1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Copyright (c) Phil Pennock 2012 */
11 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
12 one of the available supported implementations. This file is #included into
13 tls.c when USE_GNUTLS has been set.
15 The code herein is a revamp of GnuTLS integration using the current APIs; the
16 original tls-gnu.c was based on a patch which was contributed by Nikos
17 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
20 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
21 which is not widely deployed by OS vendors. Will note issues below, which may
22 assist in updating the code in the future. Another sources of hints is
23 mod_gnutls for Apache (SNI callback registration and handling).
25 Keeping client and server variables more split than before and is currently
26 the norm, in anticipation of TLS in ACL callouts.
28 I wanted to switch to gnutls_certificate_set_verify_function() so that
29 certificate rejection could happen during handshake where it belongs, rather
30 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
31 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
33 (I wasn't looking for libraries quite that old, when updating to get rid of
34 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
35 require current GnuTLS, then we'll drop support for the ancient libraries).
38 #include <gnutls/gnutls.h>
39 /* needed for cert checks in verification and DN extraction: */
40 #include <gnutls/x509.h>
41 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
42 #include <gnutls/crypto.h>
44 /* needed to disable PKCS11 autoload unless requested */
45 #if GNUTLS_VERSION_NUMBER >= 0x020c00
46 # include <gnutls/pkcs11.h>
47 # define SUPPORT_PARAM_TO_PK_BITS
49 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
50 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
53 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
54 # warning "GnuTLS library version too old; tls:cert event unsupported"
55 # define DISABLE_EVENT
57 #if GNUTLS_VERSION_NUMBER >= 0x030000
58 # define SUPPORT_SELFSIGN /* Uncertain what version is first usable but 2.12.23 is not */
60 #if GNUTLS_VERSION_NUMBER >= 0x030306
61 # define SUPPORT_CA_DIR
63 # undef SUPPORT_CA_DIR
65 #if GNUTLS_VERSION_NUMBER >= 0x030014
66 # define SUPPORT_SYSDEFAULT_CABUNDLE
68 #if GNUTLS_VERSION_NUMBER >= 0x030104
69 # define GNUTLS_CERT_VFY_STATUS_PRINT
71 #if GNUTLS_VERSION_NUMBER >= 0x030109
74 #if GNUTLS_VERSION_NUMBER >= 0x03010a
75 # define SUPPORT_GNUTLS_SESS_DESC
77 #if GNUTLS_VERSION_NUMBER >= 0x030300
78 # define GNUTLS_AUTO_GLOBAL_INIT
79 # define GNUTLS_AUTO_PKCS11_MANUAL
81 #if (GNUTLS_VERSION_NUMBER >= 0x030404) \
82 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
84 # define EXIM_HAVE_OCSP
87 #if GNUTLS_VERSION_NUMBER >= 0x030500
88 # define SUPPORT_GNUTLS_KEYLOG
90 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
91 # define SUPPORT_SRV_OCSP_STACK
93 #if GNUTLS_VERSION_NUMBER >= 0x030600
94 # define GNUTLS_AUTO_DHPARAMS
96 #if GNUTLS_VERSION_NUMBER >= 0x030603
97 # define EXIM_HAVE_TLS1_3
98 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
99 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
103 # if GNUTLS_VERSION_NUMBER >= 0x030000
104 # define DANESSL_USAGE_DANE_TA 2
105 # define DANESSL_USAGE_DANE_EE 3
107 # error GnuTLS version too early for DANE
109 # if GNUTLS_VERSION_NUMBER < 0x999999
110 # define GNUTLS_BROKEN_DANE_VALIDATION
114 #ifndef DISABLE_TLS_RESUME
115 # if GNUTLS_VERSION_NUMBER >= 0x030603
116 # define EXIM_HAVE_TLS_RESUME
118 # warning "GnuTLS library version too old; resumption unsupported"
122 #if GNUTLS_VERSION_NUMBER >= 0x030200
123 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
124 # define EXIM_HAVE_ALPN
129 # include <gnutls/ocsp.h>
132 # include <gnutls/dane.h>
135 #include "tls-cipher-stdname.c"
142 # ifndef DISABLE_TLS_RESUME
143 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
145 # ifdef EXIM_HAVE_TLS1_3
146 builtin_macro_create(US"_HAVE_TLS1_3");
148 # ifdef EXIM_HAVE_OCSP
149 builtin_macro_create(US"_HAVE_TLS_OCSP");
151 # ifdef SUPPORT_SRV_OCSP_STACK
152 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
154 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
155 builtin_macro_create(US"_HAVE_TLS_CA_CACHE");
164 gnutls_global_set_audit_log_function()
167 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
170 /* Local static variables for GnuTLS */
172 /* Values for verify_requirement */
174 enum peer_verify_requirement
175 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
177 /* This holds most state for server or client; with this, we can set up an
178 outbound TLS-enabled connection in an ACL callout, while not stomping all
179 over the TLS variables available for expansion.
181 Some of these correspond to variables in globals.c; those variables will
182 be set to point to content in one of these instances, as appropriate for
183 the stage of the process lifetime.
185 Not handled here: global tlsp->tls_channelbinding.
188 typedef struct exim_gnutls_state {
189 gnutls_session_t session;
191 exim_tlslib_state lib_state;
192 #define x509_cred libdata0
193 #define pri_cache libdata1
195 enum peer_verify_requirement verify_requirement;
199 BOOL peer_cert_verified:1;
200 BOOL peer_dane_verified:1;
201 BOOL trigger_sni_changes:1;
202 BOOL have_set_peerdn:1;
203 BOOL xfer_eof:1; /*XXX never gets set! */
209 const struct host_item *host; /* NULL if server */
210 gnutls_x509_crt_t peercert;
213 uschar *received_sni;
215 const uschar *tls_certificate;
216 const uschar *tls_privatekey;
217 const uschar *tls_sni; /* client send only, not received */
218 const uschar *tls_verify_certificates;
219 const uschar *tls_crl;
220 const uschar *tls_require_ciphers;
222 uschar *exp_tls_certificate;
223 uschar *exp_tls_privatekey;
224 uschar *exp_tls_verify_certificates;
226 uschar *exp_tls_require_ciphers;
227 const uschar *exp_tls_verify_cert_hostnames;
228 #ifndef DISABLE_EVENT
229 uschar *event_action;
232 char * const * dane_data;
233 const int * dane_data_len;
236 tls_support *tlsp; /* set in tls_init() */
241 } exim_gnutls_state_st;
243 static const exim_gnutls_state_st exim_gnutls_state_init = {
244 /* all elements not explicitly intialised here get 0/NULL/FALSE */
249 /* Not only do we have our own APIs which don't pass around state, assuming
250 it's held in globals, GnuTLS doesn't appear to let us register callback data
251 for callbacks, or as part of the session, so we have to keep a "this is the
252 context we're currently dealing with" pointer and rely upon being
253 single-threaded to keep from processing data on an inbound TLS connection while
254 talking to another TLS connection for an outbound check. This does mean that
255 there's no way for heart-beats to be responded to, for the duration of the
257 XXX But see gnutls_session_get_ptr()
260 static exim_gnutls_state_st state_server = {
261 /* all elements not explicitly intialised here get 0/NULL/FALSE */
266 #ifndef GNUTLS_AUTO_DHPARAMS
267 /* dh_params are initialised once within the lifetime of a process using TLS;
268 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
269 don't want to repeat this. */
271 static gnutls_dh_params_t dh_server_params = NULL;
274 static int ssl_session_timeout = 7200; /* Two hours */
276 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
278 /* Guard library core initialisation */
280 static BOOL exim_gnutls_base_init_done = FALSE;
283 static BOOL gnutls_buggy_ocsp = FALSE;
284 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
287 #ifdef EXIM_HAVE_ALPN
288 static BOOL server_seen_alpn = FALSE;
290 #ifdef EXIM_HAVE_TLS_RESUME
291 static gnutls_datum_t server_sessticket_key;
295 /* ------------------------------------------------------------------------ */
298 #define MAX_HOST_LEN 255
300 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
301 the library logging; a value less than 0 disables the calls to set up logging
302 callbacks. GNuTLS also looks for an environment variable - except not for
303 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
304 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
305 but the env var must be added to /etc/sudoers too. */
306 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
307 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
310 #ifndef EXIM_CLIENT_DH_MIN_BITS
311 # define EXIM_CLIENT_DH_MIN_BITS 1024
314 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
315 can ask for a bit-strength. Without that, we stick to the constant we had
317 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
318 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
321 #define Expand_check_tlsvar(Varname, errstr) \
322 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
324 #if GNUTLS_VERSION_NUMBER >= 0x020c00
325 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
326 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
327 # define HAVE_GNUTLS_RND
328 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
329 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
330 * isn't available sometimes, so this needs to become a conditional
331 * compilation; the sanest way to deal with this being a problem on
332 * older OSes is to block it in the Local/Makefile with this compiler
334 # ifndef AVOID_GNUTLS_PKCS11
335 # define HAVE_GNUTLS_PKCS11
336 # endif /* AVOID_GNUTLS_PKCS11 */
342 /* ------------------------------------------------------------------------ */
343 /* Callback declarations */
345 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
346 static void exim_gnutls_logger_cb(int level, const char *message);
349 static int exim_sni_handling_cb(gnutls_session_t session);
351 #ifdef EXIM_HAVE_TLS_RESUME
353 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
354 unsigned incoming, const gnutls_datum_t * msg);
358 /*************************************************
360 *************************************************/
362 /* Called from lots of places when errors occur before actually starting to do
363 the TLS handshake, that is, while the session is still in clear. Always returns
364 DEFER for a server and FAIL for a client so that most calls can use "return
365 tls_error(...)" to do this processing and then give an appropriate return. A
366 single function is used for both server and client, because it is called from
367 some shared functions.
370 prefix text to include in the logged error
371 msg additional error string (may be NULL)
372 usually obtained from gnutls_strerror()
373 host NULL if setting up a server;
374 the connected host if setting up a client
375 errstr pointer to returned error string
377 Returns: OK/DEFER/FAIL
381 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
385 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
386 return host ? FAIL : DEFER;
391 tls_error_gnu(const uschar *prefix, int err, const host_item *host,
394 return tls_error(prefix, US gnutls_strerror(err), host, errstr);
398 tls_error_sys(const uschar *prefix, int err, const host_item *host,
401 return tls_error(prefix, US strerror(err), host, errstr);
405 /* ------------------------------------------------------------------------ */
411 tls_is_buggy_ocsp(void)
414 uschar maj, mid, mic;
416 s = CUS gnutls_check_version(NULL);
420 while (*s && *s != '.') s++;
428 while (*s && *s != '.') s++;
430 return mic <= (mid == 3 ? 16 : 3);
440 tls_g_init(uschar ** errstr)
443 DEBUG(D_tls) debug_printf("GnuTLS global init required\n");
445 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
446 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
447 which loads modules from a config file, which sounds good and may be wanted
448 by some sysadmin, but also means in common configurations that GNOME keyring
449 environment variables are used and so breaks for users calling mailq.
450 To prevent this, we init PKCS11 first, which is the documented approach. */
452 if (!gnutls_allow_auto_pkcs11)
453 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
454 return tls_error_gnu(US"gnutls_pkcs11_init", rc, NULL, errstr);
457 #ifndef GNUTLS_AUTO_GLOBAL_INIT
458 if ((rc = gnutls_global_init()))
459 return tls_error_gnu(US"gnutls_global_init", rc, NULL, errstr);
462 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
465 gnutls_global_set_log_function(exim_gnutls_logger_cb);
466 /* arbitrarily chosen level; bump up to 9 for more */
467 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
472 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
473 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
476 exim_gnutls_base_init_done = TRUE;
482 /* Daemon-call before each connection. Nothing to do for GnuTLS. */
485 tls_per_lib_daemon_tick(void)
489 /* Daemon one-time initialisation */
492 tls_per_lib_daemon_init(void)
494 uschar * dummy_errstr;
495 static BOOL once = FALSE;
497 if (!exim_gnutls_base_init_done)
498 tls_g_init(&dummy_errstr);
504 #ifdef EXIM_HAVE_TLS_RESUME
505 /* We are dependent on the GnuTLS implementation of the Session Ticket
506 encryption; both the strength and the key rotation period. We hope that
507 the strength at least matches that of the ciphersuite (but GnuTLS does not
510 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
511 if (f.running_in_test_harness) ssl_session_timeout = 6;
514 tls_daemon_creds_reload();
518 /* ------------------------------------------------------------------------ */
520 /*************************************************
521 * Deal with logging errors during I/O *
522 *************************************************/
524 /* We have to get the identity of the peer from saved data.
527 state the current GnuTLS exim state container
528 rc the GnuTLS error code, or 0 if it's a local error
529 when text identifying read or write
530 text local error text when rc is 0
536 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
541 msg = rc == GNUTLS_E_FATAL_ALERT_RECEIVED
542 ? string_sprintf("A TLS fatal alert has been received: %s",
543 US gnutls_alert_get_name(gnutls_alert_get(state->session)))
544 #ifdef GNUTLS_E_PREMATURE_TERMINATION
545 : rc == GNUTLS_E_PREMATURE_TERMINATION && errno
546 ? string_sprintf("%s: syscall: %s", US gnutls_strerror(rc), strerror(errno))
548 : US gnutls_strerror(rc);
550 (void) tls_error(when, msg, state->host, &errstr);
553 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
554 state->host->name, state->host->address, errstr);
557 uschar * conn_info = smtp_get_connection_info();
558 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
559 /* I'd like to get separated H= here, but too hard for now */
560 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
567 /*************************************************
568 * Set various Exim expansion vars *
569 *************************************************/
571 #define exim_gnutls_cert_err(Label) \
574 if (rc != GNUTLS_E_SUCCESS) \
576 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
577 (Label), gnutls_strerror(rc)); \
583 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
587 rc = gnutls_x509_crt_init(crtp);
588 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
590 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
591 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
596 #undef exim_gnutls_cert_err
599 /* We set various Exim global variables from the state, once a session has
600 been established. With TLS callouts, may need to change this to stack
601 variables, or just re-call it with the server state after client callout
604 Make sure anything set here is unset in tls_getc().
608 tls_bits strength indicator
609 tls_certificate_verified bool indicator
610 tls_channelbinding for some SASL mechanisms
613 tls_peercert pointer to library internal
615 tls_sni a (UTF-8) string
616 tls_ourcert pointer to library internal
619 state the relevant exim_gnutls_state_st *
623 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
625 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
628 gnutls_datum_t channel;
630 tls_support * tlsp = state->tlsp;
632 tlsp->active.sock = state->fd_out;
633 tlsp->active.tls_ctx = state;
635 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
637 tlsp->certificate_verified = state->peer_cert_verified;
639 tlsp->dane_verified = state->peer_dane_verified;
642 /* note that tls_channelbinding is not saved to the spool file, since it's
643 only available for use for authenticators while this TLS session is running. */
645 tlsp->channelbinding = NULL;
646 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
649 if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
650 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
653 /* Declare the taintedness of the binding info. On server, untainted; on
654 client, tainted - being the Finish msg from the server. */
656 old_pool = store_pool;
657 store_pool = POOL_PERM;
658 tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size,
660 store_pool = old_pool;
661 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n");
665 /* peercert is set in peer_status() */
666 tlsp->peerdn = state->peerdn;
668 /* do not corrupt sni sent by client; record sni rxd by server */
670 tlsp->sni = state->received_sni;
672 /* record our certificate */
674 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
675 gnutls_x509_crt_t crt;
677 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
684 #ifndef GNUTLS_AUTO_DHPARAMS
685 /*************************************************
686 * Setup up DH parameters *
687 *************************************************/
689 /* Generating the D-H parameters may take a long time. They only need to
690 be re-generated every so often, depending on security policy. What we do is to
691 keep these parameters in a file in the spool directory. If the file does not
692 exist, we generate them. This means that it is easy to cause a regeneration.
694 The new file is written as a temporary file and renamed, so that an incomplete
695 file is never present. If two processes both compute some new parameters, you
696 waste a bit of effort, but it doesn't seem worth messing around with locking to
699 Returns: OK/DEFER/FAIL
703 init_server_dh(uschar ** errstr)
706 unsigned int dh_bits;
707 gnutls_datum_t m = {.data = NULL, .size = 0};
708 uschar filename_buf[PATH_MAX];
709 uschar *filename = NULL;
711 uschar *exp_tls_dhparam;
712 BOOL use_file_in_spool = FALSE;
713 host_item *host = NULL; /* dummy for macros */
715 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params\n");
717 if ((rc = gnutls_dh_params_init(&dh_server_params)))
718 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
720 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
723 if (!exp_tls_dhparam)
725 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
726 m.data = US std_dh_prime_default();
727 m.size = Ustrlen(m.data);
729 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
730 use_file_in_spool = TRUE;
731 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
733 DEBUG(D_tls) debug_printf("Requested no DH parameters\n");
736 else if (exp_tls_dhparam[0] != '/')
738 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
739 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
740 m.size = Ustrlen(m.data);
743 filename = exp_tls_dhparam;
747 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
748 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
749 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
753 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
754 /* If you change this constant, also change dh_param_fn_ext so that we can use a
755 different filename and ensure we have sufficient bits. */
757 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
758 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
760 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits\n",
763 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
765 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits\n",
769 /* Some clients have hard-coded limits. */
770 if (dh_bits > tls_dh_max_bits)
773 debug_printf("tls_dh_max_bits clamping override, using %d bits instead\n",
775 dh_bits = tls_dh_max_bits;
778 if (use_file_in_spool)
780 if (!string_format(filename_buf, sizeof(filename_buf),
781 "%s/gnutls-params-%d", spool_directory, dh_bits))
782 return tls_error(US"overlong filename", NULL, NULL, errstr);
783 filename = filename_buf;
786 /* Open the cache file for reading and if successful, read it and set up the
789 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
795 if (fstat(fd, &statbuf) < 0) /* EIO */
799 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
801 if (!S_ISREG(statbuf.st_mode))
804 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
806 if (!(fp = fdopen(fd, "rb")))
810 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
811 saved_errno, NULL, errstr);
814 m.size = statbuf.st_size;
815 if (!(m.data = store_malloc(m.size)))
818 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
820 if (!(sz = fread(m.data, m.size, 1, fp)))
825 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
829 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
832 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
833 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
836 /* If the file does not exist, fall through to compute new data and cache it.
837 If there was any other opening error, it is serious. */
839 else if (errno == ENOENT)
843 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
846 return tls_error(string_open_failed("\"%s\" for reading", filename),
849 /* If ret < 0, either the cache file does not exist, or the data it contains
850 is not useful. One particular case of this is when upgrading from an older
851 release of Exim in which the data was stored in a different format. We don't
852 try to be clever and support both formats; we just regenerate new data in this
858 unsigned int dh_bits_gen = dh_bits;
860 if ((PATH_MAX - Ustrlen(filename)) < 10)
861 return tls_error(US"Filename too long to generate replacement",
862 filename, NULL, errstr);
864 temp_fn = string_copy(US"exim-dh.XXXXXXX");
865 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
866 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
867 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
869 /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But
870 there's no way to ask GnuTLS how many bits there really are. We can ask
871 how many bits were used in a TLS session, but that's it! The prime itself
872 is hidden behind too much abstraction. So we ask for less, and proceed on
873 a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */
875 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
877 dh_bits_gen = dh_bits - 10;
879 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
884 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
886 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
887 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
889 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
890 and I confirmed that a NULL call to get the size first is how the GnuTLS
891 sample apps handle this. */
895 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
896 GNUTLS_X509_FMT_PEM, m.data, &sz))
897 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
898 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
901 if (!(m.data = store_malloc(m.size)))
902 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
904 /* this will return a size 1 less than the allocation size above */
905 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
909 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
911 m.size = sz; /* shrink by 1, probably */
913 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
916 return tls_error_sys(US"TLS cache write D-H params failed",
917 errno, NULL, errstr);
920 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
921 return tls_error_sys(US"TLS cache write D-H params final newline failed",
922 errno, NULL, errstr);
924 if ((rc = close(fd)))
925 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
927 if (Urename(temp_fn, filename) < 0)
928 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
929 temp_fn, filename), errno, NULL, errstr);
931 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
934 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
942 /* Create and install a selfsigned certificate, for use in server mode. */
945 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
947 gnutls_x509_crt_t cert = NULL;
949 gnutls_x509_privkey_t pkey = NULL;
950 const uschar * where;
953 #ifndef SUPPORT_SELFSIGN
954 where = US"library too old";
955 rc = GNUTLS_E_NO_CERTIFICATE_FOUND;
959 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
960 where = US"initialising pkey";
961 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
963 where = US"initialising cert";
964 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
966 where = US"generating pkey"; /* Hangs on 2.12.23 */
967 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
968 #ifdef SUPPORT_PARAM_TO_PK_BITS
969 # ifndef GNUTLS_SEC_PARAM_MEDIUM
970 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
972 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
979 where = US"configuring cert";
981 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
982 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
983 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
984 || (rc = gnutls_x509_crt_set_expiration_time(cert, (long)2 * 60 * 60)) /* 2 hour */
985 || (rc = gnutls_x509_crt_set_key(cert, pkey))
987 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
988 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
989 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
990 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
991 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
992 GNUTLS_OID_X520_COMMON_NAME, 0,
993 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
997 where = US"signing cert";
998 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
1000 where = US"installing selfsign cert";
1002 if ((rc = gnutls_certificate_set_x509_key(state->lib_state.x509_cred,
1009 if (cert) gnutls_x509_crt_deinit(cert);
1010 if (pkey) gnutls_x509_privkey_deinit(pkey);
1014 rc = tls_error_gnu(where, rc, NULL, errstr);
1021 /* Add certificate and key, from files.
1024 Zero or negative: good. Negate value for certificate index if < 0.
1025 Greater than zero: FAIL or DEFER code.
1029 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
1030 const uschar * certfile, const uschar * keyfile, uschar ** errstr)
1032 int rc = gnutls_certificate_set_x509_key_file(state->lib_state.x509_cred,
1033 CCS certfile, CCS keyfile, GNUTLS_X509_FMT_PEM);
1035 return tls_error_gnu(
1036 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
1042 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1043 /* Load an OCSP proof from file for sending by the server. Called
1044 on getting a status-request handshake message, for earlier versions
1048 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1049 gnutls_datum_t * ocsp_response)
1052 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
1054 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1056 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1058 tls_in.ocsp = OCSP_NOT_RESP;
1059 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1062 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1068 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1069 /* Make a note that we saw a status-request */
1071 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
1072 const unsigned char *data, unsigned size)
1074 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1077 case 5: /* status_request */
1078 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
1079 tls_in.ocsp = OCSP_NOT_RESP;
1081 #ifdef EXIM_HAVE_ALPN
1082 case 16: /* Application Layer Protocol Notification */
1083 DEBUG(D_tls) debug_printf("Seen ALPN extension from client\n");
1084 server_seen_alpn = TRUE;
1091 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
1093 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
1094 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1096 /* Call fn for each extension seen. 3.6.3 onwards */
1097 return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
1098 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
1102 # ifdef notdef_crashes
1103 /* Make a note that we saw a status-response */
1105 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
1106 const unsigned char *data, unsigned size)
1108 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
1109 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1110 if (FALSE && tls_id == 5) /* status_request */
1112 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
1113 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1114 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1120 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
1122 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
1123 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1125 /* Call fn for each extension seen. 3.6.3 onwards */
1126 # ifdef notdef_crashes
1128 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
1131 #endif /*SUPPORT_GNUTLS_EXT_RAW_PARSE*/
1133 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
1134 "Handshake Protocol: Certificate" record.
1135 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
1137 This is different to tls1.2 - where it is a separate record (wireshark term) / handshake message (gnutls term).
1140 #if defined(EXIM_HAVE_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1141 /* Callback for certificate-status, on server. We sent stapled OCSP. */
1143 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
1144 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1146 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
1147 # ifdef SUPPORT_SRV_OCSP_STACK
1148 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1149 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1151 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1156 /* Callback for handshake messages, on server */
1158 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1159 unsigned incoming, const gnutls_datum_t * msg)
1161 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
1164 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1165 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1166 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1167 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1168 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1170 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1171 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1172 # ifdef EXIM_HAVE_TLS_RESUME
1173 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1174 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1183 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1185 tls_server_testharness_ocsp_fiddle(void)
1187 extern char ** environ;
1188 if (environ) for (uschar ** p = USS environ; *p; p++)
1189 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1191 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1192 exim_testharness_disable_ocsp_validity_check = TRUE;
1197 /**************************************************
1198 * One-time init credentials for server and client *
1199 **************************************************/
1202 creds_basic_init(gnutls_certificate_credentials_t x509_cred, BOOL server)
1204 #ifdef SUPPORT_SRV_OCSP_STACK
1205 gnutls_certificate_set_flags(x509_cred, GNUTLS_CERTIFICATE_API_V2);
1207 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1208 if (server && tls_ocsp_file)
1210 if (f.running_in_test_harness)
1211 tls_server_testharness_ocsp_fiddle();
1213 if (exim_testharness_disable_ocsp_validity_check)
1214 gnutls_certificate_set_flags(x509_cred,
1215 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1220 debug_printf("TLS: basic cred init, %s\n", server ? "server" : "client");
1224 creds_load_server_certs(exim_gnutls_state_st * state, const uschar * cert,
1225 const uschar * pkey, const uschar * ocsp, uschar ** errstr)
1227 const uschar * clist = cert;
1228 const uschar * klist = pkey;
1229 const uschar * olist;
1230 int csep = 0, ksep = 0, osep = 0, cnt = 0, rc;
1231 uschar * cfile, * kfile, * ofile;
1232 #ifndef DISABLE_OCSP
1233 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1234 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1237 if (!expand_check(ocsp, US"tls_ocsp_file", &ofile, errstr))
1242 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1244 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1245 return tls_error(US"cert/key setup: out of keys", NULL, NULL, errstr);
1246 else if ((rc = tls_add_certfile(state, NULL, cfile, kfile, errstr)) > 0)
1250 int gnutls_cert_index = -rc;
1251 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1252 gnutls_cert_index, cfile);
1254 #ifndef DISABLE_OCSP
1257 /* Set the OCSP stapling server info */
1258 if (gnutls_buggy_ocsp)
1261 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1263 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1265 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1266 gnutls_cert_index, ofile);
1267 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1268 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1270 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1273 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1275 ocsp_fmt = GNUTLS_X509_FMT_DER;
1279 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1280 state->lib_state.x509_cred, CCS ofile, gnutls_cert_index,
1282 return tls_error_gnu(
1283 US"gnutls_certificate_set_ocsp_status_request_file2",
1286 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1288 /* Arrange callbacks for OCSP request observability */
1291 gnutls_handshake_set_hook_function(state->session,
1292 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1294 state->lib_state.ocsp_hook = TRUE;
1298 # if defined(SUPPORT_SRV_OCSP_STACK)
1299 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1300 state->lib_state.x509_cred, gnutls_cert_index,
1301 server_ocsp_stapling_cb, ofile)))
1302 return tls_error_gnu(
1303 US"gnutls_certificate_set_ocsp_status_request_function2",
1311 debug_printf("oops; multiple OCSP files not supported\n");
1314 gnutls_certificate_set_ocsp_status_request_function(
1315 state->lib_state.x509_cred, server_ocsp_stapling_cb, ofile);
1317 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1320 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1322 #endif /* DISABLE_OCSP */
1328 creds_load_client_certs(exim_gnutls_state_st * state, const host_item * host,
1329 const uschar * cert, const uschar * pkey, uschar ** errstr)
1331 int rc = tls_add_certfile(state, host, cert, pkey, errstr);
1332 if (rc > 0) return rc;
1333 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1338 creds_load_cabundle(exim_gnutls_state_st * state, const uschar * bundle,
1339 const host_item * host, uschar ** errstr)
1342 struct stat statbuf;
1344 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1345 if (Ustrcmp(bundle, "system") == 0 || Ustrncmp(bundle, "system,", 7) == 0)
1346 cert_count = gnutls_certificate_set_x509_system_trust(state->lib_state.x509_cred);
1350 if (Ustat(bundle, &statbuf) < 0)
1352 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1353 "(tls_verify_certificates): %s", bundle, strerror(errno));
1357 #ifndef SUPPORT_CA_DIR
1358 /* The test suite passes in /dev/null; we could check for that path explicitly,
1359 but who knows if someone has some weird FIFO which always dumps some certs, or
1360 other weirdness. The thing we really want to check is that it's not a
1361 directory, since while OpenSSL supports that, GnuTLS does not.
1362 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1363 if (S_ISDIR(statbuf.st_mode))
1365 log_write(0, LOG_MAIN|LOG_PANIC,
1366 "tls_verify_certificates \"%s\" is a directory", bundle);
1371 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1372 bundle, statbuf.st_size);
1374 if (statbuf.st_size == 0)
1377 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1383 #ifdef SUPPORT_CA_DIR
1384 (statbuf.st_mode & S_IFMT) == S_IFDIR
1386 gnutls_certificate_set_x509_trust_dir(state->lib_state.x509_cred,
1387 CS bundle, GNUTLS_X509_FMT_PEM)
1390 gnutls_certificate_set_x509_trust_file(state->lib_state.x509_cred,
1391 CS bundle, GNUTLS_X509_FMT_PEM);
1393 #ifdef SUPPORT_CA_DIR
1394 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1395 when using the directory-of-certs config model. */
1397 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1399 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1401 state->lib_state.ca_rdn_emulate = TRUE;
1406 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1408 debug_printf("Added %d certificate authorities\n", cert_count);
1415 creds_load_crl(exim_gnutls_state_st * state, const uschar * crl, uschar ** errstr)
1418 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", crl);
1419 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->lib_state.x509_cred,
1420 CS crl, GNUTLS_X509_FMT_PEM)) < 0)
1421 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1422 cert_count, state->host, errstr);
1424 DEBUG(D_tls) debug_printf("Processed %d CRLs\n", cert_count);
1430 creds_load_pristring(exim_gnutls_state_st * state, const uschar * p,
1431 const char ** errpos)
1435 p = exim_default_gnutls_priority;
1437 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1439 return gnutls_priority_init( (gnutls_priority_t *) &state->lib_state.pri_cache,
1444 tls_server_creds_init(void)
1446 uschar * dummy_errstr;
1447 unsigned lifetime = 0;
1449 state_server.lib_state = null_tls_preload;
1450 if (gnutls_certificate_allocate_credentials(
1451 (gnutls_certificate_credentials_t *) &state_server.lib_state.x509_cred))
1453 state_server.lib_state.x509_cred = NULL;
1456 creds_basic_init(state_server.lib_state.x509_cred, TRUE);
1458 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1459 /* If tls_certificate has any $ indicating expansions, it is not good.
1460 If tls_privatekey is set but has $, not good. Likewise for tls_ocsp_file.
1461 If all good (and tls_certificate set), load the cert(s). */
1463 if ( opt_set_and_noexpand(tls_certificate)
1464 # ifndef DISABLE_OCSP
1465 && opt_unset_or_noexpand(tls_ocsp_file)
1467 && opt_unset_or_noexpand(tls_privatekey))
1469 /* Set watches on the filenames. The implementation does de-duplication
1470 so we can just blindly do them all.
1473 if ( tls_set_watch(tls_certificate, TRUE)
1474 # ifndef DISABLE_OCSP
1475 && tls_set_watch(tls_ocsp_file, TRUE)
1477 && tls_set_watch(tls_privatekey, TRUE))
1479 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1480 if (creds_load_server_certs(&state_server, tls_certificate,
1481 tls_privatekey && *tls_privatekey ? tls_privatekey : tls_certificate,
1482 # ifdef DISABLE_OCSP
1487 &dummy_errstr) == 0)
1488 state_server.lib_state.conn_certs = TRUE;
1491 else if ( !tls_certificate && !tls_privatekey
1492 # ifndef DISABLE_OCSP
1496 { /* Generate & preload a selfsigned cert. No files to watch. */
1497 if ((tls_install_selfsign(&state_server, &dummy_errstr)) == OK)
1499 state_server.lib_state.conn_certs = TRUE;
1500 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1504 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1506 /* If tls_verify_certificates is non-empty and has no $, load CAs */
1508 if (opt_set_and_noexpand(tls_verify_certificates))
1510 if (tls_set_watch(tls_verify_certificates, FALSE))
1512 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1513 if (creds_load_cabundle(&state_server, tls_verify_certificates,
1514 NULL, &dummy_errstr) != OK)
1516 state_server.lib_state.cabundle = TRUE;
1518 /* If CAs loaded and tls_crl is non-empty and has no $, load it */
1520 if (opt_set_and_noexpand(tls_crl))
1522 if (tls_set_watch(tls_crl, FALSE))
1524 DEBUG(D_tls) debug_printf("TLS: preloading CRL for server\n");
1525 if (creds_load_crl(&state_server, tls_crl, &dummy_errstr) != OK)
1527 state_server.lib_state.crl = TRUE;
1531 DEBUG(D_tls) debug_printf("TLS: not preloading CRL for server\n");
1535 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1536 #endif /* EXIM_HAVE_INOTIFY */
1538 /* If tls_require_ciphers is non-empty and has no $, load the
1539 ciphers priority cache. If unset, load with the default.
1540 (server-only as the client one depends on non/DANE) */
1542 if (!tls_require_ciphers || opt_set_and_noexpand(tls_require_ciphers))
1544 const char * dummy_errpos;
1545 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server: %s\n",
1546 tls_require_ciphers);
1547 if ( creds_load_pristring(&state_server, tls_require_ciphers, &dummy_errpos)
1549 state_server.lib_state.pri_string = TRUE;
1552 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1557 /* Preload whatever creds are static, onto a transport. The client can then
1558 just copy the pointer as it starts up. */
1561 tls_client_creds_init(transport_instance * t, BOOL watch)
1563 smtp_transport_options_block * ob = t->options_block;
1564 exim_gnutls_state_st tpt_dummy_state;
1565 host_item * dummy_host = (host_item *)1;
1566 uschar * dummy_errstr;
1568 if ( !exim_gnutls_base_init_done
1569 && tls_g_init(&dummy_errstr) != OK)
1572 ob->tls_preload = null_tls_preload;
1573 if (gnutls_certificate_allocate_credentials(
1574 (struct gnutls_certificate_credentials_st **)&ob->tls_preload.x509_cred))
1576 ob->tls_preload.x509_cred = NULL;
1579 creds_basic_init(ob->tls_preload.x509_cred, FALSE);
1581 tpt_dummy_state.session = NULL;
1582 tpt_dummy_state.lib_state = ob->tls_preload;
1584 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1585 if ( opt_set_and_noexpand(ob->tls_certificate)
1586 && opt_unset_or_noexpand(ob->tls_privatekey))
1589 || ( tls_set_watch(ob->tls_certificate, FALSE)
1590 && tls_set_watch(ob->tls_privatekey, FALSE)
1593 const uschar * pkey = ob->tls_privatekey;
1596 debug_printf("TLS: preloading client certs for transport '%s'\n", t->name);
1598 /* The state->lib_state.x509_cred is used for the certs load, and is the sole
1599 structure element used. So we can set up a dummy. The hoat arg only
1600 selects a retcode in case of fail, so any value */
1602 if (creds_load_client_certs(&tpt_dummy_state, dummy_host,
1603 ob->tls_certificate, pkey ? pkey : ob->tls_certificate,
1604 &dummy_errstr) == OK)
1605 ob->tls_preload.conn_certs = TRUE;
1610 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1612 if (opt_set_and_noexpand(ob->tls_verify_certificates))
1614 if (!watch || tls_set_watch(ob->tls_verify_certificates, FALSE))
1617 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1618 if (creds_load_cabundle(&tpt_dummy_state, ob->tls_verify_certificates,
1619 dummy_host, &dummy_errstr) != OK)
1621 ob->tls_preload.cabundle = TRUE;
1623 if (opt_set_and_noexpand(ob->tls_crl))
1625 if (!watch || tls_set_watch(ob->tls_crl, FALSE))
1627 DEBUG(D_tls) debug_printf("TLS: preloading CRL for transport '%s'\n", t->name);
1628 if (creds_load_crl(&tpt_dummy_state, ob->tls_crl, &dummy_errstr) != OK)
1630 ob->tls_preload.crl = TRUE;
1634 DEBUG(D_tls) debug_printf("TLS: not preloading CRL, for transport '%s'\n", t->name);
1639 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1641 /* We do not preload tls_require_ciphers to to the transport as it implicitly
1642 depends on DANE or plain usage. */
1648 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1649 /* Invalidate the creds cached, by dropping the current ones.
1650 Call when we notice one of the source files has changed. */
1653 tls_server_creds_invalidate(void)
1655 if (state_server.lib_state.pri_cache)
1656 gnutls_priority_deinit(state_server.lib_state.pri_cache);
1657 state_server.lib_state.pri_cache = NULL;
1659 if (state_server.lib_state.x509_cred)
1660 gnutls_certificate_free_credentials(state_server.lib_state.x509_cred);
1661 state_server.lib_state = null_tls_preload;
1666 tls_client_creds_invalidate(transport_instance * t)
1668 smtp_transport_options_block * ob = t->options_block;
1669 if (ob->tls_preload.x509_cred)
1670 gnutls_certificate_free_credentials(ob->tls_preload.x509_cred);
1671 ob->tls_preload = null_tls_preload;
1676 /*************************************************
1677 * Variables re-expanded post-SNI *
1678 *************************************************/
1680 /* Called from both server and client code, via tls_init(), and also from
1681 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1683 We can tell the two apart by state->received_sni being non-NULL in callback.
1685 The callback should not call us unless state->trigger_sni_changes is true,
1686 which we are responsible for setting on the first pass through.
1689 state exim_gnutls_state_st *
1690 errstr error string pointer
1692 Returns: OK/DEFER/FAIL
1696 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1699 const host_item *host = state->host; /* macro should be reconsidered? */
1700 const uschar *saved_tls_certificate = NULL;
1701 const uschar *saved_tls_privatekey = NULL;
1702 const uschar *saved_tls_verify_certificates = NULL;
1703 const uschar *saved_tls_crl = NULL;
1706 /* We check for tls_sni *before* expansion. */
1707 if (!host) /* server */
1708 if (!state->received_sni)
1710 if ( state->tls_certificate
1711 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1712 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1713 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1716 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI\n");
1717 state->trigger_sni_changes = TRUE;
1720 else /* SNI callback case */
1722 /* useful for debugging */
1723 saved_tls_certificate = state->exp_tls_certificate;
1724 saved_tls_privatekey = state->exp_tls_privatekey;
1725 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1726 saved_tls_crl = state->exp_tls_crl;
1729 if (!state->lib_state.x509_cred)
1731 if ((rc = gnutls_certificate_allocate_credentials(
1732 (gnutls_certificate_credentials_t *) &state->lib_state.x509_cred)))
1733 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
1735 creds_basic_init(state->lib_state.x509_cred, !host);
1739 /* remember: Expand_check_tlsvar() is expand_check() but fiddling with
1740 state members, assuming consistent naming; and expand_check() returns
1741 false if expansion failed, unless expansion was forced to fail. */
1743 /* check if we at least have a certificate, before doing expensive
1746 if (!state->lib_state.conn_certs)
1748 if (!Expand_check_tlsvar(tls_certificate, errstr))
1751 /* certificate is mandatory in server, optional in client */
1753 if ( !state->exp_tls_certificate
1754 || !*state->exp_tls_certificate
1757 return tls_install_selfsign(state, errstr);
1759 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1761 if (state->tls_privatekey && !Expand_check_tlsvar(tls_privatekey, errstr))
1764 /* tls_privatekey is optional, defaulting to same file as certificate */
1766 if (!state->tls_privatekey || !*state->tls_privatekey)
1768 state->tls_privatekey = state->tls_certificate;
1769 state->exp_tls_privatekey = state->exp_tls_certificate;
1772 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1775 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1776 state->exp_tls_certificate, state->exp_tls_privatekey);
1778 if (state->received_sni)
1779 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1780 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1783 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1784 load = FALSE; /* avoid re-loading the same certs */
1786 else /* unload the pre-SNI certs before loading new ones */
1788 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair\n");
1789 gnutls_certificate_free_keys(state->lib_state.x509_cred);
1794 ? creds_load_client_certs(state, host, state->exp_tls_certificate,
1795 state->exp_tls_privatekey, errstr)
1796 : creds_load_server_certs(state, state->exp_tls_certificate,
1797 state->exp_tls_privatekey,
1810 debug_printf("%s certs were preloaded\n", host ? "client" : "server");
1812 if (!state->tls_privatekey) state->tls_privatekey = state->tls_certificate;
1813 state->exp_tls_certificate = US state->tls_certificate;
1814 state->exp_tls_privatekey = US state->tls_privatekey;
1816 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1817 if (state->lib_state.ocsp_hook)
1818 gnutls_handshake_set_hook_function(state->session,
1819 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1824 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1825 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1826 error message is provided. However, if we just refrain from setting anything up
1827 in that case, certificate verification fails, which seems to be the correct
1830 if (!state->lib_state.cabundle)
1832 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1834 if (!Expand_check_tlsvar(tls_verify_certificates, errstr))
1836 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1837 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1838 state->exp_tls_verify_certificates = NULL;
1840 if (state->tls_crl && *state->tls_crl)
1841 if (!Expand_check_tlsvar(tls_crl, errstr))
1844 if (!(state->exp_tls_verify_certificates &&
1845 *state->exp_tls_verify_certificates))
1848 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1849 /* With no tls_verify_certificates, we ignore tls_crl too */
1856 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1859 rc = creds_load_cabundle(state, state->exp_tls_verify_certificates, host, errstr);
1860 if (rc != OK) return rc;
1865 debug_printf("%s CA bundle was preloaded\n", host ? "client" : "server");
1866 state->exp_tls_verify_certificates = US state->tls_verify_certificates;
1868 #ifdef SUPPORT_CA_DIR
1869 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1870 when using the directory-of-certs config model. */
1871 if (state->lib_state.ca_rdn_emulate)
1872 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1877 if (!state->lib_state.crl)
1879 if ( state->tls_crl && *state->tls_crl
1880 && state->exp_tls_crl && *state->exp_tls_crl)
1881 return creds_load_crl(state, state->exp_tls_crl, errstr);
1886 debug_printf("%s CRL was preloaded\n", host ? "client" : "server");
1887 state->exp_tls_crl = US state->tls_crl;
1896 /*************************************************
1897 * Set X.509 state variables *
1898 *************************************************/
1900 /* In GnuTLS, the registered cert/key are not replaced by a later
1901 set of a cert/key, so for SNI support we need a whole new x509_cred
1902 structure. Which means various other non-re-expanded pieces of state
1903 need to be re-set in the new struct, so the setting logic is pulled
1907 state exim_gnutls_state_st *
1908 errstr error string pointer
1910 Returns: OK/DEFER/FAIL
1914 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1917 const host_item *host = state->host; /* macro should be reconsidered? */
1919 #ifndef GNUTLS_AUTO_DHPARAMS
1920 /* Create D-H parameters, or read them from the cache file. This function does
1921 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1922 client-side params. */
1926 if (!dh_server_params)
1927 if ((rc = init_server_dh(errstr)) != OK) return rc;
1929 /* Unnecessary & discouraged with 3.6.0 or later */
1930 gnutls_certificate_set_dh_params(state->lib_state.x509_cred, dh_server_params);
1934 /* Link the credentials to the session. */
1936 if ((rc = gnutls_credentials_set(state->session,
1937 GNUTLS_CRD_CERTIFICATE, state->lib_state.x509_cred)))
1938 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1943 /*************************************************
1944 * Initialize for GnuTLS *
1945 *************************************************/
1948 /* Called from both server and client code. In the case of a server, errors
1949 before actual TLS negotiation return DEFER.
1952 host connected host, if client; NULL if server
1953 ob tranport options block, if client; NULL if server
1954 require_ciphers tls_require_ciphers setting
1955 caller_state returned state-info structure
1956 errstr error string pointer
1958 Returns: OK/DEFER/FAIL
1963 const host_item *host,
1964 smtp_transport_options_block * ob,
1965 const uschar * require_ciphers,
1966 exim_gnutls_state_st **caller_state,
1970 exim_gnutls_state_st * state;
1974 if ( !exim_gnutls_base_init_done
1975 && (rc = tls_g_init(errstr)) != OK)
1980 /* For client-side sessions we allocate a context. This lets us run
1981 several in parallel. */
1983 int old_pool = store_pool;
1984 store_pool = POOL_PERM;
1985 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
1986 store_pool = old_pool;
1988 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1989 state->lib_state = ob->tls_preload;
1991 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1992 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1994 state->tls_certificate = ob->tls_certificate;
1995 state->tls_privatekey = ob->tls_privatekey;
1996 state->tls_sni = ob->tls_sni;
1997 state->tls_verify_certificates = ob->tls_verify_certificates;
1998 state->tls_crl = ob->tls_crl;
2002 /* Server operations always use the one state_server context. It is not
2003 shared because we have forked a fresh process for every receive. However it
2004 can get re-used for successive TLS sessions on a single TCP connection. */
2006 state = &state_server;
2008 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
2009 rc = gnutls_init(&state->session, GNUTLS_SERVER);
2011 state->tls_certificate = tls_certificate;
2012 state->tls_privatekey = tls_privatekey;
2013 state->tls_sni = NULL;
2014 state->tls_verify_certificates = tls_verify_certificates;
2015 state->tls_crl = tls_crl;
2018 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
2020 state->tls_require_ciphers = require_ciphers;
2023 /* This handles the variables that might get re-expanded after TLS SNI;
2024 tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
2027 debug_printf("Expanding various TLS configuration options for session credentials\n");
2028 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
2030 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
2031 requires a new structure afterwards. */
2033 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
2035 /* set SNI in client, only */
2038 if (!expand_check(state->tls_sni, US"tls_out_sni", &state->tlsp->sni, errstr))
2040 if (state->tlsp->sni && *state->tlsp->sni)
2043 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
2044 sz = Ustrlen(state->tlsp->sni);
2045 if ((rc = gnutls_server_name_set(state->session,
2046 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
2047 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
2050 else if (state->tls_sni)
2051 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
2052 "have an SNI set for a server [%s]\n", state->tls_sni);
2054 if (!state->lib_state.pri_string)
2056 const uschar * p = NULL;
2057 const char * errpos;
2059 /* This is the priority string support,
2060 http://www.gnutls.org/manual/html_node/Priority-Strings.html
2061 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
2062 This was backwards incompatible, but means Exim no longer needs to track
2063 all algorithms and provide string forms for them. */
2065 if (state->tls_require_ciphers && *state->tls_require_ciphers)
2067 if (!Expand_check_tlsvar(tls_require_ciphers, errstr))
2069 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
2071 p = state->exp_tls_require_ciphers;
2072 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
2076 if ((rc = creds_load_pristring(state, p, &errpos)))
2077 return tls_error_gnu(string_sprintf(
2078 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
2079 p, errpos - CS p, errpos),
2084 DEBUG(D_tls) debug_printf("cipher list preloaded\n");
2085 state->exp_tls_require_ciphers = US state->tls_require_ciphers;
2089 if ((rc = gnutls_priority_set(state->session, state->lib_state.pri_cache)))
2090 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
2092 /* This also sets the server ticket expiration time to the same, and
2093 the STEK rotation time to 3x. */
2095 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
2097 /* Reduce security in favour of increased compatibility, if the admin
2098 decides to make that trade-off. */
2099 if (gnutls_compat_mode)
2101 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
2102 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
2103 gnutls_session_enable_compatibility_mode(state->session);
2105 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
2109 *caller_state = state;
2115 /*************************************************
2116 * Extract peer information *
2117 *************************************************/
2119 static const uschar *
2120 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
2121 gnutls_mac_algorithm_t mac)
2124 gnutls_kx_algorithm_t kx_i;
2125 gnutls_cipher_algorithm_t cipher_i;
2126 gnutls_mac_algorithm_t mac_i;
2129 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
2131 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
2132 return cipher_stdname(cs_id[0], cs_id[1]);
2138 /* Called from both server and client code.
2139 Only this is allowed to set state->peerdn and state->have_set_peerdn
2140 and we use that to detect double-calls.
2142 NOTE: the state blocks last while the TLS connection is up, which is fine
2143 for logging in the server side, but for the client side, we log after teardown
2144 in src/deliver.c. While the session is up, we can twist about states and
2145 repoint tls_* globals, but those variables used for logging or other variable
2146 expansion that happens _after_ delivery need to have a longer life-time.
2148 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
2149 doing this more than once per generation of a state context. We set them in
2150 the state context, and repoint tls_* to them. After the state goes away, the
2151 tls_* copies of the pointers remain valid and client delivery logging is happy.
2153 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
2157 state exim_gnutls_state_st *
2158 errstr pointer to error string
2160 Returns: OK/DEFER/FAIL
2164 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
2166 gnutls_session_t session = state->session;
2167 const gnutls_datum_t * cert_list;
2169 unsigned int cert_list_size = 0;
2170 gnutls_protocol_t protocol;
2171 gnutls_cipher_algorithm_t cipher;
2172 gnutls_kx_algorithm_t kx;
2173 gnutls_mac_algorithm_t mac;
2174 gnutls_certificate_type_t ct;
2175 gnutls_x509_crt_t crt;
2179 if (state->have_set_peerdn)
2181 state->have_set_peerdn = TRUE;
2183 state->peerdn = NULL;
2186 cipher = gnutls_cipher_get(session);
2187 protocol = gnutls_protocol_get_version(session);
2188 mac = gnutls_mac_get(session);
2190 #ifdef GNUTLS_TLS1_3
2191 protocol >= GNUTLS_TLS1_3 ? 0 :
2193 gnutls_kx_get(session);
2195 old_pool = store_pool;
2197 tls_support * tlsp = state->tlsp;
2198 store_pool = POOL_PERM;
2200 #ifdef SUPPORT_GNUTLS_SESS_DESC
2203 uschar * s = US gnutls_session_get_desc(session), c;
2205 /* Nikos M suggests we use this by preference. It returns like:
2206 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
2208 For partial back-compat, put a colon after the TLS version, replace the
2209 )-( grouping with __, replace in-group - with _ and append the :keysize. */
2211 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
2213 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
2215 tlsp->ver = string_copyn(g->s, g->ptr);
2216 for (uschar * p = US tlsp->ver; *p; p++)
2217 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
2219 g = string_catn(g, US":", 1);
2220 if (*s) s++; /* now on _ between groups */
2223 for (*++s && ++s; (c = *s) && c != ')'; s++)
2224 g = string_catn(g, c == '-' ? US"_" : s, 1);
2225 /* now on ) closing group */
2226 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
2227 /* now on _ between groups */
2229 g = string_catn(g, US":", 1);
2230 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
2231 state->ciphersuite = string_from_gstring(g);
2234 state->ciphersuite = string_sprintf("%s:%s:%d",
2235 gnutls_protocol_get_name(protocol),
2236 gnutls_cipher_suite_get_name(kx, cipher, mac),
2237 (int) gnutls_cipher_get_key_size(cipher) * 8);
2239 /* I don't see a way that spaces could occur, in the current GnuTLS
2240 code base, but it was a concern in the old code and perhaps older GnuTLS
2241 releases did return "TLS 1.0"; play it safe, just in case. */
2243 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
2244 tlsp->ver = string_copyn(state->ciphersuite,
2245 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
2248 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
2250 tlsp->cipher = state->ciphersuite;
2251 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
2253 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
2255 store_pool = old_pool;
2258 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
2260 if (!cert_list || cert_list_size == 0)
2262 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
2263 cert_list, cert_list_size);
2264 if (state->verify_requirement >= VERIFY_REQUIRED)
2265 return tls_error(US"certificate verification failed",
2266 US"no certificate received from peer", state->host, errstr);
2270 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
2272 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
2274 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
2275 if (state->verify_requirement >= VERIFY_REQUIRED)
2276 return tls_error(US"certificate verification not possible, unhandled type",
2277 ctn, state->host, errstr);
2281 #define exim_gnutls_peer_err(Label) \
2283 if (rc != GNUTLS_E_SUCCESS) \
2285 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
2286 (Label), gnutls_strerror(rc)); \
2287 if (state->verify_requirement >= VERIFY_REQUIRED) \
2288 return tls_error_gnu((Label), rc, state->host, errstr); \
2293 rc = import_cert(&cert_list[0], &crt);
2294 exim_gnutls_peer_err(US"cert 0");
2296 state->tlsp->peercert = state->peercert = crt;
2299 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
2300 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
2302 exim_gnutls_peer_err(US"getting size for cert DN failed");
2303 return FAIL; /* should not happen */
2305 dn_buf = store_get_perm(sz, TRUE); /* tainted */
2306 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
2307 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
2309 state->peerdn = dn_buf;
2312 #undef exim_gnutls_peer_err
2318 /*************************************************
2319 * Verify peer certificate *
2320 *************************************************/
2322 /* Called from both server and client code.
2323 *Should* be using a callback registered with
2324 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
2325 the peer information, but that's too new for some OSes.
2328 state exim_gnutls_state_st *
2329 errstr where to put an error message
2332 FALSE if the session should be rejected
2333 TRUE if the cert is okay or we just don't care
2337 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
2342 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
2344 rc = peer_status(state, errstr);
2346 if (state->verify_requirement == VERIFY_NONE)
2349 if (rc != OK || !state->peerdn)
2351 verify = GNUTLS_CERT_INVALID;
2352 *errstr = US"certificate not supplied";
2358 if (state->verify_requirement == VERIFY_DANE && state->host)
2360 /* Using dane_verify_session_crt() would be easy, as it does it all for us
2361 including talking to a DNS resolver. But we want to do that bit ourselves
2362 as the testsuite intercepts and fakes its own DNS environment. */
2367 const gnutls_datum_t * certlist =
2368 gnutls_certificate_get_peers(state->session, &lsize);
2369 int usage = tls_out.tlsa_usage;
2371 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2372 /* Split the TLSA records into two sets, TA and EE selectors. Run the
2373 dane-verification separately so that we know which selector verified;
2374 then we know whether to do name-verification (needed for TA but not EE). */
2376 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
2377 { /* a mixed-usage bundle */
2382 for (nrec = 0; state->dane_data_len[nrec]; ) nrec++;
2385 dd = store_get(nrec * sizeof(uschar *), FALSE);
2386 ddl = store_get(nrec * sizeof(int), FALSE);
2389 if ((rc = dane_state_init(&s, 0)))
2392 for (usage = DANESSL_USAGE_DANE_EE;
2393 usage >= DANESSL_USAGE_DANE_TA; usage--)
2394 { /* take records with this usage */
2395 for (j = i = 0; i < nrec; i++)
2396 if (state->dane_data[i][0] == usage)
2398 dd[j] = state->dane_data[i];
2399 ddl[j++] = state->dane_data_len[i];
2406 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
2409 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
2410 gnutls_certificate_type_get(state->session),
2412 usage == DANESSL_USAGE_DANE_EE
2413 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2417 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
2419 else if (verify == 0) /* verification passed */
2427 if (rc) goto tlsa_prob;
2432 if ( (rc = dane_state_init(&s, 0))
2433 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
2435 || (rc = dane_verify_crt_raw(s, certlist, lsize,
2436 gnutls_certificate_type_get(state->session),
2438 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2439 usage == (1 << DANESSL_USAGE_DANE_EE)
2440 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2449 if (verify != 0) /* verification failed */
2452 (void) dane_verification_status_print(verify, &str, 0);
2453 *errstr = US str.data; /* don't bother to free */
2457 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2458 /* If a TA-mode TLSA record was used for verification we must additionally
2459 verify the cert name (but not the CA chain). For EE-mode, skip it. */
2461 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2464 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2467 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2468 /* Assume that the name on the A-record is the one that should be matching
2469 the cert. An alternate view is that the domain part of the email address
2470 is also permissible. */
2472 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2473 CS state->host->name))
2475 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2480 #endif /*SUPPORT_DANE*/
2482 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2485 /* Handle the result of verification. INVALID is set if any others are. */
2487 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2489 state->peer_cert_verified = FALSE;
2492 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2497 if (gnutls_certificate_verification_status_print(verify,
2498 gnutls_certificate_type_get(state->session), &txt, 0)
2499 == GNUTLS_E_SUCCESS)
2501 debug_printf("%s\n", txt.data);
2502 gnutls_free(txt.data);
2506 *errstr = verify & GNUTLS_CERT_REVOKED
2507 ? US"certificate revoked" : US"certificate invalid";
2511 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2512 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2514 if (state->verify_requirement >= VERIFY_REQUIRED)
2517 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2522 /* Client side, check the server's certificate name versus the name on the
2523 A-record for the connection we made. What to do for server side - what name
2524 to use for client? We document that there is no such checking for server
2527 if ( state->exp_tls_verify_cert_hostnames
2528 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2529 CS state->exp_tls_verify_cert_hostnames)
2533 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2534 if (state->verify_requirement >= VERIFY_REQUIRED)
2539 state->peer_cert_verified = TRUE;
2540 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2541 state->peerdn ? state->peerdn : US"<unset>");
2545 state->tlsp->peerdn = state->peerdn;
2550 *errstr = string_sprintf("TLSA record problem: %s",
2551 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2555 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2562 /* ------------------------------------------------------------------------ */
2565 /* Logging function which can be registered with
2566 * gnutls_global_set_log_function()
2567 * gnutls_global_set_log_level() 0..9
2569 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2571 exim_gnutls_logger_cb(int level, const char *message)
2573 size_t len = strlen(message);
2576 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2579 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2580 message[len-1] == '\n' ? "" : "\n");
2585 /* Called after client hello, should handle SNI work.
2586 This will always set tls_sni (state->received_sni) if available,
2587 and may trigger presenting different certificates,
2588 if state->trigger_sni_changes is TRUE.
2590 Should be registered with
2591 gnutls_handshake_set_post_client_hello_function()
2593 "This callback must return 0 on success or a gnutls error code to terminate the
2596 For inability to get SNI information, we return 0.
2597 We only return non-zero if re-setup failed.
2598 Only used for server-side TLS.
2602 exim_sni_handling_cb(gnutls_session_t session)
2604 char sni_name[MAX_HOST_LEN];
2605 size_t data_len = MAX_HOST_LEN;
2606 exim_gnutls_state_st *state = &state_server;
2607 unsigned int sni_type;
2609 uschar * dummy_errstr;
2611 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2612 if (rc != GNUTLS_E_SUCCESS)
2615 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2616 debug_printf("TLS: no SNI presented in handshake\n");
2618 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2619 gnutls_strerror(rc), rc);
2623 if (sni_type != GNUTLS_NAME_DNS)
2625 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2629 /* We now have a UTF-8 string in sni_name */
2630 old_pool = store_pool;
2631 store_pool = POOL_PERM;
2632 state->received_sni = string_copy_taint(US sni_name, TRUE);
2633 store_pool = old_pool;
2635 /* We set this one now so that variable expansions below will work */
2636 state->tlsp->sni = state->received_sni;
2638 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2639 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2641 if (!state->trigger_sni_changes)
2644 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2646 /* If the setup of certs/etc failed before handshake, TLS would not have
2647 been offered. The best we can do now is abort. */
2648 return GNUTLS_E_APPLICATION_ERROR_MIN;
2651 rc = tls_set_remaining_x509(state, &dummy_errstr);
2652 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2659 #ifndef DISABLE_EVENT
2661 We use this callback to get observability and detail-level control
2662 for an exim TLS connection (either direction), raising a tls:cert event
2663 for each cert in the chain presented by the peer. Any event
2664 can deny verification.
2666 Return 0 for the handshake to continue or non-zero to terminate.
2670 verify_cb(gnutls_session_t session)
2672 const gnutls_datum_t * cert_list;
2673 unsigned int cert_list_size = 0;
2674 gnutls_x509_crt_t crt;
2677 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2679 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2680 while (cert_list_size--)
2682 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2684 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2685 cert_list_size, gnutls_strerror(rc));
2689 state->tlsp->peercert = crt;
2690 if ((yield = event_raise(state->event_action,
2691 US"tls:cert", string_sprintf("%d", cert_list_size))))
2693 log_write(0, LOG_MAIN,
2694 "SSL verify denied by event-action: depth=%d: %s",
2695 cert_list_size, yield);
2696 return 1; /* reject */
2698 state->tlsp->peercert = NULL;
2708 ddump(gnutls_datum_t * d)
2710 gstring * g = string_get((d->size+1) * 2);
2711 uschar * s = d->data;
2712 for (unsigned i = d->size; i > 0; i--, s++)
2714 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2715 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2721 post_handshake_debug(exim_gnutls_state_st * state)
2723 #ifdef SUPPORT_GNUTLS_SESS_DESC
2724 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2727 #ifdef SUPPORT_GNUTLS_KEYLOG
2728 # ifdef EXIM_HAVE_TLS1_3
2729 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2734 gnutls_datum_t c, s;
2736 /* For TLS1.2 we only want the client random and the master secret */
2737 gnutls_session_get_random(state->session, &c, &s);
2738 gnutls_session_get_master_secret(state->session, &s);
2741 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2744 debug_printf("To get keying info for TLS1.3 is hard:\n"
2745 " Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,\n"
2746 " and make sure it is writable by the Exim runtime user.\n"
2747 " Add SSLKEYLOGFILE to keep_environment in the exim config.\n"
2748 " Start Exim as root.\n"
2749 " If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2750 " (works for TLS1.2 also, and saves cut-paste into file).\n"
2751 " Trying to use add_environment for this will not work\n");
2756 #ifdef EXIM_HAVE_TLS_RESUME
2758 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2759 unsigned incoming, const gnutls_datum_t * msg)
2761 DEBUG(D_tls) debug_printf("newticket cb\n");
2762 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2767 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2769 /* Should the server offer session resumption? */
2770 tls_in.resumption = RESUME_SUPPORTED;
2771 if (verify_check_host(&tls_resumption_hosts) == OK)
2774 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2775 an offered resumption is unacceptable. We lose one resumption per ticket
2776 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2777 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2778 least they go out in a single packet. */
2780 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2781 &server_sessticket_key)))
2782 tls_in.resumption |= RESUME_SERVER_TICKET;
2785 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2787 /* Try to tell if we see a ticket request */
2788 gnutls_handshake_set_hook_function(state->session,
2789 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2794 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2796 if (gnutls_session_resumption_requested(state->session))
2798 /* This tells us the client sent a full ticket. We use a
2799 callback on session-ticket request, elsewhere, to tell
2800 if a client asked for a ticket. */
2802 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2803 DEBUG(D_tls) debug_printf("client requested resumption\n");
2805 if (gnutls_session_is_resumed(state->session))
2807 tls_in.resumption |= RESUME_USED;
2808 DEBUG(D_tls) debug_printf("Session resumed\n");
2814 #ifdef EXIM_HAVE_ALPN
2816 tls_server_set_acceptable_alpns(exim_gnutls_state_st * state)
2819 gnutls_datum_t protocols[2] = {[0] = {.data = US"smtp", .size = 4},
2820 [1] = {.data = US"esmtp", .size = 5}};
2822 /* Set non-mandatory set of protocol names */
2823 if (!(rc = gnutls_alpn_set_protocols(state->session, protocols, 2, 0)))
2824 gnutls_handshake_set_hook_function(state->session,
2825 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2828 debug_printf("setting alpn protocols: %s\n", US gnutls_strerror(rc));
2832 /* ------------------------------------------------------------------------ */
2833 /* Exported functions */
2838 /*************************************************
2839 * Start a TLS session in a server *
2840 *************************************************/
2842 /* This is called when Exim is running as a server, after having received
2843 the STARTTLS command. It must respond to that command, and then negotiate
2847 errstr pointer to error string
2849 Returns: OK on success
2850 DEFER for errors before the start of the negotiation
2851 FAIL for errors during the negotiation; the server can't
2856 tls_server_start(uschar ** errstr)
2859 exim_gnutls_state_st * state = NULL;
2861 /* Check for previous activation */
2862 if (tls_in.active.sock >= 0)
2864 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2865 smtp_printf("554 Already in TLS\r\n", FALSE);
2869 /* Initialize the library. If it fails, it will already have logged the error
2870 and sent an SMTP response. */
2872 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2875 #ifdef MEASURE_TIMING
2877 gettimeofday(&t0, NULL);
2880 if ((rc = tls_init(NULL, NULL,
2881 tls_require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2883 #ifdef MEASURE_TIMING
2884 report_time_since(&t0, US"server tls_init (delta)");
2888 #ifdef EXIM_HAVE_ALPN
2889 tls_server_set_acceptable_alpns(state);
2892 #ifdef EXIM_HAVE_TLS_RESUME
2893 tls_server_resume_prehandshake(state);
2896 /* If this is a host for which certificate verification is mandatory or
2897 optional, set up appropriately. */
2899 if (verify_check_host(&tls_verify_hosts) == OK)
2902 debug_printf("TLS: a client certificate will be required\n");
2903 state->verify_requirement = VERIFY_REQUIRED;
2904 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2906 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2909 debug_printf("TLS: a client certificate will be requested but not required\n");
2910 state->verify_requirement = VERIFY_OPTIONAL;
2911 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2916 debug_printf("TLS: a client certificate will not be requested\n");
2917 state->verify_requirement = VERIFY_NONE;
2918 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2921 #ifndef DISABLE_EVENT
2924 state->event_action = event_action;
2925 gnutls_session_set_ptr(state->session, state);
2926 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
2930 /* Register SNI handling; always, even if not in tls_certificate, so that the
2931 expansion variable $tls_sni is always available. */
2933 gnutls_handshake_set_post_client_hello_function(state->session,
2934 exim_sni_handling_cb);
2936 /* Set context and tell client to go ahead, except in the case of TLS startup
2937 on connection, where outputting anything now upsets the clients and tends to
2938 make them disconnect. We need to have an explicit fflush() here, to force out
2939 the response. Other smtp_printf() calls do not need it, because in non-TLS
2940 mode, the fflush() happens when smtp_getc() is called. */
2942 if (!state->tlsp->on_connect)
2944 smtp_printf("220 TLS go ahead\r\n", FALSE);
2948 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2949 that the GnuTLS library doesn't.
2950 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2951 to set (and clear down afterwards) up a pull-timeout callback function that does
2952 a select, so we're no better off unless avoiding signals becomes an issue. */
2954 gnutls_transport_set_ptr2(state->session,
2955 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2956 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
2957 state->fd_in = fileno(smtp_in);
2958 state->fd_out = fileno(smtp_out);
2960 sigalrm_seen = FALSE;
2961 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2963 rc = gnutls_handshake(state->session);
2964 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2967 if (rc != GNUTLS_E_SUCCESS)
2969 /* It seems that, except in the case of a timeout, we have to close the
2970 connection right here; otherwise if the other end is running OpenSSL it hangs
2971 until the server times out. */
2975 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
2976 gnutls_db_remove_session(state->session);
2980 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
2981 (void) gnutls_alert_send_appropriate(state->session, rc);
2982 gnutls_deinit(state->session);
2983 gnutls_certificate_free_credentials(state->lib_state.x509_cred);
2984 state->lib_state = null_tls_preload;
2986 shutdown(state->fd_out, SHUT_WR);
2987 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
2988 (void)fclose(smtp_out);
2989 (void)fclose(smtp_in);
2990 smtp_out = smtp_in = NULL;
2996 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
2997 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
2998 tls_in.ext_master_secret = TRUE;
3001 #ifdef EXIM_HAVE_TLS_RESUME
3002 tls_server_resume_posthandshake(state);
3005 DEBUG(D_tls) post_handshake_debug(state);
3007 #ifdef EXIM_HAVE_ALPN
3008 if (server_seen_alpn)
3010 /* The client offered ALPN. We were set up with a nonmandatory list;
3011 see what was negotiated. We require a match now, given that something
3013 gnutls_datum_t p = {.size = 0};
3014 int rc = gnutls_alpn_get_selected_protocol(state->session, &p);
3015 if (!rc || rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
3019 *errstr = US"ALPN rejected";
3024 debug_printf("ALPN negotiated: %.*s\n", (int)p.size, p.data);
3028 debug_printf("getting alpn protocol: %s\n", US gnutls_strerror(rc));
3033 /* Verify after the fact */
3035 if (!verify_certificate(state, errstr))
3037 if (state->verify_requirement != VERIFY_OPTIONAL)
3039 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
3043 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
3047 /* Sets various Exim expansion variables; always safe within server */
3049 extract_exim_vars_from_tls_state(state);
3051 /* TLS has been set up. Adjust the input functions to read via TLS,
3052 and initialize appropriately. */
3054 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3056 receive_getc = tls_getc;
3057 receive_getbuf = tls_getbuf;
3058 receive_get_cache = tls_get_cache;
3059 receive_ungetc = tls_ungetc;
3060 receive_feof = tls_feof;
3061 receive_ferror = tls_ferror;
3062 receive_smtp_buffered = tls_smtp_buffered;
3071 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
3072 smtp_transport_options_block * ob)
3074 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3076 state->exp_tls_verify_cert_hostnames =
3078 string_domain_utf8_to_alabel(host->certname, NULL);
3083 debug_printf("TLS: server cert verification includes hostname: \"%s\"\n",
3084 state->exp_tls_verify_cert_hostnames);
3092 /* Given our list of RRs from the TLSA lookup, build a lookup block in
3093 GnuTLS-DANE's preferred format. Hang it on the state str for later
3094 use in DANE verification.
3096 We point at the dnsa data not copy it, so it must remain valid until
3097 after verification is done.*/
3100 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
3104 const char ** dane_data;
3105 int * dane_data_len;
3108 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3109 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3110 ) if (rr->type == T_TLSA) i++;
3112 dane_data = store_get(i * sizeof(uschar *), FALSE);
3113 dane_data_len = store_get(i * sizeof(int), FALSE);
3116 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3117 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3118 ) if (rr->type == T_TLSA && rr->size > 3)
3120 const uschar * p = rr->data;
3121 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
3122 uint8_t usage = p[0], sel = p[1], type = p[2];
3125 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
3127 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
3128 || (sel != 0 && sel != 1)
3133 case 0: /* Full: cannot check at present */
3135 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
3137 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
3142 tls_out.tlsa_usage |= 1<<usage;
3143 dane_data[i] = CS p;
3144 dane_data_len[i++] = rr->size;
3147 if (!i) return FALSE;
3149 dane_data[i] = NULL;
3150 dane_data_len[i] = 0;
3152 state->dane_data = (char * const *)dane_data;
3153 state->dane_data_len = dane_data_len;
3160 #ifdef EXIM_HAVE_TLS_RESUME
3161 /* On the client, get any stashed session for the given IP from hints db
3162 and apply it to the ssl-connection for attempted resumption. Although
3163 there is a gnutls_session_ticket_enable_client() interface it is
3164 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
3165 by deafult". There seems to be no way to disable them, so even hosts not
3166 enabled by the transport option will be sent a ticket request. We will
3167 however avoid storing and retrieving session information. */
3170 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
3171 host_item * host, smtp_transport_options_block * ob)
3173 tlsp->resumption = RESUME_SUPPORTED;
3174 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3176 dbdata_tls_session * dt;
3178 open_db dbblock, * dbm_file;
3181 debug_printf("check for resumable session for %s\n", host->address);
3182 tlsp->host_resumable = TRUE;
3183 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3184 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
3186 /* Key for the db is the IP. We'd like to filter the retrieved session
3187 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
3189 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
3190 if (!(rc = gnutls_session_set_data(session,
3191 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
3193 DEBUG(D_tls) debug_printf("good session\n");
3194 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3196 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
3197 US gnutls_strerror(rc));
3198 dbfn_close(dbm_file);
3205 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
3207 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
3208 but this flag is not set until the second. TLS 1.3 it's the other way about.
3209 Keep both calls as the session data cannot be extracted before handshake
3212 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
3217 DEBUG(D_tls) debug_printf("server offered session ticket\n");
3218 tlsp->ticket_received = TRUE;
3219 tlsp->resumption |= RESUME_SERVER_TICKET;
3221 if (tlsp->host_resumable)
3222 if (!(rc = gnutls_session_get_data2(session, &tkt)))
3224 open_db dbblock, * dbm_file;
3225 int dlen = sizeof(dbdata_tls_session) + tkt.size;
3226 dbdata_tls_session * dt = store_get(dlen, TRUE);
3228 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
3229 memcpy(dt->session, tkt.data, tkt.size);
3230 gnutls_free(tkt.data);
3232 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3234 /* key for the db is the IP */
3235 dbfn_delete(dbm_file, host->address);
3236 dbfn_write(dbm_file, host->address, dt, dlen);
3237 dbfn_close(dbm_file);
3240 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
3244 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
3249 /* With a TLS1.3 session, the ticket(s) are not seen until
3250 the first data read is attempted. And there's often two of them.
3251 Pick them up with this callback. We are also called for 1.2
3255 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
3256 unsigned incoming, const gnutls_datum_t * msg)
3258 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
3259 tls_support * tlsp = state->tlsp;
3261 DEBUG(D_tls) debug_printf("newticket cb\n");
3263 if (!tlsp->ticket_received)
3264 tls_save_session(tlsp, sess, state->host);
3270 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
3271 tls_support * tlsp, host_item * host,
3272 smtp_transport_options_block * ob)
3274 gnutls_session_set_ptr(state->session, state);
3275 gnutls_handshake_set_hook_function(state->session,
3276 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
3278 tls_retrieve_session(tlsp, state->session, host, ob);
3282 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
3283 tls_support * tlsp, host_item * host)
3285 if (gnutls_session_is_resumed(state->session))
3287 DEBUG(D_tls) debug_printf("Session resumed\n");
3288 tlsp->resumption |= RESUME_USED;
3291 tls_save_session(tlsp, state->session, host);
3293 #endif /* !DISABLE_TLS_RESUME */
3296 /*************************************************
3297 * Start a TLS session in a client *
3298 *************************************************/
3300 /* Called from the smtp transport after STARTTLS has been accepted.
3303 cctx connection context
3304 conn_args connection details
3305 cookie datum for randomness (not used)
3306 tlsp record details of channel configuration here; must be non-NULL
3307 errstr error string pointer
3309 Returns: TRUE for success with TLS session context set in smtp context,
3314 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3315 void * cookie ARG_UNUSED,
3316 tls_support * tlsp, uschar ** errstr)
3318 host_item * host = conn_args->host; /* for msgs and option-tests */
3319 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3320 smtp_transport_options_block * ob = tb
3321 ? (smtp_transport_options_block *)tb->options_block
3322 : &smtp_transport_option_defaults;
3324 exim_gnutls_state_st * state = NULL;
3325 uschar * cipher_list = NULL;
3327 #ifndef DISABLE_OCSP
3329 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3330 BOOL request_ocsp = require_ocsp ? TRUE
3331 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3334 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
3337 /* If dane is flagged, have either request or require dane for this host, and
3338 a TLSA record found. Therefore, dane verify required. Which implies cert must
3339 be requested and supplied, dane verify must pass, and cert verify irrelevant
3340 (incl. hostnames), and (caller handled) require_tls and sni=$domain */
3342 if (conn_args->dane && ob->dane_require_tls_ciphers)
3344 /* not using Expand_check_tlsvar because not yet in state */
3345 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3346 &cipher_list, errstr))
3348 cipher_list = cipher_list && *cipher_list
3349 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
3354 cipher_list = ob->tls_require_ciphers;
3357 #ifdef MEASURE_TIMING
3359 gettimeofday(&t0, NULL);
3362 if (tls_init(host, ob, cipher_list, &state, tlsp, errstr) != OK)
3365 #ifdef MEASURE_TIMING
3366 report_time_since(&t0, US"client tls_init (delta)");
3371 int dh_min_bits = ob->tls_dh_min_bits;
3372 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
3375 debug_printf("WARNING: tls_dh_min_bits far too low,"
3376 " clamping %d up to %d\n",
3377 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
3378 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
3381 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
3382 " acceptable bits to %d\n",
3384 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
3387 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
3388 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
3389 the specified host patterns if one of them is defined */
3392 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
3395 debug_printf("TLS: server certificate DANE required\n");
3396 state->verify_requirement = VERIFY_DANE;
3397 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3401 if ( ( state->exp_tls_verify_certificates
3402 && !ob->tls_verify_hosts
3403 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
3405 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3408 tls_client_setup_hostname_checks(host, state, ob);
3410 debug_printf("TLS: server certificate verification required\n");
3411 state->verify_requirement = VERIFY_REQUIRED;
3412 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3414 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3416 tls_client_setup_hostname_checks(host, state, ob);
3418 debug_printf("TLS: server certificate verification optional\n");
3419 state->verify_requirement = VERIFY_OPTIONAL;
3420 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
3425 debug_printf("TLS: server certificate verification not required\n");
3426 state->verify_requirement = VERIFY_NONE;
3427 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3430 #ifndef DISABLE_OCSP
3431 /* supported since GnuTLS 3.1.3 */
3434 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
3435 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
3436 NULL, 0, NULL)) != OK)
3438 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
3441 tlsp->ocsp = OCSP_NOT_RESP;
3445 #ifdef EXIM_HAVE_TLS_RESUME
3446 tls_client_resume_prehandshake(state, tlsp, host, ob);
3449 #ifndef DISABLE_EVENT
3450 if (tb && tb->event_action)
3452 state->event_action = tb->event_action;
3453 gnutls_session_set_ptr(state->session, state);
3454 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3458 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
3459 state->fd_in = cctx->sock;
3460 state->fd_out = cctx->sock;
3462 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
3463 /* There doesn't seem to be a built-in timeout on connection. */
3465 sigalrm_seen = FALSE;
3466 ALARM(ob->command_timeout);
3468 rc = gnutls_handshake(state->session);
3469 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3472 if (rc != GNUTLS_E_SUCCESS)
3476 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
3477 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
3480 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
3484 DEBUG(D_tls) post_handshake_debug(state);
3488 if (!verify_certificate(state, errstr))
3490 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
3494 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3495 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3496 tlsp->ext_master_secret = TRUE;
3499 #ifndef DISABLE_OCSP
3504 gnutls_datum_t stapling;
3505 gnutls_ocsp_resp_t resp;
3506 gnutls_datum_t printed;
3510 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
3511 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
3513 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
3516 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
3517 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
3518 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
3521 debug_printf("%.4096s", printed.data);
3522 gnutls_free(printed.data);
3525 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3527 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3530 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3532 tlsp->ocsp = OCSP_FAILED;
3533 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3539 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3540 tlsp->ocsp = OCSP_VFIED;
3545 #ifdef EXIM_HAVE_TLS_RESUME
3546 tls_client_resume_posthandshake(state, tlsp, host);
3549 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3551 extract_exim_vars_from_tls_state(state);
3553 cctx->tls_ctx = state;
3562 ct_ctx client TLS context pointer, or NULL for the one global server context
3566 tls_shutdown_wr(void * ct_ctx)
3568 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3569 tls_support * tlsp = state->tlsp;
3571 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3573 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3575 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
3576 gnutls_bye(state->session, GNUTLS_SHUT_WR);
3579 /*************************************************
3580 * Close down a TLS session *
3581 *************************************************/
3583 /* This is also called from within a delivery subprocess forked from the
3584 daemon, to shut down the TLS library, without actually doing a shutdown (which
3585 would tamper with the TLS session in the parent process).
3588 ct_ctx client context pointer, or NULL for the one global server context
3589 do_shutdown 0 no data-flush or TLS close-alert
3590 1 if TLS close-alert is to be sent,
3591 2 if also response to be waited for (2s timeout)
3597 tls_close(void * ct_ctx, int do_shutdown)
3599 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3600 tls_support * tlsp = state->tlsp;
3602 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3606 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3607 do_shutdown > 1 ? " (with response-wait)" : "");
3609 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3612 gnutls_bye(state->session, do_shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3616 if (!ct_ctx) /* server */
3618 receive_getc = smtp_getc;
3619 receive_getbuf = smtp_getbuf;
3620 receive_get_cache = smtp_get_cache;
3621 receive_ungetc = smtp_ungetc;
3622 receive_feof = smtp_feof;
3623 receive_ferror = smtp_ferror;
3624 receive_smtp_buffered = smtp_buffered;
3627 gnutls_deinit(state->session);
3628 gnutls_certificate_free_credentials(state->lib_state.x509_cred);
3629 state->lib_state = null_tls_preload;
3631 tlsp->active.sock = -1;
3632 tlsp->active.tls_ctx = NULL;
3633 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3634 tlsp->channelbinding = NULL;
3637 if (state->xfer_buffer) store_free(state->xfer_buffer);
3644 tls_refill(unsigned lim)
3646 exim_gnutls_state_st * state = &state_server;
3649 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, buffersize=%u)\n",
3650 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3652 sigalrm_seen = FALSE;
3653 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3657 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3658 MIN(ssl_xfer_buffer_size, lim));
3659 while (inbytes == GNUTLS_E_AGAIN);
3661 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3663 if (had_command_timeout) /* set by signal handler */
3664 smtp_command_timeout_exit(); /* does not return */
3665 if (had_command_sigterm)
3666 smtp_command_sigterm_exit();
3667 if (had_data_timeout)
3668 smtp_data_timeout_exit();
3669 if (had_data_sigint)
3670 smtp_data_sigint_exit();
3672 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3673 TLS session has been closed down, not that the socket itself has been closed
3674 down. Revert to non-TLS handling. */
3678 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3679 state->xfer_error = TRUE;
3683 else if (inbytes == 0)
3685 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3686 tls_close(NULL, TLS_NO_SHUTDOWN);
3690 /* Handle genuine errors */
3692 else if (inbytes < 0)
3694 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3695 record_io_error(state, (int) inbytes, US"recv", NULL);
3696 state->xfer_error = TRUE;
3699 #ifndef DISABLE_DKIM
3700 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3702 state->xfer_buffer_hwm = (int) inbytes;
3703 state->xfer_buffer_lwm = 0;
3707 /*************************************************
3708 * TLS version of getc *
3709 *************************************************/
3711 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3712 it refills the buffer via the GnuTLS reading function.
3713 Only used by the server-side TLS.
3715 This feeds DKIM and should be used for all message-body reads.
3717 Arguments: lim Maximum amount to read/buffer
3718 Returns: the next character or EOF
3722 tls_getc(unsigned lim)
3724 exim_gnutls_state_st * state = &state_server;
3726 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3727 if (!tls_refill(lim))
3728 return state->xfer_error ? EOF : smtp_getc(lim);
3730 /* Something in the buffer; return next uschar */
3732 return state->xfer_buffer[state->xfer_buffer_lwm++];
3736 tls_getbuf(unsigned * len)
3738 exim_gnutls_state_st * state = &state_server;
3742 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3743 if (!tls_refill(*len))
3745 if (!state->xfer_error) return smtp_getbuf(len);
3750 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3752 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3753 state->xfer_buffer_lwm += size;
3762 #ifndef DISABLE_DKIM
3763 exim_gnutls_state_st * state = &state_server;
3764 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3766 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3772 tls_could_read(void)
3774 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3775 || gnutls_record_check_pending(state_server.session) > 0;
3779 /*************************************************
3780 * Read bytes from TLS channel *
3781 *************************************************/
3783 /* This does not feed DKIM, so if the caller uses this for reading message body,
3784 then the caller must feed DKIM.
3787 ct_ctx client context pointer, or NULL for the one global server context
3791 Returns: the number of bytes read
3792 -1 after a failed read, including EOF
3796 tls_read(void * ct_ctx, uschar *buff, size_t len)
3798 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3804 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3806 debug_printf("*** PROBABLY A BUG *** " \
3807 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3808 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3811 debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, len=" SIZE_T_FMT ")\n",
3812 state->session, buff, len);
3816 inbytes = gnutls_record_recv(state->session, buff, len);
3817 while (inbytes == GNUTLS_E_AGAIN);
3819 if (inbytes > 0) return inbytes;
3822 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3826 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3827 record_io_error(state, (int)inbytes, US"recv", NULL);
3836 /*************************************************
3837 * Write bytes down TLS channel *
3838 *************************************************/
3842 ct_ctx client context pointer, or NULL for the one global server context
3845 more more data expected soon
3847 Calling with len zero and more unset will flush buffered writes. The buff
3848 argument can be null for that case.
3850 Returns: the number of bytes after a successful write,
3851 -1 after a failed write
3855 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
3859 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3862 if (more && !state->corked)
3864 DEBUG(D_tls) debug_printf("gnutls_record_cork(session=%p)\n", state->session);
3865 gnutls_record_cork(state->session);
3866 state->corked = TRUE;
3870 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
3871 buff, left, more ? ", more" : "");
3875 DEBUG(D_tls) debug_printf("gnutls_record_send(session=%p, buffer=%p, left=" SIZE_T_FMT ")\n",
3876 state->session, buff, left);
3880 outbytes = gnutls_record_send(state->session, buff, left);
3881 while (outbytes == GNUTLS_E_AGAIN);
3883 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
3887 #ifdef GNUTLS_E_PREMATURE_TERMINATION
3888 if ( outbytes == GNUTLS_E_PREMATURE_TERMINATION && errno == ECONNRESET
3889 && !ct_ctx && f.smtp_in_quit
3891 { /* Outlook, dammit */
3892 if (LOGGING(protocol_detail))
3893 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
3894 " SMTP response and TLS close\n", sender_host_address);
3896 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
3897 " client reset TCP before TLS close\n", sender_host_address);
3902 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
3903 record_io_error(state, outbytes, US"send", NULL);
3909 record_io_error(state, 0, US"send", US"TLS channel closed on write");
3920 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
3926 if (!more && state->corked)
3928 DEBUG(D_tls) debug_printf("gnutls_record_uncork(session=%p)\n", state->session);
3930 /* We can't use GNUTLS_RECORD_WAIT here, as it retries on
3931 GNUTLS_E_AGAIN || GNUTLS_E_INTR, which would break our timeout set by alarm().
3932 The GNUTLS_E_AGAIN should not happen ever, as our sockets are blocking anyway.
3933 But who knows. (That all relies on the fact that GNUTLS_E_INTR and GNUTLS_E_AGAIN
3934 match the EINTR and EAGAIN errno values.) */
3935 outbytes = gnutls_record_uncork(state->session, 0);
3936 while (outbytes == GNUTLS_E_AGAIN);
3940 record_io_error(state, len, US"uncork", NULL);
3944 state->corked = FALSE;
3954 /*************************************************
3955 * Random number generation *
3956 *************************************************/
3958 /* Pseudo-random number generation. The result is not expected to be
3959 cryptographically strong but not so weak that someone will shoot themselves
3960 in the foot using it as a nonce in input in some email header scheme or
3961 whatever weirdness they'll twist this into. The result should handle fork()
3962 and avoid repeating sequences. OpenSSL handles that for us.
3966 Returns a random number in range [0, max-1]
3969 #ifdef HAVE_GNUTLS_RND
3971 vaguely_random_number(int max)
3975 uschar smallbuf[sizeof(r)];
3980 needed_len = sizeof(r);
3981 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
3982 asked for a number less than 10. */
3984 for (r = max, i = 0; r; ++i)
3990 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
3993 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback\n");
3994 return vaguely_random_number_fallback(max);
3997 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4000 /* We don't particularly care about weighted results; if someone wants
4001 * smooth distribution and cares enough then they should submit a patch then. */
4004 #else /* HAVE_GNUTLS_RND */
4006 vaguely_random_number(int max)
4008 return vaguely_random_number_fallback(max);
4010 #endif /* HAVE_GNUTLS_RND */
4015 /*************************************************
4016 * Let tls_require_ciphers be checked at startup *
4017 *************************************************/
4019 /* The tls_require_ciphers option, if set, must be something which the
4022 Returns: NULL on success, or error message
4026 tls_validate_require_cipher(void)
4029 uschar *expciphers = NULL;
4030 gnutls_priority_t priority_cache;
4032 uschar * dummy_errstr;
4034 #ifdef GNUTLS_AUTO_GLOBAL_INIT
4035 # define validate_check_rc(Label) do { \
4036 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \
4037 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4038 # define return_deinit(Label) do { return (Label); } while (0)
4040 # define validate_check_rc(Label) do { \
4041 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
4042 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4043 # define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
4046 if (exim_gnutls_base_init_done)
4047 log_write(0, LOG_MAIN|LOG_PANIC,
4048 "already initialised GnuTLS, Exim developer bug");
4050 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
4051 if (!gnutls_allow_auto_pkcs11)
4053 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
4054 validate_check_rc(US"gnutls_pkcs11_init");
4057 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4058 rc = gnutls_global_init();
4059 validate_check_rc(US"gnutls_global_init()");
4061 exim_gnutls_base_init_done = TRUE;
4063 if (!(tls_require_ciphers && *tls_require_ciphers))
4064 return_deinit(NULL);
4066 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4068 return_deinit(US"failed to expand tls_require_ciphers");
4070 if (!(expciphers && *expciphers))
4071 return_deinit(NULL);
4074 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4076 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
4077 validate_check_rc(string_sprintf(
4078 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
4079 expciphers, errpos - CS expciphers, errpos));
4081 #undef return_deinit
4082 #undef validate_check_rc
4083 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4084 gnutls_global_deinit();
4093 /*************************************************
4094 * Report the library versions. *
4095 *************************************************/
4097 /* See a description in tls-openssl.c for an explanation of why this exists.
4099 Arguments: a FILE* to print the results to
4104 tls_version_report(FILE *f)
4106 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
4109 gnutls_check_version(NULL));
4112 #endif /*!MACRO_PREDEF*/
4115 /* End of tls-gnu.c */