1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Copyright (c) Phil Pennock 2012 */
11 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
12 one of the available supported implementations. This file is #included into
13 tls.c when USE_GNUTLS has been set.
15 The code herein is a revamp of GnuTLS integration using the current APIs; the
16 original tls-gnu.c was based on a patch which was contributed by Nikos
17 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
20 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
21 which is not widely deployed by OS vendors. Will note issues below, which may
22 assist in updating the code in the future. Another sources of hints is
23 mod_gnutls for Apache (SNI callback registration and handling).
25 Keeping client and server variables more split than before and is currently
26 the norm, in anticipation of TLS in ACL callouts.
28 I wanted to switch to gnutls_certificate_set_verify_function() so that
29 certificate rejection could happen during handshake where it belongs, rather
30 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
31 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
33 (I wasn't looking for libraries quite that old, when updating to get rid of
34 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
35 require current GnuTLS, then we'll drop support for the ancient libraries).
38 #include <gnutls/gnutls.h>
39 /* needed for cert checks in verification and DN extraction: */
40 #include <gnutls/x509.h>
41 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
42 #include <gnutls/crypto.h>
44 /* needed to disable PKCS11 autoload unless requested */
45 #if GNUTLS_VERSION_NUMBER >= 0x020c00
46 # include <gnutls/pkcs11.h>
47 # define SUPPORT_PARAM_TO_PK_BITS
49 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
50 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
53 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
54 # warning "GnuTLS library version too old; tls:cert event unsupported"
55 # define DISABLE_EVENT
57 #if GNUTLS_VERSION_NUMBER >= 0x030000
58 # define SUPPORT_SELFSIGN /* Uncertain what version is first usable but 2.12.23 is not */
60 #if GNUTLS_VERSION_NUMBER >= 0x030306
61 # define SUPPORT_CA_DIR
63 # undef SUPPORT_CA_DIR
65 #if GNUTLS_VERSION_NUMBER >= 0x030014
66 # define SUPPORT_SYSDEFAULT_CABUNDLE
68 #if GNUTLS_VERSION_NUMBER >= 0x030104
69 # define GNUTLS_CERT_VFY_STATUS_PRINT
71 #if GNUTLS_VERSION_NUMBER >= 0x030109
74 #if GNUTLS_VERSION_NUMBER >= 0x03010a
75 # define SUPPORT_GNUTLS_SESS_DESC
77 #if GNUTLS_VERSION_NUMBER >= 0x030300
78 # define GNUTLS_AUTO_GLOBAL_INIT
79 # define GNUTLS_AUTO_PKCS11_MANUAL
81 #if (GNUTLS_VERSION_NUMBER >= 0x030404) \
82 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
84 # define EXIM_HAVE_OCSP
87 #if GNUTLS_VERSION_NUMBER >= 0x030500
88 # define SUPPORT_GNUTLS_KEYLOG
90 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
91 # define SUPPORT_SRV_OCSP_STACK
93 #if GNUTLS_VERSION_NUMBER >= 0x030600
94 # define GNUTLS_AUTO_DHPARAMS
96 #if GNUTLS_VERSION_NUMBER >= 0x030603
97 # define EXIM_HAVE_TLS1_3
98 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
99 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
103 # if GNUTLS_VERSION_NUMBER >= 0x030000
104 # define DANESSL_USAGE_DANE_TA 2
105 # define DANESSL_USAGE_DANE_EE 3
107 # error GnuTLS version too early for DANE
109 # if GNUTLS_VERSION_NUMBER < 0x999999
110 # define GNUTLS_BROKEN_DANE_VALIDATION
114 #ifndef DISABLE_TLS_RESUME
115 # if GNUTLS_VERSION_NUMBER >= 0x030603
116 # define EXIM_HAVE_TLS_RESUME
118 # warning "GnuTLS library version too old; resumption unsupported"
122 #if GNUTLS_VERSION_NUMBER >= 0x030200
123 # define EXIM_HAVE_ALPN
127 # include <gnutls/ocsp.h>
130 # include <gnutls/dane.h>
133 #include "tls-cipher-stdname.c"
140 # ifndef DISABLE_TLS_RESUME
141 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
143 # ifdef EXIM_HAVE_TLS1_3
144 builtin_macro_create(US"_HAVE_TLS1_3");
146 # ifdef EXIM_HAVE_OCSP
147 builtin_macro_create(US"_HAVE_TLS_OCSP");
149 # ifdef SUPPORT_SRV_OCSP_STACK
150 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
152 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
153 builtin_macro_create(US"_HAVE_TLS_CA_CACHE");
162 gnutls_global_set_audit_log_function()
165 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
168 /* Local static variables for GnuTLS */
170 /* Values for verify_requirement */
172 enum peer_verify_requirement
173 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
175 /* This holds most state for server or client; with this, we can set up an
176 outbound TLS-enabled connection in an ACL callout, while not stomping all
177 over the TLS variables available for expansion.
179 Some of these correspond to variables in globals.c; those variables will
180 be set to point to content in one of these instances, as appropriate for
181 the stage of the process lifetime.
183 Not handled here: global tlsp->tls_channelbinding.
186 typedef struct exim_gnutls_state {
187 gnutls_session_t session;
189 exim_tlslib_state lib_state;
190 #define x509_cred libdata0
191 #define pri_cache libdata1
193 enum peer_verify_requirement verify_requirement;
197 BOOL peer_cert_verified:1;
198 BOOL peer_dane_verified:1;
199 BOOL trigger_sni_changes:1;
200 BOOL have_set_peerdn:1;
201 BOOL xfer_eof:1; /*XXX never gets set! */
207 const struct host_item *host; /* NULL if server */
208 gnutls_x509_crt_t peercert;
211 uschar *received_sni;
213 const uschar *tls_certificate;
214 const uschar *tls_privatekey;
215 const uschar *tls_sni; /* client send only, not received */
216 const uschar *tls_verify_certificates;
217 const uschar *tls_crl;
218 const uschar *tls_require_ciphers;
220 uschar *exp_tls_certificate;
221 uschar *exp_tls_privatekey;
222 uschar *exp_tls_verify_certificates;
224 uschar *exp_tls_require_ciphers;
225 const uschar *exp_tls_verify_cert_hostnames;
226 #ifndef DISABLE_EVENT
227 uschar *event_action;
230 char * const * dane_data;
231 const int * dane_data_len;
234 tls_support *tlsp; /* set in tls_init() */
239 } exim_gnutls_state_st;
241 static const exim_gnutls_state_st exim_gnutls_state_init = {
242 /* all elements not explicitly intialised here get 0/NULL/FALSE */
247 /* Not only do we have our own APIs which don't pass around state, assuming
248 it's held in globals, GnuTLS doesn't appear to let us register callback data
249 for callbacks, or as part of the session, so we have to keep a "this is the
250 context we're currently dealing with" pointer and rely upon being
251 single-threaded to keep from processing data on an inbound TLS connection while
252 talking to another TLS connection for an outbound check. This does mean that
253 there's no way for heart-beats to be responded to, for the duration of the
255 XXX But see gnutls_session_get_ptr()
258 static exim_gnutls_state_st state_server = {
259 /* all elements not explicitly intialised here get 0/NULL/FALSE */
264 #ifndef GNUTLS_AUTO_DHPARAMS
265 /* dh_params are initialised once within the lifetime of a process using TLS;
266 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
267 don't want to repeat this. */
269 static gnutls_dh_params_t dh_server_params = NULL;
272 static int ssl_session_timeout = 7200; /* Two hours */
274 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
276 /* Guard library core initialisation */
278 static BOOL exim_gnutls_base_init_done = FALSE;
281 static BOOL gnutls_buggy_ocsp = FALSE;
282 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
285 #ifdef EXIM_HAVE_ALPN
286 static BOOL server_seen_alpn = FALSE;
288 #ifdef EXIM_HAVE_TLS_RESUME
289 static gnutls_datum_t server_sessticket_key;
293 /* ------------------------------------------------------------------------ */
296 #define MAX_HOST_LEN 255
298 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
299 the library logging; a value less than 0 disables the calls to set up logging
300 callbacks. GNuTLS also looks for an environment variable - except not for
301 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
302 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
303 but the env var must be added to /etc/sudoers too. */
304 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
305 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
308 #ifndef EXIM_CLIENT_DH_MIN_BITS
309 # define EXIM_CLIENT_DH_MIN_BITS 1024
312 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
313 can ask for a bit-strength. Without that, we stick to the constant we had
315 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
316 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
319 #define Expand_check_tlsvar(Varname, errstr) \
320 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
322 #if GNUTLS_VERSION_NUMBER >= 0x020c00
323 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
324 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
325 # define HAVE_GNUTLS_RND
326 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
327 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
328 * isn't available sometimes, so this needs to become a conditional
329 * compilation; the sanest way to deal with this being a problem on
330 * older OSes is to block it in the Local/Makefile with this compiler
332 # ifndef AVOID_GNUTLS_PKCS11
333 # define HAVE_GNUTLS_PKCS11
334 # endif /* AVOID_GNUTLS_PKCS11 */
340 /* ------------------------------------------------------------------------ */
341 /* Callback declarations */
343 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
344 static void exim_gnutls_logger_cb(int level, const char *message);
347 static int exim_sni_handling_cb(gnutls_session_t session);
349 #ifdef EXIM_HAVE_TLS_RESUME
351 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
352 unsigned incoming, const gnutls_datum_t * msg);
356 /*************************************************
358 *************************************************/
360 /* Called from lots of places when errors occur before actually starting to do
361 the TLS handshake, that is, while the session is still in clear. Always returns
362 DEFER for a server and FAIL for a client so that most calls can use "return
363 tls_error(...)" to do this processing and then give an appropriate return. A
364 single function is used for both server and client, because it is called from
365 some shared functions.
368 prefix text to include in the logged error
369 msg additional error string (may be NULL)
370 usually obtained from gnutls_strerror()
371 host NULL if setting up a server;
372 the connected host if setting up a client
373 errstr pointer to returned error string
375 Returns: OK/DEFER/FAIL
379 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
383 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
384 return host ? FAIL : DEFER;
389 tls_error_gnu(const uschar *prefix, int err, const host_item *host,
392 return tls_error(prefix, US gnutls_strerror(err), host, errstr);
396 tls_error_sys(const uschar *prefix, int err, const host_item *host,
399 return tls_error(prefix, US strerror(err), host, errstr);
403 /* ------------------------------------------------------------------------ */
409 tls_is_buggy_ocsp(void)
412 uschar maj, mid, mic;
414 s = CUS gnutls_check_version(NULL);
418 while (*s && *s != '.') s++;
426 while (*s && *s != '.') s++;
428 return mic <= (mid == 3 ? 16 : 3);
438 tls_g_init(uschar ** errstr)
441 DEBUG(D_tls) debug_printf("GnuTLS global init required\n");
443 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
444 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
445 which loads modules from a config file, which sounds good and may be wanted
446 by some sysadmin, but also means in common configurations that GNOME keyring
447 environment variables are used and so breaks for users calling mailq.
448 To prevent this, we init PKCS11 first, which is the documented approach. */
450 if (!gnutls_allow_auto_pkcs11)
451 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
452 return tls_error_gnu(US"gnutls_pkcs11_init", rc, NULL, errstr);
455 #ifndef GNUTLS_AUTO_GLOBAL_INIT
456 if ((rc = gnutls_global_init()))
457 return tls_error_gnu(US"gnutls_global_init", rc, NULL, errstr);
460 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
463 gnutls_global_set_log_function(exim_gnutls_logger_cb);
464 /* arbitrarily chosen level; bump up to 9 for more */
465 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
470 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
471 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
474 exim_gnutls_base_init_done = TRUE;
480 /* Daemon-call before each connection. Nothing to do for GnuTLS. */
483 tls_per_lib_daemon_tick(void)
487 /* Daemon one-time initialisation */
490 tls_per_lib_daemon_init(void)
492 uschar * dummy_errstr;
493 static BOOL once = FALSE;
495 if (!exim_gnutls_base_init_done)
496 tls_g_init(&dummy_errstr);
502 #ifdef EXIM_HAVE_TLS_RESUME
503 /* We are dependent on the GnuTLS implementation of the Session Ticket
504 encryption; both the strength and the key rotation period. We hope that
505 the strength at least matches that of the ciphersuite (but GnuTLS does not
508 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
509 if (f.running_in_test_harness) ssl_session_timeout = 6;
512 tls_daemon_creds_reload();
516 /* ------------------------------------------------------------------------ */
518 /*************************************************
519 * Deal with logging errors during I/O *
520 *************************************************/
522 /* We have to get the identity of the peer from saved data.
525 state the current GnuTLS exim state container
526 rc the GnuTLS error code, or 0 if it's a local error
527 when text identifying read or write
528 text local error text when rc is 0
534 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
539 msg = rc == GNUTLS_E_FATAL_ALERT_RECEIVED
540 ? string_sprintf("A TLS fatal alert has been received: %s",
541 US gnutls_alert_get_name(gnutls_alert_get(state->session)))
542 #ifdef GNUTLS_E_PREMATURE_TERMINATION
543 : rc == GNUTLS_E_PREMATURE_TERMINATION && errno
544 ? string_sprintf("%s: syscall: %s", US gnutls_strerror(rc), strerror(errno))
546 : US gnutls_strerror(rc);
548 (void) tls_error(when, msg, state->host, &errstr);
551 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
552 state->host->name, state->host->address, errstr);
555 uschar * conn_info = smtp_get_connection_info();
556 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
557 /* I'd like to get separated H= here, but too hard for now */
558 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
565 /*************************************************
566 * Set various Exim expansion vars *
567 *************************************************/
569 #define exim_gnutls_cert_err(Label) \
572 if (rc != GNUTLS_E_SUCCESS) \
574 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
575 (Label), gnutls_strerror(rc)); \
581 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
585 rc = gnutls_x509_crt_init(crtp);
586 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
588 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
589 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
594 #undef exim_gnutls_cert_err
597 /* We set various Exim global variables from the state, once a session has
598 been established. With TLS callouts, may need to change this to stack
599 variables, or just re-call it with the server state after client callout
602 Make sure anything set here is unset in tls_getc().
606 tls_bits strength indicator
607 tls_certificate_verified bool indicator
608 tls_channelbinding for some SASL mechanisms
611 tls_peercert pointer to library internal
613 tls_sni a (UTF-8) string
614 tls_ourcert pointer to library internal
617 state the relevant exim_gnutls_state_st *
621 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
623 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
626 gnutls_datum_t channel;
628 tls_support * tlsp = state->tlsp;
630 tlsp->active.sock = state->fd_out;
631 tlsp->active.tls_ctx = state;
633 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
635 tlsp->certificate_verified = state->peer_cert_verified;
637 tlsp->dane_verified = state->peer_dane_verified;
640 /* note that tls_channelbinding is not saved to the spool file, since it's
641 only available for use for authenticators while this TLS session is running. */
643 tlsp->channelbinding = NULL;
644 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
647 if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
648 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
651 /* Declare the taintedness of the binding info. On server, untainted; on
652 client, tainted - being the Finish msg from the server. */
654 old_pool = store_pool;
655 store_pool = POOL_PERM;
656 tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size,
658 store_pool = old_pool;
659 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n");
663 /* peercert is set in peer_status() */
664 tlsp->peerdn = state->peerdn;
666 /* do not corrupt sni sent by client; record sni rxd by server */
668 tlsp->sni = state->received_sni;
670 /* record our certificate */
672 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
673 gnutls_x509_crt_t crt;
675 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
682 #ifndef GNUTLS_AUTO_DHPARAMS
683 /*************************************************
684 * Setup up DH parameters *
685 *************************************************/
687 /* Generating the D-H parameters may take a long time. They only need to
688 be re-generated every so often, depending on security policy. What we do is to
689 keep these parameters in a file in the spool directory. If the file does not
690 exist, we generate them. This means that it is easy to cause a regeneration.
692 The new file is written as a temporary file and renamed, so that an incomplete
693 file is never present. If two processes both compute some new parameters, you
694 waste a bit of effort, but it doesn't seem worth messing around with locking to
697 Returns: OK/DEFER/FAIL
701 init_server_dh(uschar ** errstr)
704 unsigned int dh_bits;
705 gnutls_datum_t m = {.data = NULL, .size = 0};
706 uschar filename_buf[PATH_MAX];
707 uschar *filename = NULL;
709 uschar *exp_tls_dhparam;
710 BOOL use_file_in_spool = FALSE;
711 host_item *host = NULL; /* dummy for macros */
713 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params\n");
715 if ((rc = gnutls_dh_params_init(&dh_server_params)))
716 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
718 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
721 if (!exp_tls_dhparam)
723 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
724 m.data = US std_dh_prime_default();
725 m.size = Ustrlen(m.data);
727 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
728 use_file_in_spool = TRUE;
729 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
731 DEBUG(D_tls) debug_printf("Requested no DH parameters\n");
734 else if (exp_tls_dhparam[0] != '/')
736 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
737 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
738 m.size = Ustrlen(m.data);
741 filename = exp_tls_dhparam;
745 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
746 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
747 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
751 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
752 /* If you change this constant, also change dh_param_fn_ext so that we can use a
753 different filename and ensure we have sufficient bits. */
755 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
756 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
758 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits\n",
761 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
763 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits\n",
767 /* Some clients have hard-coded limits. */
768 if (dh_bits > tls_dh_max_bits)
771 debug_printf("tls_dh_max_bits clamping override, using %d bits instead\n",
773 dh_bits = tls_dh_max_bits;
776 if (use_file_in_spool)
778 if (!string_format(filename_buf, sizeof(filename_buf),
779 "%s/gnutls-params-%d", spool_directory, dh_bits))
780 return tls_error(US"overlong filename", NULL, NULL, errstr);
781 filename = filename_buf;
784 /* Open the cache file for reading and if successful, read it and set up the
787 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
793 if (fstat(fd, &statbuf) < 0) /* EIO */
797 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
799 if (!S_ISREG(statbuf.st_mode))
802 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
804 if (!(fp = fdopen(fd, "rb")))
808 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
809 saved_errno, NULL, errstr);
812 m.size = statbuf.st_size;
813 if (!(m.data = store_malloc(m.size)))
816 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
818 if (!(sz = fread(m.data, m.size, 1, fp)))
823 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
827 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
830 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
831 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
834 /* If the file does not exist, fall through to compute new data and cache it.
835 If there was any other opening error, it is serious. */
837 else if (errno == ENOENT)
841 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
844 return tls_error(string_open_failed("\"%s\" for reading", filename),
847 /* If ret < 0, either the cache file does not exist, or the data it contains
848 is not useful. One particular case of this is when upgrading from an older
849 release of Exim in which the data was stored in a different format. We don't
850 try to be clever and support both formats; we just regenerate new data in this
856 unsigned int dh_bits_gen = dh_bits;
858 if ((PATH_MAX - Ustrlen(filename)) < 10)
859 return tls_error(US"Filename too long to generate replacement",
860 filename, NULL, errstr);
862 temp_fn = string_copy(US"exim-dh.XXXXXXX");
863 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
864 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
865 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
867 /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But
868 there's no way to ask GnuTLS how many bits there really are. We can ask
869 how many bits were used in a TLS session, but that's it! The prime itself
870 is hidden behind too much abstraction. So we ask for less, and proceed on
871 a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */
873 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
875 dh_bits_gen = dh_bits - 10;
877 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
882 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
884 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
885 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
887 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
888 and I confirmed that a NULL call to get the size first is how the GnuTLS
889 sample apps handle this. */
893 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
894 GNUTLS_X509_FMT_PEM, m.data, &sz))
895 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
896 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
899 if (!(m.data = store_malloc(m.size)))
900 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
902 /* this will return a size 1 less than the allocation size above */
903 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
907 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
909 m.size = sz; /* shrink by 1, probably */
911 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
914 return tls_error_sys(US"TLS cache write D-H params failed",
915 errno, NULL, errstr);
918 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
919 return tls_error_sys(US"TLS cache write D-H params final newline failed",
920 errno, NULL, errstr);
922 if ((rc = close(fd)))
923 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
925 if (Urename(temp_fn, filename) < 0)
926 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
927 temp_fn, filename), errno, NULL, errstr);
929 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
932 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
940 /* Create and install a selfsigned certificate, for use in server mode. */
943 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
945 gnutls_x509_crt_t cert = NULL;
947 gnutls_x509_privkey_t pkey = NULL;
948 const uschar * where;
951 #ifndef SUPPORT_SELFSIGN
952 where = US"library too old";
953 rc = GNUTLS_E_NO_CERTIFICATE_FOUND;
957 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
958 where = US"initialising pkey";
959 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
961 where = US"initialising cert";
962 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
964 where = US"generating pkey"; /* Hangs on 2.12.23 */
965 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
966 #ifdef SUPPORT_PARAM_TO_PK_BITS
967 # ifndef GNUTLS_SEC_PARAM_MEDIUM
968 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
970 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
977 where = US"configuring cert";
979 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
980 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
981 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
982 || (rc = gnutls_x509_crt_set_expiration_time(cert, (long)2 * 60 * 60)) /* 2 hour */
983 || (rc = gnutls_x509_crt_set_key(cert, pkey))
985 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
986 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
987 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
988 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
989 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
990 GNUTLS_OID_X520_COMMON_NAME, 0,
991 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
995 where = US"signing cert";
996 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
998 where = US"installing selfsign cert";
1000 if ((rc = gnutls_certificate_set_x509_key(state->lib_state.x509_cred,
1007 if (cert) gnutls_x509_crt_deinit(cert);
1008 if (pkey) gnutls_x509_privkey_deinit(pkey);
1012 rc = tls_error_gnu(where, rc, NULL, errstr);
1019 /* Add certificate and key, from files.
1022 Zero or negative: good. Negate value for certificate index if < 0.
1023 Greater than zero: FAIL or DEFER code.
1027 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
1028 const uschar * certfile, const uschar * keyfile, uschar ** errstr)
1030 int rc = gnutls_certificate_set_x509_key_file(state->lib_state.x509_cred,
1031 CCS certfile, CCS keyfile, GNUTLS_X509_FMT_PEM);
1033 return tls_error_gnu(
1034 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
1040 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1041 /* Load an OCSP proof from file for sending by the server. Called
1042 on getting a status-request handshake message, for earlier versions
1046 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1047 gnutls_datum_t * ocsp_response)
1050 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
1052 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1054 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1056 tls_in.ocsp = OCSP_NOT_RESP;
1057 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1060 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1066 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1067 /* Make a note that we saw a status-request */
1069 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
1070 const unsigned char *data, unsigned size)
1072 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1075 case 5: /* status_request */
1076 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
1077 tls_in.ocsp = OCSP_NOT_RESP;
1079 #ifdef EXIM_HAVE_ALPN
1080 case 16: /* Application Layer Protocol Notification */
1081 DEBUG(D_tls) debug_printf("Seen ALPN extension from client\n");
1082 server_seen_alpn = TRUE;
1089 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
1091 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
1092 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1094 /* Call fn for each extension seen. 3.6.3 onwards */
1095 return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
1096 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
1100 # ifdef notdef_crashes
1101 /* Make a note that we saw a status-response */
1103 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
1104 const unsigned char *data, unsigned size)
1106 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
1107 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1108 if (FALSE && tls_id == 5) /* status_request */
1110 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
1111 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1112 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1118 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
1120 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
1121 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1123 /* Call fn for each extension seen. 3.6.3 onwards */
1124 # ifdef notdef_crashes
1126 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
1129 #endif /*SUPPORT_GNUTLS_EXT_RAW_PARSE*/
1131 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
1132 "Handshake Protocol: Certificate" record.
1133 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
1135 This is different to tls1.2 - where it is a separate record (wireshark term) / handshake message (gnutls term).
1138 #if defined(EXIM_HAVE_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1139 /* Callback for certificate-status, on server. We sent stapled OCSP. */
1141 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
1142 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1144 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
1145 #ifdef SUPPORT_SRV_OCSP_STACK
1146 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1147 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1149 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1154 /* Callback for handshake messages, on server */
1156 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1157 unsigned incoming, const gnutls_datum_t * msg)
1159 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
1162 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1163 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1164 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1165 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1166 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1168 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1169 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1170 # ifdef EXIM_HAVE_TLS_RESUME
1171 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1172 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1181 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1183 tls_server_testharness_ocsp_fiddle(void)
1185 extern char ** environ;
1186 if (environ) for (uschar ** p = USS environ; *p; p++)
1187 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1189 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1190 exim_testharness_disable_ocsp_validity_check = TRUE;
1195 /**************************************************
1196 * One-time init credentials for server and client *
1197 **************************************************/
1200 creds_basic_init(gnutls_certificate_credentials_t x509_cred, BOOL server)
1202 #ifdef SUPPORT_SRV_OCSP_STACK
1203 gnutls_certificate_set_flags(x509_cred, GNUTLS_CERTIFICATE_API_V2);
1205 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1206 if (server && tls_ocsp_file)
1208 if (f.running_in_test_harness)
1209 tls_server_testharness_ocsp_fiddle();
1211 if (exim_testharness_disable_ocsp_validity_check)
1212 gnutls_certificate_set_flags(x509_cred,
1213 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1218 debug_printf("TLS: basic cred init, %s\n", server ? "server" : "client");
1222 creds_load_server_certs(exim_gnutls_state_st * state, const uschar * cert,
1223 const uschar * pkey, const uschar * ocsp, uschar ** errstr)
1225 const uschar * clist = cert;
1226 const uschar * klist = pkey;
1227 const uschar * olist;
1228 int csep = 0, ksep = 0, osep = 0, cnt = 0, rc;
1229 uschar * cfile, * kfile, * ofile;
1230 #ifndef DISABLE_OCSP
1231 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1232 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1235 if (!expand_check(ocsp, US"tls_ocsp_file", &ofile, errstr))
1240 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1242 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1243 return tls_error(US"cert/key setup: out of keys", NULL, NULL, errstr);
1244 else if ((rc = tls_add_certfile(state, NULL, cfile, kfile, errstr)) > 0)
1248 int gnutls_cert_index = -rc;
1249 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1250 gnutls_cert_index, cfile);
1252 #ifndef DISABLE_OCSP
1255 /* Set the OCSP stapling server info */
1256 if (gnutls_buggy_ocsp)
1259 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1261 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1263 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1264 gnutls_cert_index, ofile);
1265 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1266 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1268 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1271 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1273 ocsp_fmt = GNUTLS_X509_FMT_DER;
1277 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1278 state->lib_state.x509_cred, CCS ofile, gnutls_cert_index,
1280 return tls_error_gnu(
1281 US"gnutls_certificate_set_ocsp_status_request_file2",
1284 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1286 /* Arrange callbacks for OCSP request observability */
1289 gnutls_handshake_set_hook_function(state->session,
1290 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1292 state->lib_state.ocsp_hook = TRUE;
1296 # if defined(SUPPORT_SRV_OCSP_STACK)
1297 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1298 state->lib_state.x509_cred, gnutls_cert_index,
1299 server_ocsp_stapling_cb, ofile)))
1300 return tls_error_gnu(
1301 US"gnutls_certificate_set_ocsp_status_request_function2",
1309 debug_printf("oops; multiple OCSP files not supported\n");
1312 gnutls_certificate_set_ocsp_status_request_function(
1313 state->lib_state.x509_cred, server_ocsp_stapling_cb, ofile);
1315 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1318 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1320 #endif /* DISABLE_OCSP */
1326 creds_load_client_certs(exim_gnutls_state_st * state, const host_item * host,
1327 const uschar * cert, const uschar * pkey, uschar ** errstr)
1329 int rc = tls_add_certfile(state, host, cert, pkey, errstr);
1330 if (rc > 0) return rc;
1331 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1336 creds_load_cabundle(exim_gnutls_state_st * state, const uschar * bundle,
1337 const host_item * host, uschar ** errstr)
1340 struct stat statbuf;
1342 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1343 if (Ustrcmp(bundle, "system") == 0 || Ustrncmp(bundle, "system,", 7) == 0)
1344 cert_count = gnutls_certificate_set_x509_system_trust(state->lib_state.x509_cred);
1348 if (Ustat(bundle, &statbuf) < 0)
1350 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1351 "(tls_verify_certificates): %s", bundle, strerror(errno));
1355 #ifndef SUPPORT_CA_DIR
1356 /* The test suite passes in /dev/null; we could check for that path explicitly,
1357 but who knows if someone has some weird FIFO which always dumps some certs, or
1358 other weirdness. The thing we really want to check is that it's not a
1359 directory, since while OpenSSL supports that, GnuTLS does not.
1360 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1361 if (S_ISDIR(statbuf.st_mode))
1363 log_write(0, LOG_MAIN|LOG_PANIC,
1364 "tls_verify_certificates \"%s\" is a directory", bundle);
1369 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1370 bundle, statbuf.st_size);
1372 if (statbuf.st_size == 0)
1375 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1381 #ifdef SUPPORT_CA_DIR
1382 (statbuf.st_mode & S_IFMT) == S_IFDIR
1384 gnutls_certificate_set_x509_trust_dir(state->lib_state.x509_cred,
1385 CS bundle, GNUTLS_X509_FMT_PEM)
1388 gnutls_certificate_set_x509_trust_file(state->lib_state.x509_cred,
1389 CS bundle, GNUTLS_X509_FMT_PEM);
1391 #ifdef SUPPORT_CA_DIR
1392 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1393 when using the directory-of-certs config model. */
1395 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1397 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1399 state->lib_state.ca_rdn_emulate = TRUE;
1404 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1406 debug_printf("Added %d certificate authorities\n", cert_count);
1413 creds_load_crl(exim_gnutls_state_st * state, const uschar * crl, uschar ** errstr)
1416 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", crl);
1417 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->lib_state.x509_cred,
1418 CS crl, GNUTLS_X509_FMT_PEM)) < 0)
1419 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1420 cert_count, state->host, errstr);
1422 DEBUG(D_tls) debug_printf("Processed %d CRLs\n", cert_count);
1428 creds_load_pristring(exim_gnutls_state_st * state, const uschar * p,
1429 const char ** errpos)
1433 p = exim_default_gnutls_priority;
1435 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1437 return gnutls_priority_init( (gnutls_priority_t *) &state->lib_state.pri_cache,
1442 tls_server_creds_init(void)
1444 uschar * dummy_errstr;
1445 unsigned lifetime = 0;
1447 state_server.lib_state = null_tls_preload;
1448 if (gnutls_certificate_allocate_credentials(
1449 (gnutls_certificate_credentials_t *) &state_server.lib_state.x509_cred))
1451 state_server.lib_state.x509_cred = NULL;
1454 creds_basic_init(state_server.lib_state.x509_cred, TRUE);
1456 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1457 /* If tls_certificate has any $ indicating expansions, it is not good.
1458 If tls_privatekey is set but has $, not good. Likewise for tls_ocsp_file.
1459 If all good (and tls_certificate set), load the cert(s). */
1461 if ( opt_set_and_noexpand(tls_certificate)
1462 # ifndef DISABLE_OCSP
1463 && opt_unset_or_noexpand(tls_ocsp_file)
1465 && opt_unset_or_noexpand(tls_privatekey))
1467 /* Set watches on the filenames. The implementation does de-duplication
1468 so we can just blindly do them all.
1471 if ( tls_set_watch(tls_certificate, TRUE)
1472 # ifndef DISABLE_OCSP
1473 && tls_set_watch(tls_ocsp_file, TRUE)
1475 && tls_set_watch(tls_privatekey, TRUE))
1477 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1478 if (creds_load_server_certs(&state_server, tls_certificate,
1479 tls_privatekey && *tls_privatekey ? tls_privatekey : tls_certificate,
1480 # ifdef DISABLE_OCSP
1485 &dummy_errstr) == 0)
1486 state_server.lib_state.conn_certs = TRUE;
1489 else if ( !tls_certificate && !tls_privatekey
1490 # ifndef DISABLE_OCSP
1494 { /* Generate & preload a selfsigned cert. No files to watch. */
1495 if ((tls_install_selfsign(&state_server, &dummy_errstr)) == OK)
1497 state_server.lib_state.conn_certs = TRUE;
1498 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1502 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1504 /* If tls_verify_certificates is non-empty and has no $, load CAs */
1506 if (opt_set_and_noexpand(tls_verify_certificates))
1508 if (tls_set_watch(tls_verify_certificates, FALSE))
1510 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1511 if (creds_load_cabundle(&state_server, tls_verify_certificates,
1512 NULL, &dummy_errstr) != OK)
1514 state_server.lib_state.cabundle = TRUE;
1516 /* If CAs loaded and tls_crl is non-empty and has no $, load it */
1518 if (opt_set_and_noexpand(tls_crl))
1520 if (tls_set_watch(tls_crl, FALSE))
1522 DEBUG(D_tls) debug_printf("TLS: preloading CRL for server\n");
1523 if (creds_load_crl(&state_server, tls_crl, &dummy_errstr) != OK)
1525 state_server.lib_state.crl = TRUE;
1529 DEBUG(D_tls) debug_printf("TLS: not preloading CRL for server\n");
1533 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1534 #endif /* EXIM_HAVE_INOTIFY */
1536 /* If tls_require_ciphers is non-empty and has no $, load the
1537 ciphers priority cache. If unset, load with the default.
1538 (server-only as the client one depends on non/DANE) */
1540 if (!tls_require_ciphers || opt_set_and_noexpand(tls_require_ciphers))
1542 const char * dummy_errpos;
1543 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server: %s\n",
1544 tls_require_ciphers);
1545 if ( creds_load_pristring(&state_server, tls_require_ciphers, &dummy_errpos)
1547 state_server.lib_state.pri_string = TRUE;
1550 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1555 /* Preload whatever creds are static, onto a transport. The client can then
1556 just copy the pointer as it starts up. */
1559 tls_client_creds_init(transport_instance * t, BOOL watch)
1561 smtp_transport_options_block * ob = t->options_block;
1562 exim_gnutls_state_st tpt_dummy_state;
1563 host_item * dummy_host = (host_item *)1;
1564 uschar * dummy_errstr;
1566 if ( !exim_gnutls_base_init_done
1567 && tls_g_init(&dummy_errstr) != OK)
1570 ob->tls_preload = null_tls_preload;
1571 if (gnutls_certificate_allocate_credentials(
1572 (struct gnutls_certificate_credentials_st **)&ob->tls_preload.x509_cred))
1574 ob->tls_preload.x509_cred = NULL;
1577 creds_basic_init(ob->tls_preload.x509_cred, FALSE);
1579 tpt_dummy_state.session = NULL;
1580 tpt_dummy_state.lib_state = ob->tls_preload;
1582 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1583 if ( opt_set_and_noexpand(ob->tls_certificate)
1584 && opt_unset_or_noexpand(ob->tls_privatekey))
1587 || ( tls_set_watch(ob->tls_certificate, FALSE)
1588 && tls_set_watch(ob->tls_privatekey, FALSE)
1591 const uschar * pkey = ob->tls_privatekey;
1594 debug_printf("TLS: preloading client certs for transport '%s'\n", t->name);
1596 /* The state->lib_state.x509_cred is used for the certs load, and is the sole
1597 structure element used. So we can set up a dummy. The hoat arg only
1598 selects a retcode in case of fail, so any value */
1600 if (creds_load_client_certs(&tpt_dummy_state, dummy_host,
1601 ob->tls_certificate, pkey ? pkey : ob->tls_certificate,
1602 &dummy_errstr) == OK)
1603 ob->tls_preload.conn_certs = TRUE;
1608 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1610 if (opt_set_and_noexpand(ob->tls_verify_certificates))
1612 if (!watch || tls_set_watch(ob->tls_verify_certificates, FALSE))
1615 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1616 if (creds_load_cabundle(&tpt_dummy_state, ob->tls_verify_certificates,
1617 dummy_host, &dummy_errstr) != OK)
1619 ob->tls_preload.cabundle = TRUE;
1621 if (opt_set_and_noexpand(ob->tls_crl))
1623 if (!watch || tls_set_watch(ob->tls_crl, FALSE))
1625 DEBUG(D_tls) debug_printf("TLS: preloading CRL for transport '%s'\n", t->name);
1626 if (creds_load_crl(&tpt_dummy_state, ob->tls_crl, &dummy_errstr) != OK)
1628 ob->tls_preload.crl = TRUE;
1632 DEBUG(D_tls) debug_printf("TLS: not preloading CRL, for transport '%s'\n", t->name);
1637 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1639 /* We do not preload tls_require_ciphers to to the transport as it implicitly
1640 depends on DANE or plain usage. */
1646 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1647 /* Invalidate the creds cached, by dropping the current ones.
1648 Call when we notice one of the source files has changed. */
1651 tls_server_creds_invalidate(void)
1653 if (state_server.lib_state.pri_cache)
1654 gnutls_priority_deinit(state_server.lib_state.pri_cache);
1655 state_server.lib_state.pri_cache = NULL;
1657 if (state_server.lib_state.x509_cred)
1658 gnutls_certificate_free_credentials(state_server.lib_state.x509_cred);
1659 state_server.lib_state = null_tls_preload;
1664 tls_client_creds_invalidate(transport_instance * t)
1666 smtp_transport_options_block * ob = t->options_block;
1667 if (ob->tls_preload.x509_cred)
1668 gnutls_certificate_free_credentials(ob->tls_preload.x509_cred);
1669 ob->tls_preload = null_tls_preload;
1674 /*************************************************
1675 * Variables re-expanded post-SNI *
1676 *************************************************/
1678 /* Called from both server and client code, via tls_init(), and also from
1679 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1681 We can tell the two apart by state->received_sni being non-NULL in callback.
1683 The callback should not call us unless state->trigger_sni_changes is true,
1684 which we are responsible for setting on the first pass through.
1687 state exim_gnutls_state_st *
1688 errstr error string pointer
1690 Returns: OK/DEFER/FAIL
1694 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1697 const host_item *host = state->host; /* macro should be reconsidered? */
1698 const uschar *saved_tls_certificate = NULL;
1699 const uschar *saved_tls_privatekey = NULL;
1700 const uschar *saved_tls_verify_certificates = NULL;
1701 const uschar *saved_tls_crl = NULL;
1704 /* We check for tls_sni *before* expansion. */
1705 if (!host) /* server */
1706 if (!state->received_sni)
1708 if ( state->tls_certificate
1709 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1710 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1711 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1714 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI\n");
1715 state->trigger_sni_changes = TRUE;
1718 else /* SNI callback case */
1720 /* useful for debugging */
1721 saved_tls_certificate = state->exp_tls_certificate;
1722 saved_tls_privatekey = state->exp_tls_privatekey;
1723 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1724 saved_tls_crl = state->exp_tls_crl;
1727 if (!state->lib_state.x509_cred)
1729 if ((rc = gnutls_certificate_allocate_credentials(
1730 (gnutls_certificate_credentials_t *) &state->lib_state.x509_cred)))
1731 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
1733 creds_basic_init(state->lib_state.x509_cred, !host);
1737 /* remember: Expand_check_tlsvar() is expand_check() but fiddling with
1738 state members, assuming consistent naming; and expand_check() returns
1739 false if expansion failed, unless expansion was forced to fail. */
1741 /* check if we at least have a certificate, before doing expensive
1744 if (!state->lib_state.conn_certs)
1746 if (!Expand_check_tlsvar(tls_certificate, errstr))
1749 /* certificate is mandatory in server, optional in client */
1751 if ( !state->exp_tls_certificate
1752 || !*state->exp_tls_certificate
1755 return tls_install_selfsign(state, errstr);
1757 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1759 if (state->tls_privatekey && !Expand_check_tlsvar(tls_privatekey, errstr))
1762 /* tls_privatekey is optional, defaulting to same file as certificate */
1764 if (!state->tls_privatekey || !*state->tls_privatekey)
1766 state->tls_privatekey = state->tls_certificate;
1767 state->exp_tls_privatekey = state->exp_tls_certificate;
1770 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1773 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1774 state->exp_tls_certificate, state->exp_tls_privatekey);
1776 if (state->received_sni)
1777 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1778 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1781 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1782 load = FALSE; /* avoid re-loading the same certs */
1784 else /* unload the pre-SNI certs before loading new ones */
1786 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair\n");
1787 gnutls_certificate_free_keys(state->lib_state.x509_cred);
1792 ? creds_load_client_certs(state, host, state->exp_tls_certificate,
1793 state->exp_tls_privatekey, errstr)
1794 : creds_load_server_certs(state, state->exp_tls_certificate,
1795 state->exp_tls_privatekey,
1808 debug_printf("%s certs were preloaded\n", host ? "client" : "server");
1810 if (!state->tls_privatekey) state->tls_privatekey = state->tls_certificate;
1811 state->exp_tls_certificate = US state->tls_certificate;
1812 state->exp_tls_privatekey = US state->tls_privatekey;
1814 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1815 if (state->lib_state.ocsp_hook)
1816 gnutls_handshake_set_hook_function(state->session,
1817 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1822 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1823 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1824 error message is provided. However, if we just refrain from setting anything up
1825 in that case, certificate verification fails, which seems to be the correct
1828 if (!state->lib_state.cabundle)
1830 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1832 if (!Expand_check_tlsvar(tls_verify_certificates, errstr))
1834 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1835 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1836 state->exp_tls_verify_certificates = NULL;
1838 if (state->tls_crl && *state->tls_crl)
1839 if (!Expand_check_tlsvar(tls_crl, errstr))
1842 if (!(state->exp_tls_verify_certificates &&
1843 *state->exp_tls_verify_certificates))
1846 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1847 /* With no tls_verify_certificates, we ignore tls_crl too */
1854 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1857 rc = creds_load_cabundle(state, state->exp_tls_verify_certificates, host, errstr);
1858 if (rc != OK) return rc;
1863 debug_printf("%s CA bundle was preloaded\n", host ? "client" : "server");
1864 state->exp_tls_verify_certificates = US state->tls_verify_certificates;
1866 #ifdef SUPPORT_CA_DIR
1867 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1868 when using the directory-of-certs config model. */
1869 if (state->lib_state.ca_rdn_emulate)
1870 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1875 if (!state->lib_state.crl)
1877 if ( state->tls_crl && *state->tls_crl
1878 && state->exp_tls_crl && *state->exp_tls_crl)
1879 return creds_load_crl(state, state->exp_tls_crl, errstr);
1884 debug_printf("%s CRL was preloaded\n", host ? "client" : "server");
1885 state->exp_tls_crl = US state->tls_crl;
1894 /*************************************************
1895 * Set X.509 state variables *
1896 *************************************************/
1898 /* In GnuTLS, the registered cert/key are not replaced by a later
1899 set of a cert/key, so for SNI support we need a whole new x509_cred
1900 structure. Which means various other non-re-expanded pieces of state
1901 need to be re-set in the new struct, so the setting logic is pulled
1905 state exim_gnutls_state_st *
1906 errstr error string pointer
1908 Returns: OK/DEFER/FAIL
1912 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1915 const host_item *host = state->host; /* macro should be reconsidered? */
1917 #ifndef GNUTLS_AUTO_DHPARAMS
1918 /* Create D-H parameters, or read them from the cache file. This function does
1919 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1920 client-side params. */
1924 if (!dh_server_params)
1925 if ((rc = init_server_dh(errstr)) != OK) return rc;
1927 /* Unnecessary & discouraged with 3.6.0 or later */
1928 gnutls_certificate_set_dh_params(state->lib_state.x509_cred, dh_server_params);
1932 /* Link the credentials to the session. */
1934 if ((rc = gnutls_credentials_set(state->session,
1935 GNUTLS_CRD_CERTIFICATE, state->lib_state.x509_cred)))
1936 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1941 /*************************************************
1942 * Initialize for GnuTLS *
1943 *************************************************/
1946 /* Called from both server and client code. In the case of a server, errors
1947 before actual TLS negotiation return DEFER.
1950 host connected host, if client; NULL if server
1951 ob tranport options block, if client; NULL if server
1952 require_ciphers tls_require_ciphers setting
1953 caller_state returned state-info structure
1954 errstr error string pointer
1956 Returns: OK/DEFER/FAIL
1961 const host_item *host,
1962 smtp_transport_options_block * ob,
1963 const uschar * require_ciphers,
1964 exim_gnutls_state_st **caller_state,
1968 exim_gnutls_state_st * state;
1972 if ( !exim_gnutls_base_init_done
1973 && (rc = tls_g_init(errstr)) != OK)
1978 /* For client-side sessions we allocate a context. This lets us run
1979 several in parallel. */
1981 int old_pool = store_pool;
1982 store_pool = POOL_PERM;
1983 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
1984 store_pool = old_pool;
1986 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1987 state->lib_state = ob->tls_preload;
1989 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1990 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1992 state->tls_certificate = ob->tls_certificate;
1993 state->tls_privatekey = ob->tls_privatekey;
1994 state->tls_sni = ob->tls_sni;
1995 state->tls_verify_certificates = ob->tls_verify_certificates;
1996 state->tls_crl = ob->tls_crl;
2000 /* Server operations always use the one state_server context. It is not
2001 shared because we have forked a fresh process for every receive. However it
2002 can get re-used for successive TLS sessions on a single TCP connection. */
2004 state = &state_server;
2006 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
2007 rc = gnutls_init(&state->session, GNUTLS_SERVER);
2009 state->tls_certificate = tls_certificate;
2010 state->tls_privatekey = tls_privatekey;
2011 state->tls_sni = NULL;
2012 state->tls_verify_certificates = tls_verify_certificates;
2013 state->tls_crl = tls_crl;
2016 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
2018 state->tls_require_ciphers = require_ciphers;
2021 /* This handles the variables that might get re-expanded after TLS SNI;
2022 tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
2025 debug_printf("Expanding various TLS configuration options for session credentials\n");
2026 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
2028 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
2029 requires a new structure afterwards. */
2031 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
2033 /* set SNI in client, only */
2036 if (!expand_check(state->tls_sni, US"tls_out_sni", &state->tlsp->sni, errstr))
2038 if (state->tlsp->sni && *state->tlsp->sni)
2041 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
2042 sz = Ustrlen(state->tlsp->sni);
2043 if ((rc = gnutls_server_name_set(state->session,
2044 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
2045 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
2048 else if (state->tls_sni)
2049 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
2050 "have an SNI set for a server [%s]\n", state->tls_sni);
2052 if (!state->lib_state.pri_string)
2054 const uschar * p = NULL;
2055 const char * errpos;
2057 /* This is the priority string support,
2058 http://www.gnutls.org/manual/html_node/Priority-Strings.html
2059 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
2060 This was backwards incompatible, but means Exim no longer needs to track
2061 all algorithms and provide string forms for them. */
2063 if (state->tls_require_ciphers && *state->tls_require_ciphers)
2065 if (!Expand_check_tlsvar(tls_require_ciphers, errstr))
2067 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
2069 p = state->exp_tls_require_ciphers;
2070 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
2074 if ((rc = creds_load_pristring(state, p, &errpos)))
2075 return tls_error_gnu(string_sprintf(
2076 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
2077 p, errpos - CS p, errpos),
2082 DEBUG(D_tls) debug_printf("cipher list preloaded\n");
2083 state->exp_tls_require_ciphers = US state->tls_require_ciphers;
2087 if ((rc = gnutls_priority_set(state->session, state->lib_state.pri_cache)))
2088 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
2090 /* This also sets the server ticket expiration time to the same, and
2091 the STEK rotation time to 3x. */
2093 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
2095 /* Reduce security in favour of increased compatibility, if the admin
2096 decides to make that trade-off. */
2097 if (gnutls_compat_mode)
2099 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
2100 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
2101 gnutls_session_enable_compatibility_mode(state->session);
2103 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
2107 *caller_state = state;
2113 /*************************************************
2114 * Extract peer information *
2115 *************************************************/
2117 static const uschar *
2118 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
2119 gnutls_mac_algorithm_t mac)
2122 gnutls_kx_algorithm_t kx_i;
2123 gnutls_cipher_algorithm_t cipher_i;
2124 gnutls_mac_algorithm_t mac_i;
2127 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
2129 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
2130 return cipher_stdname(cs_id[0], cs_id[1]);
2136 /* Called from both server and client code.
2137 Only this is allowed to set state->peerdn and state->have_set_peerdn
2138 and we use that to detect double-calls.
2140 NOTE: the state blocks last while the TLS connection is up, which is fine
2141 for logging in the server side, but for the client side, we log after teardown
2142 in src/deliver.c. While the session is up, we can twist about states and
2143 repoint tls_* globals, but those variables used for logging or other variable
2144 expansion that happens _after_ delivery need to have a longer life-time.
2146 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
2147 doing this more than once per generation of a state context. We set them in
2148 the state context, and repoint tls_* to them. After the state goes away, the
2149 tls_* copies of the pointers remain valid and client delivery logging is happy.
2151 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
2155 state exim_gnutls_state_st *
2156 errstr pointer to error string
2158 Returns: OK/DEFER/FAIL
2162 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
2164 gnutls_session_t session = state->session;
2165 const gnutls_datum_t * cert_list;
2167 unsigned int cert_list_size = 0;
2168 gnutls_protocol_t protocol;
2169 gnutls_cipher_algorithm_t cipher;
2170 gnutls_kx_algorithm_t kx;
2171 gnutls_mac_algorithm_t mac;
2172 gnutls_certificate_type_t ct;
2173 gnutls_x509_crt_t crt;
2177 if (state->have_set_peerdn)
2179 state->have_set_peerdn = TRUE;
2181 state->peerdn = NULL;
2184 cipher = gnutls_cipher_get(session);
2185 protocol = gnutls_protocol_get_version(session);
2186 mac = gnutls_mac_get(session);
2188 #ifdef GNUTLS_TLS1_3
2189 protocol >= GNUTLS_TLS1_3 ? 0 :
2191 gnutls_kx_get(session);
2193 old_pool = store_pool;
2195 tls_support * tlsp = state->tlsp;
2196 store_pool = POOL_PERM;
2198 #ifdef SUPPORT_GNUTLS_SESS_DESC
2201 uschar * s = US gnutls_session_get_desc(session), c;
2203 /* Nikos M suggests we use this by preference. It returns like:
2204 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
2206 For partial back-compat, put a colon after the TLS version, replace the
2207 )-( grouping with __, replace in-group - with _ and append the :keysize. */
2209 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
2211 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
2213 tlsp->ver = string_copyn(g->s, g->ptr);
2214 for (uschar * p = US tlsp->ver; *p; p++)
2215 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
2217 g = string_catn(g, US":", 1);
2218 if (*s) s++; /* now on _ between groups */
2221 for (*++s && ++s; (c = *s) && c != ')'; s++)
2222 g = string_catn(g, c == '-' ? US"_" : s, 1);
2223 /* now on ) closing group */
2224 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
2225 /* now on _ between groups */
2227 g = string_catn(g, US":", 1);
2228 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
2229 state->ciphersuite = string_from_gstring(g);
2232 state->ciphersuite = string_sprintf("%s:%s:%d",
2233 gnutls_protocol_get_name(protocol),
2234 gnutls_cipher_suite_get_name(kx, cipher, mac),
2235 (int) gnutls_cipher_get_key_size(cipher) * 8);
2237 /* I don't see a way that spaces could occur, in the current GnuTLS
2238 code base, but it was a concern in the old code and perhaps older GnuTLS
2239 releases did return "TLS 1.0"; play it safe, just in case. */
2241 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
2242 tlsp->ver = string_copyn(state->ciphersuite,
2243 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
2246 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
2248 tlsp->cipher = state->ciphersuite;
2249 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
2251 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
2253 store_pool = old_pool;
2256 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
2258 if (!cert_list || cert_list_size == 0)
2260 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
2261 cert_list, cert_list_size);
2262 if (state->verify_requirement >= VERIFY_REQUIRED)
2263 return tls_error(US"certificate verification failed",
2264 US"no certificate received from peer", state->host, errstr);
2268 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
2270 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
2272 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
2273 if (state->verify_requirement >= VERIFY_REQUIRED)
2274 return tls_error(US"certificate verification not possible, unhandled type",
2275 ctn, state->host, errstr);
2279 #define exim_gnutls_peer_err(Label) \
2281 if (rc != GNUTLS_E_SUCCESS) \
2283 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
2284 (Label), gnutls_strerror(rc)); \
2285 if (state->verify_requirement >= VERIFY_REQUIRED) \
2286 return tls_error_gnu((Label), rc, state->host, errstr); \
2291 rc = import_cert(&cert_list[0], &crt);
2292 exim_gnutls_peer_err(US"cert 0");
2294 state->tlsp->peercert = state->peercert = crt;
2297 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
2298 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
2300 exim_gnutls_peer_err(US"getting size for cert DN failed");
2301 return FAIL; /* should not happen */
2303 dn_buf = store_get_perm(sz, TRUE); /* tainted */
2304 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
2305 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
2307 state->peerdn = dn_buf;
2310 #undef exim_gnutls_peer_err
2316 /*************************************************
2317 * Verify peer certificate *
2318 *************************************************/
2320 /* Called from both server and client code.
2321 *Should* be using a callback registered with
2322 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
2323 the peer information, but that's too new for some OSes.
2326 state exim_gnutls_state_st *
2327 errstr where to put an error message
2330 FALSE if the session should be rejected
2331 TRUE if the cert is okay or we just don't care
2335 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
2340 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
2342 rc = peer_status(state, errstr);
2344 if (state->verify_requirement == VERIFY_NONE)
2347 if (rc != OK || !state->peerdn)
2349 verify = GNUTLS_CERT_INVALID;
2350 *errstr = US"certificate not supplied";
2356 if (state->verify_requirement == VERIFY_DANE && state->host)
2358 /* Using dane_verify_session_crt() would be easy, as it does it all for us
2359 including talking to a DNS resolver. But we want to do that bit ourselves
2360 as the testsuite intercepts and fakes its own DNS environment. */
2365 const gnutls_datum_t * certlist =
2366 gnutls_certificate_get_peers(state->session, &lsize);
2367 int usage = tls_out.tlsa_usage;
2369 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2370 /* Split the TLSA records into two sets, TA and EE selectors. Run the
2371 dane-verification separately so that we know which selector verified;
2372 then we know whether to do name-verification (needed for TA but not EE). */
2374 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
2375 { /* a mixed-usage bundle */
2380 for (nrec = 0; state->dane_data_len[nrec]; ) nrec++;
2383 dd = store_get(nrec * sizeof(uschar *), FALSE);
2384 ddl = store_get(nrec * sizeof(int), FALSE);
2387 if ((rc = dane_state_init(&s, 0)))
2390 for (usage = DANESSL_USAGE_DANE_EE;
2391 usage >= DANESSL_USAGE_DANE_TA; usage--)
2392 { /* take records with this usage */
2393 for (j = i = 0; i < nrec; i++)
2394 if (state->dane_data[i][0] == usage)
2396 dd[j] = state->dane_data[i];
2397 ddl[j++] = state->dane_data_len[i];
2404 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
2407 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
2408 gnutls_certificate_type_get(state->session),
2410 usage == DANESSL_USAGE_DANE_EE
2411 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2415 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
2417 else if (verify == 0) /* verification passed */
2425 if (rc) goto tlsa_prob;
2430 if ( (rc = dane_state_init(&s, 0))
2431 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
2433 || (rc = dane_verify_crt_raw(s, certlist, lsize,
2434 gnutls_certificate_type_get(state->session),
2436 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2437 usage == (1 << DANESSL_USAGE_DANE_EE)
2438 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2447 if (verify != 0) /* verification failed */
2450 (void) dane_verification_status_print(verify, &str, 0);
2451 *errstr = US str.data; /* don't bother to free */
2455 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2456 /* If a TA-mode TLSA record was used for verification we must additionally
2457 verify the cert name (but not the CA chain). For EE-mode, skip it. */
2459 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2462 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2465 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2466 /* Assume that the name on the A-record is the one that should be matching
2467 the cert. An alternate view is that the domain part of the email address
2468 is also permissible. */
2470 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2471 CS state->host->name))
2473 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2478 #endif /*SUPPORT_DANE*/
2480 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2483 /* Handle the result of verification. INVALID is set if any others are. */
2485 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2487 state->peer_cert_verified = FALSE;
2490 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2495 if (gnutls_certificate_verification_status_print(verify,
2496 gnutls_certificate_type_get(state->session), &txt, 0)
2497 == GNUTLS_E_SUCCESS)
2499 debug_printf("%s\n", txt.data);
2500 gnutls_free(txt.data);
2504 *errstr = verify & GNUTLS_CERT_REVOKED
2505 ? US"certificate revoked" : US"certificate invalid";
2509 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2510 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2512 if (state->verify_requirement >= VERIFY_REQUIRED)
2515 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2520 /* Client side, check the server's certificate name versus the name on the
2521 A-record for the connection we made. What to do for server side - what name
2522 to use for client? We document that there is no such checking for server
2525 if ( state->exp_tls_verify_cert_hostnames
2526 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2527 CS state->exp_tls_verify_cert_hostnames)
2531 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2532 if (state->verify_requirement >= VERIFY_REQUIRED)
2537 state->peer_cert_verified = TRUE;
2538 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2539 state->peerdn ? state->peerdn : US"<unset>");
2543 state->tlsp->peerdn = state->peerdn;
2548 *errstr = string_sprintf("TLSA record problem: %s",
2549 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2553 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2560 /* ------------------------------------------------------------------------ */
2563 /* Logging function which can be registered with
2564 * gnutls_global_set_log_function()
2565 * gnutls_global_set_log_level() 0..9
2567 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2569 exim_gnutls_logger_cb(int level, const char *message)
2571 size_t len = strlen(message);
2574 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2577 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2578 message[len-1] == '\n' ? "" : "\n");
2583 /* Called after client hello, should handle SNI work.
2584 This will always set tls_sni (state->received_sni) if available,
2585 and may trigger presenting different certificates,
2586 if state->trigger_sni_changes is TRUE.
2588 Should be registered with
2589 gnutls_handshake_set_post_client_hello_function()
2591 "This callback must return 0 on success or a gnutls error code to terminate the
2594 For inability to get SNI information, we return 0.
2595 We only return non-zero if re-setup failed.
2596 Only used for server-side TLS.
2600 exim_sni_handling_cb(gnutls_session_t session)
2602 char sni_name[MAX_HOST_LEN];
2603 size_t data_len = MAX_HOST_LEN;
2604 exim_gnutls_state_st *state = &state_server;
2605 unsigned int sni_type;
2607 uschar * dummy_errstr;
2609 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2610 if (rc != GNUTLS_E_SUCCESS)
2613 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2614 debug_printf("TLS: no SNI presented in handshake\n");
2616 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2617 gnutls_strerror(rc), rc);
2621 if (sni_type != GNUTLS_NAME_DNS)
2623 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2627 /* We now have a UTF-8 string in sni_name */
2628 old_pool = store_pool;
2629 store_pool = POOL_PERM;
2630 state->received_sni = string_copy_taint(US sni_name, TRUE);
2631 store_pool = old_pool;
2633 /* We set this one now so that variable expansions below will work */
2634 state->tlsp->sni = state->received_sni;
2636 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2637 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2639 if (!state->trigger_sni_changes)
2642 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2644 /* If the setup of certs/etc failed before handshake, TLS would not have
2645 been offered. The best we can do now is abort. */
2646 return GNUTLS_E_APPLICATION_ERROR_MIN;
2649 rc = tls_set_remaining_x509(state, &dummy_errstr);
2650 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2657 #ifndef DISABLE_EVENT
2659 We use this callback to get observability and detail-level control
2660 for an exim TLS connection (either direction), raising a tls:cert event
2661 for each cert in the chain presented by the peer. Any event
2662 can deny verification.
2664 Return 0 for the handshake to continue or non-zero to terminate.
2668 verify_cb(gnutls_session_t session)
2670 const gnutls_datum_t * cert_list;
2671 unsigned int cert_list_size = 0;
2672 gnutls_x509_crt_t crt;
2675 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2677 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2678 while (cert_list_size--)
2680 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2682 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2683 cert_list_size, gnutls_strerror(rc));
2687 state->tlsp->peercert = crt;
2688 if ((yield = event_raise(state->event_action,
2689 US"tls:cert", string_sprintf("%d", cert_list_size))))
2691 log_write(0, LOG_MAIN,
2692 "SSL verify denied by event-action: depth=%d: %s",
2693 cert_list_size, yield);
2694 return 1; /* reject */
2696 state->tlsp->peercert = NULL;
2706 ddump(gnutls_datum_t * d)
2708 gstring * g = string_get((d->size+1) * 2);
2709 uschar * s = d->data;
2710 for (unsigned i = d->size; i > 0; i--, s++)
2712 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2713 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2719 post_handshake_debug(exim_gnutls_state_st * state)
2721 #ifdef SUPPORT_GNUTLS_SESS_DESC
2722 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2725 #ifdef SUPPORT_GNUTLS_KEYLOG
2726 # ifdef EXIM_HAVE_TLS1_3
2727 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2732 gnutls_datum_t c, s;
2734 /* For TLS1.2 we only want the client random and the master secret */
2735 gnutls_session_get_random(state->session, &c, &s);
2736 gnutls_session_get_master_secret(state->session, &s);
2739 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2742 debug_printf("To get keying info for TLS1.3 is hard:\n"
2743 " Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,\n"
2744 " and make sure it is writable by the Exim runtime user.\n"
2745 " Add SSLKEYLOGFILE to keep_environment in the exim config.\n"
2746 " Start Exim as root.\n"
2747 " If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2748 " (works for TLS1.2 also, and saves cut-paste into file).\n"
2749 " Trying to use add_environment for this will not work\n");
2754 #ifdef EXIM_HAVE_TLS_RESUME
2756 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2757 unsigned incoming, const gnutls_datum_t * msg)
2759 DEBUG(D_tls) debug_printf("newticket cb\n");
2760 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2765 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2767 /* Should the server offer session resumption? */
2768 tls_in.resumption = RESUME_SUPPORTED;
2769 if (verify_check_host(&tls_resumption_hosts) == OK)
2772 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2773 an offered resumption is unacceptable. We lose one resumption per ticket
2774 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2775 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2776 least they go out in a single packet. */
2778 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2779 &server_sessticket_key)))
2780 tls_in.resumption |= RESUME_SERVER_TICKET;
2783 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2785 /* Try to tell if we see a ticket request */
2786 gnutls_handshake_set_hook_function(state->session,
2787 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2792 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2794 if (gnutls_session_resumption_requested(state->session))
2796 /* This tells us the client sent a full ticket. We use a
2797 callback on session-ticket request, elsewhere, to tell
2798 if a client asked for a ticket. */
2800 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2801 DEBUG(D_tls) debug_printf("client requested resumption\n");
2803 if (gnutls_session_is_resumed(state->session))
2805 tls_in.resumption |= RESUME_USED;
2806 DEBUG(D_tls) debug_printf("Session resumed\n");
2812 #ifdef EXIM_HAVE_ALPN
2814 tls_server_set_acceptable_alpns(exim_gnutls_state_st * state)
2817 gnutls_datum_t protocols[2] = {[0] = {.data = US"smtp", .size = 4},
2818 [1] = {.data = US"esmtp", .size = 5}};
2820 /* Set non-mandatory set of protocol names */
2821 if (!(rc = gnutls_alpn_set_protocols(state->session, protocols, 2, 0)))
2822 gnutls_handshake_set_hook_function(state->session,
2823 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2826 debug_printf("setting alpn protocols: %s\n", US gnutls_strerror(rc));
2830 /* ------------------------------------------------------------------------ */
2831 /* Exported functions */
2836 /*************************************************
2837 * Start a TLS session in a server *
2838 *************************************************/
2840 /* This is called when Exim is running as a server, after having received
2841 the STARTTLS command. It must respond to that command, and then negotiate
2845 errstr pointer to error string
2847 Returns: OK on success
2848 DEFER for errors before the start of the negotiation
2849 FAIL for errors during the negotiation; the server can't
2854 tls_server_start(uschar ** errstr)
2857 exim_gnutls_state_st * state = NULL;
2859 /* Check for previous activation */
2860 if (tls_in.active.sock >= 0)
2862 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2863 smtp_printf("554 Already in TLS\r\n", FALSE);
2867 /* Initialize the library. If it fails, it will already have logged the error
2868 and sent an SMTP response. */
2870 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2873 #ifdef MEASURE_TIMING
2875 gettimeofday(&t0, NULL);
2878 if ((rc = tls_init(NULL, NULL,
2879 tls_require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2881 #ifdef MEASURE_TIMING
2882 report_time_since(&t0, US"server tls_init (delta)");
2886 #ifdef EXIM_HAVE_ALPN
2887 tls_server_set_acceptable_alpns(state);
2890 #ifdef EXIM_HAVE_TLS_RESUME
2891 tls_server_resume_prehandshake(state);
2894 /* If this is a host for which certificate verification is mandatory or
2895 optional, set up appropriately. */
2897 if (verify_check_host(&tls_verify_hosts) == OK)
2900 debug_printf("TLS: a client certificate will be required\n");
2901 state->verify_requirement = VERIFY_REQUIRED;
2902 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2904 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2907 debug_printf("TLS: a client certificate will be requested but not required\n");
2908 state->verify_requirement = VERIFY_OPTIONAL;
2909 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2914 debug_printf("TLS: a client certificate will not be requested\n");
2915 state->verify_requirement = VERIFY_NONE;
2916 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2919 #ifndef DISABLE_EVENT
2922 state->event_action = event_action;
2923 gnutls_session_set_ptr(state->session, state);
2924 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
2928 /* Register SNI handling; always, even if not in tls_certificate, so that the
2929 expansion variable $tls_sni is always available. */
2931 gnutls_handshake_set_post_client_hello_function(state->session,
2932 exim_sni_handling_cb);
2934 /* Set context and tell client to go ahead, except in the case of TLS startup
2935 on connection, where outputting anything now upsets the clients and tends to
2936 make them disconnect. We need to have an explicit fflush() here, to force out
2937 the response. Other smtp_printf() calls do not need it, because in non-TLS
2938 mode, the fflush() happens when smtp_getc() is called. */
2940 if (!state->tlsp->on_connect)
2942 smtp_printf("220 TLS go ahead\r\n", FALSE);
2946 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2947 that the GnuTLS library doesn't.
2948 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2949 to set (and clear down afterwards) up a pull-timeout callback function that does
2950 a select, so we're no better off unless avoiding signals becomes an issue. */
2952 gnutls_transport_set_ptr2(state->session,
2953 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2954 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
2955 state->fd_in = fileno(smtp_in);
2956 state->fd_out = fileno(smtp_out);
2958 sigalrm_seen = FALSE;
2959 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2961 rc = gnutls_handshake(state->session);
2962 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2965 if (rc != GNUTLS_E_SUCCESS)
2967 /* It seems that, except in the case of a timeout, we have to close the
2968 connection right here; otherwise if the other end is running OpenSSL it hangs
2969 until the server times out. */
2973 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
2974 gnutls_db_remove_session(state->session);
2978 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
2979 (void) gnutls_alert_send_appropriate(state->session, rc);
2980 gnutls_deinit(state->session);
2981 gnutls_certificate_free_credentials(state->lib_state.x509_cred);
2982 state->lib_state = null_tls_preload;
2984 shutdown(state->fd_out, SHUT_WR);
2985 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
2986 (void)fclose(smtp_out);
2987 (void)fclose(smtp_in);
2988 smtp_out = smtp_in = NULL;
2994 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
2995 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
2996 tls_in.ext_master_secret = TRUE;
2999 #ifdef EXIM_HAVE_TLS_RESUME
3000 tls_server_resume_posthandshake(state);
3003 DEBUG(D_tls) post_handshake_debug(state);
3005 #ifdef EXIM_HAVE_ALPN
3006 if (server_seen_alpn)
3008 /* The client offered ALPN. We were set up with a nonmandatory list;
3009 see what was negotiated. We require a match now, given that something
3011 gnutls_datum_t p = {.size = 0};
3012 int rc = gnutls_alpn_get_selected_protocol(state->session, &p);
3013 if (!rc || rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
3017 *errstr = US"ALPN rejected";
3022 debug_printf("ALPN negotiated: %.*s\n", (int)p.size, p.data);
3026 debug_printf("getting alpn protocol: %s\n", US gnutls_strerror(rc));
3031 /* Verify after the fact */
3033 if (!verify_certificate(state, errstr))
3035 if (state->verify_requirement != VERIFY_OPTIONAL)
3037 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
3041 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
3045 /* Sets various Exim expansion variables; always safe within server */
3047 extract_exim_vars_from_tls_state(state);
3049 /* TLS has been set up. Adjust the input functions to read via TLS,
3050 and initialize appropriately. */
3052 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3054 receive_getc = tls_getc;
3055 receive_getbuf = tls_getbuf;
3056 receive_get_cache = tls_get_cache;
3057 receive_ungetc = tls_ungetc;
3058 receive_feof = tls_feof;
3059 receive_ferror = tls_ferror;
3060 receive_smtp_buffered = tls_smtp_buffered;
3069 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
3070 smtp_transport_options_block * ob)
3072 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3074 state->exp_tls_verify_cert_hostnames =
3076 string_domain_utf8_to_alabel(host->certname, NULL);
3081 debug_printf("TLS: server cert verification includes hostname: \"%s\"\n",
3082 state->exp_tls_verify_cert_hostnames);
3090 /* Given our list of RRs from the TLSA lookup, build a lookup block in
3091 GnuTLS-DANE's preferred format. Hang it on the state str for later
3092 use in DANE verification.
3094 We point at the dnsa data not copy it, so it must remain valid until
3095 after verification is done.*/
3098 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
3102 const char ** dane_data;
3103 int * dane_data_len;
3106 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3107 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3108 ) if (rr->type == T_TLSA) i++;
3110 dane_data = store_get(i * sizeof(uschar *), FALSE);
3111 dane_data_len = store_get(i * sizeof(int), FALSE);
3114 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3115 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3116 ) if (rr->type == T_TLSA && rr->size > 3)
3118 const uschar * p = rr->data;
3119 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
3120 uint8_t usage = p[0], sel = p[1], type = p[2];
3123 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
3125 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
3126 || (sel != 0 && sel != 1)
3131 case 0: /* Full: cannot check at present */
3133 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
3135 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
3140 tls_out.tlsa_usage |= 1<<usage;
3141 dane_data[i] = CS p;
3142 dane_data_len[i++] = rr->size;
3145 if (!i) return FALSE;
3147 dane_data[i] = NULL;
3148 dane_data_len[i] = 0;
3150 state->dane_data = (char * const *)dane_data;
3151 state->dane_data_len = dane_data_len;
3158 #ifdef EXIM_HAVE_TLS_RESUME
3159 /* On the client, get any stashed session for the given IP from hints db
3160 and apply it to the ssl-connection for attempted resumption. Although
3161 there is a gnutls_session_ticket_enable_client() interface it is
3162 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
3163 by deafult". There seems to be no way to disable them, so even hosts not
3164 enabled by the transport option will be sent a ticket request. We will
3165 however avoid storing and retrieving session information. */
3168 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
3169 host_item * host, smtp_transport_options_block * ob)
3171 tlsp->resumption = RESUME_SUPPORTED;
3172 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3174 dbdata_tls_session * dt;
3176 open_db dbblock, * dbm_file;
3179 debug_printf("check for resumable session for %s\n", host->address);
3180 tlsp->host_resumable = TRUE;
3181 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3182 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
3184 /* Key for the db is the IP. We'd like to filter the retrieved session
3185 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
3187 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
3188 if (!(rc = gnutls_session_set_data(session,
3189 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
3191 DEBUG(D_tls) debug_printf("good session\n");
3192 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3194 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
3195 US gnutls_strerror(rc));
3196 dbfn_close(dbm_file);
3203 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
3205 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
3206 but this flag is not set until the second. TLS 1.3 it's the other way about.
3207 Keep both calls as the session data cannot be extracted before handshake
3210 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
3215 DEBUG(D_tls) debug_printf("server offered session ticket\n");
3216 tlsp->ticket_received = TRUE;
3217 tlsp->resumption |= RESUME_SERVER_TICKET;
3219 if (tlsp->host_resumable)
3220 if (!(rc = gnutls_session_get_data2(session, &tkt)))
3222 open_db dbblock, * dbm_file;
3223 int dlen = sizeof(dbdata_tls_session) + tkt.size;
3224 dbdata_tls_session * dt = store_get(dlen, TRUE);
3226 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
3227 memcpy(dt->session, tkt.data, tkt.size);
3228 gnutls_free(tkt.data);
3230 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3232 /* key for the db is the IP */
3233 dbfn_delete(dbm_file, host->address);
3234 dbfn_write(dbm_file, host->address, dt, dlen);
3235 dbfn_close(dbm_file);
3238 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
3242 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
3247 /* With a TLS1.3 session, the ticket(s) are not seen until
3248 the first data read is attempted. And there's often two of them.
3249 Pick them up with this callback. We are also called for 1.2
3253 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
3254 unsigned incoming, const gnutls_datum_t * msg)
3256 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
3257 tls_support * tlsp = state->tlsp;
3259 DEBUG(D_tls) debug_printf("newticket cb\n");
3261 if (!tlsp->ticket_received)
3262 tls_save_session(tlsp, sess, state->host);
3268 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
3269 tls_support * tlsp, host_item * host,
3270 smtp_transport_options_block * ob)
3272 gnutls_session_set_ptr(state->session, state);
3273 gnutls_handshake_set_hook_function(state->session,
3274 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
3276 tls_retrieve_session(tlsp, state->session, host, ob);
3280 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
3281 tls_support * tlsp, host_item * host)
3283 if (gnutls_session_is_resumed(state->session))
3285 DEBUG(D_tls) debug_printf("Session resumed\n");
3286 tlsp->resumption |= RESUME_USED;
3289 tls_save_session(tlsp, state->session, host);
3291 #endif /* !DISABLE_TLS_RESUME */
3294 /*************************************************
3295 * Start a TLS session in a client *
3296 *************************************************/
3298 /* Called from the smtp transport after STARTTLS has been accepted.
3301 cctx connection context
3302 conn_args connection details
3303 cookie datum for randomness (not used)
3304 tlsp record details of channel configuration here; must be non-NULL
3305 errstr error string pointer
3307 Returns: TRUE for success with TLS session context set in smtp context,
3312 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3313 void * cookie ARG_UNUSED,
3314 tls_support * tlsp, uschar ** errstr)
3316 host_item * host = conn_args->host; /* for msgs and option-tests */
3317 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3318 smtp_transport_options_block * ob = tb
3319 ? (smtp_transport_options_block *)tb->options_block
3320 : &smtp_transport_option_defaults;
3322 exim_gnutls_state_st * state = NULL;
3323 uschar * cipher_list = NULL;
3325 #ifndef DISABLE_OCSP
3327 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3328 BOOL request_ocsp = require_ocsp ? TRUE
3329 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3332 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
3335 /* If dane is flagged, have either request or require dane for this host, and
3336 a TLSA record found. Therefore, dane verify required. Which implies cert must
3337 be requested and supplied, dane verify must pass, and cert verify irrelevant
3338 (incl. hostnames), and (caller handled) require_tls and sni=$domain */
3340 if (conn_args->dane && ob->dane_require_tls_ciphers)
3342 /* not using Expand_check_tlsvar because not yet in state */
3343 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3344 &cipher_list, errstr))
3346 cipher_list = cipher_list && *cipher_list
3347 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
3352 cipher_list = ob->tls_require_ciphers;
3355 #ifdef MEASURE_TIMING
3357 gettimeofday(&t0, NULL);
3360 if (tls_init(host, ob, cipher_list, &state, tlsp, errstr) != OK)
3363 #ifdef MEASURE_TIMING
3364 report_time_since(&t0, US"client tls_init (delta)");
3369 int dh_min_bits = ob->tls_dh_min_bits;
3370 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
3373 debug_printf("WARNING: tls_dh_min_bits far too low,"
3374 " clamping %d up to %d\n",
3375 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
3376 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
3379 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
3380 " acceptable bits to %d\n",
3382 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
3385 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
3386 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
3387 the specified host patterns if one of them is defined */
3390 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
3393 debug_printf("TLS: server certificate DANE required\n");
3394 state->verify_requirement = VERIFY_DANE;
3395 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3399 if ( ( state->exp_tls_verify_certificates
3400 && !ob->tls_verify_hosts
3401 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
3403 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3406 tls_client_setup_hostname_checks(host, state, ob);
3408 debug_printf("TLS: server certificate verification required\n");
3409 state->verify_requirement = VERIFY_REQUIRED;
3410 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3412 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3414 tls_client_setup_hostname_checks(host, state, ob);
3416 debug_printf("TLS: server certificate verification optional\n");
3417 state->verify_requirement = VERIFY_OPTIONAL;
3418 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
3423 debug_printf("TLS: server certificate verification not required\n");
3424 state->verify_requirement = VERIFY_NONE;
3425 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3428 #ifndef DISABLE_OCSP
3429 /* supported since GnuTLS 3.1.3 */
3432 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
3433 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
3434 NULL, 0, NULL)) != OK)
3436 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
3439 tlsp->ocsp = OCSP_NOT_RESP;
3443 #ifdef EXIM_HAVE_TLS_RESUME
3444 tls_client_resume_prehandshake(state, tlsp, host, ob);
3447 #ifndef DISABLE_EVENT
3448 if (tb && tb->event_action)
3450 state->event_action = tb->event_action;
3451 gnutls_session_set_ptr(state->session, state);
3452 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3456 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
3457 state->fd_in = cctx->sock;
3458 state->fd_out = cctx->sock;
3460 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
3461 /* There doesn't seem to be a built-in timeout on connection. */
3463 sigalrm_seen = FALSE;
3464 ALARM(ob->command_timeout);
3466 rc = gnutls_handshake(state->session);
3467 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3470 if (rc != GNUTLS_E_SUCCESS)
3474 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
3475 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
3478 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
3482 DEBUG(D_tls) post_handshake_debug(state);
3486 if (!verify_certificate(state, errstr))
3488 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
3492 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3493 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3494 tlsp->ext_master_secret = TRUE;
3497 #ifndef DISABLE_OCSP
3502 gnutls_datum_t stapling;
3503 gnutls_ocsp_resp_t resp;
3504 gnutls_datum_t printed;
3508 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
3509 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
3511 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
3514 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
3515 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
3516 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
3519 debug_printf("%.4096s", printed.data);
3520 gnutls_free(printed.data);
3523 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3525 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3528 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3530 tlsp->ocsp = OCSP_FAILED;
3531 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3537 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3538 tlsp->ocsp = OCSP_VFIED;
3543 #ifdef EXIM_HAVE_TLS_RESUME
3544 tls_client_resume_posthandshake(state, tlsp, host);
3547 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3549 extract_exim_vars_from_tls_state(state);
3551 cctx->tls_ctx = state;
3560 ct_ctx client TLS context pointer, or NULL for the one global server context
3564 tls_shutdown_wr(void * ct_ctx)
3566 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3567 tls_support * tlsp = state->tlsp;
3569 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3571 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3573 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
3574 gnutls_bye(state->session, GNUTLS_SHUT_WR);
3577 /*************************************************
3578 * Close down a TLS session *
3579 *************************************************/
3581 /* This is also called from within a delivery subprocess forked from the
3582 daemon, to shut down the TLS library, without actually doing a shutdown (which
3583 would tamper with the TLS session in the parent process).
3586 ct_ctx client context pointer, or NULL for the one global server context
3587 do_shutdown 0 no data-flush or TLS close-alert
3588 1 if TLS close-alert is to be sent,
3589 2 if also response to be waited for (2s timeout)
3595 tls_close(void * ct_ctx, int do_shutdown)
3597 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3598 tls_support * tlsp = state->tlsp;
3600 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3604 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3605 do_shutdown > 1 ? " (with response-wait)" : "");
3607 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3610 gnutls_bye(state->session, do_shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3614 if (!ct_ctx) /* server */
3616 receive_getc = smtp_getc;
3617 receive_getbuf = smtp_getbuf;
3618 receive_get_cache = smtp_get_cache;
3619 receive_ungetc = smtp_ungetc;
3620 receive_feof = smtp_feof;
3621 receive_ferror = smtp_ferror;
3622 receive_smtp_buffered = smtp_buffered;
3625 gnutls_deinit(state->session);
3626 gnutls_certificate_free_credentials(state->lib_state.x509_cred);
3627 state->lib_state = null_tls_preload;
3629 tlsp->active.sock = -1;
3630 tlsp->active.tls_ctx = NULL;
3631 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3632 tlsp->channelbinding = NULL;
3635 if (state->xfer_buffer) store_free(state->xfer_buffer);
3642 tls_refill(unsigned lim)
3644 exim_gnutls_state_st * state = &state_server;
3647 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, buffersize=%u)\n",
3648 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3650 sigalrm_seen = FALSE;
3651 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3655 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3656 MIN(ssl_xfer_buffer_size, lim));
3657 while (inbytes == GNUTLS_E_AGAIN);
3659 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3661 if (had_command_timeout) /* set by signal handler */
3662 smtp_command_timeout_exit(); /* does not return */
3663 if (had_command_sigterm)
3664 smtp_command_sigterm_exit();
3665 if (had_data_timeout)
3666 smtp_data_timeout_exit();
3667 if (had_data_sigint)
3668 smtp_data_sigint_exit();
3670 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3671 TLS session has been closed down, not that the socket itself has been closed
3672 down. Revert to non-TLS handling. */
3676 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3677 state->xfer_error = TRUE;
3681 else if (inbytes == 0)
3683 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3684 tls_close(NULL, TLS_NO_SHUTDOWN);
3688 /* Handle genuine errors */
3690 else if (inbytes < 0)
3692 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3693 record_io_error(state, (int) inbytes, US"recv", NULL);
3694 state->xfer_error = TRUE;
3697 #ifndef DISABLE_DKIM
3698 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3700 state->xfer_buffer_hwm = (int) inbytes;
3701 state->xfer_buffer_lwm = 0;
3705 /*************************************************
3706 * TLS version of getc *
3707 *************************************************/
3709 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3710 it refills the buffer via the GnuTLS reading function.
3711 Only used by the server-side TLS.
3713 This feeds DKIM and should be used for all message-body reads.
3715 Arguments: lim Maximum amount to read/buffer
3716 Returns: the next character or EOF
3720 tls_getc(unsigned lim)
3722 exim_gnutls_state_st * state = &state_server;
3724 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3725 if (!tls_refill(lim))
3726 return state->xfer_error ? EOF : smtp_getc(lim);
3728 /* Something in the buffer; return next uschar */
3730 return state->xfer_buffer[state->xfer_buffer_lwm++];
3734 tls_getbuf(unsigned * len)
3736 exim_gnutls_state_st * state = &state_server;
3740 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3741 if (!tls_refill(*len))
3743 if (!state->xfer_error) return smtp_getbuf(len);
3748 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3750 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3751 state->xfer_buffer_lwm += size;
3760 #ifndef DISABLE_DKIM
3761 exim_gnutls_state_st * state = &state_server;
3762 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3764 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3770 tls_could_read(void)
3772 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3773 || gnutls_record_check_pending(state_server.session) > 0;
3777 /*************************************************
3778 * Read bytes from TLS channel *
3779 *************************************************/
3781 /* This does not feed DKIM, so if the caller uses this for reading message body,
3782 then the caller must feed DKIM.
3785 ct_ctx client context pointer, or NULL for the one global server context
3789 Returns: the number of bytes read
3790 -1 after a failed read, including EOF
3794 tls_read(void * ct_ctx, uschar *buff, size_t len)
3796 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3802 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3804 debug_printf("*** PROBABLY A BUG *** " \
3805 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3806 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3809 debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, len=" SIZE_T_FMT ")\n",
3810 state->session, buff, len);
3814 inbytes = gnutls_record_recv(state->session, buff, len);
3815 while (inbytes == GNUTLS_E_AGAIN);
3817 if (inbytes > 0) return inbytes;
3820 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3824 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3825 record_io_error(state, (int)inbytes, US"recv", NULL);
3834 /*************************************************
3835 * Write bytes down TLS channel *
3836 *************************************************/
3840 ct_ctx client context pointer, or NULL for the one global server context
3843 more more data expected soon
3845 Calling with len zero and more unset will flush buffered writes. The buff
3846 argument can be null for that case.
3848 Returns: the number of bytes after a successful write,
3849 -1 after a failed write
3853 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
3857 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3860 if (more && !state->corked)
3862 DEBUG(D_tls) debug_printf("gnutls_record_cork(session=%p)\n", state->session);
3863 gnutls_record_cork(state->session);
3864 state->corked = TRUE;
3868 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
3869 buff, left, more ? ", more" : "");
3873 DEBUG(D_tls) debug_printf("gnutls_record_send(session=%p, buffer=%p, left=" SIZE_T_FMT ")\n",
3874 state->session, buff, left);
3878 outbytes = gnutls_record_send(state->session, buff, left);
3879 while (outbytes == GNUTLS_E_AGAIN);
3881 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
3885 #ifdef GNUTLS_E_PREMATURE_TERMINATION
3886 if ( outbytes == GNUTLS_E_PREMATURE_TERMINATION && errno == ECONNRESET
3887 && !ct_ctx && f.smtp_in_quit
3889 { /* Outlook, dammit */
3890 if (LOGGING(protocol_detail))
3891 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
3892 " SMTP response and TLS close\n", sender_host_address);
3894 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
3895 " client reset TCP before TLS close\n", sender_host_address);
3900 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
3901 record_io_error(state, outbytes, US"send", NULL);
3907 record_io_error(state, 0, US"send", US"TLS channel closed on write");
3918 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
3924 if (!more && state->corked)
3926 DEBUG(D_tls) debug_printf("gnutls_record_uncork(session=%p)\n", state->session);
3928 /* We can't use GNUTLS_RECORD_WAIT here, as it retries on
3929 GNUTLS_E_AGAIN || GNUTLS_E_INTR, which would break our timeout set by alarm().
3930 The GNUTLS_E_AGAIN should not happen ever, as our sockets are blocking anyway.
3931 But who knows. (That all relies on the fact that GNUTLS_E_INTR and GNUTLS_E_AGAIN
3932 match the EINTR and EAGAIN errno values.) */
3933 outbytes = gnutls_record_uncork(state->session, 0);
3934 while (outbytes == GNUTLS_E_AGAIN);
3938 record_io_error(state, len, US"uncork", NULL);
3942 state->corked = FALSE;
3952 /*************************************************
3953 * Random number generation *
3954 *************************************************/
3956 /* Pseudo-random number generation. The result is not expected to be
3957 cryptographically strong but not so weak that someone will shoot themselves
3958 in the foot using it as a nonce in input in some email header scheme or
3959 whatever weirdness they'll twist this into. The result should handle fork()
3960 and avoid repeating sequences. OpenSSL handles that for us.
3964 Returns a random number in range [0, max-1]
3967 #ifdef HAVE_GNUTLS_RND
3969 vaguely_random_number(int max)
3973 uschar smallbuf[sizeof(r)];
3978 needed_len = sizeof(r);
3979 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
3980 asked for a number less than 10. */
3982 for (r = max, i = 0; r; ++i)
3988 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
3991 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback\n");
3992 return vaguely_random_number_fallback(max);
3995 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
3998 /* We don't particularly care about weighted results; if someone wants
3999 * smooth distribution and cares enough then they should submit a patch then. */
4002 #else /* HAVE_GNUTLS_RND */
4004 vaguely_random_number(int max)
4006 return vaguely_random_number_fallback(max);
4008 #endif /* HAVE_GNUTLS_RND */
4013 /*************************************************
4014 * Let tls_require_ciphers be checked at startup *
4015 *************************************************/
4017 /* The tls_require_ciphers option, if set, must be something which the
4020 Returns: NULL on success, or error message
4024 tls_validate_require_cipher(void)
4027 uschar *expciphers = NULL;
4028 gnutls_priority_t priority_cache;
4030 uschar * dummy_errstr;
4032 #ifdef GNUTLS_AUTO_GLOBAL_INIT
4033 # define validate_check_rc(Label) do { \
4034 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \
4035 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4036 # define return_deinit(Label) do { return (Label); } while (0)
4038 # define validate_check_rc(Label) do { \
4039 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
4040 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4041 # define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
4044 if (exim_gnutls_base_init_done)
4045 log_write(0, LOG_MAIN|LOG_PANIC,
4046 "already initialised GnuTLS, Exim developer bug");
4048 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
4049 if (!gnutls_allow_auto_pkcs11)
4051 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
4052 validate_check_rc(US"gnutls_pkcs11_init");
4055 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4056 rc = gnutls_global_init();
4057 validate_check_rc(US"gnutls_global_init()");
4059 exim_gnutls_base_init_done = TRUE;
4061 if (!(tls_require_ciphers && *tls_require_ciphers))
4062 return_deinit(NULL);
4064 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4066 return_deinit(US"failed to expand tls_require_ciphers");
4068 if (!(expciphers && *expciphers))
4069 return_deinit(NULL);
4072 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4074 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
4075 validate_check_rc(string_sprintf(
4076 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
4077 expciphers, errpos - CS expciphers, errpos));
4079 #undef return_deinit
4080 #undef validate_check_rc
4081 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4082 gnutls_global_deinit();
4091 /*************************************************
4092 * Report the library versions. *
4093 *************************************************/
4095 /* See a description in tls-openssl.c for an explanation of why this exists.
4097 Arguments: a FILE* to print the results to
4102 tls_version_report(FILE *f)
4104 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
4107 gnutls_check_version(NULL));
4110 #endif /*!MACRO_PREDEF*/
4113 /* End of tls-gnu.c */