1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2017 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Portions Copyright (c) The OpenSSL Project 1999 */
10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11 library. It is #included into the tls.c file when that library is used. The
12 code herein is based on a patch that was originally contributed by Steve
13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
15 No cryptographic code is included in Exim. All this module does is to call
16 functions from the OpenSSL library. */
21 #include <openssl/lhash.h>
22 #include <openssl/ssl.h>
23 #include <openssl/err.h>
24 #include <openssl/rand.h>
25 #ifndef OPENSSL_NO_ECDH
26 # include <openssl/ec.h>
29 # include <openssl/ocsp.h>
31 #ifdef EXPERIMENTAL_DANE
37 # define EXIM_OCSP_SKEW_SECONDS (300L)
38 # define EXIM_OCSP_MAX_AGE (-1L)
41 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
42 # define EXIM_HAVE_OPENSSL_TLSEXT
44 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
45 # define EXIM_HAVE_RSA_GENKEY_EX
47 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
48 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define EXIM_HAVE_EPHEM_RSA_KEX
51 # define EXIM_HAVE_RAND_PSEUDO
53 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
54 # define EXIM_HAVE_SHA256
58 * X509_check_host provides sane certificate hostname checking, but was added
59 * to OpenSSL late, after other projects forked off the code-base. So in
60 * addition to guarding against the base version number, beware that LibreSSL
61 * does not (at this time) support this function.
63 * If LibreSSL gains a different API, perhaps via libtls, then we'll probably
64 * opt to disentangle and ask a LibreSSL user to provide glue for a third
65 * crypto provider for libtls instead of continuing to tie the OpenSSL glue
66 * into even twistier knots. If LibreSSL gains the same API, we can just
67 * change this guard and punt the issue for a while longer.
69 #ifndef LIBRESSL_VERSION_NUMBER
70 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
71 # define EXIM_HAVE_OPENSSL_CHECKHOST
73 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
74 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
75 # define EXIM_HAVE_OPENSSL_CHECKHOST
79 #if !defined(LIBRESSL_VERSION_NUMBER) \
80 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
81 # if !defined(OPENSSL_NO_ECDH)
82 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
83 # define EXIM_HAVE_ECDH
85 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
86 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
91 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
92 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
96 /* Structure for collecting random data for seeding. */
98 typedef struct randstuff {
103 /* Local static variables */
105 static BOOL client_verify_callback_called = FALSE;
106 static BOOL server_verify_callback_called = FALSE;
107 static const uschar *sid_ctx = US"exim";
109 /* We have three different contexts to care about.
111 Simple case: client, `client_ctx`
112 As a client, we can be doing a callout or cut-through delivery while receiving
113 a message. So we have a client context, which should have options initialised
114 from the SMTP Transport.
117 There are two cases: with and without ServerNameIndication from the client.
118 Given TLS SNI, we can be using different keys, certs and various other
119 configuration settings, because they're re-expanded with $tls_sni set. This
120 allows vhosting with TLS. This SNI is sent in the handshake.
121 A client might not send SNI, so we need a fallback, and an initial setup too.
122 So as a server, we start out using `server_ctx`.
123 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
124 `server_sni` from `server_ctx` and then initialise settings by re-expanding
128 static SSL_CTX *client_ctx = NULL;
129 static SSL_CTX *server_ctx = NULL;
130 static SSL *client_ssl = NULL;
131 static SSL *server_ssl = NULL;
133 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
134 static SSL_CTX *server_sni = NULL;
137 static char ssl_errstring[256];
139 static int ssl_session_timeout = 200;
140 static BOOL client_verify_optional = FALSE;
141 static BOOL server_verify_optional = FALSE;
143 static BOOL reexpand_tls_files_for_sni = FALSE;
146 typedef struct tls_ext_ctx_cb {
151 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
155 uschar *file_expanded;
156 OCSP_RESPONSE *response;
159 X509_STORE *verify_store; /* non-null if status requested */
160 BOOL verify_required;
165 /* these are cached from first expand */
166 uschar *server_cipher_list;
167 /* only passed down to tls_error: */
169 const uschar * verify_cert_hostnames;
170 #ifndef DISABLE_EVENT
171 uschar * event_action;
175 /* should figure out a cleanup of API to handle state preserved per
176 implementation, for various reasons, which can be void * in the APIs.
177 For now, we hack around it. */
178 tls_ext_ctx_cb *client_static_cbinfo = NULL;
179 tls_ext_ctx_cb *server_static_cbinfo = NULL;
182 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
183 int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
186 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
187 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
190 static int tls_server_stapling_cb(SSL *s, void *arg);
194 /*************************************************
196 *************************************************/
198 /* Called from lots of places when errors occur before actually starting to do
199 the TLS handshake, that is, while the session is still in clear. Always returns
200 DEFER for a server and FAIL for a client so that most calls can use "return
201 tls_error(...)" to do this processing and then give an appropriate return. A
202 single function is used for both server and client, because it is called from
203 some shared functions.
206 prefix text to include in the logged error
207 host NULL if setting up a server;
208 the connected host if setting up a client
209 msg error message or NULL if we should ask OpenSSL
211 Returns: OK/DEFER/FAIL
215 tls_error(uschar * prefix, const host_item * host, uschar * msg)
219 ERR_error_string(ERR_get_error(), ssl_errstring);
220 msg = (uschar *)ssl_errstring;
225 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s): %s",
226 host->name, host->address, prefix, msg);
231 uschar *conn_info = smtp_get_connection_info();
232 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
234 /* I'd like to get separated H= here, but too hard for now */
235 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
236 conn_info, prefix, msg);
243 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
244 /*************************************************
245 * Callback to generate RSA key *
246 *************************************************/
254 Returns: pointer to generated key
258 rsa_callback(SSL *s, int export, int keylength)
261 #ifdef EXIM_HAVE_RSA_GENKEY_EX
262 BIGNUM *bn = BN_new();
265 export = export; /* Shut picky compilers up */
266 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
268 #ifdef EXIM_HAVE_RSA_GENKEY_EX
269 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
270 || !(rsa_key = RSA_new())
271 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
274 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
278 ERR_error_string(ERR_get_error(), ssl_errstring);
279 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
292 x509_store_dump_cert_s_names(X509_STORE * store)
294 STACK_OF(X509_OBJECT) * roots= store->objs;
296 static uschar name[256];
298 for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
300 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
301 if(tmp_obj->type == X509_LU_X509)
303 X509 * current_cert= tmp_obj->data.x509;
304 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
305 name[sizeof(name)-1] = '\0';
306 debug_printf(" %s\n", name);
314 #ifndef DISABLE_EVENT
316 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
317 BOOL *calledp, const BOOL *optionalp, const uschar * what)
323 ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
326 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
327 old_cert = tlsp->peercert;
328 tlsp->peercert = X509_dup(cert);
329 /* NB we do not bother setting peerdn */
330 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
332 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
333 "depth=%d cert=%s: %s",
334 tlsp == &tls_out ? deliver_host_address : sender_host_address,
335 what, depth, dn, yield);
339 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
340 return 1; /* reject (leaving peercert set) */
342 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
343 "(host in tls_try_verify_hosts)\n");
345 X509_free(tlsp->peercert);
346 tlsp->peercert = old_cert;
352 /*************************************************
353 * Callback for verification *
354 *************************************************/
356 /* The SSL library does certificate verification if set up to do so. This
357 callback has the current yes/no state is in "state". If verification succeeded,
358 we set the certificate-verified flag. If verification failed, what happens
359 depends on whether the client is required to present a verifiable certificate
362 If verification is optional, we change the state to yes, but still log the
363 verification error. For some reason (it really would help to have proper
364 documentation of OpenSSL), this callback function then gets called again, this
365 time with state = 1. We must take care not to set the private verified flag on
366 the second time through.
368 Note: this function is not called if the client fails to present a certificate
369 when asked. We get here only if a certificate has been received. Handling of
370 optional verification for this case is done when requesting SSL to verify, by
371 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
373 May be called multiple times for different issues with a certificate, even
374 for a given "depth" in the certificate chain.
377 preverify_ok current yes/no state as 1/0
378 x509ctx certificate information.
379 tlsp per-direction (client vs. server) support data
380 calledp has-been-called flag
381 optionalp verification-is-optional flag
383 Returns: 0 if verification should fail, otherwise 1
387 verify_callback(int preverify_ok, X509_STORE_CTX *x509ctx,
388 tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
390 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
391 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
394 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
395 dn[sizeof(dn)-1] = '\0';
397 if (preverify_ok == 0)
399 log_write(0, LOG_MAIN, "[%s] SSL verify error: depth=%d error=%s cert=%s",
400 tlsp == &tls_out ? deliver_host_address : sender_host_address,
402 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
408 tlsp->peercert = X509_dup(cert); /* record failing cert */
409 return 0; /* reject */
411 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
412 "tls_try_verify_hosts)\n");
417 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
419 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
420 { /* client, wanting stapling */
421 /* Add the server cert's signing chain as the one
422 for the verification of the OCSP stapled information. */
424 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
427 sk_X509_push(client_static_cbinfo->verify_stack, cert);
430 #ifndef DISABLE_EVENT
431 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
432 return 0; /* reject, with peercert set */
437 const uschar * verify_cert_hostnames;
439 if ( tlsp == &tls_out
440 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
441 /* client, wanting hostname check */
444 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
445 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
446 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
448 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
449 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
452 const uschar * list = verify_cert_hostnames;
455 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
456 if ((rc = X509_check_host(cert, CCS name, 0,
457 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
458 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
463 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
464 deliver_host_address);
471 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
474 log_write(0, LOG_MAIN,
475 "[%s] SSL verify error: certificate name mismatch: "
476 "DN=\"%s\" H=\"%s\"",
477 deliver_host_address, dn, verify_cert_hostnames);
482 tlsp->peercert = X509_dup(cert); /* record failing cert */
483 return 0; /* reject */
485 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
486 "tls_try_verify_hosts)\n");
490 #ifndef DISABLE_EVENT
491 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
492 return 0; /* reject, with peercert set */
495 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
496 *calledp ? "" : " authenticated", dn);
497 if (!*calledp) tlsp->certificate_verified = TRUE;
501 return 1; /* accept, at least for this level */
505 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
507 return verify_callback(preverify_ok, x509ctx, &tls_out,
508 &client_verify_callback_called, &client_verify_optional);
512 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
514 return verify_callback(preverify_ok, x509ctx, &tls_in,
515 &server_verify_callback_called, &server_verify_optional);
519 #ifdef EXPERIMENTAL_DANE
521 /* This gets called *by* the dane library verify callback, which interposes
525 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
527 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
529 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
530 #ifndef DISABLE_EVENT
531 BOOL dummy_called, optional = FALSE;
534 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
535 dn[sizeof(dn)-1] = '\0';
537 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
538 preverify_ok ? "ok":"BAD", depth, dn);
540 #ifndef DISABLE_EVENT
541 if (verify_event(&tls_out, cert, depth, dn,
542 &dummy_called, &optional, US"DANE"))
543 return 0; /* reject, with peercert set */
546 if (preverify_ok == 1)
547 tls_out.dane_verified =
548 tls_out.certificate_verified = TRUE;
551 int err = X509_STORE_CTX_get_error(x509ctx);
553 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
554 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
560 #endif /*EXPERIMENTAL_DANE*/
563 /*************************************************
564 * Information callback *
565 *************************************************/
567 /* The SSL library functions call this from time to time to indicate what they
568 are doing. We copy the string to the debugging output when TLS debugging has
580 info_callback(SSL *s, int where, int ret)
584 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
589 /*************************************************
590 * Initialize for DH *
591 *************************************************/
593 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
596 sctx The current SSL CTX (inbound or outbound)
597 dhparam DH parameter file or fixed parameter identity string
598 host connected host, if client; NULL if server
600 Returns: TRUE if OK (nothing to set up, or setup worked)
604 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host)
611 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
614 if (!dhexpanded || !*dhexpanded)
615 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
616 else if (dhexpanded[0] == '/')
618 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
620 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
621 host, US strerror(errno));
627 if (Ustrcmp(dhexpanded, "none") == 0)
629 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
633 if (!(pem = std_dh_prime_named(dhexpanded)))
635 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
636 host, US strerror(errno));
639 bio = BIO_new_mem_buf(CS pem, -1);
642 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
645 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
650 /* Even if it is larger, we silently return success rather than cause things
651 * to fail out, so that a too-large DH will not knock out all TLS; it's a
652 * debatable choice. */
653 if ((8*DH_size(dh)) > tls_dh_max_bits)
656 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
657 8*DH_size(dh), tls_dh_max_bits);
661 SSL_CTX_set_tmp_dh(sctx, dh);
663 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
664 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
676 /*************************************************
677 * Initialize for ECDH *
678 *************************************************/
680 /* Load parameters for ECDH encryption.
682 For now, we stick to NIST P-256 because: it's simple and easy to configure;
683 it avoids any patent issues that might bite redistributors; despite events in
684 the news and concerns over curve choices, we're not cryptographers, we're not
685 pretending to be, and this is "good enough" to be better than no support,
686 protecting against most adversaries. Given another year or two, there might
687 be sufficient clarity about a "right" way forward to let us make an informed
688 decision, instead of a knee-jerk reaction.
690 Longer-term, we should look at supporting both various named curves and
691 external files generated with "openssl ecparam", much as we do for init_dh().
692 We should also support "none" as a value, to explicitly avoid initialisation.
697 sctx The current SSL CTX (inbound or outbound)
698 host connected host, if client; NULL if server
700 Returns: TRUE if OK (nothing to set up, or setup worked)
704 init_ecdh(SSL_CTX * sctx, host_item * host)
706 #ifdef OPENSSL_NO_ECDH
715 if (host) /* No ECDH setup for clients, only for servers */
718 # ifndef EXIM_HAVE_ECDH
720 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
724 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve))
726 if (!exp_curve || !*exp_curve)
729 /* "auto" needs to be handled carefully.
730 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
731 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
732 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
733 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
734 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
736 if (Ustrcmp(exp_curve, "auto") == 0)
738 #if OPENSSL_VERSION_NUMBER < 0x10002000L
739 DEBUG(D_tls) debug_printf(
740 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
741 exp_curve = "prime256v1";
743 # if defined SSL_CTRL_SET_ECDH_AUTO
744 DEBUG(D_tls) debug_printf(
745 "ECDH OpenSSL 1.0.2+ temp key parameter settings: autoselection\n");
746 SSL_CTX_set_ecdh_auto(sctx, 1);
749 DEBUG(D_tls) debug_printf(
750 "ECDH OpenSSL 1.1.0+ temp key parameter settings: default selection\n");
756 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
757 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
758 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
759 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
763 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'",
769 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
771 tls_error(US"Unable to create ec curve", host, NULL);
775 /* The "tmp" in the name here refers to setting a temporary key
776 not to the stability of the interface. */
778 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
779 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL);
781 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
786 # endif /*EXIM_HAVE_ECDH*/
787 #endif /*OPENSSL_NO_ECDH*/
794 /*************************************************
795 * Load OCSP information into state *
796 *************************************************/
797 /* Called to load the server OCSP response from the given file into memory, once
798 caller has determined this is needed. Checks validity. Debugs a message
801 ASSUMES: single response, for single cert.
804 sctx the SSL_CTX* to update
805 cbinfo various parts of session state
806 expanded the filename putatively holding an OCSP response
811 ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
814 OCSP_RESPONSE * resp;
815 OCSP_BASICRESP * basic_response;
816 OCSP_SINGLERESP * single_response;
817 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
819 unsigned long verify_flags;
820 int status, reason, i;
822 cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
823 if (cbinfo->u_ocsp.server.response)
825 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
826 cbinfo->u_ocsp.server.response = NULL;
829 if (!(bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb")))
831 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
832 cbinfo->u_ocsp.server.file_expanded);
836 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
840 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
844 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
846 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
847 OCSP_response_status_str(status), status);
851 if (!(basic_response = OCSP_response_get1_basic(resp)))
854 debug_printf("OCSP response parse error: unable to extract basic response.\n");
858 sk = cbinfo->verify_stack;
859 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
861 /* May need to expose ability to adjust those flags?
862 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
863 OCSP_TRUSTOTHER OCSP_NOINTERN */
865 /* This does a full verify on the OCSP proof before we load it for serving
866 up; possibly overkill - just date-checks might be nice enough.
868 OCSP_basic_verify takes a "store" arg, but does not
869 use it for the chain verification, which is all we do
870 when OCSP_NOVERIFY is set. The content from the wire
871 "basic_response" and a cert-stack "sk" are all that is used.
873 We have a stack, loaded in setup_certs() if tls_verify_certificates
874 was a file (not a directory, or "system"). It is unfortunate we
875 cannot used the connection context store, as that would neatly
876 handle the "system" case too, but there seems to be no library
877 function for getting a stack from a store.
878 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
879 We do not free the stack since it could be needed a second time for
882 Separately we might try to replace using OCSP_basic_verify() - which seems to not
883 be a public interface into the OpenSSL library (there's no manual entry) -
884 But what with? We also use OCSP_basic_verify in the client stapling callback.
885 And there we NEED it; we must verify that status... unless the
886 library does it for us anyway? */
888 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
892 ERR_error_string(ERR_get_error(), ssl_errstring);
893 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
898 /* Here's the simplifying assumption: there's only one response, for the
899 one certificate we use, and nothing for anything else in a chain. If this
900 proves false, we need to extract a cert id from our issued cert
901 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
902 right cert in the stack and then calls OCSP_single_get0_status()).
904 I'm hoping to avoid reworking a bunch more of how we handle state here. */
906 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
909 debug_printf("Unable to get first response from OCSP basic response.\n");
913 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
914 if (status != V_OCSP_CERTSTATUS_GOOD)
916 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
917 OCSP_cert_status_str(status), status,
918 OCSP_crl_reason_str(reason), reason);
922 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
924 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
929 cbinfo->u_ocsp.server.response = resp;
933 if (running_in_test_harness)
935 extern char ** environ;
937 if (environ) for (p = USS environ; *p != NULL; p++)
938 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
940 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
941 goto supply_response;
946 #endif /*!DISABLE_OCSP*/
951 /* Create and install a selfsigned certificate, for use in server mode */
954 tls_install_selfsign(SSL_CTX * sctx)
962 where = US"allocating pkey";
963 if (!(pkey = EVP_PKEY_new()))
966 where = US"allocating cert";
967 if (!(x509 = X509_new()))
970 where = US"generating pkey";
971 /* deprecated, use RSA_generate_key_ex() */
972 if (!(rsa = RSA_generate_key(1024, RSA_F4, NULL, NULL)))
975 where = US"assigning pkey";
976 if (!EVP_PKEY_assign_RSA(pkey, rsa))
979 X509_set_version(x509, 2); /* N+1 - version 3 */
980 ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
981 X509_gmtime_adj(X509_get_notBefore(x509), 0);
982 X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60); /* 1 hour */
983 X509_set_pubkey(x509, pkey);
985 name = X509_get_subject_name(x509);
986 X509_NAME_add_entry_by_txt(name, "C",
987 MBSTRING_ASC, CUS "UK", -1, -1, 0);
988 X509_NAME_add_entry_by_txt(name, "O",
989 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
990 X509_NAME_add_entry_by_txt(name, "CN",
991 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
992 X509_set_issuer_name(x509, name);
994 where = US"signing cert";
995 if (!X509_sign(x509, pkey, EVP_md5()))
998 where = US"installing selfsign cert";
999 if (!SSL_CTX_use_certificate(sctx, x509))
1002 where = US"installing selfsign key";
1003 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
1009 (void) tls_error(where, NULL, NULL);
1010 if (x509) X509_free(x509);
1011 if (pkey) EVP_PKEY_free(pkey);
1018 /*************************************************
1019 * Expand key and cert file specs *
1020 *************************************************/
1022 /* Called once during tls_init and possibly again during TLS setup, for a
1023 new context, if Server Name Indication was used and tls_sni was seen in
1024 the certificate string.
1027 sctx the SSL_CTX* to update
1028 cbinfo various parts of session state
1030 Returns: OK/DEFER/FAIL
1034 tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
1038 if (!cbinfo->certificate)
1040 if (cbinfo->host) /* client */
1043 if (tls_install_selfsign(sctx) != OK)
1048 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
1049 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
1050 Ustrstr(cbinfo->certificate, US"tls_out_sni")
1052 reexpand_tls_files_for_sni = TRUE;
1054 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
1057 if (expanded != NULL)
1059 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
1060 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
1061 return tls_error(string_sprintf(
1062 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
1063 cbinfo->host, NULL);
1066 if (cbinfo->privatekey != NULL &&
1067 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
1070 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1071 of the expansion is an empty string, ignore it also, and assume the private
1072 key is in the same file as the certificate. */
1074 if (expanded && *expanded)
1076 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
1077 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
1078 return tls_error(string_sprintf(
1079 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
1083 #ifndef DISABLE_OCSP
1084 if (cbinfo->is_server && cbinfo->u_ocsp.server.file)
1086 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
1089 if (expanded && *expanded)
1091 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
1092 if ( cbinfo->u_ocsp.server.file_expanded
1093 && (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
1095 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1098 ocsp_load_response(sctx, cbinfo, expanded);
1109 /*************************************************
1110 * Callback to handle SNI *
1111 *************************************************/
1113 /* Called when acting as server during the TLS session setup if a Server Name
1114 Indication extension was sent by the client.
1116 API documentation is OpenSSL s_server.c implementation.
1119 s SSL* of the current session
1120 ad unknown (part of OpenSSL API) (unused)
1121 arg Callback of "our" registered data
1123 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
1126 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1128 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
1130 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
1131 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1133 int old_pool = store_pool;
1136 return SSL_TLSEXT_ERR_OK;
1138 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
1139 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
1141 /* Make the extension value available for expansion */
1142 store_pool = POOL_PERM;
1143 tls_in.sni = string_copy(US servername);
1144 store_pool = old_pool;
1146 if (!reexpand_tls_files_for_sni)
1147 return SSL_TLSEXT_ERR_OK;
1149 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1150 not confident that memcpy wouldn't break some internal reference counting.
1151 Especially since there's a references struct member, which would be off. */
1153 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
1155 ERR_error_string(ERR_get_error(), ssl_errstring);
1156 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
1157 return SSL_TLSEXT_ERR_NOACK;
1160 /* Not sure how many of these are actually needed, since SSL object
1161 already exists. Might even need this selfsame callback, for reneg? */
1163 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1164 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1165 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1166 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1167 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1168 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
1170 if ( !init_dh(server_sni, cbinfo->dhparam, NULL)
1171 || !init_ecdh(server_sni, NULL)
1173 return SSL_TLSEXT_ERR_NOACK;
1175 if (cbinfo->server_cipher_list)
1176 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
1177 #ifndef DISABLE_OCSP
1178 if (cbinfo->u_ocsp.server.file)
1180 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
1181 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
1185 if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
1186 verify_callback_server)) != OK)
1187 return SSL_TLSEXT_ERR_NOACK;
1189 /* do this after setup_certs, because this can require the certs for verifying
1190 OCSP information. */
1191 if ((rc = tls_expand_session_files(server_sni, cbinfo)) != OK)
1192 return SSL_TLSEXT_ERR_NOACK;
1194 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
1195 SSL_set_SSL_CTX(s, server_sni);
1197 return SSL_TLSEXT_ERR_OK;
1199 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
1204 #ifndef DISABLE_OCSP
1206 /*************************************************
1207 * Callback to handle OCSP Stapling *
1208 *************************************************/
1210 /* Called when acting as server during the TLS session setup if the client
1211 requests OCSP information with a Certificate Status Request.
1213 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1219 tls_server_stapling_cb(SSL *s, void *arg)
1221 const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1222 uschar *response_der;
1223 int response_der_len;
1226 debug_printf("Received TLS status request (OCSP stapling); %s response\n",
1227 cbinfo->u_ocsp.server.response ? "have" : "lack");
1229 tls_in.ocsp = OCSP_NOT_RESP;
1230 if (!cbinfo->u_ocsp.server.response)
1231 return SSL_TLSEXT_ERR_NOACK;
1233 response_der = NULL;
1234 response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
1236 if (response_der_len <= 0)
1237 return SSL_TLSEXT_ERR_NOACK;
1239 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
1240 tls_in.ocsp = OCSP_VFIED;
1241 return SSL_TLSEXT_ERR_OK;
1246 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1248 BIO_printf(bp, "\t%s: ", str);
1249 ASN1_GENERALIZEDTIME_print(bp, time);
1254 tls_client_stapling_cb(SSL *s, void *arg)
1256 tls_ext_ctx_cb * cbinfo = arg;
1257 const unsigned char * p;
1259 OCSP_RESPONSE * rsp;
1260 OCSP_BASICRESP * bs;
1263 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
1264 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1267 /* Expect this when we requested ocsp but got none */
1268 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
1269 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
1271 DEBUG(D_tls) debug_printf(" null\n");
1272 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1275 if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1277 tls_out.ocsp = OCSP_FAILED;
1278 if (LOGGING(tls_cipher))
1279 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
1281 DEBUG(D_tls) debug_printf(" parse error\n");
1285 if(!(bs = OCSP_response_get1_basic(rsp)))
1287 tls_out.ocsp = OCSP_FAILED;
1288 if (LOGGING(tls_cipher))
1289 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
1291 DEBUG(D_tls) debug_printf(" error parsing response\n");
1292 OCSP_RESPONSE_free(rsp);
1296 /* We'd check the nonce here if we'd put one in the request. */
1297 /* However that would defeat cacheability on the server so we don't. */
1299 /* This section of code reworked from OpenSSL apps source;
1300 The OpenSSL Project retains copyright:
1301 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1306 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1308 DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1310 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1312 /* Use the chain that verified the server cert to verify the stapled info */
1313 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1315 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
1316 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
1318 tls_out.ocsp = OCSP_FAILED;
1319 if (LOGGING(tls_cipher))
1320 log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
1321 BIO_printf(bp, "OCSP response verify failure\n");
1322 ERR_print_errors(bp);
1326 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1328 /*XXX So we have a good stapled OCSP status. How do we know
1329 it is for the cert of interest? OpenSSL 1.1.0 has a routine
1330 OCSP_resp_find_status() which matches on a cert id, which presumably
1331 we should use. Making an id needs OCSP_cert_id_new(), which takes
1332 issuerName, issuerKey, serialNumber. Are they all in the cert?
1334 For now, carry on blindly accepting the resp. */
1337 OCSP_SINGLERESP * single;
1339 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
1340 if (OCSP_resp_count(bs) != 1)
1342 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1343 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1346 tls_out.ocsp = OCSP_FAILED;
1347 log_write(0, LOG_MAIN, "OCSP stapling "
1348 "with multiple responses not handled");
1351 single = OCSP_resp_get0(bs, 0);
1352 status = OCSP_single_get0_status(single, &reason, &rev,
1353 &thisupd, &nextupd);
1356 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1357 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1358 if (!OCSP_check_validity(thisupd, nextupd,
1359 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1361 tls_out.ocsp = OCSP_FAILED;
1362 DEBUG(D_tls) ERR_print_errors(bp);
1363 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1367 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1368 OCSP_cert_status_str(status));
1371 case V_OCSP_CERTSTATUS_GOOD:
1372 tls_out.ocsp = OCSP_VFIED;
1375 case V_OCSP_CERTSTATUS_REVOKED:
1376 tls_out.ocsp = OCSP_FAILED;
1377 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1378 reason != -1 ? "; reason: " : "",
1379 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1380 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1383 tls_out.ocsp = OCSP_FAILED;
1384 log_write(0, LOG_MAIN,
1385 "Server certificate status unknown, in OCSP stapling");
1390 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1395 OCSP_RESPONSE_free(rsp);
1398 #endif /*!DISABLE_OCSP*/
1401 /*************************************************
1402 * Initialize for TLS *
1403 *************************************************/
1405 /* Called from both server and client code, to do preliminary initialization
1406 of the library. We allocate and return a context structure.
1409 ctxp returned SSL context
1410 host connected host, if client; NULL if server
1411 dhparam DH parameter file
1412 certificate certificate file
1413 privatekey private key
1414 ocsp_file file of stapling info (server); flag for require ocsp (client)
1415 addr address if client; NULL if server (for some randomness)
1416 cbp place to put allocated callback context
1418 Returns: OK/DEFER/FAIL
1422 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
1424 #ifndef DISABLE_OCSP
1427 address_item *addr, tls_ext_ctx_cb ** cbp)
1431 tls_ext_ctx_cb * cbinfo;
1433 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1434 cbinfo->certificate = certificate;
1435 cbinfo->privatekey = privatekey;
1436 #ifndef DISABLE_OCSP
1437 cbinfo->verify_stack = NULL;
1438 if ((cbinfo->is_server = host==NULL))
1440 cbinfo->u_ocsp.server.file = ocsp_file;
1441 cbinfo->u_ocsp.server.file_expanded = NULL;
1442 cbinfo->u_ocsp.server.response = NULL;
1445 cbinfo->u_ocsp.client.verify_store = NULL;
1447 cbinfo->dhparam = dhparam;
1448 cbinfo->server_cipher_list = NULL;
1449 cbinfo->host = host;
1450 #ifndef DISABLE_EVENT
1451 cbinfo->event_action = NULL;
1454 SSL_load_error_strings(); /* basic set up */
1455 OpenSSL_add_ssl_algorithms();
1457 #ifdef EXIM_HAVE_SHA256
1458 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1459 list of available digests. */
1460 EVP_add_digest(EVP_sha256());
1463 /* Create a context.
1464 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1465 negotiation in the different methods; as far as I can tell, the only
1466 *_{server,client}_method which allows negotiation is SSLv23, which exists even
1467 when OpenSSL is built without SSLv2 support.
1468 By disabling with openssl_options, we can let admins re-enable with the
1471 *ctxp = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method());
1473 if (!*ctxp) return tls_error(US"SSL_CTX_new", host, NULL);
1475 /* It turns out that we need to seed the random number generator this early in
1476 order to get the full complement of ciphers to work. It took me roughly a day
1477 of work to discover this by experiment.
1479 On systems that have /dev/urandom, SSL may automatically seed itself from
1480 there. Otherwise, we have to make something up as best we can. Double check
1486 gettimeofday(&r.tv, NULL);
1489 RAND_seed((uschar *)(&r), sizeof(r));
1490 RAND_seed((uschar *)big_buffer, big_buffer_size);
1491 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1494 return tls_error(US"RAND_status", host,
1495 US"unable to seed random number generator");
1498 /* Set up the information callback, which outputs if debugging is at a suitable
1501 DEBUG(D_tls) SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
1503 /* Automatically re-try reads/writes after renegotiation. */
1504 (void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
1506 /* Apply administrator-supplied work-arounds.
1507 Historically we applied just one requested option,
1508 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1509 moved to an administrator-controlled list of options to specify and
1510 grandfathered in the first one as the default value for "openssl_options".
1512 No OpenSSL version number checks: the options we accept depend upon the
1513 availability of the option value macros from OpenSSL. */
1515 if (!tls_openssl_options_parse(openssl_options, &init_options))
1516 return tls_error(US"openssl_options parsing failed", host, NULL);
1520 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
1521 if (!(SSL_CTX_set_options(*ctxp, init_options)))
1522 return tls_error(string_sprintf(
1523 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1526 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
1528 /* Disable session cache unconditionally */
1530 (void) SSL_CTX_set_session_cache_mode(*ctxp, SSL_SESS_CACHE_OFF);
1532 /* Initialize with DH parameters if supplied */
1533 /* Initialize ECDH temp key parameter selection */
1535 if ( !init_dh(*ctxp, dhparam, host)
1536 || !init_ecdh(*ctxp, host)
1540 /* Set up certificate and key (and perhaps OCSP info) */
1542 if ((rc = tls_expand_session_files(*ctxp, cbinfo)) != OK)
1545 /* If we need to handle SNI or OCSP, do so */
1547 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1548 # ifndef DISABLE_OCSP
1549 if (!(cbinfo->verify_stack = sk_X509_new_null()))
1551 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
1556 if (host == NULL) /* server */
1558 # ifndef DISABLE_OCSP
1559 /* We check u_ocsp.server.file, not server.response, because we care about if
1560 the option exists, not what the current expansion might be, as SNI might
1561 change the certificate and OCSP file in use between now and the time the
1562 callback is invoked. */
1563 if (cbinfo->u_ocsp.server.file)
1565 SSL_CTX_set_tlsext_status_cb(*ctxp, tls_server_stapling_cb);
1566 SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1569 /* We always do this, so that $tls_sni is available even if not used in
1571 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1572 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
1574 # ifndef DISABLE_OCSP
1576 if(ocsp_file) /* wanting stapling */
1578 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1580 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1583 SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1584 SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1589 cbinfo->verify_cert_hostnames = NULL;
1591 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
1592 /* Set up the RSA callback */
1593 SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
1596 /* Finally, set the timeout, and we are done */
1598 SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
1599 DEBUG(D_tls) debug_printf("Initialized TLS\n");
1609 /*************************************************
1610 * Get name of cipher in use *
1611 *************************************************/
1614 Argument: pointer to an SSL structure for the connection
1615 buffer to use for answer
1617 pointer to number of bits for cipher
1622 construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
1624 /* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1625 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1626 the accessor functions use const in the prototype. */
1627 const SSL_CIPHER *c;
1630 ver = (const uschar *)SSL_get_version(ssl);
1632 c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
1633 SSL_CIPHER_get_bits(c, bits);
1635 string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1636 SSL_CIPHER_get_name(c), *bits);
1638 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1643 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned bsize)
1645 /*XXX we might consider a list-of-certs variable for the cert chain.
1646 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
1647 in list-handling functions, also consider the difference between the entire
1648 chain and the elements sent by the peer. */
1650 /* Will have already noted peercert on a verify fail; possibly not the leaf */
1651 if (!tlsp->peercert)
1652 tlsp->peercert = SSL_get_peer_certificate(ssl);
1653 /* Beware anonymous ciphers which lead to server_cert being NULL */
1656 X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, bsize);
1657 peerdn[bsize-1] = '\0';
1658 tlsp->peerdn = peerdn; /*XXX a static buffer... */
1661 tlsp->peerdn = NULL;
1668 /*************************************************
1669 * Set up for verifying certificates *
1670 *************************************************/
1672 /* Load certs from file, return TRUE on success */
1675 chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
1680 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
1681 while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
1682 sk_X509_push(verify_stack, x);
1689 /* Called by both client and server startup
1692 sctx SSL_CTX* to initialise
1693 certs certs file or NULL
1694 crl CRL file or NULL
1695 host NULL in a server; the remote host in a client
1696 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1697 otherwise passed as FALSE
1698 cert_vfy_cb Callback function for certificate verification
1700 Returns: OK/DEFER/FAIL
1704 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1705 int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
1707 uschar *expcerts, *expcrl;
1709 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1712 if (expcerts && *expcerts)
1714 /* Tell the library to use its compiled-in location for the system default
1715 CA bundle. Then add the ones specified in the config, if any. */
1717 if (!SSL_CTX_set_default_verify_paths(sctx))
1718 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1720 if (Ustrcmp(expcerts, "system") != 0)
1722 struct stat statbuf;
1724 if (Ustat(expcerts, &statbuf) < 0)
1726 log_write(0, LOG_MAIN|LOG_PANIC,
1727 "failed to stat %s for certificates", expcerts);
1733 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1734 { file = NULL; dir = expcerts; }
1737 file = expcerts; dir = NULL;
1738 #ifndef DISABLE_OCSP
1739 /* In the server if we will be offering an OCSP proof, load chain from
1740 file for verifying the OCSP proof at load time. */
1743 && statbuf.st_size > 0
1744 && server_static_cbinfo->u_ocsp.server.file
1745 && !chain_from_pem_file(file, server_static_cbinfo->verify_stack)
1748 log_write(0, LOG_MAIN|LOG_PANIC,
1749 "failed to load cert hain from %s", file);
1755 /* If a certificate file is empty, the next function fails with an
1756 unhelpful error message. If we skip it, we get the correct behaviour (no
1757 certificates are recognized, but the error message is still misleading (it
1758 says no certificate was supplied). But this is better. */
1760 if ( (!file || statbuf.st_size > 0)
1761 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1762 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1764 /* Load the list of CAs for which we will accept certs, for sending
1765 to the client. This is only for the one-file tls_verify_certificates
1767 If a list isn't loaded into the server, but
1768 some verify locations are set, the server end appears to make
1769 a wildcard request for client certs.
1770 Meanwhile, the client library as default behaviour *ignores* the list
1771 we send over the wire - see man SSL_CTX_set_client_cert_cb.
1772 Because of this, and that the dir variant is likely only used for
1773 the public-CA bundle (not for a private CA), not worth fixing.
1777 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
1779 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
1780 sk_X509_NAME_num(names));
1781 SSL_CTX_set_client_CA_list(sctx, names);
1786 /* Handle a certificate revocation list. */
1788 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1790 /* This bit of code is now the version supplied by Lars Mainka. (I have
1791 merely reformatted it into the Exim code style.)
1793 "From here I changed the code to add support for multiple crl's
1794 in pem format in one file or to support hashed directory entries in
1795 pem format instead of a file. This method now uses the library function
1796 X509_STORE_load_locations to add the CRL location to the SSL context.
1797 OpenSSL will then handle the verify against CA certs and CRLs by
1798 itself in the verify callback." */
1800 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1801 if (expcrl && *expcrl)
1803 struct stat statbufcrl;
1804 if (Ustat(expcrl, &statbufcrl) < 0)
1806 log_write(0, LOG_MAIN|LOG_PANIC,
1807 "failed to stat %s for certificates revocation lists", expcrl);
1812 /* is it a file or directory? */
1814 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
1815 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
1819 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
1825 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
1827 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
1828 return tls_error(US"X509_STORE_load_locations", host, NULL);
1830 /* setting the flags to check against the complete crl chain */
1832 X509_STORE_set_flags(cvstore,
1833 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
1837 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1839 /* If verification is optional, don't fail if no certificate */
1841 SSL_CTX_set_verify(sctx,
1842 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
1851 /*************************************************
1852 * Start a TLS session in a server *
1853 *************************************************/
1855 /* This is called when Exim is running as a server, after having received
1856 the STARTTLS command. It must respond to that command, and then negotiate
1860 require_ciphers allowed ciphers
1862 Returns: OK on success
1863 DEFER for errors before the start of the negotiation
1864 FAIL for errors during the negotiation; the server can't
1869 tls_server_start(const uschar *require_ciphers)
1873 tls_ext_ctx_cb *cbinfo;
1874 static uschar peerdn[256];
1875 static uschar cipherbuf[256];
1877 /* Check for previous activation */
1879 if (tls_in.active >= 0)
1881 tls_error(US"STARTTLS received after TLS started", NULL, US"");
1882 smtp_printf("554 Already in TLS\r\n");
1886 /* Initialize the SSL library. If it fails, it will already have logged
1889 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
1890 #ifndef DISABLE_OCSP
1893 NULL, &server_static_cbinfo);
1894 if (rc != OK) return rc;
1895 cbinfo = server_static_cbinfo;
1897 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1900 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1901 were historically separated by underscores. So that I can use either form in my
1902 tests, and also for general convenience, we turn underscores into hyphens here.
1907 uschar * s = expciphers;
1908 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1909 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1910 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
1911 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
1912 cbinfo->server_cipher_list = expciphers;
1915 /* If this is a host for which certificate verification is mandatory or
1916 optional, set up appropriately. */
1918 tls_in.certificate_verified = FALSE;
1919 #ifdef EXPERIMENTAL_DANE
1920 tls_in.dane_verified = FALSE;
1922 server_verify_callback_called = FALSE;
1924 if (verify_check_host(&tls_verify_hosts) == OK)
1926 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1927 FALSE, verify_callback_server);
1928 if (rc != OK) return rc;
1929 server_verify_optional = FALSE;
1931 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1933 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1934 TRUE, verify_callback_server);
1935 if (rc != OK) return rc;
1936 server_verify_optional = TRUE;
1939 /* Prepare for new connection */
1941 if (!(server_ssl = SSL_new(server_ctx))) return tls_error(US"SSL_new", NULL, NULL);
1943 /* Warning: we used to SSL_clear(ssl) here, it was removed.
1945 * With the SSL_clear(), we get strange interoperability bugs with
1946 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1947 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1949 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1950 * session shutdown. In this case, we have a brand new object and there's no
1951 * obvious reason to immediately clear it. I'm guessing that this was
1952 * originally added because of incomplete initialisation which the clear fixed,
1953 * in some historic release.
1956 /* Set context and tell client to go ahead, except in the case of TLS startup
1957 on connection, where outputting anything now upsets the clients and tends to
1958 make them disconnect. We need to have an explicit fflush() here, to force out
1959 the response. Other smtp_printf() calls do not need it, because in non-TLS
1960 mode, the fflush() happens when smtp_getc() is called. */
1962 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1963 if (!tls_in.on_connect)
1965 smtp_printf("220 TLS go ahead\r\n");
1969 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1970 that the OpenSSL library doesn't. */
1972 SSL_set_wfd(server_ssl, fileno(smtp_out));
1973 SSL_set_rfd(server_ssl, fileno(smtp_in));
1974 SSL_set_accept_state(server_ssl);
1976 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1978 sigalrm_seen = FALSE;
1979 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1980 rc = SSL_accept(server_ssl);
1985 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
1986 if (ERR_get_error() == 0)
1987 log_write(0, LOG_MAIN,
1988 "TLS client disconnected cleanly (rejected our certificate?)");
1992 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1994 /* TLS has been set up. Adjust the input functions to read via TLS,
1995 and initialize things. */
1997 peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
1999 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
2000 tls_in.cipher = cipherbuf;
2005 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
2006 debug_printf("Shared ciphers: %s\n", buf);
2009 /* Record the certificate we presented */
2011 X509 * crt = SSL_get_certificate(server_ssl);
2012 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
2015 /* Only used by the server-side tls (tls_in), including tls_getc.
2016 Client-side (tls_out) reads (seem to?) go via
2017 smtp_read_response()/ip_recv().
2018 Hence no need to duplicate for _in and _out.
2020 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2021 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
2022 ssl_xfer_eof = ssl_xfer_error = 0;
2024 receive_getc = tls_getc;
2025 receive_get_cache = tls_get_cache;
2026 receive_ungetc = tls_ungetc;
2027 receive_feof = tls_feof;
2028 receive_ferror = tls_ferror;
2029 receive_smtp_buffered = tls_smtp_buffered;
2031 tls_in.active = fileno(smtp_out);
2039 tls_client_basic_ctx_init(SSL_CTX * ctx,
2040 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo
2044 /* stick to the old behaviour for compatibility if tls_verify_certificates is
2045 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2046 the specified host patterns if one of them is defined */
2048 if ( ( !ob->tls_verify_hosts
2049 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2051 || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
2053 client_verify_optional = FALSE;
2054 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
2055 client_verify_optional = TRUE;
2059 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
2060 ob->tls_crl, host, client_verify_optional, verify_callback_client)) != OK)
2063 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
2065 cbinfo->verify_cert_hostnames =
2067 string_domain_utf8_to_alabel(host->name, NULL);
2071 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
2072 cbinfo->verify_cert_hostnames);
2078 #ifdef EXPERIMENTAL_DANE
2080 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
2084 const char * hostnames[2] = { CS host->name, NULL };
2087 if (DANESSL_init(ssl, NULL, hostnames) != 1)
2088 return tls_error(US"hostnames load", host, NULL);
2090 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
2092 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2093 ) if (rr->type == T_TLSA)
2095 const uschar * p = rr->data;
2096 uint8_t usage, selector, mtype;
2097 const char * mdname;
2101 /* Only DANE-TA(2) and DANE-EE(3) are supported */
2102 if (usage != 2 && usage != 3) continue;
2109 default: continue; /* Only match-types 0, 1, 2 are supported */
2110 case 0: mdname = NULL; break;
2111 case 1: mdname = "sha256"; break;
2112 case 2: mdname = "sha512"; break;
2116 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
2119 return tls_error(US"tlsa load", host, NULL);
2120 case 0: /* action not taken */
2124 tls_out.tlsa_usage |= 1<<usage;
2130 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
2133 #endif /*EXPERIMENTAL_DANE*/
2137 /*************************************************
2138 * Start a TLS session in a client *
2139 *************************************************/
2141 /* Called from the smtp transport after STARTTLS has been accepted.
2144 fd the fd of the connection
2145 host connected host (for messages)
2146 addr the first address
2147 tb transport (always smtp)
2148 tlsa_dnsa tlsa lookup, if DANE, else null
2150 Returns: OK on success
2151 FAIL otherwise - note that tls_error() will not give DEFER
2152 because this is not a server
2156 tls_client_start(int fd, host_item *host, address_item *addr,
2157 transport_instance *tb
2158 #ifdef EXPERIMENTAL_DANE
2159 , dns_answer * tlsa_dnsa
2163 smtp_transport_options_block * ob =
2164 (smtp_transport_options_block *)tb->options_block;
2165 static uschar peerdn[256];
2166 uschar * expciphers;
2168 static uschar cipherbuf[256];
2170 #ifndef DISABLE_OCSP
2171 BOOL request_ocsp = FALSE;
2172 BOOL require_ocsp = FALSE;
2175 #ifdef EXPERIMENTAL_DANE
2176 tls_out.tlsa_usage = 0;
2179 #ifndef DISABLE_OCSP
2181 # ifdef EXPERIMENTAL_DANE
2183 && ob->hosts_request_ocsp[0] == '*'
2184 && ob->hosts_request_ocsp[1] == '\0'
2187 /* Unchanged from default. Use a safer one under DANE */
2188 request_ocsp = TRUE;
2189 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
2190 " {= {4}{$tls_out_tlsa_usage}} } "
2196 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK))
2197 request_ocsp = TRUE;
2199 # ifdef EXPERIMENTAL_DANE
2203 verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2207 rc = tls_init(&client_ctx, host, NULL,
2208 ob->tls_certificate, ob->tls_privatekey,
2209 #ifndef DISABLE_OCSP
2210 (void *)(long)request_ocsp,
2212 addr, &client_static_cbinfo);
2213 if (rc != OK) return rc;
2215 tls_out.certificate_verified = FALSE;
2216 client_verify_callback_called = FALSE;
2218 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
2222 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
2223 are separated by underscores. So that I can use either form in my tests, and
2224 also for general convenience, we turn underscores into hyphens here. */
2226 if (expciphers != NULL)
2228 uschar *s = expciphers;
2229 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2230 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
2231 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
2232 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
2235 #ifdef EXPERIMENTAL_DANE
2238 SSL_CTX_set_verify(client_ctx,
2239 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
2240 verify_callback_client_dane);
2242 if (!DANESSL_library_init())
2243 return tls_error(US"library init", host, NULL);
2244 if (DANESSL_CTX_init(client_ctx) <= 0)
2245 return tls_error(US"context init", host, NULL);
2251 if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob, client_static_cbinfo))
2255 if ((client_ssl = SSL_new(client_ctx)) == NULL)
2256 return tls_error(US"SSL_new", host, NULL);
2257 SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
2258 SSL_set_fd(client_ssl, fd);
2259 SSL_set_connect_state(client_ssl);
2263 if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
2265 if (tls_out.sni == NULL)
2267 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
2269 else if (!Ustrlen(tls_out.sni))
2273 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2274 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
2275 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
2277 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
2283 #ifdef EXPERIMENTAL_DANE
2285 if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa)) != OK)
2289 #ifndef DISABLE_OCSP
2290 /* Request certificate status at connection-time. If the server
2291 does OCSP stapling we will get the callback (set in tls_init()) */
2292 # ifdef EXPERIMENTAL_DANE
2296 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2297 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2299 { /* Re-eval now $tls_out_tlsa_usage is populated. If
2300 this means we avoid the OCSP request, we wasted the setup
2301 cost in tls_init(). */
2302 require_ocsp = verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
2303 request_ocsp = require_ocsp
2304 || verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2311 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
2312 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
2313 tls_out.ocsp = OCSP_NOT_RESP;
2317 #ifndef DISABLE_EVENT
2318 client_static_cbinfo->event_action = tb->event_action;
2321 /* There doesn't seem to be a built-in timeout on connection. */
2323 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
2324 sigalrm_seen = FALSE;
2325 alarm(ob->command_timeout);
2326 rc = SSL_connect(client_ssl);
2329 #ifdef EXPERIMENTAL_DANE
2331 DANESSL_cleanup(client_ssl);
2335 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
2337 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
2339 peer_cert(client_ssl, &tls_out, peerdn, sizeof(peerdn));
2341 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
2342 tls_out.cipher = cipherbuf;
2344 /* Record the certificate we presented */
2346 X509 * crt = SSL_get_certificate(client_ssl);
2347 tls_out.ourcert = crt ? X509_dup(crt) : NULL;
2350 tls_out.active = fd;
2358 /*************************************************
2359 * TLS version of getc *
2360 *************************************************/
2362 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2363 it refills the buffer via the SSL reading function.
2365 Arguments: lim Maximum amount to read/buffer
2366 Returns: the next character or EOF
2368 Only used by the server-side TLS.
2372 tls_getc(unsigned lim)
2374 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2379 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
2380 ssl_xfer_buffer, ssl_xfer_buffer_size);
2382 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2383 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer,
2384 MIN(ssl_xfer_buffer_size, lim));
2385 error = SSL_get_error(server_ssl, inbytes);
2388 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2389 closed down, not that the socket itself has been closed down. Revert to
2390 non-SSL handling. */
2392 if (error == SSL_ERROR_ZERO_RETURN)
2394 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2396 receive_getc = smtp_getc;
2397 receive_get_cache = smtp_get_cache;
2398 receive_ungetc = smtp_ungetc;
2399 receive_feof = smtp_feof;
2400 receive_ferror = smtp_ferror;
2401 receive_smtp_buffered = smtp_buffered;
2403 SSL_free(server_ssl);
2407 tls_in.cipher = NULL;
2408 tls_in.peerdn = NULL;
2411 return smtp_getc(lim);
2414 /* Handle genuine errors */
2416 else if (error == SSL_ERROR_SSL)
2418 ERR_error_string(ERR_get_error(), ssl_errstring);
2419 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
2424 else if (error != SSL_ERROR_NONE)
2426 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2431 #ifndef DISABLE_DKIM
2432 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2434 ssl_xfer_buffer_hwm = inbytes;
2435 ssl_xfer_buffer_lwm = 0;
2438 /* Something in the buffer; return next uschar */
2440 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2446 #ifndef DISABLE_DKIM
2447 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
2449 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
2455 /*************************************************
2456 * Read bytes from TLS channel *
2457 *************************************************/
2464 Returns: the number of bytes read
2465 -1 after a failed read
2467 Only used by the client-side TLS.
2471 tls_read(BOOL is_server, uschar *buff, size_t len)
2473 SSL *ssl = is_server ? server_ssl : client_ssl;
2477 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
2478 buff, (unsigned int)len);
2480 inbytes = SSL_read(ssl, CS buff, len);
2481 error = SSL_get_error(ssl, inbytes);
2483 if (error == SSL_ERROR_ZERO_RETURN)
2485 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2488 else if (error != SSL_ERROR_NONE)
2500 /*************************************************
2501 * Write bytes down TLS channel *
2502 *************************************************/
2506 is_server channel specifier
2510 Returns: the number of bytes after a successful write,
2511 -1 after a failed write
2513 Used by both server-side and client-side TLS.
2517 tls_write(BOOL is_server, const uschar *buff, size_t len)
2522 SSL *ssl = is_server ? server_ssl : client_ssl;
2524 DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
2527 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
2528 outbytes = SSL_write(ssl, CS buff, left);
2529 error = SSL_get_error(ssl, outbytes);
2530 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2534 ERR_error_string(ERR_get_error(), ssl_errstring);
2535 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2538 case SSL_ERROR_NONE:
2543 case SSL_ERROR_ZERO_RETURN:
2544 log_write(0, LOG_MAIN, "SSL channel closed on write");
2547 case SSL_ERROR_SYSCALL:
2548 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2549 sender_fullhost ? sender_fullhost : US"<unknown>",
2554 log_write(0, LOG_MAIN, "SSL_write error %d", error);
2563 /*************************************************
2564 * Close down a TLS session *
2565 *************************************************/
2567 /* This is also called from within a delivery subprocess forked from the
2568 daemon, to shut down the TLS library, without actually doing a shutdown (which
2569 would tamper with the SSL session in the parent process).
2571 Arguments: TRUE if SSL_shutdown is to be called
2574 Used by both server-side and client-side TLS.
2578 tls_close(BOOL is_server, BOOL shutdown)
2580 SSL **sslp = is_server ? &server_ssl : &client_ssl;
2581 int *fdp = is_server ? &tls_in.active : &tls_out.active;
2583 if (*fdp < 0) return; /* TLS was not active */
2587 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
2588 SSL_shutdown(*sslp);
2600 /*************************************************
2601 * Let tls_require_ciphers be checked at startup *
2602 *************************************************/
2604 /* The tls_require_ciphers option, if set, must be something which the
2607 Returns: NULL on success, or error message
2611 tls_validate_require_cipher(void)
2614 uschar *s, *expciphers, *err;
2616 /* this duplicates from tls_init(), we need a better "init just global
2617 state, for no specific purpose" singleton function of our own */
2619 SSL_load_error_strings();
2620 OpenSSL_add_ssl_algorithms();
2621 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2622 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2623 list of available digests. */
2624 EVP_add_digest(EVP_sha256());
2627 if (!(tls_require_ciphers && *tls_require_ciphers))
2630 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2631 return US"failed to expand tls_require_ciphers";
2633 if (!(expciphers && *expciphers))
2636 /* normalisation ripped from above */
2638 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2642 ctx = SSL_CTX_new(SSLv23_server_method());
2645 ERR_error_string(ERR_get_error(), ssl_errstring);
2646 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2650 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2652 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2654 ERR_error_string(ERR_get_error(), ssl_errstring);
2655 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2666 /*************************************************
2667 * Report the library versions. *
2668 *************************************************/
2670 /* There have historically been some issues with binary compatibility in
2671 OpenSSL libraries; if Exim (like many other applications) is built against
2672 one version of OpenSSL but the run-time linker picks up another version,
2673 it can result in serious failures, including crashing with a SIGSEGV. So
2674 report the version found by the compiler and the run-time version.
2676 Note: some OS vendors backport security fixes without changing the version
2677 number/string, and the version date remains unchanged. The _build_ date
2678 will change, so we can more usefully assist with version diagnosis by also
2679 reporting the build date.
2681 Arguments: a FILE* to print the results to
2686 tls_version_report(FILE *f)
2688 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
2691 OPENSSL_VERSION_TEXT,
2692 SSLeay_version(SSLEAY_VERSION),
2693 SSLeay_version(SSLEAY_BUILT_ON));
2694 /* third line is 38 characters for the %s and the line is 73 chars long;
2695 the OpenSSL output includes a "built on: " prefix already. */
2701 /*************************************************
2702 * Random number generation *
2703 *************************************************/
2705 /* Pseudo-random number generation. The result is not expected to be
2706 cryptographically strong but not so weak that someone will shoot themselves
2707 in the foot using it as a nonce in input in some email header scheme or
2708 whatever weirdness they'll twist this into. The result should handle fork()
2709 and avoid repeating sequences. OpenSSL handles that for us.
2713 Returns a random number in range [0, max-1]
2717 vaguely_random_number(int max)
2721 static pid_t pidlast = 0;
2724 uschar smallbuf[sizeof(r)];
2730 if (pidnow != pidlast)
2732 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2733 is unique for each thread", this doesn't apparently apply across processes,
2734 so our own warning from vaguely_random_number_fallback() applies here too.
2735 Fix per PostgreSQL. */
2741 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2745 gettimeofday(&r.tv, NULL);
2748 RAND_seed((uschar *)(&r), sizeof(r));
2750 /* We're after pseudo-random, not random; if we still don't have enough data
2751 in the internal PRNG then our options are limited. We could sleep and hope
2752 for entropy to come along (prayer technique) but if the system is so depleted
2753 in the first place then something is likely to just keep taking it. Instead,
2754 we'll just take whatever little bit of pseudo-random we can still manage to
2757 needed_len = sizeof(r);
2758 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2759 asked for a number less than 10. */
2760 for (r = max, i = 0; r; ++i)
2766 #ifdef EXIM_HAVE_RAND_PSEUDO
2767 /* We do not care if crypto-strong */
2768 i = RAND_pseudo_bytes(smallbuf, needed_len);
2770 i = RAND_bytes(smallbuf, needed_len);
2776 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2777 return vaguely_random_number_fallback(max);
2781 for (p = smallbuf; needed_len; --needed_len, ++p)
2787 /* We don't particularly care about weighted results; if someone wants
2788 smooth distribution and cares enough then they should submit a patch then. */
2795 /*************************************************
2796 * OpenSSL option parse *
2797 *************************************************/
2799 /* Parse one option for tls_openssl_options_parse below
2802 name one option name
2803 value place to store a value for it
2804 Returns success or failure in parsing
2807 struct exim_openssl_option {
2811 /* We could use a macro to expand, but we need the ifdef and not all the
2812 options document which version they were introduced in. Policylet: include
2813 all options unless explicitly for DTLS, let the administrator choose which
2816 This list is current as of:
2818 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2820 static struct exim_openssl_option exim_openssl_options[] = {
2821 /* KEEP SORTED ALPHABETICALLY! */
2823 { US"all", SSL_OP_ALL },
2825 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
2826 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
2828 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
2829 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
2831 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
2832 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
2834 #ifdef SSL_OP_EPHEMERAL_RSA
2835 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
2837 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
2838 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
2840 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
2841 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
2843 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
2844 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
2846 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
2847 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
2849 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
2850 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
2852 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
2853 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
2855 #ifdef SSL_OP_NO_COMPRESSION
2856 { US"no_compression", SSL_OP_NO_COMPRESSION },
2858 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2859 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
2861 #ifdef SSL_OP_NO_SSLv2
2862 { US"no_sslv2", SSL_OP_NO_SSLv2 },
2864 #ifdef SSL_OP_NO_SSLv3
2865 { US"no_sslv3", SSL_OP_NO_SSLv3 },
2867 #ifdef SSL_OP_NO_TICKET
2868 { US"no_ticket", SSL_OP_NO_TICKET },
2870 #ifdef SSL_OP_NO_TLSv1
2871 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2873 #ifdef SSL_OP_NO_TLSv1_1
2874 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
2875 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2876 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2878 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2881 #ifdef SSL_OP_NO_TLSv1_2
2882 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2884 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2885 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2887 #ifdef SSL_OP_SINGLE_DH_USE
2888 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
2890 #ifdef SSL_OP_SINGLE_ECDH_USE
2891 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
2893 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
2894 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
2896 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
2897 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
2899 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
2900 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
2902 #ifdef SSL_OP_TLS_D5_BUG
2903 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
2905 #ifdef SSL_OP_TLS_ROLLBACK_BUG
2906 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
2909 static int exim_openssl_options_size =
2910 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2914 tls_openssl_one_option_parse(uschar *name, long *value)
2917 int last = exim_openssl_options_size;
2918 while (last > first)
2920 int middle = (first + last)/2;
2921 int c = Ustrcmp(name, exim_openssl_options[middle].name);
2924 *value = exim_openssl_options[middle].value;
2938 /*************************************************
2939 * OpenSSL option parsing logic *
2940 *************************************************/
2942 /* OpenSSL has a number of compatibility options which an administrator might
2943 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
2944 we look like log_selector.
2947 option_spec the administrator-supplied string of options
2948 results ptr to long storage for the options bitmap
2949 Returns success or failure
2953 tls_openssl_options_parse(uschar *option_spec, long *results)
2958 BOOL adding, item_parsed;
2960 result = SSL_OP_NO_TICKET;
2961 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
2962 * from default because it increases BEAST susceptibility. */
2963 #ifdef SSL_OP_NO_SSLv2
2964 result |= SSL_OP_NO_SSLv2;
2966 #ifdef SSL_OP_SINGLE_DH_USE
2967 result |= SSL_OP_SINGLE_DH_USE;
2976 for (s=option_spec; *s != '\0'; /**/)
2978 while (isspace(*s)) ++s;
2981 if (*s != '+' && *s != '-')
2983 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
2984 "+ or - expected but found \"%s\"\n", s);
2987 adding = *s++ == '+';
2988 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2991 item_parsed = tls_openssl_one_option_parse(s, &item);
2995 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
2998 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2999 adding ? "adding" : "removing", result, item, s);
3013 /* End of tls-openssl.c */