Debug: feed startup "whats supported" info through normal debug channel

[exim.git] / src / src / tls-openssl.c

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 4bc92bd05d8e342c9ddb048d4301444033378a4e..26279848653bea2c964432fa32bd2b8b5e1b0263 100644 (file)
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -805,6 +805,7 @@ return !rv;
 *        Expand key and cert file specs          *
 *************************************************/
 
 *        Expand key and cert file specs          *
 *************************************************/
 

+#if OPENSSL_VERSION_NUMBER < 0x30000000L

 /*
 Arguments:
   s          SSL connection (not used)
 /*
 Arguments:
   s          SSL connection (not used)


@@ -824,14 +825,14 @@ BIGNUM *bn = BN_new();
 
 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
 
 
 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
 

-#ifdef EXIM_HAVE_RSA_GENKEY_EX
+# ifdef EXIM_HAVE_RSA_GENKEY_EX

 if (  !BN_set_word(bn, (unsigned long)RSA_F4)
    || !(rsa_key = RSA_new())
    || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
    )
 if (  !BN_set_word(bn, (unsigned long)RSA_F4)
    || !(rsa_key = RSA_new())
    || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
    )

-#else
+# else

 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))

-#endif
+# endif

 
   {
   ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
 
   {
   ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));


@@ -841,6 +842,7 @@ if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
   }
 return rsa_key;
 }
   }
 return rsa_key;
 }

+#endif /* pre-3.0.0 */

 
 
 
 
 
 


@@ -854,7 +856,6 @@ tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
 {
 X509 * x509 = NULL;
 EVP_PKEY * pkey;
 {
 X509 * x509 = NULL;
 EVP_PKEY * pkey;

-RSA * rsa;

 X509_NAME * name;
 uschar * where;
 
 X509_NAME * name;
 uschar * where;
 


@@ -868,12 +869,19 @@ if (!(x509 = X509_new()))
   goto err;
 
 where = US"generating pkey";
   goto err;
 
 where = US"generating pkey";

-if (!(rsa = rsa_callback(NULL, 0, 2048)))
-  goto err;
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ {
+  RSA * rsa;
+  if (!(rsa = rsa_callback(NULL, 0, 2048)))
+    goto err;

 
 

-where = US"assigning pkey";
-if (!EVP_PKEY_assign_RSA(pkey, rsa))
-  goto err;
+  where = US"assigning pkey";
+  if (!EVP_PKEY_assign_RSA(pkey, rsa))
+    goto err;
+ }
+#else
+pkey = EVP_RSA_gen(2048);
+#endif

 
 X509_set_version(x509, 2);                             /* N+1 - version 3 */
 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
 
 X509_set_version(x509, 2);                             /* N+1 - version 3 */
 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);


@@ -1001,7 +1009,7 @@ if (ev)
   old_cert = tlsp->peercert;
   tlsp->peercert = X509_dup(cert);
   /* NB we do not bother setting peerdn */
   old_cert = tlsp->peercert;
   tlsp->peercert = X509_dup(cert);
   /* NB we do not bother setting peerdn */

-  if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
+  if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth), &errno)))

     {
     log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
                "depth=%d cert=%s: %s",
     {
     log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
                "depth=%d cert=%s: %s",


@@ -1634,11 +1642,24 @@ return OK;
 * One-time init credentials for server and client *
 **************************************************/
 
 * One-time init credentials for server and client *
 **************************************************/
 

+static void
+normalise_ciphers(uschar ** ciphers, const uschar * pre_expansion_ciphers)
+{
+uschar * s = *ciphers;
+
+if (!s || !Ustrchr(s, '_')) return;    /* no change needed */
+
+if (s == pre_expansion_ciphers)
+  s = string_copy(s);                  /* get writable copy */
+
+for (uschar * t = s; *t; t++) if (*t == '_') *t = '-';
+*ciphers = s;
+}
+

 static int
 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
   uschar * ciphers, uschar ** errstr)
 {
 static int
 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
   uschar * ciphers, uschar ** errstr)
 {

-for (uschar * s = ciphers; *s; s++ ) if (*s == '_') *s = '-';

 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
   return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
   return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);


@@ -1790,6 +1811,7 @@ else
 if (opt_set_and_noexpand(tls_require_ciphers))
   {
   DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
 if (opt_set_and_noexpand(tls_require_ciphers))
   {
   DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");

+  normalise_ciphers(&tls_require_ciphers, tls_require_ciphers);

   if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
                          &dummy_errstr) == OK)
     state_server.lib_state.pri_string = TRUE;
   if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
                          &dummy_errstr) == OK)
     state_server.lib_state.pri_string = TRUE;


@@ -1945,7 +1967,11 @@ typedef struct {                 /* Session ticket encryption key */
 
   const EVP_CIPHER *   aes_cipher;
   uschar               aes_key[32];    /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
 
   const EVP_CIPHER *   aes_cipher;
   uschar               aes_key[32];    /* size needed depends on cipher. aes_128 implies 128/8 = 16? */

+# if OPENSSL_VERSION_NUMBER < 0x30000000L

   const EVP_MD *       hmac_hash;
   const EVP_MD *       hmac_hash;

+# else
+  const uschar *       hmac_hashname;
+# endif

   uschar               hmac_key[16];
   time_t               renew;
   time_t               expire;
   uschar               hmac_key[16];
   time_t               renew;
   time_t               expire;


@@ -1974,7 +2000,11 @@ if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
 
 exim_tk.name[0] = 'E';
 exim_tk.aes_cipher = EVP_aes_256_cbc();
 
 exim_tk.name[0] = 'E';
 exim_tk.aes_cipher = EVP_aes_256_cbc();

+# if OPENSSL_VERSION_NUMBER < 0x30000000L

 exim_tk.hmac_hash = EVP_sha256();
 exim_tk.hmac_hash = EVP_sha256();

+# else
+exim_tk.hmac_hashname = US "sha256";
+# endif

 exim_tk.expire = t + ssl_session_timeout;
 exim_tk.renew = t + ssl_session_timeout/2;
 }
 exim_tk.expire = t + ssl_session_timeout;
 exim_tk.renew = t + ssl_session_timeout/2;
 }


@@ -1994,10 +2024,49 @@ return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
   : NULL;
 }
 
   : NULL;
 }
 

+
+static int
+tk_hmac_init(
+# if OPENSSL_VERSION_NUMBER < 0x30000000L
+  HMAC_CTX * hctx,
+#else
+  EVP_MAC_CTX * hctx,
+#endif
+  exim_stek * key
+  )
+{
+/*XXX will want these dependent on the ssl session strength */
+# if OPENSSL_VERSION_NUMBER < 0x30000000L
+  HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
+               key->hmac_hash, NULL);
+#else
+ {
+  OSSL_PARAM params[3];
+  uschar * hk = string_copy(key->hmac_hashname);       /* need nonconst */
+  params[0] = OSSL_PARAM_construct_octet_string("key", key->hmac_key, sizeof(key->hmac_key));
+  params[1] = OSSL_PARAM_construct_utf8_string("digest", CS hk, 0);
+  params[2] = OSSL_PARAM_construct_end();
+  if (EVP_MAC_CTX_set_params(hctx, params) == 0)
+    {
+    DEBUG(D_tls) debug_printf("EVP_MAC_CTX_set_params: %s\n",
+      ERR_reason_error_string(ERR_get_error()));
+    return 0; /* error in mac initialisation */
+    }
+}
+#endif
+return 1;
+}
+

 /* Callback for session tickets, on server */
 static int
 ticket_key_callback(SSL * ssl, uschar key_name[16],
 /* Callback for session tickets, on server */
 static int
 ticket_key_callback(SSL * ssl, uschar key_name[16],

-  uschar * iv, EVP_CIPHER_CTX * c_ctx, HMAC_CTX * hctx, int enc)
+  uschar * iv, EVP_CIPHER_CTX * c_ctx,
+# if OPENSSL_VERSION_NUMBER < 0x30000000L
+  HMAC_CTX * hctx,
+#else
+  EVP_MAC_CTX * hctx,
+#endif
+  int enc)

 {
 tls_support * tlsp = state_server.tlsp;
 exim_stek * key;
 {
 tls_support * tlsp = state_server.tlsp;
 exim_stek * key;


@@ -2015,9 +2084,7 @@ if (enc)
   memcpy(key_name, key->name, 16);
   DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
 
   memcpy(key_name, key->name, 16);
   DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
 

-  /*XXX will want these dependent on the ssl session strength */
-  HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
-               key->hmac_hash, NULL);
+  if (tk_hmac_init(hctx, key) == 0) return 0;

   EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
 
   DEBUG(D_tls) debug_printf("ticket created\n");
   EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
 
   DEBUG(D_tls) debug_printf("ticket created\n");


@@ -2040,8 +2107,7 @@ else
     return 0;
     }
 
     return 0;
     }
 

-  HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
-               key->hmac_hash, NULL);
+  if (tk_hmac_init(hctx, key) == 0) return 0;

   EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
 
   DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
   EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
 
   DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);


@@ -2054,7 +2120,7 @@ else
   return key->renew < now ? 2 : 1;
   }
 }
   return key->renew < now ? 2 : 1;
   }
 }

-#endif
+#endif /* !DISABLE_TLS_RESUME */

 
 
 
 
 
 


@@ -2394,7 +2460,7 @@ if (!(bs = OCSP_response_get1_basic(rsp)))
     STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
 #endif
 
     STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
 #endif
 

-    DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
+    DEBUG(D_tls) bp = BIO_new(BIO_s_mem());

 
     /*OCSP_RESPONSE_print(bp, rsp, 0);   extreme debug: stapling content */
 
 
     /*OCSP_RESPONSE_print(bp, rsp, 0);   extreme debug: stapling content */
 


@@ -2409,9 +2475,12 @@ if (!(bs = OCSP_response_get1_basic(rsp)))
        if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
                "Received TLS cert status response, itself unverifiable: %s",
                ERR_reason_error_string(ERR_peek_error()));
        if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
                "Received TLS cert status response, itself unverifiable: %s",
                ERR_reason_error_string(ERR_peek_error()));

-       BIO_printf(bp, "OCSP response verify failure\n");
-       ERR_print_errors(bp);
-       OCSP_RESPONSE_print(bp, rsp, 0);
+       DEBUG(D_tls)
+         {
+         BIO_printf(bp, "OCSP response verify failure\n");
+         ERR_print_errors(bp);
+         OCSP_RESPONSE_print(bp, rsp, 0);
+         }

        goto failed;
        }
       else
        goto failed;
        }
       else


@@ -2449,14 +2518,17 @@ if (!(bs = OCSP_response_get1_basic(rsp)))
       status = OCSP_single_get0_status(single, &reason, &rev,
                  &thisupd, &nextupd);
 
       status = OCSP_single_get0_status(single, &reason, &rev,
                  &thisupd, &nextupd);
 

-      DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
-      DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
+      DEBUG(D_tls)
+       {
+       time_print(bp, "This OCSP Update", thisupd);
+       if (nextupd) time_print(bp, "Next OCSP Update", nextupd);
+       }

       if (!OCSP_check_validity(thisupd, nextupd,
            EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
        {
        tls_out.ocsp = OCSP_FAILED;
        DEBUG(D_tls) ERR_print_errors(bp);
       if (!OCSP_check_validity(thisupd, nextupd,
            EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
        {
        tls_out.ocsp = OCSP_FAILED;
        DEBUG(D_tls) ERR_print_errors(bp);

-       log_write(0, LOG_MAIN, "Server OSCP dates invalid");
+       log_write(0, LOG_MAIN, "OCSP dates invalid");

        goto failed;
        }
 
        goto failed;
        }
 


@@ -2489,6 +2561,11 @@ if (!(bs = OCSP_response_get1_basic(rsp)))
     tls_out.ocsp = OCSP_FAILED;
     i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
   good:
     tls_out.ocsp = OCSP_FAILED;
     i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
   good:

+    {
+    uschar * s = NULL;
+    int len = (int) BIO_get_mem_data(bp, CSS &s);
+    if (len > 0) debug_printf("%.*s", len, s);
+    }

     BIO_free(bp);
   }
 
     BIO_free(bp);
   }
 


@@ -3064,6 +3141,21 @@ return OK;
 
 
 
 
 
 

+static void
+tls_dump_keylog(SSL * ssl)
+{
+#ifdef EXIM_HAVE_OPENSSL_KEYLOG
+  BIO * bp = BIO_new(BIO_s_mem());
+  uschar * s = NULL;
+  int len;
+  SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
+  len = (int) BIO_get_mem_data(bp, CSS &s);
+  if (len > 0) debug_printf("%.*s", len, s);
+  BIO_free(bp);
+#endif
+}
+
+

 /*************************************************
 *       Start a TLS session in a server          *
 *************************************************/
 /*************************************************
 *       Start a TLS session in a server          *
 *************************************************/


@@ -3126,9 +3218,12 @@ else
   if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
     return FAIL;
 
   if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
     return FAIL;
 

-  if (  expciphers
-     && (rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
-    return rc;
+  if (expciphers)
+    {
+    normalise_ciphers(&expciphers, tls_require_ciphers);
+    if ((rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
+      return rc;
+    }

   }
 
 /* If this is a host for which certificate verification is mandatory or
   }
 
 /* If this is a host for which certificate verification is mandatory or


@@ -3166,9 +3261,15 @@ else
 skip_certs: ;
 
 #ifndef DISABLE_TLS_RESUME
 skip_certs: ;
 
 #ifndef DISABLE_TLS_RESUME

+# if OPENSSL_VERSION_NUMBER < 0x30000000L

 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
 /* despite working, appears to always return failure, so ignoring */
 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
 /* despite working, appears to always return failure, so ignoring */

+# else
+SSL_CTX_set_tlsext_ticket_key_evp_cb(ctx, ticket_key_callback);
+/* despite working, appears to always return failure, so ignoring */
+# endif

 #endif
 #endif

+

 #ifdef OPENSSL_HAVE_NUM_TICKETS
 # ifndef DISABLE_TLS_RESUME
 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
 #ifdef OPENSSL_HAVE_NUM_TICKETS
 # ifndef DISABLE_TLS_RESUME
 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);


@@ -3236,9 +3337,10 @@ if (rc <= 0)
     case SSL_ERROR_ZERO_RETURN:
       DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
       (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
     case SSL_ERROR_ZERO_RETURN:
       DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
       (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);

+      (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);

 
       if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
 
       if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)

-           SSL_shutdown(ssl);
+       SSL_shutdown(ssl);

 
       tls_close(NULL, TLS_NO_SHUTDOWN);
       return FAIL;
 
       tls_close(NULL, TLS_NO_SHUTDOWN);
       return FAIL;


@@ -3253,8 +3355,9 @@ if (rc <= 0)
          || r == SSL_R_VERSION_TOO_LOW
 #endif
          || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
          || r == SSL_R_VERSION_TOO_LOW
 #endif
          || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)

-       s = string_sprintf("%s (%s)", s, SSL_get_version(ssl));
+       s = string_sprintf("(%s)", SSL_get_version(ssl));

       (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
       (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);

+      (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);

       return FAIL;
       }
 
       return FAIL;
       }
 


@@ -3265,6 +3368,7 @@ if (rc <= 0)
        if (!errno)
          {
          *errstr = US"SSL_accept: TCP connection closed by peer";
        if (!errno)
          {
          *errstr = US"SSL_accept: TCP connection closed by peer";

+         (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);

          return FAIL;
          }
        DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
          return FAIL;
          }
        DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));


@@ -3273,6 +3377,7 @@ if (rc <= 0)
                      sigalrm_seen ? US"timed out"
                      : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
                      errstr);
                      sigalrm_seen ? US"timed out"
                      : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
                      errstr);

+      (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);

       return FAIL;
     }
   }
       return FAIL;
     }
   }


@@ -3334,13 +3439,7 @@ DEBUG(D_tls)
   if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
     debug_printf("Shared ciphers: %s\n", buf);
 
   if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
     debug_printf("Shared ciphers: %s\n", buf);
 

-#ifdef EXIM_HAVE_OPENSSL_KEYLOG
-  {
-  BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
-  SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
-  BIO_free(bp);
-  }
-#endif
+  tls_dump_keylog(ssl);

 
 #ifdef EXIM_HAVE_SESSION_TICKET
   {
 
 #ifdef EXIM_HAVE_SESSION_TICKET
   {


@@ -3823,21 +3922,25 @@ if (conn_args->dane)
     return FALSE;
   if (expciphers && *expciphers == '\0')
     expciphers = NULL;
     return FALSE;
   if (expciphers && *expciphers == '\0')
     expciphers = NULL;

+
+  normalise_ciphers(&expciphers, ob->dane_require_tls_ciphers);

   }
 #endif
   }
 #endif

-if (!expciphers &&
-    !expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
+if (!expciphers)
+  {
+  if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",

       &expciphers, errstr))
       &expciphers, errstr))

-  return FALSE;
+    return FALSE;

 
 

-/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
-are separated by underscores. So that I can use either form in my tests, and
-also for general convenience, we turn underscores into hyphens here. */
+  /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
+  are separated by underscores. So that I can use either form in my tests, and
+  also for general convenience, we turn underscores into hyphens here. */
+
+  normalise_ciphers(&expciphers, ob->tls_require_ciphers);
+  }

 
 if (expciphers)
   {
 
 if (expciphers)
   {

-  uschar *s = expciphers;
-  while (*s) { if (*s == '_') *s = '-'; s++; }

   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
   if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
     {
   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
   if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
     {


@@ -3997,13 +4100,7 @@ if (rc <= 0)
 DEBUG(D_tls)
   {
   debug_printf("SSL_connect succeeded\n");
 DEBUG(D_tls)
   {
   debug_printf("SSL_connect succeeded\n");

-#ifdef EXIM_HAVE_OPENSSL_KEYLOG
-  {
-  BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
-  SSL_SESSION_print_keylog(bp, SSL_get_session(exim_client_ctx->ssl));
-  BIO_free(bp);
-  }
-#endif
+  tls_dump_keylog(exim_client_ctx->ssl);

   }
 
 #ifndef DISABLE_TLS_RESUME
   }
 
 #ifndef DISABLE_TLS_RESUME


@@ -4433,6 +4530,9 @@ if (do_shutdown)
   if (  (rc = SSL_shutdown(*sslp)) == 0        /* send "close notify" alert */
      && do_shutdown > 1)
     {
   if (  (rc = SSL_shutdown(*sslp)) == 0        /* send "close notify" alert */
      && do_shutdown > 1)
     {

+#ifdef EXIM_TCP_CORK
+    (void) setsockopt(*fdp, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
+#endif

     ALARM(2);
     rc = SSL_shutdown(*sslp);          /* wait for response */
     ALARM_CLR(0);
     ALARM(2);
     rc = SSL_shutdown(*sslp);          /* wait for response */
     ALARM_CLR(0);


@@ -4500,12 +4600,9 @@ if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
 if (!(expciphers && *expciphers))
   return NULL;
 
 if (!(expciphers && *expciphers))
   return NULL;
 

-/* normalisation ripped from above */
-s = expciphers;
-while (*s != 0) { if (*s == '_') *s = '-'; s++; }
+normalise_ciphers(&expciphers, tls_require_ciphers);

 
 err = NULL;
 
 err = NULL;

-

 if (lib_ctx_new(&ctx, NULL, &err) == OK)
   {
   DEBUG(D_tls)
 if (lib_ctx_new(&ctx, NULL, &err) == OK)
   {
   DEBUG(D_tls)


@@ -4541,21 +4638,22 @@ number/string, and the version date remains unchanged.  The _build_ date
 will change, so we can more usefully assist with version diagnosis by also
 reporting the build date.
 
 will change, so we can more usefully assist with version diagnosis by also
 reporting the build date.
 

-Arguments:   a FILE* to print the results to
-Returns:     nothing
+Arguments:   string to append to
+Returns:     string

 */
 
 */
 

-void
-tls_version_report(FILE *f)
+gstring *
+tls_version_report(gstring * g)

 {
 {

-fprintf(f, "Library version: OpenSSL: Compile: %s\n"
-           "                          Runtime: %s\n"
-           "                                 : %s\n",
-           OPENSSL_VERSION_TEXT,
-           SSLeay_version(SSLEAY_VERSION),
-           SSLeay_version(SSLEAY_BUILT_ON));
-/* third line is 38 characters for the %s and the line is 73 chars long;
-the OpenSSL output includes a "built on: " prefix already. */
+return string_fmt_append(g,
+    "Library version: OpenSSL: Compile: %s\n"
+    "                          Runtime: %s\n"
+    "                                 : %s\n",
+            OPENSSL_VERSION_TEXT,
+            SSLeay_version(SSLEAY_VERSION),
+            SSLeay_version(SSLEAY_BUILT_ON));
+  /* third line is 38 characters for the %s and the line is 73 chars long;
+  the OpenSSL output includes a "built on: " prefix already. */

 }
 
 
 }