1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2012 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
46 gnutls_global_set_audit_log_function()
49 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
52 /* Local static variables for GnuTLS */
54 /* Values for verify_requirement */
56 enum peer_verify_requirement { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
58 /* This holds most state for server or client; with this, we can set up an
59 outbound TLS-enabled connection in an ACL callout, while not stomping all
60 over the TLS variables available for expansion.
62 Some of these correspond to variables in globals.c; those variables will
63 be set to point to content in one of these instances, as appropriate for
64 the stage of the process lifetime.
66 Not handled here: globals tls_active, tls_bits, tls_cipher, tls_peerdn,
67 tls_certificate_verified, tls_channelbinding_b64, tls_sni.
70 typedef struct exim_gnutls_state {
71 gnutls_session_t session;
72 gnutls_certificate_credentials_t x509_cred;
73 gnutls_priority_t priority_cache;
74 enum peer_verify_requirement verify_requirement;
77 BOOL peer_cert_verified;
78 BOOL trigger_sni_changes;
79 const struct host_item *host;
83 const uschar *tls_certificate;
84 const uschar *tls_privatekey;
85 const uschar *tls_sni; /* client send only, not received */
86 const uschar *tls_verify_certificates;
87 const uschar *tls_crl;
88 const uschar *tls_require_ciphers;
89 uschar *exp_tls_certificate;
90 uschar *exp_tls_privatekey;
92 uschar *exp_tls_verify_certificates;
94 uschar *exp_tls_require_ciphers;
102 uschar cipherbuf[256];
103 } exim_gnutls_state_st;
105 static const exim_gnutls_state_st exim_gnutls_state_init = {
106 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE,
108 NULL, NULL, NULL, NULL, NULL, NULL,
109 NULL, NULL, NULL, NULL, NULL, NULL,
114 /* Not only do we have our own APIs which don't pass around state, assuming
115 it's held in globals, GnuTLS doesn't appear to let us register callback data
116 for callbacks, or as part of the session, so we have to keep a "this is the
117 context we're currently dealing with" pointer and rely upon being
118 single-threaded to keep from processing data on an inbound TLS connection while
119 talking to another TLS connection for an outbound check. This does mean that
120 there's no way for heart-beats to be responded to, for the duration of the
121 second connection. */
123 static exim_gnutls_state_st state_server, state_client;
124 static exim_gnutls_state_st *current_global_tls_state;
126 /* dh_params are initialised once within the lifetime of a process using TLS;
127 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
128 don't want to repeat this. */
130 static gnutls_dh_params_t dh_server_params = NULL;
132 /* No idea how this value was chosen; preserving it. Default is 3600. */
134 static const int ssl_session_timeout = 200;
136 static const char * const exim_default_gnutls_priority = "NORMAL";
138 /* Guard library core initialisation */
140 static BOOL exim_gnutls_base_init_done = FALSE;
143 /* ------------------------------------------------------------------------ */
146 #define MAX_HOST_LEN 255
148 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
149 the library logging; a value less than 0 disables the calls to set up logging
151 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
152 #define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
155 #ifndef EXIM_CLIENT_DH_MIN_BITS
156 #define EXIM_CLIENT_DH_MIN_BITS 1024
159 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
160 can ask for a bit-strength. Without that, we stick to the constant we had
162 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
163 #define EXIM_SERVER_DH_BITS_PRE2_12 1024
166 #define exim_gnutls_err_check(Label) do { \
167 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
169 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
171 #if GNUTLS_VERSION_NUMBER >= 0x020c00
172 #define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
173 #define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
174 #define HAVE_GNUTLS_RND
180 /* ------------------------------------------------------------------------ */
181 /* Callback declarations */
183 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
184 static void exim_gnutls_logger_cb(int level, const char *message);
187 static int exim_sni_handling_cb(gnutls_session_t session);
192 /* ------------------------------------------------------------------------ */
193 /* Static functions */
195 /*************************************************
197 *************************************************/
199 /* Called from lots of places when errors occur before actually starting to do
200 the TLS handshake, that is, while the session is still in clear. Always returns
201 DEFER for a server and FAIL for a client so that most calls can use "return
202 tls_error(...)" to do this processing and then give an appropriate return. A
203 single function is used for both server and client, because it is called from
204 some shared functions.
207 prefix text to include in the logged error
208 msg additional error string (may be NULL)
209 usually obtained from gnutls_strerror()
210 host NULL if setting up a server;
211 the connected host if setting up a client
213 Returns: OK/DEFER/FAIL
217 tls_error(const uschar *prefix, const char *msg, const host_item *host)
221 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
222 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
227 uschar *conn_info = smtp_get_connection_info();
228 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
230 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
231 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
239 /*************************************************
240 * Deal with logging errors during I/O *
241 *************************************************/
243 /* We have to get the identity of the peer from saved data.
246 state the current GnuTLS exim state container
247 rc the GnuTLS error code, or 0 if it's a local error
248 when text identifying read or write
249 text local error text when ec is 0
255 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
259 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
260 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
261 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
263 msg = gnutls_strerror(rc);
265 tls_error(when, msg, state->host);
271 /*************************************************
272 * Set various Exim expansion vars *
273 *************************************************/
275 /* We set various Exim global variables from the state, once a session has
276 been established. With TLS callouts, may need to change this to stack
277 variables, or just re-call it with the server state after client callout
280 Make sure anything set here is inset in tls_getc().
284 tls_bits strength indicator
285 tls_certificate_verified bool indicator
286 tls_channelbinding_b64 for some SASL mechanisms
289 tls_sni a (UTF-8) string
291 current_global_tls_state for API limitations
294 state the relevant exim_gnutls_state_st *
298 extract_exim_vars_from_tls_state(exim_gnutls_state_st *state)
300 gnutls_protocol_t protocol;
301 gnutls_cipher_algorithm_t cipher;
302 gnutls_kx_algorithm_t kx;
303 gnutls_mac_algorithm_t mac;
305 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
308 gnutls_datum_t channel;
311 current_global_tls_state = state;
313 tls_active = state->fd_out;
315 cipher = gnutls_cipher_get(state->session);
316 /* returns size in "bytes" */
317 tls_bits = gnutls_cipher_get_key_size(cipher) * 8;
319 if (!*state->cipherbuf)
321 protocol = gnutls_protocol_get_version(state->session);
322 mac = gnutls_mac_get(state->session);
323 kx = gnutls_kx_get(state->session);
325 string_format(state->cipherbuf, sizeof(state->cipherbuf),
327 gnutls_protocol_get_name(protocol),
328 gnutls_cipher_suite_get_name(kx, cipher, mac),
331 /* I don't see a way that spaces could occur, in the current GnuTLS
332 code base, but it was a concern in the old code and perhaps older GnuTLS
333 releases did return "TLS 1.0"; play it safe, just in case. */
334 for (p = state->cipherbuf; *p != '\0'; ++p)
338 tls_cipher = state->cipherbuf;
340 DEBUG(D_tls) debug_printf("cipher: %s\n", tls_cipher);
342 tls_certificate_verified = state->peer_cert_verified;
344 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
345 only available for use for authenticators while this TLS session is running. */
347 tls_channelbinding_b64 = NULL;
348 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
351 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
353 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
355 old_pool = store_pool;
356 store_pool = POOL_PERM;
357 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
358 store_pool = old_pool;
359 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
363 tls_peerdn = state->peerdn;
365 tls_sni = state->received_sni;
371 /*************************************************
372 * Setup up DH parameters *
373 *************************************************/
375 /* Generating the D-H parameters may take a long time. They only need to
376 be re-generated every so often, depending on security policy. What we do is to
377 keep these parameters in a file in the spool directory. If the file does not
378 exist, we generate them. This means that it is easy to cause a regeneration.
380 The new file is written as a temporary file and renamed, so that an incomplete
381 file is never present. If two processes both compute some new parameters, you
382 waste a bit of effort, but it doesn't seem worth messing around with locking to
386 host NULL for server, server for client (for error handling)
388 Returns: OK/DEFER/FAIL
395 unsigned int dh_bits;
397 uschar filename[PATH_MAX];
399 host_item *host = NULL; /* dummy for macros */
401 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
403 rc = gnutls_dh_params_init(&dh_server_params);
404 exim_gnutls_err_check(US"gnutls_dh_params_init");
406 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
407 /* If you change this constant, also change dh_param_fn_ext so that we can use a
408 different filename and ensure we have sufficient bits. */
409 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
411 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
413 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
416 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
418 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
422 if (!string_format(filename, sizeof(filename),
423 "%s/gnutls-params-%d", spool_directory, dh_bits))
424 return tls_error(US"overlong filename", NULL, NULL);
426 /* Open the cache file for reading and if successful, read it and set up the
429 fd = Uopen(filename, O_RDONLY, 0);
436 if (fstat(fd, &statbuf) < 0) /* EIO */
440 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
442 if (!S_ISREG(statbuf.st_mode))
445 return tls_error(US"TLS cache not a file", NULL, NULL);
447 fp = fdopen(fd, "rb");
452 return tls_error(US"fdopen(TLS cache stat fd) failed",
453 strerror(saved_errno), NULL);
456 m.size = statbuf.st_size;
457 m.data = malloc(m.size);
461 return tls_error(US"malloc failed", strerror(errno), NULL);
463 sz = fread(m.data, m.size, 1, fp);
469 return tls_error(US"fread failed", strerror(saved_errno), NULL);
473 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
475 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
476 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
479 /* If the file does not exist, fall through to compute new data and cache it.
480 If there was any other opening error, it is serious. */
482 else if (errno == ENOENT)
486 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
489 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
492 /* If ret < 0, either the cache file does not exist, or the data it contains
493 is not useful. One particular case of this is when upgrading from an older
494 release of Exim in which the data was stored in a different format. We don't
495 try to be clever and support both formats; we just regenerate new data in this
502 if ((PATH_MAX - Ustrlen(filename)) < 10)
503 return tls_error(US"Filename too long to generate replacement",
506 temp_fn = string_copy(US "%s.XXXXXXX");
507 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
509 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
510 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
512 DEBUG(D_tls) debug_printf("generating %d bits Diffie-Hellman key ...\n", dh_bits);
513 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits);
514 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
516 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
517 and I confirmed that a NULL call to get the size first is how the GnuTLS
518 sample apps handle this. */
522 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
524 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
525 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
527 m.data = malloc(m.size);
529 return tls_error(US"memory allocation failed", strerror(errno), NULL);
530 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
532 if (rc != GNUTLS_E_SUCCESS)
535 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
538 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
542 return tls_error(US"TLS cache write D-H params failed",
543 strerror(errno), NULL);
546 sz = write_to_fd_buf(fd, US"\n", 1);
548 return tls_error(US"TLS cache write D-H params final newline failed",
549 strerror(errno), NULL);
553 return tls_error(US"TLS cache write close() failed",
554 strerror(errno), NULL);
556 if (Urename(temp_fn, filename) < 0)
557 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
558 temp_fn, filename), strerror(errno), NULL);
560 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
563 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
570 /*************************************************
571 * Variables re-expanded post-SNI *
572 *************************************************/
574 /* Called from both server and client code, via tls_init(), and also from
575 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
577 We can tell the two apart by state->received_sni being non-NULL in callback.
579 The callback should not call us unless state->trigger_sni_changes is true,
580 which we are responsible for setting on the first pass through.
583 state exim_gnutls_state_st *
585 Returns: OK/DEFER/FAIL
589 tls_expand_session_files(exim_gnutls_state_st *state)
593 const host_item *host = state->host; /* macro should be reconsidered? */
594 uschar *saved_tls_certificate = NULL;
595 uschar *saved_tls_privatekey = NULL;
596 uschar *saved_tls_verify_certificates = NULL;
597 uschar *saved_tls_crl = NULL;
600 /* We check for tls_sni *before* expansion. */
603 if (!state->received_sni)
605 if (Ustrstr(state->tls_certificate, US"tls_sni"))
607 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
608 state->trigger_sni_changes = TRUE;
613 /* useful for debugging */
614 saved_tls_certificate = state->exp_tls_certificate;
615 saved_tls_privatekey = state->exp_tls_privatekey;
616 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
617 saved_tls_crl = state->exp_tls_crl;
621 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
622 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
624 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
625 state members, assuming consistent naming; and expand_check() returns
626 false if expansion failed, unless expansion was forced to fail. */
628 /* check if we at least have a certificate, before doing expensive
631 if (!expand_check_tlsvar(tls_certificate))
634 /* certificate is mandatory in server, optional in client */
636 if ((state->exp_tls_certificate == NULL) ||
637 (*state->exp_tls_certificate == '\0'))
639 if (state->host == NULL)
640 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
642 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
645 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
648 /* tls_privatekey is optional, defaulting to same file as certificate */
650 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
652 state->tls_privatekey = state->tls_certificate;
653 state->exp_tls_privatekey = state->exp_tls_certificate;
657 if (state->exp_tls_certificate && *state->exp_tls_certificate)
659 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
660 state->exp_tls_certificate, state->exp_tls_privatekey);
662 if (state->received_sni)
664 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
665 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
667 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
671 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
675 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
676 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
677 GNUTLS_X509_FMT_PEM);
678 exim_gnutls_err_check(
679 string_sprintf("cert/key setup: cert=%s key=%s",
680 state->exp_tls_certificate, state->exp_tls_privatekey));
681 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
682 } /* tls_certificate */
684 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
685 provided. Experiment shows that, if the certificate file is empty, an unhelpful
686 error message is provided. However, if we just refrain from setting anything up
687 in that case, certificate verification fails, which seems to be the correct
690 if (state->tls_verify_certificates && *state->tls_verify_certificates)
692 if (!expand_check_tlsvar(tls_verify_certificates))
694 if (state->tls_crl && *state->tls_crl)
695 if (!expand_check_tlsvar(tls_crl))
698 if (!(state->exp_tls_verify_certificates &&
699 *state->exp_tls_verify_certificates))
702 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
703 /* With no tls_verify_certificates, we ignore tls_crl too */
710 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
714 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
716 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
717 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
722 if (!S_ISREG(statbuf.st_mode))
725 debug_printf("verify certificates path is not a file: \"%s\"\n%s\n",
726 state->exp_tls_verify_certificates,
727 S_ISDIR(statbuf.st_mode)
728 ? " it's a directory, that's OpenSSL, this is GnuTLS"
729 : " (not a directory either)");
730 log_write(0, LOG_MAIN|LOG_PANIC,
731 "tls_verify_certificates \"%s\" is not a file",
732 state->exp_tls_verify_certificates);
736 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
737 state->exp_tls_verify_certificates, statbuf.st_size);
739 if (statbuf.st_size == 0)
742 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
746 cert_count = gnutls_certificate_set_x509_trust_file(state->x509_cred,
747 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
751 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
753 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
755 if (state->tls_crl && *state->tls_crl)
757 if (state->exp_tls_crl && *state->exp_tls_crl)
759 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
760 rc = gnutls_certificate_set_x509_crl_file(state->x509_cred,
761 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
762 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
772 /*************************************************
773 * Set X.509 state variables *
774 *************************************************/
776 /* In GnuTLS, the registered cert/key are not replaced by a later
777 set of a cert/key, so for SNI support we need a whole new x509_cred
778 structure. Which means various other non-re-expanded pieces of state
779 need to be re-set in the new struct, so the setting logic is pulled
783 state exim_gnutls_state_st *
785 Returns: OK/DEFER/FAIL
789 tls_set_remaining_x509(exim_gnutls_state_st *state)
792 const host_item *host = state->host; /* macro should be reconsidered? */
794 /* Create D-H parameters, or read them from the cache file. This function does
795 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
796 client-side params. */
800 if (!dh_server_params)
802 rc = init_server_dh();
803 if (rc != OK) return rc;
805 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
808 /* Link the credentials to the session. */
810 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
811 exim_gnutls_err_check(US"gnutls_credentials_set");
816 /*************************************************
817 * Initialize for GnuTLS *
818 *************************************************/
820 /* Called from both server and client code. In the case of a server, errors
821 before actual TLS negotiation return DEFER.
824 host connected host, if client; NULL if server
825 certificate certificate file
826 privatekey private key file
827 sni TLS SNI to send, sometimes when client; else NULL
830 require_ciphers tls_require_ciphers setting
832 Returns: OK/DEFER/FAIL
837 const host_item *host,
838 const uschar *certificate,
839 const uschar *privatekey,
843 const uschar *require_ciphers,
844 exim_gnutls_state_st **caller_state)
846 exim_gnutls_state_st *state;
851 BOOL want_default_priorities;
853 if (!exim_gnutls_base_init_done)
855 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
857 rc = gnutls_global_init();
858 exim_gnutls_err_check(US"gnutls_global_init");
860 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
863 gnutls_global_set_log_function(exim_gnutls_logger_cb);
864 /* arbitrarily chosen level; bump upto 9 for more */
865 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
869 exim_gnutls_base_init_done = TRUE;
874 state = &state_client;
875 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
876 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
877 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
881 state = &state_server;
882 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
883 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
884 rc = gnutls_init(&state->session, GNUTLS_SERVER);
886 exim_gnutls_err_check(US"gnutls_init");
890 state->tls_certificate = certificate;
891 state->tls_privatekey = privatekey;
892 state->tls_sni = sni;
893 state->tls_verify_certificates = cas;
894 state->tls_crl = crl;
896 /* This handles the variables that might get re-expanded after TLS SNI;
897 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
900 debug_printf("Expanding various TLS configuration options for session credentials.\n");
901 rc = tls_expand_session_files(state);
902 if (rc != OK) return rc;
904 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
905 requires a new structure afterwards. */
907 rc = tls_set_remaining_x509(state);
908 if (rc != OK) return rc;
910 /* set SNI in client, only */
913 if (!expand_check_tlsvar(tls_sni))
915 if (state->exp_tls_sni && *state->exp_tls_sni)
918 debug_printf("Setting TLS client SNI to \"%s\"\n", state->exp_tls_sni);
919 sz = Ustrlen(state->exp_tls_sni);
920 rc = gnutls_server_name_set(state->session,
921 GNUTLS_NAME_DNS, state->exp_tls_sni, sz);
922 exim_gnutls_err_check(US"gnutls_server_name_set");
925 else if (state->tls_sni)
926 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
927 "have an SNI set for a client [%s]\n", state->tls_sni);
929 /* This is the priority string support,
930 http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html
931 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
932 This was backwards incompatible, but means Exim no longer needs to track
933 all algorithms and provide string forms for them. */
935 want_default_priorities = TRUE;
937 if (state->tls_require_ciphers && *state->tls_require_ciphers)
939 if (!expand_check_tlsvar(tls_require_ciphers))
941 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
943 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
944 state->exp_tls_require_ciphers);
946 rc = gnutls_priority_init(&state->priority_cache,
947 CS state->exp_tls_require_ciphers, &errpos);
948 want_default_priorities = FALSE;
949 p = state->exp_tls_require_ciphers;
952 if (want_default_priorities)
955 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
956 exim_default_gnutls_priority);
957 rc = gnutls_priority_init(&state->priority_cache,
958 exim_default_gnutls_priority, &errpos);
959 p = US exim_default_gnutls_priority;
962 exim_gnutls_err_check(string_sprintf(
963 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
964 p, errpos - CS p, errpos));
966 rc = gnutls_priority_set(state->session, state->priority_cache);
967 exim_gnutls_err_check(US"gnutls_priority_set");
969 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
971 /* Reduce security in favour of increased compatibility, if the admin
972 decides to make that trade-off. */
973 if (gnutls_compat_mode)
975 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
976 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
977 gnutls_session_enable_compatibility_mode(state->session);
979 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
983 *caller_state = state;
984 /* needs to happen before callbacks during handshake */
985 current_global_tls_state = state;
992 /*************************************************
993 * Extract peer information *
994 *************************************************/
996 /* Called from both server and client code.
997 Only this is allowed to set state->peerdn and we use that to detect double-calls.
1000 state exim_gnutls_state_st *
1002 Returns: OK/DEFER/FAIL
1006 peer_status(exim_gnutls_state_st *state)
1008 const gnutls_datum *cert_list;
1010 unsigned int cert_list_size = 0;
1011 gnutls_certificate_type_t ct;
1012 gnutls_x509_crt_t crt;
1019 state->peerdn = US"unknown";
1021 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1023 if (cert_list == NULL || cert_list_size == 0)
1025 state->peerdn = US"unknown (no certificate)";
1026 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1027 cert_list, cert_list_size);
1028 if (state->verify_requirement == VERIFY_REQUIRED)
1029 return tls_error(US"certificate verification failed",
1030 "no certificate received from peer", state->host);
1034 ct = gnutls_certificate_type_get(state->session);
1035 if (ct != GNUTLS_CRT_X509)
1037 const char *ctn = gnutls_certificate_type_get_name(ct);
1038 state->peerdn = string_sprintf("unknown (type %s)", ctn);
1040 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1041 if (state->verify_requirement == VERIFY_REQUIRED)
1042 return tls_error(US"certificate verification not possible, unhandled type",
1047 #define exim_gnutls_peer_err(Label) do { \
1048 if (rc != GNUTLS_E_SUCCESS) { \
1049 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1050 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1051 return OK; } } while (0)
1053 rc = gnutls_x509_crt_init(&crt);
1054 exim_gnutls_peer_err(US"gnutls_x509_crt_init (crt)");
1056 rc = gnutls_x509_crt_import(crt, &cert_list[0], GNUTLS_X509_FMT_DER);
1057 exim_gnutls_peer_err(US"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1059 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1060 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1062 exim_gnutls_peer_err(US"getting size for cert DN failed");
1063 return FAIL; /* should not happen */
1065 dn_buf = store_get_perm(sz);
1066 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1067 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1068 state->peerdn = dn_buf;
1071 #undef exim_gnutls_peer_err
1077 /*************************************************
1078 * Verify peer certificate *
1079 *************************************************/
1081 /* Called from both server and client code.
1082 *Should* be using a callback registered with
1083 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1084 the peer information, but that's too new for some OSes.
1087 state exim_gnutls_state_st *
1088 error where to put an error message
1091 FALSE if the session should be rejected
1092 TRUE if the cert is okay or we just don't care
1096 verify_certificate(exim_gnutls_state_st *state, const char **error)
1099 unsigned int verify;
1103 rc = peer_status(state);
1106 verify = GNUTLS_CERT_INVALID;
1107 *error = "not supplied";
1111 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1114 /* Handle the result of verification. INVALID seems to be set as well
1115 as REVOKED, but leave the test for both. */
1117 if ((rc < 0) || (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
1119 state->peer_cert_verified = FALSE;
1121 *error = ((verify & GNUTLS_CERT_REVOKED) != 0) ? "revoked" : "invalid";
1124 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
1125 *error, state->peerdn);
1127 if (state->verify_requirement == VERIFY_REQUIRED)
1129 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1133 debug_printf("TLS verify failure overriden (host in tls_try_verify_hosts)\n");
1137 state->peer_cert_verified = TRUE;
1138 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=%s\n", state->peerdn);
1141 tls_peerdn = state->peerdn;
1149 /* ------------------------------------------------------------------------ */
1152 /* Logging function which can be registered with
1153 * gnutls_global_set_log_function()
1154 * gnutls_global_set_log_level() 0..9
1156 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1158 exim_gnutls_logger_cb(int level, const char *message)
1160 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s\n", level, message);
1165 /* Called after client hello, should handle SNI work.
1166 This will always set tls_sni (state->received_sni) if available,
1167 and may trigger presenting different certificates,
1168 if state->trigger_sni_changes is TRUE.
1170 Should be registered with
1171 gnutls_handshake_set_post_client_hello_function()
1173 "This callback must return 0 on success or a gnutls error code to terminate the
1176 For inability to get SNI information, we return 0.
1177 We only return non-zero if re-setup failed.
1181 exim_sni_handling_cb(gnutls_session_t session)
1183 char sni_name[MAX_HOST_LEN];
1184 size_t data_len = MAX_HOST_LEN;
1185 exim_gnutls_state_st *state = current_global_tls_state;
1186 unsigned int sni_type;
1189 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1190 if (rc != GNUTLS_E_SUCCESS)
1193 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1194 debug_printf("TLS: no SNI presented in handshake.\n");
1196 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1197 gnutls_strerror(rc), rc);
1202 if (sni_type != GNUTLS_NAME_DNS)
1204 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1208 /* We now have a UTF-8 string in sni_name */
1209 old_pool = store_pool;
1210 store_pool = POOL_PERM;
1211 state->received_sni = string_copyn(US sni_name, data_len);
1212 store_pool = old_pool;
1214 /* We set this one now so that variable expansions below will work */
1215 tls_sni = state->received_sni;
1217 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1218 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1220 if (!state->trigger_sni_changes)
1223 rc = tls_expand_session_files(state);
1226 /* If the setup of certs/etc failed before handshake, TLS would not have
1227 been offered. The best we can do now is abort. */
1228 return GNUTLS_E_APPLICATION_ERROR_MIN;
1231 rc = tls_set_remaining_x509(state);
1232 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1240 /* ------------------------------------------------------------------------ */
1241 /* Exported functions */
1246 /*************************************************
1247 * Start a TLS session in a server *
1248 *************************************************/
1250 /* This is called when Exim is running as a server, after having received
1251 the STARTTLS command. It must respond to that command, and then negotiate
1255 require_ciphers list of allowed ciphers or NULL
1257 Returns: OK on success
1258 DEFER for errors before the start of the negotiation
1259 FAIL for errors during the negotation; the server can't
1264 tls_server_start(const uschar *require_ciphers)
1268 exim_gnutls_state_st *state = NULL;
1270 /* Check for previous activation */
1271 /* nb: this will not be TLS callout safe, needs reworking as part of that. */
1273 if (tls_active >= 0)
1275 tls_error(US"STARTTLS received after TLS started", "", NULL);
1276 smtp_printf("554 Already in TLS\r\n");
1280 /* Initialize the library. If it fails, it will already have logged the error
1281 and sent an SMTP response. */
1283 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1285 rc = tls_init(NULL, tls_certificate, tls_privatekey,
1286 NULL, tls_verify_certificates, tls_crl,
1287 require_ciphers, &state);
1288 if (rc != OK) return rc;
1290 /* If this is a host for which certificate verification is mandatory or
1291 optional, set up appropriately. */
1293 if (verify_check_host(&tls_verify_hosts) == OK)
1295 DEBUG(D_tls) debug_printf("TLS: a client certificate will be required.\n");
1296 state->verify_requirement = VERIFY_REQUIRED;
1297 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1299 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1301 DEBUG(D_tls) debug_printf("TLS: a client certificate will be requested but not required.\n");
1302 state->verify_requirement = VERIFY_OPTIONAL;
1303 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1307 DEBUG(D_tls) debug_printf("TLS: a client certificate will not be requested.\n");
1308 state->verify_requirement = VERIFY_NONE;
1309 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1312 /* Register SNI handling; always, even if not in tls_certificate, so that the
1313 expansion variable $tls_sni is always available. */
1315 gnutls_handshake_set_post_client_hello_function(state->session,
1316 exim_sni_handling_cb);
1318 /* Set context and tell client to go ahead, except in the case of TLS startup
1319 on connection, where outputting anything now upsets the clients and tends to
1320 make them disconnect. We need to have an explicit fflush() here, to force out
1321 the response. Other smtp_printf() calls do not need it, because in non-TLS
1322 mode, the fflush() happens when smtp_getc() is called. */
1324 if (!tls_on_connect)
1326 smtp_printf("220 TLS go ahead\r\n");
1330 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1331 that the GnuTLS library doesn't. */
1333 gnutls_transport_set_ptr2(state->session,
1334 (gnutls_transport_ptr)fileno(smtp_in),
1335 (gnutls_transport_ptr)fileno(smtp_out));
1336 state->fd_in = fileno(smtp_in);
1337 state->fd_out = fileno(smtp_out);
1339 sigalrm_seen = FALSE;
1340 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1343 rc = gnutls_handshake(state->session);
1344 } while ((rc == GNUTLS_E_AGAIN) || (rc == GNUTLS_E_INTERRUPTED));
1347 if (rc != GNUTLS_E_SUCCESS)
1349 tls_error(US"gnutls_handshake",
1350 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
1351 /* It seems that, except in the case of a timeout, we have to close the
1352 connection right here; otherwise if the other end is running OpenSSL it hangs
1353 until the server times out. */
1357 (void)fclose(smtp_out);
1358 (void)fclose(smtp_in);
1364 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1366 /* Verify after the fact */
1368 if (state->verify_requirement != VERIFY_NONE)
1370 if (!verify_certificate(state, &error))
1372 if (state->verify_requirement == VERIFY_OPTIONAL)
1375 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1380 tls_error(US"certificate verification failed", error, NULL);
1386 /* Figure out peer DN, and if authenticated, etc. */
1388 rc = peer_status(state);
1389 if (rc != OK) return rc;
1391 /* Sets various Exim expansion variables; always safe within server */
1393 extract_exim_vars_from_tls_state(state);
1395 /* TLS has been set up. Adjust the input functions to read via TLS,
1396 and initialize appropriately. */
1398 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1400 receive_getc = tls_getc;
1401 receive_ungetc = tls_ungetc;
1402 receive_feof = tls_feof;
1403 receive_ferror = tls_ferror;
1404 receive_smtp_buffered = tls_smtp_buffered;
1412 /*************************************************
1413 * Start a TLS session in a client *
1414 *************************************************/
1416 /* Called from the smtp transport after STARTTLS has been accepted.
1419 fd the fd of the connection
1420 host connected host (for messages)
1421 addr the first address (not used)
1422 dhparam DH parameter file (ignored, we're a client)
1423 certificate certificate file
1424 privatekey private key file
1425 sni TLS SNI to send to remote host
1426 verify_certs file for certificate verify
1427 verify_crl CRL for verify
1428 require_ciphers list of allowed ciphers or NULL
1429 timeout startup timeout
1431 Returns: OK/DEFER/FAIL (because using common functions),
1432 but for a client, DEFER and FAIL have the same meaning
1436 tls_client_start(int fd, host_item *host,
1437 address_item *addr ARG_UNUSED, uschar *dhparam ARG_UNUSED,
1438 uschar *certificate, uschar *privatekey, uschar *sni,
1439 uschar *verify_certs, uschar *verify_crl,
1440 uschar *require_ciphers, int timeout)
1444 exim_gnutls_state_st *state = NULL;
1446 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
1448 rc = tls_init(host, certificate, privatekey,
1449 sni, verify_certs, verify_crl, require_ciphers, &state);
1450 if (rc != OK) return rc;
1452 gnutls_dh_set_prime_bits(state->session, EXIM_CLIENT_DH_MIN_BITS);
1454 if (verify_certs == NULL)
1456 DEBUG(D_tls) debug_printf("TLS: server certificate verification not required\n");
1457 state->verify_requirement = VERIFY_NONE;
1458 /* we still ask for it, to log it, etc */
1459 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1463 DEBUG(D_tls) debug_printf("TLS: server certificate verification required\n");
1464 state->verify_requirement = VERIFY_REQUIRED;
1465 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1468 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)fd);
1472 /* There doesn't seem to be a built-in timeout on connection. */
1474 sigalrm_seen = FALSE;
1478 rc = gnutls_handshake(state->session);
1479 } while ((rc == GNUTLS_E_AGAIN) || (rc == GNUTLS_E_INTERRUPTED));
1482 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1486 if (state->verify_requirement != VERIFY_NONE &&
1487 !verify_certificate(state, &error))
1488 return tls_error(US"certificate verification failed", error, state->host);
1490 /* Figure out peer DN, and if authenticated, etc. */
1492 rc = peer_status(state);
1493 if (rc != OK) return rc;
1495 /* Sets various Exim expansion variables; always safe within server */
1497 extract_exim_vars_from_tls_state(state);
1505 /*************************************************
1506 * Close down a TLS session *
1507 *************************************************/
1509 /* This is also called from within a delivery subprocess forked from the
1510 daemon, to shut down the TLS library, without actually doing a shutdown (which
1511 would tamper with the TLS session in the parent process).
1513 Arguments: TRUE if gnutls_bye is to be called
1518 tls_close(BOOL shutdown)
1520 exim_gnutls_state_st *state = current_global_tls_state;
1522 if (tls_active < 0) return; /* TLS was not active */
1526 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1527 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1530 gnutls_deinit(state->session);
1532 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1534 if ((state_server.session == NULL) && (state_client.session == NULL))
1536 gnutls_global_deinit();
1537 exim_gnutls_base_init_done = FALSE;
1546 /*************************************************
1547 * TLS version of getc *
1548 *************************************************/
1550 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
1551 it refills the buffer via the GnuTLS reading function.
1553 This feeds DKIM and should be used for all message-body reads.
1556 Returns: the next character or EOF
1562 exim_gnutls_state_st *state = current_global_tls_state;
1563 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
1567 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1568 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
1570 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1571 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
1572 ssl_xfer_buffer_size);
1575 /* A zero-byte return appears to mean that the TLS session has been
1576 closed down, not that the socket itself has been closed down. Revert to
1577 non-TLS handling. */
1581 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1583 receive_getc = smtp_getc;
1584 receive_ungetc = smtp_ungetc;
1585 receive_feof = smtp_feof;
1586 receive_ferror = smtp_ferror;
1587 receive_smtp_buffered = smtp_buffered;
1589 gnutls_deinit(state->session);
1590 state->session = NULL;
1593 tls_certificate_verified = FALSE;
1594 tls_channelbinding_b64 = NULL;
1601 /* Handle genuine errors */
1603 else if (inbytes < 0)
1605 record_io_error(state, (int) inbytes, US"recv", NULL);
1606 state->xfer_error = 1;
1609 #ifndef DISABLE_DKIM
1610 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
1612 state->xfer_buffer_hwm = (int) inbytes;
1613 state->xfer_buffer_lwm = 0;
1616 /* Something in the buffer; return next uschar */
1618 return state->xfer_buffer[state->xfer_buffer_lwm++];
1624 /*************************************************
1625 * Read bytes from TLS channel *
1626 *************************************************/
1628 /* This does not feed DKIM, so if the caller uses this for reading message body,
1629 then the caller must feed DKIM.
1634 Returns: the number of bytes read
1635 -1 after a failed read
1639 tls_read(uschar *buff, size_t len)
1641 exim_gnutls_state_st *state = current_global_tls_state;
1647 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
1649 debug_printf("*** PROBABLY A BUG *** " \
1650 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1651 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
1654 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
1655 state->session, buff, len);
1657 inbytes = gnutls_record_recv(state->session, buff, len);
1658 if (inbytes > 0) return inbytes;
1661 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1663 else record_io_error(state, (int)inbytes, US"recv", NULL);
1671 /*************************************************
1672 * Write bytes down TLS channel *
1673 *************************************************/
1680 Returns: the number of bytes after a successful write,
1681 -1 after a failed write
1685 tls_write(const uschar *buff, size_t len)
1689 exim_gnutls_state_st *state = current_global_tls_state;
1691 DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
1694 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
1696 outbytes = gnutls_record_send(state->session, buff, left);
1698 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
1701 record_io_error(state, outbytes, US"send", NULL);
1706 record_io_error(state, 0, US"send", US"TLS channel closed on write");
1717 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
1728 /*************************************************
1729 * Random number generation *
1730 *************************************************/
1732 /* Pseudo-random number generation. The result is not expected to be
1733 cryptographically strong but not so weak that someone will shoot themselves
1734 in the foot using it as a nonce in input in some email header scheme or
1735 whatever weirdness they'll twist this into. The result should handle fork()
1736 and avoid repeating sequences. OpenSSL handles that for us.
1740 Returns a random number in range [0, max-1]
1743 #ifdef HAVE_GNUTLS_RND
1745 vaguely_random_number(int max)
1750 uschar smallbuf[sizeof(r)];
1755 needed_len = sizeof(r);
1756 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
1757 * asked for a number less than 10. */
1758 for (r = max, i = 0; r; ++i)
1764 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
1767 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
1768 return vaguely_random_number_fallback(max);
1771 for (p = smallbuf; needed_len; --needed_len, ++p)
1777 /* We don't particularly care about weighted results; if someone wants
1778 * smooth distribution and cares enough then they should submit a patch then. */
1781 #else /* HAVE_GNUTLS_RND */
1783 vaguely_random_number(int max)
1785 return vaguely_random_number_fallback(max);
1787 #endif /* HAVE_GNUTLS_RND */
1792 /*************************************************
1793 * Report the library versions. *
1794 *************************************************/
1796 /* See a description in tls-openssl.c for an explanation of why this exists.
1798 Arguments: a FILE* to print the results to
1803 tls_version_report(FILE *f)
1805 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
1808 gnutls_check_version(NULL));
1811 /* End of tls-gnu.c */