1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2019 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Portions Copyright (c) The OpenSSL Project 1999 */
11 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
12 library. It is #included into the tls.c file when that library is used. The
13 code herein is based on a patch that was originally contributed by Steve
14 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
16 No cryptographic code is included in Exim. All this module does is to call
17 functions from the OpenSSL library. */
22 #include <openssl/lhash.h>
23 #include <openssl/ssl.h>
24 #include <openssl/err.h>
25 #include <openssl/rand.h>
26 #ifndef OPENSSL_NO_ECDH
27 # include <openssl/ec.h>
30 # include <openssl/ocsp.h>
38 # define EXIM_OCSP_SKEW_SECONDS (300L)
39 # define EXIM_OCSP_MAX_AGE (-1L)
42 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
43 # define EXIM_HAVE_OPENSSL_TLSEXT
45 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
46 # define EXIM_HAVE_RSA_GENKEY_EX
48 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
49 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define OPENSSL_AUTO_SHA256
52 # define EXIM_HAVE_EPHEM_RSA_KEX
53 # define EXIM_HAVE_RAND_PSEUDO
55 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
56 # define EXIM_HAVE_SHA256
59 /* X509_check_host provides sane certificate hostname checking, but was added
60 to OpenSSL late, after other projects forked off the code-base. So in
61 addition to guarding against the base version number, beware that LibreSSL
62 does not (at this time) support this function.
64 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
65 opt to disentangle and ask a LibreSSL user to provide glue for a third
66 crypto provider for libtls instead of continuing to tie the OpenSSL glue
67 into even twistier knots. If LibreSSL gains the same API, we can just
68 change this guard and punt the issue for a while longer. */
70 #ifndef LIBRESSL_VERSION_NUMBER
71 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
72 # define EXIM_HAVE_OPENSSL_CHECKHOST
73 # define EXIM_HAVE_OPENSSL_DH_BITS
74 # define EXIM_HAVE_OPENSSL_TLS_METHOD
75 # define EXIM_HAVE_OPENSSL_KEYLOG
76 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
77 # define EXIM_HAVE_SESSION_TICKET
78 # define EXIM_HAVE_OPESSL_TRACE
79 # define EXIM_HAVE_OPESSL_GET0_SERIAL
81 # define EXIM_HAVE_OCSP
84 # define EXIM_NEED_OPENSSL_INIT
86 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
87 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
88 # define EXIM_HAVE_OPENSSL_CHECKHOST
92 #if !defined(LIBRESSL_VERSION_NUMBER) \
93 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
94 # if !defined(OPENSSL_NO_ECDH)
95 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
96 # define EXIM_HAVE_ECDH
98 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
99 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
104 #ifndef LIBRESSL_VERSION_NUMBER
105 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
106 # define OPENSSL_HAVE_KEYLOG_CB
107 # define OPENSSL_HAVE_NUM_TICKETS
108 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
110 # define OPENSSL_BAD_SRVR_OURCERT
114 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
115 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
116 # define DISABLE_OCSP
119 #ifndef DISABLE_TLS_RESUME
120 # if OPENSSL_VERSION_NUMBER < 0x0101010L
121 # error OpenSSL version too old for session-resumption
125 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
126 # include <openssl/x509v3.h>
129 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
130 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
131 # define SSL_CIPHER_get_id(c) (c->id)
133 # ifndef MACRO_PREDEF
134 # include "tls-cipher-stdname.c"
138 /*************************************************
139 * OpenSSL option parse *
140 *************************************************/
142 typedef struct exim_openssl_option {
145 } exim_openssl_option;
146 /* We could use a macro to expand, but we need the ifdef and not all the
147 options document which version they were introduced in. Policylet: include
148 all options unless explicitly for DTLS, let the administrator choose which
151 This list is current as of:
154 XXX could we autobuild this list, as with predefined-macros?
155 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
156 Also allow a numeric literal?
158 static exim_openssl_option exim_openssl_options[] = {
159 /* KEEP SORTED ALPHABETICALLY! */
161 { US"all", (long) SSL_OP_ALL },
163 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
164 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
166 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
167 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
169 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
170 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
172 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
173 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
175 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
176 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
178 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
179 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
181 #ifdef SSL_OP_EPHEMERAL_RSA
182 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
184 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
185 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
187 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
188 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
190 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
191 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
193 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
194 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
196 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
197 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
199 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
200 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
202 #ifdef SSL_OP_NO_ANTI_REPLAY
203 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
205 #ifdef SSL_OP_NO_COMPRESSION
206 { US"no_compression", SSL_OP_NO_COMPRESSION },
208 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
209 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
211 #ifdef SSL_OP_NO_RENEGOTIATION
212 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
214 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
215 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
217 #ifdef SSL_OP_NO_SSLv2
218 { US"no_sslv2", SSL_OP_NO_SSLv2 },
220 #ifdef SSL_OP_NO_SSLv3
221 { US"no_sslv3", SSL_OP_NO_SSLv3 },
223 #ifdef SSL_OP_NO_TICKET
224 { US"no_ticket", SSL_OP_NO_TICKET },
226 #ifdef SSL_OP_NO_TLSv1
227 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
229 #ifdef SSL_OP_NO_TLSv1_1
230 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
231 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
232 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
234 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
237 #ifdef SSL_OP_NO_TLSv1_2
238 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
240 #ifdef SSL_OP_NO_TLSv1_3
241 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
243 #ifdef SSL_OP_PRIORITIZE_CHACHA
244 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
246 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
247 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
249 #ifdef SSL_OP_SINGLE_DH_USE
250 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
252 #ifdef SSL_OP_SINGLE_ECDH_USE
253 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
255 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
256 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
258 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
259 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
261 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
262 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
264 #ifdef SSL_OP_TLS_D5_BUG
265 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
267 #ifdef SSL_OP_TLS_ROLLBACK_BUG
268 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
270 #ifdef SSL_OP_TLSEXT_PADDING
271 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
276 static int exim_openssl_options_size = nelem(exim_openssl_options);
277 static long init_options = 0;
286 for (struct exim_openssl_option * o = exim_openssl_options;
287 o < exim_openssl_options + nelem(exim_openssl_options); o++)
289 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
290 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
292 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
293 builtin_macro_create(buf);
296 # ifndef DISABLE_TLS_RESUME
297 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
299 # ifdef SSL_OP_NO_TLSv1_3
300 builtin_macro_create(US"_HAVE_TLS1_3");
302 # ifdef OPENSSL_BAD_SRVR_OURCERT
303 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
305 # ifdef EXIM_HAVE_OCSP
306 builtin_macro_create(US"_HAVE_TLS_OCSP");
307 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
312 /******************************************************************************/
314 /* Structure for collecting random data for seeding. */
316 typedef struct randstuff {
321 /* Local static variables */
323 static BOOL client_verify_callback_called = FALSE;
324 static BOOL server_verify_callback_called = FALSE;
325 static const uschar *sid_ctx = US"exim";
327 /* We have three different contexts to care about.
329 Simple case: client, `client_ctx`
330 As a client, we can be doing a callout or cut-through delivery while receiving
331 a message. So we have a client context, which should have options initialised
332 from the SMTP Transport. We may also concurrently want to make TLS connections
333 to utility daemons, so client-contexts are allocated and passed around in call
334 args rather than using a gobal.
337 There are two cases: with and without ServerNameIndication from the client.
338 Given TLS SNI, we can be using different keys, certs and various other
339 configuration settings, because they're re-expanded with $tls_sni set. This
340 allows vhosting with TLS. This SNI is sent in the handshake.
341 A client might not send SNI, so we need a fallback, and an initial setup too.
342 So as a server, we start out using `server_ctx`.
343 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
344 `server_sni` from `server_ctx` and then initialise settings by re-expanding
352 } exim_openssl_client_tls_ctx;
355 /* static SSL_CTX *server_ctx = NULL; */
356 /* static SSL *server_ssl = NULL; */
358 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
359 static SSL_CTX *server_sni = NULL;
362 static char ssl_errstring[256];
364 static int ssl_session_timeout = 7200; /* Two hours */
365 static BOOL client_verify_optional = FALSE;
366 static BOOL server_verify_optional = FALSE;
368 static BOOL reexpand_tls_files_for_sni = FALSE;
371 typedef struct ocsp_resp {
372 struct ocsp_resp * next;
373 OCSP_RESPONSE * resp;
376 typedef struct exim_openssl_state {
377 exim_tlslib_state lib_state;
378 #define lib_ctx libdata0
379 #define lib_ssl libdata1
382 uschar * certificate;
386 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
390 const uschar *file_expanded;
391 ocsp_resplist *olist;
394 X509_STORE *verify_store; /* non-null if status requested */
395 BOOL verify_required;
400 /* these are cached from first expand */
401 uschar * server_cipher_list;
402 /* only passed down to tls_error: */
404 const uschar * verify_cert_hostnames;
405 #ifndef DISABLE_EVENT
406 uschar * event_action;
408 } exim_openssl_state_st;
410 /* should figure out a cleanup of API to handle state preserved per
411 implementation, for various reasons, which can be void * in the APIs.
412 For now, we hack around it. */
413 exim_openssl_state_st *client_static_state = NULL; /*XXX should not use static; multiple concurrent clients! */
414 exim_openssl_state_st state_server = {.is_server = TRUE};
417 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
421 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
422 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
425 static int tls_server_stapling_cb(SSL *s, void *arg);
430 /* Daemon-called, before every connection, key create/rotate */
431 #ifndef DISABLE_TLS_RESUME
432 static void tk_init(void);
433 static int tls_exdata_idx = -1;
437 tls_per_lib_daemon_tick(void)
439 #ifndef DISABLE_TLS_RESUME
444 /* Called once at daemon startup */
447 tls_per_lib_daemon_init(void)
449 tls_daemon_creds_reload();
453 /*************************************************
455 *************************************************/
457 /* Called from lots of places when errors occur before actually starting to do
458 the TLS handshake, that is, while the session is still in clear. Always returns
459 DEFER for a server and FAIL for a client so that most calls can use "return
460 tls_error(...)" to do this processing and then give an appropriate return. A
461 single function is used for both server and client, because it is called from
462 some shared functions.
465 prefix text to include in the logged error
466 host NULL if setting up a server;
467 the connected host if setting up a client
468 msg error message or NULL if we should ask OpenSSL
469 errstr pointer to output error message
471 Returns: OK/DEFER/FAIL
475 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
479 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
480 msg = US ssl_errstring;
483 msg = string_sprintf("(%s): %s", prefix, msg);
484 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
485 if (errstr) *errstr = msg;
486 return host ? FAIL : DEFER;
491 /**************************************************
492 * General library initalisation *
493 **************************************************/
496 lib_rand_init(void * addr)
499 if (!RAND_status()) return TRUE;
501 gettimeofday(&r.tv, NULL);
503 RAND_seed(US (&r), sizeof(r));
504 RAND_seed(US big_buffer, big_buffer_size);
505 if (addr) RAND_seed(US addr, sizeof(addr));
507 return RAND_status();
512 tls_openssl_init(void)
514 static BOOL once = FALSE;
518 #ifdef EXIM_NEED_OPENSSL_INIT
519 SSL_load_error_strings(); /* basic set up */
520 OpenSSL_add_ssl_algorithms();
523 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
524 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
525 list of available digests. */
526 EVP_add_digest(EVP_sha256());
529 (void) lib_rand_init(NULL);
530 (void) tls_openssl_options_parse(openssl_options, &init_options);
535 /*************************************************
536 * Initialize for DH *
537 *************************************************/
539 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
542 sctx The current SSL CTX (inbound or outbound)
543 dhparam DH parameter file or fixed parameter identity string
544 host connected host, if client; NULL if server
545 errstr error string pointer
547 Returns: TRUE if OK (nothing to set up, or setup worked)
551 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host, uschar ** errstr)
559 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
562 if (!dhexpanded || !*dhexpanded)
563 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
564 else if (dhexpanded[0] == '/')
566 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
568 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
569 host, US strerror(errno), errstr);
575 if (Ustrcmp(dhexpanded, "none") == 0)
577 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
581 if (!(pem = std_dh_prime_named(dhexpanded)))
583 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
584 host, US strerror(errno), errstr);
587 bio = BIO_new_mem_buf(CS pem, -1);
590 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
593 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
598 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
599 * an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with
600 * 2236. But older OpenSSL can only report in bytes (octets), not bits.
601 * If someone wants to dance at the edge, then they can raise the limit or use
602 * current libraries. */
603 #ifdef EXIM_HAVE_OPENSSL_DH_BITS
604 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
605 * This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
606 dh_bitsize = DH_bits(dh);
608 dh_bitsize = 8 * DH_size(dh);
611 /* Even if it is larger, we silently return success rather than cause things
612 * to fail out, so that a too-large DH will not knock out all TLS; it's a
613 * debatable choice. */
614 if (dh_bitsize > tls_dh_max_bits)
617 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d\n",
618 dh_bitsize, tls_dh_max_bits);
622 SSL_CTX_set_tmp_dh(sctx, dh);
624 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
625 dhexpanded ? dhexpanded : US"default", dh_bitsize);
637 /*************************************************
638 * Initialize for ECDH *
639 *************************************************/
641 /* Load parameters for ECDH encryption.
643 For now, we stick to NIST P-256 because: it's simple and easy to configure;
644 it avoids any patent issues that might bite redistributors; despite events in
645 the news and concerns over curve choices, we're not cryptographers, we're not
646 pretending to be, and this is "good enough" to be better than no support,
647 protecting against most adversaries. Given another year or two, there might
648 be sufficient clarity about a "right" way forward to let us make an informed
649 decision, instead of a knee-jerk reaction.
651 Longer-term, we should look at supporting both various named curves and
652 external files generated with "openssl ecparam", much as we do for init_dh().
653 We should also support "none" as a value, to explicitly avoid initialisation.
658 sctx The current SSL CTX (inbound or outbound)
659 host connected host, if client; NULL if server
660 errstr error string pointer
662 Returns: TRUE if OK (nothing to set up, or setup worked)
666 init_ecdh(SSL_CTX * sctx, host_item * host, uschar ** errstr)
668 #ifdef OPENSSL_NO_ECDH
677 if (host) /* No ECDH setup for clients, only for servers */
680 # ifndef EXIM_HAVE_ECDH
682 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
686 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
688 if (!exp_curve || !*exp_curve)
691 /* "auto" needs to be handled carefully.
692 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
693 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
694 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
695 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
696 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
698 if (Ustrcmp(exp_curve, "auto") == 0)
700 #if OPENSSL_VERSION_NUMBER < 0x10002000L
701 DEBUG(D_tls) debug_printf(
702 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
703 exp_curve = US"prime256v1";
705 # if defined SSL_CTRL_SET_ECDH_AUTO
706 DEBUG(D_tls) debug_printf(
707 "ECDH OpenSSL 1.0.2+ temp key parameter settings: autoselection\n");
708 SSL_CTX_set_ecdh_auto(sctx, 1);
711 DEBUG(D_tls) debug_printf(
712 "ECDH OpenSSL 1.1.0+ temp key parameter settings: default selection\n");
718 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
719 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
720 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
721 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
725 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
730 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
732 tls_error(US"Unable to create ec curve", host, NULL, errstr);
736 /* The "tmp" in the name here refers to setting a temporary key
737 not to the stability of the interface. */
739 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
740 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL, errstr);
742 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
747 # endif /*EXIM_HAVE_ECDH*/
748 #endif /*OPENSSL_NO_ECDH*/
753 /*************************************************
754 * Expand key and cert file specs *
755 *************************************************/
759 s SSL connection (not used)
763 Returns: pointer to generated key
767 rsa_callback(SSL *s, int export, int keylength)
770 #ifdef EXIM_HAVE_RSA_GENKEY_EX
771 BIGNUM *bn = BN_new();
774 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
776 #ifdef EXIM_HAVE_RSA_GENKEY_EX
777 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
778 || !(rsa_key = RSA_new())
779 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
782 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
786 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
787 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
796 /* Create and install a selfsigned certificate, for use in server mode */
799 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
807 where = US"allocating pkey";
808 if (!(pkey = EVP_PKEY_new()))
811 where = US"allocating cert";
812 if (!(x509 = X509_new()))
815 where = US"generating pkey";
816 if (!(rsa = rsa_callback(NULL, 0, 2048)))
819 where = US"assigning pkey";
820 if (!EVP_PKEY_assign_RSA(pkey, rsa))
823 X509_set_version(x509, 2); /* N+1 - version 3 */
824 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
825 X509_gmtime_adj(X509_get_notBefore(x509), 0);
826 X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60); /* 1 hour */
827 X509_set_pubkey(x509, pkey);
829 name = X509_get_subject_name(x509);
830 X509_NAME_add_entry_by_txt(name, "C",
831 MBSTRING_ASC, CUS "UK", -1, -1, 0);
832 X509_NAME_add_entry_by_txt(name, "O",
833 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
834 X509_NAME_add_entry_by_txt(name, "CN",
835 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
836 X509_set_issuer_name(x509, name);
838 where = US"signing cert";
839 if (!X509_sign(x509, pkey, EVP_md5()))
842 where = US"installing selfsign cert";
843 if (!SSL_CTX_use_certificate(sctx, x509))
846 where = US"installing selfsign key";
847 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
853 (void) tls_error(where, NULL, NULL, errstr);
854 if (x509) X509_free(x509);
855 if (pkey) EVP_PKEY_free(pkey);
865 /*************************************************
866 * Information callback *
867 *************************************************/
869 /* The SSL library functions call this from time to time to indicate what they
870 are doing. We copy the string to the debugging output when TLS debugging has
882 info_callback(SSL *s, int where, int ret)
888 if (where & SSL_ST_CONNECT)
889 str = US"SSL_connect";
890 else if (where & SSL_ST_ACCEPT)
891 str = US"SSL_accept";
893 str = US"SSL info (undefined)";
895 if (where & SSL_CB_LOOP)
896 debug_printf("%s: %s\n", str, SSL_state_string_long(s));
897 else if (where & SSL_CB_ALERT)
898 debug_printf("SSL3 alert %s:%s:%s\n",
899 str = where & SSL_CB_READ ? US"read" : US"write",
900 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
901 else if (where & SSL_CB_EXIT)
903 debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
905 debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
906 else if (where & SSL_CB_HANDSHAKE_START)
907 debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
908 else if (where & SSL_CB_HANDSHAKE_DONE)
909 debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s));
913 #ifdef OPENSSL_HAVE_KEYLOG_CB
915 keylog_callback(const SSL *ssl, const char *line)
919 DEBUG(D_tls) debug_printf("%.200s\n", line);
920 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
921 if (!(fp = fopen(filename, "a"))) return;
922 fprintf(fp, "%s\n", line);
931 #ifndef DISABLE_EVENT
933 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
934 BOOL *calledp, const BOOL *optionalp, const uschar * what)
940 ev = tlsp == &tls_out ? client_static_state->event_action : event_action;
943 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
944 old_cert = tlsp->peercert;
945 tlsp->peercert = X509_dup(cert);
946 /* NB we do not bother setting peerdn */
947 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
949 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
950 "depth=%d cert=%s: %s",
951 tlsp == &tls_out ? deliver_host_address : sender_host_address,
952 what, depth, dn, yield);
956 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
957 return 1; /* reject (leaving peercert set) */
959 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
960 "(host in tls_try_verify_hosts)\n");
961 tlsp->verify_override = TRUE;
963 X509_free(tlsp->peercert);
964 tlsp->peercert = old_cert;
970 /*************************************************
971 * Callback for verification *
972 *************************************************/
974 /* The SSL library does certificate verification if set up to do so. This
975 callback has the current yes/no state is in "state". If verification succeeded,
976 we set the certificate-verified flag. If verification failed, what happens
977 depends on whether the client is required to present a verifiable certificate
980 If verification is optional, we change the state to yes, but still log the
981 verification error. For some reason (it really would help to have proper
982 documentation of OpenSSL), this callback function then gets called again, this
983 time with state = 1. We must take care not to set the private verified flag on
984 the second time through.
986 Note: this function is not called if the client fails to present a certificate
987 when asked. We get here only if a certificate has been received. Handling of
988 optional verification for this case is done when requesting SSL to verify, by
989 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
991 May be called multiple times for different issues with a certificate, even
992 for a given "depth" in the certificate chain.
995 preverify_ok current yes/no state as 1/0
996 x509ctx certificate information.
997 tlsp per-direction (client vs. server) support data
998 calledp has-been-called flag
999 optionalp verification-is-optional flag
1001 Returns: 0 if verification should fail, otherwise 1
1005 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
1006 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
1008 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1009 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1012 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1014 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1015 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1016 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1019 dn[sizeof(dn)-1] = '\0';
1021 tlsp->verify_override = FALSE;
1022 if (preverify_ok == 0)
1024 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
1025 *verify_mode, sender_host_address)
1027 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
1028 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1030 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
1034 if (!tlsp->peercert)
1035 tlsp->peercert = X509_dup(cert); /* record failing cert */
1036 return 0; /* reject */
1038 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
1039 "tls_try_verify_hosts)\n");
1040 tlsp->verify_override = TRUE;
1043 else if (depth != 0)
1045 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
1046 #ifndef DISABLE_OCSP
1047 if (tlsp == &tls_out && client_static_state->u_ocsp.client.verify_store)
1048 { /* client, wanting stapling */
1049 /* Add the server cert's signing chain as the one
1050 for the verification of the OCSP stapled information. */
1052 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1055 sk_X509_push(client_static_state->verify_stack, cert);
1058 #ifndef DISABLE_EVENT
1059 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1060 return 0; /* reject, with peercert set */
1065 const uschar * verify_cert_hostnames;
1067 if ( tlsp == &tls_out
1068 && ((verify_cert_hostnames = client_static_state->verify_cert_hostnames)))
1069 /* client, wanting hostname check */
1072 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
1073 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1074 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
1076 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
1077 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
1080 const uschar * list = verify_cert_hostnames;
1083 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1084 if ((rc = X509_check_host(cert, CCS name, 0,
1085 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
1086 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
1091 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1092 tlsp == &tls_out ? deliver_host_address : sender_host_address);
1099 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
1102 uschar * extra = verify_mode
1103 ? string_sprintf(" (during %c-verify for [%s])",
1104 *verify_mode, sender_host_address)
1106 log_write(0, LOG_MAIN,
1107 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
1108 tlsp == &tls_out ? deliver_host_address : sender_host_address,
1109 extra, dn, verify_cert_hostnames);
1113 if (!tlsp->peercert)
1114 tlsp->peercert = X509_dup(cert); /* record failing cert */
1115 return 0; /* reject */
1117 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
1118 "tls_try_verify_hosts)\n");
1119 tlsp->verify_override = TRUE;
1123 #ifndef DISABLE_EVENT
1124 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
1125 return 0; /* reject, with peercert set */
1128 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
1129 *calledp ? "" : " authenticated", dn);
1133 return 1; /* accept, at least for this level */
1137 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
1139 return verify_callback(preverify_ok, x509ctx, &tls_out,
1140 &client_verify_callback_called, &client_verify_optional);
1144 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
1146 return verify_callback(preverify_ok, x509ctx, &tls_in,
1147 &server_verify_callback_called, &server_verify_optional);
1153 /* This gets called *by* the dane library verify callback, which interposes
1157 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
1159 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
1161 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
1162 #ifndef DISABLE_EVENT
1163 BOOL dummy_called, optional = FALSE;
1166 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
1168 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
1169 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
1170 deliver_host_address);
1173 dn[sizeof(dn)-1] = '\0';
1175 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
1176 preverify_ok ? "ok":"BAD", depth, dn);
1178 #ifndef DISABLE_EVENT
1179 if (verify_event(&tls_out, cert, depth, dn,
1180 &dummy_called, &optional, US"DANE"))
1181 return 0; /* reject, with peercert set */
1184 if (preverify_ok == 1)
1186 tls_out.dane_verified = TRUE;
1187 #ifndef DISABLE_OCSP
1188 if (client_static_state->u_ocsp.client.verify_store)
1189 { /* client, wanting stapling */
1190 /* Add the server cert's signing chain as the one
1191 for the verification of the OCSP stapled information. */
1193 if (!X509_STORE_add_cert(client_static_state->u_ocsp.client.verify_store,
1196 sk_X509_push(client_static_state->verify_stack, cert);
1202 int err = X509_STORE_CTX_get_error(x509ctx);
1204 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
1205 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
1208 return preverify_ok;
1211 #endif /*SUPPORT_DANE*/
1214 #ifndef DISABLE_OCSP
1215 /*************************************************
1216 * Load OCSP information into state *
1217 *************************************************/
1218 /* Called to load the server OCSP response from the given file into memory, once
1219 caller has determined this is needed. Checks validity. Debugs a message
1222 ASSUMES: single response, for single cert.
1225 state various parts of session state
1226 filename the filename putatively holding an OCSP response
1227 is_pem file is PEM format; otherwise is DER
1231 ocsp_load_response(exim_openssl_state_st * state, const uschar * filename,
1235 OCSP_RESPONSE * resp;
1236 OCSP_BASICRESP * basic_response;
1237 OCSP_SINGLERESP * single_response;
1238 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1239 STACK_OF(X509) * sk;
1240 unsigned long verify_flags;
1241 int status, reason, i;
1244 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1246 if (!(bio = BIO_new_file(CS filename, "rb")))
1248 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
1255 uschar * data, * freep;
1258 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1260 DEBUG(D_tls) debug_printf("Failed to read PEM file \"%s\"\n",
1265 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1266 OPENSSL_free(freep);
1269 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1274 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
1278 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1280 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1281 OCSP_response_status_str(status), status);
1287 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1288 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1293 if (!(basic_response = OCSP_response_get1_basic(resp)))
1296 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1300 sk = state->verify_stack;
1301 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1303 /* May need to expose ability to adjust those flags?
1304 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1305 OCSP_TRUSTOTHER OCSP_NOINTERN */
1307 /* This does a full verify on the OCSP proof before we load it for serving
1308 up; possibly overkill - just date-checks might be nice enough.
1310 OCSP_basic_verify takes a "store" arg, but does not
1311 use it for the chain verification, which is all we do
1312 when OCSP_NOVERIFY is set. The content from the wire
1313 "basic_response" and a cert-stack "sk" are all that is used.
1315 We have a stack, loaded in setup_certs() if tls_verify_certificates
1316 was a file (not a directory, or "system"). It is unfortunate we
1317 cannot used the connection context store, as that would neatly
1318 handle the "system" case too, but there seems to be no library
1319 function for getting a stack from a store.
1320 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1321 We do not free the stack since it could be needed a second time for
1324 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1325 be a public interface into the OpenSSL library (there's no manual entry) -
1326 But what with? We also use OCSP_basic_verify in the client stapling callback.
1327 And there we NEED it; we must verify that status... unless the
1328 library does it for us anyway? */
1330 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
1334 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1335 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
1340 /* Here's the simplifying assumption: there's only one response, for the
1341 one certificate we use, and nothing for anything else in a chain. If this
1342 proves false, we need to extract a cert id from our issued cert
1343 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1344 right cert in the stack and then calls OCSP_single_get0_status()).
1346 I'm hoping to avoid reworking a bunch more of how we handle state here.
1348 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1351 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1354 debug_printf("Unable to get first response from OCSP basic response.\n");
1358 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1359 if (status != V_OCSP_CERTSTATUS_GOOD)
1361 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1362 OCSP_cert_status_str(status), status,
1363 OCSP_crl_reason_str(reason), reason);
1367 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1369 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
1374 /* Add the resp to the list used by tls_server_stapling_cb() */
1376 ocsp_resplist ** op = &state->u_ocsp.server.olist, * oentry;
1377 while (oentry = *op)
1379 *op = oentry = store_get(sizeof(ocsp_resplist), FALSE);
1380 oentry->next = NULL;
1381 oentry->resp = resp;
1386 if (f.running_in_test_harness)
1388 extern char ** environ;
1389 if (environ) for (uschar ** p = USS environ; *p; p++)
1390 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1392 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1393 goto supply_response;
1401 ocsp_free_response_list(exim_openssl_state_st * cbinfo)
1403 for (ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; olist;
1404 olist = olist->next)
1405 OCSP_RESPONSE_free(olist->resp);
1406 cbinfo->u_ocsp.server.olist = NULL;
1408 #endif /*!DISABLE_OCSP*/
1415 tls_add_certfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1418 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1419 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1420 return tls_error(string_sprintf(
1421 "SSL_CTX_use_certificate_chain_file file=%s", file),
1422 cbinfo->host, NULL, errstr);
1427 tls_add_pkeyfile(SSL_CTX * sctx, exim_openssl_state_st * cbinfo, uschar * file,
1430 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1431 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1432 return tls_error(string_sprintf(
1433 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1440 /* Called once during tls_init and possibly again during TLS setup, for a
1441 new context, if Server Name Indication was used and tls_sni was seen in
1442 the certificate string.
1445 sctx the SSL_CTX* to update
1446 state various parts of session state
1447 errstr error string pointer
1449 Returns: OK/DEFER/FAIL
1453 tls_expand_session_files(SSL_CTX * sctx, exim_openssl_state_st * state,
1458 if (!state->certificate)
1460 if (!state->is_server) /* client */
1463 if (tls_install_selfsign(sctx, errstr) != OK)
1470 if ( !reexpand_tls_files_for_sni
1471 && ( Ustrstr(state->certificate, US"tls_sni")
1472 || Ustrstr(state->certificate, US"tls_in_sni")
1473 || Ustrstr(state->certificate, US"tls_out_sni")
1475 reexpand_tls_files_for_sni = TRUE;
1477 if (!expand_check(state->certificate, US"tls_certificate", &expanded, errstr))
1481 if (state->is_server)
1483 const uschar * file_list = expanded;
1486 #ifndef DISABLE_OCSP
1487 const uschar * olist = state->u_ocsp.server.file;
1490 BOOL fmt_pem = FALSE;
1493 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1495 if (olist && !*olist)
1498 if ( state->u_ocsp.server.file_expanded && olist
1499 && (Ustrcmp(olist, state->u_ocsp.server.file_expanded) == 0))
1501 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1506 ocsp_free_response_list(state);
1507 state->u_ocsp.server.file_expanded = olist;
1511 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1513 if ((err = tls_add_certfile(sctx, state, file, errstr)))
1516 #ifndef DISABLE_OCSP
1518 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1520 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1525 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1530 ocsp_load_response(state, ofile, fmt_pem);
1533 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1537 else /* would there ever be a need for multiple client certs? */
1538 if ((err = tls_add_certfile(sctx, state, expanded, errstr)))
1541 if ( state->privatekey
1542 && !expand_check(state->privatekey, US"tls_privatekey", &expanded, errstr))
1545 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1546 of the expansion is an empty string, ignore it also, and assume the private
1547 key is in the same file as the certificate. */
1549 if (expanded && *expanded)
1550 if (state->is_server)
1552 const uschar * file_list = expanded;
1556 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1557 if ((err = tls_add_pkeyfile(sctx, state, file, errstr)))
1560 else /* would there ever be a need for multiple client certs? */
1561 if ((err = tls_add_pkeyfile(sctx, state, expanded, errstr)))
1571 /**************************************************
1572 * One-time init credentials for server and client *
1573 **************************************************/
1578 creds_basic_init(gnutls_certificate_credentials_t x509_cred, BOOL server)
1584 creds_load_server_certs(/*exim_gnutls_state_st * state,*/ const uschar * cert,
1585 const uschar * pkey, const uschar * ocsp, uschar ** errstr)
1588 const uschar * clist = cert;
1589 const uschar * klist = pkey;
1590 const uschar * olist;
1591 int csep = 0, ksep = 0, osep = 0, cnt = 0, rc;
1592 uschar * cfile, * kfile, * ofile;
1593 #ifndef DISABLE_OCSP
1594 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1595 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1598 if (!expand_check(ocsp, US"tls_ocsp_file", &ofile, errstr))
1603 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1605 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1606 return tls_error(US"cert/key setup: out of keys", NULL, NULL, errstr);
1607 else if ((rc = tls_add_certfile(state, NULL, cfile, kfile, errstr)) > 0)
1611 int gnutls_cert_index = -rc;
1612 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1613 gnutls_cert_index, cfile);
1615 #ifndef DISABLE_OCSP
1618 /* Set the OCSP stapling server info */
1619 if (gnutls_buggy_ocsp)
1622 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1624 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1626 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1627 gnutls_cert_index, ofile);
1628 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1629 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1631 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1634 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1636 ocsp_fmt = GNUTLS_X509_FMT_DER;
1640 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1641 state->lib_state.x509_cred, CCS ofile, gnutls_cert_index,
1643 return tls_error_gnu(
1644 US"gnutls_certificate_set_ocsp_status_request_file2",
1647 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1649 /* Arrange callbacks for OCSP request observability */
1652 gnutls_handshake_set_hook_function(state->session,
1653 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1655 state->lib_state.ocsp_hook = TRUE;
1659 # if defined(SUPPORT_SRV_OCSP_STACK)
1660 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1661 state->lib_state.x509_cred, gnutls_cert_index,
1662 server_ocsp_stapling_cb, ofile)))
1663 return tls_error_gnu(
1664 US"gnutls_certificate_set_ocsp_status_request_function2",
1672 debug_printf("oops; multiple OCSP files not supported\n");
1675 gnutls_certificate_set_ocsp_status_request_function(
1676 state->lib_state.x509_cred, server_ocsp_stapling_cb, ofile);
1678 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1681 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1683 #endif /* DISABLE_OCSP */
1690 creds_load_client_certs(/*exim_gnutls_state_st * state,*/ const host_item * host,
1691 const uschar * cert, const uschar * pkey, uschar ** errstr)
1697 creds_load_cabundle(/*exim_gnutls_state_st * state,*/ const uschar * bundle,
1698 const host_item * host, uschar ** errstr)
1702 struct stat statbuf;
1704 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1705 if (Ustrcmp(bundle, "system") == 0 || Ustrncmp(bundle, "system,", 7) == 0)
1706 cert_count = gnutls_certificate_set_x509_system_trust(state->lib_state.x509_cred);
1710 if (Ustat(bundle, &statbuf) < 0)
1712 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1713 "(tls_verify_certificates): %s", bundle, strerror(errno));
1717 #ifndef SUPPORT_CA_DIR
1718 /* The test suite passes in /dev/null; we could check for that path explicitly,
1719 but who knows if someone has some weird FIFO which always dumps some certs, or
1720 other weirdness. The thing we really want to check is that it's not a
1721 directory, since while OpenSSL supports that, GnuTLS does not.
1722 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1723 if (S_ISDIR(statbuf.st_mode))
1725 log_write(0, LOG_MAIN|LOG_PANIC,
1726 "tls_verify_certificates \"%s\" is a directory", bundle);
1731 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1732 bundle, statbuf.st_size);
1734 if (statbuf.st_size == 0)
1737 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1743 #ifdef SUPPORT_CA_DIR
1744 (statbuf.st_mode & S_IFMT) == S_IFDIR
1746 gnutls_certificate_set_x509_trust_dir(state->lib_state.x509_cred,
1747 CS bundle, GNUTLS_X509_FMT_PEM)
1750 gnutls_certificate_set_x509_trust_file(state->lib_state.x509_cred,
1751 CS bundle, GNUTLS_X509_FMT_PEM);
1753 #ifdef SUPPORT_CA_DIR
1754 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1755 when using the directory-of-certs config model. */
1757 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1759 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1761 state->lib_state.ca_rdn_emulate = TRUE;
1766 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1768 debug_printf("Added %d certificate authorities\n", cert_count);
1776 creds_load_crl(/*exim_gnutls_state_st * state,*/ const uschar * crl, uschar ** errstr)
1783 creds_load_pristring(/*exim_gnutls_state_st * state,*/ const uschar * p,
1784 const char ** errpos)
1790 server_load_ciphers(SSL_CTX * ctx, exim_openssl_state_st * state,
1791 uschar * ciphers, uschar ** errstr)
1793 for (uschar * s = ciphers; *s; s++ ) if (*s == '_') *s = '-';
1794 DEBUG(D_tls) debug_printf("required ciphers: %s\n", ciphers);
1795 if (!SSL_CTX_set_cipher_list(ctx, CS ciphers))
1796 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
1797 state->server_cipher_list = ciphers;
1804 lib_ctx_new(SSL_CTX ** ctxp, host_item * host, uschar ** errstr)
1807 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1808 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1810 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
1812 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
1814 /* Set up the information callback, which outputs if debugging is at a suitable
1819 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
1820 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1821 /* this needs a debug build of OpenSSL */
1822 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
1824 #ifdef OPENSSL_HAVE_KEYLOG_CB
1825 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
1829 /* Automatically re-try reads/writes after renegotiation. */
1830 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
1837 tls_server_creds_init(void)
1840 uschar * dummy_errstr;
1844 state_server.lib_state = null_tls_preload;
1846 if (lib_ctx_new(&ctx, NULL, &dummy_errstr) != OK)
1848 state_server.lib_state.lib_ctx = ctx;
1850 /* Preload DH params and EC curve */
1852 if (opt_unset_or_noexpand(tls_dhparam))
1854 DEBUG(D_tls) debug_printf("TLS: preloading DH params for server\n");
1855 if (init_dh(ctx, tls_dhparam, NULL, &dummy_errstr))
1856 state_server.lib_state.dh = TRUE;
1858 if (opt_unset_or_noexpand(tls_eccurve))
1860 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for server\n");
1861 if (init_ecdh(ctx, NULL, &dummy_errstr))
1862 state_server.lib_state.ecdh = TRUE;
1865 #ifdef EXIM_HAVE_INOTIFY
1866 /* If we can, preload the server-side cert, key and ocsp */
1868 if ( opt_set_and_noexpand(tls_certificate)
1869 # ifndef DISABLE_OCSP
1870 && opt_unset_or_noexpand(tls_ocsp_file)
1872 && opt_unset_or_noexpand(tls_privatekey))
1874 /* Set watches on the filenames. The implementation does de-duplication
1875 so we can just blindly do them all.
1878 if ( tls_set_watch(tls_certificate, TRUE)
1879 # ifndef DISABLE_OCSP
1880 && tls_set_watch(tls_ocsp_file, TRUE)
1882 && tls_set_watch(tls_privatekey, TRUE))
1884 state_server.certificate = tls_certificate;
1885 state_server.privatekey = tls_privatekey;
1886 #ifndef DISABLE_OCSP
1887 state_server.u_ocsp.server.file = tls_ocsp_file;
1890 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1891 if (tls_expand_session_files(ctx, &state_server, &dummy_errstr) == OK)
1892 state_server.lib_state.conn_certs = TRUE;
1896 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1899 /* If we can, preload the Authorities for checking client certs against.
1900 Actual choice to do verify is made (tls_{,try_}verify_hosts)
1901 at TLS conn startup */
1903 if ( opt_set_and_noexpand(tls_verify_certificates)
1904 && opt_unset_or_noexpand(tls_crl))
1906 /* Watch the default dir also as they are always included */
1908 if ( tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
1909 && tls_set_watch(tls_verify_certificates, FALSE)
1910 && tls_set_watch(tls_crl, FALSE))
1912 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1914 if (setup_certs(ctx, tls_verify_certificates, tls_crl, NULL, &dummy_errstr)
1916 state_server.lib_state.cabundle = TRUE;
1920 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1921 #endif /* EXIM_HAVE_INOTIFY */
1924 /* If we can, preload the ciphers control string */
1926 if (opt_set_and_noexpand(tls_require_ciphers))
1928 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server\n");
1929 if (server_load_ciphers(ctx, &state_server, tls_require_ciphers,
1930 &dummy_errstr) == OK)
1931 state_server.lib_state.pri_string = TRUE;
1934 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1940 /* Preload whatever creds are static, onto a transport. The client can then
1941 just copy the pointer as it starts up.
1942 Called from the daemon after a cache-invalidate with watch set; called from
1943 a queue-run startup with watch clear. */
1946 tls_client_creds_init(transport_instance * t, BOOL watch)
1948 smtp_transport_options_block * ob = t->options_block;
1949 exim_openssl_state_st tpt_dummy_state;
1950 host_item * dummy_host = (host_item *)1;
1951 uschar * dummy_errstr;
1956 ob->tls_preload = null_tls_preload;
1957 if (lib_ctx_new(&ctx, dummy_host, &dummy_errstr) != OK)
1959 ob->tls_preload.lib_ctx = ctx;
1961 tpt_dummy_state.lib_state = ob->tls_preload;
1963 if (opt_unset_or_noexpand(tls_dhparam))
1965 DEBUG(D_tls) debug_printf("TLS: preloading DH params for transport '%s'\n", t->name);
1966 if (init_dh(ctx, tls_dhparam, NULL, &dummy_errstr))
1967 ob->tls_preload.dh = TRUE;
1969 if (opt_unset_or_noexpand(tls_eccurve))
1971 DEBUG(D_tls) debug_printf("TLS: preloading ECDH curve for transport '%s'\n", t->name);
1972 if (init_ecdh(ctx, NULL, &dummy_errstr))
1973 ob->tls_preload.ecdh = TRUE;
1976 #ifdef EXIM_HAVE_INOTIFY
1977 if ( opt_set_and_noexpand(ob->tls_certificate)
1978 && opt_unset_or_noexpand(ob->tls_privatekey))
1981 || ( tls_set_watch(ob->tls_certificate, FALSE)
1982 && tls_set_watch(ob->tls_privatekey, FALSE)
1985 uschar * pkey = ob->tls_privatekey;
1988 debug_printf("TLS: preloading client certs for transport '%s'\n",t->name);
1990 if ( tls_add_certfile(ctx, &tpt_dummy_state, ob->tls_certificate,
1992 && tls_add_pkeyfile(ctx, &tpt_dummy_state,
1993 pkey ? pkey : ob->tls_certificate,
1996 ob->tls_preload.conn_certs = TRUE;
2001 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
2004 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
2005 && opt_unset_or_noexpand(ob->tls_crl))
2008 || tls_set_watch(CUS X509_get_default_cert_file(), FALSE)
2009 && tls_set_watch(ob->tls_verify_certificates, FALSE)
2010 && tls_set_watch(ob->tls_crl, FALSE)
2014 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
2016 if (setup_certs(ctx, ob->tls_verify_certificates,
2017 ob->tls_crl, dummy_host, &dummy_errstr) == OK)
2018 ob->tls_preload.cabundle = TRUE;
2023 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
2025 #endif /*EXIM_HAVE_INOTIFY*/
2029 #ifdef EXIM_HAVE_INOTIFY
2030 /* Invalidate the creds cached, by dropping the current ones.
2031 Call when we notice one of the source files has changed. */
2034 tls_server_creds_invalidate(void)
2036 SSL_CTX_free(state_server.lib_state.lib_ctx);
2037 state_server.lib_state = null_tls_preload;
2042 tls_client_creds_invalidate(transport_instance * t)
2044 smtp_transport_options_block * ob = t->options_block;
2045 SSL_CTX_free(ob->tls_preload.lib_ctx);
2046 ob->tls_preload = null_tls_preload;
2048 #endif /*EXIM_HAVE_INOTIFY*/
2052 #ifndef DISABLE_OCSP
2054 x509_store_dump_cert_s_names(X509_STORE * store)
2056 STACK_OF(X509_OBJECT) * roots= store->objs;
2057 static uschar name[256];
2059 for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
2061 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
2062 if(tmp_obj->type == X509_LU_X509)
2064 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
2065 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
2067 name[sizeof(name)-1] = '\0';
2068 debug_printf(" %s\n", name);
2077 #ifndef DISABLE_TLS_RESUME
2078 /* Manage the keysets used for encrypting the session tickets, on the server. */
2080 typedef struct { /* Session ticket encryption key */
2083 const EVP_CIPHER * aes_cipher;
2084 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
2085 const EVP_MD * hmac_hash;
2086 uschar hmac_key[16];
2091 static exim_stek exim_tk; /* current key */
2092 static exim_stek exim_tk_old; /* previous key */
2097 time_t t = time(NULL);
2099 if (exim_tk.name[0])
2101 if (exim_tk.renew >= t) return;
2102 exim_tk_old = exim_tk;
2105 if (f.running_in_test_harness) ssl_session_timeout = 6;
2107 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
2108 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
2109 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
2110 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
2112 exim_tk.name[0] = 'E';
2113 exim_tk.aes_cipher = EVP_aes_256_cbc();
2114 exim_tk.hmac_hash = EVP_sha256();
2115 exim_tk.expire = t + ssl_session_timeout;
2116 exim_tk.renew = t + ssl_session_timeout/2;
2122 if (!exim_tk.name[0]) return NULL;
2127 tk_find(const uschar * name)
2129 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
2130 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
2134 /* Callback for session tickets, on server */
2136 ticket_key_callback(SSL * ssl, uschar key_name[16],
2137 uschar * iv, EVP_CIPHER_CTX * c_ctx, HMAC_CTX * hctx, int enc)
2139 tls_support * tlsp = state_server.tlsp;
2144 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
2145 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2147 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
2148 return -1; /* insufficient random */
2150 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
2151 return 0; /* key couldn't be created */
2152 memcpy(key_name, key->name, 16);
2153 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
2155 /*XXX will want these dependent on the ssl session strength */
2156 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2157 key->hmac_hash, NULL);
2158 EVP_EncryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2160 DEBUG(D_tls) debug_printf("ticket created\n");
2165 time_t now = time(NULL);
2167 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
2168 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2170 if (!(key = tk_find(key_name)) || key->expire < now)
2174 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
2175 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
2180 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
2181 key->hmac_hash, NULL);
2182 EVP_DecryptInit_ex(c_ctx, key->aes_cipher, NULL, key->aes_key, iv);
2184 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
2186 /* The ticket lifetime and renewal are the same as the STEK lifetime and
2187 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
2188 be better. To do that we'd have to encode ticket lifetime in the name as
2189 we don't yet see the restored session. Could check posthandshake for TLS1.3
2190 and trigger a new ticket then, but cannot do that for TLS1.2 */
2191 return key->renew < now ? 2 : 1;
2199 setup_cert_verify(SSL_CTX * ctx, BOOL optional,
2200 int (*cert_vfy_cb)(int, X509_STORE_CTX *))
2202 /* If verification is optional, don't fail if no certificate */
2204 SSL_CTX_set_verify(ctx,
2205 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2210 /*************************************************
2211 * Callback to handle SNI *
2212 *************************************************/
2214 /* Called when acting as server during the TLS session setup if a Server Name
2215 Indication extension was sent by the client.
2217 API documentation is OpenSSL s_server.c implementation.
2220 s SSL* of the current session
2221 ad unknown (part of OpenSSL API) (unused)
2222 arg Callback of "our" registered data
2224 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
2226 XXX might need to change to using ClientHello callback,
2227 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
2230 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2232 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
2234 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
2235 exim_openssl_state_st *state = (exim_openssl_state_st *) arg;
2237 int old_pool = store_pool;
2238 uschar * dummy_errstr;
2241 return SSL_TLSEXT_ERR_OK;
2243 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
2244 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
2246 /* Make the extension value available for expansion */
2247 store_pool = POOL_PERM;
2248 tls_in.sni = string_copy_taint(US servername, TRUE);
2249 store_pool = old_pool;
2251 if (!reexpand_tls_files_for_sni)
2252 return SSL_TLSEXT_ERR_OK;
2254 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
2255 not confident that memcpy wouldn't break some internal reference counting.
2256 Especially since there's a references struct member, which would be off. */
2258 if (lib_ctx_new(&server_sni, NULL, &dummy_errstr) != OK)
2261 /* Not sure how many of these are actually needed, since SSL object
2262 already exists. Might even need this selfsame callback, for reneg? */
2265 SSL_CTX * ctx = state_server.lib_state.lib_ctx;
2266 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(ctx));
2267 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(ctx));
2268 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(ctx));
2269 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(ctx));
2270 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
2271 SSL_CTX_set_tlsext_servername_arg(server_sni, state);
2274 if ( !init_dh(server_sni, state->dhparam, NULL, &dummy_errstr)
2275 || !init_ecdh(server_sni, NULL, &dummy_errstr)
2279 if ( state->server_cipher_list
2280 && !SSL_CTX_set_cipher_list(server_sni, CS state->server_cipher_list))
2283 #ifndef DISABLE_OCSP
2284 if (state->u_ocsp.server.file)
2286 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
2287 SSL_CTX_set_tlsext_status_arg(server_sni, state);
2293 if ( !expand_check(tls_verify_certificates, US"tls_verify_certificates",
2294 &expcerts, &dummy_errstr)
2295 || (rc = setup_certs(server_sni, expcerts, tls_crl, NULL,
2296 &dummy_errstr)) != OK)
2299 if (expcerts && *expcerts)
2300 setup_cert_verify(server_sni, FALSE, verify_callback_server);
2303 /* do this after setup_certs, because this can require the certs for verifying
2304 OCSP information. */
2305 if ((rc = tls_expand_session_files(server_sni, state, &dummy_errstr)) != OK)
2308 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
2309 SSL_set_SSL_CTX(s, server_sni);
2310 return SSL_TLSEXT_ERR_OK;
2312 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
2314 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
2319 #ifndef DISABLE_OCSP
2321 /*************************************************
2322 * Callback to handle OCSP Stapling *
2323 *************************************************/
2325 /* Called when acting as server during the TLS session setup if the client
2326 requests OCSP information with a Certificate Status Request.
2328 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
2334 tls_server_stapling_cb(SSL *s, void *arg)
2336 const exim_openssl_state_st * state = arg;
2337 ocsp_resplist * olist = state->u_ocsp.server.olist;
2338 uschar * response_der; /*XXX blob */
2339 int response_der_len;
2342 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
2343 olist ? "have" : "lack");
2345 tls_in.ocsp = OCSP_NOT_RESP;
2347 return SSL_TLSEXT_ERR_NOACK;
2349 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
2351 const X509 * cert_sent = SSL_get_certificate(s);
2352 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
2353 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
2354 const X509_NAME * cert_issuer = X509_get_issuer_name(cert_sent);
2358 for (; olist; olist = olist->next)
2360 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
2361 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
2362 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
2363 ASN1_INTEGER * res_cert_serial;
2364 const BIGNUM * resp_bn;
2365 ASN1_OCTET_STRING * res_cert_iNameHash;
2368 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
2369 (OCSP_CERTID *) cid);
2370 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
2374 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
2375 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
2378 if (BN_cmp(cert_bn, resp_bn) == 0)
2380 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
2382 /*XXX TODO: check the rest of the list for duplicate matches.
2383 If any, need to also check the Issuer Name hash.
2384 Without this, we will provide the wrong status in the case of
2389 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
2393 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
2394 return SSL_TLSEXT_ERR_NOACK;
2400 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
2401 return SSL_TLSEXT_ERR_NOACK;
2405 /*XXX could we do the i2d earlier, rather than during the callback? */
2406 response_der = NULL;
2407 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
2408 if (response_der_len <= 0)
2409 return SSL_TLSEXT_ERR_NOACK;
2411 SSL_set_tlsext_status_ocsp_resp(state_server.lib_state.lib_ssl,
2412 response_der, response_der_len);
2413 tls_in.ocsp = OCSP_VFIED;
2414 return SSL_TLSEXT_ERR_OK;
2419 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
2421 BIO_printf(bp, "\t%s: ", str);
2422 ASN1_GENERALIZEDTIME_print(bp, time);
2427 tls_client_stapling_cb(SSL *s, void *arg)
2429 exim_openssl_state_st * cbinfo = arg;
2430 const unsigned char * p;
2432 OCSP_RESPONSE * rsp;
2433 OCSP_BASICRESP * bs;
2436 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
2437 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
2440 /* Expect this when we requested ocsp but got none */
2441 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
2442 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
2444 DEBUG(D_tls) debug_printf(" null\n");
2445 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2448 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
2450 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
2451 if (LOGGING(tls_cipher))
2452 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
2454 DEBUG(D_tls) debug_printf(" parse error\n");
2458 if (!(bs = OCSP_response_get1_basic(rsp)))
2460 tls_out.ocsp = OCSP_FAILED;
2461 if (LOGGING(tls_cipher))
2462 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
2464 DEBUG(D_tls) debug_printf(" error parsing response\n");
2465 OCSP_RESPONSE_free(rsp);
2469 /* We'd check the nonce here if we'd put one in the request. */
2470 /* However that would defeat cacheability on the server so we don't. */
2472 /* This section of code reworked from OpenSSL apps source;
2473 The OpenSSL Project retains copyright:
2474 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
2478 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
2479 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
2482 DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
2484 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
2486 /* Use the chain that verified the server cert to verify the stapled info */
2487 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
2489 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
2490 cbinfo->u_ocsp.client.verify_store, OCSP_NOEXPLICIT)) <= 0)
2491 if (ERR_peek_error())
2493 tls_out.ocsp = OCSP_FAILED;
2494 if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
2495 "Received TLS cert status response, itself unverifiable: %s",
2496 ERR_reason_error_string(ERR_peek_error()));
2497 BIO_printf(bp, "OCSP response verify failure\n");
2498 ERR_print_errors(bp);
2499 OCSP_RESPONSE_print(bp, rsp, 0);
2503 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
2504 " in the root CA certificate; ignoring\n");
2506 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
2508 /*XXX So we have a good stapled OCSP status. How do we know
2509 it is for the cert of interest? OpenSSL 1.1.0 has a routine
2510 OCSP_resp_find_status() which matches on a cert id, which presumably
2511 we should use. Making an id needs OCSP_cert_id_new(), which takes
2512 issuerName, issuerKey, serialNumber. Are they all in the cert?
2514 For now, carry on blindly accepting the resp. */
2517 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
2518 OCSP_resp_count(bs) - 1;
2520 sk_OCSP_SINGLERESP_num(sresp) - 1;
2524 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
2526 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
2528 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
2529 - but what happens with a GnuTLS-style input?
2531 we could do with a debug label for each singleresp
2532 - it has a certID with a serialNumber, but I see no API to get that
2534 status = OCSP_single_get0_status(single, &reason, &rev,
2535 &thisupd, &nextupd);
2537 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
2538 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
2539 if (!OCSP_check_validity(thisupd, nextupd,
2540 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
2542 tls_out.ocsp = OCSP_FAILED;
2543 DEBUG(D_tls) ERR_print_errors(bp);
2544 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
2548 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
2549 OCSP_cert_status_str(status));
2552 case V_OCSP_CERTSTATUS_GOOD:
2553 continue; /* the idx loop */
2554 case V_OCSP_CERTSTATUS_REVOKED:
2555 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2556 reason != -1 ? "; reason: " : "",
2557 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2558 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2561 log_write(0, LOG_MAIN,
2562 "Server certificate status unknown, in OCSP stapling");
2570 tls_out.ocsp = OCSP_VFIED;
2574 tls_out.ocsp = OCSP_FAILED;
2575 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2580 OCSP_RESPONSE_free(rsp);
2583 #endif /*!DISABLE_OCSP*/
2586 /*************************************************
2587 * Initialize for TLS *
2588 *************************************************/
2589 /* Called from both server and client code, to do preliminary initialization
2590 of the library. We allocate and return a context structure.
2593 host connected host, if client; NULL if server
2594 ob transport options block, if client; NULL if server
2595 ocsp_file file of stapling info (server); flag for require ocsp (client)
2596 addr address if client; NULL if server (for some randomness)
2597 caller_state place to put pointer to allocated state-struct
2598 errstr error string pointer
2600 Returns: OK/DEFER/FAIL
2604 tls_init(host_item * host, smtp_transport_options_block * ob,
2605 #ifndef DISABLE_OCSP
2608 address_item *addr, exim_openssl_state_st ** caller_state,
2613 exim_openssl_state_st * state;
2616 if (host) /* client */
2618 state = store_malloc(sizeof(exim_openssl_state_st));
2619 memset(state, 0, sizeof(*state));
2620 state->certificate = ob->tls_certificate;
2621 state->privatekey = ob->tls_privatekey;
2622 state->is_server = FALSE;
2623 state->dhparam = NULL;
2624 state->lib_state = ob->tls_preload;
2628 state = &state_server;
2629 state->certificate = tls_certificate;
2630 state->privatekey = tls_privatekey;
2631 state->is_server = TRUE;
2632 state->dhparam = tls_dhparam;
2633 state->lib_state = state_server.lib_state;
2639 if (!state->lib_state.pri_string)
2640 state->server_cipher_list = NULL;
2642 #ifndef DISABLE_EVENT
2643 state->event_action = NULL;
2648 /* It turns out that we need to seed the random number generator this early in
2649 order to get the full complement of ciphers to work. It took me roughly a day
2650 of work to discover this by experiment.
2652 On systems that have /dev/urandom, SSL may automatically seed itself from
2653 there. Otherwise, we have to make something up as best we can. Double check
2656 Although we likely called this before, at daemon startup, this is a chance
2657 to mix in further variable info (time, pid) if needed. */
2659 if (!lib_rand_init(addr))
2660 return tls_error(US"RAND_status", host,
2661 US"unable to seed random number generator", errstr);
2663 /* Apply administrator-supplied work-arounds.
2664 Historically we applied just one requested option,
2665 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2666 moved to an administrator-controlled list of options to specify and
2667 grandfathered in the first one as the default value for "openssl_options".
2669 No OpenSSL version number checks: the options we accept depend upon the
2670 availability of the option value macros from OpenSSL. */
2673 if (!tls_openssl_options_parse(openssl_options, &init_options))
2674 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2676 /* Create a context.
2677 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2678 negotiation in the different methods; as far as I can tell, the only
2679 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2680 when OpenSSL is built without SSLv2 support.
2681 By disabling with openssl_options, we can let admins re-enable with the
2684 if (!(ctx = state->lib_state.lib_ctx))
2686 if ((rc = lib_ctx_new(&ctx, host, errstr)) != OK)
2688 state->lib_state.lib_ctx = ctx;
2691 #ifndef DISABLE_TLS_RESUME
2692 tlsp->resumption = RESUME_SUPPORTED;
2696 #ifndef DISABLE_TLS_RESUME
2697 /* Should the server offer session resumption? */
2698 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2700 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2701 init_options &= ~SSL_OP_NO_TICKET;
2702 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2703 tlsp->host_resumable = TRUE;
2707 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
2708 if (!(SSL_CTX_set_options(ctx, init_options)))
2709 return tls_error(string_sprintf(
2710 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2713 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2715 /* We'd like to disable session cache unconditionally, but foolish Outlook
2716 Express clients then give up the first TLS connection and make a second one
2717 (which works). Only when there is an IMAP service on the same machine.
2718 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2719 now, until we work out a decent way of presenting control to the config. It
2720 will never be used because we use a new context every time. */
2722 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2725 /* Initialize with DH parameters if supplied */
2726 /* Initialize ECDH temp key parameter selection */
2728 if (state->lib_state.dh)
2729 { DEBUG(D_tls) debug_printf("TLS: DH params were preloaded\n"); }
2731 if (!init_dh(ctx, state->dhparam, host, errstr)) return DEFER;
2733 if (state->lib_state.ecdh)
2734 { DEBUG(D_tls) debug_printf("TLS: ECDH curve was preloaded\n"); }
2736 if (!init_ecdh(ctx, host, errstr)) return DEFER;
2738 /* Set up certificate and key (and perhaps OCSP info) */
2740 if (state->lib_state.conn_certs)
2743 debug_printf("TLS: %s certs were preloaded\n", host ? "client":"server");
2747 #ifndef DISABLE_OCSP
2750 state->u_ocsp.server.file = ocsp_file;
2751 state->u_ocsp.server.file_expanded = NULL;
2752 state->u_ocsp.server.olist = NULL;
2755 if ((rc = tls_expand_session_files(ctx, state, errstr)) != OK) return rc;
2758 /* If we need to handle SNI or OCSP, do so */
2760 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2761 # ifndef DISABLE_OCSP
2762 if (!(state->verify_stack = sk_X509_new_null()))
2764 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2769 if (!host) /* server */
2771 # ifndef DISABLE_OCSP
2772 /* We check u_ocsp.server.file, not server.olist, because we care about if
2773 the option exists, not what the current expansion might be, as SNI might
2774 change the certificate and OCSP file in use between now and the time the
2775 callback is invoked. */
2776 if (state->u_ocsp.server.file)
2778 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2779 SSL_CTX_set_tlsext_status_arg(ctx, state);
2782 /* We always do this, so that $tls_sni is available even if not used in
2784 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2785 SSL_CTX_set_tlsext_servername_arg(ctx, state);
2787 # ifndef DISABLE_OCSP
2789 if(ocsp_file) /* wanting stapling */
2791 if (!(state->u_ocsp.client.verify_store = X509_STORE_new()))
2793 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2796 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2797 SSL_CTX_set_tlsext_status_arg(ctx, state);
2802 state->verify_cert_hostnames = NULL;
2804 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
2805 /* Set up the RSA callback */
2806 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
2809 /* Finally, set the session cache timeout, and we are done.
2810 The period appears to be also used for (server-generated) session tickets */
2812 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
2813 DEBUG(D_tls) debug_printf("Initialized TLS\n");
2815 *caller_state = state;
2823 /*************************************************
2824 * Get name of cipher in use *
2825 *************************************************/
2828 Argument: pointer to an SSL structure for the connection
2829 pointer to number of bits for cipher
2830 Returns: pointer to allocated string in perm-pool
2834 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
2836 int pool = store_pool;
2837 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
2838 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2839 the accessor functions use const in the prototype. */
2841 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
2844 SSL_CIPHER_get_bits(c, bits);
2846 store_pool = POOL_PERM;
2847 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2849 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2854 /* Get IETF-standard name for ciphersuite.
2855 Argument: pointer to an SSL structure for the connection
2856 Returns: pointer to string
2859 static const uschar *
2860 cipher_stdname_ssl(SSL * ssl)
2862 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2863 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2865 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2866 return cipher_stdname(id >> 8, id & 0xff);
2871 static const uschar *
2872 tlsver_name(SSL * ssl)
2875 int pool = store_pool;
2877 store_pool = POOL_PERM;
2878 s = string_copy(US SSL_get_version(ssl));
2880 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
2881 for (;; p++) if (!(*p = p[1])) break;
2887 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
2889 /*XXX we might consider a list-of-certs variable for the cert chain.
2890 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2891 in list-handling functions, also consider the difference between the entire
2892 chain and the elements sent by the peer. */
2894 tlsp->peerdn = NULL;
2896 /* Will have already noted peercert on a verify fail; possibly not the leaf */
2897 if (!tlsp->peercert)
2898 tlsp->peercert = SSL_get_peer_certificate(ssl);
2899 /* Beware anonymous ciphers which lead to server_cert being NULL */
2901 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2902 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2905 int oldpool = store_pool;
2907 peerdn[siz-1] = '\0'; /* paranoia */
2908 store_pool = POOL_PERM;
2909 tlsp->peerdn = string_copy(peerdn);
2910 store_pool = oldpool;
2912 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2913 but they don't get called on session-resumption. So use the official
2914 interface, which uses the resumed value. Unfortunately this claims verified
2915 when it actually failed but we're in try-verify mode, due to us wanting the
2916 knowlege that it failed so needing to have the callback and forcing a
2917 permissive return. If we don't force it, the TLS startup is failed.
2918 The extra bit of information is set in verify_override in the cb, stashed
2919 for resumption next to the TLS session, and used here. */
2921 if (!tlsp->verify_override)
2922 tlsp->certificate_verified =
2924 tlsp->dane_verified ||
2926 SSL_get_verify_result(ssl) == X509_V_OK;
2934 /*************************************************
2935 * Set up for verifying certificates *
2936 *************************************************/
2938 #ifndef DISABLE_OCSP
2939 /* Load certs from file, return TRUE on success */
2942 chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
2947 while (sk_X509_num(verify_stack) > 0)
2948 X509_free(sk_X509_pop(verify_stack));
2950 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
2951 while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
2952 sk_X509_push(verify_stack, x);
2960 /* Called by both client and server startup; on the server possibly
2961 repeated after a Server Name Indication.
2964 sctx SSL_CTX* to initialise
2965 certs certs file, expanded
2966 crl CRL file or NULL
2967 host NULL in a server; the remote host in a client
2968 errstr error string pointer
2970 Returns: OK/DEFER/FAIL
2974 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host,
2977 uschar *expcerts, *expcrl;
2979 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
2981 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
2983 if (expcerts && *expcerts)
2985 /* Tell the library to use its compiled-in location for the system default
2986 CA bundle. Then add the ones specified in the config, if any. */
2988 if (!SSL_CTX_set_default_verify_paths(sctx))
2989 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
2991 if (Ustrcmp(expcerts, "system") != 0 && Ustrncmp(expcerts, "system,", 7) != 0)
2993 struct stat statbuf;
2995 if (Ustat(expcerts, &statbuf) < 0)
2997 log_write(0, LOG_MAIN|LOG_PANIC,
2998 "failed to stat %s for certificates", expcerts);
3004 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
3005 { file = NULL; dir = expcerts; }
3008 file = expcerts; dir = NULL;
3009 #ifndef DISABLE_OCSP
3010 /* In the server if we will be offering an OCSP proof, load chain from
3011 file for verifying the OCSP proof at load time. */
3013 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
3014 This is inconsistent with the need to verify the OCSP proof of the server cert.
3018 && statbuf.st_size > 0
3019 && state_server.u_ocsp.server.file
3020 && !chain_from_pem_file(file, state_server.verify_stack)
3023 log_write(0, LOG_MAIN|LOG_PANIC,
3024 "failed to load cert chain from %s", file);
3030 /* If a certificate file is empty, the load function fails with an
3031 unhelpful error message. If we skip it, we get the correct behaviour (no
3032 certificates are recognized, but the error message is still misleading (it
3033 says no certificate was supplied). But this is better. */
3035 if ( (!file || statbuf.st_size > 0)
3036 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
3037 return tls_error(US"SSL_CTX_load_verify_locations",
3038 host, NULL, errstr);
3040 /* On the server load the list of CAs for which we will accept certs, for
3041 sending to the client. This is only for the one-file
3042 tls_verify_certificates variant.
3043 If a list isn't loaded into the server, but some verify locations are set,
3044 the server end appears to make a wildcard request for client certs.
3045 Meanwhile, the client library as default behaviour *ignores* the list
3046 we send over the wire - see man SSL_CTX_set_client_cert_cb.
3047 Because of this, and that the dir variant is likely only used for
3048 the public-CA bundle (not for a private CA), not worth fixing. */
3052 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
3053 int i = sk_X509_NAME_num(names);
3055 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
3056 DEBUG(D_tls) debug_printf("Added %d additional certificate authorit%s\n",
3057 i, i>1 ? "ies":"y");
3061 debug_printf("Added dir for additional certificate authorities\n");
3065 /* Handle a certificate revocation list. */
3067 #if OPENSSL_VERSION_NUMBER > 0x00907000L
3069 /* This bit of code is now the version supplied by Lars Mainka. (I have
3070 merely reformatted it into the Exim code style.)
3072 "From here I changed the code to add support for multiple crl's
3073 in pem format in one file or to support hashed directory entries in
3074 pem format instead of a file. This method now uses the library function
3075 X509_STORE_load_locations to add the CRL location to the SSL context.
3076 OpenSSL will then handle the verify against CA certs and CRLs by
3077 itself in the verify callback." */
3079 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
3080 if (expcrl && *expcrl)
3082 struct stat statbufcrl;
3083 if (Ustat(expcrl, &statbufcrl) < 0)
3085 log_write(0, LOG_MAIN|LOG_PANIC,
3086 "failed to stat %s for certificates revocation lists", expcrl);
3091 /* is it a file or directory? */
3093 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
3094 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
3098 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
3104 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
3106 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
3107 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
3109 /* setting the flags to check against the complete crl chain */
3111 X509_STORE_set_flags(cvstore,
3112 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
3116 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
3124 /*************************************************
3125 * Start a TLS session in a server *
3126 *************************************************/
3127 /* This is called when Exim is running as a server, after having received
3128 the STARTTLS command. It must respond to that command, and then negotiate
3132 errstr pointer to error message
3134 Returns: OK on success
3135 DEFER for errors before the start of the negotiation
3136 FAIL for errors during the negotiation; the server can't
3141 tls_server_start(uschar ** errstr)
3144 uschar * expciphers;
3145 exim_openssl_state_st * dummy_statep;
3148 static uschar peerdn[256];
3150 /* Check for previous activation */
3152 if (tls_in.active.sock >= 0)
3154 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
3155 smtp_printf("554 Already in TLS\r\n", FALSE);
3159 /* Initialize the SSL library. If it fails, it will already have logged
3162 rc = tls_init(NULL, NULL,
3163 #ifndef DISABLE_OCSP
3166 NULL, &dummy_statep, &tls_in, errstr);
3167 if (rc != OK) return rc;
3168 ctx = state_server.lib_state.lib_ctx;
3170 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3171 were historically separated by underscores. So that I can use either form in my
3172 tests, and also for general convenience, we turn underscores into hyphens here.
3174 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
3175 for TLS 1.3 . Since we do not call it at present we get the default list:
3176 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
3179 if (state_server.lib_state.pri_string)
3180 { DEBUG(D_tls) debug_printf("TLS: cipher list was preloaded\n"); }
3183 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
3187 && (rc = server_load_ciphers(ctx, &state_server, expciphers, errstr)) != OK)
3191 /* If this is a host for which certificate verification is mandatory or
3192 optional, set up appropriately. */
3194 tls_in.certificate_verified = FALSE;
3196 tls_in.dane_verified = FALSE;
3198 server_verify_callback_called = FALSE;
3200 if (verify_check_host(&tls_verify_hosts) == OK)
3201 server_verify_optional = FALSE;
3202 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3203 server_verify_optional = TRUE;
3209 if (!expand_check(tls_verify_certificates, US"tls_verify_certificates",
3212 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3214 if (state_server.lib_state.cabundle)
3215 { DEBUG(D_tls) debug_printf("TLS: CA bundle for server was preloaded\n"); }
3217 if ((rc = setup_certs(ctx, expcerts, tls_crl, NULL, errstr)) != OK)
3220 if (expcerts && *expcerts)
3221 setup_cert_verify(ctx, server_verify_optional, verify_callback_server);
3225 #ifndef DISABLE_TLS_RESUME
3226 SSL_CTX_set_tlsext_ticket_key_cb(ctx, ticket_key_callback);
3227 /* despite working, appears to always return failure, so ignoring */
3229 #ifdef OPENSSL_HAVE_NUM_TICKETS
3230 # ifndef DISABLE_TLS_RESUME
3231 SSL_CTX_set_num_tickets(ctx, tls_in.host_resumable ? 1 : 0);
3233 SSL_CTX_set_num_tickets(ctx, 0); /* send no TLS1.3 stateful-tickets */
3238 /* Prepare for new connection */
3240 if (!(ssl = SSL_new(ctx)))
3241 return tls_error(US"SSL_new", NULL, NULL, errstr);
3242 state_server.lib_state.lib_ssl = ssl;
3244 /* Warning: we used to SSL_clear(ssl) here, it was removed.
3246 * With the SSL_clear(), we get strange interoperability bugs with
3247 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
3248 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
3250 * The SSL_clear() call is to let an existing SSL* be reused, typically after
3251 * session shutdown. In this case, we have a brand new object and there's no
3252 * obvious reason to immediately clear it. I'm guessing that this was
3253 * originally added because of incomplete initialisation which the clear fixed,
3254 * in some historic release.
3257 /* Set context and tell client to go ahead, except in the case of TLS startup
3258 on connection, where outputting anything now upsets the clients and tends to
3259 make them disconnect. We need to have an explicit fflush() here, to force out
3260 the response. Other smtp_printf() calls do not need it, because in non-TLS
3261 mode, the fflush() happens when smtp_getc() is called. */
3263 SSL_set_session_id_context(ssl, sid_ctx, Ustrlen(sid_ctx));
3264 if (!tls_in.on_connect)
3266 smtp_printf("220 TLS go ahead\r\n", FALSE);
3270 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3271 that the OpenSSL library doesn't. */
3273 SSL_set_wfd(ssl, fileno(smtp_out));
3274 SSL_set_rfd(ssl, fileno(smtp_in));
3275 SSL_set_accept_state(ssl);
3277 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
3280 sigalrm_seen = FALSE;
3281 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3282 rc = SSL_accept(ssl);
3287 int error = SSL_get_error(ssl, rc);
3290 case SSL_ERROR_NONE:
3293 case SSL_ERROR_ZERO_RETURN:
3294 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3295 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3297 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
3300 tls_close(NULL, TLS_NO_SHUTDOWN);
3303 /* Handle genuine errors */
3306 uschar * s = US"SSL_accept";
3307 int r = ERR_GET_REASON(ERR_peek_error());
3308 if ( r == SSL_R_WRONG_VERSION_NUMBER
3309 #ifdef SSL_R_VERSION_TOO_LOW
3310 || r == SSL_R_VERSION_TOO_LOW
3312 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
3313 s = string_sprintf("%s (%s)", s, SSL_get_version(ssl));
3314 (void) tls_error(s, NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
3319 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3320 if (error == SSL_ERROR_SYSCALL)
3324 *errstr = US"SSL_accept: TCP connection closed by peer";
3327 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
3329 (void) tls_error(US"SSL_accept", NULL,
3330 sigalrm_seen ? US"timed out"
3331 : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
3337 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
3338 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
3339 anon-authentication ciphersuite negotiated. */
3341 #ifndef DISABLE_TLS_RESUME
3342 if (SSL_session_reused(ssl))
3344 tls_in.resumption |= RESUME_USED;
3345 DEBUG(D_tls) debug_printf("Session reused\n");
3349 /* TLS has been set up. Record data for the connection,
3350 adjust the input functions to read via TLS, and initialize things. */
3352 #ifdef SSL_get_extms_support
3353 tls_in.ext_master_secret = SSL_get_extms_support(ssl) == 1;
3355 peer_cert(ssl, &tls_in, peerdn, sizeof(peerdn));
3357 tls_in.ver = tlsver_name(ssl);
3358 tls_in.cipher = construct_cipher_name(ssl, tls_in.ver, &tls_in.bits);
3359 tls_in.cipher_stdname = cipher_stdname_ssl(ssl);
3364 if (SSL_get_shared_ciphers(ssl, CS buf, sizeof(buf)))
3365 debug_printf("Shared ciphers: %s\n", buf);
3367 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3369 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
3370 SSL_SESSION_print_keylog(bp, SSL_get_session(ssl));
3375 #ifdef EXIM_HAVE_SESSION_TICKET
3377 SSL_SESSION * ss = SSL_get_session(ssl);
3378 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
3379 debug_printf("The session has a ticket, life %lu seconds\n",
3380 SSL_SESSION_get_ticket_lifetime_hint(ss));
3385 /* Record the certificate we presented */
3387 X509 * crt = SSL_get_certificate(ssl);
3388 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
3391 /* Channel-binding info for authenticators
3392 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/ */
3395 size_t len = SSL_get_peer_finished(ssl, &c, 0);
3396 int old_pool = store_pool;
3398 SSL_get_peer_finished(ssl, s = store_get((int)len, FALSE), len);
3399 store_pool = POOL_PERM;
3400 tls_in.channelbinding = b64encode_taint(CUS s, (int)len, FALSE);
3401 store_pool = old_pool;
3402 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p\n", tls_in.channelbinding);
3405 /* Only used by the server-side tls (tls_in), including tls_getc.
3406 Client-side (tls_out) reads (seem to?) go via
3407 smtp_read_response()/ip_recv().
3408 Hence no need to duplicate for _in and _out.
3410 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3411 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
3412 ssl_xfer_eof = ssl_xfer_error = FALSE;
3414 receive_getc = tls_getc;
3415 receive_getbuf = tls_getbuf;
3416 receive_get_cache = tls_get_cache;
3417 receive_ungetc = tls_ungetc;
3418 receive_feof = tls_feof;
3419 receive_ferror = tls_ferror;
3420 receive_smtp_buffered = tls_smtp_buffered;
3422 tls_in.active.sock = fileno(smtp_out);
3423 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
3431 tls_client_basic_ctx_init(SSL_CTX * ctx,
3432 host_item * host, smtp_transport_options_block * ob, exim_openssl_state_st * state,
3437 /* Back-compatible old behaviour if tls_verify_certificates is set but both
3438 tls_verify_hosts and tls_try_verify_hosts are not set. Check only the specified
3439 host patterns if one of them is set with content. */
3441 if ( ( ( !ob->tls_verify_hosts || !ob->tls_verify_hosts
3442 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3444 && ( !ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts
3445 || Ustrcmp(ob->tls_try_verify_hosts, ":") == 0
3448 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3450 client_verify_optional = FALSE;
3451 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3452 client_verify_optional = TRUE;
3458 if (!expand_check(ob->tls_verify_certificates, US"tls_verify_certificates",
3461 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
3463 if (state->lib_state.cabundle)
3464 { DEBUG(D_tls) debug_printf("TLS: CA bundle was preloaded\n"); }
3466 if ((rc = setup_certs(ctx, expcerts, ob->tls_crl, host, errstr)) != OK)
3469 if (expcerts && *expcerts)
3470 setup_cert_verify(ctx, client_verify_optional, verify_callback_client);
3473 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3475 state->verify_cert_hostnames =
3477 string_domain_utf8_to_alabel(host->certname, NULL);
3481 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
3482 state->verify_cert_hostnames);
3490 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
3493 const char * hostnames[2] = { CS host->name, NULL };
3496 if (DANESSL_init(ssl, NULL, hostnames) != 1)
3497 return tls_error(US"hostnames load", host, NULL, errstr);
3499 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3500 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3501 ) if (rr->type == T_TLSA && rr->size > 3)
3503 const uschar * p = rr->data;
3504 uint8_t usage, selector, mtype;
3505 const char * mdname;
3509 /* Only DANE-TA(2) and DANE-EE(3) are supported */
3510 if (usage != 2 && usage != 3) continue;
3517 default: continue; /* Only match-types 0, 1, 2 are supported */
3518 case 0: mdname = NULL; break;
3519 case 1: mdname = "sha256"; break;
3520 case 2: mdname = "sha512"; break;
3524 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
3527 return tls_error(US"tlsa load", host, NULL, errstr);
3528 case 0: /* action not taken */
3532 tls_out.tlsa_usage |= 1<<usage;
3538 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
3541 #endif /*SUPPORT_DANE*/
3545 #ifndef DISABLE_TLS_RESUME
3546 /* On the client, get any stashed session for the given IP from hints db
3547 and apply it to the ssl-connection for attempted resumption. */
3550 tls_retrieve_session(tls_support * tlsp, SSL * ssl, const uschar * key)
3552 tlsp->resumption |= RESUME_SUPPORTED;
3553 if (tlsp->host_resumable)
3555 dbdata_tls_session * dt;
3557 open_db dbblock, * dbm_file;
3559 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3560 DEBUG(D_tls) debug_printf("checking for resumable session for %s\n", key);
3561 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3563 /* key for the db is the IP */
3564 if ((dt = dbfn_read_with_length(dbm_file, key, &len)))
3566 SSL_SESSION * ss = NULL;
3567 const uschar * sess_asn1 = dt->session;
3569 len -= sizeof(dbdata_tls_session);
3570 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3574 ERR_error_string_n(ERR_get_error(),
3575 ssl_errstring, sizeof(ssl_errstring));
3576 debug_printf("decoding session: %s\n", ssl_errstring);
3579 #ifdef EXIM_HAVE_SESSION_TICKET
3580 else if ( SSL_SESSION_get_ticket_lifetime_hint(ss) + dt->time_stamp
3583 DEBUG(D_tls) debug_printf("session expired\n");
3584 dbfn_delete(dbm_file, key);
3587 else if (!SSL_set_session(ssl, ss))
3591 ERR_error_string_n(ERR_get_error(),
3592 ssl_errstring, sizeof(ssl_errstring));
3593 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3598 DEBUG(D_tls) debug_printf("good session\n");
3599 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3600 tlsp->verify_override = dt->verify_override;
3601 tlsp->ocsp = dt->ocsp;
3605 DEBUG(D_tls) debug_printf("no session record\n");
3606 dbfn_close(dbm_file);
3612 /* On the client, save the session for later resumption */
3615 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3617 exim_openssl_state_st * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3620 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3622 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3624 # ifdef OPENSSL_HAVE_NUM_TICKETS
3625 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3628 int len = i2d_SSL_SESSION(ss, NULL);
3629 int dlen = sizeof(dbdata_tls_session) + len;
3630 dbdata_tls_session * dt = store_get(dlen, TRUE);
3631 uschar * s = dt->session;
3632 open_db dbblock, * dbm_file;
3634 DEBUG(D_tls) debug_printf("session is resumable\n");
3635 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3637 dt->verify_override = tlsp->verify_override;
3638 dt->ocsp = tlsp->ocsp;
3639 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3641 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3643 const uschar * key = cbinfo->host->address;
3644 dbfn_delete(dbm_file, key);
3645 dbfn_write(dbm_file, key, dt, dlen);
3646 dbfn_close(dbm_file);
3647 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3656 tls_client_ctx_resume_prehandshake(
3657 exim_openssl_client_tls_ctx * exim_client_ctx, tls_support * tlsp,
3658 smtp_transport_options_block * ob, host_item * host)
3660 /* Should the client request a session resumption ticket? */
3661 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3663 tlsp->host_resumable = TRUE;
3665 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3666 SSL_SESS_CACHE_CLIENT
3667 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3668 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3673 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3674 host_item * host, uschar ** errstr)
3676 if (tlsp->host_resumable)
3679 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3680 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3682 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3683 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_state))
3685 tls_error(US"set ex_data", host, NULL, errstr);
3688 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_state);
3691 tlsp->resumption = RESUME_SUPPORTED;
3692 /* Pick up a previous session, saved on an old ticket */
3693 tls_retrieve_session(tlsp, ssl, host->address);
3698 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
3701 if (SSL_session_reused(exim_client_ctx->ssl))
3703 DEBUG(D_tls) debug_printf("The session was reused\n");
3704 tlsp->resumption |= RESUME_USED;
3707 #endif /* !DISABLE_TLS_RESUME */
3710 /*************************************************
3711 * Start a TLS session in a client *
3712 *************************************************/
3714 /* Called from the smtp transport after STARTTLS has been accepted.
3717 cctx connection context
3718 conn_args connection details
3719 cookie datum for randomness; can be NULL
3720 tlsp record details of TLS channel configuration here; must be non-NULL
3721 errstr error string pointer
3723 Returns: TRUE for success with TLS session context set in connection context,
3728 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3729 void * cookie, tls_support * tlsp, uschar ** errstr)
3731 host_item * host = conn_args->host; /* for msgs and option-tests */
3732 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3733 smtp_transport_options_block * ob = tb
3734 ? (smtp_transport_options_block *)tb->options_block
3735 : &smtp_transport_option_defaults;
3736 exim_openssl_client_tls_ctx * exim_client_ctx;
3737 uschar * expciphers;
3739 static uschar peerdn[256];
3741 #ifndef DISABLE_OCSP
3742 BOOL request_ocsp = FALSE;
3743 BOOL require_ocsp = FALSE;
3747 store_pool = POOL_PERM;
3748 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), FALSE);
3749 exim_client_ctx->corked = NULL;
3753 tlsp->tlsa_usage = 0;
3756 #ifndef DISABLE_OCSP
3758 # ifdef SUPPORT_DANE
3759 /*XXX this should be moved to caller, to be common across gnutls/openssl */
3760 if ( conn_args->dane
3761 && ob->hosts_request_ocsp[0] == '*'
3762 && ob->hosts_request_ocsp[1] == '\0'
3765 /* Unchanged from default. Use a safer one under DANE */
3766 request_ocsp = TRUE;
3767 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3768 " {= {4}{$tls_out_tlsa_usage}} } "
3774 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
3775 request_ocsp = TRUE;
3777 # ifdef SUPPORT_DANE
3781 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3785 rc = tls_init(host, ob,
3786 #ifndef DISABLE_OCSP
3787 (void *)(long)request_ocsp,
3789 cookie, &client_static_state, tlsp, errstr);
3790 if (rc != OK) return FALSE;
3792 exim_client_ctx->ctx = client_static_state->lib_state.lib_ctx;
3794 tlsp->certificate_verified = FALSE;
3795 client_verify_callback_called = FALSE;
3799 if (conn_args->dane)
3801 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3802 other failures should be treated as problems. */
3803 if (ob->dane_require_tls_ciphers &&
3804 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3805 &expciphers, errstr))
3807 if (expciphers && *expciphers == '\0')
3812 !expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
3813 &expciphers, errstr))
3816 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3817 are separated by underscores. So that I can use either form in my tests, and
3818 also for general convenience, we turn underscores into hyphens here. */
3822 uschar *s = expciphers;
3823 while (*s) { if (*s == '_') *s = '-'; s++; }
3824 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
3825 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
3827 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
3833 if (conn_args->dane)
3835 SSL_CTX_set_verify(exim_client_ctx->ctx,
3836 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
3837 verify_callback_client_dane);
3839 if (!DANESSL_library_init())
3841 tls_error(US"library init", host, NULL, errstr);
3844 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
3846 tls_error(US"context init", host, NULL, errstr);
3854 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
3855 client_static_state, errstr) != OK)
3858 #ifndef DISABLE_TLS_RESUME
3859 tls_client_ctx_resume_prehandshake(exim_client_ctx, tlsp, ob, host);
3863 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
3865 tls_error(US"SSL_new", host, NULL, errstr);
3868 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
3870 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
3871 SSL_set_connect_state(exim_client_ctx->ssl);
3875 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
3879 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
3881 else if (!Ustrlen(tlsp->sni))
3885 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
3886 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
3887 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
3889 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
3896 if (conn_args->dane)
3897 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
3901 #ifndef DISABLE_OCSP
3902 /* Request certificate status at connection-time. If the server
3903 does OCSP stapling we will get the callback (set in tls_init()) */
3904 # ifdef SUPPORT_DANE
3908 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3909 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3911 { /* Re-eval now $tls_out_tlsa_usage is populated. If
3912 this means we avoid the OCSP request, we wasted the setup
3913 cost in tls_init(). */
3914 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3915 request_ocsp = require_ocsp
3916 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3923 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
3924 client_static_state->u_ocsp.client.verify_required = require_ocsp;
3925 tlsp->ocsp = OCSP_NOT_RESP;
3929 #ifndef DISABLE_TLS_RESUME
3930 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
3935 #ifndef DISABLE_EVENT
3936 client_static_state->event_action = tb ? tb->event_action : NULL;
3939 /* There doesn't seem to be a built-in timeout on connection. */
3941 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
3942 sigalrm_seen = FALSE;
3943 ALARM(ob->command_timeout);
3944 rc = SSL_connect(exim_client_ctx->ssl);
3948 if (conn_args->dane)
3949 DANESSL_cleanup(exim_client_ctx->ssl);
3954 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
3960 debug_printf("SSL_connect succeeded\n");
3961 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3963 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
3964 SSL_SESSION_print_keylog(bp, SSL_get_session(exim_client_ctx->ssl));
3970 #ifndef DISABLE_TLS_RESUME
3971 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
3974 #ifdef SSL_get_extms_support
3975 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
3977 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
3979 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
3980 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
3981 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
3983 /* Record the certificate we presented */
3985 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
3986 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
3989 /*XXX will this work with continued-TLS? */
3990 /* Channel-binding info for authenticators */
3993 size_t len = SSL_get_finished(exim_client_ctx->ssl, &c, 0);
3994 int old_pool = store_pool;
3996 SSL_get_finished(exim_client_ctx->ssl, s = store_get((int)len, TRUE), len);
3997 store_pool = POOL_PERM;
3998 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, TRUE);
3999 store_pool = old_pool;
4000 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
4003 tlsp->active.sock = cctx->sock;
4004 tlsp->active.tls_ctx = exim_client_ctx;
4005 cctx->tls_ctx = exim_client_ctx;
4014 tls_refill(unsigned lim)
4016 SSL * ssl = state_server.lib_state.lib_ssl;
4020 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4021 ssl_xfer_buffer, ssl_xfer_buffer_size);
4024 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4025 inbytes = SSL_read(ssl, CS ssl_xfer_buffer,
4026 MIN(ssl_xfer_buffer_size, lim));
4027 error = SSL_get_error(ssl, inbytes);
4028 if (smtp_receive_timeout > 0) ALARM_CLR(0);
4030 if (had_command_timeout) /* set by signal handler */
4031 smtp_command_timeout_exit(); /* does not return */
4032 if (had_command_sigterm)
4033 smtp_command_sigterm_exit();
4034 if (had_data_timeout)
4035 smtp_data_timeout_exit();
4036 if (had_data_sigint)
4037 smtp_data_sigint_exit();
4039 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
4040 closed down, not that the socket itself has been closed down. Revert to
4041 non-SSL handling. */
4045 case SSL_ERROR_NONE:
4048 case SSL_ERROR_ZERO_RETURN:
4049 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4051 if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
4054 tls_close(NULL, TLS_NO_SHUTDOWN);
4057 /* Handle genuine errors */
4059 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4060 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
4061 ssl_xfer_error = TRUE;
4065 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
4066 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
4067 debug_printf(" - syscall %s\n", strerror(errno));
4068 ssl_xfer_error = TRUE;
4072 #ifndef DISABLE_DKIM
4073 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
4075 ssl_xfer_buffer_hwm = inbytes;
4076 ssl_xfer_buffer_lwm = 0;
4081 /*************************************************
4082 * TLS version of getc *
4083 *************************************************/
4085 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
4086 it refills the buffer via the SSL reading function.
4088 Arguments: lim Maximum amount to read/buffer
4089 Returns: the next character or EOF
4091 Only used by the server-side TLS.
4095 tls_getc(unsigned lim)
4097 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4098 if (!tls_refill(lim))
4099 return ssl_xfer_error ? EOF : smtp_getc(lim);
4101 /* Something in the buffer; return next uschar */
4103 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
4107 tls_getbuf(unsigned * len)
4112 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
4113 if (!tls_refill(*len))
4115 if (!ssl_xfer_error) return smtp_getbuf(len);
4120 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
4122 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
4123 ssl_xfer_buffer_lwm += size;
4132 #ifndef DISABLE_DKIM
4133 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
4135 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
4141 tls_could_read(void)
4143 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm
4144 || SSL_pending(state_server.lib_state.lib_ssl) > 0;
4148 /*************************************************
4149 * Read bytes from TLS channel *
4150 *************************************************/
4154 ct_ctx client context pointer, or NULL for the one global server context
4158 Returns: the number of bytes read
4159 -1 after a failed read, including EOF
4161 Only used by the client-side TLS.
4165 tls_read(void * ct_ctx, uschar *buff, size_t len)
4167 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4168 : state_server.lib_state.lib_ssl;
4172 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
4173 buff, (unsigned int)len);
4176 inbytes = SSL_read(ssl, CS buff, len);
4177 error = SSL_get_error(ssl, inbytes);
4179 if (error == SSL_ERROR_ZERO_RETURN)
4181 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
4184 else if (error != SSL_ERROR_NONE)
4194 /*************************************************
4195 * Write bytes down TLS channel *
4196 *************************************************/
4200 ct_ctx client context pointer, or NULL for the one global server context
4203 more further data expected soon
4205 Returns: the number of bytes after a successful write,
4206 -1 after a failed write
4208 Used by both server-side and client-side TLS. Calling with len zero and more unset
4209 will flush buffered writes; buff can be null for this case.
4213 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4216 int outbytes, error;
4218 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl
4219 : state_server.lib_state.lib_ssl;
4220 static gstring * server_corked = NULL;
4221 gstring ** corkedp = ct_ctx
4222 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
4223 gstring * corked = *corkedp;
4225 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
4226 buff, (unsigned long)len, more ? ", more" : "");
4228 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
4229 "more" is notified. This hack is only ok if small amounts are involved AND only
4230 one stream does it, in one context (i.e. no store reset). Currently it is used
4231 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
4232 We support callouts done by the server process by using a separate client
4233 context for the stashed information. */
4234 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
4235 a store reset there, so use POOL_PERM. */
4236 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
4240 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
4242 #ifndef DISABLE_PIPE_CONNECT
4243 int save_pool = store_pool;
4244 store_pool = POOL_PERM;
4247 corked = string_catn(corked, buff, len);
4249 #ifndef DISABLE_PIPE_CONNECT
4250 store_pool = save_pool;
4258 buff = CUS corked->s;
4263 for (int left = len; left > 0;)
4265 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
4267 outbytes = SSL_write(ssl, CS buff, left);
4268 error = SSL_get_error(ssl, outbytes);
4269 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
4272 case SSL_ERROR_NONE: /* the usual case */
4278 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4279 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
4282 case SSL_ERROR_ZERO_RETURN:
4283 log_write(0, LOG_MAIN, "SSL channel closed on write");
4286 case SSL_ERROR_SYSCALL:
4287 if (ct_ctx || errno != ECONNRESET || !f.smtp_in_quit)
4288 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
4289 sender_fullhost ? sender_fullhost : US"<unknown>",
4291 else if (LOGGING(protocol_detail))
4292 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4293 " SMTP response and TLS close\n", sender_host_address);
4295 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4296 " client reset TCP before TLS close\n", sender_host_address);
4300 log_write(0, LOG_MAIN, "SSL_write error %d", error);
4309 /*************************************************
4310 * Close down a TLS session *
4311 *************************************************/
4313 /* This is also called from within a delivery subprocess forked from the
4314 daemon, to shut down the TLS library, without actually doing a shutdown (which
4315 would tamper with the SSL session in the parent process).
4318 ct_ctx client TLS context pointer, or NULL for the one global server context
4319 shutdown 1 if TLS close-alert is to be sent,
4320 2 if also response to be waited for
4324 Used by both server-side and client-side TLS.
4328 tls_close(void * ct_ctx, int shutdown)
4330 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
4331 SSL **sslp = o_ctx ? &o_ctx->ssl : (SSL **) &state_server.lib_state.lib_ssl;
4332 int *fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
4334 if (*fdp < 0) return; /* TLS was not active */
4339 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
4340 shutdown > 1 ? " (with response-wait)" : "");
4342 if ( (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
4346 rc = SSL_shutdown(*sslp); /* wait for response */
4350 if (rc < 0) DEBUG(D_tls)
4352 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4353 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
4357 if (!o_ctx) /* server side */
4359 #ifndef DISABLE_OCSP
4360 sk_X509_pop_free(state_server.verify_stack, X509_free);
4361 state_server.verify_stack = NULL;
4364 receive_getc = smtp_getc;
4365 receive_getbuf = smtp_getbuf;
4366 receive_get_cache = smtp_get_cache;
4367 receive_ungetc = smtp_ungetc;
4368 receive_feof = smtp_feof;
4369 receive_ferror = smtp_ferror;
4370 receive_smtp_buffered = smtp_buffered;
4371 tls_in.active.tls_ctx = NULL;
4373 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
4384 /*************************************************
4385 * Let tls_require_ciphers be checked at startup *
4386 *************************************************/
4388 /* The tls_require_ciphers option, if set, must be something which the
4391 Returns: NULL on success, or error message
4395 tls_validate_require_cipher(void)
4398 uschar *s, *expciphers, *err;
4402 if (!(tls_require_ciphers && *tls_require_ciphers))
4405 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4407 return US"failed to expand tls_require_ciphers";
4409 if (!(expciphers && *expciphers))
4412 /* normalisation ripped from above */
4414 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
4418 if (lib_ctx_new(&ctx, NULL, &err) == OK)
4421 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4423 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
4425 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
4426 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
4427 expciphers, ssl_errstring);
4438 /*************************************************
4439 * Report the library versions. *
4440 *************************************************/
4442 /* There have historically been some issues with binary compatibility in
4443 OpenSSL libraries; if Exim (like many other applications) is built against
4444 one version of OpenSSL but the run-time linker picks up another version,
4445 it can result in serious failures, including crashing with a SIGSEGV. So
4446 report the version found by the compiler and the run-time version.
4448 Note: some OS vendors backport security fixes without changing the version
4449 number/string, and the version date remains unchanged. The _build_ date
4450 will change, so we can more usefully assist with version diagnosis by also
4451 reporting the build date.
4453 Arguments: a FILE* to print the results to
4458 tls_version_report(FILE *f)
4460 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
4463 OPENSSL_VERSION_TEXT,
4464 SSLeay_version(SSLEAY_VERSION),
4465 SSLeay_version(SSLEAY_BUILT_ON));
4466 /* third line is 38 characters for the %s and the line is 73 chars long;
4467 the OpenSSL output includes a "built on: " prefix already. */
4473 /*************************************************
4474 * Random number generation *
4475 *************************************************/
4477 /* Pseudo-random number generation. The result is not expected to be
4478 cryptographically strong but not so weak that someone will shoot themselves
4479 in the foot using it as a nonce in input in some email header scheme or
4480 whatever weirdness they'll twist this into. The result should handle fork()
4481 and avoid repeating sequences. OpenSSL handles that for us.
4485 Returns a random number in range [0, max-1]
4489 vaguely_random_number(int max)
4493 static pid_t pidlast = 0;
4495 uschar smallbuf[sizeof(r)];
4501 if (pidnow != pidlast)
4503 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
4504 is unique for each thread", this doesn't apparently apply across processes,
4505 so our own warning from vaguely_random_number_fallback() applies here too.
4506 Fix per PostgreSQL. */
4512 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
4516 gettimeofday(&r.tv, NULL);
4519 RAND_seed(US (&r), sizeof(r));
4521 /* We're after pseudo-random, not random; if we still don't have enough data
4522 in the internal PRNG then our options are limited. We could sleep and hope
4523 for entropy to come along (prayer technique) but if the system is so depleted
4524 in the first place then something is likely to just keep taking it. Instead,
4525 we'll just take whatever little bit of pseudo-random we can still manage to
4528 needed_len = sizeof(r);
4529 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4530 asked for a number less than 10. */
4531 for (r = max, i = 0; r; ++i)
4537 #ifdef EXIM_HAVE_RAND_PSEUDO
4538 /* We do not care if crypto-strong */
4539 i = RAND_pseudo_bytes(smallbuf, needed_len);
4541 i = RAND_bytes(smallbuf, needed_len);
4547 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
4548 return vaguely_random_number_fallback(max);
4552 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4555 /* We don't particularly care about weighted results; if someone wants
4556 smooth distribution and cares enough then they should submit a patch then. */
4563 /*************************************************
4564 * OpenSSL option parse *
4565 *************************************************/
4567 /* Parse one option for tls_openssl_options_parse below
4570 name one option name
4571 value place to store a value for it
4572 Returns success or failure in parsing
4578 tls_openssl_one_option_parse(uschar *name, long *value)
4581 int last = exim_openssl_options_size;
4582 while (last > first)
4584 int middle = (first + last)/2;
4585 int c = Ustrcmp(name, exim_openssl_options[middle].name);
4588 *value = exim_openssl_options[middle].value;
4602 /*************************************************
4603 * OpenSSL option parsing logic *
4604 *************************************************/
4606 /* OpenSSL has a number of compatibility options which an administrator might
4607 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
4608 we look like log_selector.
4611 option_spec the administrator-supplied string of options
4612 results ptr to long storage for the options bitmap
4613 Returns success or failure
4617 tls_openssl_options_parse(uschar *option_spec, long *results)
4620 uschar * exp, * end;
4622 BOOL adding, item_parsed;
4624 /* Server: send no (<= TLS1.2) session tickets */
4625 result = SSL_OP_NO_TICKET;
4627 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
4628 from default because it increases BEAST susceptibility. */
4629 #ifdef SSL_OP_NO_SSLv2
4630 result |= SSL_OP_NO_SSLv2;
4632 #ifdef SSL_OP_NO_SSLv3
4633 result |= SSL_OP_NO_SSLv3;
4635 #ifdef SSL_OP_SINGLE_DH_USE
4636 result |= SSL_OP_SINGLE_DH_USE;
4638 #ifdef SSL_OP_NO_RENEGOTIATION
4639 result |= SSL_OP_NO_RENEGOTIATION;
4648 if (!expand_check(option_spec, US"openssl_options", &exp, &end))
4651 for (uschar * s = exp; *s; /**/)
4653 while (isspace(*s)) ++s;
4656 if (*s != '+' && *s != '-')
4658 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
4659 "+ or - expected but found \"%s\"\n", s);
4662 adding = *s++ == '+';
4663 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
4666 item_parsed = tls_openssl_one_option_parse(s, &item);
4670 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
4673 DEBUG(D_tls) debug_printf("openssl option, %s %08lx: %08lx (%s)\n",
4674 adding ? "adding to " : "removing from", result, item, s);
4686 #endif /*!MACRO_PREDEF*/
4689 /* End of tls-openssl.c */