1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2014 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42 /* needed to disable PKCS11 autoload unless requested */
43 #if GNUTLS_VERSION_NUMBER >= 0x020c00
44 # include <gnutls/pkcs11.h>
46 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
47 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50 #if GNUTLS_VERSION_NUMBER < 0x020a00 && defined(EXPERIMENTAL_TPDA)
51 # warning "GnuTLS library version too old; TPDA tls:cert event unsupported"
52 # undef EXPERIMENTAL_TPDA
56 # include <gnutls/ocsp.h>
62 gnutls_global_set_audit_log_function()
65 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
68 /* Local static variables for GnuTLS */
70 /* Values for verify_requirement */
72 enum peer_verify_requirement
73 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED
74 #ifdef EXPERIMENTAL_CERTNAMES
79 /* This holds most state for server or client; with this, we can set up an
80 outbound TLS-enabled connection in an ACL callout, while not stomping all
81 over the TLS variables available for expansion.
83 Some of these correspond to variables in globals.c; those variables will
84 be set to point to content in one of these instances, as appropriate for
85 the stage of the process lifetime.
87 Not handled here: global tls_channelbinding_b64.
90 typedef struct exim_gnutls_state {
91 gnutls_session_t session;
92 gnutls_certificate_credentials_t x509_cred;
93 gnutls_priority_t priority_cache;
94 enum peer_verify_requirement verify_requirement;
97 BOOL peer_cert_verified;
98 BOOL trigger_sni_changes;
100 const struct host_item *host;
101 gnutls_x509_crt_t peercert;
104 uschar *received_sni;
106 const uschar *tls_certificate;
107 const uschar *tls_privatekey;
108 const uschar *tls_sni; /* client send only, not received */
109 const uschar *tls_verify_certificates;
110 const uschar *tls_crl;
111 const uschar *tls_require_ciphers;
113 uschar *exp_tls_certificate;
114 uschar *exp_tls_privatekey;
115 uschar *exp_tls_verify_certificates;
117 uschar *exp_tls_require_ciphers;
118 uschar *exp_tls_ocsp_file;
119 #ifdef EXPERIMENTAL_CERTNAMES
120 uschar *exp_tls_verify_cert_hostnames;
122 #ifdef EXPERIMENTAL_TPDA
123 uschar *event_action;
126 tls_support *tlsp; /* set in tls_init() */
133 } exim_gnutls_state_st;
135 static const exim_gnutls_state_st exim_gnutls_state_init = {
136 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
137 NULL, NULL, NULL, NULL,
138 NULL, NULL, NULL, NULL, NULL, NULL,
139 NULL, NULL, NULL, NULL, NULL, NULL, NULL,
140 #ifdef EXPERIMENTAL_CERTNAMES
143 #ifdef EXPERIMENTAL_TPDA
150 /* Not only do we have our own APIs which don't pass around state, assuming
151 it's held in globals, GnuTLS doesn't appear to let us register callback data
152 for callbacks, or as part of the session, so we have to keep a "this is the
153 context we're currently dealing with" pointer and rely upon being
154 single-threaded to keep from processing data on an inbound TLS connection while
155 talking to another TLS connection for an outbound check. This does mean that
156 there's no way for heart-beats to be responded to, for the duration of the
158 XXX But see gnutls_session_get_ptr()
161 static exim_gnutls_state_st state_server, state_client;
163 /* dh_params are initialised once within the lifetime of a process using TLS;
164 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
165 don't want to repeat this. */
167 static gnutls_dh_params_t dh_server_params = NULL;
169 /* No idea how this value was chosen; preserving it. Default is 3600. */
171 static const int ssl_session_timeout = 200;
173 static const char * const exim_default_gnutls_priority = "NORMAL";
175 /* Guard library core initialisation */
177 static BOOL exim_gnutls_base_init_done = FALSE;
180 /* ------------------------------------------------------------------------ */
183 #define MAX_HOST_LEN 255
185 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
186 the library logging; a value less than 0 disables the calls to set up logging
188 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
189 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
192 #ifndef EXIM_CLIENT_DH_MIN_BITS
193 # define EXIM_CLIENT_DH_MIN_BITS 1024
196 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
197 can ask for a bit-strength. Without that, we stick to the constant we had
199 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
200 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
203 #define exim_gnutls_err_check(Label) do { \
204 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
206 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
208 #if GNUTLS_VERSION_NUMBER >= 0x020c00
209 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
210 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
211 # define HAVE_GNUTLS_RND
212 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
213 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
214 * isn't available sometimes, so this needs to become a conditional
215 * compilation; the sanest way to deal with this being a problem on
216 * older OSes is to block it in the Local/Makefile with this compiler
218 # ifndef AVOID_GNUTLS_PKCS11
219 # define HAVE_GNUTLS_PKCS11
220 # endif /* AVOID_GNUTLS_PKCS11 */
226 /* ------------------------------------------------------------------------ */
227 /* Callback declarations */
229 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
230 static void exim_gnutls_logger_cb(int level, const char *message);
233 static int exim_sni_handling_cb(gnutls_session_t session);
236 static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
237 gnutls_datum_t * ocsp_response);
242 /* ------------------------------------------------------------------------ */
243 /* Static functions */
245 /*************************************************
247 *************************************************/
249 /* Called from lots of places when errors occur before actually starting to do
250 the TLS handshake, that is, while the session is still in clear. Always returns
251 DEFER for a server and FAIL for a client so that most calls can use "return
252 tls_error(...)" to do this processing and then give an appropriate return. A
253 single function is used for both server and client, because it is called from
254 some shared functions.
257 prefix text to include in the logged error
258 msg additional error string (may be NULL)
259 usually obtained from gnutls_strerror()
260 host NULL if setting up a server;
261 the connected host if setting up a client
263 Returns: OK/DEFER/FAIL
267 tls_error(const uschar *prefix, const char *msg, const host_item *host)
271 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
272 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
277 uschar *conn_info = smtp_get_connection_info();
278 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
280 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
281 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
289 /*************************************************
290 * Deal with logging errors during I/O *
291 *************************************************/
293 /* We have to get the identity of the peer from saved data.
296 state the current GnuTLS exim state container
297 rc the GnuTLS error code, or 0 if it's a local error
298 when text identifying read or write
299 text local error text when ec is 0
305 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
309 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
310 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
311 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
313 msg = gnutls_strerror(rc);
315 tls_error(when, msg, state->host);
321 /*************************************************
322 * Set various Exim expansion vars *
323 *************************************************/
325 #define exim_gnutls_cert_err(Label) \
328 if (rc != GNUTLS_E_SUCCESS) \
330 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
331 (Label), gnutls_strerror(rc)); \
337 import_cert(const gnutls_datum * cert, gnutls_x509_crt_t * crtp)
341 rc = gnutls_x509_crt_init(crtp);
342 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
344 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
345 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
350 #undef exim_gnutls_cert_err
353 /* We set various Exim global variables from the state, once a session has
354 been established. With TLS callouts, may need to change this to stack
355 variables, or just re-call it with the server state after client callout
358 Make sure anything set here is unset in tls_getc().
362 tls_bits strength indicator
363 tls_certificate_verified bool indicator
364 tls_channelbinding_b64 for some SASL mechanisms
366 tls_peercert pointer to library internal
368 tls_sni a (UTF-8) string
369 tls_ourcert pointer to library internal
372 state the relevant exim_gnutls_state_st *
376 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
378 gnutls_cipher_algorithm_t cipher;
379 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
382 gnutls_datum_t channel;
384 tls_support * tlsp = state->tlsp;
386 tlsp->active = state->fd_out;
388 cipher = gnutls_cipher_get(state->session);
389 /* returns size in "bytes" */
390 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
392 tlsp->cipher = state->ciphersuite;
394 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
396 tlsp->certificate_verified = state->peer_cert_verified;
398 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
399 only available for use for authenticators while this TLS session is running. */
401 tls_channelbinding_b64 = NULL;
402 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
405 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
407 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
409 old_pool = store_pool;
410 store_pool = POOL_PERM;
411 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
412 store_pool = old_pool;
413 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
417 /* peercert is set in peer_status() */
418 tlsp->peerdn = state->peerdn;
419 tlsp->sni = state->received_sni;
421 /* record our certificate */
423 const gnutls_datum * cert = gnutls_certificate_get_ours(state->session);
424 gnutls_x509_crt_t crt;
426 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
433 /*************************************************
434 * Setup up DH parameters *
435 *************************************************/
437 /* Generating the D-H parameters may take a long time. They only need to
438 be re-generated every so often, depending on security policy. What we do is to
439 keep these parameters in a file in the spool directory. If the file does not
440 exist, we generate them. This means that it is easy to cause a regeneration.
442 The new file is written as a temporary file and renamed, so that an incomplete
443 file is never present. If two processes both compute some new parameters, you
444 waste a bit of effort, but it doesn't seem worth messing around with locking to
447 Returns: OK/DEFER/FAIL
454 unsigned int dh_bits;
456 uschar filename_buf[PATH_MAX];
457 uschar *filename = NULL;
459 uschar *exp_tls_dhparam;
460 BOOL use_file_in_spool = FALSE;
461 BOOL use_fixed_file = FALSE;
462 host_item *host = NULL; /* dummy for macros */
464 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
466 rc = gnutls_dh_params_init(&dh_server_params);
467 exim_gnutls_err_check(US"gnutls_dh_params_init");
472 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
475 if (!exp_tls_dhparam)
477 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
478 m.data = US std_dh_prime_default();
479 m.size = Ustrlen(m.data);
481 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
482 use_file_in_spool = TRUE;
483 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
485 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
488 else if (exp_tls_dhparam[0] != '/')
490 m.data = US std_dh_prime_named(exp_tls_dhparam);
492 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
493 m.size = Ustrlen(m.data);
497 use_fixed_file = TRUE;
498 filename = exp_tls_dhparam;
503 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
504 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
505 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
509 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
510 /* If you change this constant, also change dh_param_fn_ext so that we can use a
511 different filename and ensure we have sufficient bits. */
512 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
514 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
516 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
519 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
521 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
525 /* Some clients have hard-coded limits. */
526 if (dh_bits > tls_dh_max_bits)
529 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
531 dh_bits = tls_dh_max_bits;
534 if (use_file_in_spool)
536 if (!string_format(filename_buf, sizeof(filename_buf),
537 "%s/gnutls-params-%d", spool_directory, dh_bits))
538 return tls_error(US"overlong filename", NULL, NULL);
539 filename = filename_buf;
542 /* Open the cache file for reading and if successful, read it and set up the
545 fd = Uopen(filename, O_RDONLY, 0);
552 if (fstat(fd, &statbuf) < 0) /* EIO */
556 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
558 if (!S_ISREG(statbuf.st_mode))
561 return tls_error(US"TLS cache not a file", NULL, NULL);
563 fp = fdopen(fd, "rb");
568 return tls_error(US"fdopen(TLS cache stat fd) failed",
569 strerror(saved_errno), NULL);
572 m.size = statbuf.st_size;
573 m.data = malloc(m.size);
577 return tls_error(US"malloc failed", strerror(errno), NULL);
579 sz = fread(m.data, m.size, 1, fp);
585 return tls_error(US"fread failed", strerror(saved_errno), NULL);
589 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
591 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
592 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
595 /* If the file does not exist, fall through to compute new data and cache it.
596 If there was any other opening error, it is serious. */
598 else if (errno == ENOENT)
602 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
605 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
608 /* If ret < 0, either the cache file does not exist, or the data it contains
609 is not useful. One particular case of this is when upgrading from an older
610 release of Exim in which the data was stored in a different format. We don't
611 try to be clever and support both formats; we just regenerate new data in this
617 unsigned int dh_bits_gen = dh_bits;
619 if ((PATH_MAX - Ustrlen(filename)) < 10)
620 return tls_error(US"Filename too long to generate replacement",
623 temp_fn = string_copy(US "%s.XXXXXXX");
624 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
626 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
627 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
629 /* GnuTLS overshoots!
630 * If we ask for 2236, we might get 2237 or more.
631 * But there's no way to ask GnuTLS how many bits there really are.
632 * We can ask how many bits were used in a TLS session, but that's it!
633 * The prime itself is hidden behind too much abstraction.
634 * So we ask for less, and proceed on a wing and a prayer.
635 * First attempt, subtracted 3 for 2233 and got 2240.
637 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
639 dh_bits_gen = dh_bits - 10;
641 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
646 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
648 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
649 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
651 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
652 and I confirmed that a NULL call to get the size first is how the GnuTLS
653 sample apps handle this. */
657 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
659 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
660 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
662 m.data = malloc(m.size);
664 return tls_error(US"memory allocation failed", strerror(errno), NULL);
665 /* this will return a size 1 less than the allocation size above */
666 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
668 if (rc != GNUTLS_E_SUCCESS)
671 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
673 m.size = sz; /* shrink by 1, probably */
675 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
679 return tls_error(US"TLS cache write D-H params failed",
680 strerror(errno), NULL);
683 sz = write_to_fd_buf(fd, US"\n", 1);
685 return tls_error(US"TLS cache write D-H params final newline failed",
686 strerror(errno), NULL);
690 return tls_error(US"TLS cache write close() failed",
691 strerror(errno), NULL);
693 if (Urename(temp_fn, filename) < 0)
694 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
695 temp_fn, filename), strerror(errno), NULL);
697 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
700 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
707 /*************************************************
708 * Variables re-expanded post-SNI *
709 *************************************************/
711 /* Called from both server and client code, via tls_init(), and also from
712 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
714 We can tell the two apart by state->received_sni being non-NULL in callback.
716 The callback should not call us unless state->trigger_sni_changes is true,
717 which we are responsible for setting on the first pass through.
720 state exim_gnutls_state_st *
722 Returns: OK/DEFER/FAIL
726 tls_expand_session_files(exim_gnutls_state_st *state)
730 const host_item *host = state->host; /* macro should be reconsidered? */
731 uschar *saved_tls_certificate = NULL;
732 uschar *saved_tls_privatekey = NULL;
733 uschar *saved_tls_verify_certificates = NULL;
734 uschar *saved_tls_crl = NULL;
737 /* We check for tls_sni *before* expansion. */
738 if (!host) /* server */
740 if (!state->received_sni)
742 if (state->tls_certificate &&
743 (Ustrstr(state->tls_certificate, US"tls_sni") ||
744 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
745 Ustrstr(state->tls_certificate, US"tls_out_sni")
748 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
749 state->trigger_sni_changes = TRUE;
754 /* useful for debugging */
755 saved_tls_certificate = state->exp_tls_certificate;
756 saved_tls_privatekey = state->exp_tls_privatekey;
757 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
758 saved_tls_crl = state->exp_tls_crl;
762 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
763 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
765 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
766 state members, assuming consistent naming; and expand_check() returns
767 false if expansion failed, unless expansion was forced to fail. */
769 /* check if we at least have a certificate, before doing expensive
772 if (!expand_check_tlsvar(tls_certificate))
775 /* certificate is mandatory in server, optional in client */
777 if ((state->exp_tls_certificate == NULL) ||
778 (*state->exp_tls_certificate == '\0'))
781 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
783 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
786 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
789 /* tls_privatekey is optional, defaulting to same file as certificate */
791 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
793 state->tls_privatekey = state->tls_certificate;
794 state->exp_tls_privatekey = state->exp_tls_certificate;
798 if (state->exp_tls_certificate && *state->exp_tls_certificate)
800 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
801 state->exp_tls_certificate, state->exp_tls_privatekey);
803 if (state->received_sni)
805 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
806 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
808 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
812 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
816 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
817 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
818 GNUTLS_X509_FMT_PEM);
819 exim_gnutls_err_check(
820 string_sprintf("cert/key setup: cert=%s key=%s",
821 state->exp_tls_certificate, state->exp_tls_privatekey));
822 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
823 } /* tls_certificate */
826 /* Set the OCSP stapling server info */
829 if ( !host /* server */
833 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file",
834 &state->exp_tls_ocsp_file))
837 /* Use the full callback method for stapling just to get observability.
838 More efficient would be to read the file once only, if it never changed
839 (due to SNI). Would need restart on file update, or watch datestamp. */
841 gnutls_certificate_set_ocsp_status_request_function(state->x509_cred,
842 server_ocsp_stapling_cb, state->exp_tls_ocsp_file);
844 DEBUG(D_tls) debug_printf("Set OCSP response file %s\n", &state->exp_tls_ocsp_file);
849 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
850 provided. Experiment shows that, if the certificate file is empty, an unhelpful
851 error message is provided. However, if we just refrain from setting anything up
852 in that case, certificate verification fails, which seems to be the correct
855 if (state->tls_verify_certificates && *state->tls_verify_certificates)
857 if (!expand_check_tlsvar(tls_verify_certificates))
859 if (state->tls_crl && *state->tls_crl)
860 if (!expand_check_tlsvar(tls_crl))
863 if (!(state->exp_tls_verify_certificates &&
864 *state->exp_tls_verify_certificates))
867 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
868 /* With no tls_verify_certificates, we ignore tls_crl too */
875 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
879 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
881 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
882 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
887 /* The test suite passes in /dev/null; we could check for that path explicitly,
888 but who knows if someone has some weird FIFO which always dumps some certs, or
889 other weirdness. The thing we really want to check is that it's not a
890 directory, since while OpenSSL supports that, GnuTLS does not.
891 So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
892 if (S_ISDIR(statbuf.st_mode))
895 debug_printf("verify certificates path is a dir: \"%s\"\n",
896 state->exp_tls_verify_certificates);
897 log_write(0, LOG_MAIN|LOG_PANIC,
898 "tls_verify_certificates \"%s\" is a directory",
899 state->exp_tls_verify_certificates);
903 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
904 state->exp_tls_verify_certificates, statbuf.st_size);
906 if (statbuf.st_size == 0)
909 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
913 cert_count = gnutls_certificate_set_x509_trust_file(state->x509_cred,
914 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
918 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
920 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
922 if (state->tls_crl && *state->tls_crl &&
923 state->exp_tls_crl && *state->exp_tls_crl)
925 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
926 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
927 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
931 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
933 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
942 /*************************************************
943 * Set X.509 state variables *
944 *************************************************/
946 /* In GnuTLS, the registered cert/key are not replaced by a later
947 set of a cert/key, so for SNI support we need a whole new x509_cred
948 structure. Which means various other non-re-expanded pieces of state
949 need to be re-set in the new struct, so the setting logic is pulled
953 state exim_gnutls_state_st *
955 Returns: OK/DEFER/FAIL
959 tls_set_remaining_x509(exim_gnutls_state_st *state)
962 const host_item *host = state->host; /* macro should be reconsidered? */
964 /* Create D-H parameters, or read them from the cache file. This function does
965 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
966 client-side params. */
970 if (!dh_server_params)
972 rc = init_server_dh();
973 if (rc != OK) return rc;
975 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
978 /* Link the credentials to the session. */
980 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
981 exim_gnutls_err_check(US"gnutls_credentials_set");
986 /*************************************************
987 * Initialize for GnuTLS *
988 *************************************************/
990 /* Called from both server and client code. In the case of a server, errors
991 before actual TLS negotiation return DEFER.
994 host connected host, if client; NULL if server
995 certificate certificate file
996 privatekey private key file
997 sni TLS SNI to send, sometimes when client; else NULL
1000 require_ciphers tls_require_ciphers setting
1001 caller_state returned state-info structure
1003 Returns: OK/DEFER/FAIL
1008 const host_item *host,
1009 const uschar *certificate,
1010 const uschar *privatekey,
1014 const uschar *require_ciphers,
1015 exim_gnutls_state_st **caller_state)
1017 exim_gnutls_state_st *state;
1022 BOOL want_default_priorities;
1024 if (!exim_gnutls_base_init_done)
1026 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1028 #ifdef HAVE_GNUTLS_PKCS11
1029 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1030 which loads modules from a config file, which sounds good and may be wanted
1031 by some sysadmin, but also means in common configurations that GNOME keyring
1032 environment variables are used and so breaks for users calling mailq.
1033 To prevent this, we init PKCS11 first, which is the documented approach. */
1034 if (!gnutls_allow_auto_pkcs11)
1036 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1037 exim_gnutls_err_check(US"gnutls_pkcs11_init");
1041 rc = gnutls_global_init();
1042 exim_gnutls_err_check(US"gnutls_global_init");
1044 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1047 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1048 /* arbitrarily chosen level; bump upto 9 for more */
1049 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1053 exim_gnutls_base_init_done = TRUE;
1058 state = &state_client;
1059 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1060 state->tlsp = &tls_out;
1061 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1062 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1066 state = &state_server;
1067 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1068 state->tlsp = &tls_in;
1069 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1070 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1072 exim_gnutls_err_check(US"gnutls_init");
1076 state->tls_certificate = certificate;
1077 state->tls_privatekey = privatekey;
1078 state->tls_require_ciphers = require_ciphers;
1079 state->tls_sni = sni;
1080 state->tls_verify_certificates = cas;
1081 state->tls_crl = crl;
1083 /* This handles the variables that might get re-expanded after TLS SNI;
1084 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1087 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1088 rc = tls_expand_session_files(state);
1089 if (rc != OK) return rc;
1091 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1092 requires a new structure afterwards. */
1094 rc = tls_set_remaining_x509(state);
1095 if (rc != OK) return rc;
1097 /* set SNI in client, only */
1100 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni))
1102 if (state->tlsp->sni && *state->tlsp->sni)
1105 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1106 sz = Ustrlen(state->tlsp->sni);
1107 rc = gnutls_server_name_set(state->session,
1108 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
1109 exim_gnutls_err_check(US"gnutls_server_name_set");
1112 else if (state->tls_sni)
1113 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1114 "have an SNI set for a client [%s]\n", state->tls_sni);
1116 /* This is the priority string support,
1117 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1118 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1119 This was backwards incompatible, but means Exim no longer needs to track
1120 all algorithms and provide string forms for them. */
1122 want_default_priorities = TRUE;
1124 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1126 if (!expand_check_tlsvar(tls_require_ciphers))
1128 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1130 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1131 state->exp_tls_require_ciphers);
1133 rc = gnutls_priority_init(&state->priority_cache,
1134 CS state->exp_tls_require_ciphers, &errpos);
1135 want_default_priorities = FALSE;
1136 p = state->exp_tls_require_ciphers;
1139 if (want_default_priorities)
1142 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1143 exim_default_gnutls_priority);
1144 rc = gnutls_priority_init(&state->priority_cache,
1145 exim_default_gnutls_priority, &errpos);
1146 p = US exim_default_gnutls_priority;
1149 exim_gnutls_err_check(string_sprintf(
1150 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1151 p, errpos - CS p, errpos));
1153 rc = gnutls_priority_set(state->session, state->priority_cache);
1154 exim_gnutls_err_check(US"gnutls_priority_set");
1156 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1158 /* Reduce security in favour of increased compatibility, if the admin
1159 decides to make that trade-off. */
1160 if (gnutls_compat_mode)
1162 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1163 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1164 gnutls_session_enable_compatibility_mode(state->session);
1166 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1170 *caller_state = state;
1176 /*************************************************
1177 * Extract peer information *
1178 *************************************************/
1180 /* Called from both server and client code.
1181 Only this is allowed to set state->peerdn and state->have_set_peerdn
1182 and we use that to detect double-calls.
1184 NOTE: the state blocks last while the TLS connection is up, which is fine
1185 for logging in the server side, but for the client side, we log after teardown
1186 in src/deliver.c. While the session is up, we can twist about states and
1187 repoint tls_* globals, but those variables used for logging or other variable
1188 expansion that happens _after_ delivery need to have a longer life-time.
1190 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1191 doing this more than once per generation of a state context. We set them in
1192 the state context, and repoint tls_* to them. After the state goes away, the
1193 tls_* copies of the pointers remain valid and client delivery logging is happy.
1195 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1199 state exim_gnutls_state_st *
1201 Returns: OK/DEFER/FAIL
1205 peer_status(exim_gnutls_state_st *state)
1207 uschar cipherbuf[256];
1208 const gnutls_datum *cert_list;
1210 unsigned int cert_list_size = 0;
1211 gnutls_protocol_t protocol;
1212 gnutls_cipher_algorithm_t cipher;
1213 gnutls_kx_algorithm_t kx;
1214 gnutls_mac_algorithm_t mac;
1215 gnutls_certificate_type_t ct;
1216 gnutls_x509_crt_t crt;
1220 if (state->have_set_peerdn)
1222 state->have_set_peerdn = TRUE;
1224 state->peerdn = NULL;
1227 cipher = gnutls_cipher_get(state->session);
1228 protocol = gnutls_protocol_get_version(state->session);
1229 mac = gnutls_mac_get(state->session);
1230 kx = gnutls_kx_get(state->session);
1232 string_format(cipherbuf, sizeof(cipherbuf),
1234 gnutls_protocol_get_name(protocol),
1235 gnutls_cipher_suite_get_name(kx, cipher, mac),
1236 (int) gnutls_cipher_get_key_size(cipher) * 8);
1238 /* I don't see a way that spaces could occur, in the current GnuTLS
1239 code base, but it was a concern in the old code and perhaps older GnuTLS
1240 releases did return "TLS 1.0"; play it safe, just in case. */
1241 for (p = cipherbuf; *p != '\0'; ++p)
1244 old_pool = store_pool;
1245 store_pool = POOL_PERM;
1246 state->ciphersuite = string_copy(cipherbuf);
1247 store_pool = old_pool;
1248 state->tlsp->cipher = state->ciphersuite;
1251 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1253 if (cert_list == NULL || cert_list_size == 0)
1255 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1256 cert_list, cert_list_size);
1257 if (state->verify_requirement >= VERIFY_REQUIRED)
1258 return tls_error(US"certificate verification failed",
1259 "no certificate received from peer", state->host);
1263 ct = gnutls_certificate_type_get(state->session);
1264 if (ct != GNUTLS_CRT_X509)
1266 const char *ctn = gnutls_certificate_type_get_name(ct);
1268 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1269 if (state->verify_requirement >= VERIFY_REQUIRED)
1270 return tls_error(US"certificate verification not possible, unhandled type",
1275 #define exim_gnutls_peer_err(Label) \
1277 if (rc != GNUTLS_E_SUCCESS) \
1279 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1280 (Label), gnutls_strerror(rc)); \
1281 if (state->verify_requirement >= VERIFY_REQUIRED) \
1282 return tls_error((Label), gnutls_strerror(rc), state->host); \
1287 rc = import_cert(&cert_list[0], &crt);
1288 exim_gnutls_peer_err(US"cert 0");
1290 state->tlsp->peercert = state->peercert = crt;
1293 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1294 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1296 exim_gnutls_peer_err(US"getting size for cert DN failed");
1297 return FAIL; /* should not happen */
1299 dn_buf = store_get_perm(sz);
1300 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1301 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1303 state->peerdn = dn_buf;
1306 #undef exim_gnutls_peer_err
1312 /*************************************************
1313 * Verify peer certificate *
1314 *************************************************/
1316 /* Called from both server and client code.
1317 *Should* be using a callback registered with
1318 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1319 the peer information, but that's too new for some OSes.
1322 state exim_gnutls_state_st *
1323 error where to put an error message
1326 FALSE if the session should be rejected
1327 TRUE if the cert is okay or we just don't care
1331 verify_certificate(exim_gnutls_state_st *state, const char **error)
1334 unsigned int verify;
1338 if ((rc = peer_status(state)) != OK)
1340 verify = GNUTLS_CERT_INVALID;
1341 *error = "certificate not supplied";
1344 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1346 /* Handle the result of verification. INVALID seems to be set as well
1347 as REVOKED, but leave the test for both. */
1350 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1353 state->peer_cert_verified = FALSE;
1355 *error = verify & GNUTLS_CERT_REVOKED
1356 ? "certificate revoked" : "certificate invalid";
1359 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1360 *error, state->peerdn ? state->peerdn : US"<unset>");
1362 if (state->verify_requirement >= VERIFY_REQUIRED)
1364 gnutls_alert_send(state->session,
1365 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1369 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1374 #ifdef EXPERIMENTAL_CERTNAMES
1375 if (state->verify_requirement == VERIFY_WITHHOST)
1378 uschar * list = state->exp_tls_verify_cert_hostnames;
1380 while (name = string_nextinlist(&list, &sep, NULL, 0))
1381 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1386 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1387 gnutls_alert_send(state->session,
1388 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1393 state->peer_cert_verified = TRUE;
1394 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1395 state->peerdn ? state->peerdn : US"<unset>");
1398 state->tlsp->peerdn = state->peerdn;
1406 /* ------------------------------------------------------------------------ */
1409 /* Logging function which can be registered with
1410 * gnutls_global_set_log_function()
1411 * gnutls_global_set_log_level() 0..9
1413 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1415 exim_gnutls_logger_cb(int level, const char *message)
1417 size_t len = strlen(message);
1420 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1423 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1424 message[len-1] == '\n' ? "" : "\n");
1429 /* Called after client hello, should handle SNI work.
1430 This will always set tls_sni (state->received_sni) if available,
1431 and may trigger presenting different certificates,
1432 if state->trigger_sni_changes is TRUE.
1434 Should be registered with
1435 gnutls_handshake_set_post_client_hello_function()
1437 "This callback must return 0 on success or a gnutls error code to terminate the
1440 For inability to get SNI information, we return 0.
1441 We only return non-zero if re-setup failed.
1442 Only used for server-side TLS.
1446 exim_sni_handling_cb(gnutls_session_t session)
1448 char sni_name[MAX_HOST_LEN];
1449 size_t data_len = MAX_HOST_LEN;
1450 exim_gnutls_state_st *state = &state_server;
1451 unsigned int sni_type;
1454 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1455 if (rc != GNUTLS_E_SUCCESS)
1458 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1459 debug_printf("TLS: no SNI presented in handshake.\n");
1461 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1462 gnutls_strerror(rc), rc);
1467 if (sni_type != GNUTLS_NAME_DNS)
1469 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1473 /* We now have a UTF-8 string in sni_name */
1474 old_pool = store_pool;
1475 store_pool = POOL_PERM;
1476 state->received_sni = string_copyn(US sni_name, data_len);
1477 store_pool = old_pool;
1479 /* We set this one now so that variable expansions below will work */
1480 state->tlsp->sni = state->received_sni;
1482 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1483 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1485 if (!state->trigger_sni_changes)
1488 rc = tls_expand_session_files(state);
1491 /* If the setup of certs/etc failed before handshake, TLS would not have
1492 been offered. The best we can do now is abort. */
1493 return GNUTLS_E_APPLICATION_ERROR_MIN;
1496 rc = tls_set_remaining_x509(state);
1497 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1504 #ifndef DISABLE_OCSP
1507 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1508 gnutls_datum_t * ocsp_response)
1512 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1514 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1516 tls_in.ocsp = OCSP_NOT_RESP;
1517 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1520 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1527 #ifdef EXPERIMENTAL_TPDA
1529 We use this callback to get observability and detail-level control
1530 for an exim client TLS connection, raising a TPDA tls:cert event
1531 for each cert in the chain presented by the server. Any event
1532 can deny verification.
1534 Return 0 for the handshake to continue or non-zero to terminate.
1538 client_verify_cb(gnutls_session_t session)
1540 const gnutls_datum * cert_list;
1541 unsigned int cert_list_size = 0;
1542 gnutls_x509_crt_t crt;
1544 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1546 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1548 while (cert_list_size--)
1550 rc = import_cert(&cert_list[cert_list_size], &crt);
1551 if (rc != GNUTLS_E_SUCCESS)
1553 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1554 cert_list_size, gnutls_strerror(rc));
1558 state->tlsp->peercert = crt;
1559 if (tpda_raise_event(state->event_action,
1560 US"tls:cert", string_sprintf("%d", cert_list_size)) == DEFER)
1562 log_write(0, LOG_MAIN,
1563 "SSL verify denied by event-action: depth=%d", cert_list_size);
1564 return 1; /* reject */
1566 state->tlsp->peercert = NULL;
1576 /* ------------------------------------------------------------------------ */
1577 /* Exported functions */
1582 /*************************************************
1583 * Start a TLS session in a server *
1584 *************************************************/
1586 /* This is called when Exim is running as a server, after having received
1587 the STARTTLS command. It must respond to that command, and then negotiate
1591 require_ciphers list of allowed ciphers or NULL
1593 Returns: OK on success
1594 DEFER for errors before the start of the negotiation
1595 FAIL for errors during the negotation; the server can't
1600 tls_server_start(const uschar *require_ciphers)
1604 exim_gnutls_state_st *state = NULL;
1606 /* Check for previous activation */
1607 if (tls_in.active >= 0)
1609 tls_error(US"STARTTLS received after TLS started", "", NULL);
1610 smtp_printf("554 Already in TLS\r\n");
1614 /* Initialize the library. If it fails, it will already have logged the error
1615 and sent an SMTP response. */
1617 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1619 rc = tls_init(NULL, tls_certificate, tls_privatekey,
1620 NULL, tls_verify_certificates, tls_crl,
1621 require_ciphers, &state);
1622 if (rc != OK) return rc;
1624 /* If this is a host for which certificate verification is mandatory or
1625 optional, set up appropriately. */
1627 if (verify_check_host(&tls_verify_hosts) == OK)
1630 debug_printf("TLS: a client certificate will be required.\n");
1631 state->verify_requirement = VERIFY_REQUIRED;
1632 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1634 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1637 debug_printf("TLS: a client certificate will be requested but not required.\n");
1638 state->verify_requirement = VERIFY_OPTIONAL;
1639 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1644 debug_printf("TLS: a client certificate will not be requested.\n");
1645 state->verify_requirement = VERIFY_NONE;
1646 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1649 /* Register SNI handling; always, even if not in tls_certificate, so that the
1650 expansion variable $tls_sni is always available. */
1652 gnutls_handshake_set_post_client_hello_function(state->session,
1653 exim_sni_handling_cb);
1655 /* Set context and tell client to go ahead, except in the case of TLS startup
1656 on connection, where outputting anything now upsets the clients and tends to
1657 make them disconnect. We need to have an explicit fflush() here, to force out
1658 the response. Other smtp_printf() calls do not need it, because in non-TLS
1659 mode, the fflush() happens when smtp_getc() is called. */
1661 if (!state->tlsp->on_connect)
1663 smtp_printf("220 TLS go ahead\r\n");
1667 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1668 that the GnuTLS library doesn't. */
1670 gnutls_transport_set_ptr2(state->session,
1671 (gnutls_transport_ptr)(long) fileno(smtp_in),
1672 (gnutls_transport_ptr)(long) fileno(smtp_out));
1673 state->fd_in = fileno(smtp_in);
1674 state->fd_out = fileno(smtp_out);
1676 sigalrm_seen = FALSE;
1677 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1680 rc = gnutls_handshake(state->session);
1681 } while ((rc == GNUTLS_E_AGAIN) ||
1682 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1685 if (rc != GNUTLS_E_SUCCESS)
1687 tls_error(US"gnutls_handshake",
1688 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
1689 /* It seems that, except in the case of a timeout, we have to close the
1690 connection right here; otherwise if the other end is running OpenSSL it hangs
1691 until the server times out. */
1695 (void)fclose(smtp_out);
1696 (void)fclose(smtp_in);
1702 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1704 /* Verify after the fact */
1706 if ( state->verify_requirement != VERIFY_NONE
1707 && !verify_certificate(state, &error))
1709 if (state->verify_requirement != VERIFY_OPTIONAL)
1711 tls_error(US"certificate verification failed", error, NULL);
1715 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1719 /* Figure out peer DN, and if authenticated, etc. */
1721 rc = peer_status(state);
1722 if (rc != OK) return rc;
1724 /* Sets various Exim expansion variables; always safe within server */
1726 extract_exim_vars_from_tls_state(state);
1728 /* TLS has been set up. Adjust the input functions to read via TLS,
1729 and initialize appropriately. */
1731 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1733 receive_getc = tls_getc;
1734 receive_ungetc = tls_ungetc;
1735 receive_feof = tls_feof;
1736 receive_ferror = tls_ferror;
1737 receive_smtp_buffered = tls_smtp_buffered;
1745 /*************************************************
1746 * Start a TLS session in a client *
1747 *************************************************/
1749 /* Called from the smtp transport after STARTTLS has been accepted.
1752 fd the fd of the connection
1753 host connected host (for messages)
1754 addr the first address (not used)
1755 tb transport (always smtp)
1757 Returns: OK/DEFER/FAIL (because using common functions),
1758 but for a client, DEFER and FAIL have the same meaning
1762 tls_client_start(int fd, host_item *host,
1763 address_item *addr ARG_UNUSED,
1764 transport_instance *tb
1765 #ifdef EXPERIMENTAL_DANE
1766 , dne_answer * unused_tlsa_dnsa
1770 smtp_transport_options_block *ob =
1771 (smtp_transport_options_block *)tb->options_block;
1774 exim_gnutls_state_st *state = NULL;
1775 #ifndef DISABLE_OCSP
1776 BOOL require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1777 NULL, host->name, host->address, NULL) == OK;
1778 BOOL request_ocsp = require_ocsp ? TRUE
1779 : verify_check_this_host(&ob->hosts_request_ocsp,
1780 NULL, host->name, host->address, NULL) == OK;
1783 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
1785 if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
1786 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
1787 ob->tls_require_ciphers, &state)) != OK)
1791 int dh_min_bits = ob->tls_dh_min_bits;
1792 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1795 debug_printf("WARNING: tls_dh_min_bits far too low,"
1796 " clamping %d up to %d\n",
1797 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1798 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1801 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
1802 " acceptable bits to %d\n",
1804 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1807 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
1808 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
1809 the specified host patterns if one of them is defined */
1811 if (( state->exp_tls_verify_certificates
1812 && !ob->tls_verify_hosts
1813 && !ob->tls_try_verify_hosts
1816 verify_check_host(&ob->tls_verify_hosts) == OK
1819 #ifdef EXPERIMENTAL_CERTNAMES
1820 if (ob->tls_verify_cert_hostnames)
1823 debug_printf("TLS: server cert incl. hostname verification required.\n");
1824 state->verify_requirement = VERIFY_WITHHOST;
1825 if (!expand_check(ob->tls_verify_cert_hostnames,
1826 US"tls_verify_cert_hostnames",
1827 &state->exp_tls_verify_cert_hostnames))
1829 if (state->exp_tls_verify_cert_hostnames)
1830 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1831 state->exp_tls_verify_cert_hostnames);
1837 debug_printf("TLS: server certificate verification required.\n");
1838 state->verify_requirement = VERIFY_REQUIRED;
1840 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1842 else if (verify_check_host(&ob->tls_try_verify_hosts) == OK)
1845 debug_printf("TLS: server certificate verification optional.\n");
1846 state->verify_requirement = VERIFY_OPTIONAL;
1847 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1852 debug_printf("TLS: server certificate verification not required.\n");
1853 state->verify_requirement = VERIFY_NONE;
1854 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1857 #ifndef DISABLE_OCSP
1858 /* supported since GnuTLS 3.1.3 */
1861 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
1862 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
1863 NULL, 0, NULL)) != OK)
1864 return tls_error(US"cert-status-req",
1865 gnutls_strerror(rc), state->host);
1866 tls_out.ocsp = OCSP_NOT_RESP;
1870 #ifdef EXPERIMENTAL_TPDA
1871 if (tb->tpda_event_action)
1873 state->event_action = tb->tpda_event_action;
1874 gnutls_session_set_ptr(state->session, state);
1875 gnutls_certificate_set_verify_function(state->x509_cred, client_verify_cb);
1879 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)(long) fd);
1883 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
1884 /* There doesn't seem to be a built-in timeout on connection. */
1886 sigalrm_seen = FALSE;
1887 alarm(ob->command_timeout);
1890 rc = gnutls_handshake(state->session);
1891 } while ((rc == GNUTLS_E_AGAIN) ||
1892 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1895 if (rc != GNUTLS_E_SUCCESS)
1896 return tls_error(US"gnutls_handshake",
1897 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1899 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1903 if (state->verify_requirement != VERIFY_NONE &&
1904 !verify_certificate(state, &error))
1905 return tls_error(US"certificate verification failed", error, state->host);
1907 #ifndef DISABLE_OCSP
1912 gnutls_datum_t stapling;
1913 gnutls_ocsp_resp_t resp;
1914 gnutls_datum_t printed;
1915 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
1916 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
1917 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
1918 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
1921 debug_printf("%.4096s", printed.data);
1922 gnutls_free(printed.data);
1925 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host);
1928 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
1930 tls_out.ocsp = OCSP_FAILED;
1931 return tls_error(US"certificate status check failed", NULL, state->host);
1933 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
1934 tls_out.ocsp = OCSP_VFIED;
1938 /* Figure out peer DN, and if authenticated, etc. */
1940 if ((rc = peer_status(state)) != OK)
1943 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
1945 extract_exim_vars_from_tls_state(state);
1953 /*************************************************
1954 * Close down a TLS session *
1955 *************************************************/
1957 /* This is also called from within a delivery subprocess forked from the
1958 daemon, to shut down the TLS library, without actually doing a shutdown (which
1959 would tamper with the TLS session in the parent process).
1961 Arguments: TRUE if gnutls_bye is to be called
1966 tls_close(BOOL is_server, BOOL shutdown)
1968 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
1970 if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
1974 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1975 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1978 gnutls_deinit(state->session);
1980 state->tlsp->active = -1;
1981 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1983 if ((state_server.session == NULL) && (state_client.session == NULL))
1985 gnutls_global_deinit();
1986 exim_gnutls_base_init_done = FALSE;
1994 /*************************************************
1995 * TLS version of getc *
1996 *************************************************/
1998 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
1999 it refills the buffer via the GnuTLS reading function.
2000 Only used by the server-side TLS.
2002 This feeds DKIM and should be used for all message-body reads.
2005 Returns: the next character or EOF
2011 exim_gnutls_state_st *state = &state_server;
2012 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2016 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2017 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2019 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2020 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2021 ssl_xfer_buffer_size);
2024 /* A zero-byte return appears to mean that the TLS session has been
2025 closed down, not that the socket itself has been closed down. Revert to
2026 non-TLS handling. */
2030 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2032 receive_getc = smtp_getc;
2033 receive_ungetc = smtp_ungetc;
2034 receive_feof = smtp_feof;
2035 receive_ferror = smtp_ferror;
2036 receive_smtp_buffered = smtp_buffered;
2038 gnutls_deinit(state->session);
2039 state->session = NULL;
2040 state->tlsp->active = -1;
2041 state->tlsp->bits = 0;
2042 state->tlsp->certificate_verified = FALSE;
2043 tls_channelbinding_b64 = NULL;
2044 state->tlsp->cipher = NULL;
2045 state->tlsp->peercert = NULL;
2046 state->tlsp->peerdn = NULL;
2051 /* Handle genuine errors */
2053 else if (inbytes < 0)
2055 record_io_error(state, (int) inbytes, US"recv", NULL);
2056 state->xfer_error = 1;
2059 #ifndef DISABLE_DKIM
2060 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2062 state->xfer_buffer_hwm = (int) inbytes;
2063 state->xfer_buffer_lwm = 0;
2066 /* Something in the buffer; return next uschar */
2068 return state->xfer_buffer[state->xfer_buffer_lwm++];
2074 /*************************************************
2075 * Read bytes from TLS channel *
2076 *************************************************/
2078 /* This does not feed DKIM, so if the caller uses this for reading message body,
2079 then the caller must feed DKIM.
2085 Returns: the number of bytes read
2086 -1 after a failed read
2090 tls_read(BOOL is_server, uschar *buff, size_t len)
2092 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2098 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2100 debug_printf("*** PROBABLY A BUG *** " \
2101 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2102 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2105 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2106 state->session, buff, len);
2108 inbytes = gnutls_record_recv(state->session, buff, len);
2109 if (inbytes > 0) return inbytes;
2112 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2114 else record_io_error(state, (int)inbytes, US"recv", NULL);
2122 /*************************************************
2123 * Write bytes down TLS channel *
2124 *************************************************/
2128 is_server channel specifier
2132 Returns: the number of bytes after a successful write,
2133 -1 after a failed write
2137 tls_write(BOOL is_server, const uschar *buff, size_t len)
2141 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2143 DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
2146 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2148 outbytes = gnutls_record_send(state->session, buff, left);
2150 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
2153 record_io_error(state, outbytes, US"send", NULL);
2158 record_io_error(state, 0, US"send", US"TLS channel closed on write");
2169 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2180 /*************************************************
2181 * Random number generation *
2182 *************************************************/
2184 /* Pseudo-random number generation. The result is not expected to be
2185 cryptographically strong but not so weak that someone will shoot themselves
2186 in the foot using it as a nonce in input in some email header scheme or
2187 whatever weirdness they'll twist this into. The result should handle fork()
2188 and avoid repeating sequences. OpenSSL handles that for us.
2192 Returns a random number in range [0, max-1]
2195 #ifdef HAVE_GNUTLS_RND
2197 vaguely_random_number(int max)
2202 uschar smallbuf[sizeof(r)];
2207 needed_len = sizeof(r);
2208 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2209 * asked for a number less than 10. */
2210 for (r = max, i = 0; r; ++i)
2216 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2219 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2220 return vaguely_random_number_fallback(max);
2223 for (p = smallbuf; needed_len; --needed_len, ++p)
2229 /* We don't particularly care about weighted results; if someone wants
2230 * smooth distribution and cares enough then they should submit a patch then. */
2233 #else /* HAVE_GNUTLS_RND */
2235 vaguely_random_number(int max)
2237 return vaguely_random_number_fallback(max);
2239 #endif /* HAVE_GNUTLS_RND */
2244 /*************************************************
2245 * Let tls_require_ciphers be checked at startup *
2246 *************************************************/
2248 /* The tls_require_ciphers option, if set, must be something which the
2251 Returns: NULL on success, or error message
2255 tls_validate_require_cipher(void)
2258 uschar *expciphers = NULL;
2259 gnutls_priority_t priority_cache;
2262 #define validate_check_rc(Label) do { \
2263 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2264 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2265 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2267 if (exim_gnutls_base_init_done)
2268 log_write(0, LOG_MAIN|LOG_PANIC,
2269 "already initialised GnuTLS, Exim developer bug");
2271 #ifdef HAVE_GNUTLS_PKCS11
2272 if (!gnutls_allow_auto_pkcs11)
2274 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2275 validate_check_rc(US"gnutls_pkcs11_init");
2278 rc = gnutls_global_init();
2279 validate_check_rc(US"gnutls_global_init()");
2280 exim_gnutls_base_init_done = TRUE;
2282 if (!(tls_require_ciphers && *tls_require_ciphers))
2283 return_deinit(NULL);
2285 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2286 return_deinit(US"failed to expand tls_require_ciphers");
2288 if (!(expciphers && *expciphers))
2289 return_deinit(NULL);
2292 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2294 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2295 validate_check_rc(string_sprintf(
2296 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2297 expciphers, errpos - CS expciphers, errpos));
2299 #undef return_deinit
2300 #undef validate_check_rc
2301 gnutls_global_deinit();
2309 /*************************************************
2310 * Report the library versions. *
2311 *************************************************/
2313 /* See a description in tls-openssl.c for an explanation of why this exists.
2315 Arguments: a FILE* to print the results to
2320 tls_version_report(FILE *f)
2322 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2325 gnutls_check_version(NULL));
2330 /* End of tls-gnu.c */