1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2019 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Portions Copyright (c) The OpenSSL Project 1999 */
10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11 library. It is #included into the tls.c file when that library is used. The
12 code herein is based on a patch that was originally contributed by Steve
13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
15 No cryptographic code is included in Exim. All this module does is to call
16 functions from the OpenSSL library. */
21 #include <openssl/lhash.h>
22 #include <openssl/ssl.h>
23 #include <openssl/err.h>
24 #include <openssl/rand.h>
25 #ifndef OPENSSL_NO_ECDH
26 # include <openssl/ec.h>
29 # include <openssl/ocsp.h>
37 # define EXIM_OCSP_SKEW_SECONDS (300L)
38 # define EXIM_OCSP_MAX_AGE (-1L)
41 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
42 # define EXIM_HAVE_OPENSSL_TLSEXT
44 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
45 # define EXIM_HAVE_RSA_GENKEY_EX
47 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
48 # define EXIM_HAVE_OCSP_RESP_COUNT
49 # define OPENSSL_AUTO_SHA256
51 # define EXIM_HAVE_EPHEM_RSA_KEX
52 # define EXIM_HAVE_RAND_PSEUDO
54 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
55 # define EXIM_HAVE_SHA256
58 /* X509_check_host provides sane certificate hostname checking, but was added
59 to OpenSSL late, after other projects forked off the code-base. So in
60 addition to guarding against the base version number, beware that LibreSSL
61 does not (at this time) support this function.
63 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
64 opt to disentangle and ask a LibreSSL user to provide glue for a third
65 crypto provider for libtls instead of continuing to tie the OpenSSL glue
66 into even twistier knots. If LibreSSL gains the same API, we can just
67 change this guard and punt the issue for a while longer. */
69 #ifndef LIBRESSL_VERSION_NUMBER
70 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
71 # define EXIM_HAVE_OPENSSL_CHECKHOST
72 # define EXIM_HAVE_OPENSSL_DH_BITS
73 # define EXIM_HAVE_OPENSSL_TLS_METHOD
74 # define EXIM_HAVE_OPENSSL_KEYLOG
75 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
76 # define EXIM_HAVE_SESSION_TICKET
77 # define EXIM_HAVE_OPESSL_TRACE
78 # define EXIM_HAVE_OPESSL_GET0_SERIAL
80 # define EXIM_NEED_OPENSSL_INIT
82 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
83 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
84 # define EXIM_HAVE_OPENSSL_CHECKHOST
88 #if !defined(LIBRESSL_VERSION_NUMBER) \
89 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
90 # if !defined(OPENSSL_NO_ECDH)
91 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
92 # define EXIM_HAVE_ECDH
94 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
95 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
100 #ifndef LIBRESSL_VERSION_NUMBER
101 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
102 # define OPENSSL_HAVE_KEYLOG_CB
103 # define OPENSSL_HAVE_NUM_TICKETS
104 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
108 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
109 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
110 # define DISABLE_OCSP
113 #ifdef EXPERIMENTAL_TLS_RESUME
114 # if OPENSSL_VERSION_NUMBER < 0x0101010L
115 # error OpenSSL version too old for session-resumption
119 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
120 # include <openssl/x509v3.h>
123 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
124 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
125 # define SSL_CIPHER_get_id(c) (c->id)
127 # ifndef MACRO_PREDEF
128 # include "tls-cipher-stdname.c"
132 /*************************************************
133 * OpenSSL option parse *
134 *************************************************/
136 typedef struct exim_openssl_option {
139 } exim_openssl_option;
140 /* We could use a macro to expand, but we need the ifdef and not all the
141 options document which version they were introduced in. Policylet: include
142 all options unless explicitly for DTLS, let the administrator choose which
145 This list is current as of:
147 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
148 Plus SSL_OP_NO_TLSv1_3 for 1.1.2-dev
150 static exim_openssl_option exim_openssl_options[] = {
151 /* KEEP SORTED ALPHABETICALLY! */
153 { US"all", (long) SSL_OP_ALL },
155 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
156 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
158 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
159 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
161 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
162 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
164 #ifdef SSL_OP_EPHEMERAL_RSA
165 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
167 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
168 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
170 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
171 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
173 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
174 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
176 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
177 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
179 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
180 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
182 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
183 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
185 #ifdef SSL_OP_NO_COMPRESSION
186 { US"no_compression", SSL_OP_NO_COMPRESSION },
188 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
189 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
191 #ifdef SSL_OP_NO_SSLv2
192 { US"no_sslv2", SSL_OP_NO_SSLv2 },
194 #ifdef SSL_OP_NO_SSLv3
195 { US"no_sslv3", SSL_OP_NO_SSLv3 },
197 #ifdef SSL_OP_NO_TICKET
198 { US"no_ticket", SSL_OP_NO_TICKET },
200 #ifdef SSL_OP_NO_TLSv1
201 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
203 #ifdef SSL_OP_NO_TLSv1_1
204 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
205 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
206 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
208 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
211 #ifdef SSL_OP_NO_TLSv1_2
212 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
214 #ifdef SSL_OP_NO_TLSv1_3
215 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
217 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
218 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
220 #ifdef SSL_OP_SINGLE_DH_USE
221 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
223 #ifdef SSL_OP_SINGLE_ECDH_USE
224 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
226 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
227 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
229 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
230 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
232 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
233 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
235 #ifdef SSL_OP_TLS_D5_BUG
236 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
238 #ifdef SSL_OP_TLS_ROLLBACK_BUG
239 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
244 static int exim_openssl_options_size = nelem(exim_openssl_options);
253 for (struct exim_openssl_option * o = exim_openssl_options;
254 o < exim_openssl_options + nelem(exim_openssl_options); o++)
256 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
257 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
259 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
260 builtin_macro_create(buf);
263 # ifdef EXPERIMENTAL_TLS_RESUME
264 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
266 # ifdef SSL_OP_NO_TLSv1_3
267 builtin_macro_create(US"_HAVE_TLS1_3");
272 /******************************************************************************/
274 /* Structure for collecting random data for seeding. */
276 typedef struct randstuff {
281 /* Local static variables */
283 static BOOL client_verify_callback_called = FALSE;
284 static BOOL server_verify_callback_called = FALSE;
285 static const uschar *sid_ctx = US"exim";
287 /* We have three different contexts to care about.
289 Simple case: client, `client_ctx`
290 As a client, we can be doing a callout or cut-through delivery while receiving
291 a message. So we have a client context, which should have options initialised
292 from the SMTP Transport. We may also concurrently want to make TLS connections
293 to utility daemons, so client-contexts are allocated and passed around in call
294 args rather than using a gobal.
297 There are two cases: with and without ServerNameIndication from the client.
298 Given TLS SNI, we can be using different keys, certs and various other
299 configuration settings, because they're re-expanded with $tls_sni set. This
300 allows vhosting with TLS. This SNI is sent in the handshake.
301 A client might not send SNI, so we need a fallback, and an initial setup too.
302 So as a server, we start out using `server_ctx`.
303 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
304 `server_sni` from `server_ctx` and then initialise settings by re-expanding
312 } exim_openssl_client_tls_ctx;
314 static SSL_CTX *server_ctx = NULL;
315 static SSL *server_ssl = NULL;
317 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
318 static SSL_CTX *server_sni = NULL;
321 static char ssl_errstring[256];
323 static int ssl_session_timeout = 7200; /* Two hours */
324 static BOOL client_verify_optional = FALSE;
325 static BOOL server_verify_optional = FALSE;
327 static BOOL reexpand_tls_files_for_sni = FALSE;
330 typedef struct ocsp_resp {
331 struct ocsp_resp * next;
332 OCSP_RESPONSE * resp;
335 typedef struct tls_ext_ctx_cb {
341 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
345 const uschar *file_expanded;
346 ocsp_resplist *olist;
349 X509_STORE *verify_store; /* non-null if status requested */
350 BOOL verify_required;
355 /* these are cached from first expand */
356 uschar *server_cipher_list;
357 /* only passed down to tls_error: */
359 const uschar * verify_cert_hostnames;
360 #ifndef DISABLE_EVENT
361 uschar * event_action;
365 /* should figure out a cleanup of API to handle state preserved per
366 implementation, for various reasons, which can be void * in the APIs.
367 For now, we hack around it. */
368 tls_ext_ctx_cb *client_static_cbinfo = NULL; /*XXX should not use static; multiple concurrent clients! */
369 tls_ext_ctx_cb *server_static_cbinfo = NULL;
372 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
373 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr );
376 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
377 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
380 static int tls_server_stapling_cb(SSL *s, void *arg);
385 /* Daemon-called, before every connection, key create/rotate */
386 #ifdef EXPERIMENTAL_TLS_RESUME
387 static void tk_init(void);
388 static int tls_exdata_idx = -1;
392 tls_daemon_init(void)
394 #ifdef EXPERIMENTAL_TLS_RESUME
401 /*************************************************
403 *************************************************/
405 /* Called from lots of places when errors occur before actually starting to do
406 the TLS handshake, that is, while the session is still in clear. Always returns
407 DEFER for a server and FAIL for a client so that most calls can use "return
408 tls_error(...)" to do this processing and then give an appropriate return. A
409 single function is used for both server and client, because it is called from
410 some shared functions.
413 prefix text to include in the logged error
414 host NULL if setting up a server;
415 the connected host if setting up a client
416 msg error message or NULL if we should ask OpenSSL
417 errstr pointer to output error message
419 Returns: OK/DEFER/FAIL
423 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
427 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
428 msg = US ssl_errstring;
431 msg = string_sprintf("(%s): %s", prefix, msg);
432 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
433 if (errstr) *errstr = msg;
434 return host ? FAIL : DEFER;
439 /*************************************************
440 * Callback to generate RSA key *
441 *************************************************/
445 s SSL connection (not used)
449 Returns: pointer to generated key
453 rsa_callback(SSL *s, int export, int keylength)
456 #ifdef EXIM_HAVE_RSA_GENKEY_EX
457 BIGNUM *bn = BN_new();
460 export = export; /* Shut picky compilers up */
461 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
463 #ifdef EXIM_HAVE_RSA_GENKEY_EX
464 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
465 || !(rsa_key = RSA_new())
466 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
469 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
473 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
474 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
486 x509_store_dump_cert_s_names(X509_STORE * store)
488 STACK_OF(X509_OBJECT) * roots= store->objs;
489 static uschar name[256];
491 for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
493 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
494 if(tmp_obj->type == X509_LU_X509)
496 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
497 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
499 name[sizeof(name)-1] = '\0';
500 debug_printf(" %s\n", name);
509 #ifndef DISABLE_EVENT
511 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
512 BOOL *calledp, const BOOL *optionalp, const uschar * what)
518 ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
521 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
522 old_cert = tlsp->peercert;
523 tlsp->peercert = X509_dup(cert);
524 /* NB we do not bother setting peerdn */
525 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
527 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
528 "depth=%d cert=%s: %s",
529 tlsp == &tls_out ? deliver_host_address : sender_host_address,
530 what, depth, dn, yield);
534 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
535 return 1; /* reject (leaving peercert set) */
537 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
538 "(host in tls_try_verify_hosts)\n");
539 tlsp->verify_override = TRUE;
541 X509_free(tlsp->peercert);
542 tlsp->peercert = old_cert;
548 /*************************************************
549 * Callback for verification *
550 *************************************************/
552 /* The SSL library does certificate verification if set up to do so. This
553 callback has the current yes/no state is in "state". If verification succeeded,
554 we set the certificate-verified flag. If verification failed, what happens
555 depends on whether the client is required to present a verifiable certificate
558 If verification is optional, we change the state to yes, but still log the
559 verification error. For some reason (it really would help to have proper
560 documentation of OpenSSL), this callback function then gets called again, this
561 time with state = 1. We must take care not to set the private verified flag on
562 the second time through.
564 Note: this function is not called if the client fails to present a certificate
565 when asked. We get here only if a certificate has been received. Handling of
566 optional verification for this case is done when requesting SSL to verify, by
567 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
569 May be called multiple times for different issues with a certificate, even
570 for a given "depth" in the certificate chain.
573 preverify_ok current yes/no state as 1/0
574 x509ctx certificate information.
575 tlsp per-direction (client vs. server) support data
576 calledp has-been-called flag
577 optionalp verification-is-optional flag
579 Returns: 0 if verification should fail, otherwise 1
583 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
584 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
586 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
587 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
590 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
592 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
593 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
594 tlsp == &tls_out ? deliver_host_address : sender_host_address);
597 dn[sizeof(dn)-1] = '\0';
599 tlsp->verify_override = FALSE;
600 if (preverify_ok == 0)
602 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
603 *verify_mode, sender_host_address)
605 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
606 tlsp == &tls_out ? deliver_host_address : sender_host_address,
608 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
613 tlsp->peercert = X509_dup(cert); /* record failing cert */
614 return 0; /* reject */
616 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
617 "tls_try_verify_hosts)\n");
618 tlsp->verify_override = TRUE;
623 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
625 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
626 { /* client, wanting stapling */
627 /* Add the server cert's signing chain as the one
628 for the verification of the OCSP stapled information. */
630 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
633 sk_X509_push(client_static_cbinfo->verify_stack, cert);
636 #ifndef DISABLE_EVENT
637 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
638 return 0; /* reject, with peercert set */
643 const uschar * verify_cert_hostnames;
645 if ( tlsp == &tls_out
646 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
647 /* client, wanting hostname check */
650 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
651 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
652 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
654 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
655 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
658 const uschar * list = verify_cert_hostnames;
661 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
662 if ((rc = X509_check_host(cert, CCS name, 0,
663 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
664 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
669 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
670 tlsp == &tls_out ? deliver_host_address : sender_host_address);
677 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
680 uschar * extra = verify_mode
681 ? string_sprintf(" (during %c-verify for [%s])",
682 *verify_mode, sender_host_address)
684 log_write(0, LOG_MAIN,
685 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
686 tlsp == &tls_out ? deliver_host_address : sender_host_address,
687 extra, dn, verify_cert_hostnames);
692 tlsp->peercert = X509_dup(cert); /* record failing cert */
693 return 0; /* reject */
695 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
696 "tls_try_verify_hosts)\n");
697 tlsp->verify_override = TRUE;
701 #ifndef DISABLE_EVENT
702 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
703 return 0; /* reject, with peercert set */
706 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
707 *calledp ? "" : " authenticated", dn);
711 return 1; /* accept, at least for this level */
715 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
717 return verify_callback(preverify_ok, x509ctx, &tls_out,
718 &client_verify_callback_called, &client_verify_optional);
722 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
724 return verify_callback(preverify_ok, x509ctx, &tls_in,
725 &server_verify_callback_called, &server_verify_optional);
731 /* This gets called *by* the dane library verify callback, which interposes
735 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
737 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
739 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
740 #ifndef DISABLE_EVENT
741 BOOL dummy_called, optional = FALSE;
744 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
746 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
747 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
748 deliver_host_address);
751 dn[sizeof(dn)-1] = '\0';
753 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
754 preverify_ok ? "ok":"BAD", depth, dn);
756 #ifndef DISABLE_EVENT
757 if (verify_event(&tls_out, cert, depth, dn,
758 &dummy_called, &optional, US"DANE"))
759 return 0; /* reject, with peercert set */
762 if (preverify_ok == 1)
764 tls_out.dane_verified = TRUE;
766 if (client_static_cbinfo->u_ocsp.client.verify_store)
767 { /* client, wanting stapling */
768 /* Add the server cert's signing chain as the one
769 for the verification of the OCSP stapled information. */
771 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
774 sk_X509_push(client_static_cbinfo->verify_stack, cert);
780 int err = X509_STORE_CTX_get_error(x509ctx);
782 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
783 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
789 #endif /*SUPPORT_DANE*/
792 /*************************************************
793 * Information callback *
794 *************************************************/
796 /* The SSL library functions call this from time to time to indicate what they
797 are doing. We copy the string to the debugging output when TLS debugging has
809 info_callback(SSL *s, int where, int ret)
815 if (where & SSL_ST_CONNECT)
816 str = US"SSL_connect";
817 else if (where & SSL_ST_ACCEPT)
818 str = US"SSL_accept";
820 str = US"SSL info (undefined)";
822 if (where & SSL_CB_LOOP)
823 debug_printf("%s: %s\n", str, SSL_state_string_long(s));
824 else if (where & SSL_CB_ALERT)
825 debug_printf("SSL3 alert %s:%s:%s\n",
826 str = where & SSL_CB_READ ? US"read" : US"write",
827 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
828 else if (where & SSL_CB_EXIT)
830 debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
832 debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
833 else if (where & SSL_CB_HANDSHAKE_START)
834 debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
835 else if (where & SSL_CB_HANDSHAKE_DONE)
836 debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s));
840 #ifdef OPENSSL_HAVE_KEYLOG_CB
842 keylog_callback(const SSL *ssl, const char *line)
844 DEBUG(D_tls) debug_printf("%.200s\n", line);
849 #ifdef EXPERIMENTAL_TLS_RESUME
850 /* Manage the keysets used for encrypting the session tickets, on the server. */
852 typedef struct { /* Session ticket encryption key */
855 const EVP_CIPHER * aes_cipher;
856 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
857 const EVP_MD * hmac_hash;
863 static exim_stek exim_tk; /* current key */
864 static exim_stek exim_tk_old; /* previous key */
869 time_t t = time(NULL);
873 if (exim_tk.renew >= t) return;
874 exim_tk_old = exim_tk;
877 if (f.running_in_test_harness) ssl_session_timeout = 6;
879 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
880 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
881 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
882 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
884 exim_tk.name[0] = 'E';
885 exim_tk.aes_cipher = EVP_aes_256_cbc();
886 exim_tk.hmac_hash = EVP_sha256();
887 exim_tk.expire = t + ssl_session_timeout;
888 exim_tk.renew = t + ssl_session_timeout/2;
894 if (!exim_tk.name[0]) return NULL;
899 tk_find(const uschar * name)
901 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
902 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
906 /* Callback for session tickets, on server */
908 ticket_key_callback(SSL * ssl, uschar key_name[16],
909 uschar * iv, EVP_CIPHER_CTX * ctx, HMAC_CTX * hctx, int enc)
911 tls_support * tlsp = server_static_cbinfo->tlsp;
916 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
917 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
919 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
920 return -1; /* insufficient random */
922 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
923 return 0; /* key couldn't be created */
924 memcpy(key_name, key->name, 16);
925 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
927 /*XXX will want these dependent on the ssl session strength */
928 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
929 key->hmac_hash, NULL);
930 EVP_EncryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv);
932 DEBUG(D_tls) debug_printf("ticket created\n");
937 time_t now = time(NULL);
939 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
940 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
942 if (!(key = tk_find(key_name)) || key->expire < now)
946 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
947 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
952 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
953 key->hmac_hash, NULL);
954 EVP_DecryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv);
956 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
958 /* The ticket lifetime and renewal are the same as the STEK lifetime and
959 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
960 be better. To do that we'd have to encode ticket lifetime in the name as
961 we don't yet see the restored session. Could check posthandshake for TLS1.3
962 and trigger a new ticket then, but cannot do that for TLS1.2 */
963 return key->renew < now ? 2 : 1;
970 /*************************************************
971 * Initialize for DH *
972 *************************************************/
974 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
977 sctx The current SSL CTX (inbound or outbound)
978 dhparam DH parameter file or fixed parameter identity string
979 host connected host, if client; NULL if server
980 errstr error string pointer
982 Returns: TRUE if OK (nothing to set up, or setup worked)
986 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host, uschar ** errstr)
994 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
997 if (!dhexpanded || !*dhexpanded)
998 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
999 else if (dhexpanded[0] == '/')
1001 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
1003 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
1004 host, US strerror(errno), errstr);
1010 if (Ustrcmp(dhexpanded, "none") == 0)
1012 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
1016 if (!(pem = std_dh_prime_named(dhexpanded)))
1018 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
1019 host, US strerror(errno), errstr);
1022 bio = BIO_new_mem_buf(CS pem, -1);
1025 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
1028 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
1029 host, NULL, errstr);
1033 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
1034 * an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with
1035 * 2236. But older OpenSSL can only report in bytes (octets), not bits.
1036 * If someone wants to dance at the edge, then they can raise the limit or use
1037 * current libraries. */
1038 #ifdef EXIM_HAVE_OPENSSL_DH_BITS
1039 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
1040 * This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
1041 dh_bitsize = DH_bits(dh);
1043 dh_bitsize = 8 * DH_size(dh);
1046 /* Even if it is larger, we silently return success rather than cause things
1047 * to fail out, so that a too-large DH will not knock out all TLS; it's a
1048 * debatable choice. */
1049 if (dh_bitsize > tls_dh_max_bits)
1052 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d\n",
1053 dh_bitsize, tls_dh_max_bits);
1057 SSL_CTX_set_tmp_dh(sctx, dh);
1059 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
1060 dhexpanded ? dhexpanded : US"default", dh_bitsize);
1072 /*************************************************
1073 * Initialize for ECDH *
1074 *************************************************/
1076 /* Load parameters for ECDH encryption.
1078 For now, we stick to NIST P-256 because: it's simple and easy to configure;
1079 it avoids any patent issues that might bite redistributors; despite events in
1080 the news and concerns over curve choices, we're not cryptographers, we're not
1081 pretending to be, and this is "good enough" to be better than no support,
1082 protecting against most adversaries. Given another year or two, there might
1083 be sufficient clarity about a "right" way forward to let us make an informed
1084 decision, instead of a knee-jerk reaction.
1086 Longer-term, we should look at supporting both various named curves and
1087 external files generated with "openssl ecparam", much as we do for init_dh().
1088 We should also support "none" as a value, to explicitly avoid initialisation.
1093 sctx The current SSL CTX (inbound or outbound)
1094 host connected host, if client; NULL if server
1095 errstr error string pointer
1097 Returns: TRUE if OK (nothing to set up, or setup worked)
1101 init_ecdh(SSL_CTX * sctx, host_item * host, uschar ** errstr)
1103 #ifdef OPENSSL_NO_ECDH
1112 if (host) /* No ECDH setup for clients, only for servers */
1115 # ifndef EXIM_HAVE_ECDH
1117 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
1121 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
1123 if (!exp_curve || !*exp_curve)
1126 /* "auto" needs to be handled carefully.
1127 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
1128 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
1129 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
1130 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
1131 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
1133 if (Ustrcmp(exp_curve, "auto") == 0)
1135 #if OPENSSL_VERSION_NUMBER < 0x10002000L
1136 DEBUG(D_tls) debug_printf(
1137 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
1138 exp_curve = US"prime256v1";
1140 # if defined SSL_CTRL_SET_ECDH_AUTO
1141 DEBUG(D_tls) debug_printf(
1142 "ECDH OpenSSL 1.0.2+ temp key parameter settings: autoselection\n");
1143 SSL_CTX_set_ecdh_auto(sctx, 1);
1146 DEBUG(D_tls) debug_printf(
1147 "ECDH OpenSSL 1.1.0+ temp key parameter settings: default selection\n");
1153 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
1154 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
1155 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
1156 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
1160 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
1161 host, NULL, errstr);
1165 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
1167 tls_error(US"Unable to create ec curve", host, NULL, errstr);
1171 /* The "tmp" in the name here refers to setting a temporary key
1172 not to the stability of the interface. */
1174 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
1175 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL, errstr);
1177 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
1182 # endif /*EXIM_HAVE_ECDH*/
1183 #endif /*OPENSSL_NO_ECDH*/
1189 #ifndef DISABLE_OCSP
1190 /*************************************************
1191 * Load OCSP information into state *
1192 *************************************************/
1193 /* Called to load the server OCSP response from the given file into memory, once
1194 caller has determined this is needed. Checks validity. Debugs a message
1197 ASSUMES: single response, for single cert.
1200 sctx the SSL_CTX* to update
1201 cbinfo various parts of session state
1202 filename the filename putatively holding an OCSP response
1207 ocsp_load_response(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo,
1208 const uschar * filename)
1211 OCSP_RESPONSE * resp;
1212 OCSP_BASICRESP * basic_response;
1213 OCSP_SINGLERESP * single_response;
1214 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1215 STACK_OF(X509) * sk;
1216 unsigned long verify_flags;
1217 int status, reason, i;
1219 DEBUG(D_tls) debug_printf("tls_ocsp_file '%s'\n", filename);
1221 if (!(bio = BIO_new_file(CS filename, "rb")))
1223 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
1228 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1232 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
1236 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1238 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1239 OCSP_response_status_str(status), status);
1245 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1246 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1251 if (!(basic_response = OCSP_response_get1_basic(resp)))
1254 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1258 sk = cbinfo->verify_stack;
1259 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1261 /* May need to expose ability to adjust those flags?
1262 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1263 OCSP_TRUSTOTHER OCSP_NOINTERN */
1265 /* This does a full verify on the OCSP proof before we load it for serving
1266 up; possibly overkill - just date-checks might be nice enough.
1268 OCSP_basic_verify takes a "store" arg, but does not
1269 use it for the chain verification, which is all we do
1270 when OCSP_NOVERIFY is set. The content from the wire
1271 "basic_response" and a cert-stack "sk" are all that is used.
1273 We have a stack, loaded in setup_certs() if tls_verify_certificates
1274 was a file (not a directory, or "system"). It is unfortunate we
1275 cannot used the connection context store, as that would neatly
1276 handle the "system" case too, but there seems to be no library
1277 function for getting a stack from a store.
1278 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1279 We do not free the stack since it could be needed a second time for
1282 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1283 be a public interface into the OpenSSL library (there's no manual entry) -
1284 But what with? We also use OCSP_basic_verify in the client stapling callback.
1285 And there we NEED it; we must verify that status... unless the
1286 library does it for us anyway? */
1288 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
1292 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1293 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
1298 /* Here's the simplifying assumption: there's only one response, for the
1299 one certificate we use, and nothing for anything else in a chain. If this
1300 proves false, we need to extract a cert id from our issued cert
1301 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1302 right cert in the stack and then calls OCSP_single_get0_status()).
1304 I'm hoping to avoid reworking a bunch more of how we handle state here.
1306 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1309 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1312 debug_printf("Unable to get first response from OCSP basic response.\n");
1316 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1317 if (status != V_OCSP_CERTSTATUS_GOOD)
1319 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1320 OCSP_cert_status_str(status), status,
1321 OCSP_crl_reason_str(reason), reason);
1325 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1327 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
1332 /* Add the resp to the list used by tls_server_stapling_cb() */
1334 ocsp_resplist ** op = &cbinfo->u_ocsp.server.olist, * oentry;
1335 while (oentry = *op)
1337 *op = oentry = store_get(sizeof(ocsp_resplist), FALSE);
1338 oentry->next = NULL;
1339 oentry->resp = resp;
1344 if (f.running_in_test_harness)
1346 extern char ** environ;
1347 if (environ) for (uschar ** p = USS environ; *p; p++)
1348 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1350 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1351 goto supply_response;
1359 ocsp_free_response_list(tls_ext_ctx_cb * cbinfo)
1361 for (ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; olist;
1362 olist = olist->next)
1363 OCSP_RESPONSE_free(olist->resp);
1364 cbinfo->u_ocsp.server.olist = NULL;
1366 #endif /*!DISABLE_OCSP*/
1371 /* Create and install a selfsigned certificate, for use in server mode */
1374 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
1382 where = US"allocating pkey";
1383 if (!(pkey = EVP_PKEY_new()))
1386 where = US"allocating cert";
1387 if (!(x509 = X509_new()))
1390 where = US"generating pkey";
1391 if (!(rsa = rsa_callback(NULL, 0, 2048)))
1394 where = US"assigning pkey";
1395 if (!EVP_PKEY_assign_RSA(pkey, rsa))
1398 X509_set_version(x509, 2); /* N+1 - version 3 */
1399 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
1400 X509_gmtime_adj(X509_get_notBefore(x509), 0);
1401 X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60); /* 1 hour */
1402 X509_set_pubkey(x509, pkey);
1404 name = X509_get_subject_name(x509);
1405 X509_NAME_add_entry_by_txt(name, "C",
1406 MBSTRING_ASC, CUS "UK", -1, -1, 0);
1407 X509_NAME_add_entry_by_txt(name, "O",
1408 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
1409 X509_NAME_add_entry_by_txt(name, "CN",
1410 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
1411 X509_set_issuer_name(x509, name);
1413 where = US"signing cert";
1414 if (!X509_sign(x509, pkey, EVP_md5()))
1417 where = US"installing selfsign cert";
1418 if (!SSL_CTX_use_certificate(sctx, x509))
1421 where = US"installing selfsign key";
1422 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
1428 (void) tls_error(where, NULL, NULL, errstr);
1429 if (x509) X509_free(x509);
1430 if (pkey) EVP_PKEY_free(pkey);
1438 tls_add_certfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1441 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1442 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1443 return tls_error(string_sprintf(
1444 "SSL_CTX_use_certificate_chain_file file=%s", file),
1445 cbinfo->host, NULL, errstr);
1450 tls_add_pkeyfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1453 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1454 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1455 return tls_error(string_sprintf(
1456 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1461 /*************************************************
1462 * Expand key and cert file specs *
1463 *************************************************/
1465 /* Called once during tls_init and possibly again during TLS setup, for a
1466 new context, if Server Name Indication was used and tls_sni was seen in
1467 the certificate string.
1470 sctx the SSL_CTX* to update
1471 cbinfo various parts of session state
1472 errstr error string pointer
1474 Returns: OK/DEFER/FAIL
1478 tls_expand_session_files(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo,
1483 if (!cbinfo->certificate)
1485 if (!cbinfo->is_server) /* client */
1488 if (tls_install_selfsign(sctx, errstr) != OK)
1495 if ( !reexpand_tls_files_for_sni
1496 && ( Ustrstr(cbinfo->certificate, US"tls_sni")
1497 || Ustrstr(cbinfo->certificate, US"tls_in_sni")
1498 || Ustrstr(cbinfo->certificate, US"tls_out_sni")
1500 reexpand_tls_files_for_sni = TRUE;
1502 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded, errstr))
1506 if (cbinfo->is_server)
1508 const uschar * file_list = expanded;
1511 #ifndef DISABLE_OCSP
1512 const uschar * olist = cbinfo->u_ocsp.server.file;
1517 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1519 if (olist && !*olist)
1522 if ( cbinfo->u_ocsp.server.file_expanded && olist
1523 && (Ustrcmp(olist, cbinfo->u_ocsp.server.file_expanded) == 0))
1525 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1530 ocsp_free_response_list(cbinfo);
1531 cbinfo->u_ocsp.server.file_expanded = olist;
1535 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1537 if ((err = tls_add_certfile(sctx, cbinfo, file, errstr)))
1540 #ifndef DISABLE_OCSP
1542 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1543 ocsp_load_response(sctx, cbinfo, ofile);
1545 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1549 else /* would there ever be a need for multiple client certs? */
1550 if ((err = tls_add_certfile(sctx, cbinfo, expanded, errstr)))
1553 if ( cbinfo->privatekey
1554 && !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded, errstr))
1557 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1558 of the expansion is an empty string, ignore it also, and assume the private
1559 key is in the same file as the certificate. */
1561 if (expanded && *expanded)
1562 if (cbinfo->is_server)
1564 const uschar * file_list = expanded;
1568 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1569 if ((err = tls_add_pkeyfile(sctx, cbinfo, file, errstr)))
1572 else /* would there ever be a need for multiple client certs? */
1573 if ((err = tls_add_pkeyfile(sctx, cbinfo, expanded, errstr)))
1583 /*************************************************
1584 * Callback to handle SNI *
1585 *************************************************/
1587 /* Called when acting as server during the TLS session setup if a Server Name
1588 Indication extension was sent by the client.
1590 API documentation is OpenSSL s_server.c implementation.
1593 s SSL* of the current session
1594 ad unknown (part of OpenSSL API) (unused)
1595 arg Callback of "our" registered data
1597 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
1599 XXX might need to change to using ClientHello callback,
1600 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
1603 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1605 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
1607 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
1608 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1610 int old_pool = store_pool;
1611 uschar * dummy_errstr;
1614 return SSL_TLSEXT_ERR_OK;
1616 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
1617 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
1619 /* Make the extension value available for expansion */
1620 store_pool = POOL_PERM;
1621 tls_in.sni = string_copy_taint(US servername, TRUE);
1622 store_pool = old_pool;
1624 if (!reexpand_tls_files_for_sni)
1625 return SSL_TLSEXT_ERR_OK;
1627 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1628 not confident that memcpy wouldn't break some internal reference counting.
1629 Especially since there's a references struct member, which would be off. */
1631 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1632 if (!(server_sni = SSL_CTX_new(TLS_server_method())))
1634 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
1637 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1638 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
1642 /* Not sure how many of these are actually needed, since SSL object
1643 already exists. Might even need this selfsame callback, for reneg? */
1645 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1646 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1647 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1648 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1649 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1650 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
1652 if ( !init_dh(server_sni, cbinfo->dhparam, NULL, &dummy_errstr)
1653 || !init_ecdh(server_sni, NULL, &dummy_errstr)
1657 if ( cbinfo->server_cipher_list
1658 && !SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list))
1661 #ifndef DISABLE_OCSP
1662 if (cbinfo->u_ocsp.server.file)
1664 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
1665 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
1669 if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
1670 verify_callback_server, &dummy_errstr)) != OK)
1673 /* do this after setup_certs, because this can require the certs for verifying
1674 OCSP information. */
1675 if ((rc = tls_expand_session_files(server_sni, cbinfo, &dummy_errstr)) != OK)
1678 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
1679 SSL_set_SSL_CTX(s, server_sni);
1680 return SSL_TLSEXT_ERR_OK;
1682 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
1684 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
1689 #ifndef DISABLE_OCSP
1691 /*************************************************
1692 * Callback to handle OCSP Stapling *
1693 *************************************************/
1695 /* Called when acting as server during the TLS session setup if the client
1696 requests OCSP information with a Certificate Status Request.
1698 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1704 tls_server_stapling_cb(SSL *s, void *arg)
1706 const tls_ext_ctx_cb * cbinfo = (tls_ext_ctx_cb *) arg;
1707 ocsp_resplist * olist = cbinfo->u_ocsp.server.olist;
1708 uschar * response_der; /*XXX blob */
1709 int response_der_len;
1712 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
1713 olist ? "have" : "lack");
1715 tls_in.ocsp = OCSP_NOT_RESP;
1717 return SSL_TLSEXT_ERR_NOACK;
1719 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
1721 const X509 * cert_sent = SSL_get_certificate(s);
1722 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
1723 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
1724 const X509_NAME * cert_issuer = X509_get_issuer_name(cert_sent);
1728 for (; olist; olist = olist->next)
1730 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
1731 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
1732 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
1733 ASN1_INTEGER * res_cert_serial;
1734 const BIGNUM * resp_bn;
1735 ASN1_OCTET_STRING * res_cert_iNameHash;
1738 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
1739 (OCSP_CERTID *) cid);
1740 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
1744 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
1745 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
1748 if (BN_cmp(cert_bn, resp_bn) == 0)
1750 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
1752 /*XXX TODO: check the rest of the list for duplicate matches.
1753 If any, need to also check the Issuer Name hash.
1754 Without this, we will provide the wrong status in the case of
1759 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
1763 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
1764 return SSL_TLSEXT_ERR_NOACK;
1770 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
1771 return SSL_TLSEXT_ERR_NOACK;
1775 /*XXX could we do the i2d earlier, rather than during the callback? */
1776 response_der = NULL;
1777 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
1778 if (response_der_len <= 0)
1779 return SSL_TLSEXT_ERR_NOACK;
1781 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
1782 tls_in.ocsp = OCSP_VFIED;
1783 return SSL_TLSEXT_ERR_OK;
1788 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1790 BIO_printf(bp, "\t%s: ", str);
1791 ASN1_GENERALIZEDTIME_print(bp, time);
1796 tls_client_stapling_cb(SSL *s, void *arg)
1798 tls_ext_ctx_cb * cbinfo = arg;
1799 const unsigned char * p;
1801 OCSP_RESPONSE * rsp;
1802 OCSP_BASICRESP * bs;
1805 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
1806 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1809 /* Expect this when we requested ocsp but got none */
1810 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
1811 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
1813 DEBUG(D_tls) debug_printf(" null\n");
1814 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1817 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1819 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
1820 if (LOGGING(tls_cipher))
1821 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
1823 DEBUG(D_tls) debug_printf(" parse error\n");
1827 if (!(bs = OCSP_response_get1_basic(rsp)))
1829 tls_out.ocsp = OCSP_FAILED;
1830 if (LOGGING(tls_cipher))
1831 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
1833 DEBUG(D_tls) debug_printf(" error parsing response\n");
1834 OCSP_RESPONSE_free(rsp);
1838 /* We'd check the nonce here if we'd put one in the request. */
1839 /* However that would defeat cacheability on the server so we don't. */
1841 /* This section of code reworked from OpenSSL apps source;
1842 The OpenSSL Project retains copyright:
1843 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1848 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1850 DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1852 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1854 /* Use the chain that verified the server cert to verify the stapled info */
1855 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1857 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
1858 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
1860 tls_out.ocsp = OCSP_FAILED;
1861 if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
1862 "Received TLS cert status response, itself unverifiable: %s",
1863 ERR_reason_error_string(ERR_peek_error()));
1864 BIO_printf(bp, "OCSP response verify failure\n");
1865 ERR_print_errors(bp);
1866 OCSP_RESPONSE_print(bp, rsp, 0);
1870 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1872 /*XXX So we have a good stapled OCSP status. How do we know
1873 it is for the cert of interest? OpenSSL 1.1.0 has a routine
1874 OCSP_resp_find_status() which matches on a cert id, which presumably
1875 we should use. Making an id needs OCSP_cert_id_new(), which takes
1876 issuerName, issuerKey, serialNumber. Are they all in the cert?
1878 For now, carry on blindly accepting the resp. */
1881 OCSP_SINGLERESP * single;
1883 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
1884 if (OCSP_resp_count(bs) != 1)
1886 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1887 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1890 tls_out.ocsp = OCSP_FAILED;
1891 log_write(0, LOG_MAIN, "OCSP stapling "
1892 "with multiple responses not handled");
1895 single = OCSP_resp_get0(bs, 0);
1896 status = OCSP_single_get0_status(single, &reason, &rev,
1897 &thisupd, &nextupd);
1900 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1901 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1902 if (!OCSP_check_validity(thisupd, nextupd,
1903 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1905 tls_out.ocsp = OCSP_FAILED;
1906 DEBUG(D_tls) ERR_print_errors(bp);
1907 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1911 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1912 OCSP_cert_status_str(status));
1915 case V_OCSP_CERTSTATUS_GOOD:
1916 tls_out.ocsp = OCSP_VFIED;
1919 case V_OCSP_CERTSTATUS_REVOKED:
1920 tls_out.ocsp = OCSP_FAILED;
1921 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1922 reason != -1 ? "; reason: " : "",
1923 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1924 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1927 tls_out.ocsp = OCSP_FAILED;
1928 log_write(0, LOG_MAIN,
1929 "Server certificate status unknown, in OCSP stapling");
1934 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1939 OCSP_RESPONSE_free(rsp);
1942 #endif /*!DISABLE_OCSP*/
1945 /*************************************************
1946 * Initialize for TLS *
1947 *************************************************/
1950 tls_openssl_init(void)
1952 #ifdef EXIM_NEED_OPENSSL_INIT
1953 SSL_load_error_strings(); /* basic set up */
1954 OpenSSL_add_ssl_algorithms();
1957 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
1958 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1959 list of available digests. */
1960 EVP_add_digest(EVP_sha256());
1966 /* Called from both server and client code, to do preliminary initialization
1967 of the library. We allocate and return a context structure.
1970 ctxp returned SSL context
1971 host connected host, if client; NULL if server
1972 dhparam DH parameter file
1973 certificate certificate file
1974 privatekey private key
1975 ocsp_file file of stapling info (server); flag for require ocsp (client)
1976 addr address if client; NULL if server (for some randomness)
1977 cbp place to put allocated callback context
1978 errstr error string pointer
1980 Returns: OK/DEFER/FAIL
1984 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
1986 #ifndef DISABLE_OCSP
1989 address_item *addr, tls_ext_ctx_cb ** cbp,
1996 tls_ext_ctx_cb * cbinfo;
1998 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1999 cbinfo->tlsp = tlsp;
2000 cbinfo->certificate = certificate;
2001 cbinfo->privatekey = privatekey;
2002 cbinfo->is_server = host==NULL;
2003 #ifndef DISABLE_OCSP
2004 cbinfo->verify_stack = NULL;
2007 cbinfo->u_ocsp.server.file = ocsp_file;
2008 cbinfo->u_ocsp.server.file_expanded = NULL;
2009 cbinfo->u_ocsp.server.olist = NULL;
2012 cbinfo->u_ocsp.client.verify_store = NULL;
2014 cbinfo->dhparam = dhparam;
2015 cbinfo->server_cipher_list = NULL;
2016 cbinfo->host = host;
2017 #ifndef DISABLE_EVENT
2018 cbinfo->event_action = NULL;
2023 /* Create a context.
2024 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2025 negotiation in the different methods; as far as I can tell, the only
2026 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2027 when OpenSSL is built without SSLv2 support.
2028 By disabling with openssl_options, we can let admins re-enable with the
2031 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
2032 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
2034 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
2036 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
2038 /* It turns out that we need to seed the random number generator this early in
2039 order to get the full complement of ciphers to work. It took me roughly a day
2040 of work to discover this by experiment.
2042 On systems that have /dev/urandom, SSL may automatically seed itself from
2043 there. Otherwise, we have to make something up as best we can. Double check
2049 gettimeofday(&r.tv, NULL);
2052 RAND_seed(US (&r), sizeof(r));
2053 RAND_seed(US big_buffer, big_buffer_size);
2054 if (addr != NULL) RAND_seed(US addr, sizeof(addr));
2057 return tls_error(US"RAND_status", host,
2058 US"unable to seed random number generator", errstr);
2061 /* Set up the information callback, which outputs if debugging is at a suitable
2066 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
2067 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
2068 /* this needs a debug build of OpenSSL */
2069 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
2071 #ifdef OPENSSL_HAVE_KEYLOG_CB
2072 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
2076 /* Automatically re-try reads/writes after renegotiation. */
2077 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
2079 /* Apply administrator-supplied work-arounds.
2080 Historically we applied just one requested option,
2081 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2082 moved to an administrator-controlled list of options to specify and
2083 grandfathered in the first one as the default value for "openssl_options".
2085 No OpenSSL version number checks: the options we accept depend upon the
2086 availability of the option value macros from OpenSSL. */
2088 if (!tls_openssl_options_parse(openssl_options, &init_options))
2089 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2091 #ifdef EXPERIMENTAL_TLS_RESUME
2092 tlsp->resumption = RESUME_SUPPORTED;
2096 #ifdef EXPERIMENTAL_TLS_RESUME
2097 /* Should the server offer session resumption? */
2098 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2100 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2101 init_options &= ~SSL_OP_NO_TICKET;
2102 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2103 tlsp->host_resumable = TRUE;
2107 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
2108 if (!(SSL_CTX_set_options(ctx, init_options)))
2109 return tls_error(string_sprintf(
2110 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2113 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2115 /* We'd like to disable session cache unconditionally, but foolish Outlook
2116 Express clients then give up the first TLS connection and make a second one
2117 (which works). Only when there is an IMAP service on the same machine.
2118 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2119 now, until we work out a decent way of presenting control to the config. It
2120 will never be used because we use a new context every time. */
2122 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2125 /* Initialize with DH parameters if supplied */
2126 /* Initialize ECDH temp key parameter selection */
2128 if ( !init_dh(ctx, dhparam, host, errstr)
2129 || !init_ecdh(ctx, host, errstr)
2133 /* Set up certificate and key (and perhaps OCSP info) */
2135 if ((rc = tls_expand_session_files(ctx, cbinfo, errstr)) != OK)
2138 /* If we need to handle SNI or OCSP, do so */
2140 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2141 # ifndef DISABLE_OCSP
2142 if (!(cbinfo->verify_stack = sk_X509_new_null()))
2144 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2149 if (!host) /* server */
2151 # ifndef DISABLE_OCSP
2152 /* We check u_ocsp.server.file, not server.olist, because we care about if
2153 the option exists, not what the current expansion might be, as SNI might
2154 change the certificate and OCSP file in use between now and the time the
2155 callback is invoked. */
2156 if (cbinfo->u_ocsp.server.file)
2158 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2159 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
2162 /* We always do this, so that $tls_sni is available even if not used in
2164 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2165 SSL_CTX_set_tlsext_servername_arg(ctx, cbinfo);
2167 # ifndef DISABLE_OCSP
2169 if(ocsp_file) /* wanting stapling */
2171 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
2173 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2176 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2177 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
2182 cbinfo->verify_cert_hostnames = NULL;
2184 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
2185 /* Set up the RSA callback */
2186 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
2189 /* Finally, set the session cache timeout, and we are done.
2190 The period appears to be also used for (server-generated) session tickets */
2192 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
2193 DEBUG(D_tls) debug_printf("Initialized TLS\n");
2204 /*************************************************
2205 * Get name of cipher in use *
2206 *************************************************/
2209 Argument: pointer to an SSL structure for the connection
2210 pointer to number of bits for cipher
2211 Returns: pointer to allocated string in perm-pool
2215 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
2217 int pool = store_pool;
2218 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
2219 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2220 the accessor functions use const in the prototype. */
2222 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
2225 SSL_CIPHER_get_bits(c, bits);
2227 store_pool = POOL_PERM;
2228 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2230 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2235 /* Get IETF-standard name for ciphersuite.
2236 Argument: pointer to an SSL structure for the connection
2237 Returns: pointer to string
2240 static const uschar *
2241 cipher_stdname_ssl(SSL * ssl)
2243 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2244 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2246 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2247 return cipher_stdname(id >> 8, id & 0xff);
2252 static const uschar *
2253 tlsver_name(SSL * ssl)
2256 int pool = store_pool;
2258 store_pool = POOL_PERM;
2259 s = string_copy(US SSL_get_version(ssl));
2261 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
2262 for (;; p++) if (!(*p = p[1])) break;
2268 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
2270 /*XXX we might consider a list-of-certs variable for the cert chain.
2271 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2272 in list-handling functions, also consider the difference between the entire
2273 chain and the elements sent by the peer. */
2275 tlsp->peerdn = NULL;
2277 /* Will have already noted peercert on a verify fail; possibly not the leaf */
2278 if (!tlsp->peercert)
2279 tlsp->peercert = SSL_get_peer_certificate(ssl);
2280 /* Beware anonymous ciphers which lead to server_cert being NULL */
2282 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2283 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2286 int oldpool = store_pool;
2288 peerdn[siz-1] = '\0'; /* paranoia */
2289 store_pool = POOL_PERM;
2290 tlsp->peerdn = string_copy(peerdn);
2291 store_pool = oldpool;
2293 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2294 but they don't get called on session-resumption. So use the official
2295 interface, which uses the resumed value. Unfortunately this claims verified
2296 when it actually failed but we're in try-verify mode, due to us wanting the
2297 knowlege that it failed so needing to have the callback and forcing a
2298 permissive return. If we don't force it, the TLS startup is failed.
2299 The extra bit of information is set in verify_override in the cb, stashed
2300 for resumption next to the TLS session, and used here. */
2302 if (!tlsp->verify_override)
2303 tlsp->certificate_verified = SSL_get_verify_result(ssl) == X509_V_OK;
2311 /*************************************************
2312 * Set up for verifying certificates *
2313 *************************************************/
2315 #ifndef DISABLE_OCSP
2316 /* Load certs from file, return TRUE on success */
2319 chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
2324 while (sk_X509_num(verify_stack) > 0)
2325 X509_free(sk_X509_pop(verify_stack));
2327 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
2328 while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
2329 sk_X509_push(verify_stack, x);
2337 /* Called by both client and server startup; on the server possibly
2338 repeated after a Server Name Indication.
2341 sctx SSL_CTX* to initialise
2342 certs certs file or NULL
2343 crl CRL file or NULL
2344 host NULL in a server; the remote host in a client
2345 optional TRUE if called from a server for a host in tls_try_verify_hosts;
2346 otherwise passed as FALSE
2347 cert_vfy_cb Callback function for certificate verification
2348 errstr error string pointer
2350 Returns: OK/DEFER/FAIL
2354 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
2355 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr)
2357 uschar *expcerts, *expcrl;
2359 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
2361 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
2363 if (expcerts && *expcerts)
2365 /* Tell the library to use its compiled-in location for the system default
2366 CA bundle. Then add the ones specified in the config, if any. */
2368 if (!SSL_CTX_set_default_verify_paths(sctx))
2369 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
2371 if (Ustrcmp(expcerts, "system") != 0)
2373 struct stat statbuf;
2375 if (Ustat(expcerts, &statbuf) < 0)
2377 log_write(0, LOG_MAIN|LOG_PANIC,
2378 "failed to stat %s for certificates", expcerts);
2384 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
2385 { file = NULL; dir = expcerts; }
2388 file = expcerts; dir = NULL;
2389 #ifndef DISABLE_OCSP
2390 /* In the server if we will be offering an OCSP proof, load chain from
2391 file for verifying the OCSP proof at load time. */
2393 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
2394 This is inconsistent with the need to verify the OCSP proof of the server cert.
2398 && statbuf.st_size > 0
2399 && server_static_cbinfo->u_ocsp.server.file
2400 && !chain_from_pem_file(file, server_static_cbinfo->verify_stack)
2403 log_write(0, LOG_MAIN|LOG_PANIC,
2404 "failed to load cert chain from %s", file);
2410 /* If a certificate file is empty, the next function fails with an
2411 unhelpful error message. If we skip it, we get the correct behaviour (no
2412 certificates are recognized, but the error message is still misleading (it
2413 says no certificate was supplied). But this is better. */
2415 if ( (!file || statbuf.st_size > 0)
2416 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
2417 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL, errstr);
2419 /* Load the list of CAs for which we will accept certs, for sending
2420 to the client. This is only for the one-file tls_verify_certificates
2422 If a list isn't loaded into the server, but some verify locations are set,
2423 the server end appears to make a wildcard request for client certs.
2424 Meanwhile, the client library as default behaviour *ignores* the list
2425 we send over the wire - see man SSL_CTX_set_client_cert_cb.
2426 Because of this, and that the dir variant is likely only used for
2427 the public-CA bundle (not for a private CA), not worth fixing. */
2431 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
2433 SSL_CTX_set_client_CA_list(sctx, names);
2434 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
2435 sk_X509_NAME_num(names));
2440 /* Handle a certificate revocation list. */
2442 #if OPENSSL_VERSION_NUMBER > 0x00907000L
2444 /* This bit of code is now the version supplied by Lars Mainka. (I have
2445 merely reformatted it into the Exim code style.)
2447 "From here I changed the code to add support for multiple crl's
2448 in pem format in one file or to support hashed directory entries in
2449 pem format instead of a file. This method now uses the library function
2450 X509_STORE_load_locations to add the CRL location to the SSL context.
2451 OpenSSL will then handle the verify against CA certs and CRLs by
2452 itself in the verify callback." */
2454 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
2455 if (expcrl && *expcrl)
2457 struct stat statbufcrl;
2458 if (Ustat(expcrl, &statbufcrl) < 0)
2460 log_write(0, LOG_MAIN|LOG_PANIC,
2461 "failed to stat %s for certificates revocation lists", expcrl);
2466 /* is it a file or directory? */
2468 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
2469 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
2473 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
2479 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
2481 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
2482 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
2484 /* setting the flags to check against the complete crl chain */
2486 X509_STORE_set_flags(cvstore,
2487 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
2491 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
2493 /* If verification is optional, don't fail if no certificate */
2495 SSL_CTX_set_verify(sctx,
2496 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2505 /*************************************************
2506 * Start a TLS session in a server *
2507 *************************************************/
2509 /* This is called when Exim is running as a server, after having received
2510 the STARTTLS command. It must respond to that command, and then negotiate
2514 require_ciphers allowed ciphers
2515 errstr pointer to error message
2517 Returns: OK on success
2518 DEFER for errors before the start of the negotiation
2519 FAIL for errors during the negotiation; the server can't
2524 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
2527 uschar * expciphers;
2528 tls_ext_ctx_cb * cbinfo;
2529 static uschar peerdn[256];
2531 /* Check for previous activation */
2533 if (tls_in.active.sock >= 0)
2535 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
2536 smtp_printf("554 Already in TLS\r\n", FALSE);
2540 /* Initialize the SSL library. If it fails, it will already have logged
2543 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
2544 #ifndef DISABLE_OCSP
2547 NULL, &server_static_cbinfo, &tls_in, errstr);
2548 if (rc != OK) return rc;
2549 cbinfo = server_static_cbinfo;
2551 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
2554 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
2555 were historically separated by underscores. So that I can use either form in my
2556 tests, and also for general convenience, we turn underscores into hyphens here.
2558 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
2559 for TLS 1.3 . Since we do not call it at present we get the default list:
2560 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
2565 for (uschar * s = expciphers; *s; s++ ) if (*s == '_') *s = '-';
2566 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
2567 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
2568 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
2569 cbinfo->server_cipher_list = expciphers;
2572 /* If this is a host for which certificate verification is mandatory or
2573 optional, set up appropriately. */
2575 tls_in.certificate_verified = FALSE;
2577 tls_in.dane_verified = FALSE;
2579 server_verify_callback_called = FALSE;
2581 if (verify_check_host(&tls_verify_hosts) == OK)
2583 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
2584 FALSE, verify_callback_server, errstr);
2585 if (rc != OK) return rc;
2586 server_verify_optional = FALSE;
2588 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2590 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
2591 TRUE, verify_callback_server, errstr);
2592 if (rc != OK) return rc;
2593 server_verify_optional = TRUE;
2596 #ifdef EXPERIMENTAL_TLS_RESUME
2597 SSL_CTX_set_tlsext_ticket_key_cb(server_ctx, ticket_key_callback);
2598 /* despite working, appears to always return failure, so ignoring */
2600 #ifdef OPENSSL_HAVE_NUM_TICKETS
2601 # ifdef EXPERIMENTAL_TLS_RESUME
2602 SSL_CTX_set_num_tickets(server_ctx, tls_in.host_resumable ? 1 : 0);
2604 SSL_CTX_set_num_tickets(server_ctx, 0); /* send no TLS1.3 stateful-tickets */
2609 /* Prepare for new connection */
2611 if (!(server_ssl = SSL_new(server_ctx)))
2612 return tls_error(US"SSL_new", NULL, NULL, errstr);
2614 /* Warning: we used to SSL_clear(ssl) here, it was removed.
2616 * With the SSL_clear(), we get strange interoperability bugs with
2617 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
2618 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
2620 * The SSL_clear() call is to let an existing SSL* be reused, typically after
2621 * session shutdown. In this case, we have a brand new object and there's no
2622 * obvious reason to immediately clear it. I'm guessing that this was
2623 * originally added because of incomplete initialisation which the clear fixed,
2624 * in some historic release.
2627 /* Set context and tell client to go ahead, except in the case of TLS startup
2628 on connection, where outputting anything now upsets the clients and tends to
2629 make them disconnect. We need to have an explicit fflush() here, to force out
2630 the response. Other smtp_printf() calls do not need it, because in non-TLS
2631 mode, the fflush() happens when smtp_getc() is called. */
2633 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
2634 if (!tls_in.on_connect)
2636 smtp_printf("220 TLS go ahead\r\n", FALSE);
2640 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2641 that the OpenSSL library doesn't. */
2643 SSL_set_wfd(server_ssl, fileno(smtp_out));
2644 SSL_set_rfd(server_ssl, fileno(smtp_in));
2645 SSL_set_accept_state(server_ssl);
2647 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
2649 sigalrm_seen = FALSE;
2650 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2651 rc = SSL_accept(server_ssl);
2656 int error = SSL_get_error(server_ssl, rc);
2659 case SSL_ERROR_NONE:
2662 case SSL_ERROR_ZERO_RETURN:
2663 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2664 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2666 if (SSL_get_shutdown(server_ssl) == SSL_RECEIVED_SHUTDOWN)
2667 SSL_shutdown(server_ssl);
2669 tls_close(NULL, TLS_NO_SHUTDOWN);
2672 /* Handle genuine errors */
2674 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2678 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2679 if (error == SSL_ERROR_SYSCALL)
2683 *errstr = US"SSL_accept: TCP connection closed by peer";
2686 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
2688 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2693 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
2694 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
2695 anon-authentication ciphersuite negotiated. */
2697 #ifdef EXPERIMENTAL_TLS_RESUME
2698 if (SSL_session_reused(server_ssl))
2700 tls_in.resumption |= RESUME_USED;
2701 DEBUG(D_tls) debug_printf("Session reused\n");
2705 /* TLS has been set up. Record data for the connection,
2706 adjust the input functions to read via TLS, and initialize things. */
2708 peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
2710 tls_in.ver = tlsver_name(server_ssl);
2711 tls_in.cipher = construct_cipher_name(server_ssl, tls_in.ver, &tls_in.bits);
2712 tls_in.cipher_stdname = cipher_stdname_ssl(server_ssl);
2717 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)))
2718 debug_printf("Shared ciphers: %s\n", buf);
2720 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
2722 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
2723 SSL_SESSION_print_keylog(bp, SSL_get_session(server_ssl));
2728 #ifdef EXIM_HAVE_SESSION_TICKET
2730 SSL_SESSION * ss = SSL_get_session(server_ssl);
2731 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
2732 debug_printf("The session has a ticket, life %lu seconds\n",
2733 SSL_SESSION_get_ticket_lifetime_hint(ss));
2738 /* Record the certificate we presented */
2740 X509 * crt = SSL_get_certificate(server_ssl);
2741 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
2744 /* Only used by the server-side tls (tls_in), including tls_getc.
2745 Client-side (tls_out) reads (seem to?) go via
2746 smtp_read_response()/ip_recv().
2747 Hence no need to duplicate for _in and _out.
2749 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2750 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
2751 ssl_xfer_eof = ssl_xfer_error = FALSE;
2753 receive_getc = tls_getc;
2754 receive_getbuf = tls_getbuf;
2755 receive_get_cache = tls_get_cache;
2756 receive_ungetc = tls_ungetc;
2757 receive_feof = tls_feof;
2758 receive_ferror = tls_ferror;
2759 receive_smtp_buffered = tls_smtp_buffered;
2761 tls_in.active.sock = fileno(smtp_out);
2762 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
2770 tls_client_basic_ctx_init(SSL_CTX * ctx,
2771 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo,
2775 /* stick to the old behaviour for compatibility if tls_verify_certificates is
2776 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2777 the specified host patterns if one of them is defined */
2779 if ( ( !ob->tls_verify_hosts
2780 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2782 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
2784 client_verify_optional = FALSE;
2785 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
2786 client_verify_optional = TRUE;
2790 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
2791 ob->tls_crl, host, client_verify_optional, verify_callback_client,
2795 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2797 cbinfo->verify_cert_hostnames =
2799 string_domain_utf8_to_alabel(host->name, NULL);
2803 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
2804 cbinfo->verify_cert_hostnames);
2812 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
2815 const char * hostnames[2] = { CS host->name, NULL };
2818 if (DANESSL_init(ssl, NULL, hostnames) != 1)
2819 return tls_error(US"hostnames load", host, NULL, errstr);
2821 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2822 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2823 ) if (rr->type == T_TLSA && rr->size > 3)
2825 const uschar * p = rr->data;
2826 uint8_t usage, selector, mtype;
2827 const char * mdname;
2831 /* Only DANE-TA(2) and DANE-EE(3) are supported */
2832 if (usage != 2 && usage != 3) continue;
2839 default: continue; /* Only match-types 0, 1, 2 are supported */
2840 case 0: mdname = NULL; break;
2841 case 1: mdname = "sha256"; break;
2842 case 2: mdname = "sha512"; break;
2846 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
2849 return tls_error(US"tlsa load", host, NULL, errstr);
2850 case 0: /* action not taken */
2854 tls_out.tlsa_usage |= 1<<usage;
2860 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
2863 #endif /*SUPPORT_DANE*/
2867 #ifdef EXPERIMENTAL_TLS_RESUME
2868 /* On the client, get any stashed session for the given IP from hints db
2869 and apply it to the ssl-connection for attempted resumption. */
2872 tls_retrieve_session(tls_support * tlsp, SSL * ssl, const uschar * key)
2874 tlsp->resumption |= RESUME_SUPPORTED;
2875 if (tlsp->host_resumable)
2877 dbdata_tls_session * dt;
2879 open_db dbblock, * dbm_file;
2881 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2882 DEBUG(D_tls) debug_printf("checking for resumable session for %s\n", key);
2883 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
2885 /* key for the db is the IP */
2886 if ((dt = dbfn_read_with_length(dbm_file, key, &len)))
2888 SSL_SESSION * ss = NULL;
2889 const uschar * sess_asn1 = dt->session;
2891 len -= sizeof(dbdata_tls_session);
2892 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
2896 ERR_error_string_n(ERR_get_error(),
2897 ssl_errstring, sizeof(ssl_errstring));
2898 debug_printf("decoding session: %s\n", ssl_errstring);
2901 #ifdef EXIM_HAVE_SESSION_TICKET
2902 else if ( SSL_SESSION_get_ticket_lifetime_hint(ss) + dt->time_stamp
2905 DEBUG(D_tls) debug_printf("session expired\n");
2906 dbfn_delete(dbm_file, key);
2909 else if (!SSL_set_session(ssl, ss))
2913 ERR_error_string_n(ERR_get_error(),
2914 ssl_errstring, sizeof(ssl_errstring));
2915 debug_printf("applying session to ssl: %s\n", ssl_errstring);
2920 DEBUG(D_tls) debug_printf("good session\n");
2921 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2922 tlsp->verify_override = dt->verify_override;
2923 tlsp->ocsp = dt->ocsp;
2927 DEBUG(D_tls) debug_printf("no session record\n");
2928 dbfn_close(dbm_file);
2934 /* On the client, save the session for later resumption */
2937 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
2939 tls_ext_ctx_cb * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
2942 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
2944 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
2946 # ifdef OPENSSL_HAVE_NUM_TICKETS
2947 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
2950 int len = i2d_SSL_SESSION(ss, NULL);
2951 int dlen = sizeof(dbdata_tls_session) + len;
2952 dbdata_tls_session * dt = store_get(dlen, TRUE);
2953 uschar * s = dt->session;
2954 open_db dbblock, * dbm_file;
2956 DEBUG(D_tls) debug_printf("session is resumable\n");
2957 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
2959 dt->verify_override = tlsp->verify_override;
2960 dt->ocsp = tlsp->ocsp;
2961 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
2963 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
2965 const uschar * key = cbinfo->host->address;
2966 dbfn_delete(dbm_file, key);
2967 dbfn_write(dbm_file, key, dt, dlen);
2968 dbfn_close(dbm_file);
2969 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
2978 tls_client_ctx_resume_prehandshake(
2979 exim_openssl_client_tls_ctx * exim_client_ctx, tls_support * tlsp,
2980 smtp_transport_options_block * ob, host_item * host)
2982 /* Should the client request a session resumption ticket? */
2983 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
2985 tlsp->host_resumable = TRUE;
2987 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
2988 SSL_SESS_CACHE_CLIENT
2989 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
2990 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
2995 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
2996 host_item * host, uschar ** errstr)
2998 if (tlsp->host_resumable)
3001 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3002 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3004 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3005 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_cbinfo))
3007 tls_error(US"set ex_data", host, NULL, errstr);
3010 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_cbinfo);
3013 tlsp->resumption = RESUME_SUPPORTED;
3014 /* Pick up a previous session, saved on an old ticket */
3015 tls_retrieve_session(tlsp, ssl, host->address);
3020 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
3023 if (SSL_session_reused(exim_client_ctx->ssl))
3025 DEBUG(D_tls) debug_printf("The session was reused\n");
3026 tlsp->resumption |= RESUME_USED;
3029 #endif /* EXPERIMENTAL_TLS_RESUME */
3032 /*************************************************
3033 * Start a TLS session in a client *
3034 *************************************************/
3036 /* Called from the smtp transport after STARTTLS has been accepted.
3039 cctx connection context
3040 conn_args connection details
3041 cookie datum for randomness; can be NULL
3042 tlsp record details of TLS channel configuration here; must be non-NULL
3043 errstr error string pointer
3045 Returns: TRUE for success with TLS session context set in connection context,
3050 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3051 void * cookie, tls_support * tlsp, uschar ** errstr)
3053 host_item * host = conn_args->host; /* for msgs and option-tests */
3054 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3055 smtp_transport_options_block * ob = tb
3056 ? (smtp_transport_options_block *)tb->options_block
3057 : &smtp_transport_option_defaults;
3058 exim_openssl_client_tls_ctx * exim_client_ctx;
3059 uschar * expciphers;
3061 static uschar peerdn[256];
3063 #ifndef DISABLE_OCSP
3064 BOOL request_ocsp = FALSE;
3065 BOOL require_ocsp = FALSE;
3069 store_pool = POOL_PERM;
3070 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), FALSE);
3071 exim_client_ctx->corked = NULL;
3075 tlsp->tlsa_usage = 0;
3078 #ifndef DISABLE_OCSP
3080 # ifdef SUPPORT_DANE
3081 if ( conn_args->dane
3082 && ob->hosts_request_ocsp[0] == '*'
3083 && ob->hosts_request_ocsp[1] == '\0'
3086 /* Unchanged from default. Use a safer one under DANE */
3087 request_ocsp = TRUE;
3088 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3089 " {= {4}{$tls_out_tlsa_usage}} } "
3095 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
3096 request_ocsp = TRUE;
3098 # ifdef SUPPORT_DANE
3102 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3106 rc = tls_init(&exim_client_ctx->ctx, host, NULL,
3107 ob->tls_certificate, ob->tls_privatekey,
3108 #ifndef DISABLE_OCSP
3109 (void *)(long)request_ocsp,
3111 cookie, &client_static_cbinfo, tlsp, errstr);
3112 if (rc != OK) return FALSE;
3114 tlsp->certificate_verified = FALSE;
3115 client_verify_callback_called = FALSE;
3119 if (conn_args->dane)
3121 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3122 other failures should be treated as problems. */
3123 if (ob->dane_require_tls_ciphers &&
3124 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3125 &expciphers, errstr))
3127 if (expciphers && *expciphers == '\0')
3132 !expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
3133 &expciphers, errstr))
3136 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3137 are separated by underscores. So that I can use either form in my tests, and
3138 also for general convenience, we turn underscores into hyphens here. */
3142 uschar *s = expciphers;
3143 while (*s) { if (*s == '_') *s = '-'; s++; }
3144 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
3145 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
3147 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
3153 if (conn_args->dane)
3155 SSL_CTX_set_verify(exim_client_ctx->ctx,
3156 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
3157 verify_callback_client_dane);
3159 if (!DANESSL_library_init())
3161 tls_error(US"library init", host, NULL, errstr);
3164 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
3166 tls_error(US"context init", host, NULL, errstr);
3174 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
3175 client_static_cbinfo, errstr) != OK)
3178 #ifdef EXPERIMENTAL_TLS_RESUME
3179 tls_client_ctx_resume_prehandshake(exim_client_ctx, tlsp, ob, host);
3183 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
3185 tls_error(US"SSL_new", host, NULL, errstr);
3188 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
3190 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
3191 SSL_set_connect_state(exim_client_ctx->ssl);
3195 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
3199 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
3201 else if (!Ustrlen(tlsp->sni))
3205 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
3206 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
3207 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
3209 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
3216 if (conn_args->dane)
3217 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
3221 #ifndef DISABLE_OCSP
3222 /* Request certificate status at connection-time. If the server
3223 does OCSP stapling we will get the callback (set in tls_init()) */
3224 # ifdef SUPPORT_DANE
3228 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3229 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3231 { /* Re-eval now $tls_out_tlsa_usage is populated. If
3232 this means we avoid the OCSP request, we wasted the setup
3233 cost in tls_init(). */
3234 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3235 request_ocsp = require_ocsp
3236 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3243 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
3244 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
3245 tlsp->ocsp = OCSP_NOT_RESP;
3249 #ifdef EXPERIMENTAL_TLS_RESUME
3250 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
3255 #ifndef DISABLE_EVENT
3256 client_static_cbinfo->event_action = tb ? tb->event_action : NULL;
3259 /* There doesn't seem to be a built-in timeout on connection. */
3261 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
3262 sigalrm_seen = FALSE;
3263 ALARM(ob->command_timeout);
3264 rc = SSL_connect(exim_client_ctx->ssl);
3268 if (conn_args->dane)
3269 DANESSL_cleanup(exim_client_ctx->ssl);
3274 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
3280 debug_printf("SSL_connect succeeded\n");
3281 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3283 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
3284 SSL_SESSION_print_keylog(bp, SSL_get_session(exim_client_ctx->ssl));
3290 #ifdef EXPERIMENTAL_TLS_RESUME
3291 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
3294 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
3296 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
3297 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
3298 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
3300 /* Record the certificate we presented */
3302 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
3303 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
3306 tlsp->active.sock = cctx->sock;
3307 tlsp->active.tls_ctx = exim_client_ctx;
3308 cctx->tls_ctx = exim_client_ctx;
3317 tls_refill(unsigned lim)
3322 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
3323 ssl_xfer_buffer, ssl_xfer_buffer_size);
3325 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3326 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer,
3327 MIN(ssl_xfer_buffer_size, lim));
3328 error = SSL_get_error(server_ssl, inbytes);
3329 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3331 if (had_command_timeout) /* set by signal handler */
3332 smtp_command_timeout_exit(); /* does not return */
3333 if (had_command_sigterm)
3334 smtp_command_sigterm_exit();
3335 if (had_data_timeout)
3336 smtp_data_timeout_exit();
3337 if (had_data_sigint)
3338 smtp_data_sigint_exit();
3340 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
3341 closed down, not that the socket itself has been closed down. Revert to
3342 non-SSL handling. */
3346 case SSL_ERROR_NONE:
3349 case SSL_ERROR_ZERO_RETURN:
3350 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3352 if (SSL_get_shutdown(server_ssl) == SSL_RECEIVED_SHUTDOWN)
3353 SSL_shutdown(server_ssl);
3355 tls_close(NULL, TLS_NO_SHUTDOWN);
3358 /* Handle genuine errors */
3360 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3361 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
3362 ssl_xfer_error = TRUE;
3366 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3367 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
3368 debug_printf(" - syscall %s\n", strerror(errno));
3369 ssl_xfer_error = TRUE;
3373 #ifndef DISABLE_DKIM
3374 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
3376 ssl_xfer_buffer_hwm = inbytes;
3377 ssl_xfer_buffer_lwm = 0;
3382 /*************************************************
3383 * TLS version of getc *
3384 *************************************************/
3386 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3387 it refills the buffer via the SSL reading function.
3389 Arguments: lim Maximum amount to read/buffer
3390 Returns: the next character or EOF
3392 Only used by the server-side TLS.
3396 tls_getc(unsigned lim)
3398 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
3399 if (!tls_refill(lim))
3400 return ssl_xfer_error ? EOF : smtp_getc(lim);
3402 /* Something in the buffer; return next uschar */
3404 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
3408 tls_getbuf(unsigned * len)
3413 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
3414 if (!tls_refill(*len))
3416 if (!ssl_xfer_error) return smtp_getbuf(len);
3421 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
3423 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
3424 ssl_xfer_buffer_lwm += size;
3433 #ifndef DISABLE_DKIM
3434 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
3436 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
3442 tls_could_read(void)
3444 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm || SSL_pending(server_ssl) > 0;
3448 /*************************************************
3449 * Read bytes from TLS channel *
3450 *************************************************/
3454 ct_ctx client context pointer, or NULL for the one global server context
3458 Returns: the number of bytes read
3459 -1 after a failed read, including EOF
3461 Only used by the client-side TLS.
3465 tls_read(void * ct_ctx, uschar *buff, size_t len)
3467 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl : server_ssl;
3471 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
3472 buff, (unsigned int)len);
3474 inbytes = SSL_read(ssl, CS buff, len);
3475 error = SSL_get_error(ssl, inbytes);
3477 if (error == SSL_ERROR_ZERO_RETURN)
3479 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3482 else if (error != SSL_ERROR_NONE)
3492 /*************************************************
3493 * Write bytes down TLS channel *
3494 *************************************************/
3498 ct_ctx client context pointer, or NULL for the one global server context
3501 more further data expected soon
3503 Returns: the number of bytes after a successful write,
3504 -1 after a failed write
3506 Used by both server-side and client-side TLS.
3510 tls_write(void * ct_ctx, const uschar *buff, size_t len, BOOL more)
3513 int outbytes, error;
3515 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl : server_ssl;
3516 static gstring * server_corked = NULL;
3517 gstring ** corkedp = ct_ctx
3518 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
3519 gstring * corked = *corkedp;
3521 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
3522 buff, (unsigned long)len, more ? ", more" : "");
3524 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
3525 "more" is notified. This hack is only ok if small amounts are involved AND only
3526 one stream does it, in one context (i.e. no store reset). Currently it is used
3527 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
3528 We support callouts done by the server process by using a separate client
3529 context for the stashed information. */
3530 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
3531 a store reset there, so use POOL_PERM. */
3532 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
3534 if ((more || corked))
3536 #ifndef DISABLE_PIPE_CONNECT
3537 int save_pool = store_pool;
3538 store_pool = POOL_PERM;
3541 corked = string_catn(corked, buff, len);
3543 #ifndef DISABLE_PIPE_CONNECT
3544 store_pool = save_pool;
3552 buff = CUS corked->s;
3557 for (int left = len; left > 0;)
3559 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
3560 outbytes = SSL_write(ssl, CS buff, left);
3561 error = SSL_get_error(ssl, outbytes);
3562 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
3566 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3567 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
3570 case SSL_ERROR_NONE:
3575 case SSL_ERROR_ZERO_RETURN:
3576 log_write(0, LOG_MAIN, "SSL channel closed on write");
3579 case SSL_ERROR_SYSCALL:
3580 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
3581 sender_fullhost ? sender_fullhost : US"<unknown>",
3586 log_write(0, LOG_MAIN, "SSL_write error %d", error);
3595 /*************************************************
3596 * Close down a TLS session *
3597 *************************************************/
3599 /* This is also called from within a delivery subprocess forked from the
3600 daemon, to shut down the TLS library, without actually doing a shutdown (which
3601 would tamper with the SSL session in the parent process).
3604 ct_ctx client TLS context pointer, or NULL for the one global server context
3605 shutdown 1 if TLS close-alert is to be sent,
3606 2 if also response to be waited for
3610 Used by both server-side and client-side TLS.
3614 tls_close(void * ct_ctx, int shutdown)
3616 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
3617 SSL_CTX **ctxp = o_ctx ? &o_ctx->ctx : &server_ctx;
3618 SSL **sslp = o_ctx ? &o_ctx->ssl : &server_ssl;
3619 int *fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
3621 if (*fdp < 0) return; /* TLS was not active */
3626 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3627 shutdown > 1 ? " (with response-wait)" : "");
3629 if ( (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
3633 rc = SSL_shutdown(*sslp); /* wait for response */
3637 if (rc < 0) DEBUG(D_tls)
3639 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3640 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
3644 if (!o_ctx) /* server side */
3646 #ifndef DISABLE_OCSP
3647 sk_X509_pop_free(server_static_cbinfo->verify_stack, X509_free);
3648 server_static_cbinfo->verify_stack = NULL;
3651 receive_getc = smtp_getc;
3652 receive_getbuf = smtp_getbuf;
3653 receive_get_cache = smtp_get_cache;
3654 receive_ungetc = smtp_ungetc;
3655 receive_feof = smtp_feof;
3656 receive_ferror = smtp_ferror;
3657 receive_smtp_buffered = smtp_buffered;
3658 tls_in.active.tls_ctx = NULL;
3660 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3663 SSL_CTX_free(*ctxp);
3673 /*************************************************
3674 * Let tls_require_ciphers be checked at startup *
3675 *************************************************/
3677 /* The tls_require_ciphers option, if set, must be something which the
3680 Returns: NULL on success, or error message
3684 tls_validate_require_cipher(void)
3687 uschar *s, *expciphers, *err;
3691 if (!(tls_require_ciphers && *tls_require_ciphers))
3694 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
3696 return US"failed to expand tls_require_ciphers";
3698 if (!(expciphers && *expciphers))
3701 /* normalisation ripped from above */
3703 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
3707 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
3708 if (!(ctx = SSL_CTX_new(TLS_server_method())))
3710 if (!(ctx = SSL_CTX_new(SSLv23_server_method())))
3713 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3714 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
3718 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
3720 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
3722 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3723 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
3724 expciphers, ssl_errstring);
3735 /*************************************************
3736 * Report the library versions. *
3737 *************************************************/
3739 /* There have historically been some issues with binary compatibility in
3740 OpenSSL libraries; if Exim (like many other applications) is built against
3741 one version of OpenSSL but the run-time linker picks up another version,
3742 it can result in serious failures, including crashing with a SIGSEGV. So
3743 report the version found by the compiler and the run-time version.
3745 Note: some OS vendors backport security fixes without changing the version
3746 number/string, and the version date remains unchanged. The _build_ date
3747 will change, so we can more usefully assist with version diagnosis by also
3748 reporting the build date.
3750 Arguments: a FILE* to print the results to
3755 tls_version_report(FILE *f)
3757 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
3760 OPENSSL_VERSION_TEXT,
3761 SSLeay_version(SSLEAY_VERSION),
3762 SSLeay_version(SSLEAY_BUILT_ON));
3763 /* third line is 38 characters for the %s and the line is 73 chars long;
3764 the OpenSSL output includes a "built on: " prefix already. */
3770 /*************************************************
3771 * Random number generation *
3772 *************************************************/
3774 /* Pseudo-random number generation. The result is not expected to be
3775 cryptographically strong but not so weak that someone will shoot themselves
3776 in the foot using it as a nonce in input in some email header scheme or
3777 whatever weirdness they'll twist this into. The result should handle fork()
3778 and avoid repeating sequences. OpenSSL handles that for us.
3782 Returns a random number in range [0, max-1]
3786 vaguely_random_number(int max)
3790 static pid_t pidlast = 0;
3792 uschar smallbuf[sizeof(r)];
3798 if (pidnow != pidlast)
3800 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
3801 is unique for each thread", this doesn't apparently apply across processes,
3802 so our own warning from vaguely_random_number_fallback() applies here too.
3803 Fix per PostgreSQL. */
3809 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
3813 gettimeofday(&r.tv, NULL);
3816 RAND_seed(US (&r), sizeof(r));
3818 /* We're after pseudo-random, not random; if we still don't have enough data
3819 in the internal PRNG then our options are limited. We could sleep and hope
3820 for entropy to come along (prayer technique) but if the system is so depleted
3821 in the first place then something is likely to just keep taking it. Instead,
3822 we'll just take whatever little bit of pseudo-random we can still manage to
3825 needed_len = sizeof(r);
3826 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
3827 asked for a number less than 10. */
3828 for (r = max, i = 0; r; ++i)
3834 #ifdef EXIM_HAVE_RAND_PSEUDO
3835 /* We do not care if crypto-strong */
3836 i = RAND_pseudo_bytes(smallbuf, needed_len);
3838 i = RAND_bytes(smallbuf, needed_len);
3844 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
3845 return vaguely_random_number_fallback(max);
3849 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
3852 /* We don't particularly care about weighted results; if someone wants
3853 smooth distribution and cares enough then they should submit a patch then. */
3860 /*************************************************
3861 * OpenSSL option parse *
3862 *************************************************/
3864 /* Parse one option for tls_openssl_options_parse below
3867 name one option name
3868 value place to store a value for it
3869 Returns success or failure in parsing
3875 tls_openssl_one_option_parse(uschar *name, long *value)
3878 int last = exim_openssl_options_size;
3879 while (last > first)
3881 int middle = (first + last)/2;
3882 int c = Ustrcmp(name, exim_openssl_options[middle].name);
3885 *value = exim_openssl_options[middle].value;
3899 /*************************************************
3900 * OpenSSL option parsing logic *
3901 *************************************************/
3903 /* OpenSSL has a number of compatibility options which an administrator might
3904 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
3905 we look like log_selector.
3908 option_spec the administrator-supplied string of options
3909 results ptr to long storage for the options bitmap
3910 Returns success or failure
3914 tls_openssl_options_parse(uschar *option_spec, long *results)
3919 BOOL adding, item_parsed;
3921 /* Server: send no (<= TLS1.2) session tickets */
3922 result = SSL_OP_NO_TICKET;
3924 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
3925 * from default because it increases BEAST susceptibility. */
3926 #ifdef SSL_OP_NO_SSLv2
3927 result |= SSL_OP_NO_SSLv2;
3929 #ifdef SSL_OP_NO_SSLv3
3930 result |= SSL_OP_NO_SSLv3;
3932 #ifdef SSL_OP_SINGLE_DH_USE
3933 result |= SSL_OP_SINGLE_DH_USE;
3942 for (uschar * s = option_spec; *s; /**/)
3944 while (isspace(*s)) ++s;
3947 if (*s != '+' && *s != '-')
3949 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
3950 "+ or - expected but found \"%s\"\n", s);
3953 adding = *s++ == '+';
3954 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
3957 item_parsed = tls_openssl_one_option_parse(s, &item);
3961 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
3964 DEBUG(D_tls) debug_printf("openssl option, %s %8lx: %lx (%s)\n",
3965 adding ? "adding to " : "removing from", result, item, s);
3977 #endif /*!MACRO_PREDEF*/
3980 /* End of tls-openssl.c */