1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2017 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Portions Copyright (c) The OpenSSL Project 1999 */
10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11 library. It is #included into the tls.c file when that library is used. The
12 code herein is based on a patch that was originally contributed by Steve
13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
15 No cryptographic code is included in Exim. All this module does is to call
16 functions from the OpenSSL library. */
21 #include <openssl/lhash.h>
22 #include <openssl/ssl.h>
23 #include <openssl/err.h>
24 #include <openssl/rand.h>
25 #ifndef OPENSSL_NO_ECDH
26 # include <openssl/ec.h>
29 # include <openssl/ocsp.h>
31 #ifdef EXPERIMENTAL_DANE
37 # define EXIM_OCSP_SKEW_SECONDS (300L)
38 # define EXIM_OCSP_MAX_AGE (-1L)
41 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
42 # define EXIM_HAVE_OPENSSL_TLSEXT
44 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
45 # define EXIM_HAVE_RSA_GENKEY_EX
47 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
48 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define EXIM_HAVE_EPHEM_RSA_KEX
51 # define EXIM_HAVE_RAND_PSEUDO
53 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
54 # define EXIM_HAVE_SHA256
58 * X509_check_host provides sane certificate hostname checking, but was added
59 * to OpenSSL late, after other projects forked off the code-base. So in
60 * addition to guarding against the base version number, beware that LibreSSL
61 * does not (at this time) support this function.
63 * If LibreSSL gains a different API, perhaps via libtls, then we'll probably
64 * opt to disentangle and ask a LibreSSL user to provide glue for a third
65 * crypto provider for libtls instead of continuing to tie the OpenSSL glue
66 * into even twistier knots. If LibreSSL gains the same API, we can just
67 * change this guard and punt the issue for a while longer.
69 #ifndef LIBRESSL_VERSION_NUMBER
70 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
71 # define EXIM_HAVE_OPENSSL_CHECKHOST
73 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
74 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
75 # define EXIM_HAVE_OPENSSL_CHECKHOST
79 #if !defined(LIBRESSL_VERSION_NUMBER) \
80 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
81 # if !defined(OPENSSL_NO_ECDH)
82 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
83 # define EXIM_HAVE_ECDH
85 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
86 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
91 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
92 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
96 /* Structure for collecting random data for seeding. */
98 typedef struct randstuff {
103 /* Local static variables */
105 static BOOL client_verify_callback_called = FALSE;
106 static BOOL server_verify_callback_called = FALSE;
107 static const uschar *sid_ctx = US"exim";
109 /* We have three different contexts to care about.
111 Simple case: client, `client_ctx`
112 As a client, we can be doing a callout or cut-through delivery while receiving
113 a message. So we have a client context, which should have options initialised
114 from the SMTP Transport.
117 There are two cases: with and without ServerNameIndication from the client.
118 Given TLS SNI, we can be using different keys, certs and various other
119 configuration settings, because they're re-expanded with $tls_sni set. This
120 allows vhosting with TLS. This SNI is sent in the handshake.
121 A client might not send SNI, so we need a fallback, and an initial setup too.
122 So as a server, we start out using `server_ctx`.
123 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
124 `server_sni` from `server_ctx` and then initialise settings by re-expanding
128 static SSL_CTX *client_ctx = NULL;
129 static SSL_CTX *server_ctx = NULL;
130 static SSL *client_ssl = NULL;
131 static SSL *server_ssl = NULL;
133 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
134 static SSL_CTX *server_sni = NULL;
137 static char ssl_errstring[256];
139 static int ssl_session_timeout = 200;
140 static BOOL client_verify_optional = FALSE;
141 static BOOL server_verify_optional = FALSE;
143 static BOOL reexpand_tls_files_for_sni = FALSE;
146 typedef struct tls_ext_ctx_cb {
151 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
155 uschar *file_expanded;
156 OCSP_RESPONSE *response;
159 X509_STORE *verify_store; /* non-null if status requested */
160 BOOL verify_required;
165 /* these are cached from first expand */
166 uschar *server_cipher_list;
167 /* only passed down to tls_error: */
169 const uschar * verify_cert_hostnames;
170 #ifndef DISABLE_EVENT
171 uschar * event_action;
175 /* should figure out a cleanup of API to handle state preserved per
176 implementation, for various reasons, which can be void * in the APIs.
177 For now, we hack around it. */
178 tls_ext_ctx_cb *client_static_cbinfo = NULL;
179 tls_ext_ctx_cb *server_static_cbinfo = NULL;
182 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
183 int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
186 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
187 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
190 static int tls_server_stapling_cb(SSL *s, void *arg);
194 /*************************************************
196 *************************************************/
198 /* Called from lots of places when errors occur before actually starting to do
199 the TLS handshake, that is, while the session is still in clear. Always returns
200 DEFER for a server and FAIL for a client so that most calls can use "return
201 tls_error(...)" to do this processing and then give an appropriate return. A
202 single function is used for both server and client, because it is called from
203 some shared functions.
206 prefix text to include in the logged error
207 host NULL if setting up a server;
208 the connected host if setting up a client
209 msg error message or NULL if we should ask OpenSSL
211 Returns: OK/DEFER/FAIL
215 tls_error(uschar * prefix, const host_item * host, uschar * msg)
219 ERR_error_string(ERR_get_error(), ssl_errstring);
220 msg = (uschar *)ssl_errstring;
225 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s): %s",
226 host->name, host->address, prefix, msg);
231 uschar *conn_info = smtp_get_connection_info();
232 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
234 /* I'd like to get separated H= here, but too hard for now */
235 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
236 conn_info, prefix, msg);
243 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
244 /*************************************************
245 * Callback to generate RSA key *
246 *************************************************/
254 Returns: pointer to generated key
258 rsa_callback(SSL *s, int export, int keylength)
261 #ifdef EXIM_HAVE_RSA_GENKEY_EX
262 BIGNUM *bn = BN_new();
265 export = export; /* Shut picky compilers up */
266 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
268 #ifdef EXIM_HAVE_RSA_GENKEY_EX
269 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
270 || !(rsa_key = RSA_new())
271 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
274 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
278 ERR_error_string(ERR_get_error(), ssl_errstring);
279 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
292 x509_store_dump_cert_s_names(X509_STORE * store)
294 STACK_OF(X509_OBJECT) * roots= store->objs;
296 static uschar name[256];
298 for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
300 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
301 if(tmp_obj->type == X509_LU_X509)
303 X509 * current_cert= tmp_obj->data.x509;
304 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
305 name[sizeof(name)-1] = '\0';
306 debug_printf(" %s\n", name);
314 #ifndef DISABLE_EVENT
316 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
317 BOOL *calledp, const BOOL *optionalp, const uschar * what)
323 ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
326 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
327 old_cert = tlsp->peercert;
328 tlsp->peercert = X509_dup(cert);
329 /* NB we do not bother setting peerdn */
330 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
332 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
333 "depth=%d cert=%s: %s",
334 tlsp == &tls_out ? deliver_host_address : sender_host_address,
335 what, depth, dn, yield);
339 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
340 return 1; /* reject (leaving peercert set) */
342 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
343 "(host in tls_try_verify_hosts)\n");
345 X509_free(tlsp->peercert);
346 tlsp->peercert = old_cert;
352 /*************************************************
353 * Callback for verification *
354 *************************************************/
356 /* The SSL library does certificate verification if set up to do so. This
357 callback has the current yes/no state is in "state". If verification succeeded,
358 we set the certificate-verified flag. If verification failed, what happens
359 depends on whether the client is required to present a verifiable certificate
362 If verification is optional, we change the state to yes, but still log the
363 verification error. For some reason (it really would help to have proper
364 documentation of OpenSSL), this callback function then gets called again, this
365 time with state = 1. We must take care not to set the private verified flag on
366 the second time through.
368 Note: this function is not called if the client fails to present a certificate
369 when asked. We get here only if a certificate has been received. Handling of
370 optional verification for this case is done when requesting SSL to verify, by
371 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
373 May be called multiple times for different issues with a certificate, even
374 for a given "depth" in the certificate chain.
377 preverify_ok current yes/no state as 1/0
378 x509ctx certificate information.
379 tlsp per-direction (client vs. server) support data
380 calledp has-been-called flag
381 optionalp verification-is-optional flag
383 Returns: 0 if verification should fail, otherwise 1
387 verify_callback(int preverify_ok, X509_STORE_CTX *x509ctx,
388 tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
390 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
391 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
394 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
395 dn[sizeof(dn)-1] = '\0';
397 if (preverify_ok == 0)
399 log_write(0, LOG_MAIN, "[%s] SSL verify error: depth=%d error=%s cert=%s",
400 tlsp == &tls_out ? deliver_host_address : sender_host_address,
402 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
408 tlsp->peercert = X509_dup(cert); /* record failing cert */
409 return 0; /* reject */
411 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
412 "tls_try_verify_hosts)\n");
417 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
419 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
420 { /* client, wanting stapling */
421 /* Add the server cert's signing chain as the one
422 for the verification of the OCSP stapled information. */
424 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
427 sk_X509_push(client_static_cbinfo->verify_stack, cert);
430 #ifndef DISABLE_EVENT
431 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
432 return 0; /* reject, with peercert set */
437 const uschar * verify_cert_hostnames;
439 if ( tlsp == &tls_out
440 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
441 /* client, wanting hostname check */
444 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
445 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
446 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
448 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
449 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
452 const uschar * list = verify_cert_hostnames;
455 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
456 if ((rc = X509_check_host(cert, CCS name, 0,
457 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
458 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
463 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
464 deliver_host_address);
471 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
474 log_write(0, LOG_MAIN,
475 "[%s] SSL verify error: certificate name mismatch: "
476 "DN=\"%s\" H=\"%s\"",
477 deliver_host_address, dn, verify_cert_hostnames);
482 tlsp->peercert = X509_dup(cert); /* record failing cert */
483 return 0; /* reject */
485 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
486 "tls_try_verify_hosts)\n");
490 #ifndef DISABLE_EVENT
491 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
492 return 0; /* reject, with peercert set */
495 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
496 *calledp ? "" : " authenticated", dn);
497 if (!*calledp) tlsp->certificate_verified = TRUE;
501 return 1; /* accept, at least for this level */
505 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
507 return verify_callback(preverify_ok, x509ctx, &tls_out,
508 &client_verify_callback_called, &client_verify_optional);
512 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
514 return verify_callback(preverify_ok, x509ctx, &tls_in,
515 &server_verify_callback_called, &server_verify_optional);
519 #ifdef EXPERIMENTAL_DANE
521 /* This gets called *by* the dane library verify callback, which interposes
525 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
527 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
529 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
530 #ifndef DISABLE_EVENT
531 BOOL dummy_called, optional = FALSE;
534 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
535 dn[sizeof(dn)-1] = '\0';
537 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
538 preverify_ok ? "ok":"BAD", depth, dn);
540 #ifndef DISABLE_EVENT
541 if (verify_event(&tls_out, cert, depth, dn,
542 &dummy_called, &optional, US"DANE"))
543 return 0; /* reject, with peercert set */
546 if (preverify_ok == 1)
547 tls_out.dane_verified =
548 tls_out.certificate_verified = TRUE;
551 int err = X509_STORE_CTX_get_error(x509ctx);
553 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
554 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
560 #endif /*EXPERIMENTAL_DANE*/
563 /*************************************************
564 * Information callback *
565 *************************************************/
567 /* The SSL library functions call this from time to time to indicate what they
568 are doing. We copy the string to the debugging output when TLS debugging has
580 info_callback(SSL *s, int where, int ret)
584 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
589 /*************************************************
590 * Initialize for DH *
591 *************************************************/
593 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
596 sctx The current SSL CTX (inbound or outbound)
597 dhparam DH parameter file or fixed parameter identity string
598 host connected host, if client; NULL if server
600 Returns: TRUE if OK (nothing to set up, or setup worked)
604 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host)
611 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
614 if (!dhexpanded || !*dhexpanded)
615 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
616 else if (dhexpanded[0] == '/')
618 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
620 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
621 host, US strerror(errno));
627 if (Ustrcmp(dhexpanded, "none") == 0)
629 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
633 if (!(pem = std_dh_prime_named(dhexpanded)))
635 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
636 host, US strerror(errno));
639 bio = BIO_new_mem_buf(CS pem, -1);
642 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
645 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
650 /* Even if it is larger, we silently return success rather than cause things
651 * to fail out, so that a too-large DH will not knock out all TLS; it's a
652 * debatable choice. */
653 if ((8*DH_size(dh)) > tls_dh_max_bits)
656 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
657 8*DH_size(dh), tls_dh_max_bits);
661 SSL_CTX_set_tmp_dh(sctx, dh);
663 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
664 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
676 /*************************************************
677 * Initialize for ECDH *
678 *************************************************/
680 /* Load parameters for ECDH encryption.
682 For now, we stick to NIST P-256 because: it's simple and easy to configure;
683 it avoids any patent issues that might bite redistributors; despite events in
684 the news and concerns over curve choices, we're not cryptographers, we're not
685 pretending to be, and this is "good enough" to be better than no support,
686 protecting against most adversaries. Given another year or two, there might
687 be sufficient clarity about a "right" way forward to let us make an informed
688 decision, instead of a knee-jerk reaction.
690 Longer-term, we should look at supporting both various named curves and
691 external files generated with "openssl ecparam", much as we do for init_dh().
692 We should also support "none" as a value, to explicitly avoid initialisation.
697 sctx The current SSL CTX (inbound or outbound)
698 host connected host, if client; NULL if server
700 Returns: TRUE if OK (nothing to set up, or setup worked)
704 init_ecdh(SSL_CTX * sctx, host_item * host)
706 #ifdef OPENSSL_NO_ECDH
715 if (host) /* No ECDH setup for clients, only for servers */
718 # ifndef EXIM_HAVE_ECDH
720 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
724 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve))
726 if (!exp_curve || !*exp_curve)
729 /* "auto" needs to be handled carefully.
730 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
731 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
732 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
733 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
734 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
736 if (Ustrcmp(exp_curve, "auto") == 0)
738 #if OPENSSL_VERSION_NUMBER < 0x10002000L
739 DEBUG(D_tls) debug_printf(
740 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
741 exp_curve = "prime256v1";
743 # if defined SSL_CTRL_SET_ECDH_AUTO
744 DEBUG(D_tls) debug_printf(
745 "ECDH OpenSSL 1.0.2+ temp key parameter settings: autoselection\n");
746 SSL_CTX_set_ecdh_auto(sctx, 1);
749 DEBUG(D_tls) debug_printf(
750 "ECDH OpenSSL 1.1.0+ temp key parameter settings: default selection\n");
756 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
757 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
758 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
759 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
763 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'",
769 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
771 tls_error(US"Unable to create ec curve", host, NULL);
775 /* The "tmp" in the name here refers to setting a temporary key
776 not to the stability of the interface. */
778 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
779 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL);
781 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
786 # endif /*EXIM_HAVE_ECDH*/
787 #endif /*OPENSSL_NO_ECDH*/
794 /*************************************************
795 * Load OCSP information into state *
796 *************************************************/
797 /* Called to load the server OCSP response from the given file into memory, once
798 caller has determined this is needed. Checks validity. Debugs a message
801 ASSUMES: single response, for single cert.
804 sctx the SSL_CTX* to update
805 cbinfo various parts of session state
806 expanded the filename putatively holding an OCSP response
811 ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
814 OCSP_RESPONSE * resp;
815 OCSP_BASICRESP * basic_response;
816 OCSP_SINGLERESP * single_response;
817 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
819 unsigned long verify_flags;
820 int status, reason, i;
822 cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
823 if (cbinfo->u_ocsp.server.response)
825 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
826 cbinfo->u_ocsp.server.response = NULL;
829 if (!(bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb")))
831 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
832 cbinfo->u_ocsp.server.file_expanded);
836 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
840 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
844 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
846 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
847 OCSP_response_status_str(status), status);
851 if (!(basic_response = OCSP_response_get1_basic(resp)))
854 debug_printf("OCSP response parse error: unable to extract basic response.\n");
858 sk = cbinfo->verify_stack;
859 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
861 /* May need to expose ability to adjust those flags?
862 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
863 OCSP_TRUSTOTHER OCSP_NOINTERN */
865 /* This does a full verify on the OCSP proof before we load it for serving
866 up; possibly overkill - just date-checks might be nice enough.
868 OCSP_basic_verify takes a "store" arg, but does not
869 use it for the chain verification, which is all we do
870 when OCSP_NOVERIFY is set. The content from the wire
871 "basic_response" and a cert-stack "sk" are all that is used.
873 We have a stack, loaded in setup_certs() if tls_verify_certificates
874 was a file (not a directory, or "system"). It is unfortunate we
875 cannot used the connection context store, as that would neatly
876 handle the "system" case too, but there seems to be no library
877 function for getting a stack from a store.
878 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
879 We do not free the stack since it could be needed a second time for
882 Separately we might try to replace using OCSP_basic_verify() - which seems to not
883 be a public interface into the OpenSSL library (there's no manual entry) -
884 But what with? We also use OCSP_basic_verify in the client stapling callback.
885 And there we NEED it; we must verify that status... unless the
886 library does it for us anyway? */
888 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
892 ERR_error_string(ERR_get_error(), ssl_errstring);
893 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
898 /* Here's the simplifying assumption: there's only one response, for the
899 one certificate we use, and nothing for anything else in a chain. If this
900 proves false, we need to extract a cert id from our issued cert
901 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
902 right cert in the stack and then calls OCSP_single_get0_status()).
904 I'm hoping to avoid reworking a bunch more of how we handle state here. */
906 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
909 debug_printf("Unable to get first response from OCSP basic response.\n");
913 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
914 if (status != V_OCSP_CERTSTATUS_GOOD)
916 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
917 OCSP_cert_status_str(status), status,
918 OCSP_crl_reason_str(reason), reason);
922 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
924 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
929 cbinfo->u_ocsp.server.response = resp;
933 if (running_in_test_harness)
935 extern char ** environ;
937 if (environ) for (p = USS environ; *p != NULL; p++)
938 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
940 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
941 goto supply_response;
946 #endif /*!DISABLE_OCSP*/
951 /* Create and install a selfsigned certificate, for use in server mode */
954 tls_install_selfsign(SSL_CTX * sctx)
962 where = US"allocating pkey";
963 if (!(pkey = EVP_PKEY_new()))
966 where = US"allocating cert";
967 if (!(x509 = X509_new()))
970 where = US"generating pkey";
971 /* deprecated, use RSA_generate_key_ex() */
972 if (!(rsa = RSA_generate_key(1024, RSA_F4, NULL, NULL)))
975 where = US"assigning pkey";
976 if (!EVP_PKEY_assign_RSA(pkey, rsa))
979 X509_set_version(x509, 2); /* N+1 - version 3 */
980 ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
981 X509_gmtime_adj(X509_get_notBefore(x509), 0);
982 X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60); /* 1 hour */
983 X509_set_pubkey(x509, pkey);
985 name = X509_get_subject_name(x509);
986 X509_NAME_add_entry_by_txt(name, "C",
987 MBSTRING_ASC, CUS "UK", -1, -1, 0);
988 X509_NAME_add_entry_by_txt(name, "O",
989 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
990 X509_NAME_add_entry_by_txt(name, "CN",
991 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
992 X509_set_issuer_name(x509, name);
994 where = US"signing cert";
995 if (!X509_sign(x509, pkey, EVP_md5()))
998 where = US"installing selfsign cert";
999 if (!SSL_CTX_use_certificate(sctx, x509))
1002 where = US"installing selfsign key";
1003 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
1009 (void) tls_error(where, NULL, NULL);
1010 if (x509) X509_free(x509);
1011 if (pkey) EVP_PKEY_free(pkey);
1018 /*************************************************
1019 * Expand key and cert file specs *
1020 *************************************************/
1022 /* Called once during tls_init and possibly again during TLS setup, for a
1023 new context, if Server Name Indication was used and tls_sni was seen in
1024 the certificate string.
1027 sctx the SSL_CTX* to update
1028 cbinfo various parts of session state
1030 Returns: OK/DEFER/FAIL
1034 tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
1038 if (!cbinfo->certificate)
1040 if (cbinfo->host) /* client */
1043 if (tls_install_selfsign(sctx) != OK)
1048 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
1049 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
1050 Ustrstr(cbinfo->certificate, US"tls_out_sni")
1052 reexpand_tls_files_for_sni = TRUE;
1054 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
1057 if (expanded != NULL)
1059 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
1060 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
1061 return tls_error(string_sprintf(
1062 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
1063 cbinfo->host, NULL);
1066 if (cbinfo->privatekey != NULL &&
1067 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
1070 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1071 of the expansion is an empty string, ignore it also, and assume the private
1072 key is in the same file as the certificate. */
1074 if (expanded && *expanded)
1076 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
1077 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
1078 return tls_error(string_sprintf(
1079 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
1083 #ifndef DISABLE_OCSP
1084 if (cbinfo->is_server && cbinfo->u_ocsp.server.file)
1086 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
1089 if (expanded && *expanded)
1091 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
1092 if ( cbinfo->u_ocsp.server.file_expanded
1093 && (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
1095 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1098 ocsp_load_response(sctx, cbinfo, expanded);
1109 /*************************************************
1110 * Callback to handle SNI *
1111 *************************************************/
1113 /* Called when acting as server during the TLS session setup if a Server Name
1114 Indication extension was sent by the client.
1116 API documentation is OpenSSL s_server.c implementation.
1119 s SSL* of the current session
1120 ad unknown (part of OpenSSL API) (unused)
1121 arg Callback of "our" registered data
1123 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
1126 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1128 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
1130 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
1131 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1133 int old_pool = store_pool;
1136 return SSL_TLSEXT_ERR_OK;
1138 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
1139 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
1141 /* Make the extension value available for expansion */
1142 store_pool = POOL_PERM;
1143 tls_in.sni = string_copy(US servername);
1144 store_pool = old_pool;
1146 if (!reexpand_tls_files_for_sni)
1147 return SSL_TLSEXT_ERR_OK;
1149 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1150 not confident that memcpy wouldn't break some internal reference counting.
1151 Especially since there's a references struct member, which would be off. */
1153 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
1155 ERR_error_string(ERR_get_error(), ssl_errstring);
1156 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
1157 return SSL_TLSEXT_ERR_NOACK;
1160 /* Not sure how many of these are actually needed, since SSL object
1161 already exists. Might even need this selfsame callback, for reneg? */
1163 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1164 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1165 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1166 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1167 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1168 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
1170 if ( !init_dh(server_sni, cbinfo->dhparam, NULL)
1171 || !init_ecdh(server_sni, NULL)
1173 return SSL_TLSEXT_ERR_NOACK;
1175 if (cbinfo->server_cipher_list)
1176 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
1177 #ifndef DISABLE_OCSP
1178 if (cbinfo->u_ocsp.server.file)
1180 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
1181 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
1185 if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
1186 verify_callback_server)) != OK)
1187 return SSL_TLSEXT_ERR_NOACK;
1189 /* do this after setup_certs, because this can require the certs for verifying
1190 OCSP information. */
1191 if ((rc = tls_expand_session_files(server_sni, cbinfo)) != OK)
1192 return SSL_TLSEXT_ERR_NOACK;
1194 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
1195 SSL_set_SSL_CTX(s, server_sni);
1197 return SSL_TLSEXT_ERR_OK;
1199 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
1204 #ifndef DISABLE_OCSP
1206 /*************************************************
1207 * Callback to handle OCSP Stapling *
1208 *************************************************/
1210 /* Called when acting as server during the TLS session setup if the client
1211 requests OCSP information with a Certificate Status Request.
1213 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1219 tls_server_stapling_cb(SSL *s, void *arg)
1221 const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1222 uschar *response_der;
1223 int response_der_len;
1226 debug_printf("Received TLS status request (OCSP stapling); %s response\n",
1227 cbinfo->u_ocsp.server.response ? "have" : "lack");
1229 tls_in.ocsp = OCSP_NOT_RESP;
1230 if (!cbinfo->u_ocsp.server.response)
1231 return SSL_TLSEXT_ERR_NOACK;
1233 response_der = NULL;
1234 response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
1236 if (response_der_len <= 0)
1237 return SSL_TLSEXT_ERR_NOACK;
1239 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
1240 tls_in.ocsp = OCSP_VFIED;
1241 return SSL_TLSEXT_ERR_OK;
1246 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1248 BIO_printf(bp, "\t%s: ", str);
1249 ASN1_GENERALIZEDTIME_print(bp, time);
1254 tls_client_stapling_cb(SSL *s, void *arg)
1256 tls_ext_ctx_cb * cbinfo = arg;
1257 const unsigned char * p;
1259 OCSP_RESPONSE * rsp;
1260 OCSP_BASICRESP * bs;
1263 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
1264 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1267 /* Expect this when we requested ocsp but got none */
1268 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
1269 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
1271 DEBUG(D_tls) debug_printf(" null\n");
1272 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1275 if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1277 tls_out.ocsp = OCSP_FAILED;
1278 if (LOGGING(tls_cipher))
1279 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
1281 DEBUG(D_tls) debug_printf(" parse error\n");
1285 if(!(bs = OCSP_response_get1_basic(rsp)))
1287 tls_out.ocsp = OCSP_FAILED;
1288 if (LOGGING(tls_cipher))
1289 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
1291 DEBUG(D_tls) debug_printf(" error parsing response\n");
1292 OCSP_RESPONSE_free(rsp);
1296 /* We'd check the nonce here if we'd put one in the request. */
1297 /* However that would defeat cacheability on the server so we don't. */
1299 /* This section of code reworked from OpenSSL apps source;
1300 The OpenSSL Project retains copyright:
1301 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1306 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1308 DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1310 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1312 /* Use the chain that verified the server cert to verify the stapled info */
1313 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1315 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
1316 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
1318 tls_out.ocsp = OCSP_FAILED;
1319 if (LOGGING(tls_cipher))
1320 log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
1321 BIO_printf(bp, "OCSP response verify failure\n");
1322 ERR_print_errors(bp);
1326 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1328 /*XXX So we have a good stapled OCSP status. How do we know
1329 it is for the cert of interest? OpenSSL 1.1.0 has a routine
1330 OCSP_resp_find_status() which matches on a cert id, which presumably
1331 we should use. Making an id needs OCSP_cert_id_new(), which takes
1332 issuerName, issuerKey, serialNumber. Are they all in the cert?
1334 For now, carry on blindly accepting the resp. */
1337 OCSP_SINGLERESP * single;
1339 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
1340 if (OCSP_resp_count(bs) != 1)
1342 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1343 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1346 tls_out.ocsp = OCSP_FAILED;
1347 log_write(0, LOG_MAIN, "OCSP stapling "
1348 "with multiple responses not handled");
1351 single = OCSP_resp_get0(bs, 0);
1352 status = OCSP_single_get0_status(single, &reason, &rev,
1353 &thisupd, &nextupd);
1356 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1357 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1358 if (!OCSP_check_validity(thisupd, nextupd,
1359 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1361 tls_out.ocsp = OCSP_FAILED;
1362 DEBUG(D_tls) ERR_print_errors(bp);
1363 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1367 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1368 OCSP_cert_status_str(status));
1371 case V_OCSP_CERTSTATUS_GOOD:
1372 tls_out.ocsp = OCSP_VFIED;
1375 case V_OCSP_CERTSTATUS_REVOKED:
1376 tls_out.ocsp = OCSP_FAILED;
1377 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1378 reason != -1 ? "; reason: " : "",
1379 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1380 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1383 tls_out.ocsp = OCSP_FAILED;
1384 log_write(0, LOG_MAIN,
1385 "Server certificate status unknown, in OCSP stapling");
1390 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1395 OCSP_RESPONSE_free(rsp);
1398 #endif /*!DISABLE_OCSP*/
1401 /*************************************************
1402 * Initialize for TLS *
1403 *************************************************/
1405 /* Called from both server and client code, to do preliminary initialization
1406 of the library. We allocate and return a context structure.
1409 ctxp returned SSL context
1410 host connected host, if client; NULL if server
1411 dhparam DH parameter file
1412 certificate certificate file
1413 privatekey private key
1414 ocsp_file file of stapling info (server); flag for require ocsp (client)
1415 addr address if client; NULL if server (for some randomness)
1416 cbp place to put allocated callback context
1418 Returns: OK/DEFER/FAIL
1422 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
1424 #ifndef DISABLE_OCSP
1427 address_item *addr, tls_ext_ctx_cb ** cbp)
1432 tls_ext_ctx_cb * cbinfo;
1434 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1435 cbinfo->certificate = certificate;
1436 cbinfo->privatekey = privatekey;
1437 #ifndef DISABLE_OCSP
1438 cbinfo->verify_stack = NULL;
1439 if ((cbinfo->is_server = host==NULL))
1441 cbinfo->u_ocsp.server.file = ocsp_file;
1442 cbinfo->u_ocsp.server.file_expanded = NULL;
1443 cbinfo->u_ocsp.server.response = NULL;
1446 cbinfo->u_ocsp.client.verify_store = NULL;
1448 cbinfo->dhparam = dhparam;
1449 cbinfo->server_cipher_list = NULL;
1450 cbinfo->host = host;
1451 #ifndef DISABLE_EVENT
1452 cbinfo->event_action = NULL;
1455 SSL_load_error_strings(); /* basic set up */
1456 OpenSSL_add_ssl_algorithms();
1458 #ifdef EXIM_HAVE_SHA256
1459 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1460 list of available digests. */
1461 EVP_add_digest(EVP_sha256());
1464 /* Create a context.
1465 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1466 negotiation in the different methods; as far as I can tell, the only
1467 *_{server,client}_method which allows negotiation is SSLv23, which exists even
1468 when OpenSSL is built without SSLv2 support.
1469 By disabling with openssl_options, we can let admins re-enable with the
1472 *ctxp = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method());
1474 if (!*ctxp) return tls_error(US"SSL_CTX_new", host, NULL);
1476 /* It turns out that we need to seed the random number generator this early in
1477 order to get the full complement of ciphers to work. It took me roughly a day
1478 of work to discover this by experiment.
1480 On systems that have /dev/urandom, SSL may automatically seed itself from
1481 there. Otherwise, we have to make something up as best we can. Double check
1487 gettimeofday(&r.tv, NULL);
1490 RAND_seed((uschar *)(&r), sizeof(r));
1491 RAND_seed((uschar *)big_buffer, big_buffer_size);
1492 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1495 return tls_error(US"RAND_status", host,
1496 US"unable to seed random number generator");
1499 /* Set up the information callback, which outputs if debugging is at a suitable
1502 DEBUG(D_tls) SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1504 /* Automatically re-try reads/writes after renegotiation. */
1505 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1507 /* Apply administrator-supplied work-arounds.
1508 Historically we applied just one requested option,
1509 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1510 moved to an administrator-controlled list of options to specify and
1511 grandfathered in the first one as the default value for "openssl_options".
1513 No OpenSSL version number checks: the options we accept depend upon the
1514 availability of the option value macros from OpenSSL. */
1516 if (!tls_openssl_options_parse(openssl_options, &init_options))
1517 return tls_error(US"openssl_options parsing failed", host, NULL);
1521 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
1522 if (!(SSL_CTX_set_options(ctx, init_options)))
1523 return tls_error(string_sprintf(
1524 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1527 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
1529 /* Disable session cache unconditionally */
1531 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
1533 /* Initialize with DH parameters if supplied */
1534 /* Initialize ECDH temp key parameter selection */
1536 if ( !init_dh(*ctxp, dhparam, host)
1537 || !init_ecdh(*ctxp, host)
1541 /* Set up certificate and key (and perhaps OCSP info) */
1543 if ((rc = tls_expand_session_files(*ctxp, cbinfo)) != OK)
1546 /* If we need to handle SNI or OCSP, do so */
1548 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1549 # ifndef DISABLE_OCSP
1550 if (!(cbinfo->verify_stack = sk_X509_new_null()))
1552 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
1557 if (host == NULL) /* server */
1559 # ifndef DISABLE_OCSP
1560 /* We check u_ocsp.server.file, not server.response, because we care about if
1561 the option exists, not what the current expansion might be, as SNI might
1562 change the certificate and OCSP file in use between now and the time the
1563 callback is invoked. */
1564 if (cbinfo->u_ocsp.server.file)
1566 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
1567 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
1570 /* We always do this, so that $tls_sni is available even if not used in
1572 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
1573 SSL_CTX_set_tlsext_servername_arg(ctx, cbinfo);
1575 # ifndef DISABLE_OCSP
1577 if(ocsp_file) /* wanting stapling */
1579 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1581 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1584 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
1585 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
1590 cbinfo->verify_cert_hostnames = NULL;
1592 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
1593 /* Set up the RSA callback */
1594 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
1597 /* Finally, set the timeout, and we are done */
1599 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
1600 DEBUG(D_tls) debug_printf("Initialized TLS\n");
1611 /*************************************************
1612 * Get name of cipher in use *
1613 *************************************************/
1616 Argument: pointer to an SSL structure for the connection
1617 buffer to use for answer
1619 pointer to number of bits for cipher
1624 construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
1626 /* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1627 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1628 the accessor functions use const in the prototype. */
1629 const SSL_CIPHER *c;
1632 ver = (const uschar *)SSL_get_version(ssl);
1634 c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
1635 SSL_CIPHER_get_bits(c, bits);
1637 string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1638 SSL_CIPHER_get_name(c), *bits);
1640 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1645 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned bsize)
1647 /*XXX we might consider a list-of-certs variable for the cert chain.
1648 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
1649 in list-handling functions, also consider the difference between the entire
1650 chain and the elements sent by the peer. */
1652 /* Will have already noted peercert on a verify fail; possibly not the leaf */
1653 if (!tlsp->peercert)
1654 tlsp->peercert = SSL_get_peer_certificate(ssl);
1655 /* Beware anonymous ciphers which lead to server_cert being NULL */
1658 X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, bsize);
1659 peerdn[bsize-1] = '\0';
1660 tlsp->peerdn = peerdn; /*XXX a static buffer... */
1663 tlsp->peerdn = NULL;
1670 /*************************************************
1671 * Set up for verifying certificates *
1672 *************************************************/
1674 /* Load certs from file, return TRUE on success */
1677 chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
1682 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
1683 while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
1684 sk_X509_push(verify_stack, x);
1691 /* Called by both client and server startup
1694 sctx SSL_CTX* to initialise
1695 certs certs file or NULL
1696 crl CRL file or NULL
1697 host NULL in a server; the remote host in a client
1698 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1699 otherwise passed as FALSE
1700 cert_vfy_cb Callback function for certificate verification
1702 Returns: OK/DEFER/FAIL
1706 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1707 int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
1709 uschar *expcerts, *expcrl;
1711 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1714 if (expcerts && *expcerts)
1716 /* Tell the library to use its compiled-in location for the system default
1717 CA bundle. Then add the ones specified in the config, if any. */
1719 if (!SSL_CTX_set_default_verify_paths(sctx))
1720 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1722 if (Ustrcmp(expcerts, "system") != 0)
1724 struct stat statbuf;
1726 if (Ustat(expcerts, &statbuf) < 0)
1728 log_write(0, LOG_MAIN|LOG_PANIC,
1729 "failed to stat %s for certificates", expcerts);
1735 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1736 { file = NULL; dir = expcerts; }
1739 file = expcerts; dir = NULL;
1740 #ifndef DISABLE_OCSP
1741 /* In the server if we will be offering an OCSP proof, load chain from
1742 file for verifying the OCSP proof at load time. */
1745 && statbuf.st_size > 0
1746 && server_static_cbinfo->u_ocsp.server.file
1747 && !chain_from_pem_file(file, server_static_cbinfo->verify_stack)
1750 log_write(0, LOG_MAIN|LOG_PANIC,
1751 "failed to load cert hain from %s", file);
1757 /* If a certificate file is empty, the next function fails with an
1758 unhelpful error message. If we skip it, we get the correct behaviour (no
1759 certificates are recognized, but the error message is still misleading (it
1760 says no certificate was supplied). But this is better. */
1762 if ( (!file || statbuf.st_size > 0)
1763 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1764 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1766 /* Load the list of CAs for which we will accept certs, for sending
1767 to the client. This is only for the one-file tls_verify_certificates
1769 If a list isn't loaded into the server, but
1770 some verify locations are set, the server end appears to make
1771 a wildcard request for client certs.
1772 Meanwhile, the client library as default behaviour *ignores* the list
1773 we send over the wire - see man SSL_CTX_set_client_cert_cb.
1774 Because of this, and that the dir variant is likely only used for
1775 the public-CA bundle (not for a private CA), not worth fixing.
1779 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
1781 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
1782 sk_X509_NAME_num(names));
1783 SSL_CTX_set_client_CA_list(sctx, names);
1788 /* Handle a certificate revocation list. */
1790 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1792 /* This bit of code is now the version supplied by Lars Mainka. (I have
1793 merely reformatted it into the Exim code style.)
1795 "From here I changed the code to add support for multiple crl's
1796 in pem format in one file or to support hashed directory entries in
1797 pem format instead of a file. This method now uses the library function
1798 X509_STORE_load_locations to add the CRL location to the SSL context.
1799 OpenSSL will then handle the verify against CA certs and CRLs by
1800 itself in the verify callback." */
1802 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1803 if (expcrl && *expcrl)
1805 struct stat statbufcrl;
1806 if (Ustat(expcrl, &statbufcrl) < 0)
1808 log_write(0, LOG_MAIN|LOG_PANIC,
1809 "failed to stat %s for certificates revocation lists", expcrl);
1814 /* is it a file or directory? */
1816 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
1817 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
1821 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
1827 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
1829 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
1830 return tls_error(US"X509_STORE_load_locations", host, NULL);
1832 /* setting the flags to check against the complete crl chain */
1834 X509_STORE_set_flags(cvstore,
1835 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
1839 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1841 /* If verification is optional, don't fail if no certificate */
1843 SSL_CTX_set_verify(sctx,
1844 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
1853 /*************************************************
1854 * Start a TLS session in a server *
1855 *************************************************/
1857 /* This is called when Exim is running as a server, after having received
1858 the STARTTLS command. It must respond to that command, and then negotiate
1862 require_ciphers allowed ciphers
1864 Returns: OK on success
1865 DEFER for errors before the start of the negotiation
1866 FAIL for errors during the negotiation; the server can't
1871 tls_server_start(const uschar *require_ciphers)
1875 tls_ext_ctx_cb *cbinfo;
1876 static uschar peerdn[256];
1877 static uschar cipherbuf[256];
1879 /* Check for previous activation */
1881 if (tls_in.active >= 0)
1883 tls_error(US"STARTTLS received after TLS started", NULL, US"");
1884 smtp_printf("554 Already in TLS\r\n");
1888 /* Initialize the SSL library. If it fails, it will already have logged
1891 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
1892 #ifndef DISABLE_OCSP
1895 NULL, &server_static_cbinfo);
1896 if (rc != OK) return rc;
1897 cbinfo = server_static_cbinfo;
1899 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1902 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1903 were historically separated by underscores. So that I can use either form in my
1904 tests, and also for general convenience, we turn underscores into hyphens here.
1909 uschar * s = expciphers;
1910 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1911 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1912 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
1913 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
1914 cbinfo->server_cipher_list = expciphers;
1917 /* If this is a host for which certificate verification is mandatory or
1918 optional, set up appropriately. */
1920 tls_in.certificate_verified = FALSE;
1921 #ifdef EXPERIMENTAL_DANE
1922 tls_in.dane_verified = FALSE;
1924 server_verify_callback_called = FALSE;
1926 if (verify_check_host(&tls_verify_hosts) == OK)
1928 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1929 FALSE, verify_callback_server);
1930 if (rc != OK) return rc;
1931 server_verify_optional = FALSE;
1933 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1935 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1936 TRUE, verify_callback_server);
1937 if (rc != OK) return rc;
1938 server_verify_optional = TRUE;
1941 /* Prepare for new connection */
1943 if (!(server_ssl = SSL_new(server_ctx))) return tls_error(US"SSL_new", NULL, NULL);
1945 /* Warning: we used to SSL_clear(ssl) here, it was removed.
1947 * With the SSL_clear(), we get strange interoperability bugs with
1948 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1949 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1951 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1952 * session shutdown. In this case, we have a brand new object and there's no
1953 * obvious reason to immediately clear it. I'm guessing that this was
1954 * originally added because of incomplete initialisation which the clear fixed,
1955 * in some historic release.
1958 /* Set context and tell client to go ahead, except in the case of TLS startup
1959 on connection, where outputting anything now upsets the clients and tends to
1960 make them disconnect. We need to have an explicit fflush() here, to force out
1961 the response. Other smtp_printf() calls do not need it, because in non-TLS
1962 mode, the fflush() happens when smtp_getc() is called. */
1964 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1965 if (!tls_in.on_connect)
1967 smtp_printf("220 TLS go ahead\r\n");
1971 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1972 that the OpenSSL library doesn't. */
1974 SSL_set_wfd(server_ssl, fileno(smtp_out));
1975 SSL_set_rfd(server_ssl, fileno(smtp_in));
1976 SSL_set_accept_state(server_ssl);
1978 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1980 sigalrm_seen = FALSE;
1981 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1982 rc = SSL_accept(server_ssl);
1987 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
1988 if (ERR_get_error() == 0)
1989 log_write(0, LOG_MAIN,
1990 "TLS client disconnected cleanly (rejected our certificate?)");
1994 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1996 /* TLS has been set up. Adjust the input functions to read via TLS,
1997 and initialize things. */
1999 peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
2001 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
2002 tls_in.cipher = cipherbuf;
2007 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
2008 debug_printf("Shared ciphers: %s\n", buf);
2011 /* Record the certificate we presented */
2013 X509 * crt = SSL_get_certificate(server_ssl);
2014 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
2017 /* Only used by the server-side tls (tls_in), including tls_getc.
2018 Client-side (tls_out) reads (seem to?) go via
2019 smtp_read_response()/ip_recv().
2020 Hence no need to duplicate for _in and _out.
2022 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2023 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
2024 ssl_xfer_eof = ssl_xfer_error = 0;
2026 receive_getc = tls_getc;
2027 receive_get_cache = tls_get_cache;
2028 receive_ungetc = tls_ungetc;
2029 receive_feof = tls_feof;
2030 receive_ferror = tls_ferror;
2031 receive_smtp_buffered = tls_smtp_buffered;
2033 tls_in.active = fileno(smtp_out);
2041 tls_client_basic_ctx_init(SSL_CTX * ctx,
2042 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo
2046 /* stick to the old behaviour for compatibility if tls_verify_certificates is
2047 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2048 the specified host patterns if one of them is defined */
2050 if ( ( !ob->tls_verify_hosts
2051 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2053 || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
2055 client_verify_optional = FALSE;
2056 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
2057 client_verify_optional = TRUE;
2061 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
2062 ob->tls_crl, host, client_verify_optional, verify_callback_client)) != OK)
2065 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
2067 cbinfo->verify_cert_hostnames =
2069 string_domain_utf8_to_alabel(host->name, NULL);
2073 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
2074 cbinfo->verify_cert_hostnames);
2080 #ifdef EXPERIMENTAL_DANE
2082 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
2086 const char * hostnames[2] = { CS host->name, NULL };
2089 if (DANESSL_init(ssl, NULL, hostnames) != 1)
2090 return tls_error(US"hostnames load", host, NULL);
2092 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
2094 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2095 ) if (rr->type == T_TLSA)
2097 const uschar * p = rr->data;
2098 uint8_t usage, selector, mtype;
2099 const char * mdname;
2103 /* Only DANE-TA(2) and DANE-EE(3) are supported */
2104 if (usage != 2 && usage != 3) continue;
2111 default: continue; /* Only match-types 0, 1, 2 are supported */
2112 case 0: mdname = NULL; break;
2113 case 1: mdname = "sha256"; break;
2114 case 2: mdname = "sha512"; break;
2118 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
2121 return tls_error(US"tlsa load", host, NULL);
2122 case 0: /* action not taken */
2126 tls_out.tlsa_usage |= 1<<usage;
2132 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
2135 #endif /*EXPERIMENTAL_DANE*/
2139 /*************************************************
2140 * Start a TLS session in a client *
2141 *************************************************/
2143 /* Called from the smtp transport after STARTTLS has been accepted.
2146 fd the fd of the connection
2147 host connected host (for messages)
2148 addr the first address
2149 tb transport (always smtp)
2150 tlsa_dnsa tlsa lookup, if DANE, else null
2152 Returns: OK on success
2153 FAIL otherwise - note that tls_error() will not give DEFER
2154 because this is not a server
2158 tls_client_start(int fd, host_item *host, address_item *addr,
2159 transport_instance *tb
2160 #ifdef EXPERIMENTAL_DANE
2161 , dns_answer * tlsa_dnsa
2165 smtp_transport_options_block * ob =
2166 (smtp_transport_options_block *)tb->options_block;
2167 static uschar peerdn[256];
2168 uschar * expciphers;
2170 static uschar cipherbuf[256];
2172 #ifndef DISABLE_OCSP
2173 BOOL request_ocsp = FALSE;
2174 BOOL require_ocsp = FALSE;
2177 #ifdef EXPERIMENTAL_DANE
2178 tls_out.tlsa_usage = 0;
2181 #ifndef DISABLE_OCSP
2183 # ifdef EXPERIMENTAL_DANE
2185 && ob->hosts_request_ocsp[0] == '*'
2186 && ob->hosts_request_ocsp[1] == '\0'
2189 /* Unchanged from default. Use a safer one under DANE */
2190 request_ocsp = TRUE;
2191 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
2192 " {= {4}{$tls_out_tlsa_usage}} } "
2198 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK))
2199 request_ocsp = TRUE;
2201 # ifdef EXPERIMENTAL_DANE
2205 verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2209 rc = tls_init(&client_ctx, host, NULL,
2210 ob->tls_certificate, ob->tls_privatekey,
2211 #ifndef DISABLE_OCSP
2212 (void *)(long)request_ocsp,
2214 addr, &client_static_cbinfo);
2215 if (rc != OK) return rc;
2217 tls_out.certificate_verified = FALSE;
2218 client_verify_callback_called = FALSE;
2220 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
2224 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
2225 are separated by underscores. So that I can use either form in my tests, and
2226 also for general convenience, we turn underscores into hyphens here. */
2228 if (expciphers != NULL)
2230 uschar *s = expciphers;
2231 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2232 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
2233 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
2234 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
2237 #ifdef EXPERIMENTAL_DANE
2240 SSL_CTX_set_verify(client_ctx,
2241 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
2242 verify_callback_client_dane);
2244 if (!DANESSL_library_init())
2245 return tls_error(US"library init", host, NULL);
2246 if (DANESSL_CTX_init(client_ctx) <= 0)
2247 return tls_error(US"context init", host, NULL);
2253 if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob, client_static_cbinfo))
2257 if ((client_ssl = SSL_new(client_ctx)) == NULL)
2258 return tls_error(US"SSL_new", host, NULL);
2259 SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
2260 SSL_set_fd(client_ssl, fd);
2261 SSL_set_connect_state(client_ssl);
2265 if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
2267 if (tls_out.sni == NULL)
2269 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
2271 else if (!Ustrlen(tls_out.sni))
2275 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2276 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
2277 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
2279 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
2285 #ifdef EXPERIMENTAL_DANE
2287 if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa)) != OK)
2291 #ifndef DISABLE_OCSP
2292 /* Request certificate status at connection-time. If the server
2293 does OCSP stapling we will get the callback (set in tls_init()) */
2294 # ifdef EXPERIMENTAL_DANE
2298 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2299 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2301 { /* Re-eval now $tls_out_tlsa_usage is populated. If
2302 this means we avoid the OCSP request, we wasted the setup
2303 cost in tls_init(). */
2304 require_ocsp = verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
2305 request_ocsp = require_ocsp
2306 || verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2313 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
2314 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
2315 tls_out.ocsp = OCSP_NOT_RESP;
2319 #ifndef DISABLE_EVENT
2320 client_static_cbinfo->event_action = tb->event_action;
2323 /* There doesn't seem to be a built-in timeout on connection. */
2325 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
2326 sigalrm_seen = FALSE;
2327 alarm(ob->command_timeout);
2328 rc = SSL_connect(client_ssl);
2331 #ifdef EXPERIMENTAL_DANE
2333 DANESSL_cleanup(client_ssl);
2337 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
2339 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
2341 peer_cert(client_ssl, &tls_out, peerdn, sizeof(peerdn));
2343 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
2344 tls_out.cipher = cipherbuf;
2346 /* Record the certificate we presented */
2348 X509 * crt = SSL_get_certificate(client_ssl);
2349 tls_out.ourcert = crt ? X509_dup(crt) : NULL;
2352 tls_out.active = fd;
2360 /*************************************************
2361 * TLS version of getc *
2362 *************************************************/
2364 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2365 it refills the buffer via the SSL reading function.
2367 Arguments: lim Maximum amount to read/buffer
2368 Returns: the next character or EOF
2370 Only used by the server-side TLS.
2374 tls_getc(unsigned lim)
2376 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2381 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
2382 ssl_xfer_buffer, ssl_xfer_buffer_size);
2384 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2385 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer,
2386 MIN(ssl_xfer_buffer_size, lim));
2387 error = SSL_get_error(server_ssl, inbytes);
2390 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2391 closed down, not that the socket itself has been closed down. Revert to
2392 non-SSL handling. */
2394 if (error == SSL_ERROR_ZERO_RETURN)
2396 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2398 receive_getc = smtp_getc;
2399 receive_get_cache = smtp_get_cache;
2400 receive_ungetc = smtp_ungetc;
2401 receive_feof = smtp_feof;
2402 receive_ferror = smtp_ferror;
2403 receive_smtp_buffered = smtp_buffered;
2405 SSL_free(server_ssl);
2409 tls_in.cipher = NULL;
2410 tls_in.peerdn = NULL;
2413 return smtp_getc(lim);
2416 /* Handle genuine errors */
2418 else if (error == SSL_ERROR_SSL)
2420 ERR_error_string(ERR_get_error(), ssl_errstring);
2421 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
2426 else if (error != SSL_ERROR_NONE)
2428 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2433 #ifndef DISABLE_DKIM
2434 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2436 ssl_xfer_buffer_hwm = inbytes;
2437 ssl_xfer_buffer_lwm = 0;
2440 /* Something in the buffer; return next uschar */
2442 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2448 #ifndef DISABLE_DKIM
2449 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
2451 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
2457 /*************************************************
2458 * Read bytes from TLS channel *
2459 *************************************************/
2466 Returns: the number of bytes read
2467 -1 after a failed read
2469 Only used by the client-side TLS.
2473 tls_read(BOOL is_server, uschar *buff, size_t len)
2475 SSL *ssl = is_server ? server_ssl : client_ssl;
2479 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
2480 buff, (unsigned int)len);
2482 inbytes = SSL_read(ssl, CS buff, len);
2483 error = SSL_get_error(ssl, inbytes);
2485 if (error == SSL_ERROR_ZERO_RETURN)
2487 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2490 else if (error != SSL_ERROR_NONE)
2502 /*************************************************
2503 * Write bytes down TLS channel *
2504 *************************************************/
2508 is_server channel specifier
2512 Returns: the number of bytes after a successful write,
2513 -1 after a failed write
2515 Used by both server-side and client-side TLS.
2519 tls_write(BOOL is_server, const uschar *buff, size_t len)
2524 SSL *ssl = is_server ? server_ssl : client_ssl;
2526 DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
2529 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
2530 outbytes = SSL_write(ssl, CS buff, left);
2531 error = SSL_get_error(ssl, outbytes);
2532 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2536 ERR_error_string(ERR_get_error(), ssl_errstring);
2537 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2540 case SSL_ERROR_NONE:
2545 case SSL_ERROR_ZERO_RETURN:
2546 log_write(0, LOG_MAIN, "SSL channel closed on write");
2549 case SSL_ERROR_SYSCALL:
2550 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2551 sender_fullhost ? sender_fullhost : US"<unknown>",
2556 log_write(0, LOG_MAIN, "SSL_write error %d", error);
2565 /*************************************************
2566 * Close down a TLS session *
2567 *************************************************/
2569 /* This is also called from within a delivery subprocess forked from the
2570 daemon, to shut down the TLS library, without actually doing a shutdown (which
2571 would tamper with the SSL session in the parent process).
2573 Arguments: TRUE if SSL_shutdown is to be called
2576 Used by both server-side and client-side TLS.
2580 tls_close(BOOL is_server, BOOL shutdown)
2582 SSL **sslp = is_server ? &server_ssl : &client_ssl;
2583 int *fdp = is_server ? &tls_in.active : &tls_out.active;
2585 if (*fdp < 0) return; /* TLS was not active */
2589 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
2590 SSL_shutdown(*sslp);
2602 /*************************************************
2603 * Let tls_require_ciphers be checked at startup *
2604 *************************************************/
2606 /* The tls_require_ciphers option, if set, must be something which the
2609 Returns: NULL on success, or error message
2613 tls_validate_require_cipher(void)
2616 uschar *s, *expciphers, *err;
2618 /* this duplicates from tls_init(), we need a better "init just global
2619 state, for no specific purpose" singleton function of our own */
2621 SSL_load_error_strings();
2622 OpenSSL_add_ssl_algorithms();
2623 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2624 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2625 list of available digests. */
2626 EVP_add_digest(EVP_sha256());
2629 if (!(tls_require_ciphers && *tls_require_ciphers))
2632 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2633 return US"failed to expand tls_require_ciphers";
2635 if (!(expciphers && *expciphers))
2638 /* normalisation ripped from above */
2640 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2644 ctx = SSL_CTX_new(SSLv23_server_method());
2647 ERR_error_string(ERR_get_error(), ssl_errstring);
2648 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2652 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2654 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2656 ERR_error_string(ERR_get_error(), ssl_errstring);
2657 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2668 /*************************************************
2669 * Report the library versions. *
2670 *************************************************/
2672 /* There have historically been some issues with binary compatibility in
2673 OpenSSL libraries; if Exim (like many other applications) is built against
2674 one version of OpenSSL but the run-time linker picks up another version,
2675 it can result in serious failures, including crashing with a SIGSEGV. So
2676 report the version found by the compiler and the run-time version.
2678 Note: some OS vendors backport security fixes without changing the version
2679 number/string, and the version date remains unchanged. The _build_ date
2680 will change, so we can more usefully assist with version diagnosis by also
2681 reporting the build date.
2683 Arguments: a FILE* to print the results to
2688 tls_version_report(FILE *f)
2690 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
2693 OPENSSL_VERSION_TEXT,
2694 SSLeay_version(SSLEAY_VERSION),
2695 SSLeay_version(SSLEAY_BUILT_ON));
2696 /* third line is 38 characters for the %s and the line is 73 chars long;
2697 the OpenSSL output includes a "built on: " prefix already. */
2703 /*************************************************
2704 * Random number generation *
2705 *************************************************/
2707 /* Pseudo-random number generation. The result is not expected to be
2708 cryptographically strong but not so weak that someone will shoot themselves
2709 in the foot using it as a nonce in input in some email header scheme or
2710 whatever weirdness they'll twist this into. The result should handle fork()
2711 and avoid repeating sequences. OpenSSL handles that for us.
2715 Returns a random number in range [0, max-1]
2719 vaguely_random_number(int max)
2723 static pid_t pidlast = 0;
2726 uschar smallbuf[sizeof(r)];
2732 if (pidnow != pidlast)
2734 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2735 is unique for each thread", this doesn't apparently apply across processes,
2736 so our own warning from vaguely_random_number_fallback() applies here too.
2737 Fix per PostgreSQL. */
2743 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2747 gettimeofday(&r.tv, NULL);
2750 RAND_seed((uschar *)(&r), sizeof(r));
2752 /* We're after pseudo-random, not random; if we still don't have enough data
2753 in the internal PRNG then our options are limited. We could sleep and hope
2754 for entropy to come along (prayer technique) but if the system is so depleted
2755 in the first place then something is likely to just keep taking it. Instead,
2756 we'll just take whatever little bit of pseudo-random we can still manage to
2759 needed_len = sizeof(r);
2760 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2761 asked for a number less than 10. */
2762 for (r = max, i = 0; r; ++i)
2768 #ifdef EXIM_HAVE_RAND_PSEUDO
2769 /* We do not care if crypto-strong */
2770 i = RAND_pseudo_bytes(smallbuf, needed_len);
2772 i = RAND_bytes(smallbuf, needed_len);
2778 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2779 return vaguely_random_number_fallback(max);
2783 for (p = smallbuf; needed_len; --needed_len, ++p)
2789 /* We don't particularly care about weighted results; if someone wants
2790 smooth distribution and cares enough then they should submit a patch then. */
2797 /*************************************************
2798 * OpenSSL option parse *
2799 *************************************************/
2801 /* Parse one option for tls_openssl_options_parse below
2804 name one option name
2805 value place to store a value for it
2806 Returns success or failure in parsing
2809 struct exim_openssl_option {
2813 /* We could use a macro to expand, but we need the ifdef and not all the
2814 options document which version they were introduced in. Policylet: include
2815 all options unless explicitly for DTLS, let the administrator choose which
2818 This list is current as of:
2820 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2822 static struct exim_openssl_option exim_openssl_options[] = {
2823 /* KEEP SORTED ALPHABETICALLY! */
2825 { US"all", SSL_OP_ALL },
2827 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
2828 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
2830 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
2831 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
2833 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
2834 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
2836 #ifdef SSL_OP_EPHEMERAL_RSA
2837 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
2839 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
2840 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
2842 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
2843 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
2845 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
2846 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
2848 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
2849 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
2851 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
2852 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
2854 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
2855 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
2857 #ifdef SSL_OP_NO_COMPRESSION
2858 { US"no_compression", SSL_OP_NO_COMPRESSION },
2860 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2861 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
2863 #ifdef SSL_OP_NO_SSLv2
2864 { US"no_sslv2", SSL_OP_NO_SSLv2 },
2866 #ifdef SSL_OP_NO_SSLv3
2867 { US"no_sslv3", SSL_OP_NO_SSLv3 },
2869 #ifdef SSL_OP_NO_TICKET
2870 { US"no_ticket", SSL_OP_NO_TICKET },
2872 #ifdef SSL_OP_NO_TLSv1
2873 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2875 #ifdef SSL_OP_NO_TLSv1_1
2876 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
2877 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2878 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2880 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2883 #ifdef SSL_OP_NO_TLSv1_2
2884 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2886 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2887 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2889 #ifdef SSL_OP_SINGLE_DH_USE
2890 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
2892 #ifdef SSL_OP_SINGLE_ECDH_USE
2893 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
2895 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
2896 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
2898 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
2899 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
2901 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
2902 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
2904 #ifdef SSL_OP_TLS_D5_BUG
2905 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
2907 #ifdef SSL_OP_TLS_ROLLBACK_BUG
2908 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
2911 static int exim_openssl_options_size =
2912 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2916 tls_openssl_one_option_parse(uschar *name, long *value)
2919 int last = exim_openssl_options_size;
2920 while (last > first)
2922 int middle = (first + last)/2;
2923 int c = Ustrcmp(name, exim_openssl_options[middle].name);
2926 *value = exim_openssl_options[middle].value;
2940 /*************************************************
2941 * OpenSSL option parsing logic *
2942 *************************************************/
2944 /* OpenSSL has a number of compatibility options which an administrator might
2945 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
2946 we look like log_selector.
2949 option_spec the administrator-supplied string of options
2950 results ptr to long storage for the options bitmap
2951 Returns success or failure
2955 tls_openssl_options_parse(uschar *option_spec, long *results)
2960 BOOL adding, item_parsed;
2962 result = SSL_OP_NO_TICKET;
2963 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
2964 * from default because it increases BEAST susceptibility. */
2965 #ifdef SSL_OP_NO_SSLv2
2966 result |= SSL_OP_NO_SSLv2;
2968 #ifdef SSL_OP_SINGLE_DH_USE
2969 result |= SSL_OP_SINGLE_DH_USE;
2978 for (s=option_spec; *s != '\0'; /**/)
2980 while (isspace(*s)) ++s;
2983 if (*s != '+' && *s != '-')
2985 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
2986 "+ or - expected but found \"%s\"\n", s);
2989 adding = *s++ == '+';
2990 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2993 item_parsed = tls_openssl_one_option_parse(s, &item);
2997 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
3000 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
3001 adding ? "adding" : "removing", result, item, s);
3015 /* End of tls-openssl.c */