 if (conn_args->dane)
4162 DANESSL_cleanup(exim_client_ctx->ssl);
4167 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
4173 debug_printf("SSL_connect succeeded\n");
4174 tls_dump_keylog(exim_client_ctx->ssl);
4177 #ifndef DISABLE_TLS_RESUME
4178 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
4181 #ifdef EXIM_HAVE_ALPN
4182 if (ob->tls_alpn) /* We requested. See what was negotiated. */
4184 const uschar * name;
4187 SSL_get0_alpn_selected(exim_client_ctx->ssl, &name, &len);
4189 { DEBUG(D_tls) debug_printf("ALPN negotiated %u: '%.*s'\n", len, (int)*name, name+1); }
4190 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
4192 /* Would like to send a relevant fatal Alert, but OpenSSL has no API */
4193 tls_error(US"handshake", host, US"ALPN required but not negotiated", errstr);
4199 #ifdef SSL_get_extms_support
4200 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
4202 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
4204 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
4205 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
4206 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
4208 /* Record the certificate we presented */
4210 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
4211 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
4214 /*XXX will this work with continued-TLS? */
4215 tls_get_channel_binding(exim_client_ctx->ssl, tlsp, GET_TAINTED);
4217 tlsp->active.sock = cctx->sock;
4218 tlsp->active.tls_ctx = exim_client_ctx;
4219 cctx->tls_ctx = exim_client_ctx;
4228 tls_refill(unsigned lim)
4230 SSL * ssl = state_server.lib_state.lib_ssl;
4234 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4235 ssl_xfer_buffer, ssl_xfer_buffer_size);
4238 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4239 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
4240 MIN(ssl_xfer_buffer_size, lim));
4241 error = SSL_get_error(ssl, inbytes);
4242 if (smtp_receive_timeout > 0) ALARM_CLR(0);
4244 if (had_command_timeout) /* set by signal handler */
4245 smtp_command_timeout_exit(); /* does not return */
4246 if (had_command_sigterm)
4247 smtp_command_sigterm_exit();
4248 if (had_data_timeout)
4249 smtp_data_timeout_exit();
4250 if (had_data_sigint)
4251 smtp_data_sigint_exit();
4253 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
4254 closed down, not that the socket itself has been closed down. Revert to
4255 non-SSL handling. */
4259 case SSL_ERROR_NONE:
4262 case SSL_ERROR_ZERO_RETURN:
4263 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4265 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
4268 tls_close(NULL, TLS_NO_SHUTDOWN);
4271 /* Handle genuine errors */
4273 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4274 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
4275 ssl_xfer_error = TRUE;
4279 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
4280 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
4281 debug_printf(" - syscall %s\n", strerror(errno));
4282 ssl_xfer_error = TRUE;
4286 #ifndef DISABLE_DKIM
4287 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
4289 ssl_xfer_buffer_hwm = inbytes;
4290 ssl_xfer_buffer_lwm = 0;
4295 /*************************************************
4296 * TLS version of getc *
4297 *************************************************/
4299 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
4300 it refills the buffer via the SSL reading function.
4302 Arguments: lim Maximum amount to read/buffer
4303 Returns: the next character or EOF
4305 Only used by the server-side TLS.
4309 tls_getc(unsigned lim)
4311 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4312 if (!tls_refill(lim))
4313 return ssl_xfer_error ? EOF : smtp_getc(lim);
4315 /* Something in the buffer; return next uschar */
4317 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
4323 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm;
4327 tls_getbuf(unsigned * len)
4332 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4333 if (!tls_refill(*len))
4335 if (!ssl_xfer_error) return smtp_getbuf(len);
4340 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4342 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4343 ssl_xfer_buffer_lwm += size;
4350 tls_get_cache(unsigned lim)
4352 #ifndef DISABLE_DKIM
4353 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4354 debug_printf("tls_get_cache\n");
4358 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4364 tls_could_getc(void)
4366 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4367 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4371 /*************************************************
4372 * Read bytes from TLS channel *
4373 *************************************************/
4377 ct_ctx client context pointer, or NULL for the one global server context
4381 Returns: the number of bytes read
4382 -1 after a failed read, including EOF
4384 Only used by the client-side TLS.
4388 tls_read(void * ct_ctx, uschar *buff, size_t len)
4390 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4391 : state_server.lib_state.lib_ssl;
4395 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4396 buff, (unsigned int)len);
4399 inbytes = SSL_read(ssl, CS buff, len);
4400 error = SSL_get_error(ssl, inbytes);
4402 if (error == SSL_ERROR_ZERO_RETURN)
4404 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4407 else if (error != SSL_ERROR_NONE)
4417 /*************************************************
4418 * Write bytes down TLS channel *
4419 *************************************************/
4423 ct_ctx client context pointer, or NULL for the one global server context
4426 more further data expected soon
4428 Returns: the number of bytes after a successful write,
4429 -1 after a failed write
4431 Used by both server-side and client-side TLS. Calling with len zero and more unset
4432 will flush buffered writes; buff can be null for this case.
4436 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4439 int outbytes, error;
4441 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4442 : state_server.lib_state.lib_ssl;
4443 static gstring * server_corked = NULL;
4444 gstring ** corkedp = ct_ctx
4445 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4446 gstring * corked = *corkedp;
4448 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4449 buff, (unsigned long)len, more ? ", more" : "");
4451 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4452 "more" is notified. This hack is only ok if small amounts are involved AND only
4453 one stream does it, in one context (i.e. no store reset). Currently it is used
4454 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4455 We support callouts done by the server process by using a separate client
4456 context for the stashed information. */
4457 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4458 a store reset there, so use POOL_PERM. */
4459 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4463 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4465 int save_pool = store_pool;
4466 store_pool = POOL_PERM;
4468 corked = string_catn(corked, buff, len);
4470 store_pool = save_pool;
4477 buff = CUS corked->s;
4482 for (int left = len; left > 0;)
4484 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4486 outbytes = SSL_write(ssl, CS buff, left);
4487 error = SSL_get_error(ssl, outbytes);
4488 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4491 case SSL_ERROR_NONE: /* the usual case */
4497 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4498 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4501 case SSL_ERROR_ZERO_RETURN:
4502 log_write(0, LOG_MAIN, "SSL channel closed on write");
4505 case SSL_ERROR_SYSCALL:
4506 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4507 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4508 sender_fullhost ? sender_fullhost : US"<unknown>",
4510 else if (LOGGING(protocol_detail))
4511 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4512 " SMTP response and TLS close\n", sender_host_address);
4514 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4515 " client reset TCP before TLS close\n", sender_host_address);
4519 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4530 ct_ctx client TLS context pointer, or NULL for the one global server context
4534 tls_shutdown_wr(void * ct_ctx)
4536 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4537 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4538 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4541 if (*fdp < 0) return; /* TLS was not active */
4543 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4545 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
4546 rc = SSL_shutdown(*sslp);
4547 if (rc < 0) DEBUG(D_tls)
4549 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4550 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4554 /*************************************************
4555 * Close down a TLS session *
4556 *************************************************/
4558 /* This is also called from within a delivery subprocess forked from the
4559 daemon, to shut down the TLS library, without actually doing a shutdown (which
4560 would tamper with the SSL session in the parent process).
4563 ct_ctx client TLS context pointer, or NULL for the one global server context
4564 do_shutdown 0 no data-flush or TLS close-alert
4565 1 if TLS close-alert is to be sent,
4566 2 if also response to be waited for
4570 Used by both server-side and client-side TLS.
4574 tls_close(void * ct_ctx, int do_shutdown)
4576 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4577 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4578 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4580 if (*fdp < 0) return; /* TLS was not active */
4582 if (do_shutdown > TLS_NO_SHUTDOWN)
4585 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4586 do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
4588 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4590 if ( ( do_shutdown >= TLS_SHUTDOWN_WONLY
4591 || (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4593 && do_shutdown > TLS_SHUTDOWN_NOWAIT
4596 #ifdef EXIM_TCP_CORK
4597 (void) setsockopt(*fdp, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
4600 rc = SSL_shutdown(*sslp); /* wait for response */
4604 if (rc < 0) DEBUG(D_tls)
4606 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4607 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4611 if (!o_ctx) /* server side */
4613 #ifndef DISABLE_OCSP
4614 sk_X509_pop_free(state_server.verify_stack, X509_free);
4615 state_server.verify_stack = NULL;
4618 receive_getc = smtp_getc;
4619 receive_getbuf = smtp_getbuf;
4620 receive_get_cache = smtp_get_cache;
4621 receive_hasc = smtp_hasc;
4622 receive_ungetc = smtp_ungetc;
4623 receive_feof = smtp_feof;
4624 receive_ferror = smtp_ferror;
4625 tls_in.active.tls_ctx = NULL;
4627 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4638 /*************************************************
4639 * Let tls_require_ciphers be checked at startup *
4640 *************************************************/
4642 /* The tls_require_ciphers option, if set, must be something which the
4645 Returns: NULL on success, or error message
4649 tls_validate_require_cipher(void)
4652 uschar * expciphers, * err;
4656 if (!(tls_require_ciphers && *tls_require_ciphers))
4659 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4661 return US"failed to expand tls_require_ciphers";
4663 if (!(expciphers && *expciphers))
4666 normalise_ciphers(&expciphers, tls_require_ciphers);
4669 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4672 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4674 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4676 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4677 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4678 expciphers, ssl_errstring);
4689 /*************************************************
4690 * Report the library versions. *
4691 *************************************************/
4693 /* There have historically been some issues with binary compatibility in
4694 OpenSSL libraries; if Exim (like many other applications) is built against
4695 one version of OpenSSL but the run-time linker picks up another version,
4696 it can result in serious failures, including crashing with a SIGSEGV. So
4697 report the version found by the compiler and the run-time version.
4699 Note: some OS vendors backport security fixes without changing the version
4700 number/string, and the version date remains unchanged. The _build_ date
4701 will change, so we can more usefully assist with version diagnosis by also
4702 reporting the build date.
4704 Arguments: string to append to
4709 tls_version_report(gstring * g)
4711 return string_fmt_append(g,
4712 "Library version: OpenSSL: Compile: %s\n"
4715 OPENSSL_VERSION_TEXT,
4716 SSLeay_version(SSLEAY_VERSION),
4717 SSLeay_version(SSLEAY_BUILT_ON));
4718 /* third line is 38 characters for the %s and the line is 73 chars long;
4719 the OpenSSL output includes a "built on: " prefix already. */
4725 /*************************************************
4726 * Random number generation *
4727 *************************************************/
4729 /* Pseudo-random number generation. The result is not expected to be
4730 cryptographically strong but not so weak that someone will shoot themselves
4731 in the foot using it as a nonce in input in some email header scheme or
4732 whatever weirdness they'll twist this into. The result should handle fork()
4733 and avoid repeating sequences. OpenSSL handles that for us.
4737 Returns a random number in range [0, max-1]
4741 vaguely_random_number(int max)
4745 static pid_t pidlast = 0;
4747 uschar smallbuf[sizeof(r)];
4753 if (pidnow != pidlast)
4755 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
4756 is unique for each thread", this doesn't apparently apply across processes,
4757 so our own warning from vaguely_random_number_fallback() applies here too.
4758 Fix per PostgreSQL. */
4764 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
4768 gettimeofday(&r.tv, NULL);
4771 RAND_seed(US (&r), sizeof(r));
4773 /* We're after pseudo-random, not random; if we still don't have enough data
4774 in the internal PRNG then our options are limited. We could sleep and hope
4775 for entropy to come along (prayer technique) but if the system is so depleted
4776 in the first place then something is likely to just keep taking it. Instead,
4777 we'll just take whatever little bit of pseudo-random we can still manage to
4780 needed_len = sizeof(r);
4781 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4782 asked for a number less than 10. */
4783 for (r = max, i = 0; r; ++i)
4789 #ifdef EXIM_HAVE_RAND_PSEUDO
4790 /* We do not care if crypto-strong */
4791 i = RAND_pseudo_bytes(smallbuf, needed_len);
4793 i = RAND_bytes(smallbuf, needed_len);
4799 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
4800 return vaguely_random_number_fallback(max);
4804 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4807 /* We don't particularly care about weighted results; if someone wants
4808 smooth distribution and cares enough then they should submit a patch then. */
4815 /*************************************************
4816 * OpenSSL option parse *
4817 *************************************************/
4819 /* Parse one option for tls_openssl_options_parse below
4822 name one option name
4823 value place to store a value for it
4824 Returns success or failure in parsing
4830 tls_openssl_one_option_parse(uschar *name, long *value)
4833 int last = exim_openssl_options_size;
4834 while (last > first)
4836 int middle = (first + last)/2;
4837 int c = Ustrcmp(name, exim_openssl_options[middle].name);
4840 *value = exim_openssl_options[middle].value;
4854 /*************************************************
4855 * OpenSSL option parsing logic *
4856 *************************************************/
4858 /* OpenSSL has a number of compatibility options which an administrator might
4859 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
4860 we look like log_selector.
4863 option_spec the administrator-supplied string of options
4864 results ptr to long storage for the options bitmap
4865 Returns success or failure
4869 tls_openssl_options_parse(uschar *option_spec, long *results)
4872 uschar * exp, * end;
4873 BOOL adding, item_parsed;
4875 /* Server: send no (<= TLS1.2) session tickets */
4876 result = SSL_OP_NO_TICKET;
4878 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
4879 from default because it increases BEAST susceptibility. */
4880 #ifdef SSL_OP_NO_SSLv2
4881 result |= SSL_OP_NO_SSLv2;
4883 #ifdef SSL_OP_NO_SSLv3
4884 result |= SSL_OP_NO_SSLv3;
4886 #ifdef SSL_OP_SINGLE_DH_USE
4887 result |= SSL_OP_SINGLE_DH_USE;
4889 #ifdef SSL_OP_NO_RENEGOTIATION
4890 result |= SSL_OP_NO_RENEGOTIATION;
4899 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
4902 for (uschar * s = exp; *s; /**/)
4904 while (isspace(*s)) ++s;
4907 if (*s != '+' && *s != '-')
4909 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
4910 "+ or - expected but found \"%s\"\n", s);
4913 adding = *s++ == '+';
4914 for (end = s; *end && !isspace(*end); ) end++;
4915 item_parsed = tls_openssl_one_option_parse(string_copyn(s, end-s), &item);
4918 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
4921 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
4922 adding ? "adding to " : "removing from", result, item, s);
4934 #endif /*!MACRO_PREDEF*/
4937 /* End of tls-openssl.c */