[exim] some OpenSSL topics

Pàgina inicial
Delete this message
Reply to this message
Autor: Wolfgang Breyha
Data:  
A: exim-users@exim.org
Assumpte: [exim] some OpenSSL topics
Hi!

I'm currently trying to get my exim/openssl installation "right".

*) One thing I noticed is that openssl 1.0.1e sets:
/* SSL_OP_ALL: various bug workarounds that should be rather harmless.
 *             This used to be 0x000FFFFFL before 0.9.7. */
#define SSL_OP_ALL                                      0x80000BFFL


Since exim uses SSL_OP_ALL as "all" as well it isn't "all" anymore.

Negating the defaults (eg. no_sslv2) with "-all" as documented in
http://www.exim.org/exim-html-current/doc/html/spec_html/ch-main_configuration.html#SECTalomo
wont work.

*) Another thing I'm currently trying to achieve is a preferred cipher list
preferring PFS with ECDHE first, DHE second, no PFS last.
I use
openssl_options = +no_sslv2 +no_compression +cipher_server_preference
+single_dh_use +single_ecdh_use
tls_require_ciphers = ECDH:kEDH:HIGH:RC4-SHA:!PSK:!KRB5:!aNULL:!MD5:!DES

But still, ECDHE ciphers are not used if exim is in server mode. "openssl
ciphers" with the upper selection outputs:
ECDHE-RSA-AES256-GCM-SHA384:....:ECDHE-RSA-AES256-SHA384:....:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:....

If I connect to this server with the same openssl libraries using:
openssl s_client -starttls smtp -connect <host>:25 -cipher
'ECDH:kEDH:HIGH:RC4-SHA:!PSK:!KRB5:!aNULL:!MD5:!DES'
I get
    Protocol  : TLSv1.2
    Cipher    : DHE-RSA-AES256-GCM-SHA384


Exim Debug output shows:
16855 openssl option, adding from 1000000: 1000000 (no_sslv2)
16855 openssl option, adding from 1000000: 20000 (no_compression)
16855 openssl option, adding from 1020000: 400000 (cipher_server_preference)
16855 openssl option, adding from 1420000: 100000 (single_dh_use)
16855 openssl option, adding from 1520000: 80000 (single_ecdh_use)
16855 setting SSL CTX options: 0x15a0000
...
16855 required ciphers: ECDH:kEDH:HIGH:RC4-SHA:!PSK:!KRB5:!aNULL:!MD5:!DES
...
16855 SSL_accept was successful
16855 Cipher: TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256
16855 Shared ciphers: <exactly the same ciphers as "openssl ciphers" shows...
including
ECDHE-RSA-AES256-GCM-SHA384:....:ECDHE-RSA-AES256-SHA384:....:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:....>

Same s_client to GMX uses:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384


If I use -cipher 'ECDHE-RSA-AES256-GCM-SHA384' on the upper exim I get "no
shared ciphers found"!?

I can't figure out why!? Is there something missing in exim openssl code to
support ECDH?

Greetings, Wolfgang
--
Wolfgang Breyha <wbreyha@???> | http://www.blafasel.at/
Vienna University Computer Center | Austria