1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2023 */
6 /* Copyright (c) University of Cambridge 1995 - 2019 */
7 /* See the file NOTICE for conditions of use and distribution. */
8 /* SPDX-License-Identifier: GPL-2.0-or-later */
10 /* Portions Copyright (c) The OpenSSL Project 1999 */
12 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
13 library. It is #included into the tls.c file when that library is used. The
14 code herein is based on a patch that was originally contributed by Steve
15 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
17 No cryptographic code is included in Exim. All this module does is to call
18 functions from the OpenSSL library. */
23 #include <openssl/lhash.h>
24 #include <openssl/ssl.h>
25 #include <openssl/err.h>
26 #include <openssl/rand.h>
27 #ifndef OPENSSL_NO_ECDH
28 # include <openssl/ec.h>
31 # include <openssl/ocsp.h>
39 # define EXIM_OCSP_SKEW_SECONDS (300L)
40 # define EXIM_OCSP_MAX_AGE (-1L)
43 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
44 # define EXIM_HAVE_OPENSSL_TLSEXT
46 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
47 # define EXIM_HAVE_RSA_GENKEY_EX
49 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
50 # define EXIM_HAVE_OCSP_RESP_COUNT
51 # define OPENSSL_AUTO_SHA256
52 # define OPENSSL_MIN_PROTO_VERSION
54 # define EXIM_HAVE_EPHEM_RSA_KEX
55 # define EXIM_HAVE_RAND_PSEUDO
57 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
58 # define EXIM_HAVE_SHA256
61 /* X509_check_host provides sane certificate hostname checking, but was added
62 to OpenSSL late, after other projects forked off the code-base. So in
63 addition to guarding against the base version number, beware that LibreSSL
64 does not (at this time) support this function.
66 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
67 opt to disentangle and ask a LibreSSL user to provide glue for a third
68 crypto provider for libtls instead of continuing to tie the OpenSSL glue
69 into even twistier knots. If LibreSSL gains the same API, we can just
70 change this guard and punt the issue for a while longer. */
72 #ifndef LIBRESSL_VERSION_NUMBER
73 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
74 # define EXIM_HAVE_OPENSSL_CHECKHOST
75 # define EXIM_HAVE_OPENSSL_DH_BITS
76 # define EXIM_HAVE_OPENSSL_TLS_METHOD
77 # define EXIM_HAVE_OPENSSL_KEYLOG
78 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
79 # define EXIM_HAVE_SESSION_TICKET
80 # define EXIM_HAVE_OPENSSL_TRACE
81 # define EXIM_HAVE_OPENSSL_GET0_SERIAL
82 # define EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_CERTS
83 # define EXIM_HAVE_SSL_GET0_VERIFIED_CHAIN
85 # define EXIM_HAVE_OCSP
87 # define EXIM_HAVE_ALPN /* fail ret from hshake-cb is ignored by LibreSSL */
89 # define EXIM_NEED_OPENSSL_INIT
91 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
92 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
93 # define EXIM_HAVE_OPENSSL_CHECKHOST
97 #if LIBRESSL_VERSION_NUMBER >= 0x3040000fL
98 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
100 #if LIBRESSL_VERSION_NUMBER >= 0x3050000fL
101 # define EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_CERTS
104 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x030000000L)
105 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
106 # define EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
109 #if !defined(LIBRESSL_VERSION_NUMBER) \
110 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
111 # if !defined(OPENSSL_NO_ECDH)
112 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
113 # define EXIM_HAVE_ECDH
115 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
116 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
121 #ifndef LIBRESSL_VERSION_NUMBER
122 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
123 # define OPENSSL_HAVE_KEYLOG_CB
124 # define OPENSSL_HAVE_NUM_TICKETS
125 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
126 # define EXIM_HAVE_EXP_CHNL_BNGNG
127 # define EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER
128 # define EXIM_HAVE_OPENSSL_SET1_GROUPS
130 # define OPENSSL_BAD_SRVR_OURCERT
134 #if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x010002000L)
135 # define EXIM_HAVE_EXPORT_CHNL_BNGNG
138 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
139 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
140 # define DISABLE_OCSP
143 #ifndef DISABLE_TLS_RESUME
144 # if OPENSSL_VERSION_NUMBER < 0x0101010L
145 # error OpenSSL version too old for session-resumption
149 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
150 # include <openssl/x509v3.h>
153 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
154 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
155 # define SSL_CIPHER_get_id(c) (c->id)
157 # ifndef MACRO_PREDEF
158 # include "tls-cipher-stdname.c"
162 #define TESTSUITE_TICKET_LIFE 10 /* seconds */
163 /*************************************************
164 * OpenSSL option parse *
165 *************************************************/
167 typedef struct exim_openssl_option {
170 } exim_openssl_option;
171 /* We could use a macro to expand, but we need the ifdef and not all the
172 options document which version they were introduced in. Policylet: include
173 all options unless explicitly for DTLS, let the administrator choose which
176 This list is current as of:
179 XXX could we autobuild this list, as with predefined-macros?
180 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
181 Also allow a numeric literal?
183 static exim_openssl_option exim_openssl_options[] = {
184 /* KEEP SORTED ALPHABETICALLY! */
186 { US"all", (long) SSL_OP_ALL },
188 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
189 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
191 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
192 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
194 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
195 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
197 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
198 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
200 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
201 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
203 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
204 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
206 #ifdef SSL_OP_EPHEMERAL_RSA
207 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
209 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
210 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
212 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
213 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
215 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
216 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
218 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
219 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
221 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
222 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
224 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
225 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
227 #ifdef SSL_OP_NO_ANTI_REPLAY
228 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
230 #ifdef SSL_OP_NO_COMPRESSION
231 { US"no_compression", SSL_OP_NO_COMPRESSION },
233 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
234 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
236 #ifdef SSL_OP_NO_RENEGOTIATION
237 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
239 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
240 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
242 #ifdef SSL_OP_NO_SSLv2
243 { US"no_sslv2", SSL_OP_NO_SSLv2 },
245 #ifdef SSL_OP_NO_SSLv3
246 { US"no_sslv3", SSL_OP_NO_SSLv3 },
248 #ifdef SSL_OP_NO_TICKET
249 { US"no_ticket", SSL_OP_NO_TICKET },
251 #ifdef SSL_OP_NO_TLSv1
252 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
254 #ifdef SSL_OP_NO_TLSv1_1
255 # if OPENSSL_VERSION_NUMBER < 0x30000000L
256 # if SSL_OP_NO_TLSv1_1 == 0x00000400L
257 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
258 # warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
259 # define NO_SSL_OP_NO_TLSv1_1
262 # ifndef NO_SSL_OP_NO_TLSv1_1
263 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
266 #ifdef SSL_OP_NO_TLSv1_2
267 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
269 #ifdef SSL_OP_NO_TLSv1_3
270 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
272 #ifdef SSL_OP_PRIORITIZE_CHACHA
273 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
275 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
276 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
278 #ifdef SSL_OP_SINGLE_DH_USE
279 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
281 #ifdef SSL_OP_SINGLE_ECDH_USE
282 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
284 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
285 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
287 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
288 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
290 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
291 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
293 #ifdef SSL_OP_TLS_D5_BUG
294 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
296 #ifdef SSL_OP_TLS_ROLLBACK_BUG
297 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
299 #ifdef SSL_OP_TLSEXT_PADDING
300 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
305 static int exim_openssl_options_size = nelem(exim_openssl_options);
306 static long init_options = 0;
315 for (struct exim_openssl_option * o = exim_openssl_options;
316 o < exim_openssl_options + nelem(exim_openssl_options); o++)
318 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
319 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
321 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
322 builtin_macro_create(buf);
325 # ifndef DISABLE_TLS_RESUME
326 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
328 # ifdef SSL_OP_NO_TLSv1_3
329 builtin_macro_create(US"_HAVE_TLS1_3");
331 # ifdef OPENSSL_BAD_SRVR_OURCERT
332 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
334 # ifdef EXIM_HAVE_OCSP
335 builtin_macro_create(US"_HAVE_TLS_OCSP");
336 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
338 # ifdef EXIM_HAVE_ALPN
339 builtin_macro_create(US"_HAVE_TLS_ALPN");
344 /******************************************************************************/
346 /* Structure for collecting random data for seeding. */
348 typedef struct randstuff {
353 /* Local static variables */
355 static BOOL client_verify_callback_called = FALSE;
356 static BOOL server_verify_callback_called = FALSE;
357 static const uschar *sid_ctx = US"exim";
359 /* We have three different contexts to care about.
361 Simple case: client, `client_ctx`
362 As a client, we can be doing a callout or cut-through delivery while receiving
363 a message. So we have a client context, which should have options initialised
364 from the SMTP Transport. We may also concurrently want to make TLS connections
365 to utility daemons, so client-contexts are allocated and passed around in call
366 args rather than using a gobal.
369 There are two cases: with and without ServerNameIndication from the client.
370 Given TLS SNI, we can be using different keys, certs and various other
371 configuration settings, because they're re-expanded with $tls_sni set. This
372 allows vhosting with TLS. This SNI is sent in the handshake.
373 A client might not send SNI, so we need a fallback, and an initial setup too.
374 So as a server, we start out using `server_ctx`.
375 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
376 `server_sni` from `server_ctx` and then initialise settings by re-expanding
384 } exim_openssl_client_tls_ctx;
387 /* static SSL_CTX *server_ctx = NULL; */
388 /* static SSL *server_ssl = NULL; */
390 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
391 static SSL_CTX *server_sni = NULL;
393 #ifdef EXIM_HAVE_ALPN
394 static BOOL server_seen_alpn = FALSE;
397 static char ssl_errstring[256];
399 static int ssl_session_timeout = 7200; /* Two hours */
400 static BOOL client_verify_optional = FALSE;
401 static BOOL server_verify_optional = FALSE;
403 static BOOL reexpand_tls_files_for_sni = FALSE;
406 typedef struct ocsp_resp {
407 struct ocsp_resp * next;
408 OCSP_RESPONSE * resp;
411 typedef struct exim_openssl_state {
412 exim_tlslib_state lib_state;
413 #define lib_ctx libdata0
414 #define lib_ssl libdata1
417 uschar * certificate;
424 const uschar *file_expanded;
425 ocsp_resplist *olist;
426 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
429 X509_STORE *verify_store; /* non-null if status requested */
430 uschar *verify_errstr; /* only if _required */
431 BOOL verify_required;
436 /* these are cached from first expand */
437 uschar * server_cipher_list;
438 /* only passed down to tls_error: */
440 const uschar * verify_cert_hostnames;
441 #ifndef DISABLE_EVENT
442 uschar * event_action;
444 } exim_openssl_state_st;
446 /* should figure out a cleanup of API to handle state preserved per
447 implementation, for various reasons, which can be void * in the APIs.
448 For now, we hack around it. */
449 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
450 exim_openssl_state_st state_server = {.is_server = TRUE};
453 setup_certs(SSL_CTX * sctx, uschar ** certs, uschar * crl, host_item * host,
458 static int tls_server_stapling_cb(SSL *s, void *arg);
459 static void x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk);
460 static void x509_store_dump_cert_s_names(X509_STORE * store);
465 /* Daemon-called, before every connection, key create/rotate */
466 #ifndef DISABLE_TLS_RESUME
467 static void tk_init(void);
468 static int tls_exdata_idx = -1;
472 tls_per_lib_daemon_tick(void)
474 #ifndef DISABLE_TLS_RESUME
479 /* Called once at daemon startup */
482 tls_per_lib_daemon_init(void)
484 tls_daemon_creds_reload();
488 /*************************************************
490 *************************************************/
492 /* Called from lots of places when errors occur before actually starting to do
493 the TLS handshake, that is, while the session is still in clear. Always returns
494 DEFER for a server and FAIL for a client so that most calls can use "return
495 tls_error(...)" to do this processing and then give an appropriate return. A
496 single function is used for both server and client, because it is called from
497 some shared functions.
500 prefix text to include in the logged error
501 host NULL if setting up a server;
502 the connected host if setting up a client
503 msg error message or NULL if we should ask OpenSSL
504 errstr pointer to output error message
506 Returns: OK/DEFER/FAIL
510 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
514 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
515 msg = US ssl_errstring;
518 msg = string_sprintf("(%s): %s", prefix, msg);
519 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
520 if (errstr) *errstr = msg;
521 return host ? FAIL : DEFER;
526 /**************************************************
527 * General library initalisation *
528 **************************************************/
531 lib_rand_init(void * addr)
534 if (!RAND_status()) return TRUE;
536 gettimeofday(&r.tv, NULL);
538 RAND_seed(US (&r), sizeof(r));
539 RAND_seed(US big_buffer, big_buffer_size);
540 if (addr) RAND_seed(US addr, sizeof(addr));
542 return RAND_status();
547 tls_openssl_init(void)
549 static BOOL once = FALSE;
553 #ifdef EXIM_NEED_OPENSSL_INIT
554 SSL_load_error_strings(); /* basic set up */
555 OpenSSL_add_ssl_algorithms();
558 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
559 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
560 list of available digests. */
561 EVP_add_digest(EVP_sha256());
564 (void) lib_rand_init(NULL);
565 (void) tls_openssl_options_parse(openssl_options, &init_options);
570 /*************************************************
571 * Initialize for DH *
572 *************************************************/
574 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
578 sctx The current SSL CTX (inbound or outbound)
579 dhparam DH parameter file or fixed parameter identity string
580 errstr error string pointer
582 Returns: TRUE if OK (nothing to set up, or setup worked)
586 init_dh(SSL_CTX * sctx, uschar * dhparam, uschar ** errstr)
589 #if OPENSSL_VERSION_NUMBER < 0x30000000L
598 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
601 if (!dhexpanded || !*dhexpanded)
602 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
603 else if (dhexpanded[0] == '/')
605 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
607 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
608 NULL, US strerror(errno), errstr);
614 if (Ustrcmp(dhexpanded, "none") == 0)
616 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
620 if (!(pem = std_dh_prime_named(dhexpanded)))
622 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
623 NULL, US strerror(errno), errstr);
626 bio = BIO_new_mem_buf(CS pem, -1);
630 #if OPENSSL_VERSION_NUMBER < 0x30000000L
631 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)
633 pkey = PEM_read_bio_Parameters_ex(bio, NULL, NULL, NULL)
638 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
643 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
644 an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with 2236.
645 But older OpenSSL can only report in bytes (octets), not bits. If someone wants
646 to dance at the edge, then they can raise the limit or use current libraries. */
648 #if OPENSSL_VERSION_NUMBER < 0x30000000L
649 # ifdef EXIM_HAVE_OPENSSL_DH_BITS
650 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
651 This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
652 dh_bitsize = DH_bits(dh);
654 dh_bitsize = 8 * DH_size(dh);
657 dh_bitsize = EVP_PKEY_get_bits(pkey);
660 /* Even if it is larger, we silently return success rather than cause things to
661 fail out, so that a too-large DH will not knock out all TLS; it's a debatable
662 choice. Likewise for a failing attempt to set one. */
664 if (dh_bitsize <= tls_dh_max_bits)
667 #if OPENSSL_VERSION_NUMBER < 0x30000000L
668 SSL_CTX_set_tmp_dh(sctx, dh)
670 SSL_CTX_set0_tmp_dh_pkey(sctx, pkey)
674 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
675 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (D-H param setting '%s'): %s",
676 dhexpanded ? dhexpanded : US"default", ssl_errstring);
677 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
678 /* EVP_PKEY_free(pkey); crashes */
683 debug_printf(" Diffie-Hellman initialized from %s with %d-bit prime\n",
684 dhexpanded ? dhexpanded : US"default", dh_bitsize);
688 debug_printf(" dhparams '%s' %d bits, is > tls_dh_max_bits limit of %d\n",
689 dhexpanded ? dhexpanded : US"default", dh_bitsize, tls_dh_max_bits);
691 #if OPENSSL_VERSION_NUMBER < 0x30000000L
694 /* The EVP_PKEY ownership stays with the ctx; do not free it */
703 /*************************************************
704 * Initialize for ECDH *
705 *************************************************/
707 /* "auto" needs to be handled carefully.
708 OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
709 OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
710 (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
711 OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
712 https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
717 init_ecdh_auto(SSL_CTX * sctx)
719 #if OPENSSL_VERSION_NUMBER < 0x10002000L
720 DEBUG(D_tls) debug_printf(
721 " ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
722 return US"prime256v1";
725 # if defined SSL_CTRL_SET_ECDH_AUTO
727 DEBUG(D_tls) debug_printf(
728 " ECDH OpenSSL 1.0.2+: temp key parameter settings: autoselection\n");
729 SSL_CTX_set_ecdh_auto(sctx, 1);
734 DEBUG(D_tls) debug_printf(
735 " ECDH OpenSSL 1.1.0+: temp key parameter settings: library default selection\n");
742 /* Load parameters for ECDH encryption. Server only.
744 For now, we stick to NIST P-256 because: it's simple and easy to configure;
745 it avoids any patent issues that might bite redistributors; despite events in
746 the news and concerns over curve choices, we're not cryptographers, we're not
747 pretending to be, and this is "good enough" to be better than no support,
748 protecting against most adversaries. Given another year or two, there might
749 be sufficient clarity about a "right" way forward to let us make an informed
750 decision, instead of a knee-jerk reaction.
752 Longer-term, we should look at supporting both various named curves and
753 external files generated with "openssl ecparam", much as we do for init_dh().
754 We should also support "none" as a value, to explicitly avoid initialisation.
759 sctx The current SSL CTX (inbound or outbound)
760 errstr error string pointer
762 Returns: TRUE if OK (nothing to set up, or setup worked)
766 init_ecdh(SSL_CTX * sctx, uschar ** errstr)
768 #ifdef OPENSSL_NO_ECDH
772 # ifndef EXIM_HAVE_ECDH
774 debug_printf(" No OpenSSL API to define ECDH parameters, skipping\n");
779 int ngroups, rc, sep;
780 const uschar * curves_list, * curve;
781 # ifdef EXIM_HAVE_OPENSSL_SET1_GROUPS
787 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
790 /* Is the option deliberately empty? */
792 if (!exp_curve || !*exp_curve)
795 /* Limit the list to hardwired array size. Drop out if any element is "suto". */
797 curves_list = exp_curve;
800 ngroups < nelem(nids)
801 && (curve = string_nextinlist(&curves_list, &sep, NULL, 0));
803 if (Ustrcmp(curve, "auto") == 0)
805 DEBUG(D_tls) if (ngroups > 0)
806 debug_printf(" tls_eccurve 'auto' item takes precedence\n");
807 if ((exp_curve = init_ecdh_auto(sctx))) break; /* have a curve name to set */
808 return TRUE; /* all done */
813 /* Translate to NIDs */
815 curves_list = exp_curve;
816 for (ngroups = 0; curve = string_nextinlist(&curves_list, &sep, NULL, 0);
818 if ( (nids[ngroups] = OBJ_sn2nid (CCS curve)) == NID_undef
819 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
820 && (nids[ngroups] = EC_curve_nist2nid(CCS curve)) == NID_undef
824 uschar * s = string_sprintf("Unknown curve name in tls_eccurve '%s'", curve);
825 DEBUG(D_tls) debug_printf("TLS error: %s\n", s);
826 if (errstr) *errstr = s;
830 # ifdef EXIM_HAVE_OPENSSL_SET1_GROUPS
833 if ((rc = SSL_CTX_set1_groups(sctx, nids, ngroups)) == 0)
834 tls_error(string_sprintf("Error enabling '%s' group(s)", exp_curve), NULL, NULL, errstr);
836 DEBUG(D_tls) debug_printf(" ECDH: enabled '%s' group(s)\n", exp_curve);
838 # else /* Cannot handle a list; only 1 element nids array */
841 if (!(ecdh = EC_KEY_new_by_curve_name(nids[0])))
843 tls_error(US"Unable to create ec curve", NULL, NULL, errstr);
847 /* The "tmp" in the name here refers to setting a temporary key
848 not to the stability of the interface. */
850 if ((rc = SSL_CTX_set_tmp_ecdh(sctx, ecdh)) == 0)
851 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), NULL, NULL, errstr);
853 DEBUG(D_tls) debug_printf(" ECDH: enabled '%s' curve\n", exp_curve);
856 # endif /*!EXIM_HAVE_OPENSSL_SET1_GROUPS*/
860 # endif /*EXIM_HAVE_ECDH*/
861 #endif /*OPENSSL_NO_ECDH*/
866 /*************************************************
867 * Expand key and cert file specs *
868 *************************************************/
870 #if OPENSSL_VERSION_NUMBER < 0x30000000L
873 s SSL connection (not used)
877 Returns: pointer to generated key
881 rsa_callback(SSL *s, int export, int keylength)
884 #ifdef EXIM_HAVE_RSA_GENKEY_EX
885 BIGNUM *bn = BN_new();
888 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
890 # ifdef EXIM_HAVE_RSA_GENKEY_EX
891 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
892 || !(rsa_key = RSA_new())
893 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
896 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
900 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
901 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
907 #endif /* pre-3.0.0 */
911 /* Create and install a selfsigned certificate, for use in server mode */
912 /*XXX we could arrange to call this during prelo for a null tls_certificate option.
913 The normal cache inval + relo will suffice.
914 Just need a timer for inval. */
917 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
924 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
925 where = US"allocating pkey";
926 if (!(pkey = EVP_PKEY_new()))
929 where = US"allocating cert";
930 if (!(x509 = X509_new()))
933 where = US"generating pkey";
934 #if OPENSSL_VERSION_NUMBER < 0x30000000L
937 if (!(rsa = rsa_callback(NULL, 0, 2048)))
940 where = US"assigning pkey";
941 if (!EVP_PKEY_assign_RSA(pkey, rsa))
945 pkey = EVP_RSA_gen(2048);
948 X509_set_version(x509, 2); /* N+1 - version 3 */
949 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
950 X509_gmtime_adj(X509_get_notBefore(x509), 0);
951 X509_gmtime_adj(X509_get_notAfter(x509), (long)2 * 60 * 60); /* 2 hour */
952 X509_set_pubkey(x509, pkey);
954 name = X509_get_subject_name(x509);
955 X509_NAME_add_entry_by_txt(name, "C",
956 MBSTRING_ASC, CUS "UK", -1, -1, 0);
957 X509_NAME_add_entry_by_txt(name, "O",
958 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
959 X509_NAME_add_entry_by_txt(name, "CN",
960 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
961 X509_set_issuer_name(x509, name);
963 where = US"signing cert";
964 if (!X509_sign(x509, pkey, EVP_md5()))
967 where = US"installing selfsign cert";
968 if (!SSL_CTX_use_certificate(sctx, x509))
971 where = US"installing selfsign key";
972 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
978 (void) tls_error(where, NULL, NULL, errstr);
979 if (x509) X509_free(x509);
980 if (pkey) EVP_PKEY_free(pkey);
990 /*************************************************
991 * Information callback *
992 *************************************************/
994 /* The SSL library functions call this from time to time to indicate what they
995 are doing. We copy the string to the debugging output when TLS debugging has
1007 info_callback(const SSL * s, int where, int ret)
1013 if (where & SSL_ST_CONNECT) g = string_append_listele(g, ',', US"SSL_connect");
1014 if (where & SSL_ST_ACCEPT) g = string_append_listele(g, ',', US"SSL_accept");
1015 if (where & SSL_CB_LOOP) g = string_append_listele(g, ',', US"state_chg");
1016 if (where & SSL_CB_EXIT) g = string_append_listele(g, ',', US"hshake_exit");
1017 if (where & SSL_CB_READ) g = string_append_listele(g, ',', US"read");
1018 if (where & SSL_CB_WRITE) g = string_append_listele(g, ',', US"write");
1019 if (where & SSL_CB_ALERT) g = string_append_listele(g, ',', US"alert");
1020 if (where & SSL_CB_HANDSHAKE_START) g = string_append_listele(g, ',', US"hshake_start");
1021 if (where & SSL_CB_HANDSHAKE_DONE) g = string_append_listele(g, ',', US"hshake_done");
1023 if (where & SSL_CB_LOOP)
1024 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
1025 else if (where & SSL_CB_ALERT)
1026 debug_printf("SSL %s %s:%s\n", g->s,
1027 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
1028 else if (where & SSL_CB_EXIT)
1031 debug_printf("SSL %s: %s in %s\n", g->s,
1032 ret == 0 ? "failed" : "error", SSL_state_string_long(s));
1034 else if (where & (SSL_CB_HANDSHAKE_START | SSL_CB_HANDSHAKE_DONE))
1035 debug_printf("SSL %s: %s\n", g->s, SSL_state_string_long(s));
1039 #ifdef OPENSSL_HAVE_KEYLOG_CB
1041 keylog_callback(const SSL *ssl, const char *line)
1045 DEBUG(D_tls) debug_printf("%.200s\n", line);
1046 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
1047 if (!(fp = fopen(filename, "a"))) return;
1048 fprintf(fp, "%s\n", line);
1057 #ifndef DISABLE_EVENT
1059 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
1060 BOOL *calledp, const BOOL *optionalp, const uschar * what)
1066 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
1069 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
1070 old_cert = tlsp->peercert;
1071 tlsp->peercert = X509_dup(cert);
1072 /* NB we do not bother setting peerdn */
1073 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth), &errno)))
1075 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
1076 "depth=%d cert=%s: %s",
1077 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1078 what, depth, dn, yield);
1082 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
1083 return 1; /* reject (leaving peercert set) */
1085 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
1086 "(host in tls_try_verify_hosts)\n");
1087 tlsp->verify_override = TRUE;
1089 X509_free(tlsp->peercert);
1090 tlsp->peercert = old_cert;
1096 /*************************************************
1097 * Callback for verification *
1098 *************************************************/
1100 /* The SSL library does certificate verification if set up to do so. This
1101 callback has the current yes/no state is in "state". If verification succeeded,
1102 we set the certificate-verified flag. If verification failed, what happens
1103 depends on whether the client is required to present a verifiable certificate
1106 If verification is optional, we change the state to yes, but still log the
1107 verification error. For some reason (it really would help to have proper
1108 documentation of OpenSSL), this callback function then gets called again, this
1109 time with state = 1. We must take care not to set the private verified flag on
1110 the second time through.
1112 Note: this function is not called if the client fails to present a certificate
1113 when asked. We get here only if a certificate has been received. Handling of
1114 optional verification for this case is done when requesting SSL to verify, by
1115 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
1117 May be called multiple times for different issues with a certificate, even
1118 for a given "depth" in the certificate chain.
1121 preverify_ok current yes/no state as 1/0
1122 x509ctx certificate information.
1123 tlsp per-direction (client vs. server) support data
1124 calledp has-been-called flag
1125 optionalp verification-is-optional flag
1127 Returns: 0 if verification should fail, otherwise 1
1131 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1132 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1134 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1135 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1138 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1140 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1141 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1142 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1145 dn[sizeof(dn)-1] = '\0';
1147 tlsp->verify_override = FALSE;
1148 if (preverify_ok == 0)
1150 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1151 *verify_mode, sender_host_address)
1153 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1154 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1156 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1160 if (!tlsp->peercert)
1161 tlsp->peercert = X509_dup(cert); /* record failing cert */
1162 return 0; /* reject */
1164 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1165 "tls_try_verify_hosts)\n");
1166 tlsp->verify_override = TRUE;
1169 else if (depth != 0)
1171 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1172 #ifndef DISABLE_EVENT
1173 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1174 return 0; /* reject, with peercert set */
1179 const uschar * verify_cert_hostnames;
1181 if ( tlsp == &tls_out
1182 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1183 /* client, wanting hostname check */
1186 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1187 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1188 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1190 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1191 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1194 const uschar * list = verify_cert_hostnames;
1197 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1199 DEBUG(D_tls|D_lookup) debug_printf_indent("%s suitable for cert, per OpenSSL?", name);
1200 if ((rc = X509_check_host(cert, CCS name, 0,
1201 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1202 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1207 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1208 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1211 DEBUG(D_tls|D_lookup) debug_printf_indent(" yes\n");
1214 else DEBUG(D_tls|D_lookup) debug_printf_indent(" no\n");
1218 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1221 uschar * extra = verify_mode
1222 ? string_sprintf(" (during %c-verify for [%s])",
1223 *verify_mode, sender_host_address)
1225 log_write(0, LOG_MAIN,
1226 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1227 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1228 extra, dn, verify_cert_hostnames);
1232 if (!tlsp->peercert)
1233 tlsp->peercert = X509_dup(cert); /* record failing cert */
1234 return 0; /* reject */
1236 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1237 "tls_try_verify_hosts)\n");
1238 tlsp->verify_override = TRUE;
1242 #ifndef DISABLE_EVENT
1243 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1244 return 0; /* reject, with peercert set */
1247 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1248 *calledp ? "" : " authenticated", dn);
1252 return 1; /* accept, at least for this level */
1256 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1258 return verify_callback(preverify_ok, x509ctx, &tls_out,
1259 &client_verify_callback_called, &client_verify_optional);
1263 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1265 return verify_callback(preverify_ok, x509ctx, &tls_in,
1266 &server_verify_callback_called, &server_verify_optional);
1272 /* This gets called *by* the dane library verify callback, which interposes
1276 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1278 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1280 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1281 #ifndef DISABLE_EVENT
1282 BOOL dummy_called, optional = FALSE;
1285 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1287 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1288 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1289 deliver_host_address);
1292 dn[sizeof(dn)-1] = '\0';
1294 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1295 preverify_ok ? "ok":"BAD", depth, dn);
1297 #ifndef DISABLE_EVENT
1298 if (verify_event(&tls_out, cert, depth, dn,
1299 &dummy_called, &optional, US"DANE"))
1300 return 0; /* reject, with peercert set */
1303 if (preverify_ok == 1)
1304 tls_out.dane_verified = TRUE;
1307 int err = X509_STORE_CTX_get_error(x509ctx);
1309 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1310 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1313 return preverify_ok;
1316 #endif /*SUPPORT_DANE*/
1319 #ifndef DISABLE_OCSP
1321 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1323 BIO_printf(bp, "\t%s: ", str);
1324 ASN1_GENERALIZEDTIME_print(bp, time);
1328 /*************************************************
1329 * Load OCSP information into state *
1330 *************************************************/
1331 /* Called to load the server OCSP response from the given file into memory, once
1332 caller has determined this is needed. Checks validity. Debugs a message
1335 ASSUMES: single response, for single cert.
1338 state various parts of session state
1339 filename the filename putatively holding an OCSP response
1340 is_pem file is PEM format; otherwise is DER
1344 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1348 OCSP_RESPONSE * resp;
1349 OCSP_BASICRESP * basic_response;
1350 OCSP_SINGLERESP * single_response;
1351 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1352 STACK_OF(X509) * sk;
1353 int status, reason, i;
1356 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1358 if (!filename || !*filename) return;
1361 if (!(bio = BIO_new_file(CS filename, "rb")))
1363 log_write(0, LOG_MAIN|LOG_PANIC,
1364 "Failed to open OCSP response file \"%s\": %.100s",
1365 filename, ERR_reason_error_string(ERR_get_error()));
1371 uschar * data, * freep;
1374 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1376 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
1377 filename, ERR_reason_error_string(ERR_get_error()));
1381 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1382 OPENSSL_free(freep);
1385 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1390 log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
1391 filename, ERR_reason_error_string(ERR_get_error()));
1395 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1397 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1398 OCSP_response_status_str(status), status);
1404 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1405 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1410 if (!(basic_response = OCSP_response_get1_basic(resp)))
1413 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1417 sk = state->u_ocsp.server.verify_stack; /* set by setup_certs() / chain_from_pem_file() */
1419 /* May need to expose ability to adjust those flags?
1420 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1421 OCSP_TRUSTOTHER OCSP_NOINTERN */
1423 /* This does a partial verify (only the signer link, not the whole chain-to-CA)
1424 on the OCSP proof before we load it for serving up; possibly overkill -
1425 just date-checks might be nice enough.
1427 OCSP_basic_verify takes a "store" arg, but does not
1428 use it for the chain verification, when OCSP_NOVERIFY is set.
1429 The content from the wire "basic_response" and a cert-stack "sk" are all
1432 We have a stack, loaded in setup_certs() if tls_verify_certificates
1433 was a file (not a directory, or "system"). It is unfortunate we
1434 cannot used the connection context store, as that would neatly
1435 handle the "system" case too, but there seems to be no library
1436 function for getting a stack from a store.
1437 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1438 [ 3.0.0 - sk = X509_STORE_get1_all_certs(store) ]
1439 We do not free the stack since it could be needed a second time for
1442 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1443 be a public interface into the OpenSSL library (there's no manual entry) -
1444 (in 3.0.0 + it is public)
1445 But what with? We also use OCSP_basic_verify in the client stapling callback.
1446 And there we NEED it; we must verify that status... unless the
1447 library does it for us anyway? */
1449 if ((i = OCSP_basic_verify(basic_response, sk, NULL, OCSP_NOVERIFY)) < 0)
1453 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1454 debug_printf("OCSP response has bad signature: %s\n", US ssl_errstring);
1459 /* Here's the simplifying assumption: there's only one response, for the
1460 one certificate we use, and nothing for anything else in a chain. If this
1461 proves false, we need to extract a cert id from our issued cert
1462 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1463 right cert in the stack and then calls OCSP_single_get0_status()).
1465 I'm hoping to avoid reworking a bunch more of how we handle state here.
1467 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1470 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1473 debug_printf("Unable to get first response from OCSP basic response.\n");
1477 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1478 if (status != V_OCSP_CERTSTATUS_GOOD)
1480 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1481 OCSP_cert_status_str(status), status,
1482 OCSP_crl_reason_str(reason), reason);
1486 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1490 BIO * bp = BIO_new(BIO_s_mem());
1493 time_print(bp, "This OCSP Update", thisupd);
1494 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
1495 if ((len = (int) BIO_get_mem_data(bp, CSS &s)) > 0) debug_printf("%.*s", len, s);
1496 debug_printf("OCSP status invalid times.\n");
1502 /* Add the resp to the list used by tls_server_stapling_cb() */
1504 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1505 while (oentry = *op)
1507 *op = oentry = store_get(sizeof(ocsp_resplist), GET_UNTAINTED);
1508 oentry->next = NULL;
1509 oentry->resp = resp;
1514 if (f.running_in_test_harness)
1516 extern char ** environ;
1517 if (environ) for (uschar ** p = USS environ; *p; p++)
1518 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1520 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1521 goto supply_response;
1529 ocsp_free_response_list(exim_openssl_state_st * state)
1531 for (ocsp_resplist * olist = state->u_ocsp.server.olist; olist;
1532 olist = olist->next)
1533 OCSP_RESPONSE_free(olist->resp);
1534 state->u_ocsp.server.olist = NULL;
1536 #endif /*!DISABLE_OCSP*/
1543 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1546 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1547 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1548 return tls_error(string_sprintf(
1549 "SSL_CTX_use_certificate_chain_file file=%s", file),
1550 cbinfo->host, NULL, errstr);
1555 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1558 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1559 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1560 return tls_error(string_sprintf(
1561 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1568 /* Called once during tls_init and possibly again during TLS setup, for a
1569 new context, if Server Name Indication was used and tls_sni was seen in
1570 the certificate string.
1573 sctx the SSL_CTX* to update
1574 state various parts of session state
1575 errstr error string pointer
1577 Returns: OK/DEFER/FAIL
1581 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1586 if (!state->certificate)
1588 if (!state->is_server) /* client */
1591 if (tls_install_selfsign(sctx, errstr) != OK)
1598 if ( !reexpand_tls_files_for_sni
1599 && ( Ustrstr(state->certificate, US"tls_sni")
1600 || Ustrstr(state->certificate, US"tls_in_sni")
1601 || Ustrstr(state->certificate, US"tls_out_sni")
1603 reexpand_tls_files_for_sni = TRUE;
1605 if ( !expand_check(state->certificate, US"tls_certificate", &expanded, errstr)
1606 || f.expand_string_forcedfail)
1608 if (f.expand_string_forcedfail)
1609 *errstr = US"expansion of tls_certificate failed";
1614 if (state->is_server)
1616 const uschar * file_list = expanded;
1619 #ifndef DISABLE_OCSP
1620 const uschar * olist = state->u_ocsp.server.file;
1623 BOOL fmt_pem = FALSE;
1626 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1628 if (olist && !*olist)
1631 /* If doing a re-expand after SNI, avoid reloading the OCSP
1632 responses when the list of filenames has not changed.
1633 The creds-invali on content change wipes file_expanded, so that
1634 always reloads here. */
1636 if ( state->u_ocsp.server.file_expanded && olist
1637 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1639 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1644 ocsp_free_response_list(state);
1645 state->u_ocsp.server.file_expanded = olist;
1649 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1651 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1654 #ifndef DISABLE_OCSP
1656 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1658 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1663 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1668 ocsp_load_response(state, ofile, fmt_pem);
1671 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1675 else /* would there ever be a need for multiple client certs? */
1676 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1679 if ( state->privatekey
1680 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr)
1681 || f.expand_string_forcedfail)
1683 if (f.expand_string_forcedfail)
1684 *errstr = US"expansion of tls_privatekey failed";
1688 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1689 of the expansion is an empty string, ignore it also, and assume the private
1690 key is in the same file as the certificate. */
1692 if (expanded && *expanded)
1693 if (state->is_server)
1695 const uschar * file_list = expanded;
1699 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1700 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1703 else /* would there ever be a need for multiple client certs? */
1704 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1714 /**************************************************
1715 * One-time init credentials for server and client *
1716 **************************************************/
1719 normalise_ciphers(uschar ** ciphers, const uschar * pre_expansion_ciphers)
1721 uschar * s = *ciphers;
1723 if (!s || !Ustrchr(s, '_')) return; /* no change needed */
1725 if (s == pre_expansion_ciphers)
1726 s = string_copy(s); /* get writable copy */
1728 for (uschar * t = s; *t; t++) if (*t == '_') *t = '-';
1733 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1734 uschar * ciphers, uschar ** errstr)
1736 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1737 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1738 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1739 state->server_cipher_list = ciphers;
1746 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1749 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1750 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1752 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1754 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1756 /* Set up the information callback, which outputs if debugging is at a suitable
1761 SSL_CTX_set_info_callback(ctx, info_callback);
1762 #if defined(EXIM_HAVE_OPENSSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1763 /* this needs a debug build of OpenSSL */
1764 SSL_CTX_set_msg_callback(ctx, SSL_trace);
1766 #ifdef OPENSSL_HAVE_KEYLOG_CB
1767 SSL_CTX_set_keylog_callback(ctx, keylog_callback);
1771 /* Automatically re-try reads/writes after renegotiation. */
1772 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1779 tls_server_creds_init(void)
1782 uschar * dummy_errstr;
1783 unsigned lifetime = 0;
1787 state_server.lib_state = null_tls_preload;
1789 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1791 state_server.lib_state.lib_ctx = ctx;
1793 /* Preload DH params and EC curve */
1795 if (opt_unset_or_noexpand(tls_dhparam))
1797 DEBUG(D_tls) debug_printf("TLS: preloading DH params '%s' for server\n", tls_dhparam);
1798 if (init_dh(ctx, tls_dhparam, &dummy_errstr))
1799 state_server.lib_state.dh = TRUE;
1802 DEBUG(D_tls) debug_printf("TLS: not preloading DH params for server\n");
1803 if (opt_unset_or_noexpand(tls_eccurve))
1805 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve '%s' for server\n", tls_eccurve);
1806 if (init_ecdh(ctx, &dummy_errstr))
1807 state_server.lib_state.ecdh = TRUE;
1810 DEBUG(D_tls) debug_printf("TLS: not preloading ECDH curve for server\n");
1812 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1813 /* If we can, preload the Authorities for checking client certs against.
1814 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1815 at TLS conn startup.
1816 Do this before the server ocsp so that its info can verify the ocsp. */
1818 if ( opt_set_and_noexpand(tls_verify_certificates)
1819 && opt_unset_or_noexpand(tls_crl))
1821 /* Watch the default dir also as they are always included */
1823 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1824 && tls_set_watch(tls_verify_certificates, FALSE)
1825 && tls_set_watch(tls_crl, FALSE))
1827 uschar * v_certs = tls_verify_certificates;
1828 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1830 if (setup_certs(ctx, &v_certs, tls_crl, NULL, &dummy_errstr) == OK)
1831 state_server.lib_state.cabundle = TRUE;
1833 /* If we can, preload the server-side cert, key and ocsp */
1835 if ( opt_set_and_noexpand(tls_certificate)
1836 # ifndef DISABLE_OCSP
1837 && opt_unset_or_noexpand(tls_ocsp_file)
1839 && opt_unset_or_noexpand(tls_privatekey))
1841 /* Set watches on the filenames. The implementation does de-duplication
1842 so we can just blindly do them all. */
1844 if ( tls_set_watch(tls_certificate, TRUE)
1845 # ifndef DISABLE_OCSP
1846 && tls_set_watch(tls_ocsp_file, TRUE)
1848 && tls_set_watch(tls_privatekey, TRUE))
1850 state_server.certificate = tls_certificate;
1851 state_server.privatekey = tls_privatekey;
1852 #ifndef DISABLE_OCSP
1853 state_server.u_ocsp.server.file = tls_ocsp_file;
1856 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1857 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1858 state_server.lib_state.conn_certs = TRUE;
1861 else if ( !tls_certificate && !tls_privatekey
1862 # ifndef DISABLE_OCSP
1866 { /* Generate & preload a selfsigned cert. No files to watch. */
1867 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1869 state_server.lib_state.conn_certs = TRUE;
1870 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1874 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1878 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1881 #endif /* EXIM_HAVE_INOTIFY */
1884 /* If we can, preload the ciphers control string */
1886 if (opt_set_and_noexpand(tls_require_ciphers))
1888 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1889 normalise_ciphers(&tls_require_ciphers, tls_require_ciphers);
1890 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1891 &dummy_errstr) == OK)
1892 state_server.lib_state.pri_string = TRUE;
1895 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1902 /* Preload whatever creds are static, onto a transport. The client can then
1903 just copy the pointer as it starts up.
1904 Called from the daemon after a cache-invalidate with watch set; called from
1905 a queue-run startup with watch clear. */
1908 tls_client_creds_init(transport_instance * t, BOOL watch)
1910 smtp_transport_options_block * ob = t->options_block;
1911 exim_openssl_state_st tpt_dummy_state;
1912 host_item * dummy_host = (host_item *)1;
1913 uschar * dummy_errstr;
1918 ob->tls_preload = null_tls_preload;
1919 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1921 ob->tls_preload.lib_ctx = ctx;
1923 tpt_dummy_state.lib_state = ob->tls_preload;
1925 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1926 if ( opt_set_and_noexpand(ob->tls_certificate)
1927 && opt_unset_or_noexpand(ob->tls_privatekey))
1930 || ( tls_set_watch(ob->tls_certificate, FALSE)
1931 && tls_set_watch(ob->tls_privatekey, FALSE)
1934 uschar * pkey = ob->tls_privatekey;
1937 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1939 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1941 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1942 pkey ? pkey : ob->tls_certificate,
1945 ob->tls_preload.conn_certs = TRUE;
1950 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1953 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1954 && opt_unset_or_noexpand(ob->tls_crl))
1957 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1958 && tls_set_watch(ob->tls_verify_certificates, FALSE)
1959 && tls_set_watch(ob->tls_crl, FALSE)
1962 uschar * v_certs = ob->tls_verify_certificates;
1964 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1966 if (setup_certs(ctx, &v_certs,
1967 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
1968 ob->tls_preload.cabundle = TRUE;
1973 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1975 #endif /*EXIM_HAVE_INOTIFY*/
1979 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1980 /* Invalidate the creds cached, by dropping the current ones.
1981 Call when we notice one of the source files has changed. */
1984 tls_server_creds_invalidate(void)
1986 SSL_CTX_free(state_server.lib_state.lib_ctx);
1987 state_server.lib_state = null_tls_preload;
1988 #ifndef DISABLE_OCSP
1989 state_server.u_ocsp.server.file_expanded = NULL;
1995 tls_client_creds_invalidate(transport_instance * t)
1997 smtp_transport_options_block * ob = t->options_block;
1998 SSL_CTX_free(ob->tls_preload.lib_ctx);
1999 ob->tls_preload = null_tls_preload;
2005 tls_server_creds_invalidate(void)
2009 tls_client_creds_invalidate(transport_instance * t)
2012 #endif /*EXIM_HAVE_INOTIFY*/
2017 #ifndef DISABLE_OCSP
2019 debug_print_sn(const X509 * cert)
2021 X509_NAME * sn = X509_get_subject_name((X509 *)cert);
2022 static uschar name[256];
2023 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
2025 name[sizeof(name)-1] = '\0';
2026 debug_printf(" %s\n", name);
2031 x509_stack_dump_cert_s_names(const STACK_OF(X509) * sk)
2034 debug_printf(" (null)\n");
2037 int idx = sk_X509_num(sk);
2039 debug_printf(" (empty)\n");
2041 while (--idx >= 0) debug_print_sn(sk_X509_value(sk, idx));
2046 x509_store_dump_cert_s_names(X509_STORE * store)
2048 # ifdef EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
2050 debug_printf(" (no store)\n");
2053 STACK_OF(X509) * sk = X509_STORE_get1_all_certs(store);
2054 x509_stack_dump_cert_s_names(sk);
2055 sk_X509_pop_free(sk, X509_free);
2059 #endif /*!DISABLE_OCSP*/
2064 #ifndef DISABLE_TLS_RESUME
2065 /* Manage the keysets used for encrypting the session tickets, on the server. */
2067 typedef struct { /* Session ticket encryption key */
2070 const EVP_CIPHER * aes_cipher;
2071 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
2072 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2073 const EVP_MD * hmac_hash;
2075 const uschar * hmac_hashname;
2077 uschar hmac_key[16];
2082 static exim_stek exim_tk; /* current key */
2083 static exim_stek exim_tk_old; /* previous key */
2088 time_t t = time(NULL);
2090 if (exim_tk.name[0])
2092 if (exim_tk.renew >= t) return;
2093 exim_tk_old = exim_tk;
2096 if (f.running_in_test_harness) ssl_session_timeout = TESTSUITE_TICKET_LIFE;
2098 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
2099 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
2100 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
2101 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
2103 exim_tk.name[0] = 'E';
2104 exim_tk.aes_cipher = EVP_aes_256_cbc();
2105 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2106 exim_tk.hmac_hash = EVP_sha256();
2108 exim_tk.hmac_hashname = US "sha256";
2110 exim_tk.expire = t + ssl_session_timeout;
2111 exim_tk.renew = t + ssl_session_timeout/2;
2117 if (!exim_tk.name[0]) return NULL;
2122 tk_find(const uschar * name)
2124 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
2125 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
2132 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2140 /*XXX will want these dependent on the ssl session strength */
2141 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2142 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2143 key->hmac_hash, NULL);
2146 OSSL_PARAM params[3];
2147 uschar * hk = string_copy(key->hmac_hashname); /* need nonconst */
2148 params[0] = OSSL_PARAM_construct_octet_string("key", key->hmac_key, sizeof(key->hmac_key));
2149 params[1] = OSSL_PARAM_construct_utf8_string("digest", CS hk, 0);
2150 params[2] = OSSL_PARAM_construct_end();
2151 if (EVP_MAC_CTX_set_params(hctx, params) == 0)
2153 DEBUG(D_tls) debug_printf("EVP_MAC_CTX_set_params: %s\n",
2154 ERR_reason_error_string(ERR_get_error()));
2155 return 0; /* error in mac initialisation */
2162 /* Callback for session tickets, on server */
2164 ticket_key_callback(SSL * ssl, uschar key_name[16],
2165 uschar * iv, EVP_CIPHER_CTX * c_ctx,
2166 # if OPENSSL_VERSION_NUMBER < 0x30000000L
2173 tls_support * tlsp = state_server.tlsp;
2178 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
2179 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2181 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
2182 return -1; /* insufficient random */
2184 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
2185 return 0; /* key couldn't be created */
2186 memcpy(key_name, key->name, 16);
2187 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
2189 if (tk_hmac_init(hctx, key) == 0) return 0;
2190 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2192 DEBUG(D_tls) debug_printf("ticket created\n");
2197 time_t now = time(NULL);
2199 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
2200 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2202 if (!(key = tk_find(key_name)) || key->expire < now)
2206 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
2207 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
2212 if (tk_hmac_init(hctx, key) == 0) return 0;
2213 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2215 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2217 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2218 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2219 be better. To do that we'd have to encode ticket lifetime in the name as
2220 we don't yet see the restored session. Could check posthandshake for TLS1.3
2221 and trigger a new ticket then, but cannot do that for TLS1.2 */
2222 return key->renew < now ? 2 : 1;
2225 #endif /* !DISABLE_TLS_RESUME */
2230 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2231 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2233 /* If verification is optional, don't fail if no certificate */
2235 SSL_CTX_set_verify(ctx,
2236 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2241 /*************************************************
2242 * Callback to handle SNI *
2243 *************************************************/
2245 /* Called when acting as server during the TLS session setup if a Server Name
2246 Indication extension was sent by the client.
2248 API documentation is OpenSSL s_server.c implementation.
2251 s SSL* of the current session
2252 ad unknown (part of OpenSSL API) (unused)
2253 arg Callback of "our" registered data
2255 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2257 XXX might need to change to using ClientHello callback,
2258 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2261 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2263 tls_servername_cb(SSL * s, int * ad ARG_UNUSED, void * arg)
2265 const char * servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2266 exim_openssl_state_st * state = (exim_openssl_state_st *) arg;
2268 int old_pool = store_pool;
2272 return SSL_TLSEXT_ERR_OK;
2274 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2275 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2277 /* Make the extension value available for expansion */
2278 store_pool = POOL_PERM;
2279 tls_in.sni = string_copy_taint(US servername, GET_TAINTED);
2280 store_pool = old_pool;
2282 if (!reexpand_tls_files_for_sni)
2283 return SSL_TLSEXT_ERR_OK;
2285 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2286 not confident that memcpy wouldn't break some internal reference counting.
2287 Especially since there's a references struct member, which would be off. */
2289 if (lib_ctx_new(&server_sni, NULL, &errstr) != OK)
2292 /* Not sure how many of these are actually needed, since SSL object
2293 already exists. Might even need this selfsame callback, for reneg? */
2296 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2297 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2298 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2299 #ifdef OPENSSL_MIN_PROTO_VERSION
2300 SSL_CTX_set_min_proto_version(server_sni, SSL3_VERSION);
2302 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2303 SSL_CTX_clear_options(server_sni, ~SSL_CTX_get_options(ctx));
2304 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2305 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2306 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2309 if ( !init_dh(server_sni, state->dhparam, &errstr)
2310 || !init_ecdh(server_sni, &errstr)
2314 if ( state->server_cipher_list
2315 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2318 #ifndef DISABLE_OCSP
2319 if (state->u_ocsp.server.file)
2321 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2322 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2327 uschar * v_certs = tls_verify_certificates;
2328 if ((rc = setup_certs(server_sni, &v_certs, tls_crl, NULL,
2332 if (v_certs && *v_certs)
2333 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2336 /* do this after setup_certs, because this can require the certs for verifying
2337 OCSP information. */
2338 if ((rc = tls_expand_session_files(server_sni, state, &errstr)) != OK)
2341 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2342 SSL_set_SSL_CTX(s, server_sni);
2343 return SSL_TLSEXT_ERR_OK;
2346 log_write(0, LOG_MAIN|LOG_PANIC, "%s", errstr);
2347 return SSL_TLSEXT_ERR_ALERT_FATAL;
2349 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2354 #ifdef EXIM_HAVE_ALPN
2355 /*************************************************
2356 * Callback to handle ALPN *
2357 *************************************************/
2359 /* Called on server if tls_alpn nonblank after expansion,
2360 when client offers ALPN, after the SNI callback.
2361 If set and not matching the list then we dump the connection */
2364 tls_server_alpn_cb(SSL *ssl, const uschar ** out, uschar * outlen,
2365 const uschar * in, unsigned int inlen, void * arg)
2369 server_seen_alpn = TRUE;
2372 debug_printf("Received TLS ALPN offer:");
2373 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2376 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2377 debug_printf(" '%.*s'", siz, in + pos + 1);
2379 debug_printf(". Our list: '%s'\n", tls_alpn);
2382 /* Look for an acceptable ALPN */
2384 if ( inlen > 1 /* at least one name */
2385 && in[0]+1 == inlen /* filling the vector, so exactly one name */
2388 const uschar * list = tls_alpn;
2390 for (uschar * name; name = string_nextinlist(&list, &sep, NULL, 0); )
2391 if (Ustrncmp(in+1, name, in[0]) == 0)
2393 *out = in+1; /* we checked for exactly one, so can just point to it */
2395 return SSL_TLSEXT_ERR_OK; /* use ALPN */
2399 /* More than one name from client, or name did not match our list. */
2401 /* This will be fatal to the TLS conn; would be nice to kill TCP also.
2402 Maybe as an option in future; for now leave control to the config (must-tls). */
2404 for (int pos = 0, siz; pos < inlen; pos += siz+1)
2407 if (pos + 1 + siz > inlen) siz = inlen - pos - 1;
2408 g = string_append_listele_n(g, ':', in + pos + 1, siz);
2410 log_write(0, LOG_MAIN, "TLS ALPN (%Y) rejected", g);
2411 gstring_release_unused(g);
2412 return SSL_TLSEXT_ERR_ALERT_FATAL;
2414 #endif /* EXIM_HAVE_ALPN */
2418 #ifndef DISABLE_OCSP
2420 /*************************************************
2421 * Callback to handle OCSP Stapling *
2422 *************************************************/
2424 /* Called when acting as server during the TLS session setup if the client
2425 requests OCSP information with a Certificate Status Request.
2427 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2433 tls_server_stapling_cb(SSL *s, void *arg)
2435 const exim_openssl_state_st * state = arg;
2436 ocsp_resplist * olist = state->u_ocsp.server.olist;
2437 uschar * response_der; /*XXX blob */
2438 int response_der_len;
2441 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2442 olist ? "have" : "lack");
2444 tls_in.ocsp = OCSP_NOT_RESP;
2446 return SSL_TLSEXT_ERR_NOACK;
2448 #ifdef EXIM_HAVE_OPENSSL_GET0_SERIAL
2450 const X509 * cert_sent = SSL_get_certificate(s);
2451 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2452 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2454 for (; olist; olist = olist->next)
2456 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2457 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2458 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2459 ASN1_INTEGER * res_cert_serial;
2460 const BIGNUM * resp_bn;
2461 ASN1_OCTET_STRING * res_cert_iNameHash;
2464 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2465 (OCSP_CERTID *) cid);
2466 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2470 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2471 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2474 if (BN_cmp(cert_bn, resp_bn) == 0)
2476 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2478 /*XXX TODO: check the rest of the list for duplicate matches.
2479 If any, need to also check the Issuer Name hash.
2480 Without this, we will provide the wrong status in the case of
2485 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2489 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2490 return SSL_TLSEXT_ERR_NOACK;
2496 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2497 return SSL_TLSEXT_ERR_NOACK;
2501 /*XXX could we do the i2d earlier, rather than during the callback? */
2502 response_der = NULL;
2503 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2504 if (response_der_len <= 0)
2505 return SSL_TLSEXT_ERR_NOACK;
2507 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2508 response_der, response_der_len);
2509 tls_in.ocsp = OCSP_VFIED;
2510 return SSL_TLSEXT_ERR_OK;
2515 add_chain_to_store(X509_STORE * store, STACK_OF(X509) * sk,
2516 const char * debug_text)
2522 debug_printf("chain for %s:\n", debug_text);
2523 x509_stack_dump_cert_s_names(sk);
2526 if ((idx = sk_X509_num(sk)) > 0)
2528 X509_STORE_add_cert(store, sk_X509_value(sk, idx));
2533 tls_client_stapling_cb(SSL * ssl, void * arg)
2535 exim_openssl_state_st * cbinfo = arg;
2536 const unsigned char * p;
2538 OCSP_RESPONSE * rsp;
2539 OCSP_BASICRESP * bs;
2542 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2543 len = SSL_get_tlsext_status_ocsp_resp(ssl, &p);
2545 { /* Expect this when we requested ocsp but got none */
2546 if (SSL_session_reused(ssl) && tls_out.ocsp == OCSP_VFIED)
2548 DEBUG(D_tls) debug_printf(" null, but resumed; ocsp vfy stored with session is good\n");
2552 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2553 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2555 DEBUG(D_tls) debug_printf(" null\n");
2557 if (!cbinfo->u_ocsp.client.verify_required)
2559 cbinfo->u_ocsp.client.verify_errstr =
2560 US"(SSL_connect) Required TLS certificate status not received";
2564 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2566 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2567 if (LOGGING(tls_cipher))
2568 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2570 DEBUG(D_tls) debug_printf(" parse error\n");
2574 if (!(bs = OCSP_response_get1_basic(rsp)))
2576 tls_out.ocsp = OCSP_FAILED;
2577 if (LOGGING(tls_cipher))
2578 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2580 DEBUG(D_tls) debug_printf(" error parsing response\n");
2581 OCSP_RESPONSE_free(rsp);
2585 /* We'd check the nonce here if we'd put one in the request. */
2586 /* However that would defeat cacheability on the server so we don't. */
2588 /* This section of code reworked from OpenSSL apps source;
2589 The OpenSSL Project retains copyright:
2590 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2594 X509_STORE * verify_store = NULL;
2595 BOOL have_verified_OCSP_signer = FALSE;
2596 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2597 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2600 DEBUG(D_tls) bp = BIO_new(BIO_s_mem());
2602 /* Use the CA & chain that verified the server cert to verify the stapled info */
2603 /*XXX could we do an event here, for observability of ocsp? What reasonable data could we give access to? */
2604 /* Dates would be a start. Do we need another opaque variable type, as for certs, plus an extract expansion? */
2607 /* If this routine is not available, we've avoided [in tls_client_start()]
2608 asking for certificate-status under DANE, so this callback won't run for
2609 that combination. It still will for non-DANE. */
2611 #if defined(EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER) && defined(SUPPORT_DANE)
2614 if ( tls_out.dane_verified
2615 && (have_verified_OCSP_signer =
2616 OCSP_resp_get0_signer(bs, &signer, SSL_get0_verified_chain(ssl)) == 1))
2619 debug_printf("signer for OCSP basicres is in the verified chain;"
2620 " shortcut its verification\n");
2625 STACK_OF(X509) * verified_chain;
2627 verify_store = X509_STORE_new();
2629 SSL_get0_chain_certs(ssl, &verified_chain);
2630 add_chain_to_store(verify_store, verified_chain,
2631 "'current cert' per SSL_get0_chain_certs()");
2632 #ifdef EXIM_HAVE_SSL_GET0_VERIFIED_CHAIN
2633 verified_chain = SSL_get0_verified_chain(ssl);
2634 add_chain_to_store(verify_store, verified_chain,
2635 "SSL_get0_verified_chain()");
2642 debug_printf("Untrusted intermediate cert stack (from SSL_get_peer_cert_chain()):\n");
2643 x509_stack_dump_cert_s_names(SSL_get_peer_cert_chain(ssl));
2645 debug_printf("will use this CA store for verifying basicresp:\n");
2646 x509_store_dump_cert_s_names(verify_store);
2648 /* OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2650 debug_printf("certs contained in basicresp:\n");
2651 x509_stack_dump_cert_s_names(
2652 #ifdef EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_CERTS
2653 OCSP_resp_get0_certs(bs)
2659 #ifdef EXIM_HAVE_OPENSSL_X509_STORE_GET1_ALL_CERTS
2660 /* could do via X509_STORE_get0_objects(); not worth it just for debug info */
2663 if (OCSP_resp_get0_signer(bs, &signer, X509_STORE_get1_all_certs(verify_store)) == 1)
2665 debug_printf("found signer for basicres:\n");
2666 debug_print_sn(signer);
2670 debug_printf("failed to find signer for basicres:\n");
2671 ERR_print_errors(bp);
2680 /* Under DANE the trust-anchor (at least in TA mode) is indicated by the TLSA
2681 record in DNS, and probably is not the root of the chain of certificates. So
2682 accept a partial chain for that case (and hope that anchor is visible for
2683 verifying the OCSP stapling).
2684 XXX for EE mode it won't even be that. Does that make OCSP useless for EE?
2686 Worse, for LetsEncrypt-mode (ocsp signer is leaf-signer) under DANE, the
2687 data used within OpenSSL for the signer has nil pointers for signing
2688 algorithms - and a crash results. Avoid this by shortcutting verification,
2689 having determined that the OCSP signer is in the (DANE-)validated set.
2692 #ifndef OCSP_PARTIAL_CHAIN /* defined for 3.0.0 onwards */
2693 # define OCSP_PARTIAL_CHAIN 0
2696 if ((i = OCSP_basic_verify(bs, SSL_get_peer_cert_chain(ssl),
2699 tls_out.dane_verified
2700 ? have_verified_OCSP_signer
2701 ? OCSP_NOVERIFY | OCSP_NOEXPLICIT
2702 : OCSP_PARTIAL_CHAIN | OCSP_NOEXPLICIT
2705 OCSP_NOEXPLICIT)) <= 0)
2707 DEBUG(D_tls) debug_printf("OCSP_basic_verify() fail: returned %d\n", i);
2708 if (ERR_peek_error())
2710 tls_out.ocsp = OCSP_FAILED;
2711 if (LOGGING(tls_cipher))
2713 static uschar peerdn[256];
2714 const uschar * errstr;;
2716 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
2717 ERR_peek_error_all(NULL, NULL, NULL, CCSS &errstr, NULL);
2720 errstr = CUS ERR_reason_error_string(ERR_peek_error());
2722 X509_NAME_oneline(X509_get_subject_name(SSL_get_peer_certificate(ssl)),
2723 CS peerdn, sizeof(peerdn));
2724 log_write(0, LOG_MAIN,
2725 "[%s] %s Received TLS cert (DN: '%.*s') status response, "
2726 "itself unverifiable: %s",
2727 deliver_host_address, deliver_host,
2728 (int)sizeof(peerdn), peerdn, errstr);
2732 BIO_printf(bp, "OCSP response verify failure\n");
2733 ERR_print_errors(bp);
2736 int len = (int) BIO_get_mem_data(bp, CSS &s);
2737 if (len > 0) debug_printf("%.*s", len, s);
2740 OCSP_RESPONSE_print(bp, rsp, 0);
2745 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2746 " in the root CA certificate; ignoring\n");
2749 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2751 /*XXX So we have a good stapled OCSP status. How do we know
2752 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2753 OCSP_resp_find_status() which matches on a cert id, which presumably
2754 we should use. Making an id needs OCSP_cert_id_new(), which takes
2755 issuerName, issuerKey, serialNumber. Are they all in the cert?
2757 For now, carry on blindly accepting the resp. */
2760 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2761 OCSP_resp_count(bs) - 1;
2763 sk_OCSP_SINGLERESP_num(sresp) - 1;
2767 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2769 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2771 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2772 - but what happens with a GnuTLS-style input?
2774 we could do with a debug label for each singleresp
2775 - it has a certID with a serialNumber, but I see no API to get that
2777 status = OCSP_single_get0_status(single, &reason, &rev,
2778 &thisupd, &nextupd);
2782 time_print(bp, "This OCSP Update", thisupd);
2783 if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
2785 if (!OCSP_check_validity(thisupd, nextupd,
2786 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2788 tls_out.ocsp = OCSP_FAILED;
2789 DEBUG(D_tls) ERR_print_errors(bp);
2790 cbinfo->u_ocsp.client.verify_errstr =
2791 US"(SSL_connect) Server certificate status is out-of-date";
2792 log_write(0, LOG_MAIN, "OCSP dates invalid");
2796 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2797 OCSP_cert_status_str(status));
2800 case V_OCSP_CERTSTATUS_GOOD:
2801 continue; /* the idx loop */
2802 case V_OCSP_CERTSTATUS_REVOKED:
2803 cbinfo->u_ocsp.client.verify_errstr =
2804 US"(SSL_connect) Server certificate revoked";
2805 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2806 reason != -1 ? "; reason: " : "",
2807 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2808 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2811 cbinfo->u_ocsp.client.verify_errstr =
2812 US"(SSL_connect) Server certificate has unknown status";
2813 log_write(0, LOG_MAIN,
2814 "Server certificate status unknown, in OCSP stapling");
2822 tls_out.ocsp = OCSP_VFIED;
2826 tls_out.ocsp = OCSP_FAILED;
2827 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2831 int len = (int) BIO_get_mem_data(bp, CSS &s);
2832 if (len > 0) debug_printf("%.*s", len, s);
2837 OCSP_RESPONSE_free(rsp);
2840 #endif /*!DISABLE_OCSP*/
2843 /*************************************************
2844 * Initialize for TLS *
2845 *************************************************/
2846 /* Called from both server and client code, to do preliminary initialization
2847 of the library. We allocate and return a context structure.
2850 host connected host, if client; NULL if server
2851 ob transport options block, if client; NULL if server
2852 ocsp_file file of stapling info (server); flag for require ocsp (client)
2853 addr address if client; NULL if server (for some randomness)
2854 caller_state place to put pointer to allocated state-struct
2855 errstr error string pointer
2857 Returns: OK/DEFER/FAIL
2861 tls_init(host_item * host, smtp_transport_options_block * ob,
2862 #ifndef DISABLE_OCSP
2865 address_item *addr, exim_openssl_state_st ** caller_state,
2866 tls_support * tlsp, uschar ** errstr)
2869 exim_openssl_state_st * state;
2872 if (host) /* client */
2874 state = store_malloc(sizeof(exim_openssl_state_st));
2875 memset(state, 0, sizeof(*state));
2876 state->certificate = ob->tls_certificate;
2877 state->privatekey = ob->tls_privatekey;
2878 state->is_server = FALSE;
2879 state->dhparam = NULL;
2880 state->lib_state = ob->tls_preload;
2884 state = &state_server;
2885 state->certificate = tls_certificate;
2886 state->privatekey = tls_privatekey;
2887 state->is_server = TRUE;
2888 state->dhparam = tls_dhparam;
2889 state->lib_state = state_server.lib_state;
2895 if (!state->lib_state.pri_string)
2896 state->server_cipher_list = NULL;
2898 #ifndef DISABLE_EVENT
2899 state->event_action = NULL;
2904 /* It turns out that we need to seed the random number generator this early in
2905 order to get the full complement of ciphers to work. It took me roughly a day
2906 of work to discover this by experiment.
2908 On systems that have /dev/urandom, SSL may automatically seed itself from
2909 there. Otherwise, we have to make something up as best we can. Double check
2912 Although we likely called this before, at daemon startup, this is a chance
2913 to mix in further variable info (time, pid) if needed. */
2915 if (!lib_rand_init(addr))
2916 return tls_error(US"RAND_status", host,
2917 US"unable to seed random number generator", errstr);
2919 /* Apply administrator-supplied work-arounds.
2920 Historically we applied just one requested option,
2921 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2922 moved to an administrator-controlled list of options to specify and
2923 grandfathered in the first one as the default value for "openssl_options".
2925 No OpenSSL version number checks: the options we accept depend upon the
2926 availability of the option value macros from OpenSSL. */
2929 if (!tls_openssl_options_parse(openssl_options, &init_options))
2930 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2932 /* Create a context.
2933 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2934 negotiation in the different methods; as far as I can tell, the only
2935 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2936 when OpenSSL is built without SSLv2 support.
2937 By disabling with openssl_options, we can let admins re-enable with the
2940 if (!(ctx = state->lib_state.lib_ctx))
2942 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2944 state->lib_state.lib_ctx = ctx;
2947 #ifndef DISABLE_TLS_RESUME
2948 tlsp->resumption = RESUME_SUPPORTED;
2952 #ifndef DISABLE_TLS_RESUME
2953 /* Should the server offer session resumption? */
2954 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2956 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2957 init_options &= ~SSL_OP_NO_TICKET;
2958 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2959 tlsp->host_resumable = TRUE;
2963 #ifdef OPENSSL_MIN_PROTO_VERSION
2964 SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
2966 DEBUG(D_tls) debug_printf("setting SSL CTX options: %016lx\n", init_options);
2967 SSL_CTX_set_options(ctx, init_options);
2969 uint64_t readback = SSL_CTX_clear_options(ctx, ~init_options);
2970 if (readback != init_options)
2971 return tls_error(string_sprintf(
2972 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2976 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2978 /* We'd like to disable session cache unconditionally, but foolish Outlook
2979 Express clients then give up the first TLS connection and make a second one
2980 (which works). Only when there is an IMAP service on the same machine.
2981 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2982 now, until we work out a decent way of presenting control to the config. It
2983 will never be used because we use a new context every time. */
2985 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2988 /* Initialize with DH parameters if supplied */
2989 /* Initialize ECDH temp key parameter selection */
2993 if (state->lib_state.dh)
2994 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2996 if (!init_dh(ctx, state->dhparam, errstr)) return DEFER;
2998 if (state->lib_state.ecdh)
2999 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
3001 if (!init_ecdh(ctx, errstr)) return DEFER;
3004 /* Set up certificate and key (and perhaps OCSP info) */
3006 if (state->lib_state.conn_certs)
3009 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
3013 #ifndef DISABLE_OCSP
3014 if (!host) /* server */
3016 state->u_ocsp.server.file = ocsp_file;
3017 state->u_ocsp.server.file_expanded = NULL;
3018 state->u_ocsp.server.olist = NULL;
3021 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
3024 /* If we need to handle SNI or OCSP, do so */
3026 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
3027 # ifndef DISABLE_OCSP
3028 if (!host && !(state->u_ocsp.server.verify_stack = sk_X509_new_null()))
3030 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
3035 if (!host) /* server */
3037 # ifndef DISABLE_OCSP
3038 /* We check u_ocsp.server.file, not server.olist, because we care about if
3039 the option exists, not what the current expansion might be, as SNI might
3040 change the certificate and OCSP file in use between now and the time the
3041 callback is invoked. */
3042 if (state->u_ocsp.server.file)
3044 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
3045 SSL_CTX_set_tlsext_status_arg(ctx, state);
3048 /* We always do this, so that $tls_sni is available even if not used in
3050 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
3051 SSL_CTX_set_tlsext_servername_arg(ctx, state);
3053 # ifdef EXIM_HAVE_ALPN
3054 if (tls_alpn && *tls_alpn)
3057 if ( expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr)
3058 && *exp_alpn && !isblank(*exp_alpn))
3060 tls_alpn = exp_alpn; /* subprocess so ok to overwrite */
3061 SSL_CTX_set_alpn_select_cb(ctx, tls_server_alpn_cb, state);
3068 # ifndef DISABLE_OCSP
3070 if(ocsp_file) /* wanting stapling */
3072 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
3074 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
3078 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
3079 SSL_CTX_set_tlsext_status_arg(ctx, state);
3082 #endif /*EXIM_HAVE_OPENSSL_TLSEXT*/
3084 state->verify_cert_hostnames = NULL;
3086 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
3087 /* Set up the RSA callback */
3088 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
3091 /* Finally, set the session cache timeout, and we are done.
3092 The period appears to be also used for (server-generated) session tickets */
3094 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
3095 DEBUG(D_tls) debug_printf("Initialized TLS\n");
3097 *caller_state = state;
3105 /*************************************************
3106 * Get name of cipher in use *
3107 *************************************************/
3110 Argument: pointer to an SSL structure for the connection
3111 pointer to number of bits for cipher
3112 Returns: pointer to allocated string in perm-pool
3116 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
3118 int pool = store_pool;
3119 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
3120 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
3121 the accessor functions use const in the prototype. */
3123 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
3126 SSL_CIPHER_get_bits(c, bits);
3128 store_pool = POOL_PERM;
3129 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
3131 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
3136 /* Get IETF-standard name for ciphersuite.
3137 Argument: pointer to an SSL structure for the connection
3138 Returns: pointer to string
3141 static const uschar *
3142 cipher_stdname_ssl(SSL * ssl)
3144 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
3145 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
3147 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
3148 return cipher_stdname(id >> 8, id & 0xff);
3153 static const uschar *
3154 tlsver_name(SSL * ssl)
3157 int pool = store_pool;
3159 store_pool = POOL_PERM;
3160 s = string_copy(US SSL_get_version(ssl));
3162 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
3163 for (;; p++) if (!(*p = p[1])) break;
3169 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
3171 /*XXX we might consider a list-of-certs variable for the cert chain.
3172 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
3173 in list-handling functions, also consider the difference between the entire
3174 chain and the elements sent by the peer. */
3176 tlsp->peerdn = NULL;
3178 /* Will have already noted peercert on a verify fail; possibly not the leaf */
3179 if (!tlsp->peercert)
3180 tlsp->peercert = SSL_get_peer_certificate(ssl);
3181 /* Beware anonymous ciphers which lead to server_cert being NULL */
3183 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
3184 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
3187 int oldpool = store_pool;
3189 peerdn[siz-1] = '\0'; /* paranoia */
3190 store_pool = POOL_PERM;
3191 tlsp->peerdn = string_copy(peerdn);
3192 store_pool = oldpool;
3194 /* We used to set CV in the cert-verify callbacks (either plain or dane)
3195 but they don't get called on session-resumption. So use the official
3196 interface, which uses the resumed value. Unfortunately this claims verified
3197 when it actually failed but we're in try-verify mode, due to us wanting the
3198 knowlege that it failed so needing to have the callback and forcing a
3199 permissive return. If we don't force it, the TLS startup is failed.
3200 The extra bit of information is set in verify_override in the cb, stashed
3201 for resumption next to the TLS session, and used here. */
3203 if (!tlsp->verify_override)
3204 tlsp->certificate_verified =
3206 tlsp->dane_verified ||
3208 SSL_get_verify_result(ssl) == X509_V_OK;
3216 /*************************************************
3217 * Set up for verifying certificates *
3218 *************************************************/
3220 #ifndef DISABLE_OCSP
3221 /* In the server, load certs from file, return TRUE on success */
3224 chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
3227 STACK_OF(X509) * verify_stack = *vp;
3230 while (sk_X509_num(verify_stack) > 0)
3231 X509_free(sk_X509_pop(verify_stack));
3233 verify_stack = sk_X509_new_null();
3235 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
3236 for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
3237 sk_X509_push(verify_stack, x);
3246 /* Called by both client and server startup; on the server possibly
3247 repeated after a Server Name Indication.
3250 sctx SSL_CTX* to initialise
3251 certsp certs file, returned expanded
3252 crl CRL file or NULL
3253 host NULL in a server; the remote host in a client
3254 errstr error string pointer
3256 Returns: OK/DEFER/FAIL
3260 setup_certs(SSL_CTX * sctx, uschar ** certsp, uschar * crl, host_item * host,
3263 uschar * expcerts, * expcrl;
3265 if (!expand_check(*certsp, US"tls_verify_certificates", &expcerts, errstr))
3267 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3270 if (expcerts && *expcerts)
3272 /* Tell the library to use its compiled-in location for the system default
3273 CA bundle. Then add the ones specified in the config, if any. */
3275 if (!SSL_CTX_set_default_verify_paths(sctx))
3276 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
3278 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
3280 struct stat statbuf;
3282 if (Ustat(expcerts, &statbuf) < 0)
3284 log_write(0, LOG_MAIN|LOG_PANIC,
3285 "failed to stat %s for certificates", expcerts);
3291 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
3292 { file = NULL; dir = expcerts; }
3295 STACK_OF(X509) * verify_stack =
3296 #ifndef DISABLE_OCSP
3297 !host ? state_server.u_ocsp.server.verify_stack :
3300 STACK_OF(X509) ** vp = &verify_stack;
3302 file = expcerts; dir = NULL;
3303 #ifndef DISABLE_OCSP
3304 /* In the server if we will be offering an OCSP proof; load chain from
3305 file for verifying the OCSP proof at load time. */
3307 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
3308 This is inconsistent with the need to verify the OCSP proof of the server cert.
3310 /* *debug_printf("file for checking server ocsp stapling is: %s\n", file); */
3312 && statbuf.st_size > 0
3313 && state_server.u_ocsp.server.file
3314 && !chain_from_pem_file(file, vp)
3317 log_write(0, LOG_MAIN|LOG_PANIC,
3318 "failed to load cert chain from %s", file);
3324 /* If a certificate file is empty, the load function fails with an
3325 unhelpful error message. If we skip it, we get the correct behaviour (no
3326 certificates are recognized, but the error message is still misleading (it
3327 says no certificate was supplied). But this is better. */
3329 if ( (!file || statbuf.st_size > 0)
3330 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
3331 return tls_error(US"SSL_CTX_load_verify_locations",
3332 host, NULL, errstr);
3334 /* On the server load the list of CAs for which we will accept certs, for
3335 sending to the client. This is only for the one-file
3336 tls_verify_certificates variant.
3337 If a list isn't loaded into the server, but some verify locations are set,
3338 the server end appears to make a wildcard request for client certs.
3339 Meanwhile, the client library as default behaviour *ignores* the list
3340 we send over the wire - see man SSL_CTX_set_client_cert_cb.
3341 Because of this, and that the dir variant is likely only used for
3342 the public-CA bundle (not for a private CA), not worth fixing. */
3346 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
3347 int i = sk_X509_NAME_num(names);
3349 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
3350 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
3351 i, i>1 ? "ies":"y");
3355 debug_printf("Added dir for additional certificate authorities\n");
3359 /* Handle a certificate revocation list. */
3361 #if OPENSSL_VERSION_NUMBER > 0x00907000L
3363 /* This bit of code is now the version supplied by Lars Mainka. (I have
3364 merely reformatted it into the Exim code style.)
3366 "From here I changed the code to add support for multiple crl's
3367 in pem format in one file or to support hashed directory entries in
3368 pem format instead of a file. This method now uses the library function
3369 X509_STORE_load_locations to add the CRL location to the SSL context.
3370 OpenSSL will then handle the verify against CA certs and CRLs by
3371 itself in the verify callback." */
3373 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
3374 if (expcrl && *expcrl)
3376 struct stat statbufcrl;
3377 if (Ustat(expcrl, &statbufcrl) < 0)
3379 log_write(0, LOG_MAIN|LOG_PANIC,
3380 "failed to stat %s for certificates revocation lists", expcrl);
3385 /* is it a file or directory? */
3387 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
3388 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
3392 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
3398 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
3400 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
3401 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
3403 /* setting the flags to check against the complete crl chain */
3405 X509_STORE_set_flags(cvstore,
3406 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
3410 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3419 tls_dump_keylog(SSL * ssl)
3421 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3422 BIO * bp = BIO_new(BIO_s_mem());
3425 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3426 len = (int) BIO_get_mem_data(bp, CSS &s);
3427 if (len > 0) debug_printf("%.*s", len, s);
3433 /* Channel-binding info for authenticators
3434 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/
3439 tls_get_channel_binding(SSL * ssl, tls_support * tlsp, const void * taintval)
3444 #ifdef EXIM_HAVE_EXPORT_CHNL_BNGNG
3445 if (SSL_version(ssl) > TLS1_2_VERSION)
3447 /* It's not documented by OpenSSL how big the output buffer must be.
3448 The OpenSSL testcases use 80 bytes but don't say why. The GnuTLS impl only
3449 serves out 32B. RFC 9266 says it is 32B.
3450 Interop fails unless we use the same each end. */
3453 tlsp->channelbind_exporter = TRUE;
3454 taintval = GET_UNTAINTED;
3455 if (SSL_export_keying_material(ssl,
3456 s = store_get((int)len, taintval), len,
3457 "EXPORTER-Channel-Binding", (size_t) 24,
3464 len = SSL_get_peer_finished(ssl, &c, 0);
3465 len = SSL_get_peer_finished(ssl, s = store_get((int)len, taintval), len);
3470 int old_pool = store_pool;
3471 store_pool = POOL_PERM;
3472 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, taintval);
3473 store_pool = old_pool;
3474 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
3479 /*************************************************
3480 * Start a TLS session in a server *
3481 *************************************************/
3482 /* This is called when Exim is running as a server, after having received
3483 the STARTTLS command. It must respond to that command, and then negotiate
3487 errstr pointer to error message
3489 Returns: OK on success
3490 DEFER for errors before the start of the negotiation
3491 FAIL for errors during the negotiation; the server can't
3496 tls_server_start(uschar ** errstr)
3499 uschar * expciphers;
3500 exim_openssl_state_st * dummy_statep;
3503 static uschar peerdn[256];
3505 /* Check for previous activation */
3507 if (tls_in.active.sock >= 0)
3509 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3510 smtp_printf("554 Already in TLS\r\n", SP_NO_MORE);
3514 /* Initialize the SSL library. If it fails, it will already have logged
3517 rc = tls_init(NULL, NULL,
3518 #ifndef DISABLE_OCSP
3521 NULL, &dummy_statep, &tls_in, errstr);
3522 if (rc != OK) return rc;
3523 ctx = state_server.lib_state.lib_ctx;
3525 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3526 were historically separated by underscores. So that I can use either form in my
3527 tests, and also for general convenience, we turn underscores into hyphens here.
3529 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3530 for TLS 1.3 . Since we do not call it at present we get the default list:
3531 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3534 if (state_server.lib_state.pri_string)
3535 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3538 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3543 normalise_ciphers(&expciphers, tls_require_ciphers);
3544 if ((rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3549 /* If this is a host for which certificate verification is mandatory or
3550 optional, set up appropriately. */
3552 tls_in.certificate_verified = FALSE;
3554 tls_in.dane_verified = FALSE;
3556 server_verify_callback_called = FALSE;
3558 if (verify_check_host(&tls_verify_hosts) == OK)
3559 server_verify_optional = FALSE;
3560 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3561 server_verify_optional = TRUE;
3566 uschar * v_certs = tls_verify_certificates;
3568 if (state_server.lib_state.cabundle)
3570 DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n");
3571 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3575 if ((rc = setup_certs(ctx, &v_certs, tls_crl, NULL, errstr)) != OK)
3577 if (v_certs && *v_certs)
3578 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3583 #ifndef DISABLE_TLS_RESUME
3584 # if OPENSSL_VERSION_NUMBER < 0x30000000L
3585 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3586 /* despite working, appears to always return failure, so ignoring */
3588 SSL_CTX_set_tlsext_ticket_key_evp_cb(ctx, ticket_key_callback);
3589 /* despite working, appears to always return failure, so ignoring */
3593 #ifdef OPENSSL_HAVE_NUM_TICKETS
3594 # ifndef DISABLE_TLS_RESUME
3595 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3597 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3602 /* Prepare for new connection */
3604 if (!(ssl = SSL_new(ctx)))
3605 return tls_error(US"SSL_new", NULL, NULL, errstr);
3606 state_server.lib_state.lib_ssl = ssl;
3608 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3610 * With the SSL_clear(), we get strange interoperability bugs with
3611 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3612 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3614 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3615 * session shutdown. In this case, we have a brand new object and there's no
3616 * obvious reason to immediately clear it. I'm guessing that this was
3617 * originally added because of incomplete initialisation which the clear fixed,
3618 * in some historic release.
3621 /* Set context and tell client to go ahead, except in the case of TLS startup
3622 on connection, where outputting anything now upsets the clients and tends to
3623 make them disconnect. We need to have an explicit fflush() here, to force out
3624 the response. Other smtp_printf() calls do not need it, because in non-TLS
3625 mode, the fflush() happens when smtp_getc() is called. */
3627 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3628 if (!tls_in.on_connect)
3630 smtp_printf("220 TLS go ahead\r\n", SP_NO_MORE);
3634 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3635 that the OpenSSL library doesn't. */
3637 SSL_set_wfd(ssl, fileno(smtp_out));
3638 SSL_set_rfd(ssl, fileno(smtp_in));
3639 SSL_set_accept_state(ssl);
3641 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3644 sigalrm_seen = FALSE;
3645 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3646 rc = SSL_accept(ssl);
3651 int error = SSL_get_error(ssl, rc);
3654 case SSL_ERROR_NONE:
3657 case SSL_ERROR_ZERO_RETURN:
3658 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3659 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3660 #ifndef DISABLE_EVENT
3661 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3663 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3666 tls_close(NULL, TLS_NO_SHUTDOWN);
3669 /* Handle genuine errors */
3673 int r = ERR_GET_REASON(ERR_peek_error());
3674 if ( r == SSL_R_WRONG_VERSION_NUMBER
3675 #ifdef SSL_R_VERSION_TOO_LOW
3676 || r == SSL_R_VERSION_TOO_LOW
3678 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3679 s = string_sprintf("(%s)", SSL_get_version(ssl));
3680 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
3681 #ifndef DISABLE_EVENT
3682 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3688 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3689 if (error == SSL_ERROR_SYSCALL)
3693 *errstr = US"SSL_accept: TCP connection closed by peer";
3694 #ifndef DISABLE_EVENT
3695 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3699 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3701 (void) tls_error(US"SSL_accept", NULL,
3702 sigalrm_seen ? US"timed out"
3703 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3705 #ifndef DISABLE_EVENT
3706 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3712 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3713 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3714 anon-authentication ciphersuite negotiated. */
3716 #ifndef DISABLE_TLS_RESUME
3717 if (SSL_session_reused(ssl))
3719 tls_in.resumption |= RESUME_USED;
3720 DEBUG(D_tls) debug_printf("Session reused\n");
3724 #ifdef EXIM_HAVE_ALPN
3725 /* If require-alpn, check server_seen_alpn here. Else abort TLS */
3726 if (!tls_alpn || !*tls_alpn)
3727 { DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n"); }
3728 else if (!server_seen_alpn)
3729 if (verify_check_host(&hosts_require_alpn) == OK)
3731 /* We'd like to send a definitive Alert but OpenSSL provides no facility */
3733 tls_error(US"handshake", NULL, US"ALPN required but not negotiated", errstr);
3737 { DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n"); }
3740 const uschar * name;
3742 SSL_get0_alpn_selected(ssl, &name, &len);
3744 debug_printf("ALPN negotiated: '%.*s'\n", (int)*name, name+1);
3746 debug_printf("ALPN: no protocol negotiated\n");
3751 /* TLS has been set up. Record data for the connection,
3752 adjust the input functions to read via TLS, and initialize things. */
3754 #ifdef SSL_get_extms_support
3755 /*XXX what does this return for tls1.3 ? */
3756 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3758 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3760 tls_in.ver = tlsver_name(ssl);
3761 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3762 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3767 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3768 debug_printf("Shared ciphers: %s\n", buf);
3770 tls_dump_keylog(ssl);
3772 #ifdef EXIM_HAVE_SESSION_TICKET
3774 SSL_SESSION * ss = SSL_get_session(ssl);
3775 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3776 debug_printf("The session has a ticket, life %lu seconds\n",
3777 SSL_SESSION_get_ticket_lifetime_hint(ss));
3782 /* Record the certificate we presented */
3784 X509 * crt = SSL_get_certificate(ssl);
3785 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3788 tls_get_channel_binding(ssl, &tls_in, GET_UNTAINTED);
3790 /* Only used by the server-side tls (tls_in), including tls_getc.
3791 Client-side (tls_out) reads (seem to?) go via
3792 smtp_read_response()/ip_recv().
3793 Hence no need to duplicate for _in and _out.
3795 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3796 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3797 ssl_xfer_eof = ssl_xfer_error = FALSE;
3799 receive_getc = tls_getc;
3800 receive_getbuf = tls_getbuf;
3801 receive_get_cache = tls_get_cache;
3802 receive_hasc = tls_hasc;
3803 receive_ungetc = tls_ungetc;
3804 receive_feof = tls_feof;
3805 receive_ferror = tls_ferror;
3807 tls_in.active.sock = fileno(smtp_out);
3808 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3816 tls_client_basic_ctx_init(SSL_CTX * ctx,
3817 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3822 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3823 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3824 host patterns if one of them is set with content. */
3826 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3827 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3829 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3830 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3833 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3835 client_verify_optional = FALSE;
3836 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3837 client_verify_optional = TRUE;
3842 uschar * v_certs = ob->tls_verify_certificates;
3844 if (state->lib_state.cabundle)
3846 DEBUG(D_tls) debug_printf("TLS: CA bundle for tpt was preloaded\n");
3847 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3851 if ((rc = setup_certs(ctx, &v_certs, ob->tls_crl, host, errstr)) != OK)
3853 if (v_certs && *v_certs)
3854 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3858 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3860 state->verify_cert_hostnames =
3862 string_domain_utf8_to_alabel(host->certname, NULL);
3866 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3867 state->verify_cert_hostnames);
3875 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3878 const char * hostnames[2] = { CS host->name, NULL };
3881 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3882 return tls_error(US"hostnames load", host, NULL, errstr);
3884 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3885 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3886 ) if (rr->type == T_TLSA && rr->size > 3)
3888 const uschar * p = rr->data;
3889 uint8_t usage, selector, mtype;
3890 const char * mdname;
3894 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3895 if (usage != 2 && usage != 3) continue;
3902 default: continue; /* Only match-types 0, 1, 2 are supported */
3903 case 0: mdname = NULL; break;
3904 case 1: mdname = "sha256"; break;
3905 case 2: mdname = "sha512"; break;
3909 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3912 return tls_error(US"tlsa load", host, NULL, errstr);
3913 case 0: /* action not taken */
3917 tls_out.tlsa_usage |= 1<<usage;
3923 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3926 #endif /*SUPPORT_DANE*/
3930 #ifndef DISABLE_TLS_RESUME
3931 /* On the client, get any stashed session for the given IP from hints db
3932 and apply it to the ssl-connection for attempted resumption. */
3935 tls_retrieve_session(tls_support * tlsp, SSL * ssl)
3937 if (tlsp->host_resumable)
3939 dbdata_tls_session * dt;
3941 open_db dbblock, * dbm_file;
3943 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3945 debug_printf("checking for resumable session for %s\n", tlsp->resume_index);
3946 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3948 if ((dt = dbfn_read_with_length(dbm_file, tlsp->resume_index, &len)))
3950 SSL_SESSION * ss = NULL;
3951 const uschar * sess_asn1 = dt->session;
3953 len -= sizeof(dbdata_tls_session);
3954 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3958 ERR_error_string_n(ERR_get_error(),
3959 ssl_errstring, sizeof(ssl_errstring));
3960 debug_printf("decoding session: %s\n", ssl_errstring);
3965 unsigned long lifetime =
3966 #ifdef EXIM_HAVE_SESSION_TICKET
3967 SSL_SESSION_get_ticket_lifetime_hint(ss);
3968 #else /* Use, fairly arbitrilarily, what we as server would */
3969 f.running_in_test_harness ? TESTSUITE_TICKET_LIFE : ssl_session_timeout;
3971 time_t now = time(NULL), expires = lifetime + dt->time_stamp;
3974 DEBUG(D_tls) debug_printf("session expired (by " TIME_T_FMT "s from %lus)\n", now - expires, lifetime);
3975 dbfn_delete(dbm_file, tlsp->resume_index);
3977 else if (SSL_set_session(ssl, ss))
3979 DEBUG(D_tls) debug_printf("good session (" TIME_T_FMT "s left of %lus)\n", expires - now, lifetime);
3980 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3981 tlsp->verify_override = dt->verify_override;
3982 tlsp->ocsp = dt->ocsp;
3986 ERR_error_string_n(ERR_get_error(),
3987 ssl_errstring, sizeof(ssl_errstring));
3988 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3993 DEBUG(D_tls) debug_printf("no session record\n");
3994 dbfn_close(dbm_file);
4000 /* On the client, save the session for later resumption */
4003 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
4005 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
4008 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
4010 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
4012 # ifdef OPENSSL_HAVE_NUM_TICKETS
4013 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
4016 int len = i2d_SSL_SESSION(ss, NULL);
4017 int dlen = sizeof(dbdata_tls_session) + len;
4018 dbdata_tls_session * dt = store_get(dlen, GET_TAINTED);
4019 uschar * s = dt->session;
4020 open_db dbblock, * dbm_file;
4022 DEBUG(D_tls) debug_printf("session is resumable\n");
4023 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
4025 dt->verify_override = tlsp->verify_override;
4026 dt->ocsp = tlsp->ocsp;
4027 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
4029 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
4031 dbfn_write(dbm_file, tlsp->resume_index, dt, dlen);
4032 dbfn_close(dbm_file);
4033 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
4041 /* Construct a key for session DB lookup, and setup the SSL_CTX for resumption */
4044 tls_client_ctx_resume_prehandshake(
4045 exim_openssl_client_tls_ctx * exim_client_ctx, smtp_connect_args * conn_args,
4046 tls_support * tlsp, smtp_transport_options_block * ob)
4048 tlsp->host_resumable = TRUE;
4049 tls_client_resmption_key(tlsp, conn_args, ob);
4051 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
4052 SSL_SESS_CACHE_CLIENT
4053 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
4054 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
4058 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
4059 host_item * host, uschar ** errstr)
4061 if (tlsp->host_resumable)
4064 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
4065 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
4067 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
4068 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
4070 tls_error(US"set ex_data", host, NULL, errstr);
4073 /* debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state); */
4076 tlsp->resumption = RESUME_SUPPORTED;
4077 /* Pick up a previous session, saved on an old ticket */
4078 tls_retrieve_session(tlsp, ssl);
4083 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
4086 if (SSL_session_reused(exim_client_ctx->ssl))
4088 DEBUG(D_tls) debug_printf("The session was reused\n");
4089 tlsp->resumption |= RESUME_USED;
4092 #endif /* !DISABLE_TLS_RESUME */
4095 #ifdef EXIM_HAVE_ALPN
4096 /* Expand and convert an Exim list to an ALPN list. False return for fail.
4097 NULL plist return for silent no-ALPN.
4099 Overwite the passed-in list with the expanded version.
4103 tls_alpn_plist(uschar ** tls_alpn, const uschar ** plist, unsigned * plen,
4108 if (!expand_check(*tls_alpn, US"tls_alpn", &exp_alpn, errstr))
4110 *tls_alpn = exp_alpn;
4114 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
4119 /* The server implementation only accepts exactly one protocol name
4120 but it's little extra code complexity in the client. */
4122 const uschar * list = exp_alpn;
4123 uschar * p = store_get(Ustrlen(exp_alpn), exp_alpn), * s, * t;
4127 for (t = p; s = string_nextinlist(&list, &sep, NULL, 0); t += len)
4129 *t++ = len = (uschar) Ustrlen(s);
4132 *plist = (*plen = t - p) ? p : NULL;
4136 #endif /* EXIM_HAVE_ALPN */
4139 /*************************************************
4140 * Start a TLS session in a client *
4141 *************************************************/
4143 /* Called from the smtp transport after STARTTLS has been accepted.
4146 cctx connection context
4147 conn_args connection details
4148 cookie datum for randomness; can be NULL
4149 tlsp record details of TLS channel configuration here; must be non-NULL
4150 errstr error string pointer
4152 Returns: TRUE for success with TLS session context set in connection context,
4157 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
4158 void * cookie, tls_support * tlsp, uschar ** errstr)
4160 host_item * host = conn_args->host; /* for msgs and option-tests */
4161 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
4162 smtp_transport_options_block * ob = tb
4163 ? (smtp_transport_options_block *)tb->options_block
4164 : &smtp_transport_option_defaults;
4165 exim_openssl_client_tls_ctx * exim_client_ctx;
4166 uschar * expciphers;
4168 static uschar peerdn[256];
4170 #ifndef DISABLE_OCSP
4171 BOOL request_ocsp = FALSE;
4172 BOOL require_ocsp = FALSE;
4176 store_pool = POOL_PERM;
4177 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), GET_UNTAINTED);
4178 exim_client_ctx->corked = NULL;
4182 tlsp->tlsa_usage = 0;
4185 #ifndef DISABLE_OCSP
4187 # ifdef SUPPORT_DANE
4188 if ( conn_args->dane
4189 && ob->hosts_request_ocsp[0] == '*'
4190 && ob->hosts_request_ocsp[1] == '\0'
4193 /* Unchanged from default. Use a safer one under DANE */
4194 request_ocsp = TRUE;
4195 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
4196 " {= {4}{$tls_out_tlsa_usage}} } "
4202 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
4203 request_ocsp = TRUE;
4205 # ifdef SUPPORT_DANE
4209 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4211 # if defined(SUPPORT_DANE) && !defined(EXIM_HAVE_OPENSSL_OCSP_RESP_GET0_SIGNER)
4212 if (conn_args->dane && (require_ocsp || request_ocsp))
4214 DEBUG(D_tls) debug_printf("OpenSSL version to early to combine OCSP"
4215 " and DANE; disabling OCSP\n");
4216 require_ocsp = request_ocsp = FALSE;
4222 rc = tls_init(host, ob,
4223 #ifndef DISABLE_OCSP
4224 (void *)(long)request_ocsp,
4226 cookie, &client_static_state, tlsp, errstr);
4227 if (rc != OK) return FALSE;
4229 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
4231 tlsp->certificate_verified = FALSE;
4232 client_verify_callback_called = FALSE;
4236 if (conn_args->dane)
4238 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
4239 other failures should be treated as problems. */
4240 if (ob->dane_require_tls_ciphers &&
4241 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
4242 &expciphers, errstr))
4244 if (expciphers && *expciphers == '\0')
4247 normalise_ciphers(&expciphers, ob->dane_require_tls_ciphers);
4252 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
4253 &expciphers, errstr))
4256 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
4257 are separated by underscores. So that I can use either form in my tests, and
4258 also for general convenience, we turn underscores into hyphens here. */
4260 normalise_ciphers(&expciphers, ob->tls_require_ciphers);
4265 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
4266 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
4268 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
4274 if (conn_args->dane)
4276 SSL_CTX_set_verify(exim_client_ctx->ctx,
4277 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
4278 verify_callback_client_dane);
4280 if (!DANESSL_library_init())
4282 tls_error(US"library init", host, NULL, errstr);
4285 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
4287 tls_error(US"context init", host, NULL, errstr);
4290 DEBUG(D_tls) debug_printf("since dane-mode conn, not loading the usual CA bundle\n");
4296 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
4297 client_static_state, errstr) != OK)
4302 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
4305 { DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n"); }
4306 else if (!Ustrlen(tlsp->sni))
4310 #ifndef EXIM_HAVE_OPENSSL_TLSEXT
4311 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
4319 #ifdef EXIM_HAVE_ALPN
4321 const uschar * plist;
4324 if (!tls_alpn_plist(&ob->tls_alpn, &plist, &plen, errstr))
4327 if (SSL_CTX_set_alpn_protos(exim_client_ctx->ctx, plist, plen) != 0)
4329 tls_error(US"alpn init", host, NULL, errstr);
4333 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
4336 log_write(0, LOG_MAIN, "ALPN unusable with this OpenSSL library version; ignoring \"%s\"\n",
4340 #ifndef DISABLE_TLS_RESUME
4341 /*XXX have_lbserver: another cmdline arg possibly, for continued-conn, but use
4342 will be very low. */
4344 if (!conn_args->have_lbserver) /* wanted for tls_client_resmption_key() */
4345 { DEBUG(D_tls) debug_printf("resumption not supported on continued-connection\n"); }
4346 else if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
4347 tls_client_ctx_resume_prehandshake(exim_client_ctx, conn_args, tlsp, ob);
4351 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
4353 tls_error(US"SSL_new", host, NULL, errstr);
4356 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
4357 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
4358 SSL_set_connect_state(exim_client_ctx->ssl);
4360 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
4363 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
4364 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
4369 if (conn_args->dane)
4370 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
4374 #ifndef DISABLE_OCSP
4375 /* Request certificate status at connection-time. If the server
4376 does OCSP stapling we will get the callback (set in tls_init()) */
4377 # ifdef SUPPORT_DANE
4381 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4382 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
4384 { /* Re-eval now $tls_out_tlsa_usage is populated. If
4385 this means we avoid the OCSP request, we wasted the setup
4386 cost in tls_init(). */
4387 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
4388 request_ocsp = require_ocsp
4389 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
4396 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
4397 client_static_state->u_ocsp.client.verify_required = require_ocsp;
4398 tlsp->ocsp = OCSP_NOT_RESP;
4402 #ifndef DISABLE_TLS_RESUME
4403 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
4408 #ifndef DISABLE_EVENT
4409 client_static_state->event_action = tb ? tb->event_action : NULL;
4412 /* There doesn't seem to be a built-in timeout on connection. */
4414 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
4415 sigalrm_seen = FALSE;
4416 ALARM(ob->command_timeout);
4417 rc = SSL_connect(exim_client_ctx->ssl);
4421 if (conn_args->dane)
4422 DANESSL_cleanup(exim_client_ctx->ssl);
4427 #ifndef DISABLE_OCSP
4428 if (client_static_state->u_ocsp.client.verify_errstr)
4429 { if (errstr) *errstr = client_static_state->u_ocsp.client.verify_errstr; }
4432 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
4438 debug_printf("SSL_connect succeeded\n");
4439 tls_dump_keylog(exim_client_ctx->ssl);
4442 #ifndef DISABLE_TLS_RESUME
4443 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
4446 #ifdef EXIM_HAVE_ALPN
4447 if (ob->tls_alpn) /* We requested. See what was negotiated. */
4449 const uschar * name;
4452 SSL_get0_alpn_selected(exim_client_ctx->ssl, &name, &len);
4454 { DEBUG(D_tls) debug_printf("ALPN negotiated %u: '%.*s'\n", len, (int)*name, name+1); }
4455 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
4457 /* Would like to send a relevant fatal Alert, but OpenSSL has no API */
4458 tls_error(US"handshake", host, US"ALPN required but not negotiated", errstr);
4464 #ifdef SSL_get_extms_support
4465 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
4467 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
4469 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
4470 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
4471 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
4473 /* Record the certificate we presented */
4475 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
4476 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
4479 /*XXX will this work with continued-TLS? */
4480 tls_get_channel_binding(exim_client_ctx->ssl, tlsp, GET_TAINTED);
4482 tlsp->active.sock = cctx->sock;
4483 tlsp->active.tls_ctx = exim_client_ctx;
4484 cctx->tls_ctx = exim_client_ctx;
4493 tls_refill(unsigned lim)
4495 SSL * ssl = state_server.lib_state.lib_ssl;
4499 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4500 ssl_xfer_buffer, ssl_xfer_buffer_size);
4503 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4504 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
4505 MIN(ssl_xfer_buffer_size, lim));
4506 error = SSL_get_error(ssl, inbytes);
4507 if (smtp_receive_timeout > 0) ALARM_CLR(0);
4509 if (had_command_timeout) /* set by signal handler */
4510 smtp_command_timeout_exit(); /* does not return */
4511 if (had_command_sigterm)
4512 smtp_command_sigterm_exit();
4513 if (had_data_timeout)
4514 smtp_data_timeout_exit();
4515 if (had_data_sigint)
4516 smtp_data_sigint_exit();
4518 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
4519 closed down, not that the socket itself has been closed down. Revert to
4520 non-SSL handling. */
4524 case SSL_ERROR_NONE:
4527 case SSL_ERROR_ZERO_RETURN:
4528 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4530 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
4533 tls_close(NULL, TLS_NO_SHUTDOWN);
4536 /* Handle genuine errors */
4539 uschar * conn_info = smtp_get_connection_info();
4540 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
4541 /* I'd like to get separated H= here, but too hard for now */
4542 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4543 log_write(0, LOG_MAIN, "TLS error (SSL_read): on %s %s", conn_info, ssl_errstring);
4544 ssl_xfer_error = TRUE;
4549 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
4550 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
4551 debug_printf(" - syscall %s\n", strerror(errno));
4552 ssl_xfer_error = TRUE;
4556 #ifndef DISABLE_DKIM
4557 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
4559 ssl_xfer_buffer_hwm = inbytes;
4560 ssl_xfer_buffer_lwm = 0;
4565 /*************************************************
4566 * TLS version of getc *
4567 *************************************************/
4569 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
4570 it refills the buffer via the SSL reading function.
4572 Arguments: lim Maximum amount to read/buffer
4573 Returns: the next character or EOF
4575 Only used by the server-side TLS.
4579 tls_getc(unsigned lim)
4581 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4582 if (!tls_refill(lim))
4583 return ssl_xfer_error ? EOF : smtp_getc(lim);
4585 /* Something in the buffer; return next uschar */
4587 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
4593 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm;
4597 tls_getbuf(unsigned * len)
4602 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4603 if (!tls_refill(*len))
4605 if (!ssl_xfer_error) return smtp_getbuf(len);
4610 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4612 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4613 ssl_xfer_buffer_lwm += size;
4620 tls_get_cache(unsigned lim)
4622 #ifndef DISABLE_DKIM
4623 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4627 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4633 tls_could_getc(void)
4635 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4636 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4640 /*************************************************
4641 * Read bytes from TLS channel *
4642 *************************************************/
4646 ct_ctx client context pointer, or NULL for the one global server context
4650 Returns: the number of bytes read
4651 -1 after a failed read, including EOF
4653 Only used by the client-side TLS.
4657 tls_read(void * ct_ctx, uschar *buff, size_t len)
4659 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4660 : state_server.lib_state.lib_ssl;
4664 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4665 buff, (unsigned int)len);
4668 inbytes = SSL_read(ssl, CS buff, len);
4669 error = SSL_get_error(ssl, inbytes);
4671 if (error == SSL_ERROR_ZERO_RETURN)
4673 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4676 else if (error != SSL_ERROR_NONE)
4686 /*************************************************
4687 * Write bytes down TLS channel *
4688 *************************************************/
4692 ct_ctx client context pointer, or NULL for the one global server context
4695 more further data expected soon
4697 Returns: the number of bytes after a successful write,
4698 -1 after a failed write
4700 Used by both server-side and client-side TLS. Calling with len zero and more unset
4701 will flush buffered writes; buff can be null for this case.
4705 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4708 int outbytes, error;
4710 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4711 : state_server.lib_state.lib_ssl;
4712 static gstring * server_corked = NULL;
4713 gstring ** corkedp = ct_ctx
4714 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4715 gstring * corked = *corkedp;
4717 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4718 buff, (unsigned long)len, more ? ", more" : "");
4720 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4721 "more" is notified. This hack is only ok if small amounts are involved AND only
4722 one stream does it, in one context (i.e. no store reset). Currently it is used
4723 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4724 We support callouts done by the server process by using a separate client
4725 context for the stashed information. */
4726 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4727 a store reset there, so use POOL_PERM. */
4728 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4732 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4734 int save_pool = store_pool;
4735 store_pool = POOL_PERM;
4737 corked = string_catn(corked, buff, len);
4739 store_pool = save_pool;
4746 buff = CUS corked->s;
4751 for (int left = len; left > 0;)
4753 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4755 outbytes = SSL_write(ssl, CS buff, left);
4756 error = SSL_get_error(ssl, outbytes);
4757 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4760 case SSL_ERROR_NONE: /* the usual case */
4766 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4767 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4770 case SSL_ERROR_ZERO_RETURN:
4771 log_write(0, LOG_MAIN, "SSL channel closed on write");
4774 case SSL_ERROR_SYSCALL:
4775 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4776 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4777 sender_fullhost ? sender_fullhost : US"<unknown>",
4779 else if (LOGGING(protocol_detail))
4780 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4781 " SMTP response and TLS close\n", sender_host_address);
4783 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4784 " client reset TCP before TLS close\n", sender_host_address);
4788 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4799 ct_ctx client TLS context pointer, or NULL for the one global server context
4803 tls_shutdown_wr(void * ct_ctx)
4805 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4806 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4807 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4810 if (*fdp < 0) return; /* TLS was not active */
4812 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4814 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
4815 rc = SSL_shutdown(*sslp);
4816 if (rc < 0) DEBUG(D_tls)
4818 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4819 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4823 /*************************************************
4824 * Close down a TLS session *
4825 *************************************************/
4827 /* This is also called from within a delivery subprocess forked from the
4828 daemon, to shut down the TLS library, without actually doing a shutdown (which
4829 would tamper with the SSL session in the parent process).
4832 ct_ctx client TLS context pointer, or NULL for the one global server context
4833 do_shutdown 0 no data-flush or TLS close-alert
4834 1 if TLS close-alert is to be sent,
4835 2 if also response to be waited for
4839 Used by both server-side and client-side TLS.
4843 tls_close(void * ct_ctx, int do_shutdown)
4845 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4846 SSL ** sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4847 int * fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4849 if (*fdp < 0) return; /* TLS was not active */
4851 if (do_shutdown > TLS_NO_SHUTDOWN)
4854 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4855 do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
4857 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
4859 if ( ( do_shutdown >= TLS_SHUTDOWN_WONLY
4860 || (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4862 && do_shutdown > TLS_SHUTDOWN_NOWAIT
4865 #ifdef EXIM_TCP_CORK
4866 (void) setsockopt(*fdp, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
4869 rc = SSL_shutdown(*sslp); /* wait for response */
4873 if (rc < 0) DEBUG(D_tls)
4875 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4876 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4880 if (!o_ctx) /* server side */
4882 #ifndef DISABLE_OCSP
4883 sk_X509_pop_free(state_server.u_ocsp.server.verify_stack, X509_free);
4884 state_server.u_ocsp.server.verify_stack = NULL;
4887 receive_getc = smtp_getc;
4888 receive_getbuf = smtp_getbuf;
4889 receive_get_cache = smtp_get_cache;
4890 receive_hasc = smtp_hasc;
4891 receive_ungetc = smtp_ungetc;
4892 receive_feof = smtp_feof;
4893 receive_ferror = smtp_ferror;
4894 tls_in.active.tls_ctx = NULL;
4896 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4907 /*************************************************
4908 * Let tls_require_ciphers be checked at startup *
4909 *************************************************/
4911 /* The tls_require_ciphers option, if set, must be something which the
4914 Returns: NULL on success, or error message
4918 tls_validate_require_cipher(void)
4921 uschar * expciphers, * err;
4925 if (!(tls_require_ciphers && *tls_require_ciphers))
4928 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4930 return US"failed to expand tls_require_ciphers";
4932 if (!(expciphers && *expciphers))
4935 normalise_ciphers(&expciphers, tls_require_ciphers);
4938 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4941 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4943 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4945 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4946 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4947 expciphers, ssl_errstring);
4958 /*************************************************
4959 * Report the library versions. *
4960 *************************************************/
4962 /* There have historically been some issues with binary compatibility in
4963 OpenSSL libraries; if Exim (like many other applications) is built against
4964 one version of OpenSSL but the run-time linker picks up another version,
4965 it can result in serious failures, including crashing with a SIGSEGV. So
4966 report the version found by the compiler and the run-time version.
4968 Note: some OS vendors backport security fixes without changing the version
4969 number/string, and the version date remains unchanged. The _build_ date
4970 will change, so we can more usefully assist with version diagnosis by also
4971 reporting the build date.
4973 Arguments: string to append to
4978 tls_version_report(gstring * g)
4980 return string_fmt_append(g,
4981 "Library version: OpenSSL: Compile: %s\n"
4984 OPENSSL_VERSION_TEXT,
4985 SSLeay_version(SSLEAY_VERSION),
4986 SSLeay_version(SSLEAY_BUILT_ON));
4987 /* third line is 38 characters for the %s and the line is 73 chars long;
4988 the OpenSSL output includes a "built on: " prefix already. */
4994 /*************************************************
4995 * Random number generation *
4996 *************************************************/
4998 /* Pseudo-random number generation. The result is not expected to be
4999 cryptographically strong but not so weak that someone will shoot themselves
5000 in the foot using it as a nonce in input in some email header scheme or
5001 whatever weirdness they'll twist this into. The result should handle fork()
5002 and avoid repeating sequences. OpenSSL handles that for us.
5006 Returns a random number in range [0, max-1]
5010 vaguely_random_number(int max)
5014 static pid_t pidlast = 0;
5016 uschar smallbuf[sizeof(r)];
5022 if (pidnow != pidlast)
5024 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
5025 is unique for each thread", this doesn't apparently apply across processes,
5026 so our own warning from vaguely_random_number_fallback() applies here too.
5027 Fix per PostgreSQL. */
5033 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
5037 gettimeofday(&r.tv, NULL);
5040 RAND_seed(US (&r), sizeof(r));
5042 /* We're after pseudo-random, not random; if we still don't have enough data
5043 in the internal PRNG then our options are limited. We could sleep and hope
5044 for entropy to come along (prayer technique) but if the system is so depleted
5045 in the first place then something is likely to just keep taking it. Instead,
5046 we'll just take whatever little bit of pseudo-random we can still manage to
5049 needed_len = sizeof(r);
5050 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
5051 asked for a number less than 10. */
5052 for (r = max, i = 0; r; ++i)
5058 #ifdef EXIM_HAVE_RAND_PSEUDO
5059 /* We do not care if crypto-strong */
5060 i = RAND_pseudo_bytes(smallbuf, needed_len);
5062 i = RAND_bytes(smallbuf, needed_len);
5068 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
5069 return vaguely_random_number_fallback(max);
5073 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
5076 /* We don't particularly care about weighted results; if someone wants
5077 smooth distribution and cares enough then they should submit a patch then. */
5084 /*************************************************
5085 * OpenSSL option parse *
5086 *************************************************/
5088 /* Parse one option for tls_openssl_options_parse below
5091 name one option name
5092 value place to store a value for it
5093 Returns success or failure in parsing
5099 tls_openssl_one_option_parse(uschar *name, long *value)
5102 int last = exim_openssl_options_size;
5103 while (last > first)
5105 int middle = (first + last)/2;
5106 int c = Ustrcmp(name, exim_openssl_options[middle].name);
5109 *value = exim_openssl_options[middle].value;
5123 /*************************************************
5124 * OpenSSL option parsing logic *
5125 *************************************************/
5127 /* OpenSSL has a number of compatibility options which an administrator might
5128 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
5129 we look like log_selector.
5132 option_spec the administrator-supplied string of options
5133 results ptr to long storage for the options bitmap
5134 Returns success or failure
5138 tls_openssl_options_parse(uschar *option_spec, long *results)
5141 uschar * exp, * end;
5142 BOOL adding, item_parsed;
5144 /* Server: send no (<= TLS1.2) session tickets */
5145 result = SSL_OP_NO_TICKET;
5147 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
5148 from default because it increases BEAST susceptibility. */
5149 #ifdef SSL_OP_NO_SSLv2
5150 result |= SSL_OP_NO_SSLv2;
5152 #ifdef SSL_OP_NO_SSLv3
5153 result |= SSL_OP_NO_SSLv3;
5155 #ifdef SSL_OP_SINGLE_DH_USE
5156 result |= SSL_OP_SINGLE_DH_USE;
5158 #ifdef SSL_OP_NO_RENEGOTIATION
5159 result |= SSL_OP_NO_RENEGOTIATION;
5168 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
5171 for (uschar * s = exp; *s; /**/)
5173 while (isspace(*s)) ++s;
5176 if (*s != '+' && *s != '-')
5178 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
5179 "+ or - expected but found \"%s\"\n", s);
5182 adding = *s++ == '+';
5183 for (end = s; *end && !isspace(*end); ) end++;
5184 item_parsed = tls_openssl_one_option_parse(string_copyn(s, end-s), &item);
5187 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
5190 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
5191 adding ? "adding to " : "removing from", result, item, s);
5203 #endif /*!MACRO_PREDEF*/
5206 /* End of tls-openssl.c */