1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2019 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Portions Copyright (c) The OpenSSL Project 1999 */
10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11 library. It is #included into the tls.c file when that library is used. The
12 code herein is based on a patch that was originally contributed by Steve
13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
15 No cryptographic code is included in Exim. All this module does is to call
16 functions from the OpenSSL library. */
21 #include <openssl/lhash.h>
22 #include <openssl/ssl.h>
23 #include <openssl/err.h>
24 #include <openssl/rand.h>
25 #ifndef OPENSSL_NO_ECDH
26 # include <openssl/ec.h>
29 # include <openssl/ocsp.h>
37 # define EXIM_OCSP_SKEW_SECONDS (300L)
38 # define EXIM_OCSP_MAX_AGE (-1L)
41 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
42 # define EXIM_HAVE_OPENSSL_TLSEXT
44 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
45 # define EXIM_HAVE_RSA_GENKEY_EX
47 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
48 # define EXIM_HAVE_OCSP_RESP_COUNT
50 # define EXIM_HAVE_EPHEM_RSA_KEX
51 # define EXIM_HAVE_RAND_PSEUDO
53 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
54 # define EXIM_HAVE_SHA256
57 /* X509_check_host provides sane certificate hostname checking, but was added
58 to OpenSSL late, after other projects forked off the code-base. So in
59 addition to guarding against the base version number, beware that LibreSSL
60 does not (at this time) support this function.
62 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
63 opt to disentangle and ask a LibreSSL user to provide glue for a third
64 crypto provider for libtls instead of continuing to tie the OpenSSL glue
65 into even twistier knots. If LibreSSL gains the same API, we can just
66 change this guard and punt the issue for a while longer. */
68 #ifndef LIBRESSL_VERSION_NUMBER
69 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
70 # define EXIM_HAVE_OPENSSL_CHECKHOST
71 # define EXIM_HAVE_OPENSSL_DH_BITS
72 # define EXIM_HAVE_OPENSSL_TLS_METHOD
73 # define EXIM_HAVE_OPENSSL_KEYLOG
74 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
75 # define EXIM_HAVE_SESSION_TICKET
76 # define EXIM_HAVE_OPESSL_TRACE
77 # define EXIM_HAVE_OPESSL_GET0_SERIAL
79 # define EXIM_NEED_OPENSSL_INIT
81 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
82 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
83 # define EXIM_HAVE_OPENSSL_CHECKHOST
87 #if !defined(LIBRESSL_VERSION_NUMBER) \
88 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
89 # if !defined(OPENSSL_NO_ECDH)
90 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
91 # define EXIM_HAVE_ECDH
93 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
94 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
99 #ifndef LIBRESSL_VERSION_NUMBER
100 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
101 # define OPENSSL_HAVE_KEYLOG_CB
102 # define OPENSSL_HAVE_NUM_TICKETS
103 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
107 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
108 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
109 # define DISABLE_OCSP
112 #ifdef EXPERIMENTAL_TLS_RESUME
113 # if OPENSSL_VERSION_NUMBER < 0x0101010L
114 # error OpenSSL version too old for session-resumption
118 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
119 # include <openssl/x509v3.h>
122 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
123 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
124 # define SSL_CIPHER_get_id(c) (c->id)
126 # ifndef MACRO_PREDEF
127 # include "tls-cipher-stdname.c"
131 /*************************************************
132 * OpenSSL option parse *
133 *************************************************/
135 typedef struct exim_openssl_option
{
138 } exim_openssl_option
;
139 /* We could use a macro to expand, but we need the ifdef and not all the
140 options document which version they were introduced in. Policylet: include
141 all options unless explicitly for DTLS, let the administrator choose which
144 This list is current as of:
146 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
147 Plus SSL_OP_NO_TLSv1_3 for 1.1.2-dev
149 static exim_openssl_option exim_openssl_options
[] = {
150 /* KEEP SORTED ALPHABETICALLY! */
152 { US
"all", (long) SSL_OP_ALL
},
154 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
155 { US
"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
},
157 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
158 { US
"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE
},
160 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
161 { US
"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
},
163 #ifdef SSL_OP_EPHEMERAL_RSA
164 { US
"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA
},
166 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
167 { US
"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT
},
169 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
170 { US
"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
},
172 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
173 { US
"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG
},
175 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
176 { US
"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING
},
178 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
179 { US
"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG
},
181 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
182 { US
"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
},
184 #ifdef SSL_OP_NO_COMPRESSION
185 { US
"no_compression", SSL_OP_NO_COMPRESSION
},
187 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
188 { US
"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
},
190 #ifdef SSL_OP_NO_SSLv2
191 { US
"no_sslv2", SSL_OP_NO_SSLv2
},
193 #ifdef SSL_OP_NO_SSLv3
194 { US
"no_sslv3", SSL_OP_NO_SSLv3
},
196 #ifdef SSL_OP_NO_TICKET
197 { US
"no_ticket", SSL_OP_NO_TICKET
},
199 #ifdef SSL_OP_NO_TLSv1
200 { US
"no_tlsv1", SSL_OP_NO_TLSv1
},
202 #ifdef SSL_OP_NO_TLSv1_1
203 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
204 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
205 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
207 { US
"no_tlsv1_1", SSL_OP_NO_TLSv1_1
},
210 #ifdef SSL_OP_NO_TLSv1_2
211 { US
"no_tlsv1_2", SSL_OP_NO_TLSv1_2
},
213 #ifdef SSL_OP_NO_TLSv1_3
214 { US
"no_tlsv1_3", SSL_OP_NO_TLSv1_3
},
216 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
217 { US
"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG
},
219 #ifdef SSL_OP_SINGLE_DH_USE
220 { US
"single_dh_use", SSL_OP_SINGLE_DH_USE
},
222 #ifdef SSL_OP_SINGLE_ECDH_USE
223 { US
"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE
},
225 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
226 { US
"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG
},
228 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
229 { US
"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
},
231 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
232 { US
"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG
},
234 #ifdef SSL_OP_TLS_D5_BUG
235 { US
"tls_d5_bug", SSL_OP_TLS_D5_BUG
},
237 #ifdef SSL_OP_TLS_ROLLBACK_BUG
238 { US
"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG
},
243 static int exim_openssl_options_size
= nelem(exim_openssl_options
);
252 for (struct exim_openssl_option
* o
= exim_openssl_options
;
253 o
< exim_openssl_options
+ nelem(exim_openssl_options
); o
++)
255 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
256 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
258 spf(buf
, sizeof(buf
), US
"_OPT_OPENSSL_%T_X", o
->name
);
259 builtin_macro_create(buf
);
262 # ifdef EXPERIMENTAL_TLS_RESUME
263 builtin_macro_create_var(US
"_RESUME_DECODE", RESUME_DECODE_STRING
);
265 # ifdef SSL_OP_NO_TLSv1_3
266 builtin_macro_create(US
"_HAVE_TLS1_3");
271 /******************************************************************************/
273 /* Structure for collecting random data for seeding. */
275 typedef struct randstuff
{
280 /* Local static variables */
282 static BOOL client_verify_callback_called
= FALSE
;
283 static BOOL server_verify_callback_called
= FALSE
;
284 static const uschar
*sid_ctx
= US
"exim";
286 /* We have three different contexts to care about.
288 Simple case: client, `client_ctx`
289 As a client, we can be doing a callout or cut-through delivery while receiving
290 a message. So we have a client context, which should have options initialised
291 from the SMTP Transport. We may also concurrently want to make TLS connections
292 to utility daemons, so client-contexts are allocated and passed around in call
293 args rather than using a gobal.
296 There are two cases: with and without ServerNameIndication from the client.
297 Given TLS SNI, we can be using different keys, certs and various other
298 configuration settings, because they're re-expanded with $tls_sni set. This
299 allows vhosting with TLS. This SNI is sent in the handshake.
300 A client might not send SNI, so we need a fallback, and an initial setup too.
301 So as a server, we start out using `server_ctx`.
302 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
303 `server_sni` from `server_ctx` and then initialise settings by re-expanding
311 } exim_openssl_client_tls_ctx
;
313 static SSL_CTX
*server_ctx
= NULL
;
314 static SSL
*server_ssl
= NULL
;
316 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
317 static SSL_CTX
*server_sni
= NULL
;
320 static char ssl_errstring
[256];
322 static int ssl_session_timeout
= 7200; /* Two hours */
323 static BOOL client_verify_optional
= FALSE
;
324 static BOOL server_verify_optional
= FALSE
;
326 static BOOL reexpand_tls_files_for_sni
= FALSE
;
329 typedef struct ocsp_resp
{
330 struct ocsp_resp
* next
;
331 OCSP_RESPONSE
* resp
;
334 typedef struct tls_ext_ctx_cb
{
340 STACK_OF(X509
) *verify_stack
; /* chain for verifying the proof */
344 const uschar
*file_expanded
;
345 ocsp_resplist
*olist
;
348 X509_STORE
*verify_store
; /* non-null if status requested */
349 BOOL verify_required
;
354 /* these are cached from first expand */
355 uschar
*server_cipher_list
;
356 /* only passed down to tls_error: */
358 const uschar
* verify_cert_hostnames
;
359 #ifndef DISABLE_EVENT
360 uschar
* event_action
;
364 /* should figure out a cleanup of API to handle state preserved per
365 implementation, for various reasons, which can be void * in the APIs.
366 For now, we hack around it. */
367 tls_ext_ctx_cb
*client_static_cbinfo
= NULL
; /*XXX should not use static; multiple concurrent clients! */
368 tls_ext_ctx_cb
*server_static_cbinfo
= NULL
;
371 setup_certs(SSL_CTX
*sctx
, uschar
*certs
, uschar
*crl
, host_item
*host
, BOOL optional
,
372 int (*cert_vfy_cb
)(int, X509_STORE_CTX
*), uschar
** errstr
);
375 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
376 static int tls_servername_cb(SSL
*s
, int *ad ARG_UNUSED
, void *arg
);
379 static int tls_server_stapling_cb(SSL
*s
, void *arg
);
384 /* Daemon-called, before every connection, key create/rotate */
385 #ifdef EXPERIMENTAL_TLS_RESUME
386 static void tk_init(void);
387 static int tls_exdata_idx
= -1;
391 tls_daemon_init(void)
393 #ifdef EXPERIMENTAL_TLS_RESUME
400 /*************************************************
402 *************************************************/
404 /* Called from lots of places when errors occur before actually starting to do
405 the TLS handshake, that is, while the session is still in clear. Always returns
406 DEFER for a server and FAIL for a client so that most calls can use "return
407 tls_error(...)" to do this processing and then give an appropriate return. A
408 single function is used for both server and client, because it is called from
409 some shared functions.
412 prefix text to include in the logged error
413 host NULL if setting up a server;
414 the connected host if setting up a client
415 msg error message or NULL if we should ask OpenSSL
416 errstr pointer to output error message
418 Returns: OK/DEFER/FAIL
422 tls_error(uschar
* prefix
, const host_item
* host
, uschar
* msg
, uschar
** errstr
)
426 ERR_error_string_n(ERR_get_error(), ssl_errstring
, sizeof(ssl_errstring
));
427 msg
= US ssl_errstring
;
430 msg
= string_sprintf("(%s): %s", prefix
, msg
);
431 DEBUG(D_tls
) debug_printf("TLS error '%s'\n", msg
);
432 if (errstr
) *errstr
= msg
;
433 return host
? FAIL
: DEFER
;
438 /*************************************************
439 * Callback to generate RSA key *
440 *************************************************/
444 s SSL connection (not used)
448 Returns: pointer to generated key
452 rsa_callback(SSL
*s
, int export
, int keylength
)
455 #ifdef EXIM_HAVE_RSA_GENKEY_EX
456 BIGNUM
*bn
= BN_new();
459 export
= export
; /* Shut picky compilers up */
460 DEBUG(D_tls
) debug_printf("Generating %d bit RSA key...\n", keylength
);
462 #ifdef EXIM_HAVE_RSA_GENKEY_EX
463 if ( !BN_set_word(bn
, (unsigned long)RSA_F4
)
464 || !(rsa_key
= RSA_new())
465 || !RSA_generate_key_ex(rsa_key
, keylength
, bn
, NULL
)
468 if (!(rsa_key
= RSA_generate_key(keylength
, RSA_F4
, NULL
, NULL
)))
472 ERR_error_string_n(ERR_get_error(), ssl_errstring
, sizeof(ssl_errstring
));
473 log_write(0, LOG_MAIN
|LOG_PANIC
, "TLS error (RSA_generate_key): %s",
485 x509_store_dump_cert_s_names(X509_STORE * store)
487 STACK_OF(X509_OBJECT) * roots= store->objs;
488 static uschar name[256];
490 for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
492 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
493 if(tmp_obj->type == X509_LU_X509)
495 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
496 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
498 name[sizeof(name)-1] = '\0';
499 debug_printf(" %s\n", name);
508 #ifndef DISABLE_EVENT
510 verify_event(tls_support
* tlsp
, X509
* cert
, int depth
, const uschar
* dn
,
511 BOOL
*calledp
, const BOOL
*optionalp
, const uschar
* what
)
517 ev
= tlsp
== &tls_out
? client_static_cbinfo
->event_action
: event_action
;
520 DEBUG(D_tls
) debug_printf("verify_event: %s %d\n", what
, depth
);
521 old_cert
= tlsp
->peercert
;
522 tlsp
->peercert
= X509_dup(cert
);
523 /* NB we do not bother setting peerdn */
524 if ((yield
= event_raise(ev
, US
"tls:cert", string_sprintf("%d", depth
))))
526 log_write(0, LOG_MAIN
, "[%s] %s verify denied by event-action: "
527 "depth=%d cert=%s: %s",
528 tlsp
== &tls_out
? deliver_host_address
: sender_host_address
,
529 what
, depth
, dn
, yield
);
533 if (old_cert
) tlsp
->peercert
= old_cert
; /* restore 1st failing cert */
534 return 1; /* reject (leaving peercert set) */
536 DEBUG(D_tls
) debug_printf("Event-action verify failure overridden "
537 "(host in tls_try_verify_hosts)\n");
538 tlsp
->verify_override
= TRUE
;
540 X509_free(tlsp
->peercert
);
541 tlsp
->peercert
= old_cert
;
547 /*************************************************
548 * Callback for verification *
549 *************************************************/
551 /* The SSL library does certificate verification if set up to do so. This
552 callback has the current yes/no state is in "state". If verification succeeded,
553 we set the certificate-verified flag. If verification failed, what happens
554 depends on whether the client is required to present a verifiable certificate
557 If verification is optional, we change the state to yes, but still log the
558 verification error. For some reason (it really would help to have proper
559 documentation of OpenSSL), this callback function then gets called again, this
560 time with state = 1. We must take care not to set the private verified flag on
561 the second time through.
563 Note: this function is not called if the client fails to present a certificate
564 when asked. We get here only if a certificate has been received. Handling of
565 optional verification for this case is done when requesting SSL to verify, by
566 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
568 May be called multiple times for different issues with a certificate, even
569 for a given "depth" in the certificate chain.
572 preverify_ok current yes/no state as 1/0
573 x509ctx certificate information.
574 tlsp per-direction (client vs. server) support data
575 calledp has-been-called flag
576 optionalp verification-is-optional flag
578 Returns: 0 if verification should fail, otherwise 1
582 verify_callback(int preverify_ok
, X509_STORE_CTX
* x509ctx
,
583 tls_support
* tlsp
, BOOL
* calledp
, BOOL
* optionalp
)
585 X509
* cert
= X509_STORE_CTX_get_current_cert(x509ctx
);
586 int depth
= X509_STORE_CTX_get_error_depth(x509ctx
);
589 if (!X509_NAME_oneline(X509_get_subject_name(cert
), CS dn
, sizeof(dn
)))
591 DEBUG(D_tls
) debug_printf("X509_NAME_oneline() error\n");
592 log_write(0, LOG_MAIN
, "[%s] SSL verify error: internal error",
593 tlsp
== &tls_out
? deliver_host_address
: sender_host_address
);
596 dn
[sizeof(dn
)-1] = '\0';
598 tlsp
->verify_override
= FALSE
;
599 if (preverify_ok
== 0)
601 uschar
* extra
= verify_mode
? string_sprintf(" (during %c-verify for [%s])",
602 *verify_mode
, sender_host_address
)
604 log_write(0, LOG_MAIN
, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
605 tlsp
== &tls_out
? deliver_host_address
: sender_host_address
,
607 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx
)), dn
);
612 tlsp
->peercert
= X509_dup(cert
); /* record failing cert */
613 return 0; /* reject */
615 DEBUG(D_tls
) debug_printf("SSL verify failure overridden (host in "
616 "tls_try_verify_hosts)\n");
617 tlsp
->verify_override
= TRUE
;
622 DEBUG(D_tls
) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth
, dn
);
624 if (tlsp
== &tls_out
&& client_static_cbinfo
->u_ocsp
.client
.verify_store
)
625 { /* client, wanting stapling */
626 /* Add the server cert's signing chain as the one
627 for the verification of the OCSP stapled information. */
629 if (!X509_STORE_add_cert(client_static_cbinfo
->u_ocsp
.client
.verify_store
,
632 sk_X509_push(client_static_cbinfo
->verify_stack
, cert
);
635 #ifndef DISABLE_EVENT
636 if (verify_event(tlsp
, cert
, depth
, dn
, calledp
, optionalp
, US
"SSL"))
637 return 0; /* reject, with peercert set */
642 const uschar
* verify_cert_hostnames
;
644 if ( tlsp
== &tls_out
645 && ((verify_cert_hostnames
= client_static_cbinfo
->verify_cert_hostnames
)))
646 /* client, wanting hostname check */
649 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
650 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
651 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
653 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
654 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
657 const uschar
* list
= verify_cert_hostnames
;
660 while ((name
= string_nextinlist(&list
, &sep
, NULL
, 0)))
661 if ((rc
= X509_check_host(cert
, CCS name
, 0,
662 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
663 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
,
668 log_write(0, LOG_MAIN
, "[%s] SSL verify error: internal error",
669 tlsp
== &tls_out
? deliver_host_address
: sender_host_address
);
676 if (!tls_is_name_for_cert(verify_cert_hostnames
, cert
))
679 uschar
* extra
= verify_mode
680 ? string_sprintf(" (during %c-verify for [%s])",
681 *verify_mode
, sender_host_address
)
683 log_write(0, LOG_MAIN
,
684 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
685 tlsp
== &tls_out
? deliver_host_address
: sender_host_address
,
686 extra
, dn
, verify_cert_hostnames
);
691 tlsp
->peercert
= X509_dup(cert
); /* record failing cert */
692 return 0; /* reject */
694 DEBUG(D_tls
) debug_printf("SSL verify name failure overridden (host in "
695 "tls_try_verify_hosts)\n");
696 tlsp
->verify_override
= TRUE
;
700 #ifndef DISABLE_EVENT
701 if (verify_event(tlsp
, cert
, depth
, dn
, calledp
, optionalp
, US
"SSL"))
702 return 0; /* reject, with peercert set */
705 DEBUG(D_tls
) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
706 *calledp
? "" : " authenticated", dn
);
710 return 1; /* accept, at least for this level */
714 verify_callback_client(int preverify_ok
, X509_STORE_CTX
*x509ctx
)
716 return verify_callback(preverify_ok
, x509ctx
, &tls_out
,
717 &client_verify_callback_called
, &client_verify_optional
);
721 verify_callback_server(int preverify_ok
, X509_STORE_CTX
*x509ctx
)
723 return verify_callback(preverify_ok
, x509ctx
, &tls_in
,
724 &server_verify_callback_called
, &server_verify_optional
);
730 /* This gets called *by* the dane library verify callback, which interposes
734 verify_callback_client_dane(int preverify_ok
, X509_STORE_CTX
* x509ctx
)
736 X509
* cert
= X509_STORE_CTX_get_current_cert(x509ctx
);
738 int depth
= X509_STORE_CTX_get_error_depth(x509ctx
);
739 #ifndef DISABLE_EVENT
740 BOOL dummy_called
, optional
= FALSE
;
743 if (!X509_NAME_oneline(X509_get_subject_name(cert
), CS dn
, sizeof(dn
)))
745 DEBUG(D_tls
) debug_printf("X509_NAME_oneline() error\n");
746 log_write(0, LOG_MAIN
, "[%s] SSL verify error: internal error",
747 deliver_host_address
);
750 dn
[sizeof(dn
)-1] = '\0';
752 DEBUG(D_tls
) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
753 preverify_ok
? "ok":"BAD", depth
, dn
);
755 #ifndef DISABLE_EVENT
756 if (verify_event(&tls_out
, cert
, depth
, dn
,
757 &dummy_called
, &optional
, US
"DANE"))
758 return 0; /* reject, with peercert set */
761 if (preverify_ok
== 1)
763 tls_out
.dane_verified
= TRUE
;
765 if (client_static_cbinfo
->u_ocsp
.client
.verify_store
)
766 { /* client, wanting stapling */
767 /* Add the server cert's signing chain as the one
768 for the verification of the OCSP stapled information. */
770 if (!X509_STORE_add_cert(client_static_cbinfo
->u_ocsp
.client
.verify_store
,
773 sk_X509_push(client_static_cbinfo
->verify_stack
, cert
);
779 int err
= X509_STORE_CTX_get_error(x509ctx
);
781 debug_printf(" - err %d '%s'\n", err
, X509_verify_cert_error_string(err
));
782 if (err
== X509_V_ERR_APPLICATION_VERIFICATION
)
788 #endif /*SUPPORT_DANE*/
791 /*************************************************
792 * Information callback *
793 *************************************************/
795 /* The SSL library functions call this from time to time to indicate what they
796 are doing. We copy the string to the debugging output when TLS debugging has
808 info_callback(SSL
*s
, int where
, int ret
)
814 if (where
& SSL_ST_CONNECT
)
815 str
= US
"SSL_connect";
816 else if (where
& SSL_ST_ACCEPT
)
817 str
= US
"SSL_accept";
819 str
= US
"SSL info (undefined)";
821 if (where
& SSL_CB_LOOP
)
822 debug_printf("%s: %s\n", str
, SSL_state_string_long(s
));
823 else if (where
& SSL_CB_ALERT
)
824 debug_printf("SSL3 alert %s:%s:%s\n",
825 str
= where
& SSL_CB_READ
? US
"read" : US
"write",
826 SSL_alert_type_string_long(ret
), SSL_alert_desc_string_long(ret
));
827 else if (where
& SSL_CB_EXIT
)
829 debug_printf("%s: failed in %s\n", str
, SSL_state_string_long(s
));
831 debug_printf("%s: error in %s\n", str
, SSL_state_string_long(s
));
832 else if (where
& SSL_CB_HANDSHAKE_START
)
833 debug_printf("%s: hshake start: %s\n", str
, SSL_state_string_long(s
));
834 else if (where
& SSL_CB_HANDSHAKE_DONE
)
835 debug_printf("%s: hshake done: %s\n", str
, SSL_state_string_long(s
));
839 #ifdef OPENSSL_HAVE_KEYLOG_CB
841 keylog_callback(const SSL
*ssl
, const char *line
)
843 DEBUG(D_tls
) debug_printf("%.200s\n", line
);
848 #ifdef EXPERIMENTAL_TLS_RESUME
849 /* Manage the keysets used for encrypting the session tickets, on the server. */
851 typedef struct { /* Session ticket encryption key */
854 const EVP_CIPHER
* aes_cipher
;
855 uschar aes_key
[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
856 const EVP_MD
* hmac_hash
;
862 static exim_stek exim_tk
; /* current key */
863 static exim_stek exim_tk_old
; /* previous key */
868 time_t t
= time(NULL
);
872 if (exim_tk
.renew
>= t
) return;
873 exim_tk_old
= exim_tk
;
876 if (f
.running_in_test_harness
) ssl_session_timeout
= 6;
878 DEBUG(D_tls
) debug_printf("OpenSSL: %s STEK\n", exim_tk
.name
[0] ? "rotating" : "creating");
879 if (RAND_bytes(exim_tk
.aes_key
, sizeof(exim_tk
.aes_key
)) <= 0) return;
880 if (RAND_bytes(exim_tk
.hmac_key
, sizeof(exim_tk
.hmac_key
)) <= 0) return;
881 if (RAND_bytes(exim_tk
.name
+1, sizeof(exim_tk
.name
)-1) <= 0) return;
883 exim_tk
.name
[0] = 'E';
884 exim_tk
.aes_cipher
= EVP_aes_256_cbc();
885 exim_tk
.hmac_hash
= EVP_sha256();
886 exim_tk
.expire
= t
+ ssl_session_timeout
;
887 exim_tk
.renew
= t
+ ssl_session_timeout
/2;
893 if (!exim_tk
.name
[0]) return NULL
;
898 tk_find(const uschar
* name
)
900 return memcmp(name
, exim_tk
.name
, sizeof(exim_tk
.name
)) == 0 ? &exim_tk
901 : memcmp(name
, exim_tk_old
.name
, sizeof(exim_tk_old
.name
)) == 0 ? &exim_tk_old
905 /* Callback for session tickets, on server */
907 ticket_key_callback(SSL
* ssl
, uschar key_name
[16],
908 uschar
* iv
, EVP_CIPHER_CTX
* ctx
, HMAC_CTX
* hctx
, int enc
)
910 tls_support
* tlsp
= server_static_cbinfo
->tlsp
;
915 DEBUG(D_tls
) debug_printf("ticket_key_callback: create new session\n");
916 tlsp
->resumption
|= RESUME_CLIENT_REQUESTED
;
918 if (RAND_bytes(iv
, EVP_MAX_IV_LENGTH
) <= 0)
919 return -1; /* insufficient random */
921 if (!(key
= tk_current())) /* current key doesn't exist or isn't valid */
922 return 0; /* key couldn't be created */
923 memcpy(key_name
, key
->name
, 16);
924 DEBUG(D_tls
) debug_printf("STEK expire " TIME_T_FMT
"\n", key
->expire
- time(NULL
));
926 /*XXX will want these dependent on the ssl session strength */
927 HMAC_Init_ex(hctx
, key
->hmac_key
, sizeof(key
->hmac_key
),
928 key
->hmac_hash
, NULL
);
929 EVP_EncryptInit_ex(ctx
, key
->aes_cipher
, NULL
, key
->aes_key
, iv
);
931 DEBUG(D_tls
) debug_printf("ticket created\n");
936 time_t now
= time(NULL
);
938 DEBUG(D_tls
) debug_printf("ticket_key_callback: retrieve session\n");
939 tlsp
->resumption
|= RESUME_CLIENT_SUGGESTED
;
941 if (!(key
= tk_find(key_name
)) || key
->expire
< now
)
945 debug_printf("ticket not usable (%s)\n", key
? "expired" : "not found");
946 if (key
) debug_printf("STEK expire " TIME_T_FMT
"\n", key
->expire
- now
);
951 HMAC_Init_ex(hctx
, key
->hmac_key
, sizeof(key
->hmac_key
),
952 key
->hmac_hash
, NULL
);
953 EVP_DecryptInit_ex(ctx
, key
->aes_cipher
, NULL
, key
->aes_key
, iv
);
955 DEBUG(D_tls
) debug_printf("ticket usable, STEK expire " TIME_T_FMT
"\n", key
->expire
- now
);
957 /* The ticket lifetime and renewal are the same as the STEK lifetime and
958 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
959 be better. To do that we'd have to encode ticket lifetime in the name as
960 we don't yet see the restored session. Could check posthandshake for TLS1.3
961 and trigger a new ticket then, but cannot do that for TLS1.2 */
962 return key
->renew
< now
? 2 : 1;
969 /*************************************************
970 * Initialize for DH *
971 *************************************************/
973 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
976 sctx The current SSL CTX (inbound or outbound)
977 dhparam DH parameter file or fixed parameter identity string
978 host connected host, if client; NULL if server
979 errstr error string pointer
981 Returns: TRUE if OK (nothing to set up, or setup worked)
985 init_dh(SSL_CTX
*sctx
, uschar
*dhparam
, const host_item
*host
, uschar
** errstr
)
993 if (!expand_check(dhparam
, US
"tls_dhparam", &dhexpanded
, errstr
))
996 if (!dhexpanded
|| !*dhexpanded
)
997 bio
= BIO_new_mem_buf(CS
std_dh_prime_default(), -1);
998 else if (dhexpanded
[0] == '/')
1000 if (!(bio
= BIO_new_file(CS dhexpanded
, "r")))
1002 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded
),
1003 host
, US
strerror(errno
), errstr
);
1009 if (Ustrcmp(dhexpanded
, "none") == 0)
1011 DEBUG(D_tls
) debug_printf("Requested no DH parameters.\n");
1015 if (!(pem
= std_dh_prime_named(dhexpanded
)))
1017 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded
),
1018 host
, US
strerror(errno
), errstr
);
1021 bio
= BIO_new_mem_buf(CS pem
, -1);
1024 if (!(dh
= PEM_read_bio_DHparams(bio
, NULL
, NULL
, NULL
)))
1027 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded
),
1028 host
, NULL
, errstr
);
1032 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
1033 * an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with
1034 * 2236. But older OpenSSL can only report in bytes (octets), not bits.
1035 * If someone wants to dance at the edge, then they can raise the limit or use
1036 * current libraries. */
1037 #ifdef EXIM_HAVE_OPENSSL_DH_BITS
1038 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
1039 * This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
1040 dh_bitsize
= DH_bits(dh
);
1042 dh_bitsize
= 8 * DH_size(dh
);
1045 /* Even if it is larger, we silently return success rather than cause things
1046 * to fail out, so that a too-large DH will not knock out all TLS; it's a
1047 * debatable choice. */
1048 if (dh_bitsize
> tls_dh_max_bits
)
1051 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d\n",
1052 dh_bitsize
, tls_dh_max_bits
);
1056 SSL_CTX_set_tmp_dh(sctx
, dh
);
1058 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
1059 dhexpanded
? dhexpanded
: US
"default", dh_bitsize
);
1071 /*************************************************
1072 * Initialize for ECDH *
1073 *************************************************/
1075 /* Load parameters for ECDH encryption.
1077 For now, we stick to NIST P-256 because: it's simple and easy to configure;
1078 it avoids any patent issues that might bite redistributors; despite events in
1079 the news and concerns over curve choices, we're not cryptographers, we're not
1080 pretending to be, and this is "good enough" to be better than no support,
1081 protecting against most adversaries. Given another year or two, there might
1082 be sufficient clarity about a "right" way forward to let us make an informed
1083 decision, instead of a knee-jerk reaction.
1085 Longer-term, we should look at supporting both various named curves and
1086 external files generated with "openssl ecparam", much as we do for init_dh().
1087 We should also support "none" as a value, to explicitly avoid initialisation.
1092 sctx The current SSL CTX (inbound or outbound)
1093 host connected host, if client; NULL if server
1094 errstr error string pointer
1096 Returns: TRUE if OK (nothing to set up, or setup worked)
1100 init_ecdh(SSL_CTX
* sctx
, host_item
* host
, uschar
** errstr
)
1102 #ifdef OPENSSL_NO_ECDH
1111 if (host
) /* No ECDH setup for clients, only for servers */
1114 # ifndef EXIM_HAVE_ECDH
1116 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
1120 if (!expand_check(tls_eccurve
, US
"tls_eccurve", &exp_curve
, errstr
))
1122 if (!exp_curve
|| !*exp_curve
)
1125 /* "auto" needs to be handled carefully.
1126 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
1127 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
1128 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
1129 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
1130 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
1132 if (Ustrcmp(exp_curve
, "auto") == 0)
1134 #if OPENSSL_VERSION_NUMBER < 0x10002000L
1135 DEBUG(D_tls
) debug_printf(
1136 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
1137 exp_curve
= US
"prime256v1";
1139 # if defined SSL_CTRL_SET_ECDH_AUTO
1140 DEBUG(D_tls
) debug_printf(
1141 "ECDH OpenSSL 1.0.2+ temp key parameter settings: autoselection\n");
1142 SSL_CTX_set_ecdh_auto(sctx
, 1);
1145 DEBUG(D_tls
) debug_printf(
1146 "ECDH OpenSSL 1.1.0+ temp key parameter settings: default selection\n");
1152 DEBUG(D_tls
) debug_printf("ECDH: curve '%s'\n", exp_curve
);
1153 if ( (nid
= OBJ_sn2nid (CCS exp_curve
)) == NID_undef
1154 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
1155 && (nid
= EC_curve_nist2nid(CCS exp_curve
)) == NID_undef
1159 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve
),
1160 host
, NULL
, errstr
);
1164 if (!(ecdh
= EC_KEY_new_by_curve_name(nid
)))
1166 tls_error(US
"Unable to create ec curve", host
, NULL
, errstr
);
1170 /* The "tmp" in the name here refers to setting a temporary key
1171 not to the stability of the interface. */
1173 if ((rv
= SSL_CTX_set_tmp_ecdh(sctx
, ecdh
) == 0))
1174 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve
), host
, NULL
, errstr
);
1176 DEBUG(D_tls
) debug_printf("ECDH: enabled '%s' curve\n", exp_curve
);
1181 # endif /*EXIM_HAVE_ECDH*/
1182 #endif /*OPENSSL_NO_ECDH*/
1188 #ifndef DISABLE_OCSP
1189 /*************************************************
1190 * Load OCSP information into state *
1191 *************************************************/
1192 /* Called to load the server OCSP response from the given file into memory, once
1193 caller has determined this is needed. Checks validity. Debugs a message
1196 ASSUMES: single response, for single cert.
1199 sctx the SSL_CTX* to update
1200 cbinfo various parts of session state
1201 filename the filename putatively holding an OCSP response
1206 ocsp_load_response(SSL_CTX
* sctx
, tls_ext_ctx_cb
* cbinfo
,
1207 const uschar
* filename
)
1210 OCSP_RESPONSE
* resp
;
1211 OCSP_BASICRESP
* basic_response
;
1212 OCSP_SINGLERESP
* single_response
;
1213 ASN1_GENERALIZEDTIME
* rev
, * thisupd
, * nextupd
;
1214 STACK_OF(X509
) * sk
;
1215 unsigned long verify_flags
;
1216 int status
, reason
, i
;
1218 DEBUG(D_tls
) debug_printf("tls_ocsp_file '%s'\n", filename
);
1220 if (!(bio
= BIO_new_file(CS filename
, "rb")))
1222 DEBUG(D_tls
) debug_printf("Failed to open OCSP response file \"%s\"\n",
1227 resp
= d2i_OCSP_RESPONSE_bio(bio
, NULL
);
1231 DEBUG(D_tls
) debug_printf("Error reading OCSP response.\n");
1235 if ((status
= OCSP_response_status(resp
)) != OCSP_RESPONSE_STATUS_SUCCESSFUL
)
1237 DEBUG(D_tls
) debug_printf("OCSP response not valid: %s (%d)\n",
1238 OCSP_response_status_str(status
), status
);
1244 BIO
* bp
= BIO_new_fp(debug_file
, BIO_NOCLOSE
);
1245 OCSP_RESPONSE_print(bp
, resp
, 0); /* extreme debug: stapling content */
1250 if (!(basic_response
= OCSP_response_get1_basic(resp
)))
1253 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1257 sk
= cbinfo
->verify_stack
;
1258 verify_flags
= OCSP_NOVERIFY
; /* check sigs, but not purpose */
1260 /* May need to expose ability to adjust those flags?
1261 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1262 OCSP_TRUSTOTHER OCSP_NOINTERN */
1264 /* This does a full verify on the OCSP proof before we load it for serving
1265 up; possibly overkill - just date-checks might be nice enough.
1267 OCSP_basic_verify takes a "store" arg, but does not
1268 use it for the chain verification, which is all we do
1269 when OCSP_NOVERIFY is set. The content from the wire
1270 "basic_response" and a cert-stack "sk" are all that is used.
1272 We have a stack, loaded in setup_certs() if tls_verify_certificates
1273 was a file (not a directory, or "system"). It is unfortunate we
1274 cannot used the connection context store, as that would neatly
1275 handle the "system" case too, but there seems to be no library
1276 function for getting a stack from a store.
1277 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1278 We do not free the stack since it could be needed a second time for
1281 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1282 be a public interface into the OpenSSL library (there's no manual entry) -
1283 But what with? We also use OCSP_basic_verify in the client stapling callback.
1284 And there we NEED it; we must verify that status... unless the
1285 library does it for us anyway? */
1287 if ((i
= OCSP_basic_verify(basic_response
, sk
, NULL
, verify_flags
)) < 0)
1291 ERR_error_string_n(ERR_get_error(), ssl_errstring
, sizeof(ssl_errstring
));
1292 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring
);
1297 /* Here's the simplifying assumption: there's only one response, for the
1298 one certificate we use, and nothing for anything else in a chain. If this
1299 proves false, we need to extract a cert id from our issued cert
1300 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1301 right cert in the stack and then calls OCSP_single_get0_status()).
1303 I'm hoping to avoid reworking a bunch more of how we handle state here.
1305 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1308 if (!(single_response
= OCSP_resp_get0(basic_response
, 0)))
1311 debug_printf("Unable to get first response from OCSP basic response.\n");
1315 status
= OCSP_single_get0_status(single_response
, &reason
, &rev
, &thisupd
, &nextupd
);
1316 if (status
!= V_OCSP_CERTSTATUS_GOOD
)
1318 DEBUG(D_tls
) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1319 OCSP_cert_status_str(status
), status
,
1320 OCSP_crl_reason_str(reason
), reason
);
1324 if (!OCSP_check_validity(thisupd
, nextupd
, EXIM_OCSP_SKEW_SECONDS
, EXIM_OCSP_MAX_AGE
))
1326 DEBUG(D_tls
) debug_printf("OCSP status invalid times.\n");
1331 /* Add the resp to the list used by tls_server_stapling_cb() */
1333 ocsp_resplist
** op
= &cbinfo
->u_ocsp
.server
.olist
, * oentry
;
1334 while (oentry
= *op
)
1336 *op
= oentry
= store_get(sizeof(ocsp_resplist
), FALSE
);
1337 oentry
->next
= NULL
;
1338 oentry
->resp
= resp
;
1343 if (f
.running_in_test_harness
)
1345 extern char ** environ
;
1346 if (environ
) for (uschar
** p
= USS environ
; *p
; p
++)
1347 if (Ustrncmp(*p
, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1349 DEBUG(D_tls
) debug_printf("Supplying known bad OCSP response\n");
1350 goto supply_response
;
1358 ocsp_free_response_list(tls_ext_ctx_cb
* cbinfo
)
1360 for (ocsp_resplist
* olist
= cbinfo
->u_ocsp
.server
.olist
; olist
;
1361 olist
= olist
->next
)
1362 OCSP_RESPONSE_free(olist
->resp
);
1363 cbinfo
->u_ocsp
.server
.olist
= NULL
;
1365 #endif /*!DISABLE_OCSP*/
1370 /* Create and install a selfsigned certificate, for use in server mode */
1373 tls_install_selfsign(SSL_CTX
* sctx
, uschar
** errstr
)
1381 where
= US
"allocating pkey";
1382 if (!(pkey
= EVP_PKEY_new()))
1385 where
= US
"allocating cert";
1386 if (!(x509
= X509_new()))
1389 where
= US
"generating pkey";
1390 if (!(rsa
= rsa_callback(NULL
, 0, 2048)))
1393 where
= US
"assigning pkey";
1394 if (!EVP_PKEY_assign_RSA(pkey
, rsa
))
1397 X509_set_version(x509
, 2); /* N+1 - version 3 */
1398 ASN1_INTEGER_set(X509_get_serialNumber(x509
), 1);
1399 X509_gmtime_adj(X509_get_notBefore(x509
), 0);
1400 X509_gmtime_adj(X509_get_notAfter(x509
), (long)60 * 60); /* 1 hour */
1401 X509_set_pubkey(x509
, pkey
);
1403 name
= X509_get_subject_name(x509
);
1404 X509_NAME_add_entry_by_txt(name
, "C",
1405 MBSTRING_ASC
, CUS
"UK", -1, -1, 0);
1406 X509_NAME_add_entry_by_txt(name
, "O",
1407 MBSTRING_ASC
, CUS
"Exim Developers", -1, -1, 0);
1408 X509_NAME_add_entry_by_txt(name
, "CN",
1409 MBSTRING_ASC
, CUS smtp_active_hostname
, -1, -1, 0);
1410 X509_set_issuer_name(x509
, name
);
1412 where
= US
"signing cert";
1413 if (!X509_sign(x509
, pkey
, EVP_md5()))
1416 where
= US
"installing selfsign cert";
1417 if (!SSL_CTX_use_certificate(sctx
, x509
))
1420 where
= US
"installing selfsign key";
1421 if (!SSL_CTX_use_PrivateKey(sctx
, pkey
))
1427 (void) tls_error(where
, NULL
, NULL
, errstr
);
1428 if (x509
) X509_free(x509
);
1429 if (pkey
) EVP_PKEY_free(pkey
);
1437 tls_add_certfile(SSL_CTX
* sctx
, tls_ext_ctx_cb
* cbinfo
, uschar
* file
,
1440 DEBUG(D_tls
) debug_printf("tls_certificate file '%s'\n", file
);
1441 if (!SSL_CTX_use_certificate_chain_file(sctx
, CS file
))
1442 return tls_error(string_sprintf(
1443 "SSL_CTX_use_certificate_chain_file file=%s", file
),
1444 cbinfo
->host
, NULL
, errstr
);
1449 tls_add_pkeyfile(SSL_CTX
* sctx
, tls_ext_ctx_cb
* cbinfo
, uschar
* file
,
1452 DEBUG(D_tls
) debug_printf("tls_privatekey file '%s'\n", file
);
1453 if (!SSL_CTX_use_PrivateKey_file(sctx
, CS file
, SSL_FILETYPE_PEM
))
1454 return tls_error(string_sprintf(
1455 "SSL_CTX_use_PrivateKey_file file=%s", file
), cbinfo
->host
, NULL
, errstr
);
1460 /*************************************************
1461 * Expand key and cert file specs *
1462 *************************************************/
1464 /* Called once during tls_init and possibly again during TLS setup, for a
1465 new context, if Server Name Indication was used and tls_sni was seen in
1466 the certificate string.
1469 sctx the SSL_CTX* to update
1470 cbinfo various parts of session state
1471 errstr error string pointer
1473 Returns: OK/DEFER/FAIL
1477 tls_expand_session_files(SSL_CTX
* sctx
, tls_ext_ctx_cb
* cbinfo
,
1482 if (!cbinfo
->certificate
)
1484 if (!cbinfo
->is_server
) /* client */
1487 if (tls_install_selfsign(sctx
, errstr
) != OK
)
1494 if ( !reexpand_tls_files_for_sni
1495 && ( Ustrstr(cbinfo
->certificate
, US
"tls_sni")
1496 || Ustrstr(cbinfo
->certificate
, US
"tls_in_sni")
1497 || Ustrstr(cbinfo
->certificate
, US
"tls_out_sni")
1499 reexpand_tls_files_for_sni
= TRUE
;
1501 if (!expand_check(cbinfo
->certificate
, US
"tls_certificate", &expanded
, errstr
))
1505 if (cbinfo
->is_server
)
1507 const uschar
* file_list
= expanded
;
1510 #ifndef DISABLE_OCSP
1511 const uschar
* olist
= cbinfo
->u_ocsp
.server
.file
;
1516 if (!expand_check(olist
, US
"tls_ocsp_file", USS
&olist
, errstr
))
1518 if (olist
&& !*olist
)
1521 if ( cbinfo
->u_ocsp
.server
.file_expanded
&& olist
1522 && (Ustrcmp(olist
, cbinfo
->u_ocsp
.server
.file_expanded
) == 0))
1524 DEBUG(D_tls
) debug_printf(" - value unchanged, using existing values\n");
1529 ocsp_free_response_list(cbinfo
);
1530 cbinfo
->u_ocsp
.server
.file_expanded
= olist
;
1534 while (file
= string_nextinlist(&file_list
, &sep
, NULL
, 0))
1536 if ((err
= tls_add_certfile(sctx
, cbinfo
, file
, errstr
)))
1539 #ifndef DISABLE_OCSP
1541 if ((ofile
= string_nextinlist(&olist
, &osep
, NULL
, 0)))
1542 ocsp_load_response(sctx
, cbinfo
, ofile
);
1544 DEBUG(D_tls
) debug_printf("ran out of ocsp file list\n");
1548 else /* would there ever be a need for multiple client certs? */
1549 if ((err
= tls_add_certfile(sctx
, cbinfo
, expanded
, errstr
)))
1552 if ( cbinfo
->privatekey
1553 && !expand_check(cbinfo
->privatekey
, US
"tls_privatekey", &expanded
, errstr
))
1556 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1557 of the expansion is an empty string, ignore it also, and assume the private
1558 key is in the same file as the certificate. */
1560 if (expanded
&& *expanded
)
1561 if (cbinfo
->is_server
)
1563 const uschar
* file_list
= expanded
;
1567 while (file
= string_nextinlist(&file_list
, &sep
, NULL
, 0))
1568 if ((err
= tls_add_pkeyfile(sctx
, cbinfo
, file
, errstr
)))
1571 else /* would there ever be a need for multiple client certs? */
1572 if ((err
= tls_add_pkeyfile(sctx
, cbinfo
, expanded
, errstr
)))
1582 /*************************************************
1583 * Callback to handle SNI *
1584 *************************************************/
1586 /* Called when acting as server during the TLS session setup if a Server Name
1587 Indication extension was sent by the client.
1589 API documentation is OpenSSL s_server.c implementation.
1592 s SSL* of the current session
1593 ad unknown (part of OpenSSL API) (unused)
1594 arg Callback of "our" registered data
1596 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
1598 XXX might need to change to using ClientHello callback,
1599 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
1602 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1604 tls_servername_cb(SSL
*s
, int *ad ARG_UNUSED
, void *arg
)
1606 const char *servername
= SSL_get_servername(s
, TLSEXT_NAMETYPE_host_name
);
1607 tls_ext_ctx_cb
*cbinfo
= (tls_ext_ctx_cb
*) arg
;
1609 int old_pool
= store_pool
;
1610 uschar
* dummy_errstr
;
1613 return SSL_TLSEXT_ERR_OK
;
1615 DEBUG(D_tls
) debug_printf("Received TLS SNI \"%s\"%s\n", servername
,
1616 reexpand_tls_files_for_sni
? "" : " (unused for certificate selection)");
1618 /* Make the extension value available for expansion */
1619 store_pool
= POOL_PERM
;
1620 tls_in
.sni
= string_copy_taint(US servername
, TRUE
);
1621 store_pool
= old_pool
;
1623 if (!reexpand_tls_files_for_sni
)
1624 return SSL_TLSEXT_ERR_OK
;
1626 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1627 not confident that memcpy wouldn't break some internal reference counting.
1628 Especially since there's a references struct member, which would be off. */
1630 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1631 if (!(server_sni
= SSL_CTX_new(TLS_server_method())))
1633 if (!(server_sni
= SSL_CTX_new(SSLv23_server_method())))
1636 ERR_error_string_n(ERR_get_error(), ssl_errstring
, sizeof(ssl_errstring
));
1637 DEBUG(D_tls
) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring
);
1641 /* Not sure how many of these are actually needed, since SSL object
1642 already exists. Might even need this selfsame callback, for reneg? */
1644 SSL_CTX_set_info_callback(server_sni
, SSL_CTX_get_info_callback(server_ctx
));
1645 SSL_CTX_set_mode(server_sni
, SSL_CTX_get_mode(server_ctx
));
1646 SSL_CTX_set_options(server_sni
, SSL_CTX_get_options(server_ctx
));
1647 SSL_CTX_set_timeout(server_sni
, SSL_CTX_get_timeout(server_ctx
));
1648 SSL_CTX_set_tlsext_servername_callback(server_sni
, tls_servername_cb
);
1649 SSL_CTX_set_tlsext_servername_arg(server_sni
, cbinfo
);
1651 if ( !init_dh(server_sni
, cbinfo
->dhparam
, NULL
, &dummy_errstr
)
1652 || !init_ecdh(server_sni
, NULL
, &dummy_errstr
)
1656 if ( cbinfo
->server_cipher_list
1657 && !SSL_CTX_set_cipher_list(server_sni
, CS cbinfo
->server_cipher_list
))
1660 #ifndef DISABLE_OCSP
1661 if (cbinfo
->u_ocsp
.server
.file
)
1663 SSL_CTX_set_tlsext_status_cb(server_sni
, tls_server_stapling_cb
);
1664 SSL_CTX_set_tlsext_status_arg(server_sni
, cbinfo
);
1668 if ((rc
= setup_certs(server_sni
, tls_verify_certificates
, tls_crl
, NULL
, FALSE
,
1669 verify_callback_server
, &dummy_errstr
)) != OK
)
1672 /* do this after setup_certs, because this can require the certs for verifying
1673 OCSP information. */
1674 if ((rc
= tls_expand_session_files(server_sni
, cbinfo
, &dummy_errstr
)) != OK
)
1677 DEBUG(D_tls
) debug_printf("Switching SSL context.\n");
1678 SSL_set_SSL_CTX(s
, server_sni
);
1679 return SSL_TLSEXT_ERR_OK
;
1681 bad
: return SSL_TLSEXT_ERR_ALERT_FATAL
;
1683 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
1688 #ifndef DISABLE_OCSP
1690 /*************************************************
1691 * Callback to handle OCSP Stapling *
1692 *************************************************/
1694 /* Called when acting as server during the TLS session setup if the client
1695 requests OCSP information with a Certificate Status Request.
1697 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1703 tls_server_stapling_cb(SSL
*s
, void *arg
)
1705 const tls_ext_ctx_cb
* cbinfo
= (tls_ext_ctx_cb
*) arg
;
1706 ocsp_resplist
* olist
= cbinfo
->u_ocsp
.server
.olist
;
1707 uschar
* response_der
; /*XXX blob */
1708 int response_der_len
;
1711 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
1712 olist
? "have" : "lack");
1714 tls_in
.ocsp
= OCSP_NOT_RESP
;
1716 return SSL_TLSEXT_ERR_NOACK
;
1718 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
1720 const X509
* cert_sent
= SSL_get_certificate(s
);
1721 const ASN1_INTEGER
* cert_serial
= X509_get0_serialNumber(cert_sent
);
1722 const BIGNUM
* cert_bn
= ASN1_INTEGER_to_BN(cert_serial
, NULL
);
1723 const X509_NAME
* cert_issuer
= X509_get_issuer_name(cert_sent
);
1727 for (; olist
; olist
= olist
->next
)
1729 OCSP_BASICRESP
* bs
= OCSP_response_get1_basic(olist
->resp
);
1730 const OCSP_SINGLERESP
* single
= OCSP_resp_get0(bs
, 0);
1731 const OCSP_CERTID
* cid
= OCSP_SINGLERESP_get0_id(single
);
1732 ASN1_INTEGER
* res_cert_serial
;
1733 const BIGNUM
* resp_bn
;
1734 ASN1_OCTET_STRING
* res_cert_iNameHash
;
1737 (void) OCSP_id_get0_info(&res_cert_iNameHash
, NULL
, NULL
, &res_cert_serial
,
1738 (OCSP_CERTID
*) cid
);
1739 resp_bn
= ASN1_INTEGER_to_BN(res_cert_serial
, NULL
);
1743 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn
));
1744 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn
));
1747 if (BN_cmp(cert_bn
, resp_bn
) == 0)
1749 DEBUG(D_tls
) debug_printf("matched serial for ocsp\n");
1751 /*XXX TODO: check the rest of the list for duplicate matches.
1752 If any, need to also check the Issuer Name hash.
1753 Without this, we will provide the wrong status in the case of
1758 DEBUG(D_tls
) debug_printf("not match serial for ocsp\n");
1762 DEBUG(D_tls
) debug_printf("failed to find match for ocsp\n");
1763 return SSL_TLSEXT_ERR_NOACK
;
1769 DEBUG(D_tls
) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
1770 return SSL_TLSEXT_ERR_NOACK
;
1774 /*XXX could we do the i2d earlier, rather than during the callback? */
1775 response_der
= NULL
;
1776 response_der_len
= i2d_OCSP_RESPONSE(olist
->resp
, &response_der
);
1777 if (response_der_len
<= 0)
1778 return SSL_TLSEXT_ERR_NOACK
;
1780 SSL_set_tlsext_status_ocsp_resp(server_ssl
, response_der
, response_der_len
);
1781 tls_in
.ocsp
= OCSP_VFIED
;
1782 return SSL_TLSEXT_ERR_OK
;
1787 time_print(BIO
* bp
, const char * str
, ASN1_GENERALIZEDTIME
* time
)
1789 BIO_printf(bp
, "\t%s: ", str
);
1790 ASN1_GENERALIZEDTIME_print(bp
, time
);
1795 tls_client_stapling_cb(SSL
*s
, void *arg
)
1797 tls_ext_ctx_cb
* cbinfo
= arg
;
1798 const unsigned char * p
;
1800 OCSP_RESPONSE
* rsp
;
1801 OCSP_BASICRESP
* bs
;
1804 DEBUG(D_tls
) debug_printf("Received TLS status response (OCSP stapling):");
1805 len
= SSL_get_tlsext_status_ocsp_resp(s
, &p
);
1808 /* Expect this when we requested ocsp but got none */
1809 if (cbinfo
->u_ocsp
.client
.verify_required
&& LOGGING(tls_cipher
))
1810 log_write(0, LOG_MAIN
, "Received TLS status callback, null content");
1812 DEBUG(D_tls
) debug_printf(" null\n");
1813 return cbinfo
->u_ocsp
.client
.verify_required
? 0 : 1;
1816 if (!(rsp
= d2i_OCSP_RESPONSE(NULL
, &p
, len
)))
1818 tls_out
.ocsp
= OCSP_FAILED
; /*XXX should use tlsp-> to permit concurrent outbound */
1819 if (LOGGING(tls_cipher
))
1820 log_write(0, LOG_MAIN
, "Received TLS cert status response, parse error");
1822 DEBUG(D_tls
) debug_printf(" parse error\n");
1826 if (!(bs
= OCSP_response_get1_basic(rsp
)))
1828 tls_out
.ocsp
= OCSP_FAILED
;
1829 if (LOGGING(tls_cipher
))
1830 log_write(0, LOG_MAIN
, "Received TLS cert status response, error parsing response");
1832 DEBUG(D_tls
) debug_printf(" error parsing response\n");
1833 OCSP_RESPONSE_free(rsp
);
1837 /* We'd check the nonce here if we'd put one in the request. */
1838 /* However that would defeat cacheability on the server so we don't. */
1840 /* This section of code reworked from OpenSSL apps source;
1841 The OpenSSL Project retains copyright:
1842 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1847 ASN1_GENERALIZEDTIME
*rev
, *thisupd
, *nextupd
;
1849 DEBUG(D_tls
) bp
= BIO_new_fp(debug_file
, BIO_NOCLOSE
);
1851 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1853 /* Use the chain that verified the server cert to verify the stapled info */
1854 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1856 if ((i
= OCSP_basic_verify(bs
, cbinfo
->verify_stack
,
1857 cbinfo
->u_ocsp
.client
.verify_store
, 0)) <= 0)
1859 tls_out
.ocsp
= OCSP_FAILED
;
1860 if (LOGGING(tls_cipher
)) log_write(0, LOG_MAIN
,
1861 "Received TLS cert status response, itself unverifiable: %s",
1862 ERR_reason_error_string(ERR_peek_error()));
1863 BIO_printf(bp
, "OCSP response verify failure\n");
1864 ERR_print_errors(bp
);
1865 OCSP_RESPONSE_print(bp
, rsp
, 0);
1869 BIO_printf(bp
, "OCSP response well-formed and signed OK\n");
1871 /*XXX So we have a good stapled OCSP status. How do we know
1872 it is for the cert of interest? OpenSSL 1.1.0 has a routine
1873 OCSP_resp_find_status() which matches on a cert id, which presumably
1874 we should use. Making an id needs OCSP_cert_id_new(), which takes
1875 issuerName, issuerKey, serialNumber. Are they all in the cert?
1877 For now, carry on blindly accepting the resp. */
1880 OCSP_SINGLERESP
* single
;
1882 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
1883 if (OCSP_resp_count(bs
) != 1)
1885 STACK_OF(OCSP_SINGLERESP
) * sresp
= bs
->tbsResponseData
->responses
;
1886 if (sk_OCSP_SINGLERESP_num(sresp
) != 1)
1889 tls_out
.ocsp
= OCSP_FAILED
;
1890 log_write(0, LOG_MAIN
, "OCSP stapling "
1891 "with multiple responses not handled");
1894 single
= OCSP_resp_get0(bs
, 0);
1895 status
= OCSP_single_get0_status(single
, &reason
, &rev
,
1896 &thisupd
, &nextupd
);
1899 DEBUG(D_tls
) time_print(bp
, "This OCSP Update", thisupd
);
1900 DEBUG(D_tls
) if(nextupd
) time_print(bp
, "Next OCSP Update", nextupd
);
1901 if (!OCSP_check_validity(thisupd
, nextupd
,
1902 EXIM_OCSP_SKEW_SECONDS
, EXIM_OCSP_MAX_AGE
))
1904 tls_out
.ocsp
= OCSP_FAILED
;
1905 DEBUG(D_tls
) ERR_print_errors(bp
);
1906 log_write(0, LOG_MAIN
, "Server OSCP dates invalid");
1910 DEBUG(D_tls
) BIO_printf(bp
, "Certificate status: %s\n",
1911 OCSP_cert_status_str(status
));
1914 case V_OCSP_CERTSTATUS_GOOD
:
1915 tls_out
.ocsp
= OCSP_VFIED
;
1918 case V_OCSP_CERTSTATUS_REVOKED
:
1919 tls_out
.ocsp
= OCSP_FAILED
;
1920 log_write(0, LOG_MAIN
, "Server certificate revoked%s%s",
1921 reason
!= -1 ? "; reason: " : "",
1922 reason
!= -1 ? OCSP_crl_reason_str(reason
) : "");
1923 DEBUG(D_tls
) time_print(bp
, "Revocation Time", rev
);
1926 tls_out
.ocsp
= OCSP_FAILED
;
1927 log_write(0, LOG_MAIN
,
1928 "Server certificate status unknown, in OCSP stapling");
1933 i
= cbinfo
->u_ocsp
.client
.verify_required
? 0 : 1;
1938 OCSP_RESPONSE_free(rsp
);
1941 #endif /*!DISABLE_OCSP*/
1944 /*************************************************
1945 * Initialize for TLS *
1946 *************************************************/
1948 /* Called from both server and client code, to do preliminary initialization
1949 of the library. We allocate and return a context structure.
1952 ctxp returned SSL context
1953 host connected host, if client; NULL if server
1954 dhparam DH parameter file
1955 certificate certificate file
1956 privatekey private key
1957 ocsp_file file of stapling info (server); flag for require ocsp (client)
1958 addr address if client; NULL if server (for some randomness)
1959 cbp place to put allocated callback context
1960 errstr error string pointer
1962 Returns: OK/DEFER/FAIL
1966 tls_init(SSL_CTX
**ctxp
, host_item
*host
, uschar
*dhparam
, uschar
*certificate
,
1968 #ifndef DISABLE_OCSP
1971 address_item
*addr
, tls_ext_ctx_cb
** cbp
,
1978 tls_ext_ctx_cb
* cbinfo
;
1980 cbinfo
= store_malloc(sizeof(tls_ext_ctx_cb
));
1981 cbinfo
->tlsp
= tlsp
;
1982 cbinfo
->certificate
= certificate
;
1983 cbinfo
->privatekey
= privatekey
;
1984 cbinfo
->is_server
= host
==NULL
;
1985 #ifndef DISABLE_OCSP
1986 cbinfo
->verify_stack
= NULL
;
1989 cbinfo
->u_ocsp
.server
.file
= ocsp_file
;
1990 cbinfo
->u_ocsp
.server
.file_expanded
= NULL
;
1991 cbinfo
->u_ocsp
.server
.olist
= NULL
;
1994 cbinfo
->u_ocsp
.client
.verify_store
= NULL
;
1996 cbinfo
->dhparam
= dhparam
;
1997 cbinfo
->server_cipher_list
= NULL
;
1998 cbinfo
->host
= host
;
1999 #ifndef DISABLE_EVENT
2000 cbinfo
->event_action
= NULL
;
2003 #ifdef EXIM_NEED_OPENSSL_INIT
2004 SSL_load_error_strings(); /* basic set up */
2005 OpenSSL_add_ssl_algorithms();
2008 #ifdef EXIM_HAVE_SHA256
2009 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2010 list of available digests. */
2011 EVP_add_digest(EVP_sha256());
2014 /* Create a context.
2015 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2016 negotiation in the different methods; as far as I can tell, the only
2017 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2018 when OpenSSL is built without SSLv2 support.
2019 By disabling with openssl_options, we can let admins re-enable with the
2022 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
2023 if (!(ctx
= SSL_CTX_new(host
? TLS_client_method() : TLS_server_method())))
2025 if (!(ctx
= SSL_CTX_new(host
? SSLv23_client_method() : SSLv23_server_method())))
2027 return tls_error(US
"SSL_CTX_new", host
, NULL
, errstr
);
2029 /* It turns out that we need to seed the random number generator this early in
2030 order to get the full complement of ciphers to work. It took me roughly a day
2031 of work to discover this by experiment.
2033 On systems that have /dev/urandom, SSL may automatically seed itself from
2034 there. Otherwise, we have to make something up as best we can. Double check
2040 gettimeofday(&r
.tv
, NULL
);
2043 RAND_seed(US (&r
), sizeof(r
));
2044 RAND_seed(US big_buffer
, big_buffer_size
);
2045 if (addr
!= NULL
) RAND_seed(US addr
, sizeof(addr
));
2048 return tls_error(US
"RAND_status", host
,
2049 US
"unable to seed random number generator", errstr
);
2052 /* Set up the information callback, which outputs if debugging is at a suitable
2057 SSL_CTX_set_info_callback(ctx
, (void (*)())info_callback
);
2058 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
2059 /* this needs a debug build of OpenSSL */
2060 SSL_CTX_set_msg_callback(ctx
, (void (*)())SSL_trace
);
2062 #ifdef OPENSSL_HAVE_KEYLOG_CB
2063 SSL_CTX_set_keylog_callback(ctx
, (void (*)())keylog_callback
);
2067 /* Automatically re-try reads/writes after renegotiation. */
2068 (void) SSL_CTX_set_mode(ctx
, SSL_MODE_AUTO_RETRY
);
2070 /* Apply administrator-supplied work-arounds.
2071 Historically we applied just one requested option,
2072 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2073 moved to an administrator-controlled list of options to specify and
2074 grandfathered in the first one as the default value for "openssl_options".
2076 No OpenSSL version number checks: the options we accept depend upon the
2077 availability of the option value macros from OpenSSL. */
2079 if (!tls_openssl_options_parse(openssl_options
, &init_options
))
2080 return tls_error(US
"openssl_options parsing failed", host
, NULL
, errstr
);
2082 #ifdef EXPERIMENTAL_TLS_RESUME
2083 tlsp
->resumption
= RESUME_SUPPORTED
;
2087 #ifdef EXPERIMENTAL_TLS_RESUME
2088 /* Should the server offer session resumption? */
2089 if (!host
&& verify_check_host(&tls_resumption_hosts
) == OK
)
2091 DEBUG(D_tls
) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2092 init_options
&= ~SSL_OP_NO_TICKET
;
2093 tlsp
->resumption
|= RESUME_SERVER_TICKET
; /* server will give ticket on request */
2094 tlsp
->host_resumable
= TRUE
;
2098 DEBUG(D_tls
) debug_printf("setting SSL CTX options: %#lx\n", init_options
);
2099 if (!(SSL_CTX_set_options(ctx
, init_options
)))
2100 return tls_error(string_sprintf(
2101 "SSL_CTX_set_option(%#lx)", init_options
), host
, NULL
, errstr
);
2104 DEBUG(D_tls
) debug_printf("no SSL CTX options to set\n");
2106 /* We'd like to disable session cache unconditionally, but foolish Outlook
2107 Express clients then give up the first TLS connection and make a second one
2108 (which works). Only when there is an IMAP service on the same machine.
2109 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2110 now, until we work out a decent way of presenting control to the config. It
2111 will never be used because we use a new context every time. */
2113 (void) SSL_CTX_set_session_cache_mode(ctx
, SSL_SESS_CACHE_OFF
);
2116 /* Initialize with DH parameters if supplied */
2117 /* Initialize ECDH temp key parameter selection */
2119 if ( !init_dh(ctx
, dhparam
, host
, errstr
)
2120 || !init_ecdh(ctx
, host
, errstr
)
2124 /* Set up certificate and key (and perhaps OCSP info) */
2126 if ((rc
= tls_expand_session_files(ctx
, cbinfo
, errstr
)) != OK
)
2129 /* If we need to handle SNI or OCSP, do so */
2131 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2132 # ifndef DISABLE_OCSP
2133 if (!(cbinfo
->verify_stack
= sk_X509_new_null()))
2135 DEBUG(D_tls
) debug_printf("failed to create stack for stapling verify\n");
2140 if (!host
) /* server */
2142 # ifndef DISABLE_OCSP
2143 /* We check u_ocsp.server.file, not server.olist, because we care about if
2144 the option exists, not what the current expansion might be, as SNI might
2145 change the certificate and OCSP file in use between now and the time the
2146 callback is invoked. */
2147 if (cbinfo
->u_ocsp
.server
.file
)
2149 SSL_CTX_set_tlsext_status_cb(ctx
, tls_server_stapling_cb
);
2150 SSL_CTX_set_tlsext_status_arg(ctx
, cbinfo
);
2153 /* We always do this, so that $tls_sni is available even if not used in
2155 SSL_CTX_set_tlsext_servername_callback(ctx
, tls_servername_cb
);
2156 SSL_CTX_set_tlsext_servername_arg(ctx
, cbinfo
);
2158 # ifndef DISABLE_OCSP
2160 if(ocsp_file
) /* wanting stapling */
2162 if (!(cbinfo
->u_ocsp
.client
.verify_store
= X509_STORE_new()))
2164 DEBUG(D_tls
) debug_printf("failed to create store for stapling verify\n");
2167 SSL_CTX_set_tlsext_status_cb(ctx
, tls_client_stapling_cb
);
2168 SSL_CTX_set_tlsext_status_arg(ctx
, cbinfo
);
2173 cbinfo
->verify_cert_hostnames
= NULL
;
2175 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
2176 /* Set up the RSA callback */
2177 SSL_CTX_set_tmp_rsa_callback(ctx
, rsa_callback
);
2180 /* Finally, set the session cache timeout, and we are done.
2181 The period appears to be also used for (server-generated) session tickets */
2183 SSL_CTX_set_timeout(ctx
, ssl_session_timeout
);
2184 DEBUG(D_tls
) debug_printf("Initialized TLS\n");
2195 /*************************************************
2196 * Get name of cipher in use *
2197 *************************************************/
2200 Argument: pointer to an SSL structure for the connection
2201 pointer to number of bits for cipher
2202 Returns: pointer to allocated string in perm-pool
2206 construct_cipher_name(SSL
* ssl
, int * bits
)
2208 int pool
= store_pool
;
2209 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
2210 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2211 the accessor functions use const in the prototype. */
2213 const uschar
* ver
= CUS
SSL_get_version(ssl
);
2214 const SSL_CIPHER
* c
= (const SSL_CIPHER
*) SSL_get_current_cipher(ssl
);
2217 SSL_CIPHER_get_bits(c
, bits
);
2219 store_pool
= POOL_PERM
;
2220 s
= string_sprintf("%s:%s:%u", ver
, SSL_CIPHER_get_name(c
), *bits
);
2222 DEBUG(D_tls
) debug_printf("Cipher: %s\n", s
);
2227 /* Get IETF-standard name for ciphersuite.
2228 Argument: pointer to an SSL structure for the connection
2229 Returns: pointer to string
2232 static const uschar
*
2233 cipher_stdname_ssl(SSL
* ssl
)
2235 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2236 return CUS
SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl
));
2238 ushort id
= 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl
));
2239 return cipher_stdname(id
>> 8, id
& 0xff);
2245 peer_cert(SSL
* ssl
, tls_support
* tlsp
, uschar
* peerdn
, unsigned siz
)
2247 /*XXX we might consider a list-of-certs variable for the cert chain.
2248 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2249 in list-handling functions, also consider the difference between the entire
2250 chain and the elements sent by the peer. */
2252 tlsp
->peerdn
= NULL
;
2254 /* Will have already noted peercert on a verify fail; possibly not the leaf */
2255 if (!tlsp
->peercert
)
2256 tlsp
->peercert
= SSL_get_peer_certificate(ssl
);
2257 /* Beware anonymous ciphers which lead to server_cert being NULL */
2259 if (!X509_NAME_oneline(X509_get_subject_name(tlsp
->peercert
), CS peerdn
, siz
))
2260 { DEBUG(D_tls
) debug_printf("X509_NAME_oneline() error\n"); }
2263 int oldpool
= store_pool
;
2265 peerdn
[siz
-1] = '\0'; /* paranoia */
2266 store_pool
= POOL_PERM
;
2267 tlsp
->peerdn
= string_copy(peerdn
);
2268 store_pool
= oldpool
;
2270 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2271 but they don't get called on session-resumption. So use the official
2272 interface, which uses the resumed value. Unfortunately this claims verified
2273 when it actually failed but we're in try-verify mode, due to us wanting the
2274 knowlege that it failed so needing to have the callback and forcing a
2275 permissive return. If we don't force it, the TLS startup is failed.
2276 The extra bit of information is set in verify_override in the cb, stashed
2277 for resumption next to the TLS session, and used here. */
2279 if (!tlsp
->verify_override
)
2280 tlsp
->certificate_verified
= SSL_get_verify_result(ssl
) == X509_V_OK
;
2288 /*************************************************
2289 * Set up for verifying certificates *
2290 *************************************************/
2292 #ifndef DISABLE_OCSP
2293 /* Load certs from file, return TRUE on success */
2296 chain_from_pem_file(const uschar
* file
, STACK_OF(X509
) * verify_stack
)
2301 while (sk_X509_num(verify_stack
) > 0)
2302 X509_free(sk_X509_pop(verify_stack
));
2304 if (!(bp
= BIO_new_file(CS file
, "r"))) return FALSE
;
2305 while ((x
= PEM_read_bio_X509(bp
, NULL
, 0, NULL
)))
2306 sk_X509_push(verify_stack
, x
);
2314 /* Called by both client and server startup; on the server possibly
2315 repeated after a Server Name Indication.
2318 sctx SSL_CTX* to initialise
2319 certs certs file or NULL
2320 crl CRL file or NULL
2321 host NULL in a server; the remote host in a client
2322 optional TRUE if called from a server for a host in tls_try_verify_hosts;
2323 otherwise passed as FALSE
2324 cert_vfy_cb Callback function for certificate verification
2325 errstr error string pointer
2327 Returns: OK/DEFER/FAIL
2331 setup_certs(SSL_CTX
*sctx
, uschar
*certs
, uschar
*crl
, host_item
*host
, BOOL optional
,
2332 int (*cert_vfy_cb
)(int, X509_STORE_CTX
*), uschar
** errstr
)
2334 uschar
*expcerts
, *expcrl
;
2336 if (!expand_check(certs
, US
"tls_verify_certificates", &expcerts
, errstr
))
2338 DEBUG(D_tls
) debug_printf("tls_verify_certificates: %s\n", expcerts
);
2340 if (expcerts
&& *expcerts
)
2342 /* Tell the library to use its compiled-in location for the system default
2343 CA bundle. Then add the ones specified in the config, if any. */
2345 if (!SSL_CTX_set_default_verify_paths(sctx
))
2346 return tls_error(US
"SSL_CTX_set_default_verify_paths", host
, NULL
, errstr
);
2348 if (Ustrcmp(expcerts
, "system") != 0)
2350 struct stat statbuf
;
2352 if (Ustat(expcerts
, &statbuf
) < 0)
2354 log_write(0, LOG_MAIN
|LOG_PANIC
,
2355 "failed to stat %s for certificates", expcerts
);
2361 if ((statbuf
.st_mode
& S_IFMT
) == S_IFDIR
)
2362 { file
= NULL
; dir
= expcerts
; }
2365 file
= expcerts
; dir
= NULL
;
2366 #ifndef DISABLE_OCSP
2367 /* In the server if we will be offering an OCSP proof, load chain from
2368 file for verifying the OCSP proof at load time. */
2370 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
2371 This is inconsistent with the need to verify the OCSP proof of the server cert.
2375 && statbuf
.st_size
> 0
2376 && server_static_cbinfo
->u_ocsp
.server
.file
2377 && !chain_from_pem_file(file
, server_static_cbinfo
->verify_stack
)
2380 log_write(0, LOG_MAIN
|LOG_PANIC
,
2381 "failed to load cert chain from %s", file
);
2387 /* If a certificate file is empty, the next function fails with an
2388 unhelpful error message. If we skip it, we get the correct behaviour (no
2389 certificates are recognized, but the error message is still misleading (it
2390 says no certificate was supplied). But this is better. */
2392 if ( (!file
|| statbuf
.st_size
> 0)
2393 && !SSL_CTX_load_verify_locations(sctx
, CS file
, CS dir
))
2394 return tls_error(US
"SSL_CTX_load_verify_locations", host
, NULL
, errstr
);
2396 /* Load the list of CAs for which we will accept certs, for sending
2397 to the client. This is only for the one-file tls_verify_certificates
2399 If a list isn't loaded into the server, but some verify locations are set,
2400 the server end appears to make a wildcard request for client certs.
2401 Meanwhile, the client library as default behaviour *ignores* the list
2402 we send over the wire - see man SSL_CTX_set_client_cert_cb.
2403 Because of this, and that the dir variant is likely only used for
2404 the public-CA bundle (not for a private CA), not worth fixing. */
2408 STACK_OF(X509_NAME
) * names
= SSL_load_client_CA_file(CS file
);
2410 SSL_CTX_set_client_CA_list(sctx
, names
);
2411 DEBUG(D_tls
) debug_printf("Added %d certificate authorities.\n",
2412 sk_X509_NAME_num(names
));
2417 /* Handle a certificate revocation list. */
2419 #if OPENSSL_VERSION_NUMBER > 0x00907000L
2421 /* This bit of code is now the version supplied by Lars Mainka. (I have
2422 merely reformatted it into the Exim code style.)
2424 "From here I changed the code to add support for multiple crl's
2425 in pem format in one file or to support hashed directory entries in
2426 pem format instead of a file. This method now uses the library function
2427 X509_STORE_load_locations to add the CRL location to the SSL context.
2428 OpenSSL will then handle the verify against CA certs and CRLs by
2429 itself in the verify callback." */
2431 if (!expand_check(crl
, US
"tls_crl", &expcrl
, errstr
)) return DEFER
;
2432 if (expcrl
&& *expcrl
)
2434 struct stat statbufcrl
;
2435 if (Ustat(expcrl
, &statbufcrl
) < 0)
2437 log_write(0, LOG_MAIN
|LOG_PANIC
,
2438 "failed to stat %s for certificates revocation lists", expcrl
);
2443 /* is it a file or directory? */
2445 X509_STORE
*cvstore
= SSL_CTX_get_cert_store(sctx
);
2446 if ((statbufcrl
.st_mode
& S_IFMT
) == S_IFDIR
)
2450 DEBUG(D_tls
) debug_printf("SSL CRL value is a directory %s\n", dir
);
2456 DEBUG(D_tls
) debug_printf("SSL CRL value is a file %s\n", file
);
2458 if (X509_STORE_load_locations(cvstore
, CS file
, CS dir
) == 0)
2459 return tls_error(US
"X509_STORE_load_locations", host
, NULL
, errstr
);
2461 /* setting the flags to check against the complete crl chain */
2463 X509_STORE_set_flags(cvstore
,
2464 X509_V_FLAG_CRL_CHECK
|X509_V_FLAG_CRL_CHECK_ALL
);
2468 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
2470 /* If verification is optional, don't fail if no certificate */
2472 SSL_CTX_set_verify(sctx
,
2473 SSL_VERIFY_PEER
| (optional
? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT
),
2482 /*************************************************
2483 * Start a TLS session in a server *
2484 *************************************************/
2486 /* This is called when Exim is running as a server, after having received
2487 the STARTTLS command. It must respond to that command, and then negotiate
2491 require_ciphers allowed ciphers
2492 errstr pointer to error message
2494 Returns: OK on success
2495 DEFER for errors before the start of the negotiation
2496 FAIL for errors during the negotiation; the server can't
2501 tls_server_start(const uschar
* require_ciphers
, uschar
** errstr
)
2504 uschar
* expciphers
;
2505 tls_ext_ctx_cb
* cbinfo
;
2506 static uschar peerdn
[256];
2508 /* Check for previous activation */
2510 if (tls_in
.active
.sock
>= 0)
2512 tls_error(US
"STARTTLS received after TLS started", NULL
, US
"", errstr
);
2513 smtp_printf("554 Already in TLS\r\n", FALSE
);
2517 /* Initialize the SSL library. If it fails, it will already have logged
2520 rc
= tls_init(&server_ctx
, NULL
, tls_dhparam
, tls_certificate
, tls_privatekey
,
2521 #ifndef DISABLE_OCSP
2524 NULL
, &server_static_cbinfo
, &tls_in
, errstr
);
2525 if (rc
!= OK
) return rc
;
2526 cbinfo
= server_static_cbinfo
;
2528 if (!expand_check(require_ciphers
, US
"tls_require_ciphers", &expciphers
, errstr
))
2531 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
2532 were historically separated by underscores. So that I can use either form in my
2533 tests, and also for general convenience, we turn underscores into hyphens here.
2535 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
2536 for TLS 1.3 . Since we do not call it at present we get the default list:
2537 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
2542 for (uschar
* s
= expciphers
; *s
; s
++ ) if (*s
== '_') *s
= '-';
2543 DEBUG(D_tls
) debug_printf("required ciphers: %s\n", expciphers
);
2544 if (!SSL_CTX_set_cipher_list(server_ctx
, CS expciphers
))
2545 return tls_error(US
"SSL_CTX_set_cipher_list", NULL
, NULL
, errstr
);
2546 cbinfo
->server_cipher_list
= expciphers
;
2549 /* If this is a host for which certificate verification is mandatory or
2550 optional, set up appropriately. */
2552 tls_in
.certificate_verified
= FALSE
;
2554 tls_in
.dane_verified
= FALSE
;
2556 server_verify_callback_called
= FALSE
;
2558 if (verify_check_host(&tls_verify_hosts
) == OK
)
2560 rc
= setup_certs(server_ctx
, tls_verify_certificates
, tls_crl
, NULL
,
2561 FALSE
, verify_callback_server
, errstr
);
2562 if (rc
!= OK
) return rc
;
2563 server_verify_optional
= FALSE
;
2565 else if (verify_check_host(&tls_try_verify_hosts
) == OK
)
2567 rc
= setup_certs(server_ctx
, tls_verify_certificates
, tls_crl
, NULL
,
2568 TRUE
, verify_callback_server
, errstr
);
2569 if (rc
!= OK
) return rc
;
2570 server_verify_optional
= TRUE
;
2573 #ifdef EXPERIMENTAL_TLS_RESUME
2574 SSL_CTX_set_tlsext_ticket_key_cb(server_ctx
, ticket_key_callback
);
2575 /* despite working, appears to always return failure, so ignoring */
2577 #ifdef OPENSSL_HAVE_NUM_TICKETS
2578 # ifdef EXPERIMENTAL_TLS_RESUME
2579 SSL_CTX_set_num_tickets(server_ctx
, tls_in
.host_resumable
? 1 : 0);
2581 SSL_CTX_set_num_tickets(server_ctx
, 0); /* send no TLS1.3 stateful-tickets */
2586 /* Prepare for new connection */
2588 if (!(server_ssl
= SSL_new(server_ctx
)))
2589 return tls_error(US
"SSL_new", NULL
, NULL
, errstr
);
2591 /* Warning: we used to SSL_clear(ssl) here, it was removed.
2593 * With the SSL_clear(), we get strange interoperability bugs with
2594 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
2595 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
2597 * The SSL_clear() call is to let an existing SSL* be reused, typically after
2598 * session shutdown. In this case, we have a brand new object and there's no
2599 * obvious reason to immediately clear it. I'm guessing that this was
2600 * originally added because of incomplete initialisation which the clear fixed,
2601 * in some historic release.
2604 /* Set context and tell client to go ahead, except in the case of TLS startup
2605 on connection, where outputting anything now upsets the clients and tends to
2606 make them disconnect. We need to have an explicit fflush() here, to force out
2607 the response. Other smtp_printf() calls do not need it, because in non-TLS
2608 mode, the fflush() happens when smtp_getc() is called. */
2610 SSL_set_session_id_context(server_ssl
, sid_ctx
, Ustrlen(sid_ctx
));
2611 if (!tls_in
.on_connect
)
2613 smtp_printf("220 TLS go ahead\r\n", FALSE
);
2617 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2618 that the OpenSSL library doesn't. */
2620 SSL_set_wfd(server_ssl
, fileno(smtp_out
));
2621 SSL_set_rfd(server_ssl
, fileno(smtp_in
));
2622 SSL_set_accept_state(server_ssl
);
2624 DEBUG(D_tls
) debug_printf("Calling SSL_accept\n");
2626 sigalrm_seen
= FALSE
;
2627 if (smtp_receive_timeout
> 0) ALARM(smtp_receive_timeout
);
2628 rc
= SSL_accept(server_ssl
);
2633 (void) tls_error(US
"SSL_accept", NULL
, sigalrm_seen
? US
"timed out" : NULL
, errstr
);
2637 DEBUG(D_tls
) debug_printf("SSL_accept was successful\n");
2638 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
2639 anon-authentication ciphersuite negotiated. */
2641 #ifdef EXPERIMENTAL_TLS_RESUME
2642 if (SSL_session_reused(server_ssl
))
2644 tls_in
.resumption
|= RESUME_USED
;
2645 DEBUG(D_tls
) debug_printf("Session reused\n");
2649 /* TLS has been set up. Adjust the input functions to read via TLS,
2650 and initialize things. */
2652 peer_cert(server_ssl
, &tls_in
, peerdn
, sizeof(peerdn
));
2654 tls_in
.cipher
= construct_cipher_name(server_ssl
, &tls_in
.bits
);
2655 tls_in
.cipher_stdname
= cipher_stdname_ssl(server_ssl
);
2660 if (SSL_get_shared_ciphers(server_ssl
, CS buf
, sizeof(buf
)))
2661 debug_printf("Shared ciphers: %s\n", buf
);
2663 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
2665 BIO
* bp
= BIO_new_fp(debug_file
, BIO_NOCLOSE
);
2666 SSL_SESSION_print_keylog(bp
, SSL_get_session(server_ssl
));
2671 #ifdef EXIM_HAVE_SESSION_TICKET
2673 SSL_SESSION
* ss
= SSL_get_session(server_ssl
);
2674 if (SSL_SESSION_has_ticket(ss
)) /* 1.1.0 */
2675 debug_printf("The session has a ticket, life %lu seconds\n",
2676 SSL_SESSION_get_ticket_lifetime_hint(ss
));
2681 /* Record the certificate we presented */
2683 X509
* crt
= SSL_get_certificate(server_ssl
);
2684 tls_in
.ourcert
= crt
? X509_dup(crt
) : NULL
;
2687 /* Only used by the server-side tls (tls_in), including tls_getc.
2688 Client-side (tls_out) reads (seem to?) go via
2689 smtp_read_response()/ip_recv().
2690 Hence no need to duplicate for _in and _out.
2692 if (!ssl_xfer_buffer
) ssl_xfer_buffer
= store_malloc(ssl_xfer_buffer_size
);
2693 ssl_xfer_buffer_lwm
= ssl_xfer_buffer_hwm
= 0;
2694 ssl_xfer_eof
= ssl_xfer_error
= FALSE
;
2696 receive_getc
= tls_getc
;
2697 receive_getbuf
= tls_getbuf
;
2698 receive_get_cache
= tls_get_cache
;
2699 receive_ungetc
= tls_ungetc
;
2700 receive_feof
= tls_feof
;
2701 receive_ferror
= tls_ferror
;
2702 receive_smtp_buffered
= tls_smtp_buffered
;
2704 tls_in
.active
.sock
= fileno(smtp_out
);
2705 tls_in
.active
.tls_ctx
= NULL
; /* not using explicit ctx for server-side */
2713 tls_client_basic_ctx_init(SSL_CTX
* ctx
,
2714 host_item
* host
, smtp_transport_options_block
* ob
, tls_ext_ctx_cb
* cbinfo
,
2718 /* stick to the old behaviour for compatibility if tls_verify_certificates is
2719 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2720 the specified host patterns if one of them is defined */
2722 if ( ( !ob
->tls_verify_hosts
2723 && (!ob
->tls_try_verify_hosts
|| !*ob
->tls_try_verify_hosts
)
2725 || verify_check_given_host(CUSS
&ob
->tls_verify_hosts
, host
) == OK
2727 client_verify_optional
= FALSE
;
2728 else if (verify_check_given_host(CUSS
&ob
->tls_try_verify_hosts
, host
) == OK
)
2729 client_verify_optional
= TRUE
;
2733 if ((rc
= setup_certs(ctx
, ob
->tls_verify_certificates
,
2734 ob
->tls_crl
, host
, client_verify_optional
, verify_callback_client
,
2738 if (verify_check_given_host(CUSS
&ob
->tls_verify_cert_hostnames
, host
) == OK
)
2740 cbinfo
->verify_cert_hostnames
=
2742 string_domain_utf8_to_alabel(host
->name
, NULL
);
2746 DEBUG(D_tls
) debug_printf("Cert hostname to check: \"%s\"\n",
2747 cbinfo
->verify_cert_hostnames
);
2755 dane_tlsa_load(SSL
* ssl
, host_item
* host
, dns_answer
* dnsa
, uschar
** errstr
)
2758 const char * hostnames
[2] = { CS host
->name
, NULL
};
2761 if (DANESSL_init(ssl
, NULL
, hostnames
) != 1)
2762 return tls_error(US
"hostnames load", host
, NULL
, errstr
);
2764 for (dns_record
* rr
= dns_next_rr(dnsa
, &dnss
, RESET_ANSWERS
); rr
;
2765 rr
= dns_next_rr(dnsa
, &dnss
, RESET_NEXT
)
2766 ) if (rr
->type
== T_TLSA
&& rr
->size
> 3)
2768 const uschar
* p
= rr
->data
;
2769 uint8_t usage
, selector
, mtype
;
2770 const char * mdname
;
2774 /* Only DANE-TA(2) and DANE-EE(3) are supported */
2775 if (usage
!= 2 && usage
!= 3) continue;
2782 default: continue; /* Only match-types 0, 1, 2 are supported */
2783 case 0: mdname
= NULL
; break;
2784 case 1: mdname
= "sha256"; break;
2785 case 2: mdname
= "sha512"; break;
2789 switch (DANESSL_add_tlsa(ssl
, usage
, selector
, mdname
, p
, rr
->size
- 3))
2792 return tls_error(US
"tlsa load", host
, NULL
, errstr
);
2793 case 0: /* action not taken */
2797 tls_out
.tlsa_usage
|= 1<<usage
;
2803 log_write(0, LOG_MAIN
, "DANE error: No usable TLSA records");
2806 #endif /*SUPPORT_DANE*/
2810 #ifdef EXPERIMENTAL_TLS_RESUME
2811 /* On the client, get any stashed session for the given IP from hints db
2812 and apply it to the ssl-connection for attempted resumption. */
2815 tls_retrieve_session(tls_support
* tlsp
, SSL
* ssl
, const uschar
* key
)
2817 tlsp
->resumption
|= RESUME_SUPPORTED
;
2818 if (tlsp
->host_resumable
)
2820 dbdata_tls_session
* dt
;
2822 open_db dbblock
, * dbm_file
;
2824 tlsp
->resumption
|= RESUME_CLIENT_REQUESTED
;
2825 DEBUG(D_tls
) debug_printf("checking for resumable session for %s\n", key
);
2826 if ((dbm_file
= dbfn_open(US
"tls", O_RDONLY
, &dbblock
, FALSE
, FALSE
)))
2828 /* key for the db is the IP */
2829 if ((dt
= dbfn_read_with_length(dbm_file
, key
, &len
)))
2831 SSL_SESSION
* ss
= NULL
;
2832 const uschar
* sess_asn1
= dt
->session
;
2834 len
-= sizeof(dbdata_tls_session
);
2835 if (!(d2i_SSL_SESSION(&ss
, &sess_asn1
, (long)len
)))
2839 ERR_error_string_n(ERR_get_error(),
2840 ssl_errstring
, sizeof(ssl_errstring
));
2841 debug_printf("decoding session: %s\n", ssl_errstring
);
2844 #ifdef EXIM_HAVE_SESSION_TICKET
2845 else if ( SSL_SESSION_get_ticket_lifetime_hint(ss
) + dt
->time_stamp
2848 DEBUG(D_tls
) debug_printf("session expired\n");
2849 dbfn_delete(dbm_file
, key
);
2852 else if (!SSL_set_session(ssl
, ss
))
2856 ERR_error_string_n(ERR_get_error(),
2857 ssl_errstring
, sizeof(ssl_errstring
));
2858 debug_printf("applying session to ssl: %s\n", ssl_errstring
);
2863 DEBUG(D_tls
) debug_printf("good session\n");
2864 tlsp
->resumption
|= RESUME_CLIENT_SUGGESTED
;
2865 tlsp
->verify_override
= dt
->verify_override
;
2866 tlsp
->ocsp
= dt
->ocsp
;
2870 DEBUG(D_tls
) debug_printf("no session record\n");
2871 dbfn_close(dbm_file
);
2877 /* On the client, save the session for later resumption */
2880 tls_save_session_cb(SSL
* ssl
, SSL_SESSION
* ss
)
2882 tls_ext_ctx_cb
* cbinfo
= SSL_get_ex_data(ssl
, tls_exdata_idx
);
2885 DEBUG(D_tls
) debug_printf("tls_save_session_cb\n");
2887 if (!cbinfo
|| !(tlsp
= cbinfo
->tlsp
)->host_resumable
) return 0;
2889 # ifdef OPENSSL_HAVE_NUM_TICKETS
2890 if (SSL_SESSION_is_resumable(ss
)) /* 1.1.1 */
2893 int len
= i2d_SSL_SESSION(ss
, NULL
);
2894 int dlen
= sizeof(dbdata_tls_session
) + len
;
2895 dbdata_tls_session
* dt
= store_get(dlen
, TRUE
);
2896 uschar
* s
= dt
->session
;
2897 open_db dbblock
, * dbm_file
;
2899 DEBUG(D_tls
) debug_printf("session is resumable\n");
2900 tlsp
->resumption
|= RESUME_SERVER_TICKET
; /* server gave us a ticket */
2902 dt
->verify_override
= tlsp
->verify_override
;
2903 dt
->ocsp
= tlsp
->ocsp
;
2904 (void) i2d_SSL_SESSION(ss
, &s
); /* s gets bumped to end */
2906 if ((dbm_file
= dbfn_open(US
"tls", O_RDWR
, &dbblock
, FALSE
, FALSE
)))
2908 const uschar
* key
= cbinfo
->host
->address
;
2909 dbfn_delete(dbm_file
, key
);
2910 dbfn_write(dbm_file
, key
, dt
, dlen
);
2911 dbfn_close(dbm_file
);
2912 DEBUG(D_tls
) debug_printf("wrote session (len %u) to db\n",
2921 tls_client_ctx_resume_prehandshake(
2922 exim_openssl_client_tls_ctx
* exim_client_ctx
, tls_support
* tlsp
,
2923 smtp_transport_options_block
* ob
, host_item
* host
)
2925 /* Should the client request a session resumption ticket? */
2926 if (verify_check_given_host(CUSS
&ob
->tls_resumption_hosts
, host
) == OK
)
2928 tlsp
->host_resumable
= TRUE
;
2930 SSL_CTX_set_session_cache_mode(exim_client_ctx
->ctx
,
2931 SSL_SESS_CACHE_CLIENT
2932 | SSL_SESS_CACHE_NO_INTERNAL
| SSL_SESS_CACHE_NO_AUTO_CLEAR
);
2933 SSL_CTX_sess_set_new_cb(exim_client_ctx
->ctx
, tls_save_session_cb
);
2938 tls_client_ssl_resume_prehandshake(SSL
* ssl
, tls_support
* tlsp
,
2939 host_item
* host
, uschar
** errstr
)
2941 if (tlsp
->host_resumable
)
2944 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
2945 SSL_clear_options(ssl
, SSL_OP_NO_TICKET
);
2947 tls_exdata_idx
= SSL_get_ex_new_index(0, 0, 0, 0, 0);
2948 if (!SSL_set_ex_data(ssl
, tls_exdata_idx
, client_static_cbinfo
))
2950 tls_error(US
"set ex_data", host
, NULL
, errstr
);
2953 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx
, client_static_cbinfo
);
2956 tlsp
->resumption
= RESUME_SUPPORTED
;
2957 /* Pick up a previous session, saved on an old ticket */
2958 tls_retrieve_session(tlsp
, ssl
, host
->address
);
2963 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx
* exim_client_ctx
,
2966 if (SSL_session_reused(exim_client_ctx
->ssl
))
2968 DEBUG(D_tls
) debug_printf("The session was reused\n");
2969 tlsp
->resumption
|= RESUME_USED
;
2972 #endif /* EXPERIMENTAL_TLS_RESUME */
2975 /*************************************************
2976 * Start a TLS session in a client *
2977 *************************************************/
2979 /* Called from the smtp transport after STARTTLS has been accepted.
2982 cctx connection context
2983 conn_args connection details
2984 cookie datum for randomness; can be NULL
2985 tlsp record details of TLS channel configuration here; must be non-NULL
2986 errstr error string pointer
2988 Returns: TRUE for success with TLS session context set in connection context,
2993 tls_client_start(client_conn_ctx
* cctx
, smtp_connect_args
* conn_args
,
2994 void * cookie
, tls_support
* tlsp
, uschar
** errstr
)
2996 host_item
* host
= conn_args
->host
; /* for msgs and option-tests */
2997 transport_instance
* tb
= conn_args
->tblock
; /* always smtp or NULL */
2998 smtp_transport_options_block
* ob
= tb
2999 ? (smtp_transport_options_block
*)tb
->options_block
3000 : &smtp_transport_option_defaults
;
3001 exim_openssl_client_tls_ctx
* exim_client_ctx
;
3002 uschar
* expciphers
;
3004 static uschar peerdn
[256];
3006 #ifndef DISABLE_OCSP
3007 BOOL request_ocsp
= FALSE
;
3008 BOOL require_ocsp
= FALSE
;
3012 store_pool
= POOL_PERM
;
3013 exim_client_ctx
= store_get(sizeof(exim_openssl_client_tls_ctx
), FALSE
);
3014 exim_client_ctx
->corked
= NULL
;
3018 tlsp
->tlsa_usage
= 0;
3021 #ifndef DISABLE_OCSP
3023 # ifdef SUPPORT_DANE
3024 if ( conn_args
->dane
3025 && ob
->hosts_request_ocsp
[0] == '*'
3026 && ob
->hosts_request_ocsp
[1] == '\0'
3029 /* Unchanged from default. Use a safer one under DANE */
3030 request_ocsp
= TRUE
;
3031 ob
->hosts_request_ocsp
= US
"${if or { {= {0}{$tls_out_tlsa_usage}} "
3032 " {= {4}{$tls_out_tlsa_usage}} } "
3038 verify_check_given_host(CUSS
&ob
->hosts_require_ocsp
, host
) == OK
))
3039 request_ocsp
= TRUE
;
3041 # ifdef SUPPORT_DANE
3045 verify_check_given_host(CUSS
&ob
->hosts_request_ocsp
, host
) == OK
;
3049 rc
= tls_init(&exim_client_ctx
->ctx
, host
, NULL
,
3050 ob
->tls_certificate
, ob
->tls_privatekey
,
3051 #ifndef DISABLE_OCSP
3052 (void *)(long)request_ocsp
,
3054 cookie
, &client_static_cbinfo
, tlsp
, errstr
);
3055 if (rc
!= OK
) return FALSE
;
3057 tlsp
->certificate_verified
= FALSE
;
3058 client_verify_callback_called
= FALSE
;
3062 if (conn_args
->dane
)
3064 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3065 other failures should be treated as problems. */
3066 if (ob
->dane_require_tls_ciphers
&&
3067 !expand_check(ob
->dane_require_tls_ciphers
, US
"dane_require_tls_ciphers",
3068 &expciphers
, errstr
))
3070 if (expciphers
&& *expciphers
== '\0')
3075 !expand_check(ob
->tls_require_ciphers
, US
"tls_require_ciphers",
3076 &expciphers
, errstr
))
3079 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3080 are separated by underscores. So that I can use either form in my tests, and
3081 also for general convenience, we turn underscores into hyphens here. */
3085 uschar
*s
= expciphers
;
3086 while (*s
) { if (*s
== '_') *s
= '-'; s
++; }
3087 DEBUG(D_tls
) debug_printf("required ciphers: %s\n", expciphers
);
3088 if (!SSL_CTX_set_cipher_list(exim_client_ctx
->ctx
, CS expciphers
))
3090 tls_error(US
"SSL_CTX_set_cipher_list", host
, NULL
, errstr
);
3096 if (conn_args
->dane
)
3098 SSL_CTX_set_verify(exim_client_ctx
->ctx
,
3099 SSL_VERIFY_PEER
| SSL_VERIFY_FAIL_IF_NO_PEER_CERT
,
3100 verify_callback_client_dane
);
3102 if (!DANESSL_library_init())
3104 tls_error(US
"library init", host
, NULL
, errstr
);
3107 if (DANESSL_CTX_init(exim_client_ctx
->ctx
) <= 0)
3109 tls_error(US
"context init", host
, NULL
, errstr
);
3117 if (tls_client_basic_ctx_init(exim_client_ctx
->ctx
, host
, ob
,
3118 client_static_cbinfo
, errstr
) != OK
)
3121 #ifdef EXPERIMENTAL_TLS_RESUME
3122 tls_client_ctx_resume_prehandshake(exim_client_ctx
, tlsp
, ob
, host
);
3126 if (!(exim_client_ctx
->ssl
= SSL_new(exim_client_ctx
->ctx
)))
3128 tls_error(US
"SSL_new", host
, NULL
, errstr
);
3131 SSL_set_session_id_context(exim_client_ctx
->ssl
, sid_ctx
, Ustrlen(sid_ctx
));
3133 SSL_set_fd(exim_client_ctx
->ssl
, cctx
->sock
);
3134 SSL_set_connect_state(exim_client_ctx
->ssl
);
3138 if (!expand_check(ob
->tls_sni
, US
"tls_sni", &tlsp
->sni
, errstr
))
3142 DEBUG(D_tls
) debug_printf("Setting TLS SNI forced to fail, not sending\n");
3144 else if (!Ustrlen(tlsp
->sni
))
3148 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
3149 DEBUG(D_tls
) debug_printf("Setting TLS SNI \"%s\"\n", tlsp
->sni
);
3150 SSL_set_tlsext_host_name(exim_client_ctx
->ssl
, tlsp
->sni
);
3152 log_write(0, LOG_MAIN
, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
3159 if (conn_args
->dane
)
3160 if (dane_tlsa_load(exim_client_ctx
->ssl
, host
, &conn_args
->tlsa_dnsa
, errstr
) != OK
)
3164 #ifndef DISABLE_OCSP
3165 /* Request certificate status at connection-time. If the server
3166 does OCSP stapling we will get the callback (set in tls_init()) */
3167 # ifdef SUPPORT_DANE
3171 if ( ((s
= ob
->hosts_require_ocsp
) && Ustrstr(s
, US
"tls_out_tlsa_usage"))
3172 || ((s
= ob
->hosts_request_ocsp
) && Ustrstr(s
, US
"tls_out_tlsa_usage"))
3174 { /* Re-eval now $tls_out_tlsa_usage is populated. If
3175 this means we avoid the OCSP request, we wasted the setup
3176 cost in tls_init(). */
3177 require_ocsp
= verify_check_given_host(CUSS
&ob
->hosts_require_ocsp
, host
) == OK
;
3178 request_ocsp
= require_ocsp
3179 || verify_check_given_host(CUSS
&ob
->hosts_request_ocsp
, host
) == OK
;
3186 SSL_set_tlsext_status_type(exim_client_ctx
->ssl
, TLSEXT_STATUSTYPE_ocsp
);
3187 client_static_cbinfo
->u_ocsp
.client
.verify_required
= require_ocsp
;
3188 tlsp
->ocsp
= OCSP_NOT_RESP
;
3192 #ifdef EXPERIMENTAL_TLS_RESUME
3193 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx
->ssl
, tlsp
, host
,
3198 #ifndef DISABLE_EVENT
3199 client_static_cbinfo
->event_action
= tb
? tb
->event_action
: NULL
;
3202 /* There doesn't seem to be a built-in timeout on connection. */
3204 DEBUG(D_tls
) debug_printf("Calling SSL_connect\n");
3205 sigalrm_seen
= FALSE
;
3206 ALARM(ob
->command_timeout
);
3207 rc
= SSL_connect(exim_client_ctx
->ssl
);
3211 if (conn_args
->dane
)
3212 DANESSL_cleanup(exim_client_ctx
->ssl
);
3217 tls_error(US
"SSL_connect", host
, sigalrm_seen
? US
"timed out" : NULL
, errstr
);
3223 debug_printf("SSL_connect succeeded\n");
3224 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3226 BIO
* bp
= BIO_new_fp(debug_file
, BIO_NOCLOSE
);
3227 SSL_SESSION_print_keylog(bp
, SSL_get_session(exim_client_ctx
->ssl
));
3233 #ifdef EXPERIMENTAL_TLS_RESUME
3234 tls_client_resume_posthandshake(exim_client_ctx
, tlsp
);
3237 peer_cert(exim_client_ctx
->ssl
, tlsp
, peerdn
, sizeof(peerdn
));
3239 tlsp
->cipher
= construct_cipher_name(exim_client_ctx
->ssl
, &tlsp
->bits
);
3240 tlsp
->cipher_stdname
= cipher_stdname_ssl(exim_client_ctx
->ssl
);
3242 /* Record the certificate we presented */
3244 X509
* crt
= SSL_get_certificate(exim_client_ctx
->ssl
);
3245 tlsp
->ourcert
= crt
? X509_dup(crt
) : NULL
;
3248 tlsp
->active
.sock
= cctx
->sock
;
3249 tlsp
->active
.tls_ctx
= exim_client_ctx
;
3250 cctx
->tls_ctx
= exim_client_ctx
;
3259 tls_refill(unsigned lim
)
3264 DEBUG(D_tls
) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl
,
3265 ssl_xfer_buffer
, ssl_xfer_buffer_size
);
3267 if (smtp_receive_timeout
> 0) ALARM(smtp_receive_timeout
);
3268 inbytes
= SSL_read(server_ssl
, CS ssl_xfer_buffer
,
3269 MIN(ssl_xfer_buffer_size
, lim
));
3270 error
= SSL_get_error(server_ssl
, inbytes
);
3271 if (smtp_receive_timeout
> 0) ALARM_CLR(0);
3273 if (had_command_timeout
) /* set by signal handler */
3274 smtp_command_timeout_exit(); /* does not return */
3275 if (had_command_sigterm
)
3276 smtp_command_sigterm_exit();
3277 if (had_data_timeout
)
3278 smtp_data_timeout_exit();
3279 if (had_data_sigint
)
3280 smtp_data_sigint_exit();
3282 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
3283 closed down, not that the socket itself has been closed down. Revert to
3284 non-SSL handling. */
3288 case SSL_ERROR_NONE
:
3291 case SSL_ERROR_ZERO_RETURN
:
3292 DEBUG(D_tls
) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3294 if (SSL_get_shutdown(server_ssl
) == SSL_RECEIVED_SHUTDOWN
)
3295 SSL_shutdown(server_ssl
);
3297 tls_close(NULL
, TLS_NO_SHUTDOWN
);
3300 /* Handle genuine errors */
3302 ERR_error_string_n(ERR_get_error(), ssl_errstring
, sizeof(ssl_errstring
));
3303 log_write(0, LOG_MAIN
, "TLS error (SSL_read): %s", ssl_errstring
);
3304 ssl_xfer_error
= TRUE
;
3308 DEBUG(D_tls
) debug_printf("Got SSL error %d\n", error
);
3309 DEBUG(D_tls
) if (error
== SSL_ERROR_SYSCALL
)
3310 debug_printf(" - syscall %s\n", strerror(errno
));
3311 ssl_xfer_error
= TRUE
;
3315 #ifndef DISABLE_DKIM
3316 dkim_exim_verify_feed(ssl_xfer_buffer
, inbytes
);
3318 ssl_xfer_buffer_hwm
= inbytes
;
3319 ssl_xfer_buffer_lwm
= 0;
3324 /*************************************************
3325 * TLS version of getc *
3326 *************************************************/
3328 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3329 it refills the buffer via the SSL reading function.
3331 Arguments: lim Maximum amount to read/buffer
3332 Returns: the next character or EOF
3334 Only used by the server-side TLS.
3338 tls_getc(unsigned lim
)
3340 if (ssl_xfer_buffer_lwm
>= ssl_xfer_buffer_hwm
)
3341 if (!tls_refill(lim
))
3342 return ssl_xfer_error
? EOF
: smtp_getc(lim
);
3344 /* Something in the buffer; return next uschar */
3346 return ssl_xfer_buffer
[ssl_xfer_buffer_lwm
++];
3350 tls_getbuf(unsigned * len
)
3355 if (ssl_xfer_buffer_lwm
>= ssl_xfer_buffer_hwm
)
3356 if (!tls_refill(*len
))
3358 if (!ssl_xfer_error
) return smtp_getbuf(len
);
3363 if ((size
= ssl_xfer_buffer_hwm
- ssl_xfer_buffer_lwm
) > *len
)
3365 buf
= &ssl_xfer_buffer
[ssl_xfer_buffer_lwm
];
3366 ssl_xfer_buffer_lwm
+= size
;
3375 #ifndef DISABLE_DKIM
3376 int n
= ssl_xfer_buffer_hwm
- ssl_xfer_buffer_lwm
;
3378 dkim_exim_verify_feed(ssl_xfer_buffer
+ssl_xfer_buffer_lwm
, n
);
3384 tls_could_read(void)
3386 return ssl_xfer_buffer_lwm
< ssl_xfer_buffer_hwm
|| SSL_pending(server_ssl
) > 0;
3390 /*************************************************
3391 * Read bytes from TLS channel *
3392 *************************************************/
3396 ct_ctx client context pointer, or NULL for the one global server context
3400 Returns: the number of bytes read
3401 -1 after a failed read, including EOF
3403 Only used by the client-side TLS.
3407 tls_read(void * ct_ctx
, uschar
*buff
, size_t len
)
3409 SSL
* ssl
= ct_ctx
? ((exim_openssl_client_tls_ctx
*)ct_ctx
)->ssl
: server_ssl
;
3413 DEBUG(D_tls
) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl
,
3414 buff
, (unsigned int)len
);
3416 inbytes
= SSL_read(ssl
, CS buff
, len
);
3417 error
= SSL_get_error(ssl
, inbytes
);
3419 if (error
== SSL_ERROR_ZERO_RETURN
)
3421 DEBUG(D_tls
) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3424 else if (error
!= SSL_ERROR_NONE
)
3434 /*************************************************
3435 * Write bytes down TLS channel *
3436 *************************************************/
3440 ct_ctx client context pointer, or NULL for the one global server context
3443 more further data expected soon
3445 Returns: the number of bytes after a successful write,
3446 -1 after a failed write
3448 Used by both server-side and client-side TLS.
3452 tls_write(void * ct_ctx
, const uschar
*buff
, size_t len
, BOOL more
)
3455 int outbytes
, error
;
3457 ? ((exim_openssl_client_tls_ctx
*)ct_ctx
)->ssl
: server_ssl
;
3458 static gstring
* server_corked
= NULL
;
3459 gstring
** corkedp
= ct_ctx
3460 ? &((exim_openssl_client_tls_ctx
*)ct_ctx
)->corked
: &server_corked
;
3461 gstring
* corked
= *corkedp
;
3463 DEBUG(D_tls
) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__
,
3464 buff
, (unsigned long)len
, more
? ", more" : "");
3466 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
3467 "more" is notified. This hack is only ok if small amounts are involved AND only
3468 one stream does it, in one context (i.e. no store reset). Currently it is used
3469 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
3470 We support callouts done by the server process by using a separate client
3471 context for the stashed information. */
3472 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
3473 a store reset there, so use POOL_PERM. */
3474 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
3476 if ((more
|| corked
))
3478 #ifdef SUPPORT_PIPE_CONNECT
3479 int save_pool
= store_pool
;
3480 store_pool
= POOL_PERM
;
3483 corked
= string_catn(corked
, buff
, len
);
3485 #ifdef SUPPORT_PIPE_CONNECT
3486 store_pool
= save_pool
;
3494 buff
= CUS corked
->s
;
3499 for (int left
= len
; left
> 0;)
3501 DEBUG(D_tls
) debug_printf("SSL_write(%p, %p, %d)\n", ssl
, buff
, left
);
3502 outbytes
= SSL_write(ssl
, CS buff
, left
);
3503 error
= SSL_get_error(ssl
, outbytes
);
3504 DEBUG(D_tls
) debug_printf("outbytes=%d error=%d\n", outbytes
, error
);
3508 ERR_error_string_n(ERR_get_error(), ssl_errstring
, sizeof(ssl_errstring
));
3509 log_write(0, LOG_MAIN
, "TLS error (SSL_write): %s", ssl_errstring
);
3512 case SSL_ERROR_NONE
:
3517 case SSL_ERROR_ZERO_RETURN
:
3518 log_write(0, LOG_MAIN
, "SSL channel closed on write");
3521 case SSL_ERROR_SYSCALL
:
3522 log_write(0, LOG_MAIN
, "SSL_write: (from %s) syscall: %s",
3523 sender_fullhost
? sender_fullhost
: US
"<unknown>",
3528 log_write(0, LOG_MAIN
, "SSL_write error %d", error
);
3537 /*************************************************
3538 * Close down a TLS session *
3539 *************************************************/
3541 /* This is also called from within a delivery subprocess forked from the
3542 daemon, to shut down the TLS library, without actually doing a shutdown (which
3543 would tamper with the SSL session in the parent process).
3546 ct_ctx client TLS context pointer, or NULL for the one global server context
3547 shutdown 1 if TLS close-alert is to be sent,
3548 2 if also response to be waited for
3552 Used by both server-side and client-side TLS.
3556 tls_close(void * ct_ctx
, int shutdown
)
3558 exim_openssl_client_tls_ctx
* o_ctx
= ct_ctx
;
3559 SSL_CTX
**ctxp
= o_ctx
? &o_ctx
->ctx
: &server_ctx
;
3560 SSL
**sslp
= o_ctx
? &o_ctx
->ssl
: &server_ssl
;
3561 int *fdp
= o_ctx
? &tls_out
.active
.sock
: &tls_in
.active
.sock
;
3563 if (*fdp
< 0) return; /* TLS was not active */
3568 DEBUG(D_tls
) debug_printf("tls_close(): shutting down TLS%s\n",
3569 shutdown
> 1 ? " (with response-wait)" : "");
3571 if ( (rc
= SSL_shutdown(*sslp
)) == 0 /* send "close notify" alert */
3575 rc
= SSL_shutdown(*sslp
); /* wait for response */
3579 if (rc
< 0) DEBUG(D_tls
)
3581 ERR_error_string_n(ERR_get_error(), ssl_errstring
, sizeof(ssl_errstring
));
3582 debug_printf("SSL_shutdown: %s\n", ssl_errstring
);
3586 if (!o_ctx
) /* server side */
3588 #ifndef DISABLE_OCSP
3589 sk_X509_pop_free(server_static_cbinfo
->verify_stack
, X509_free
);
3590 server_static_cbinfo
->verify_stack
= NULL
;
3593 receive_getc
= smtp_getc
;
3594 receive_getbuf
= smtp_getbuf
;
3595 receive_get_cache
= smtp_get_cache
;
3596 receive_ungetc
= smtp_ungetc
;
3597 receive_feof
= smtp_feof
;
3598 receive_ferror
= smtp_ferror
;
3599 receive_smtp_buffered
= smtp_buffered
;
3600 tls_in
.active
.tls_ctx
= NULL
;
3602 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3605 SSL_CTX_free(*ctxp
);
3615 /*************************************************
3616 * Let tls_require_ciphers be checked at startup *
3617 *************************************************/
3619 /* The tls_require_ciphers option, if set, must be something which the
3622 Returns: NULL on success, or error message
3626 tls_validate_require_cipher(void)
3629 uschar
*s
, *expciphers
, *err
;
3631 /* this duplicates from tls_init(), we need a better "init just global
3632 state, for no specific purpose" singleton function of our own */
3634 #ifdef EXIM_NEED_OPENSSL_INIT
3635 SSL_load_error_strings();
3636 OpenSSL_add_ssl_algorithms();
3638 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
3639 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
3640 list of available digests. */
3641 EVP_add_digest(EVP_sha256());
3644 if (!(tls_require_ciphers
&& *tls_require_ciphers
))
3647 if (!expand_check(tls_require_ciphers
, US
"tls_require_ciphers", &expciphers
,
3649 return US
"failed to expand tls_require_ciphers";
3651 if (!(expciphers
&& *expciphers
))
3654 /* normalisation ripped from above */
3656 while (*s
!= 0) { if (*s
== '_') *s
= '-'; s
++; }
3660 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
3661 if (!(ctx
= SSL_CTX_new(TLS_server_method())))
3663 if (!(ctx
= SSL_CTX_new(SSLv23_server_method())))
3666 ERR_error_string_n(ERR_get_error(), ssl_errstring
, sizeof(ssl_errstring
));
3667 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring
);
3671 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers
);
3673 if (!SSL_CTX_set_cipher_list(ctx
, CS expciphers
))
3675 ERR_error_string_n(ERR_get_error(), ssl_errstring
, sizeof(ssl_errstring
));
3676 err
= string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
3677 expciphers
, ssl_errstring
);
3688 /*************************************************
3689 * Report the library versions. *
3690 *************************************************/
3692 /* There have historically been some issues with binary compatibility in
3693 OpenSSL libraries; if Exim (like many other applications) is built against
3694 one version of OpenSSL but the run-time linker picks up another version,
3695 it can result in serious failures, including crashing with a SIGSEGV. So
3696 report the version found by the compiler and the run-time version.
3698 Note: some OS vendors backport security fixes without changing the version
3699 number/string, and the version date remains unchanged. The _build_ date
3700 will change, so we can more usefully assist with version diagnosis by also
3701 reporting the build date.
3703 Arguments: a FILE* to print the results to
3708 tls_version_report(FILE *f
)
3710 fprintf(f
, "Library version: OpenSSL: Compile: %s\n"
3713 OPENSSL_VERSION_TEXT
,
3714 SSLeay_version(SSLEAY_VERSION
),
3715 SSLeay_version(SSLEAY_BUILT_ON
));
3716 /* third line is 38 characters for the %s and the line is 73 chars long;
3717 the OpenSSL output includes a "built on: " prefix already. */
3723 /*************************************************
3724 * Random number generation *
3725 *************************************************/
3727 /* Pseudo-random number generation. The result is not expected to be
3728 cryptographically strong but not so weak that someone will shoot themselves
3729 in the foot using it as a nonce in input in some email header scheme or
3730 whatever weirdness they'll twist this into. The result should handle fork()
3731 and avoid repeating sequences. OpenSSL handles that for us.
3735 Returns a random number in range [0, max-1]
3739 vaguely_random_number(int max
)
3743 static pid_t pidlast
= 0;
3745 uschar smallbuf
[sizeof(r
)];
3751 if (pidnow
!= pidlast
)
3753 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
3754 is unique for each thread", this doesn't apparently apply across processes,
3755 so our own warning from vaguely_random_number_fallback() applies here too.
3756 Fix per PostgreSQL. */
3762 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
3766 gettimeofday(&r
.tv
, NULL
);
3769 RAND_seed(US (&r
), sizeof(r
));
3771 /* We're after pseudo-random, not random; if we still don't have enough data
3772 in the internal PRNG then our options are limited. We could sleep and hope
3773 for entropy to come along (prayer technique) but if the system is so depleted
3774 in the first place then something is likely to just keep taking it. Instead,
3775 we'll just take whatever little bit of pseudo-random we can still manage to
3778 needed_len
= sizeof(r
);
3779 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
3780 asked for a number less than 10. */
3781 for (r
= max
, i
= 0; r
; ++i
)
3787 #ifdef EXIM_HAVE_RAND_PSEUDO
3788 /* We do not care if crypto-strong */
3789 i
= RAND_pseudo_bytes(smallbuf
, needed_len
);
3791 i
= RAND_bytes(smallbuf
, needed_len
);
3797 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
3798 return vaguely_random_number_fallback(max
);
3802 for (uschar
* p
= smallbuf
; needed_len
; --needed_len
, ++p
)
3805 /* We don't particularly care about weighted results; if someone wants
3806 smooth distribution and cares enough then they should submit a patch then. */
3813 /*************************************************
3814 * OpenSSL option parse *
3815 *************************************************/
3817 /* Parse one option for tls_openssl_options_parse below
3820 name one option name
3821 value place to store a value for it
3822 Returns success or failure in parsing
3828 tls_openssl_one_option_parse(uschar
*name
, long *value
)
3831 int last
= exim_openssl_options_size
;
3832 while (last
> first
)
3834 int middle
= (first
+ last
)/2;
3835 int c
= Ustrcmp(name
, exim_openssl_options
[middle
].name
);
3838 *value
= exim_openssl_options
[middle
].value
;
3852 /*************************************************
3853 * OpenSSL option parsing logic *
3854 *************************************************/
3856 /* OpenSSL has a number of compatibility options which an administrator might
3857 reasonably wish to set. Interpret a list similarly to decode_bits(), so that
3858 we look like log_selector.
3861 option_spec the administrator-supplied string of options
3862 results ptr to long storage for the options bitmap
3863 Returns success or failure
3867 tls_openssl_options_parse(uschar
*option_spec
, long *results
)
3872 BOOL adding
, item_parsed
;
3874 /* Server: send no (<= TLS1.2) session tickets */
3875 result
= SSL_OP_NO_TICKET
;
3877 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
3878 * from default because it increases BEAST susceptibility. */
3879 #ifdef SSL_OP_NO_SSLv2
3880 result
|= SSL_OP_NO_SSLv2
;
3882 #ifdef SSL_OP_NO_SSLv3
3883 result
|= SSL_OP_NO_SSLv3
;
3885 #ifdef SSL_OP_SINGLE_DH_USE
3886 result
|= SSL_OP_SINGLE_DH_USE
;
3895 for (uschar
* s
= option_spec
; *s
; /**/)
3897 while (isspace(*s
)) ++s
;
3900 if (*s
!= '+' && *s
!= '-')
3902 DEBUG(D_tls
) debug_printf("malformed openssl option setting: "
3903 "+ or - expected but found \"%s\"\n", s
);
3906 adding
= *s
++ == '+';
3907 for (end
= s
; (*end
!= '\0') && !isspace(*end
); ++end
) /**/ ;
3910 item_parsed
= tls_openssl_one_option_parse(s
, &item
);
3914 DEBUG(D_tls
) debug_printf("openssl option setting unrecognised: \"%s\"\n", s
);
3917 DEBUG(D_tls
) debug_printf("openssl option, %s %8lx: %lx (%s)\n",
3918 adding
? "adding to " : "removing from", result
, item
, s
);
3930 #endif /*!MACRO_PREDEF*/
3933 /* End of tls-openssl.c */