1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2019 */
7 /* See the file NOTICE for conditions of use and distribution. */
8 /* SPDX-License-Identifier: GPL-2.0-or-later */
10 /* Portions Copyright (c) The OpenSSL Project 1999 */
12 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
13 library. It is #included into the tls.c file when that library is used. The
14 code herein is based on a patch that was originally contributed by Steve
15 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
17 No cryptographic code is included in Exim. All this module does is to call
18 functions from the OpenSSL library. */
23 #include <openssl/lhash.h>
24 #include <openssl/ssl.h>
25 #include <openssl/err.h>
26 #include <openssl/rand.h>
27 #ifndef OPENSSL_NO_ECDH
28 # include <openssl/ec.h>
31 # include <openssl/ocsp.h>
39 # define EXIM_OCSP_SKEW_SECONDS (300L)
40 # define EXIM_OCSP_MAX_AGE (-1L)
43 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
44 # define EXIM_HAVE_OPENSSL_TLSEXT
46 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
47 # define EXIM_HAVE_RSA_GENKEY_EX
49 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
50 # define EXIM_HAVE_OCSP_RESP_COUNT
51 # define OPENSSL_AUTO_SHA256
52 # define OPENSSL_MIN_PROTO_VERSION
54 # define EXIM_HAVE_EPHEM_RSA_KEX
55 # define EXIM_HAVE_RAND_PSEUDO
57 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
58 # define EXIM_HAVE_SHA256
61 /* X509_check_host provides sane certificate hostname checking, but was added
62 to OpenSSL late, after other projects forked off the code-base. So in
63 addition to guarding against the base version number, beware that LibreSSL
64 does not (at this time) support this function.
66 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
67 opt to disentangle and ask a LibreSSL user to provide glue for a third
68 crypto provider for libtls instead of continuing to tie the OpenSSL glue
69 into even twistier knots. If LibreSSL gains the same API, we can just
70 change this guard and punt the issue for a while longer. */
72 #ifndef LIBRESSL_VERSION_NUMBER
73 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
74 # define EXIM_HAVE_OPENSSL_CHECKHOST
75 # define EXIM_HAVE_OPENSSL_DH_BITS
76 # define EXIM_HAVE_OPENSSL_TLS_METHOD
77 # define EXIM_HAVE_OPENSSL_KEYLOG
78 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
79 # define EXIM_HAVE_SESSION_TICKET
80 # define EXIM_HAVE_OPESSL_TRACE
81 # define EXIM_HAVE_OPESSL_GET0_SERIAL
82 # define EXIM_HAVE_OPESSL_OCSP_RESP_GET0_CERTS
83 # define EXIM_HAVE_SSL_GET0_VERIFIED_CHAIN
85 # define EXIM_HAVE_OCSP
87 # define EXIM_HAVE_ALPN /* fail ret from hshake-cb is ignored by LibreSSL */
89 # define EXIM_NEED_OPENSSL_INIT
91 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
92 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
93 # define EXIM_HAVE_OPENSSL_CHECKHOST
97 #if LIBRESSL_VERSION_NUMBER >= 0x3040000fL
98 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
101 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x030000000L)
102 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
103 # define EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
106 #if !defined(LIBRESSL_VERSION_NUMBER) \
107 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
108 # if !defined(OPENSSL_NO_ECDH)
109 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
110 # define EXIM_HAVE_ECDH
112 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
113 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
118 #ifndef LIBRESSL_VERSION_NUMBER
119 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
120 # define OPENSSL_HAVE_KEYLOG_CB
121 # define OPENSSL_HAVE_NUM_TICKETS
122 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
123 # define EXIM_HAVE_EXP_CHNL_BNGNG
124 # define EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER
126 # define OPENSSL_BAD_SRVR_OURCERT
130 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x010002000L)
131 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
134 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
135 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
136 # define DISABLE_OCSP
139 #ifndef DISABLE_TLS_RESUME
140 # if OPENSSL_VERSION_NUMBER < 0x0101010L
141 # error OpenSSL version too old for session-resumption
145 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
146 # include <openssl/x509v3.h>
149 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
150 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
151 # define SSL_CIPHER_get_id(c) (c->id)
153 # ifndef MACRO_PREDEF
154 # include "tls-cipher-stdname.c"
158 /*************************************************
159 * OpenSSL option parse *
160 *************************************************/
162 typedef struct exim_openssl_option {
165 } exim_openssl_option;
166 /* We could use a macro to expand, but we need the ifdef and not all the
167 options document which version they were introduced in. Policylet: include
168 all options unless explicitly for DTLS, let the administrator choose which
171 This list is current as of:
174 XXX could we autobuild this list, as with predefined-macros?
175 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
176 Also allow a numeric literal?
178 static exim_openssl_option exim_openssl_options[] = {
179 /* KEEP SORTED ALPHABETICALLY! */
181 { US"all", (long) SSL_OP_ALL },
183 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
184 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
186 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
187 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
189 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
190 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
192 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
193 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
195 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
196 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
198 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
199 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
201 #ifdef SSL_OP_EPHEMERAL_RSA
202 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
204 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
205 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
207 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
208 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
210 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
211 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
213 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
214 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
216 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
217 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
219 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
220 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
222 #ifdef SSL_OP_NO_ANTI_REPLAY
223 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
225 #ifdef SSL_OP_NO_COMPRESSION
226 { US"no_compression", SSL_OP_NO_COMPRESSION },
228 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
229 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
231 #ifdef SSL_OP_NO_RENEGOTIATION
232 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
234 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
235 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
237 #ifdef SSL_OP_NO_SSLv2
238 { US"no_sslv2", SSL_OP_NO_SSLv2 },
240 #ifdef SSL_OP_NO_SSLv3
241 { US"no_sslv3", SSL_OP_NO_SSLv3 },
243 #ifdef SSL_OP_NO_TICKET
244 { US"no_ticket", SSL_OP_NO_TICKET },
246 #ifdef SSL_OP_NO_TLSv1
247 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
249 #ifdef SSL_OP_NO_TLSv1_1
250 # if OPENSSL_VERSION_NUMBER < 0x30000000L
251 # if SSL_OP_NO_TLSv1_1 == 0x00000400L
252 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
253 # warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
254 # define NO_SSL_OP_NO_TLSv1_1
257 # ifndef NO_SSL_OP_NO_TLSv1_1
258 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
261 #ifdef SSL_OP_NO_TLSv1_2
262 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
264 #ifdef SSL_OP_NO_TLSv1_3
265 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
267 #ifdef SSL_OP_PRIORITIZE_CHACHA
268 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
270 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
271 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
273 #ifdef SSL_OP_SINGLE_DH_USE
274 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
276 #ifdef SSL_OP_SINGLE_ECDH_USE
277 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
279 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
280 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
282 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
283 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
285 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
286 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
288 #ifdef SSL_OP_TLS_D5_BUG
289 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
291 #ifdef SSL_OP_TLS_ROLLBACK_BUG
292 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
294 #ifdef SSL_OP_TLSEXT_PADDING
295 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
300 static int exim_openssl_options_size = nelem(exim_openssl_options);
301 static long init_options = 0;
310 for (struct exim_openssl_option * o = exim_openssl_options;
311 o < exim_openssl_options + nelem(exim_openssl_options); o++)
313 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
314 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
316 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
317 builtin_macro_create(buf);
320 # ifndef DISABLE_TLS_RESUME
321 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
323 # ifdef SSL_OP_NO_TLSv1_3
324 builtin_macro_create(US"_HAVE_TLS1_3");
326 # ifdef OPENSSL_BAD_SRVR_OURCERT
327 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
329 # ifdef EXIM_HAVE_OCSP
330 builtin_macro_create(US"_HAVE_TLS_OCSP");
331 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
333 # ifdef EXIM_HAVE_ALPN
334 builtin_macro_create(US"_HAVE_TLS_ALPN");
339 /******************************************************************************/
341 /* Structure for collecting random data for seeding. */
343 typedef struct randstuff {
348 /* Local static variables */
350 static BOOL client_verify_callback_called = FALSE;
351 static BOOL server_verify_callback_called = FALSE;
352 static const uschar *sid_ctx = US"exim";
354 /* We have three different contexts to care about.
356 Simple case: client, `client_ctx`
357 As a client, we can be doing a callout or cut-through delivery while receiving
358 a message. So we have a client context, which should have options initialised
359 from the SMTP Transport. We may also concurrently want to make TLS connections
360 to utility daemons, so client-contexts are allocated and passed around in call
361 args rather than using a gobal.
364 There are two cases: with and without ServerNameIndication from the client.
365 Given TLS SNI, we can be using different keys, certs and various other
366 configuration settings, because they're re-expanded with $tls_sni set. This
367 allows vhosting with TLS. This SNI is sent in the handshake.
368 A client might not send SNI, so we need a fallback, and an initial setup too.
369 So as a server, we start out using `server_ctx`.
370 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
371 `server_sni` from `server_ctx` and then initialise settings by re-expanding
379 } exim_openssl_client_tls_ctx;
382 /* static SSL_CTX *server_ctx = NULL; */
383 /* static SSL *server_ssl = NULL; */
385 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
386 static SSL_CTX *server_sni = NULL;
388 #ifdef EXIM_HAVE_ALPN
389 static BOOL server_seen_alpn = FALSE;
392 static char ssl_errstring[256];
394 static int ssl_session_timeout = 7200; /* Two hours */
395 static BOOL client_verify_optional = FALSE;
396 static BOOL server_verify_optional = FALSE;
398 static BOOL reexpand_tls_files_for_sni = FALSE;
401 typedef struct ocsp_resp {
402 struct ocsp_resp * next;
403 OCSP_RESPONSE * resp;
406 typedef struct exim_openssl_state {
407 exim_tlslib_state lib_state;
408 #define lib_ctx libdata0
409 #define lib_ssl libdata1
412 uschar * certificate;
419 const uschar *file_expanded;
420 ocsp_resplist *olist;
421 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
424 X509_STORE *verify_store; /* non-null if status requested */
425 uschar *verify_errstr; /* only if _required */
426 BOOL verify_required;
431 /* these are cached from first expand */
432 uschar * server_cipher_list;
433 /* only passed down to tls_error: */
435 const uschar * verify_cert_hostnames;
436 #ifndef DISABLE_EVENT
437 uschar * event_action;
439 } exim_openssl_state_st;
441 /* should figure out a cleanup of API to handle state preserved per
442 implementation, for various reasons, which can be void * in the APIs.
443 For now, we hack around it. */
444 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
445 exim_openssl_state_st state_server = {.is_server = TRUE};
448 setup_certs(SSL_CTX * sctx, uschar ** certs, uschar * crl, host_item * host,
453 static int tls_server_stapling_cb(SSL *s, void *arg);
454 static void x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk);
455 static void x509_store_dump_cert_s_names(X509_STORE * store);
460 /* Daemon-called, before every connection, key create/rotate */
461 #ifndef DISABLE_TLS_RESUME
462 static void tk_init(void);
463 static int tls_exdata_idx = -1;
467 tls_per_lib_daemon_tick(void)
469 #ifndef DISABLE_TLS_RESUME
474 /* Called once at daemon startup */
477 tls_per_lib_daemon_init(void)
479 tls_daemon_creds_reload();
483 /*************************************************
485 *************************************************/
487 /* Called from lots of places when errors occur before actually starting to do
488 the TLS handshake, that is, while the session is still in clear. Always returns
489 DEFER for a server and FAIL for a client so that most calls can use "return
490 tls_error(...)" to do this processing and then give an appropriate return. A
491 single function is used for both server and client, because it is called from
492 some shared functions.
495 prefix text to include in the logged error
496 host NULL if setting up a server;
497 the connected host if setting up a client
498 msg error message or NULL if we should ask OpenSSL
499 errstr pointer to output error message
501 Returns: OK/DEFER/FAIL
505 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
509 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
510 msg = US ssl_errstring;
513 msg = string_sprintf("(%s): %s", prefix, msg);
514 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
515 if (errstr) *errstr = msg;
516 return host ? FAIL : DEFER;
521 /**************************************************
522 * General library initalisation *
523 **************************************************/
526 lib_rand_init(void * addr)
529 if (!RAND_status()) return TRUE;
531 gettimeofday(&r.tv, NULL);
533 RAND_seed(US (&r), sizeof(r));
534 RAND_seed(US big_buffer, big_buffer_size);
535 if (addr) RAND_seed(US addr, sizeof(addr));
537 return RAND_status();
542 tls_openssl_init(void)
544 static BOOL once = FALSE;
548 #ifdef EXIM_NEED_OPENSSL_INIT
549 SSL_load_error_strings(); /* basic set up */
550 OpenSSL_add_ssl_algorithms();
553 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
554 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
555 list of available digests. */
556 EVP_add_digest(EVP_sha256());
559 (void) lib_rand_init(NULL);
560 (void) tls_openssl_options_parse(openssl_options, &init_options);
565 /*************************************************
566 * Initialize for DH *
567 *************************************************/
569 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
573 sctx The current SSL CTX (inbound or outbound)
574 dhparam DH parameter file or fixed parameter identity string
575 errstr error string pointer
577 Returns: TRUE if OK (nothing to set up, or setup worked)
581 init_dh(SSL_CTX * sctx, uschar * dhparam, uschar ** errstr)
584 #if OPENSSL_VERSION_NUMBER < 0x30000000L
593 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
596 if (!dhexpanded || !*dhexpanded)
597 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
598 else if (dhexpanded[0] == '/')
600 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
602 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
603 NULL, US strerror(errno), errstr);
609 if (Ustrcmp(dhexpanded, "none") == 0)
611 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
615 if (!(pem = std_dh_prime_named(dhexpanded)))
617 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
618 NULL, US strerror(errno), errstr);
621 bio = BIO_new_mem_buf(CS pem, -1);
625 #if OPENSSL_VERSION_NUMBER < 0x30000000L
626 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)
628 pkey = PEM_read_bio_Parameters_ex(bio, NULL, NULL, NULL)
633 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
638 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
639 an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with 2236.
640 But older OpenSSL can only report in bytes (octets), not bits. If someone wants
641 to dance at the edge, then they can raise the limit or use current libraries. */
643 #if OPENSSL_VERSION_NUMBER < 0x30000000L
644 # ifdef EXIM_HAVE_OPENSSL_DH_BITS
645 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
646 This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
647 dh_bitsize = DH_bits(dh);
649 dh_bitsize = 8 * DH_size(dh);
652 dh_bitsize = EVP_PKEY_get_bits(pkey);
655 /* Even if it is larger, we silently return success rather than cause things to
656 fail out, so that a too-large DH will not knock out all TLS; it's a debatable
657 choice. Likewise for a failing attempt to set one. */
659 if (dh_bitsize <= tls_dh_max_bits)
662 #if OPENSSL_VERSION_NUMBER < 0x30000000L
663 SSL_CTX_set_tmp_dh(sctx, dh)
665 SSL_CTX_set0_tmp_dh_pkey(sctx, pkey)
669 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
670 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (D-H param setting '%s'): %s",
671 dhexpanded ? dhexpanded : US"default", ssl_errstring);
672 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
673 /* EVP_PKEY_free(pkey); crashes */
678 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
679 dhexpanded ? dhexpanded : US"default", dh_bitsize);
683 debug_printf("dhparams '%s' %d bits, is > tls_dh_max_bits limit of %d\n",
684 dhexpanded ? dhexpanded : US"default", dh_bitsize, tls_dh_max_bits);
686 #if OPENSSL_VERSION_NUMBER < 0x30000000L
689 /* The EVP_PKEY ownership stays with the ctx; do not free it */
698 /*************************************************
699 * Initialize for ECDH *
700 *************************************************/
702 /* Load parameters for ECDH encryption. Server only.
704 For now, we stick to NIST P-256 because: it's simple and easy to configure;
705 it avoids any patent issues that might bite redistributors; despite events in
706 the news and concerns over curve choices, we're not cryptographers, we're not
707 pretending to be, and this is "good enough" to be better than no support,
708 protecting against most adversaries. Given another year or two, there might
709 be sufficient clarity about a "right" way forward to let us make an informed
710 decision, instead of a knee-jerk reaction.
712 Longer-term, we should look at supporting both various named curves and
713 external files generated with "openssl ecparam", much as we do for init_dh().
714 We should also support "none" as a value, to explicitly avoid initialisation.
719 sctx The current SSL CTX (inbound or outbound)
720 errstr error string pointer
722 Returns: TRUE if OK (nothing to set up, or setup worked)
726 init_ecdh(SSL_CTX * sctx, uschar ** errstr)
728 #ifdef OPENSSL_NO_ECDH
736 # ifndef EXIM_HAVE_ECDH
738 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
742 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
744 if (!exp_curve || !*exp_curve)
747 /* "auto" needs to be handled carefully.
748 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
749 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
750 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
751 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
752 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
754 if (Ustrcmp(exp_curve, "auto") == 0)
756 #if OPENSSL_VERSION_NUMBER < 0x10002000L
757 DEBUG(D_tls) debug_printf(
758 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
759 exp_curve = US"prime256v1";
761 # if defined SSL_CTRL_SET_ECDH_AUTO
762 DEBUG(D_tls) debug_printf(
763 "ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n");
764 SSL_CTX_set_ecdh_auto(sctx, 1);
767 DEBUG(D_tls) debug_printf(
768 "ECDH OpenSSL 1.1.0+: temp key parameter settings: default selection\n");
774 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
775 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
776 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
777 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
781 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
786 # if OPENSSL_VERSION_NUMBER < 0x30000000L
789 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
791 tls_error(US"Unable to create ec curve", NULL, NULL, errstr);
795 /* The "tmp" in the name here refers to setting a temporary key
796 not to the stability of the interface. */
798 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
799 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), NULL, NULL, errstr);
801 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
805 #else /* v 3.0.0 + */
807 if ((rv = SSL_CTX_set1_groups(sctx, &nid, 1)) == 0)
808 tls_error(string_sprintf("Error enabling '%s' group", exp_curve), NULL, NULL, errstr);
810 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' group\n", exp_curve);
816 # endif /*EXIM_HAVE_ECDH*/
817 #endif /*OPENSSL_NO_ECDH*/
822 /*************************************************
823 * Expand key and cert file specs *
824 *************************************************/
826 #if OPENSSL_VERSION_NUMBER < 0x30000000L
829 s SSL connection (not used)
833 Returns: pointer to generated key
837 rsa_callback(SSL *s, int export, int keylength)
840 #ifdef EXIM_HAVE_RSA_GENKEY_EX
841 BIGNUM *bn = BN_new();
844 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
846 # ifdef EXIM_HAVE_RSA_GENKEY_EX
847 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
848 || !(rsa_key = RSA_new())
849 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
852 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
856 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
857 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
863 #endif /* pre-3.0.0 */
867 /* Create and install a selfsigned certificate, for use in server mode */
868 /*XXX we could arrange to call this during prelo for a null tls_certificate option.
869 The normal cache inval + relo will suffice.
870 Just need a timer for inval. */
873 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
880 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
881 where = US"allocating pkey";
882 if (!(pkey = EVP_PKEY_new()))
885 where = US"allocating cert";
886 if (!(x509 = X509_new()))
889 where = US"generating pkey";
890 #if OPENSSL_VERSION_NUMBER < 0x30000000L
893 if (!(rsa = rsa_callback(NULL, 0, 2048)))
896 where = US"assigning pkey";
897 if (!EVP_PKEY_assign_RSA(pkey, rsa))
901 pkey = EVP_RSA_gen(2048);
904 X509_set_version(x509, 2); /* N+1 - version 3 */
905 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
906 X509_gmtime_adj(X509_get_notBefore(x509), 0);
907 X509_gmtime_adj(X509_get_notAfter(x509), (long)2 * 60 * 60); /* 2 hour */
908 X509_set_pubkey(x509, pkey);
910 name = X509_get_subject_name(x509);
911 X509_NAME_add_entry_by_txt(name, "C",
912 MBSTRING_ASC, CUS "UK", -1, -1, 0);
913 X509_NAME_add_entry_by_txt(name, "O",
914 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
915 X509_NAME_add_entry_by_txt(name, "CN",
916 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
917 X509_set_issuer_name(x509, name);
919 where = US"signing cert";
920 if (!X509_sign(x509, pkey, EVP_md5()))
923 where = US"installing selfsign cert";
924 if (!SSL_CTX_use_certificate(sctx, x509))
927 where = US"installing selfsign key";
928 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
934 (void) tls_error(where, NULL, NULL, errstr);
935 if (x509) X509_free(x509);
936 if (pkey) EVP_PKEY_free(pkey);
946 /*************************************************
947 * Information callback *
948 *************************************************/
950 /* The SSL library functions call this from time to time to indicate what they
951 are doing. We copy the string to the debugging output when TLS debugging has
963 info_callback(SSL * s, int where, int ret)
969 if (where & SSL_ST_CONNECT) g = string_append_listele(g, ',', US"SSL_connect");
970 if (where & SSL_ST_ACCEPT) g = string_append_listele(g, ',', US"SSL_accept");
971 if (where & SSL_CB_LOOP) g = string_append_listele(g, ',', US"state_chg");
972 if (where & SSL_CB_EXIT) g = string_append_listele(g, ',', US"hshake_exit");
973 if (where & SSL_CB_READ) g = string_append_listele(g, ',', US"read");
974 if (where & SSL_CB_WRITE) g = string_append_listele(g, ',', US"write");
975 if (where & SSL_CB_ALERT) g = string_append_listele(g, ',', US"alert");
976 if (where & SSL_CB_HANDSHAKE_START) g = string_append_listele(g, ',', US"hshake_start");
977 if (where & SSL_CB_HANDSHAKE_DONE) g = string_append_listele(g, ',', US"hshake_done");
979 if (where & SSL_CB_LOOP)
980 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
981 else if (where & SSL_CB_ALERT)
982 debug_printf("SSL %s %s:%s\n", g->s,
983 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
984 else if (where & SSL_CB_EXIT)
987 debug_printf("SSL %s: %s in %s\n", g->s,
988 ret == 0 ? "failed" : "error", SSL_state_string_long(s));
990 else if (where & (SSL_CB_HANDSHAKE_START | SSL_CB_HANDSHAKE_DONE))
991 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
995 #ifdef OPENSSL_HAVE_KEYLOG_CB
997 keylog_callback(const SSL *ssl, const char *line)
1001 DEBUG(D_tls) debug_printf("%.200s\n", line);
1002 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
1003 if (!(fp = fopen(filename, "a"))) return;
1004 fprintf(fp, "%s\n", line);
1013 #ifndef DISABLE_EVENT
1015 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
1016 BOOL *calledp, const BOOL *optionalp, const uschar * what)
1022 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
1025 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
1026 old_cert = tlsp->peercert;
1027 tlsp->peercert = X509_dup(cert);
1028 /* NB we do not bother setting peerdn */
1029 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth), &errno)))
1031 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
1032 "depth=%d cert=%s: %s",
1033 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1034 what, depth, dn, yield);
1038 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
1039 return 1; /* reject (leaving peercert set) */
1041 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
1042 "(host in tls_try_verify_hosts)\n");
1043 tlsp->verify_override = TRUE;
1045 X509_free(tlsp->peercert);
1046 tlsp->peercert = old_cert;
1052 /*************************************************
1053 * Callback for verification *
1054 *************************************************/
1056 /* The SSL library does certificate verification if set up to do so. This
1057 callback has the current yes/no state is in "state". If verification succeeded,
1058 we set the certificate-verified flag. If verification failed, what happens
1059 depends on whether the client is required to present a verifiable certificate
1062 If verification is optional, we change the state to yes, but still log the
1063 verification error. For some reason (it really would help to have proper
1064 documentation of OpenSSL), this callback function then gets called again, this
1065 time with state = 1. We must take care not to set the private verified flag on
1066 the second time through.
1068 Note: this function is not called if the client fails to present a certificate
1069 when asked. We get here only if a certificate has been received. Handling of
1070 optional verification for this case is done when requesting SSL to verify, by
1071 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
1073 May be called multiple times for different issues with a certificate, even
1074 for a given "depth" in the certificate chain.
1077 preverify_ok current yes/no state as 1/0
1078 x509ctx certificate information.
1079 tlsp per-direction (client vs. server) support data
1080 calledp has-been-called flag
1081 optionalp verification-is-optional flag
1083 Returns: 0 if verification should fail, otherwise 1
1087 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1088 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1090 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1091 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1094 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1096 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1097 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1098 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1101 dn[sizeof(dn)-1] = '\0';
1103 tlsp->verify_override = FALSE;
1104 if (preverify_ok == 0)
1106 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1107 *verify_mode, sender_host_address)
1109 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1110 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1112 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1116 if (!tlsp->peercert)
1117 tlsp->peercert = X509_dup(cert); /* record failing cert */
1118 return 0; /* reject */
1120 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1121 "tls_try_verify_hosts)\n");
1122 tlsp->verify_override = TRUE;
1125 else if (depth != 0)
1127 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1128 #ifndef DISABLE_EVENT
1129 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1130 return 0; /* reject, with peercert set */
1135 const uschar * verify_cert_hostnames;
1137 if ( tlsp == &tls_out
1138 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1139 /* client, wanting hostname check */
1142 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1143 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1144 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1146 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1147 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1150 const uschar * list = verify_cert_hostnames;
1153 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1154 if ((rc = X509_check_host(cert, CCS name, 0,
1155 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1156 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1161 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1162 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1169 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1172 uschar * extra = verify_mode
1173 ? string_sprintf(" (during %c-verify for [%s])",
1174 *verify_mode, sender_host_address)
1176 log_write(0, LOG_MAIN,
1177 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1178 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1179 extra, dn, verify_cert_hostnames);
1183 if (!tlsp->peercert)
1184 tlsp->peercert = X509_dup(cert); /* record failing cert */
1185 return 0; /* reject */
1187 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1188 "tls_try_verify_hosts)\n");
1189 tlsp->verify_override = TRUE;
1193 #ifndef DISABLE_EVENT
1194 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1195 return 0; /* reject, with peercert set */
1198 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1199 *calledp ? "" : " authenticated", dn);
1203 return 1; /* accept, at least for this level */
1207 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1209 return verify_callback(preverify_ok, x509ctx, &tls_out,
1210 &client_verify_callback_called, &client_verify_optional);
1214 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1216 return verify_callback(preverify_ok, x509ctx, &tls_in,
1217 &server_verify_callback_called, &server_verify_optional);
1223 /* This gets called *by* the dane library verify callback, which interposes
1227 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1229 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1231 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1232 #ifndef DISABLE_EVENT
1233 BOOL dummy_called, optional = FALSE;
1236 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1238 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1239 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1240 deliver_host_address);
1243 dn[sizeof(dn)-1] = '\0';
1245 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1246 preverify_ok ? "ok":"BAD", depth, dn);
1248 #ifndef DISABLE_EVENT
1249 if (verify_event(&tls_out, cert, depth, dn,
1250 &dummy_called, &optional, US"DANE"))
1251 return 0; /* reject, with peercert set */
1254 if (preverify_ok == 1)
1255 tls_out.dane_verified = TRUE;
1258 int err = X509_STORE_CTX_get_error(x509ctx);
1260 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1261 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1264 return preverify_ok;
1267 #endif /*SUPPORT_DANE*/
1270 #ifndef DISABLE_OCSP
1272 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1274 BIO_printf(bp, "\t%s: ", str);
1275 ASN1_GENERALIZEDTIME_print(bp, time);
1279 /*************************************************
1280 * Load OCSP information into state *
1281 *************************************************/
1282 /* Called to load the server OCSP response from the given file into memory, once
1283 caller has determined this is needed. Checks validity. Debugs a message
1286 ASSUMES: single response, for single cert.
1289 state various parts of session state
1290 filename the filename putatively holding an OCSP response
1291 is_pem file is PEM format; otherwise is DER
1295 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1299 OCSP_RESPONSE * resp;
1300 OCSP_BASICRESP * basic_response;
1301 OCSP_SINGLERESP * single_response;
1302 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1303 STACK_OF(X509) * sk;
1304 int status, reason, i;
1307 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1309 if (!filename || !*filename) return;
1312 if (!(bio = BIO_new_file(CS filename, "rb")))
1314 log_write(0, LOG_MAIN|LOG_PANIC,
1315 "Failed to open OCSP response file \"%s\": %.100s",
1316 filename, ERR_reason_error_string(ERR_get_error()));
1322 uschar * data, * freep;
1325 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1327 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
1328 filename, ERR_reason_error_string(ERR_get_error()));
1332 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1333 OPENSSL_free(freep);
1336 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1341 log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
1342 filename, ERR_reason_error_string(ERR_get_error()));
1346 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1348 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1349 OCSP_response_status_str(status), status);
1355 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1356 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1361 if (!(basic_response = OCSP_response_get1_basic(resp)))
1364 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1368 sk = state->u_ocsp.server.verify_stack; /* set by setup_certs() / chain_from_pem_file() */
1370 /* May need to expose ability to adjust those flags?
1371 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1372 OCSP_TRUSTOTHER OCSP_NOINTERN */
1374 /* This does a partial verify (only the signer link, not the whole chain-to-CA)
1375 on the OCSP proof before we load it for serving up; possibly overkill -
1376 just date-checks might be nice enough.
1378 OCSP_basic_verify takes a "store" arg, but does not
1379 use it for the chain verification, when OCSP_NOVERIFY is set.
1380 The content from the wire "basic_response" and a cert-stack "sk" are all
1383 We have a stack, loaded in setup_certs() if tls_verify_certificates
1384 was a file (not a directory, or "system"). It is unfortunate we
1385 cannot used the connection context store, as that would neatly
1386 handle the "system" case too, but there seems to be no library
1387 function for getting a stack from a store.
1388 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1389 [ 3.0.0 - sk = X509_STORE_get1_all_certs(store) ]
1390 We do not free the stack since it could be needed a second time for
1393 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1394 be a public interface into the OpenSSL library (there's no manual entry) -
1395 (in 3.0.0 + is is public)
1396 But what with? We also use OCSP_basic_verify in the client stapling callback.
1397 And there we NEED it; we must verify that status... unless the
1398 library does it for us anyway? */
1400 if ((i = OCSP_basic_verify(basic_response, sk, NULL, OCSP_NOVERIFY)) < 0)
1404 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1405 debug_printf("OCSP response has bad signature: %s\n", US ssl_errstring);
1410 /* Here's the simplifying assumption: there's only one response, for the
1411 one certificate we use, and nothing for anything else in a chain. If this
1412 proves false, we need to extract a cert id from our issued cert
1413 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1414 right cert in the stack and then calls OCSP_single_get0_status()).
1416 I'm hoping to avoid reworking a bunch more of how we handle state here.
1418 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1421 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1424 debug_printf("Unable to get first response from OCSP basic response.\n");
1428 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1429 if (status != V_OCSP_CERTSTATUS_GOOD)
1431 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1432 OCSP_cert_status_str(status), status,
1433 OCSP_crl_reason_str(reason), reason);
1437 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1441 BIO * bp = BIO_new(BIO_s_mem());
1444 time_print(bp, "This OCSP Update", thisupd);
1445 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
1446 if ((len = (int) BIO_get_mem_data(bp, CSS &s)) > 0) debug_printf("%.*s", len, s);
1447 debug_printf("OCSP status invalid times.\n");
1453 /* Add the resp to the list used by tls_server_stapling_cb() */
1455 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1456 while (oentry = *op)
1458 *op = oentry = store_get(sizeof(ocsp_resplist), GET_UNTAINTED);
1459 oentry->next = NULL;
1460 oentry->resp = resp;
1465 if (f.running_in_test_harness)
1467 extern char ** environ;
1468 if (environ) for (uschar ** p = USS environ; *p; p++)
1469 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1471 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1472 goto supply_response;
1480 ocsp_free_response_list(exim_openssl_state_st * state)
1482 for (ocsp_resplist * olist = state->u_ocsp.server.olist; olist;
1483 olist = olist->next)
1484 OCSP_RESPONSE_free(olist->resp);
1485 state->u_ocsp.server.olist = NULL;
1487 #endif /*!DISABLE_OCSP*/
1494 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1497 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1498 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1499 return tls_error(string_sprintf(
1500 "SSL_CTX_use_certificate_chain_file file=%s", file),
1501 cbinfo->host, NULL, errstr);
1506 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1509 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1510 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1511 return tls_error(string_sprintf(
1512 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1519 /* Called once during tls_init and possibly again during TLS setup, for a
1520 new context, if Server Name Indication was used and tls_sni was seen in
1521 the certificate string.
1524 sctx the SSL_CTX* to update
1525 state various parts of session state
1526 errstr error string pointer
1528 Returns: OK/DEFER/FAIL
1532 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1537 if (!state->certificate)
1539 if (!state->is_server) /* client */
1542 if (tls_install_selfsign(sctx, errstr) != OK)
1549 if ( !reexpand_tls_files_for_sni
1550 && ( Ustrstr(state->certificate, US"tls_sni")
1551 || Ustrstr(state->certificate, US"tls_in_sni")
1552 || Ustrstr(state->certificate, US"tls_out_sni")
1554 reexpand_tls_files_for_sni = TRUE;
1556 if ( !expand_check(state->certificate, US"tls_certificate", &expanded, errstr)
1557 || f.expand_string_forcedfail)
1559 if (f.expand_string_forcedfail)
1560 *errstr = US"expansion of tls_certificate failed";
1565 if (state->is_server)
1567 const uschar * file_list = expanded;
1570 #ifndef DISABLE_OCSP
1571 const uschar * olist = state->u_ocsp.server.file;
1574 BOOL fmt_pem = FALSE;
1577 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1579 if (olist && !*olist)
1582 /* If doing a re-expand after SNI, avoid reloading the OCSP
1583 responses when the list of filenames has not changed.
1584 The creds-invali on content change wipes file_expanded, so that
1585 always reloads here. */
1587 if ( state->u_ocsp.server.file_expanded && olist
1588 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1590 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1595 ocsp_free_response_list(state);
1596 state->u_ocsp.server.file_expanded = olist;
1600 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1602 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1605 #ifndef DISABLE_OCSP
1607 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1609 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1614 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1619 ocsp_load_response(state, ofile, fmt_pem);
1622 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1626 else /* would there ever be a need for multiple client certs? */
1627 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1630 if ( state->privatekey
1631 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr)
1632 || f.expand_string_forcedfail)
1634 if (f.expand_string_forcedfail)
1635 *errstr = US"expansion of tls_privatekey failed";
1639 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1640 of the expansion is an empty string, ignore it also, and assume the private
1641 key is in the same file as the certificate. */
1643 if (expanded && *expanded)
1644 if (state->is_server)
1646 const uschar * file_list = expanded;
1650 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1651 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1654 else /* would there ever be a need for multiple client certs? */
1655 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1665 /**************************************************
1666 * One-time init credentials for server and client *
1667 **************************************************/
1670 normalise_ciphers(uschar ** ciphers, const uschar * pre_expansion_ciphers)
1672 uschar * s = *ciphers;
1674 if (!s || !Ustrchr(s, '_')) return; /* no change needed */
1676 if (s == pre_expansion_ciphers)
1677 s = string_copy(s); /* get writable copy */
1679 for (uschar * t = s; *t; t++) if (*t == '_') *t = '-';
1684 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1685 uschar * ciphers, uschar ** errstr)
1687 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1688 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1689 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1690 state->server_cipher_list = ciphers;
1697 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1700 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1701 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1703 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1705 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1707 /* Set up the information callback, which outputs if debugging is at a suitable
1712 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1713 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1714 /* this needs a debug build of OpenSSL */
1715 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
1717 #ifdef OPENSSL_HAVE_KEYLOG_CB
1718 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
1722 /* Automatically re-try reads/writes after renegotiation. */
1723 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1730 tls_server_creds_init(void)
1733 uschar * dummy_errstr;
1734 unsigned lifetime = 0;
1738 state_server.lib_state = null_tls_preload;
1740 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1742 state_server.lib_state.lib_ctx = ctx;
1744 /* Preload DH params and EC curve */
1746 if (opt_unset_or_noexpand(tls_dhparam))
1748 DEBUG(D_tls) debug_printf("TLS: preloading DH params for server\n");
1749 if (init_dh(ctx, tls_dhparam, &dummy_errstr))
1750 state_server.lib_state.dh = TRUE;
1753 DEBUG(D_tls) debug_printf("TLS: not preloading DH params for server\n");
1754 if (opt_unset_or_noexpand(tls_eccurve))
1756 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for server\n");
1757 if (init_ecdh(ctx, &dummy_errstr))
1758 state_server.lib_state.ecdh = TRUE;
1761 DEBUG(D_tls) debug_printf("TLS: not preloading ECDH curve for server\n");
1763 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1764 /* If we can, preload the Authorities for checking client certs against.
1765 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1766 at TLS conn startup.
1767 Do this before the server ocsp so that its info can verify the ocsp. */
1769 if ( opt_set_and_noexpand(tls_verify_certificates)
1770 && opt_unset_or_noexpand(tls_crl))
1772 /* Watch the default dir also as they are always included */
1774 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1775 && tls_set_watch(tls_verify_certificates, FALSE)
1776 && tls_set_watch(tls_crl, FALSE))
1778 uschar * v_certs = tls_verify_certificates;
1779 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1781 if (setup_certs(ctx, &v_certs, tls_crl, NULL, &dummy_errstr) == OK)
1782 state_server.lib_state.cabundle = TRUE;
1784 /* If we can, preload the server-side cert, key and ocsp */
1786 if ( opt_set_and_noexpand(tls_certificate)
1787 # ifndef DISABLE_OCSP
1788 && opt_unset_or_noexpand(tls_ocsp_file)
1790 && opt_unset_or_noexpand(tls_privatekey))
1792 /* Set watches on the filenames. The implementation does de-duplication
1793 so we can just blindly do them all. */
1795 if ( tls_set_watch(tls_certificate, TRUE)
1796 # ifndef DISABLE_OCSP
1797 && tls_set_watch(tls_ocsp_file, TRUE)
1799 && tls_set_watch(tls_privatekey, TRUE))
1801 state_server.certificate = tls_certificate;
1802 state_server.privatekey = tls_privatekey;
1803 #ifndef DISABLE_OCSP
1804 state_server.u_ocsp.server.file = tls_ocsp_file;
1807 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1808 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1809 state_server.lib_state.conn_certs = TRUE;
1812 else if ( !tls_certificate && !tls_privatekey
1813 # ifndef DISABLE_OCSP
1817 { /* Generate & preload a selfsigned cert. No files to watch. */
1818 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1820 state_server.lib_state.conn_certs = TRUE;
1821 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1825 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1829 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1832 #endif /* EXIM_HAVE_INOTIFY */
1835 /* If we can, preload the ciphers control string */
1837 if (opt_set_and_noexpand(tls_require_ciphers))
1839 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1840 normalise_ciphers(&tls_require_ciphers, tls_require_ciphers);
1841 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1842 &dummy_errstr) == OK)
1843 state_server.lib_state.pri_string = TRUE;
1846 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1853 /* Preload whatever creds are static, onto a transport. The client can then
1854 just copy the pointer as it starts up.
1855 Called from the daemon after a cache-invalidate with watch set; called from
1856 a queue-run startup with watch clear. */
1859 tls_client_creds_init(transport_instance * t, BOOL watch)
1861 smtp_transport_options_block * ob = t->options_block;
1862 exim_openssl_state_st tpt_dummy_state;
1863 host_item * dummy_host = (host_item *)1;
1864 uschar * dummy_errstr;
1869 ob->tls_preload = null_tls_preload;
1870 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1872 ob->tls_preload.lib_ctx = ctx;
1874 tpt_dummy_state.lib_state = ob->tls_preload;
1876 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1877 if ( opt_set_and_noexpand(ob->tls_certificate)
1878 && opt_unset_or_noexpand(ob->tls_privatekey))
1881 || ( tls_set_watch(ob->tls_certificate, FALSE)
1882 && tls_set_watch(ob->tls_privatekey, FALSE)
1885 uschar * pkey = ob->tls_privatekey;
1888 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1890 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1892 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1893 pkey ? pkey : ob->tls_certificate,
1896 ob->tls_preload.conn_certs = TRUE;
1901 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1904 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1905 && opt_unset_or_noexpand(ob->tls_crl))
1908 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1909 && tls_set_watch(ob->tls_verify_certificates, FALSE)
1910 && tls_set_watch(ob->tls_crl, FALSE)
1913 uschar * v_certs = ob->tls_verify_certificates;
1915 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1917 if (setup_certs(ctx, &v_certs,
1918 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
1919 ob->tls_preload.cabundle = TRUE;
1924 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1926 #endif /*EXIM_HAVE_INOTIFY*/
1930 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1931 /* Invalidate the creds cached, by dropping the current ones.
1932 Call when we notice one of the source files has changed. */
1935 tls_server_creds_invalidate(void)
1937 SSL_CTX_free(state_server.lib_state.lib_ctx);
1938 state_server.lib_state = null_tls_preload;
1939 #ifndef DISABLE_OCSP
1940 state_server.u_ocsp.server.file_expanded = NULL;
1946 tls_client_creds_invalidate(transport_instance * t)
1948 smtp_transport_options_block * ob = t->options_block;
1949 SSL_CTX_free(ob->tls_preload.lib_ctx);
1950 ob->tls_preload = null_tls_preload;
1956 tls_server_creds_invalidate(void)
1960 tls_client_creds_invalidate(transport_instance * t)
1963 #endif /*EXIM_HAVE_INOTIFY*/
1968 #ifndef DISABLE_OCSP
1970 debug_print_sn(const X509 * cert)
1972 X509_NAME * sn = X509_get_subject_name((X509 *)cert);
1973 static uschar name[256];
1974 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
1976 name[sizeof(name)-1] = '\0';
1977 debug_printf(" %s\n", name);
1982 x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk)
1985 debug_printf(" (null)\n");
1988 int idx = sk_X509_num(sk);
1990 debug_printf(" (empty)\n");
1992 while (--idx >= 0) debug_print_sn(sk_X509_value(sk, idx));
1997 x509_store_dump_cert_s_names(X509_STORE * store)
1999 # ifdef EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
2001 debug_printf(" (no store)\n");
2004 STACK_OF(X509) * sk = X509_STORE_get1_all_certs(store);
2005 x509_stack_dump_cert_s_names(sk);
2006 sk_X509_pop_free(sk, X509_free);
2010 #endif /*!DISABLE_OCSP*/
2015 #ifndef DISABLE_TLS_RESUME
2016 /* Manage the keysets used for encrypting the session tickets, on the server. */
2018 typedef struct { /* Session ticket encryption key */
2021 const EVP_CIPHER * aes_cipher;
2022 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
2023 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2024 const EVP_MD * hmac_hash;
2026 const uschar * hmac_hashname;
2028 uschar hmac_key[16];
2033 static exim_stek exim_tk; /* current key */
2034 static exim_stek exim_tk_old; /* previous key */
2039 time_t t = time(NULL);
2041 if (exim_tk.name[0])
2043 if (exim_tk.renew >= t) return;
2044 exim_tk_old = exim_tk;
2047 if (f.running_in_test_harness) ssl_session_timeout = 6;
2049 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
2050 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
2051 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
2052 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
2054 exim_tk.name[0] = 'E';
2055 exim_tk.aes_cipher = EVP_aes_256_cbc();
2056 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2057 exim_tk.hmac_hash = EVP_sha256();
2059 exim_tk.hmac_hashname = US "sha256";
2061 exim_tk.expire = t + ssl_session_timeout;
2062 exim_tk.renew = t + ssl_session_timeout/2;
2068 if (!exim_tk.name[0]) return NULL;
2073 tk_find(const uschar * name)
2075 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
2076 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
2083 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2091 /*XXX will want these dependent on the ssl session strength */
2092 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2093 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2094 key->hmac_hash, NULL);
2097 OSSL_PARAM params[3];
2098 uschar * hk = string_copy(key->hmac_hashname); /* need nonconst */
2099 params[0] = OSSL_PARAM_construct_octet_string("key", key->hmac_key, sizeof(key->hmac_key));
2100 params[1] = OSSL_PARAM_construct_utf8_string("digest", CS hk, 0);
2101 params[2] = OSSL_PARAM_construct_end();
2102 if (EVP_MAC_CTX_set_params(hctx, params) == 0)
2104 DEBUG(D_tls) debug_printf("EVP_MAC_CTX_set_params: %s\n",
2105 ERR_reason_error_string(ERR_get_error()));
2106 return 0; /* error in mac initialisation */
2113 /* Callback for session tickets, on server */
2115 ticket_key_callback(SSL * ssl, uschar key_name[16],
2116 uschar * iv, EVP_CIPHER_CTX * c_ctx,
2117 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2124 tls_support * tlsp = state_server.tlsp;
2129 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
2130 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2132 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
2133 return -1; /* insufficient random */
2135 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
2136 return 0; /* key couldn't be created */
2137 memcpy(key_name, key->name, 16);
2138 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
2140 if (tk_hmac_init(hctx, key) == 0) return 0;
2141 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2143 DEBUG(D_tls) debug_printf("ticket created\n");
2148 time_t now = time(NULL);
2150 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
2151 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2153 if (!(key = tk_find(key_name)) || key->expire < now)
2157 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
2158 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
2163 if (tk_hmac_init(hctx, key) == 0) return 0;
2164 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2166 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2168 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2169 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2170 be better. To do that we'd have to encode ticket lifetime in the name as
2171 we don't yet see the restored session. Could check posthandshake for TLS1.3
2172 and trigger a new ticket then, but cannot do that for TLS1.2 */
2173 return key->renew < now ? 2 : 1;
2176 #endif /* !DISABLE_TLS_RESUME */
2181 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2182 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2184 /* If verification is optional, don't fail if no certificate */
2186 SSL_CTX_set_verify(ctx,
2187 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2192 /*************************************************
2193 * Callback to handle SNI *
2194 *************************************************/
2196 /* Called when acting as server during the TLS session setup if a Server Name
2197 Indication extension was sent by the client.
2199 API documentation is OpenSSL s_server.c implementation.
2202 s SSL* of the current session
2203 ad unknown (part of OpenSSL API) (unused)
2204 arg Callback of "our" registered data
2206 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2208 XXX might need to change to using ClientHello callback,
2209 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2212 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2214 tls_servername_cb(SSL * s, int * ad ARG_UNUSED, void * arg)
2216 const char * servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2217 exim_openssl_state_st * state = (exim_openssl_state_st *) arg;
2219 int old_pool = store_pool;
2223 return SSL_TLSEXT_ERR_OK;
2225 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2226 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2228 /* Make the extension value available for expansion */
2229 store_pool = POOL_PERM;
2230 tls_in.sni = string_copy_taint(US servername, GET_TAINTED);
2231 store_pool = old_pool;
2233 if (!reexpand_tls_files_for_sni)
2234 return SSL_TLSEXT_ERR_OK;
2236 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2237 not confident that memcpy wouldn't break some internal reference counting.
2238 Especially since there's a references struct member, which would be off. */
2240 if (lib_ctx_new(&server_sni, NULL, &errstr) != OK)
2243 /* Not sure how many of these are actually needed, since SSL object
2244 already exists. Might even need this selfsame callback, for reneg? */
2247 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2248 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2249 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2250 #ifdef OPENSSL_MIN_PROTO_VERSION
2251 SSL_CTX_set_min_proto_version(server_sni, SSL3_VERSION);
2253 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2254 SSL_CTX_clear_options(server_sni, ~SSL_CTX_get_options(ctx));
2255 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2256 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2257 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2260 if ( !init_dh(server_sni, state->dhparam, &errstr)
2261 || !init_ecdh(server_sni, &errstr)
2265 if ( state->server_cipher_list
2266 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2269 #ifndef DISABLE_OCSP
2270 if (state->u_ocsp.server.file)
2272 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2273 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2278 uschar * v_certs = tls_verify_certificates;
2279 if ((rc = setup_certs(server_sni, &v_certs, tls_crl, NULL,
2283 if (v_certs && *v_certs)
2284 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2287 /* do this after setup_certs, because this can require the certs for verifying
2288 OCSP information. */
2289 if ((rc = tls_expand_session_files(server_sni, state, &errstr)) != OK)
2292 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2293 SSL_set_SSL_CTX(s, server_sni);
2294 return SSL_TLSEXT_ERR_OK;
2297 log_write(0, LOG_MAIN|LOG_PANIC, "%s", errstr);
2298 return SSL_TLSEXT_ERR_ALERT_FATAL;
2300 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2305 #ifdef EXIM_HAVE_ALPN
2306 /*************************************************
2307 * Callback to handle ALPN *
2308 *************************************************/
2310 /* Called on server if tls_alpn nonblank after expansion,
2311 when client offers ALPN, after the SNI callback.
2312 If set and not matching the list then we dump the connection */
2315 tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen,
2316 const uschar * in, unsigned int inlen, void * arg)
2318 server_seen_alpn = TRUE;
2321 debug_printf("Received TLS ALPN offer:");
2322 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2325 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2326 debug_printf(" '%.*s'", siz, in + pos + 1);
2328 debug_printf(". Our list: '%s'\n", tls_alpn);
2331 /* Look for an acceptable ALPN */
2333 if ( inlen > 1 /* at least one name */
2334 && in[0]+1 == inlen /* filling the vector, so exactly one name */
2337 const uschar * list = tls_alpn;
2339 for (uschar * name; name = string_nextinlist(&list, &sep, NULL, 0); )
2340 if (Ustrncmp(in+1, name, in[0]) == 0)
2342 *out = in+1; /* we checked for exactly one, so can just point to it */
2344 return SSL_TLSEXT_ERR_OK; /* use ALPN */
2348 /* More than one name from clilent, or name did not match our list. */
2350 /* This will be fatal to the TLS conn; would be nice to kill TCP also.
2351 Maybe as an option in future; for now leave control to the config (must-tls). */
2353 DEBUG(D_tls) debug_printf("TLS ALPN rejected\n");
2354 return SSL_TLSEXT_ERR_ALERT_FATAL;
2356 #endif /* EXIM_HAVE_ALPN */
2360 #ifndef DISABLE_OCSP
2362 /*************************************************
2363 * Callback to handle OCSP Stapling *
2364 *************************************************/
2366 /* Called when acting as server during the TLS session setup if the client
2367 requests OCSP information with a Certificate Status Request.
2369 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2375 tls_server_stapling_cb(SSL *s, void *arg)
2377 const exim_openssl_state_st * state = arg;
2378 ocsp_resplist * olist = state->u_ocsp.server.olist;
2379 uschar * response_der; /*XXX blob */
2380 int response_der_len;
2383 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2384 olist ? "have" : "lack");
2386 tls_in.ocsp = OCSP_NOT_RESP;
2388 return SSL_TLSEXT_ERR_NOACK;
2390 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
2392 const X509 * cert_sent = SSL_get_certificate(s);
2393 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2394 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2396 for (; olist; olist = olist->next)
2398 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2399 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2400 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2401 ASN1_INTEGER * res_cert_serial;
2402 const BIGNUM * resp_bn;
2403 ASN1_OCTET_STRING * res_cert_iNameHash;
2406 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2407 (OCSP_CERTID *) cid);
2408 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2412 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2413 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2416 if (BN_cmp(cert_bn, resp_bn) == 0)
2418 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2420 /*XXX TODO: check the rest of the list for duplicate matches.
2421 If any, need to also check the Issuer Name hash.
2422 Without this, we will provide the wrong status in the case of
2427 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2431 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2432 return SSL_TLSEXT_ERR_NOACK;
2438 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2439 return SSL_TLSEXT_ERR_NOACK;
2443 /*XXX could we do the i2d earlier, rather than during the callback? */
2444 response_der = NULL;
2445 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2446 if (response_der_len <= 0)
2447 return SSL_TLSEXT_ERR_NOACK;
2449 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2450 response_der, response_der_len);
2451 tls_in.ocsp = OCSP_VFIED;
2452 return SSL_TLSEXT_ERR_OK;
2457 add_chain_to_store(X509_STORE * store, STACK_OF(X509) * sk,
2458 const char * debug_text)
2464 debug_printf("chain for %s:\n", debug_text);
2465 x509_stack_dump_cert_s_names(sk);
2468 if ((idx = sk_X509_num(sk)) > 0)
2470 X509_STORE_add_cert(store, sk_X509_value(sk, idx));
2475 tls_client_stapling_cb(SSL * ssl, void * arg)
2477 exim_openssl_state_st * cbinfo = arg;
2478 const unsigned char * p;
2480 OCSP_RESPONSE * rsp;
2481 OCSP_BASICRESP * bs;
2484 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2485 len = SSL_get_tlsext_status_ocsp_resp(ssl, &p);
2487 { /* Expect this when we requested ocsp but got none */
2488 if (SSL_session_reused(ssl) && tls_out.ocsp == OCSP_VFIED)
2490 DEBUG(D_tls) debug_printf(" null, but resumed; ocsp vfy stored with session is good\n");
2494 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2495 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2497 DEBUG(D_tls) debug_printf(" null\n");
2499 if (!cbinfo->u_ocsp.client.verify_required)
2501 cbinfo->u_ocsp.client.verify_errstr =
2502 US"(SSL_connect) Required TLS certificate status not received";
2506 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2508 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2509 if (LOGGING(tls_cipher))
2510 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2512 DEBUG(D_tls) debug_printf(" parse error\n");
2516 if (!(bs = OCSP_response_get1_basic(rsp)))
2518 tls_out.ocsp = OCSP_FAILED;
2519 if (LOGGING(tls_cipher))
2520 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2522 DEBUG(D_tls) debug_printf(" error parsing response\n");
2523 OCSP_RESPONSE_free(rsp);
2527 /* We'd check the nonce here if we'd put one in the request. */
2528 /* However that would defeat cacheability on the server so we don't. */
2530 /* This section of code reworked from OpenSSL apps source;
2531 The OpenSSL Project retains copyright:
2532 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2536 X509_STORE * verify_store = NULL;
2537 BOOL have_verified_OCSP_signer = FALSE;
2538 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2539 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2542 DEBUG(D_tls) bp = BIO_new(BIO_s_mem());
2544 /* Use the CA & chain that verified the server cert to verify the stapled info */
2545 /*XXX could we do an event here, for observability of ocsp? What reasonable data could we give access to? */
2546 /* Dates would be a start. Do we need another opaque variable type, as for certs, plus an extract expansion? */
2549 /* If this routine is not available, we've avoided [in tls_client_start()]
2550 asking for certificate-status under DANE, so this callback won't run for
2551 that combination. It still will for non-DANE. */
2553 #ifdef EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER
2556 if ( tls_out.dane_verified
2557 && (have_verified_OCSP_signer =
2558 OCSP_resp_get0_signer(bs, &signer, SSL_get0_verified_chain(ssl)) == 1))
2561 debug_printf("signer for OCSP basicres is in the verified chain;"
2562 " shortcut its verification\n");
2567 STACK_OF(X509) * verified_chain;
2569 verify_store = X509_STORE_new();
2571 SSL_get0_chain_certs(ssl, &verified_chain);
2572 add_chain_to_store(verify_store, verified_chain,
2573 "'current cert' per SSL_get0_chain_certs()");
2574 #ifdef EXIM_HAVE_SSL_GET0_VERIFIED_CHAIN
2575 verified_chain = SSL_get0_verified_chain(ssl);
2576 add_chain_to_store(verify_store, verified_chain,
2577 "SSL_get0_verified_chain()");
2584 debug_printf("Untrusted intermediate cert stack (from SSL_get_peer_cert_chain()):\n");
2585 x509_stack_dump_cert_s_names(SSL_get_peer_cert_chain(ssl));
2587 debug_printf("will use this CA store for verifying basicresp:\n");
2588 x509_store_dump_cert_s_names(verify_store);
2590 /* OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2592 debug_printf("certs contained in basicresp:\n");
2593 x509_stack_dump_cert_s_names(
2594 #ifdef EXIM_HAVE_OPESSL_OCSP_RESP_GET0_CERTS
2595 OCSP_resp_get0_certs(bs)
2601 #ifdef EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
2602 /* could do via X509_STORE_get0_objects(); not worth it just for debug info */
2605 if (OCSP_resp_get0_signer(bs, &signer, X509_STORE_get1_all_certs(verify_store)) == 1)
2607 debug_printf("found signer for basicres:\n");
2608 debug_print_sn(signer);
2612 debug_printf("failed to find signer for basicres:\n");
2613 ERR_print_errors(bp);
2622 /* Under DANE the trust-anchor (at least in TA mode) is indicated by the TLSA
2623 record in DNS, and probably is not the root of the chain of certificates. So
2624 accept a partial chain for that case (and hope that anchor is visible for
2625 verifying the OCSP stapling).
2626 XXX for EE mode it won't even be that. Does that make OCSP useless for EE?
2628 Worse, for LetsEncrypt-mode (ocsp signer is leaf-signer) under DANE, the
2629 data used within OpenSSL for the signer has nil pointers for signing
2630 algorithms - and a crash results. Avoid this by shortcutting verification,
2631 having determined that the OCSP signer is in the (DANE-)validated set.
2634 #ifndef OCSP_PARTIAL_CHAIN /* defined for 3.0.0 onwards */
2635 # define OCSP_PARTIAL_CHAIN 0
2638 if ((i = OCSP_basic_verify(bs, SSL_get_peer_cert_chain(ssl),
2641 tls_out.dane_verified
2642 ? have_verified_OCSP_signer
2643 ? OCSP_NOVERIFY | OCSP_NOEXPLICIT
2644 : OCSP_PARTIAL_CHAIN | OCSP_NOEXPLICIT
2647 OCSP_NOEXPLICIT)) <= 0)
2649 DEBUG(D_tls) debug_printf("OCSP_basic_verify() fail: returned %d\n", i);
2650 if (ERR_peek_error())
2652 tls_out.ocsp = OCSP_FAILED;
2653 if (LOGGING(tls_cipher))
2655 static uschar peerdn[256];
2656 const uschar * errstr;;
2658 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
2659 ERR_peek_error_all(NULL, NULL, NULL, CCSS &errstr, NULL);
2662 errstr = CUS ERR_reason_error_string(ERR_peek_error());
2664 X509_NAME_oneline(X509_get_subject_name(SSL_get_peer_certificate(ssl)),
2665 CS peerdn, sizeof(peerdn));
2666 log_write(0, LOG_MAIN,
2667 "[%s] %s Received TLS cert (DN: '%.*s') status response, "
2668 "itself unverifiable: %s",
2669 deliver_host_address, deliver_host,
2670 (int)sizeof(peerdn), peerdn, errstr);
2674 BIO_printf(bp, "OCSP response verify failure\n");
2675 ERR_print_errors(bp);
2678 int len = (int) BIO_get_mem_data(bp, CSS &s);
2679 if (len > 0) debug_printf("%.*s", len, s);
2682 OCSP_RESPONSE_print(bp, rsp, 0);
2687 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2688 " in the root CA certificate; ignoring\n");
2691 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2693 /*XXX So we have a good stapled OCSP status. How do we know
2694 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2695 OCSP_resp_find_status() which matches on a cert id, which presumably
2696 we should use. Making an id needs OCSP_cert_id_new(), which takes
2697 issuerName, issuerKey, serialNumber. Are they all in the cert?
2699 For now, carry on blindly accepting the resp. */
2702 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2703 OCSP_resp_count(bs) - 1;
2705 sk_OCSP_SINGLERESP_num(sresp) - 1;
2709 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2711 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2713 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2714 - but what happens with a GnuTLS-style input?
2716 we could do with a debug label for each singleresp
2717 - it has a certID with a serialNumber, but I see no API to get that
2719 status = OCSP_single_get0_status(single, &reason, &rev,
2720 &thisupd, &nextupd);
2724 time_print(bp, "This OCSP Update", thisupd);
2725 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
2727 if (!OCSP_check_validity(thisupd, nextupd,
2728 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2730 tls_out.ocsp = OCSP_FAILED;
2731 DEBUG(D_tls) ERR_print_errors(bp);
2732 cbinfo->u_ocsp.client.verify_errstr =
2733 US"(SSL_connect) Server certificate status is out-of-date";
2734 log_write(0, LOG_MAIN, "OCSP dates invalid");
2738 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2739 OCSP_cert_status_str(status));
2742 case V_OCSP_CERTSTATUS_GOOD:
2743 continue; /* the idx loop */
2744 case V_OCSP_CERTSTATUS_REVOKED:
2745 cbinfo->u_ocsp.client.verify_errstr =
2746 US"(SSL_connect) Server certificate revoked";
2747 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2748 reason != -1 ? "; reason: " : "",
2749 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2750 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2753 cbinfo->u_ocsp.client.verify_errstr =
2754 US"(SSL_connect) Server certificate has unknown status";
2755 log_write(0, LOG_MAIN,
2756 "Server certificate status unknown, in OCSP stapling");
2764 tls_out.ocsp = OCSP_VFIED;
2768 tls_out.ocsp = OCSP_FAILED;
2769 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2773 int len = (int) BIO_get_mem_data(bp, CSS &s);
2774 if (len > 0) debug_printf("%.*s", len, s);
2779 OCSP_RESPONSE_free(rsp);
2782 #endif /*!DISABLE_OCSP*/
2785 /*************************************************
2786 * Initialize for TLS *
2787 *************************************************/
2788 /* Called from both server and client code, to do preliminary initialization
2789 of the library. We allocate and return a context structure.
2792 host connected host, if client; NULL if server
2793 ob transport options block, if client; NULL if server
2794 ocsp_file file of stapling info (server); flag for require ocsp (client)
2795 addr address if client; NULL if server (for some randomness)
2796 caller_state place to put pointer to allocated state-struct
2797 errstr error string pointer
2799 Returns: OK/DEFER/FAIL
2803 tls_init(host_item * host, smtp_transport_options_block * ob,
2804 #ifndef DISABLE_OCSP
2807 address_item *addr, exim_openssl_state_st ** caller_state,
2808 tls_support * tlsp, uschar ** errstr)
2811 exim_openssl_state_st * state;
2814 if (host) /* client */
2816 state = store_malloc(sizeof(exim_openssl_state_st));
2817 memset(state, 0, sizeof(*state));
2818 state->certificate = ob->tls_certificate;
2819 state->privatekey = ob->tls_privatekey;
2820 state->is_server = FALSE;
2821 state->dhparam = NULL;
2822 state->lib_state = ob->tls_preload;
2826 state = &state_server;
2827 state->certificate = tls_certificate;
2828 state->privatekey = tls_privatekey;
2829 state->is_server = TRUE;
2830 state->dhparam = tls_dhparam;
2831 state->lib_state = state_server.lib_state;
2837 if (!state->lib_state.pri_string)
2838 state->server_cipher_list = NULL;
2840 #ifndef DISABLE_EVENT
2841 state->event_action = NULL;
2846 /* It turns out that we need to seed the random number generator this early in
2847 order to get the full complement of ciphers to work. It took me roughly a day
2848 of work to discover this by experiment.
2850 On systems that have /dev/urandom, SSL may automatically seed itself from
2851 there. Otherwise, we have to make something up as best we can. Double check
2854 Although we likely called this before, at daemon startup, this is a chance
2855 to mix in further variable info (time, pid) if needed. */
2857 if (!lib_rand_init(addr))
2858 return tls_error(US"RAND_status", host,
2859 US"unable to seed random number generator", errstr);
2861 /* Apply administrator-supplied work-arounds.
2862 Historically we applied just one requested option,
2863 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2864 moved to an administrator-controlled list of options to specify and
2865 grandfathered in the first one as the default value for "openssl_options".
2867 No OpenSSL version number checks: the options we accept depend upon the
2868 availability of the option value macros from OpenSSL. */
2871 if (!tls_openssl_options_parse(openssl_options, &init_options))
2872 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2874 /* Create a context.
2875 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2876 negotiation in the different methods; as far as I can tell, the only
2877 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2878 when OpenSSL is built without SSLv2 support.
2879 By disabling with openssl_options, we can let admins re-enable with the
2882 if (!(ctx = state->lib_state.lib_ctx))
2884 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2886 state->lib_state.lib_ctx = ctx;
2889 #ifndef DISABLE_TLS_RESUME
2890 tlsp->resumption = RESUME_SUPPORTED;
2894 #ifndef DISABLE_TLS_RESUME
2895 /* Should the server offer session resumption? */
2896 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2898 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2899 init_options &= ~SSL_OP_NO_TICKET;
2900 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2901 tlsp->host_resumable = TRUE;
2905 #ifdef OPENSSL_MIN_PROTO_VERSION
2906 SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
2908 DEBUG(D_tls) debug_printf("setting SSL CTX options: %016lx\n", init_options);
2909 SSL_CTX_set_options(ctx, init_options);
2911 uint64_t readback = SSL_CTX_clear_options(ctx, ~init_options);
2912 if (readback != init_options)
2913 return tls_error(string_sprintf(
2914 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2918 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2920 /* We'd like to disable session cache unconditionally, but foolish Outlook
2921 Express clients then give up the first TLS connection and make a second one
2922 (which works). Only when there is an IMAP service on the same machine.
2923 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2924 now, until we work out a decent way of presenting control to the config. It
2925 will never be used because we use a new context every time. */
2927 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2930 /* Initialize with DH parameters if supplied */
2931 /* Initialize ECDH temp key parameter selection */
2935 if (state->lib_state.dh)
2936 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2938 if (!init_dh(ctx, state->dhparam, errstr)) return DEFER;
2940 if (state->lib_state.ecdh)
2941 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
2943 if (!init_ecdh(ctx, errstr)) return DEFER;
2946 /* Set up certificate and key (and perhaps OCSP info) */
2948 if (state->lib_state.conn_certs)
2951 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
2955 #ifndef DISABLE_OCSP
2956 if (!host) /* server */
2958 state->u_ocsp.server.file = ocsp_file;
2959 state->u_ocsp.server.file_expanded = NULL;
2960 state->u_ocsp.server.olist = NULL;
2963 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
2966 /* If we need to handle SNI or OCSP, do so */
2968 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2969 # ifndef DISABLE_OCSP
2970 if (!host && !(state->u_ocsp.server.verify_stack = sk_X509_new_null()))
2972 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2977 if (!host) /* server */
2979 # ifndef DISABLE_OCSP
2980 /* We check u_ocsp.server.file, not server.olist, because we care about if
2981 the option exists, not what the current expansion might be, as SNI might
2982 change the certificate and OCSP file in use between now and the time the
2983 callback is invoked. */
2984 if (state->u_ocsp.server.file)
2986 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2987 SSL_CTX_set_tlsext_status_arg(ctx, state);
2990 /* We always do this, so that $tls_sni is available even if not used in
2992 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2993 SSL_CTX_set_tlsext_servername_arg(ctx, state);
2995 # ifdef EXIM_HAVE_ALPN
2996 if (tls_alpn && *tls_alpn)
2999 if ( expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr)
3000 && *exp_alpn && !isblank(*exp_alpn))
3002 tls_alpn = exp_alpn; /* subprocess so ok to overwrite */
3003 SSL_CTX_set_alpn_select_cb(ctx, tls_server_alpn_cb, state);
3010 # ifndef DISABLE_OCSP
3012 if(ocsp_file) /* wanting stapling */
3014 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
3016 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
3020 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
3021 SSL_CTX_set_tlsext_status_arg(ctx, state);
3024 #endif /*EXIM_HAVE_OPENSSL_TLSEXT*/
3026 state->verify_cert_hostnames = NULL;
3028 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
3029 /* Set up the RSA callback */
3030 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
3033 /* Finally, set the session cache timeout, and we are done.
3034 The period appears to be also used for (server-generated) session tickets */
3036 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
3037 DEBUG(D_tls) debug_printf("Initialized TLS\n");
3039 *caller_state = state;
3047 /*************************************************
3048 * Get name of cipher in use *
3049 *************************************************/
3052 Argument: pointer to an SSL structure for the connection
3053 pointer to number of bits for cipher
3054 Returns: pointer to allocated string in perm-pool
3058 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
3060 int pool = store_pool;
3061 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
3062 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
3063 the accessor functions use const in the prototype. */
3065 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
3068 SSL_CIPHER_get_bits(c, bits);
3070 store_pool = POOL_PERM;
3071 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
3073 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
3078 /* Get IETF-standard name for ciphersuite.
3079 Argument: pointer to an SSL structure for the connection
3080 Returns: pointer to string
3083 static const uschar *
3084 cipher_stdname_ssl(SSL * ssl)
3086 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
3087 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
3089 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
3090 return cipher_stdname(id >> 8, id & 0xff);
3095 static const uschar *
3096 tlsver_name(SSL * ssl)
3099 int pool = store_pool;
3101 store_pool = POOL_PERM;
3102 s = string_copy(US SSL_get_version(ssl));
3104 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
3105 for (;; p++) if (!(*p = p[1])) break;
3111 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
3113 /*XXX we might consider a list-of-certs variable for the cert chain.
3114 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
3115 in list-handling functions, also consider the difference between the entire
3116 chain and the elements sent by the peer. */
3118 tlsp->peerdn = NULL;
3120 /* Will have already noted peercert on a verify fail; possibly not the leaf */
3121 if (!tlsp->peercert)
3122 tlsp->peercert = SSL_get_peer_certificate(ssl);
3123 /* Beware anonymous ciphers which lead to server_cert being NULL */
3125 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
3126 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
3129 int oldpool = store_pool;
3131 peerdn[siz-1] = '\0'; /* paranoia */
3132 store_pool = POOL_PERM;
3133 tlsp->peerdn = string_copy(peerdn);
3134 store_pool = oldpool;
3136 /* We used to set CV in the cert-verify callbacks (either plain or dane)
3137 but they don't get called on session-resumption. So use the official
3138 interface, which uses the resumed value. Unfortunately this claims verified
3139 when it actually failed but we're in try-verify mode, due to us wanting the
3140 knowlege that it failed so needing to have the callback and forcing a
3141 permissive return. If we don't force it, the TLS startup is failed.
3142 The extra bit of information is set in verify_override in the cb, stashed
3143 for resumption next to the TLS session, and used here. */
3145 if (!tlsp->verify_override)
3146 tlsp->certificate_verified =
3148 tlsp->dane_verified ||
3150 SSL_get_verify_result(ssl) == X509_V_OK;
3158 /*************************************************
3159 * Set up for verifying certificates *
3160 *************************************************/
3162 #ifndef DISABLE_OCSP
3163 /* In the server, load certs from file, return TRUE on success */
3166 chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
3169 STACK_OF(X509) * verify_stack = *vp;
3172 while (sk_X509_num(verify_stack) > 0)
3173 X509_free(sk_X509_pop(verify_stack));
3175 verify_stack = sk_X509_new_null();
3177 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
3178 for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
3179 sk_X509_push(verify_stack, x);
3188 /* Called by both client and server startup; on the server possibly
3189 repeated after a Server Name Indication.
3192 sctx SSL_CTX* to initialise
3193 certsp certs file, returned expanded
3194 crl CRL file or NULL
3195 host NULL in a server; the remote host in a client
3196 errstr error string pointer
3198 Returns: OK/DEFER/FAIL
3202 setup_certs(SSL_CTX * sctx, uschar ** certsp, uschar * crl, host_item * host,
3205 uschar * expcerts, * expcrl;
3207 if (!expand_check(*certsp, US"tls_verify_certificates", &expcerts, errstr))
3209 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3212 if (expcerts && *expcerts)
3214 /* Tell the library to use its compiled-in location for the system default
3215 CA bundle. Then add the ones specified in the config, if any. */
3217 if (!SSL_CTX_set_default_verify_paths(sctx))
3218 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
3220 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
3222 struct stat statbuf;
3224 if (Ustat(expcerts, &statbuf) < 0)
3226 log_write(0, LOG_MAIN|LOG_PANIC,
3227 "failed to stat %s for certificates", expcerts);
3233 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
3234 { file = NULL; dir = expcerts; }
3237 STACK_OF(X509) * verify_stack =
3238 #ifndef DISABLE_OCSP
3239 !host ? state_server.u_ocsp.server.verify_stack :
3242 STACK_OF(X509) ** vp = &verify_stack;
3244 file = expcerts; dir = NULL;
3245 #ifndef DISABLE_OCSP
3246 /* In the server if we will be offering an OCSP proof; load chain from
3247 file for verifying the OCSP proof at load time. */
3249 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
3250 This is inconsistent with the need to verify the OCSP proof of the server cert.
3252 /* *debug_printf("file for checking server ocsp stapling is: %s\n", file); */
3254 && statbuf.st_size > 0
3255 && state_server.u_ocsp.server.file
3256 && !chain_from_pem_file(file, vp)
3259 log_write(0, LOG_MAIN|LOG_PANIC,
3260 "failed to load cert chain from %s", file);
3266 /* If a certificate file is empty, the load function fails with an
3267 unhelpful error message. If we skip it, we get the correct behaviour (no
3268 certificates are recognized, but the error message is still misleading (it
3269 says no certificate was supplied). But this is better. */
3271 if ( (!file || statbuf.st_size > 0)
3272 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
3273 return tls_error(US"SSL_CTX_load_verify_locations",
3274 host, NULL, errstr);
3276 /* On the server load the list of CAs for which we will accept certs, for
3277 sending to the client. This is only for the one-file
3278 tls_verify_certificates variant.
3279 If a list isn't loaded into the server, but some verify locations are set,
3280 the server end appears to make a wildcard request for client certs.
3281 Meanwhile, the client library as default behaviour *ignores* the list
3282 we send over the wire - see man SSL_CTX_set_client_cert_cb.
3283 Because of this, and that the dir variant is likely only used for
3284 the public-CA bundle (not for a private CA), not worth fixing. */
3288 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
3289 int i = sk_X509_NAME_num(names);
3291 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
3292 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
3293 i, i>1 ? "ies":"y");
3297 debug_printf("Added dir for additional certificate authorities\n");
3301 /* Handle a certificate revocation list. */
3303 #if OPENSSL_VERSION_NUMBER > 0x00907000L
3305 /* This bit of code is now the version supplied by Lars Mainka. (I have
3306 merely reformatted it into the Exim code style.)
3308 "From here I changed the code to add support for multiple crl's
3309 in pem format in one file or to support hashed directory entries in
3310 pem format instead of a file. This method now uses the library function
3311 X509_STORE_load_locations to add the CRL location to the SSL context.
3312 OpenSSL will then handle the verify against CA certs and CRLs by
3313 itself in the verify callback." */
3315 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
3316 if (expcrl && *expcrl)
3318 struct stat statbufcrl;
3319 if (Ustat(expcrl, &statbufcrl) < 0)
3321 log_write(0, LOG_MAIN|LOG_PANIC,
3322 "failed to stat %s for certificates revocation lists", expcrl);
3327 /* is it a file or directory? */
3329 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
3330 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
3334 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
3340 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
3342 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
3343 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
3345 /* setting the flags to check against the complete crl chain */
3347 X509_STORE_set_flags(cvstore,
3348 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
3352 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3361 tls_dump_keylog(SSL * ssl)
3363 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3364 BIO * bp = BIO_new(BIO_s_mem());
3367 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3368 len = (int) BIO_get_mem_data(bp, CSS &s);
3369 if (len > 0) debug_printf("%.*s", len, s);
3375 /* Channel-binding info for authenticators
3376 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/
3381 tls_get_channel_binding(SSL * ssl, tls_support * tlsp, const void * taintval)
3386 #ifdef EXIM_HAVE_EXPORT_CHNL_BNGNG
3387 if (SSL_version(ssl) > TLS1_2_VERSION)
3389 /* It's not documented by OpenSSL how big the output buffer must be.
3390 The OpenSSL testcases use 80 bytes but don't say why. The GnuTLS impl only
3391 serves out 32B. RFC 9266 says it is 32B.
3392 Interop fails unless we use the same each end. */
3395 tlsp->channelbind_exporter = TRUE;
3396 taintval = GET_UNTAINTED;
3397 if (SSL_export_keying_material(ssl,
3398 s = store_get((int)len, taintval), len,
3399 "EXPORTER-Channel-Binding", (size_t) 24,
3406 len = SSL_get_peer_finished(ssl, &c, 0);
3407 len = SSL_get_peer_finished(ssl, s = store_get((int)len, taintval), len);
3412 int old_pool = store_pool;
3413 store_pool = POOL_PERM;
3414 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, taintval);
3415 store_pool = old_pool;
3416 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
3421 /*************************************************
3422 * Start a TLS session in a server *
3423 *************************************************/
3424 /* This is called when Exim is running as a server, after having received
3425 the STARTTLS command. It must respond to that command, and then negotiate
3429 errstr pointer to error message
3431 Returns: OK on success
3432 DEFER for errors before the start of the negotiation
3433 FAIL for errors during the negotiation; the server can't
3438 tls_server_start(uschar ** errstr)
3441 uschar * expciphers;
3442 exim_openssl_state_st * dummy_statep;
3445 static uschar peerdn[256];
3447 /* Check for previous activation */
3449 if (tls_in.active.sock >= 0)
3451 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3452 smtp_printf("554 Already in TLS\r\n", FALSE);
3456 /* Initialize the SSL library. If it fails, it will already have logged
3459 rc = tls_init(NULL, NULL,
3460 #ifndef DISABLE_OCSP
3463 NULL, &dummy_statep, &tls_in, errstr);
3464 if (rc != OK) return rc;
3465 ctx = state_server.lib_state.lib_ctx;
3467 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3468 were historically separated by underscores. So that I can use either form in my
3469 tests, and also for general convenience, we turn underscores into hyphens here.
3471 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3472 for TLS 1.3 . Since we do not call it at present we get the default list:
3473 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3476 if (state_server.lib_state.pri_string)
3477 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3480 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3485 normalise_ciphers(&expciphers, tls_require_ciphers);
3486 if ((rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3491 /* If this is a host for which certificate verification is mandatory or
3492 optional, set up appropriately. */
3494 tls_in.certificate_verified = FALSE;
3496 tls_in.dane_verified = FALSE;
3498 server_verify_callback_called = FALSE;
3500 if (verify_check_host(&tls_verify_hosts) == OK)
3501 server_verify_optional = FALSE;
3502 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3503 server_verify_optional = TRUE;
3508 uschar * v_certs = tls_verify_certificates;
3510 if (state_server.lib_state.cabundle)
3512 DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n");
3513 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3517 if ((rc = setup_certs(ctx, &v_certs, tls_crl, NULL, errstr)) != OK)
3519 if (v_certs && *v_certs)
3520 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3525 #ifndef DISABLE_TLS_RESUME
3526 # if OPENSSL_VERSION_NUMBER < 0x30000000L
3527 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3528 /* despite working, appears to always return failure, so ignoring */
3530 SSL_CTX_set_tlsext_ticket_key_evp_cb(ctx, ticket_key_callback);
3531 /* despite working, appears to always return failure, so ignoring */
3535 #ifdef OPENSSL_HAVE_NUM_TICKETS
3536 # ifndef DISABLE_TLS_RESUME
3537 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3539 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3544 /* Prepare for new connection */
3546 if (!(ssl = SSL_new(ctx)))
3547 return tls_error(US"SSL_new", NULL, NULL, errstr);
3548 state_server.lib_state.lib_ssl = ssl;
3550 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3552 * With the SSL_clear(), we get strange interoperability bugs with
3553 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3554 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3556 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3557 * session shutdown. In this case, we have a brand new object and there's no
3558 * obvious reason to immediately clear it. I'm guessing that this was
3559 * originally added because of incomplete initialisation which the clear fixed,
3560 * in some historic release.
3563 /* Set context and tell client to go ahead, except in the case of TLS startup
3564 on connection, where outputting anything now upsets the clients and tends to
3565 make them disconnect. We need to have an explicit fflush() here, to force out
3566 the response. Other smtp_printf() calls do not need it, because in non-TLS
3567 mode, the fflush() happens when smtp_getc() is called. */
3569 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3570 if (!tls_in.on_connect)
3572 smtp_printf("220 TLS go ahead\r\n", FALSE);
3576 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3577 that the OpenSSL library doesn't. */
3579 SSL_set_wfd(ssl, fileno(smtp_out));
3580 SSL_set_rfd(ssl, fileno(smtp_in));
3581 SSL_set_accept_state(ssl);
3583 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3586 sigalrm_seen = FALSE;
3587 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3588 rc = SSL_accept(ssl);
3593 int error = SSL_get_error(ssl, rc);
3596 case SSL_ERROR_NONE:
3599 case SSL_ERROR_ZERO_RETURN:
3600 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3601 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3602 #ifndef DISABLE_EVENT
3603 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3605 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3608 tls_close(NULL, TLS_NO_SHUTDOWN);
3611 /* Handle genuine errors */
3615 int r = ERR_GET_REASON(ERR_peek_error());
3616 if ( r == SSL_R_WRONG_VERSION_NUMBER
3617 #ifdef SSL_R_VERSION_TOO_LOW
3618 || r == SSL_R_VERSION_TOO_LOW
3620 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3621 s = string_sprintf("(%s)", SSL_get_version(ssl));
3622 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
3623 #ifndef DISABLE_EVENT
3624 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3630 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3631 if (error == SSL_ERROR_SYSCALL)
3635 *errstr = US"SSL_accept: TCP connection closed by peer";
3636 #ifndef DISABLE_EVENT
3637 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3641 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3643 (void) tls_error(US"SSL_accept", NULL,
3644 sigalrm_seen ? US"timed out"
3645 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3647 #ifndef DISABLE_EVENT
3648 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3654 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3655 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3656 anon-authentication ciphersuite negotiated. */
3658 #ifndef DISABLE_TLS_RESUME
3659 if (SSL_session_reused(ssl))
3661 tls_in.resumption |= RESUME_USED;
3662 DEBUG(D_tls) debug_printf("Session reused\n");
3666 #ifdef EXIM_HAVE_ALPN
3667 /* If require-alpn, check server_seen_alpn here. Else abort TLS */
3668 if (!tls_alpn || !*tls_alpn)
3669 { DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n"); }
3670 else if (!server_seen_alpn)
3671 if (verify_check_host(&hosts_require_alpn) == OK)
3673 /* We'd like to send a definitive Alert but OpenSSL provides no facility */
3675 tls_error(US"handshake", NULL, US"ALPN required but not negotiated", errstr);
3679 { DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n"); }
3682 const uschar * name;
3684 SSL_get0_alpn_selected(ssl, &name, &len);
3686 debug_printf("ALPN negotiated: '%.*s'\n", (int)*name, name+1);
3688 debug_printf("ALPN: no protocol negotiated\n");
3693 /* TLS has been set up. Record data for the connection,
3694 adjust the input functions to read via TLS, and initialize things. */
3696 #ifdef SSL_get_extms_support
3697 /*XXX what does this return for tls1.3 ? */
3698 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3700 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3702 tls_in.ver = tlsver_name(ssl);
3703 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3704 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3709 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3710 debug_printf("Shared ciphers: %s\n", buf);
3712 tls_dump_keylog(ssl);
3714 #ifdef EXIM_HAVE_SESSION_TICKET
3716 SSL_SESSION * ss = SSL_get_session(ssl);
3717 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3718 debug_printf("The session has a ticket, life %lu seconds\n",
3719 SSL_SESSION_get_ticket_lifetime_hint(ss));
3724 /* Record the certificate we presented */
3726 X509 * crt = SSL_get_certificate(ssl);
3727 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3730 tls_get_channel_binding(ssl, &tls_in, GET_UNTAINTED);
3732 /* Only used by the server-side tls (tls_in), including tls_getc.
3733 Client-side (tls_out) reads (seem to?) go via
3734 smtp_read_response()/ip_recv().
3735 Hence no need to duplicate for _in and _out.
3737 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3738 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3739 ssl_xfer_eof = ssl_xfer_error = FALSE;
3741 receive_getc = tls_getc;
3742 receive_getbuf = tls_getbuf;
3743 receive_get_cache = tls_get_cache;
3744 receive_hasc = tls_hasc;
3745 receive_ungetc = tls_ungetc;
3746 receive_feof = tls_feof;
3747 receive_ferror = tls_ferror;
3749 tls_in.active.sock = fileno(smtp_out);
3750 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3758 tls_client_basic_ctx_init(SSL_CTX * ctx,
3759 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3764 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3765 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3766 host patterns if one of them is set with content. */
3768 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3769 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3771 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3772 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3775 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3777 client_verify_optional = FALSE;
3778 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3779 client_verify_optional = TRUE;
3784 uschar * v_certs = ob->tls_verify_certificates;
3786 if (state->lib_state.cabundle)
3788 DEBUG(D_tls) debug_printf("TLS: CA bundle for tpt was preloaded\n");
3789 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3793 if ((rc = setup_certs(ctx, &v_certs, ob->tls_crl, host, errstr)) != OK)
3795 if (v_certs && *v_certs)
3796 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3800 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3802 state->verify_cert_hostnames =
3804 string_domain_utf8_to_alabel(host->certname, NULL);
3808 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3809 state->verify_cert_hostnames);
3817 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3820 const char * hostnames[2] = { CS host->name, NULL };
3823 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3824 return tls_error(US"hostnames load", host, NULL, errstr);
3826 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3827 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3828 ) if (rr->type == T_TLSA && rr->size > 3)
3830 const uschar * p = rr->data;
3831 uint8_t usage, selector, mtype;
3832 const char * mdname;
3836 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3837 if (usage != 2 && usage != 3) continue;
3844 default: continue; /* Only match-types 0, 1, 2 are supported */
3845 case 0: mdname = NULL; break;
3846 case 1: mdname = "sha256"; break;
3847 case 2: mdname = "sha512"; break;
3851 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3854 return tls_error(US"tlsa load", host, NULL, errstr);
3855 case 0: /* action not taken */
3859 tls_out.tlsa_usage |= 1<<usage;
3865 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3868 #endif /*SUPPORT_DANE*/
3872 #ifndef DISABLE_TLS_RESUME
3873 /* On the client, get any stashed session for the given IP from hints db
3874 and apply it to the ssl-connection for attempted resumption. */
3877 tls_retrieve_session(tls_support * tlsp, SSL * ssl)
3879 if (tlsp->host_resumable)
3881 dbdata_tls_session * dt;
3883 open_db dbblock, * dbm_file;
3885 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3887 debug_printf("checking for resumable session for %s\n", tlsp->resume_index);
3888 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3890 if ((dt = dbfn_read_with_length(dbm_file, tlsp->resume_index, &len)))
3892 SSL_SESSION * ss = NULL;
3893 const uschar * sess_asn1 = dt->session;
3895 len -= sizeof(dbdata_tls_session);
3896 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3900 ERR_error_string_n(ERR_get_error(),
3901 ssl_errstring, sizeof(ssl_errstring));
3902 debug_printf("decoding session: %s\n", ssl_errstring);
3907 unsigned long lifetime =
3908 #ifdef EXIM_HAVE_SESSION_TICKET
3909 SSL_SESSION_get_ticket_lifetime_hint(ss);
3910 #else /* Use, fairly arbitrilarily, what we as server would */
3911 f.running_in_test_harness ? 6 : ssl_session_timeout;
3913 if (lifetime + dt->time_stamp < time(NULL))
3915 DEBUG(D_tls) debug_printf("session expired\n");
3916 dbfn_delete(dbm_file, tlsp->resume_index);
3918 else if (SSL_set_session(ssl, ss))
3920 DEBUG(D_tls) debug_printf("good session\n");
3921 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3922 tlsp->verify_override = dt->verify_override;
3923 tlsp->ocsp = dt->ocsp;
3927 ERR_error_string_n(ERR_get_error(),
3928 ssl_errstring, sizeof(ssl_errstring));
3929 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3934 DEBUG(D_tls) debug_printf("no session record\n");
3935 dbfn_close(dbm_file);
3941 /* On the client, save the session for later resumption */
3944 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3946 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3949 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3951 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3953 # ifdef OPENSSL_HAVE_NUM_TICKETS
3954 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3957 int len = i2d_SSL_SESSION(ss, NULL);
3958 int dlen = sizeof(dbdata_tls_session) + len;
3959 dbdata_tls_session * dt = store_get(dlen, GET_TAINTED);
3960 uschar * s = dt->session;
3961 open_db dbblock, * dbm_file;
3963 DEBUG(D_tls) debug_printf("session is resumable\n");
3964 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3966 dt->verify_override = tlsp->verify_override;
3967 dt->ocsp = tlsp->ocsp;
3968 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3970 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3972 dbfn_write(dbm_file, tlsp->resume_index, dt, dlen);
3973 dbfn_close(dbm_file);
3974 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3982 /* Construct a key for session DB lookup, and setup the SSL_CTX for resumption */
3985 tls_client_ctx_resume_prehandshake(
3986 exim_openssl_client_tls_ctx * exim_client_ctx, smtp_connect_args * conn_args,
3987 tls_support * tlsp, smtp_transport_options_block * ob)
3989 tlsp->host_resumable = TRUE;
3990 tls_client_resmption_key(tlsp, conn_args, ob);
3992 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3993 SSL_SESS_CACHE_CLIENT
3994 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3995 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3999 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
4000 host_item * host, uschar ** errstr)
4002 if (tlsp->host_resumable)
4005 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
4006 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
4008 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
4009 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
4011 tls_error(US"set ex_data", host, NULL, errstr);
4014 /* debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state); */
4017 tlsp->resumption = RESUME_SUPPORTED;
4018 /* Pick up a previous session, saved on an old ticket */
4019 tls_retrieve_session(tlsp, ssl);
4024 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
4027 if (SSL_session_reused(exim_client_ctx->ssl))
4029 DEBUG(D_tls) debug_printf("The session was reused\n");
4030 tlsp->resumption |= RESUME_USED;
4033 #endif /* !DISABLE_TLS_RESUME */
4036 #ifdef EXIM_HAVE_ALPN
4037 /* Expand and convert an Exim list to an ALPN list. False return for fail.
4038 NULL plist return for silent no-ALPN.
4040 Overwite the passed-in list with the expanded version.
4044 tls_alpn_plist(uschar ** tls_alpn, const uschar ** plist, unsigned * plen,
4049 if (!expand_check(*tls_alpn, US"tls_alpn", &exp_alpn, errstr))
4051 *tls_alpn = exp_alpn;
4055 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
4060 /* The server implementation only accepts exactly one protocol name
4061 but it's little extra code complexity in the client. */
4063 const uschar * list = exp_alpn;
4064 uschar * p = store_get(Ustrlen(exp_alpn), exp_alpn), * s, * t;
4068 for (t = p; s = string_nextinlist(&list, &sep, NULL, 0); t += len)
4070 *t++ = len = (uschar) Ustrlen(s);
4073 *plist = (*plen = t - p) ? p : NULL;
4077 #endif /* EXIM_HAVE_ALPN */
4080 /*************************************************
4081 * Start a TLS session in a client *
4082 *************************************************/
4084 /* Called from the smtp transport after STARTTLS has been accepted.
4087 cctx connection context
4088 conn_args connection details
4089 cookie datum for randomness; can be NULL
4090 tlsp record details of TLS channel configuration here; must be non-NULL
4091 errstr error string pointer
4093 Returns: TRUE for success with TLS session context set in connection context,
4098 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
4099 void * cookie, tls_support * tlsp, uschar ** errstr)
4101 host_item * host = conn_args->host; /* for msgs and option-tests */
4102 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
4103 smtp_transport_options_block * ob = tb
4104 ? (smtp_transport_options_block *)tb->options_block
4105 : &smtp_transport_option_defaults;
4106 exim_openssl_client_tls_ctx * exim_client_ctx;
4107 uschar * expciphers;
4109 static uschar peerdn[256];
4111 #ifndef DISABLE_OCSP
4112 BOOL request_ocsp = FALSE;
4113 BOOL require_ocsp = FALSE;
4117 store_pool = POOL_PERM;
4118 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), GET_UNTAINTED);
4119 exim_client_ctx->corked = NULL;
4123 tlsp->tlsa_usage = 0;
4126 #ifndef DISABLE_OCSP
4128 # ifdef SUPPORT_DANE
4129 if ( conn_args->dane
4130 && ob->hosts_request_ocsp[0] == '*'
4131 && ob->hosts_request_ocsp[1] == '\0'
4134 /* Unchanged from default. Use a safer one under DANE */
4135 request_ocsp = TRUE;
4136 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
4137 " {= {4}{$tls_out_tlsa_usage}} } "
4143 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
4144 request_ocsp = TRUE;
4146 # ifdef SUPPORT_DANE
4150 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4152 # if defined(SUPPORT_DANE) && !defined(EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER)
4153 if (conn_args->dane && (require_ocsp || request_ocsp))
4155 DEBUG(D_tls) debug_printf("OpenSSL version to early to combine OCSP"
4156 " and DANE; disabling OCSP\n");
4157 require_ocsp = request_ocsp = FALSE;
4163 rc = tls_init(host, ob,
4164 #ifndef DISABLE_OCSP
4165 (void *)(long)request_ocsp,
4167 cookie, &client_static_state, tlsp, errstr);
4168 if (rc != OK) return FALSE;
4170 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
4172 tlsp->certificate_verified = FALSE;
4173 client_verify_callback_called = FALSE;
4177 if (conn_args->dane)
4179 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
4180 other failures should be treated as problems. */
4181 if (ob->dane_require_tls_ciphers &&
4182 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
4183 &expciphers, errstr))
4185 if (expciphers && *expciphers == '\0')
4188 normalise_ciphers(&expciphers, ob->dane_require_tls_ciphers);
4193 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
4194 &expciphers, errstr))
4197 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
4198 are separated by underscores. So that I can use either form in my tests, and
4199 also for general convenience, we turn underscores into hyphens here. */
4201 normalise_ciphers(&expciphers, ob->tls_require_ciphers);
4206 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
4207 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
4209 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
4215 if (conn_args->dane)
4217 SSL_CTX_set_verify(exim_client_ctx->ctx,
4218 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
4219 verify_callback_client_dane);
4221 if (!DANESSL_library_init())
4223 tls_error(US"library init", host, NULL, errstr);
4226 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
4228 tls_error(US"context init", host, NULL, errstr);
4231 DEBUG(D_tls) debug_printf("since dane-mode conn, not loading the usual CA bundle\n");
4237 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
4238 client_static_state, errstr) != OK)
4243 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
4246 { DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n"); }
4247 else if (!Ustrlen(tlsp->sni))
4251 #ifndef EXIM_HAVE_OPENSSL_TLSEXT
4252 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
4260 #ifdef EXIM_HAVE_ALPN
4262 const uschar * plist;
4265 if (!tls_alpn_plist(&ob->tls_alpn, &plist, &plen, errstr))
4268 if (SSL_CTX_set_alpn_protos(exim_client_ctx->ctx, plist, plen) != 0)
4270 tls_error(US"alpn init", host, NULL, errstr);
4274 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
4277 log_write(0, LOG_MAIN, "ALPN unusable with this OpenSSL library version; ignoring \"%s\"\n",
4281 #ifndef DISABLE_TLS_RESUME
4282 /*XXX have_lbserver: another cmdline arg possibly, for continued-conn, but use
4283 will be very low. */
4285 if (!conn_args->have_lbserver) /* wanted for tls_client_resmption_key() */
4286 { DEBUG(D_tls) debug_printf("resumption not supported on continued-connection\n"); }
4287 else if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
4288 tls_client_ctx_resume_prehandshake(exim_client_ctx, conn_args, tlsp, ob);
4292 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
4294 tls_error(US"SSL_new", host, NULL, errstr);
4297 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
4298 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
4299 SSL_set_connect_state(exim_client_ctx->ssl);
4301 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
4304 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
4305 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
4310 if (conn_args->dane)
4311 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
4315 #ifndef DISABLE_OCSP
4316 /* Request certificate status at connection-time. If the server
4317 does OCSP stapling we will get the callback (set in tls_init()) */
4318 # ifdef SUPPORT_DANE
4322 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4323 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4325 { /* Re-eval now $tls_out_tlsa_usage is populated. If
4326 this means we avoid the OCSP request, we wasted the setup
4327 cost in tls_init(). */
4328 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
4329 request_ocsp = require_ocsp
4330 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4337 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
4338 client_static_state->u_ocsp.client.verify_required = require_ocsp;
4339 tlsp->ocsp = OCSP_NOT_RESP;
4343 #ifndef DISABLE_TLS_RESUME
4344 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
4349 #ifndef DISABLE_EVENT
4350 client_static_state->event_action = tb ? tb->event_action : NULL;
4353 /* There doesn't seem to be a built-in timeout on connection. */
4355 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
4356 sigalrm_seen = FALSE;
4357 ALARM(ob->command_timeout);
4358 rc = SSL_connect(exim_client_ctx->ssl);
4362 if (conn_args->dane)
4363 DANESSL_cleanup(exim_client_ctx->ssl);
4368 #ifndef DISABLE_OCSP
4369 if (client_static_state->u_ocsp.client.verify_errstr)
4370 { if (errstr) *errstr = client_static_state->u_ocsp.client.verify_errstr; }
4373 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
4379 debug_printf("SSL_connect succeeded\n");
4380 tls_dump_keylog(exim_client_ctx->ssl);
4383 #ifndef DISABLE_TLS_RESUME
4384 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
4387 #ifdef EXIM_HAVE_ALPN
4388 if (ob->tls_alpn) /* We requested. See what was negotiated. */
4390 const uschar * name;
4393 SSL_get0_alpn_selected(exim_client_ctx->ssl, &name, &len);
4395 { DEBUG(D_tls) debug_printf("ALPN negotiated %u: '%.*s'\n", len, (int)*name, name+1); }
4396 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
4398 /* Would like to send a relevant fatal Alert, but OpenSSL has no API */
4399 tls_error(US"handshake", host, US"ALPN required but not negotiated", errstr);
4405 #ifdef SSL_get_extms_support
4406 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
4408 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
4410 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
4411 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
4412 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
4414 /* Record the certificate we presented */
4416 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
4417 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
4420 /*XXX will this work with continued-TLS? */
4421 tls_get_channel_binding(exim_client_ctx->ssl, tlsp, GET_TAINTED);
4423 tlsp->active.sock = cctx->sock;
4424 tlsp->active.tls_ctx = exim_client_ctx;
4425 cctx->tls_ctx = exim_client_ctx;
4434 tls_refill(unsigned lim)
4436 SSL * ssl = state_server.lib_state.lib_ssl;
4440 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4441 ssl_xfer_buffer, ssl_xfer_buffer_size);
4444 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4445 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
4446 MIN(ssl_xfer_buffer_size, lim));
4447 error = SSL_get_error(ssl, inbytes);
4448 if (smtp_receive_timeout > 0) ALARM_CLR(0);
4450 if (had_command_timeout) /* set by signal handler */
4451 smtp_command_timeout_exit(); /* does not return */
4452 if (had_command_sigterm)
4453 smtp_command_sigterm_exit();
4454 if (had_data_timeout)
4455 smtp_data_timeout_exit();
4456 if (had_data_sigint)
4457 smtp_data_sigint_exit();
4459 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
4460 closed down, not that the socket itself has been closed down. Revert to
4461 non-SSL handling. */
4465 case SSL_ERROR_NONE:
4468 case SSL_ERROR_ZERO_RETURN:
4469 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4471 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
4474 tls_close(NULL, TLS_NO_SHUTDOWN);
4477 /* Handle genuine errors */
4479 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4480 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
4481 ssl_xfer_error = TRUE;
4485 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
4486 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
4487 debug_printf(" - syscall %s\n", strerror(errno));
4488 ssl_xfer_error = TRUE;
4492 #ifndef DISABLE_DKIM
4493 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
4495 ssl_xfer_buffer_hwm = inbytes;
4496 ssl_xfer_buffer_lwm = 0;
4501 /*************************************************
4502 * TLS version of getc *
4503 *************************************************/
4505 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
4506 it refills the buffer via the SSL reading function.
4508 Arguments: lim Maximum amount to read/buffer
4509 Returns: the next character or EOF
4511 Only used by the server-side TLS.
4515 tls_getc(unsigned lim)
4517 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4518 if (!tls_refill(lim))
4519 return ssl_xfer_error ? EOF : smtp_getc(lim);
4521 /* Something in the buffer; return next uschar */
4523 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
4529 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm;
4533 tls_getbuf(unsigned * len)
4538 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4539 if (!tls_refill(*len))
4541 if (!ssl_xfer_error) return smtp_getbuf(len);
4546 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4548 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4549 ssl_xfer_buffer_lwm += size;
4556 tls_get_cache(unsigned lim)
4558 #ifndef DISABLE_DKIM
4559 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4563 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4569 tls_could_getc(void)
4571 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4572 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4576 /*************************************************
4577 * Read bytes from TLS channel *
4578 *************************************************/
4582 ct_ctx client context pointer, or NULL for the one global server context
4586 Returns: the number of bytes read
4587 -1 after a failed read, including EOF
4589 Only used by the client-side TLS.
4593 tls_read(void * ct_ctx, uschar *buff, size_t len)
4595 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4596 : state_server.lib_state.lib_ssl;
4600 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4601 buff, (unsigned int)len);
4604 inbytes = SSL_read(ssl, CS buff, len);
4605 error = SSL_get_error(ssl, inbytes);
4607 if (error == SSL_ERROR_ZERO_RETURN)
4609 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4612 else if (error != SSL_ERROR_NONE)
4622 /*************************************************
4623 * Write bytes down TLS channel *
4624 *************************************************/
4628 ct_ctx client context pointer, or NULL for the one global server context
4631 more further data expected soon
4633 Returns: the number of bytes after a successful write,
4634 -1 after a failed write
4636 Used by both server-side and client-side TLS. Calling with len zero and more unset
4637 will flush buffered writes; buff can be null for this case.
4641 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4644 int outbytes, error;
4646 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4647 : state_server.lib_state.lib_ssl;
4648 static gstring * server_corked = NULL;
4649 gstring ** corkedp = ct_ctx
4650 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4651 gstring * corked = *corkedp;
4653 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4654 buff, (unsigned long)len, more ? ", more" : "");
4656 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4657 "more" is notified. This hack is only ok if small amounts are involved AND only
4658 one stream does it, in one context (i.e. no store reset). Currently it is used
4659 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4660 We support callouts done by the server process by using a separate client
4661 context for the stashed information. */
4662 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4663 a store reset there, so use POOL_PERM. */
4664 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4668 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4670 int save_pool = store_pool;
4671 store_pool = POOL_PERM;
4673 corked = string_catn(corked, buff, len);
4675 store_pool = save_pool;
4682 buff = CUS corked->s;
4687 for (int left = len; left > 0;)
4689 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4691 outbytes = SSL_write(ssl, CS buff, left);
4692 error = SSL_get_error(ssl, outbytes);
4693 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4696 case SSL_ERROR_NONE: /* the usual case */
4702 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4703 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4706 case SSL_ERROR_ZERO_RETURN:
4707 log_write(0, LOG_MAIN, "SSL channel closed on write");
4710 case SSL_ERROR_SYSCALL:
4711 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4712 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4713 sender_fullhost ? sender_fullhost : US"<unknown>",
4715 else if (LOGGING(protocol_detail))
4716 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4717 " SMTP response and TLS close\n", sender_host_address);
4719 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4720 " client reset TCP before TLS close\n", sender_host_address);
4724 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4735 ct_ctx client TLS context pointer, or NULL for the one global server context
4739 tls_shutdown_wr(void * ct_ctx)
4741 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4742 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4743 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4746 if (*fdp < 0) return; /* TLS was not active */
4748 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4750 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
4751 rc = SSL_shutdown(*sslp);
4752 if (rc < 0) DEBUG(D_tls)
4754 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4755 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4759 /*************************************************
4760 * Close down a TLS session *
4761 *************************************************/
4763 /* This is also called from within a delivery subprocess forked from the
4764 daemon, to shut down the TLS library, without actually doing a shutdown (which
4765 would tamper with the SSL session in the parent process).
4768 ct_ctx client TLS context pointer, or NULL for the one global server context
4769 do_shutdown 0 no data-flush or TLS close-alert
4770 1 if TLS close-alert is to be sent,
4771 2 if also response to be waited for
4775 Used by both server-side and client-side TLS.
4779 tls_close(void * ct_ctx, int do_shutdown)
4781 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4782 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4783 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4785 if (*fdp < 0) return; /* TLS was not active */
4787 if (do_shutdown > TLS_NO_SHUTDOWN)
4790 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4791 do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
4793 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4795 if ( ( do_shutdown >= TLS_SHUTDOWN_WONLY
4796 || (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4798 && do_shutdown > TLS_SHUTDOWN_NOWAIT
4801 #ifdef EXIM_TCP_CORK
4802 (void) setsockopt(*fdp, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
4805 rc = SSL_shutdown(*sslp); /* wait for response */
4809 if (rc < 0) DEBUG(D_tls)
4811 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4812 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4816 if (!o_ctx) /* server side */
4818 #ifndef DISABLE_OCSP
4819 sk_X509_pop_free(state_server.u_ocsp.server.verify_stack, X509_free);
4820 state_server.u_ocsp.server.verify_stack = NULL;
4823 receive_getc = smtp_getc;
4824 receive_getbuf = smtp_getbuf;
4825 receive_get_cache = smtp_get_cache;
4826 receive_hasc = smtp_hasc;
4827 receive_ungetc = smtp_ungetc;
4828 receive_feof = smtp_feof;
4829 receive_ferror = smtp_ferror;
4830 tls_in.active.tls_ctx = NULL;
4832 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4843 /*************************************************
4844 * Let tls_require_ciphers be checked at startup *
4845 *************************************************/
4847 /* The tls_require_ciphers option, if set, must be something which the
4850 Returns: NULL on success, or error message
4854 tls_validate_require_cipher(void)
4857 uschar * expciphers, * err;
4861 if (!(tls_require_ciphers && *tls_require_ciphers))
4864 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4866 return US"failed to expand tls_require_ciphers";
4868 if (!(expciphers && *expciphers))
4871 normalise_ciphers(&expciphers, tls_require_ciphers);
4874 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4877 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4879 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4881 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4882 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4883 expciphers, ssl_errstring);
4894 /*************************************************
4895 * Report the library versions. *
4896 *************************************************/
4898 /* There have historically been some issues with binary compatibility in
4899 OpenSSL libraries; if Exim (like many other applications) is built against
4900 one version of OpenSSL but the run-time linker picks up another version,
4901 it can result in serious failures, including crashing with a SIGSEGV. So
4902 report the version found by the compiler and the run-time version.
4904 Note: some OS vendors backport security fixes without changing the version
4905 number/string, and the version date remains unchanged. The _build_ date
4906 will change, so we can more usefully assist with version diagnosis by also
4907 reporting the build date.
4909 Arguments: string to append to
4914 tls_version_report(gstring * g)
4916 return string_fmt_append(g,
4917 "Library version: OpenSSL: Compile: %s\n"
4920 OPENSSL_VERSION_TEXT,
4921 SSLeay_version(SSLEAY_VERSION),
4922 SSLeay_version(SSLEAY_BUILT_ON));
4923 /* third line is 38 characters for the %s and the line is 73 chars long;
4924 the OpenSSL output includes a "built on: " prefix already. */
4930 /*************************************************
4931 * Random number generation *
4932 *************************************************/
4934 /* Pseudo-random number generation. The result is not expected to be
4935 cryptographically strong but not so weak that someone will shoot themselves
4936 in the foot using it as a nonce in input in some email header scheme or
4937 whatever weirdness they'll twist this into. The result should handle fork()
4938 and avoid repeating sequences. OpenSSL handles that for us.
4942 Returns a random number in range [0, max-1]
4946 vaguely_random_number(int max)
4950 static pid_t pidlast = 0;
4952 uschar smallbuf[sizeof(r)];
4958 if (pidnow != pidlast)
4960 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
4961 is unique for each thread", this doesn't apparently apply across processes,
4962 so our own warning from vaguely_random_number_fallback() applies here too.
4963 Fix per PostgreSQL. */
4969 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
4973 gettimeofday(&r.tv, NULL);
4976 RAND_seed(US (&r), sizeof(r));
4978 /* We're after pseudo-random, not random; if we still don't have enough data
4979 in the internal PRNG then our options are limited. We could sleep and hope
4980 for entropy to come along (prayer technique) but if the system is so depleted
4981 in the first place then something is likely to just keep taking it. Instead,
4982 we'll just take whatever little bit of pseudo-random we can still manage to
4985 needed_len = sizeof(r);
4986 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4987 asked for a number less than 10. */
4988 for (r = max, i = 0; r; ++i)
4994 #ifdef EXIM_HAVE_RAND_PSEUDO
4995 /* We do not care if crypto-strong */
4996 i = RAND_pseudo_bytes(smallbuf, needed_len);
4998 i = RAND_bytes(smallbuf, needed_len);
5004 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
5005 return vaguely_random_number_fallback(max);
5009 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
5012 /* We don't particularly care about weighted results; if someone wants
5013 smooth distribution and cares enough then they should submit a patch then. */
5020 /*************************************************
5021 * OpenSSL option parse *
5022 *************************************************/
5024 /* Parse one option for tls_openssl_options_parse below
5027 name one option name
5028 value place to store a value for it
5029 Returns success or failure in parsing
5035 tls_openssl_one_option_parse(uschar *name, long *value)
5038 int last = exim_openssl_options_size;
5039 while (last > first)
5041 int middle = (first + last)/2;
5042 int c = Ustrcmp(name, exim_openssl_options[middle].name);
5045 *value = exim_openssl_options[middle].value;
5059 /*************************************************
5060 * OpenSSL option parsing logic *
5061 *************************************************/
5063 /* OpenSSL has a number of compatibility options which an administrator might
5064 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
5065 we look like log_selector.
5068 option_spec the administrator-supplied string of options
5069 results ptr to long storage for the options bitmap
5070 Returns success or failure
5074 tls_openssl_options_parse(uschar *option_spec, long *results)
5077 uschar * exp, * end;
5078 BOOL adding, item_parsed;
5080 /* Server: send no (<= TLS1.2) session tickets */
5081 result = SSL_OP_NO_TICKET;
5083 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
5084 from default because it increases BEAST susceptibility. */
5085 #ifdef SSL_OP_NO_SSLv2
5086 result |= SSL_OP_NO_SSLv2;
5088 #ifdef SSL_OP_NO_SSLv3
5089 result |= SSL_OP_NO_SSLv3;
5091 #ifdef SSL_OP_SINGLE_DH_USE
5092 result |= SSL_OP_SINGLE_DH_USE;
5094 #ifdef SSL_OP_NO_RENEGOTIATION
5095 result |= SSL_OP_NO_RENEGOTIATION;
5104 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
5107 for (uschar * s = exp; *s; /**/)
5109 while (isspace(*s)) ++s;
5112 if (*s != '+' && *s != '-')
5114 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
5115 "+ or - expected but found \"%s\"\n", s);
5118 adding = *s++ == '+';
5119 for (end = s; *end && !isspace(*end); ) end++;
5120 item_parsed = tls_openssl_one_option_parse(string_copyn(s, end-s), &item);
5123 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
5126 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
5127 adding ? "adding to " : "removing from", result, item, s);
5139 #endif /*!MACRO_PREDEF*/
5142 /* End of tls-openssl.c */