1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2015 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42 /* needed to disable PKCS11 autoload unless requested */
43 #if GNUTLS_VERSION_NUMBER >= 0x020c00
44 # include <gnutls/pkcs11.h>
45 # define SUPPORT_PARAM_TO_PK_BITS
47 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
48 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
51 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
52 # warning "GnuTLS library version too old; tls:cert event unsupported"
53 # define DISABLE_EVENT
55 #if GNUTLS_VERSION_NUMBER >= 0x030306
56 # define SUPPORT_CA_DIR
58 # undef SUPPORT_CA_DIR
60 #if GNUTLS_VERSION_NUMBER >= 0x030014
61 # define SUPPORT_SYSDEFAULT_CABUNDLE
65 # include <gnutls/ocsp.h>
71 gnutls_global_set_audit_log_function()
74 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
77 /* Local static variables for GnuTLS */
79 /* Values for verify_requirement */
81 enum peer_verify_requirement
82 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
84 /* This holds most state for server or client; with this, we can set up an
85 outbound TLS-enabled connection in an ACL callout, while not stomping all
86 over the TLS variables available for expansion.
88 Some of these correspond to variables in globals.c; those variables will
89 be set to point to content in one of these instances, as appropriate for
90 the stage of the process lifetime.
92 Not handled here: global tls_channelbinding_b64.
95 typedef struct exim_gnutls_state {
96 gnutls_session_t session;
97 gnutls_certificate_credentials_t x509_cred;
98 gnutls_priority_t priority_cache;
99 enum peer_verify_requirement verify_requirement;
102 BOOL peer_cert_verified;
103 BOOL trigger_sni_changes;
104 BOOL have_set_peerdn;
105 const struct host_item *host;
106 gnutls_x509_crt_t peercert;
109 uschar *received_sni;
111 const uschar *tls_certificate;
112 const uschar *tls_privatekey;
113 const uschar *tls_sni; /* client send only, not received */
114 const uschar *tls_verify_certificates;
115 const uschar *tls_crl;
116 const uschar *tls_require_ciphers;
118 uschar *exp_tls_certificate;
119 uschar *exp_tls_privatekey;
120 uschar *exp_tls_verify_certificates;
122 uschar *exp_tls_require_ciphers;
123 uschar *exp_tls_ocsp_file;
124 const uschar *exp_tls_verify_cert_hostnames;
125 #ifndef DISABLE_EVENT
126 uschar *event_action;
129 tls_support *tlsp; /* set in tls_init() */
136 } exim_gnutls_state_st;
138 static const exim_gnutls_state_st exim_gnutls_state_init = {
139 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
140 NULL, NULL, NULL, NULL,
141 NULL, NULL, NULL, NULL, NULL, NULL,
142 NULL, NULL, NULL, NULL, NULL, NULL, NULL,
144 #ifndef DISABLE_EVENT
151 /* Not only do we have our own APIs which don't pass around state, assuming
152 it's held in globals, GnuTLS doesn't appear to let us register callback data
153 for callbacks, or as part of the session, so we have to keep a "this is the
154 context we're currently dealing with" pointer and rely upon being
155 single-threaded to keep from processing data on an inbound TLS connection while
156 talking to another TLS connection for an outbound check. This does mean that
157 there's no way for heart-beats to be responded to, for the duration of the
159 XXX But see gnutls_session_get_ptr()
162 static exim_gnutls_state_st state_server, state_client;
164 /* dh_params are initialised once within the lifetime of a process using TLS;
165 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
166 don't want to repeat this. */
168 static gnutls_dh_params_t dh_server_params = NULL;
170 /* No idea how this value was chosen; preserving it. Default is 3600. */
172 static const int ssl_session_timeout = 200;
174 static const char * const exim_default_gnutls_priority = "NORMAL";
176 /* Guard library core initialisation */
178 static BOOL exim_gnutls_base_init_done = FALSE;
181 static BOOL gnutls_buggy_ocsp = FALSE;
185 /* ------------------------------------------------------------------------ */
188 #define MAX_HOST_LEN 255
190 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
191 the library logging; a value less than 0 disables the calls to set up logging
193 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
194 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
197 #ifndef EXIM_CLIENT_DH_MIN_BITS
198 # define EXIM_CLIENT_DH_MIN_BITS 1024
201 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
202 can ask for a bit-strength. Without that, we stick to the constant we had
204 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
205 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
208 #define exim_gnutls_err_check(Label) do { \
209 if (rc != GNUTLS_E_SUCCESS) \
210 return tls_error((Label), gnutls_strerror(rc), host, errstr); \
213 #define expand_check_tlsvar(Varname, errstr) \
214 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
216 #if GNUTLS_VERSION_NUMBER >= 0x020c00
217 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
218 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
219 # define HAVE_GNUTLS_RND
220 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
221 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
222 * isn't available sometimes, so this needs to become a conditional
223 * compilation; the sanest way to deal with this being a problem on
224 * older OSes is to block it in the Local/Makefile with this compiler
226 # ifndef AVOID_GNUTLS_PKCS11
227 # define HAVE_GNUTLS_PKCS11
228 # endif /* AVOID_GNUTLS_PKCS11 */
234 /* ------------------------------------------------------------------------ */
235 /* Callback declarations */
237 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
238 static void exim_gnutls_logger_cb(int level, const char *message);
241 static int exim_sni_handling_cb(gnutls_session_t session);
244 static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
245 gnutls_datum_t * ocsp_response);
250 /* ------------------------------------------------------------------------ */
251 /* Static functions */
253 /*************************************************
255 *************************************************/
257 /* Called from lots of places when errors occur before actually starting to do
258 the TLS handshake, that is, while the session is still in clear. Always returns
259 DEFER for a server and FAIL for a client so that most calls can use "return
260 tls_error(...)" to do this processing and then give an appropriate return. A
261 single function is used for both server and client, because it is called from
262 some shared functions.
265 prefix text to include in the logged error
266 msg additional error string (may be NULL)
267 usually obtained from gnutls_strerror()
268 host NULL if setting up a server;
269 the connected host if setting up a client
270 errstr pointer to returned error string
272 Returns: OK/DEFER/FAIL
276 tls_error(const uschar *prefix, const char *msg, const host_item *host,
280 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : "");
281 return host ? FAIL : DEFER;
287 /*************************************************
288 * Deal with logging errors during I/O *
289 *************************************************/
291 /* We have to get the identity of the peer from saved data.
294 state the current GnuTLS exim state container
295 rc the GnuTLS error code, or 0 if it's a local error
296 when text identifying read or write
297 text local error text when ec is 0
303 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
308 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
309 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
310 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
312 msg = gnutls_strerror(rc);
314 (void) tls_error(when, msg, state->host, &errstr);
317 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
318 state->host->name, state->host->address, errstr);
321 uschar * conn_info = smtp_get_connection_info();
322 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
323 /* I'd like to get separated H= here, but too hard for now */
324 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
331 /*************************************************
332 * Set various Exim expansion vars *
333 *************************************************/
335 #define exim_gnutls_cert_err(Label) \
338 if (rc != GNUTLS_E_SUCCESS) \
340 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
341 (Label), gnutls_strerror(rc)); \
347 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
351 rc = gnutls_x509_crt_init(crtp);
352 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
354 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
355 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
360 #undef exim_gnutls_cert_err
363 /* We set various Exim global variables from the state, once a session has
364 been established. With TLS callouts, may need to change this to stack
365 variables, or just re-call it with the server state after client callout
368 Make sure anything set here is unset in tls_getc().
372 tls_bits strength indicator
373 tls_certificate_verified bool indicator
374 tls_channelbinding_b64 for some SASL mechanisms
376 tls_peercert pointer to library internal
378 tls_sni a (UTF-8) string
379 tls_ourcert pointer to library internal
382 state the relevant exim_gnutls_state_st *
386 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
388 gnutls_cipher_algorithm_t cipher;
389 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
392 gnutls_datum_t channel;
394 tls_support * tlsp = state->tlsp;
396 tlsp->active = state->fd_out;
398 cipher = gnutls_cipher_get(state->session);
399 /* returns size in "bytes" */
400 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
402 tlsp->cipher = state->ciphersuite;
404 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
406 tlsp->certificate_verified = state->peer_cert_verified;
408 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
409 only available for use for authenticators while this TLS session is running. */
411 tls_channelbinding_b64 = NULL;
412 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
415 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
417 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
419 old_pool = store_pool;
420 store_pool = POOL_PERM;
421 tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
422 store_pool = old_pool;
423 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
427 /* peercert is set in peer_status() */
428 tlsp->peerdn = state->peerdn;
429 tlsp->sni = state->received_sni;
431 /* record our certificate */
433 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
434 gnutls_x509_crt_t crt;
436 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
443 /*************************************************
444 * Setup up DH parameters *
445 *************************************************/
447 /* Generating the D-H parameters may take a long time. They only need to
448 be re-generated every so often, depending on security policy. What we do is to
449 keep these parameters in a file in the spool directory. If the file does not
450 exist, we generate them. This means that it is easy to cause a regeneration.
452 The new file is written as a temporary file and renamed, so that an incomplete
453 file is never present. If two processes both compute some new parameters, you
454 waste a bit of effort, but it doesn't seem worth messing around with locking to
457 Returns: OK/DEFER/FAIL
461 init_server_dh(uschar ** errstr)
464 unsigned int dh_bits;
466 uschar filename_buf[PATH_MAX];
467 uschar *filename = NULL;
469 uschar *exp_tls_dhparam;
470 BOOL use_file_in_spool = FALSE;
471 BOOL use_fixed_file = FALSE;
472 host_item *host = NULL; /* dummy for macros */
474 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
476 rc = gnutls_dh_params_init(&dh_server_params);
477 exim_gnutls_err_check(US"gnutls_dh_params_init");
482 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
485 if (!exp_tls_dhparam)
487 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
488 m.data = US std_dh_prime_default();
489 m.size = Ustrlen(m.data);
491 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
492 use_file_in_spool = TRUE;
493 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
495 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
498 else if (exp_tls_dhparam[0] != '/')
500 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
501 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL, errstr);
502 m.size = Ustrlen(m.data);
506 use_fixed_file = TRUE;
507 filename = exp_tls_dhparam;
512 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
513 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
514 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
518 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
519 /* If you change this constant, also change dh_param_fn_ext so that we can use a
520 different filename and ensure we have sufficient bits. */
521 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
523 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
525 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
528 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
530 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
534 /* Some clients have hard-coded limits. */
535 if (dh_bits > tls_dh_max_bits)
538 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
540 dh_bits = tls_dh_max_bits;
543 if (use_file_in_spool)
545 if (!string_format(filename_buf, sizeof(filename_buf),
546 "%s/gnutls-params-%d", spool_directory, dh_bits))
547 return tls_error(US"overlong filename", NULL, NULL, errstr);
548 filename = filename_buf;
551 /* Open the cache file for reading and if successful, read it and set up the
554 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
560 if (fstat(fd, &statbuf) < 0) /* EIO */
564 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL, errstr);
566 if (!S_ISREG(statbuf.st_mode))
569 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
571 if (!(fp = fdopen(fd, "rb")))
575 return tls_error(US"fdopen(TLS cache stat fd) failed",
576 strerror(saved_errno), NULL, errstr);
579 m.size = statbuf.st_size;
580 if (!(m.data = malloc(m.size)))
583 return tls_error(US"malloc failed", strerror(errno), NULL, errstr);
585 if (!(sz = fread(m.data, m.size, 1, fp)))
590 return tls_error(US"fread failed", strerror(saved_errno), NULL, errstr);
594 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
596 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
597 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
600 /* If the file does not exist, fall through to compute new data and cache it.
601 If there was any other opening error, it is serious. */
603 else if (errno == ENOENT)
607 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
610 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
613 /* If ret < 0, either the cache file does not exist, or the data it contains
614 is not useful. One particular case of this is when upgrading from an older
615 release of Exim in which the data was stored in a different format. We don't
616 try to be clever and support both formats; we just regenerate new data in this
622 unsigned int dh_bits_gen = dh_bits;
624 if ((PATH_MAX - Ustrlen(filename)) < 10)
625 return tls_error(US"Filename too long to generate replacement",
626 CS filename, NULL, errstr);
628 temp_fn = string_copy(US "%s.XXXXXXX");
629 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
630 return tls_error(US"Unable to open temp file", strerror(errno), NULL, errstr);
631 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
633 /* GnuTLS overshoots!
634 * If we ask for 2236, we might get 2237 or more.
635 * But there's no way to ask GnuTLS how many bits there really are.
636 * We can ask how many bits were used in a TLS session, but that's it!
637 * The prime itself is hidden behind too much abstraction.
638 * So we ask for less, and proceed on a wing and a prayer.
639 * First attempt, subtracted 3 for 2233 and got 2240.
641 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
643 dh_bits_gen = dh_bits - 10;
645 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
650 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
652 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
653 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
655 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
656 and I confirmed that a NULL call to get the size first is how the GnuTLS
657 sample apps handle this. */
661 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
663 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
664 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
666 if (!(m.data = malloc(m.size)))
667 return tls_error(US"memory allocation failed", strerror(errno), NULL, errstr);
669 /* this will return a size 1 less than the allocation size above */
670 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
672 if (rc != GNUTLS_E_SUCCESS)
675 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
677 m.size = sz; /* shrink by 1, probably */
679 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
682 return tls_error(US"TLS cache write D-H params failed",
683 strerror(errno), NULL, errstr);
686 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
687 return tls_error(US"TLS cache write D-H params final newline failed",
688 strerror(errno), NULL, errstr);
690 if ((rc = close(fd)))
691 return tls_error(US"TLS cache write close() failed", strerror(errno), NULL, errstr);
693 if (Urename(temp_fn, filename) < 0)
694 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
695 temp_fn, filename), strerror(errno), NULL, errstr);
697 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
700 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
707 /* Create and install a selfsigned certificate, for use in server mode */
710 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
712 gnutls_x509_crt_t cert = NULL;
714 gnutls_x509_privkey_t pkey = NULL;
715 const uschar * where;
718 where = US"initialising pkey";
719 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
721 where = US"initialising cert";
722 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
724 where = US"generating pkey";
725 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
726 #ifdef SUPPORT_PARAM_TO_PK_BITS
727 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_LOW),
734 where = US"configuring cert";
736 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
737 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
738 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
739 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
740 || (rc = gnutls_x509_crt_set_key(cert, pkey))
742 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
743 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
744 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
745 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
746 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
747 GNUTLS_OID_X520_COMMON_NAME, 0,
748 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
752 where = US"signing cert";
753 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
755 where = US"installing selfsign cert";
757 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
763 if (cert) gnutls_x509_crt_deinit(cert);
764 if (pkey) gnutls_x509_privkey_deinit(pkey);
768 rc = tls_error(where, gnutls_strerror(rc), NULL, errstr);
775 /*************************************************
776 * Variables re-expanded post-SNI *
777 *************************************************/
779 /* Called from both server and client code, via tls_init(), and also from
780 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
782 We can tell the two apart by state->received_sni being non-NULL in callback.
784 The callback should not call us unless state->trigger_sni_changes is true,
785 which we are responsible for setting on the first pass through.
788 state exim_gnutls_state_st *
789 errstr error string pointer
791 Returns: OK/DEFER/FAIL
795 tls_expand_session_files(exim_gnutls_state_st *state, uschar ** errstr)
799 const host_item *host = state->host; /* macro should be reconsidered? */
800 uschar *saved_tls_certificate = NULL;
801 uschar *saved_tls_privatekey = NULL;
802 uschar *saved_tls_verify_certificates = NULL;
803 uschar *saved_tls_crl = NULL;
806 /* We check for tls_sni *before* expansion. */
807 if (!host) /* server */
808 if (!state->received_sni)
810 if (state->tls_certificate &&
811 (Ustrstr(state->tls_certificate, US"tls_sni") ||
812 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
813 Ustrstr(state->tls_certificate, US"tls_out_sni")
816 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
817 state->trigger_sni_changes = TRUE;
822 /* useful for debugging */
823 saved_tls_certificate = state->exp_tls_certificate;
824 saved_tls_privatekey = state->exp_tls_privatekey;
825 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
826 saved_tls_crl = state->exp_tls_crl;
829 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
830 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
832 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
833 state members, assuming consistent naming; and expand_check() returns
834 false if expansion failed, unless expansion was forced to fail. */
836 /* check if we at least have a certificate, before doing expensive
839 if (!expand_check_tlsvar(tls_certificate, errstr))
842 /* certificate is mandatory in server, optional in client */
844 if ( !state->exp_tls_certificate
845 || !*state->exp_tls_certificate
848 return tls_install_selfsign(state, errstr);
850 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
852 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
855 /* tls_privatekey is optional, defaulting to same file as certificate */
857 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
859 state->tls_privatekey = state->tls_certificate;
860 state->exp_tls_privatekey = state->exp_tls_certificate;
864 if (state->exp_tls_certificate && *state->exp_tls_certificate)
866 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
867 state->exp_tls_certificate, state->exp_tls_privatekey);
869 if (state->received_sni)
870 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
871 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
874 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
878 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
881 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
882 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
883 GNUTLS_X509_FMT_PEM);
884 exim_gnutls_err_check(
885 string_sprintf("cert/key setup: cert=%s key=%s",
886 state->exp_tls_certificate, state->exp_tls_privatekey));
887 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
888 } /* tls_certificate */
891 /* Set the OCSP stapling server info */
894 if ( !host /* server */
898 if (gnutls_buggy_ocsp)
900 DEBUG(D_tls) debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
904 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file",
905 &state->exp_tls_ocsp_file, errstr))
908 /* Use the full callback method for stapling just to get observability.
909 More efficient would be to read the file once only, if it never changed
910 (due to SNI). Would need restart on file update, or watch datestamp. */
912 gnutls_certificate_set_ocsp_status_request_function(state->x509_cred,
913 server_ocsp_stapling_cb, state->exp_tls_ocsp_file);
915 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", state->exp_tls_ocsp_file);
921 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
922 provided. Experiment shows that, if the certificate file is empty, an unhelpful
923 error message is provided. However, if we just refrain from setting anything up
924 in that case, certificate verification fails, which seems to be the correct
927 if (state->tls_verify_certificates && *state->tls_verify_certificates)
929 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
931 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
932 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
933 state->exp_tls_verify_certificates = NULL;
935 if (state->tls_crl && *state->tls_crl)
936 if (!expand_check_tlsvar(tls_crl, errstr))
939 if (!(state->exp_tls_verify_certificates &&
940 *state->exp_tls_verify_certificates))
943 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
944 /* With no tls_verify_certificates, we ignore tls_crl too */
951 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
955 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
956 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
957 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
961 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
963 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
964 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
969 #ifndef SUPPORT_CA_DIR
970 /* The test suite passes in /dev/null; we could check for that path explicitly,
971 but who knows if someone has some weird FIFO which always dumps some certs, or
972 other weirdness. The thing we really want to check is that it's not a
973 directory, since while OpenSSL supports that, GnuTLS does not.
974 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
975 if (S_ISDIR(statbuf.st_mode))
978 debug_printf("verify certificates path is a dir: \"%s\"\n",
979 state->exp_tls_verify_certificates);
980 log_write(0, LOG_MAIN|LOG_PANIC,
981 "tls_verify_certificates \"%s\" is a directory",
982 state->exp_tls_verify_certificates);
987 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
988 state->exp_tls_verify_certificates, statbuf.st_size);
990 if (statbuf.st_size == 0)
993 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
999 #ifdef SUPPORT_CA_DIR
1000 (statbuf.st_mode & S_IFMT) == S_IFDIR
1002 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1003 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1006 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1007 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1013 exim_gnutls_err_check(US"setting certificate trust");
1015 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
1017 if (state->tls_crl && *state->tls_crl &&
1018 state->exp_tls_crl && *state->exp_tls_crl)
1020 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1021 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1022 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1026 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
1028 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1037 /*************************************************
1038 * Set X.509 state variables *
1039 *************************************************/
1041 /* In GnuTLS, the registered cert/key are not replaced by a later
1042 set of a cert/key, so for SNI support we need a whole new x509_cred
1043 structure. Which means various other non-re-expanded pieces of state
1044 need to be re-set in the new struct, so the setting logic is pulled
1048 state exim_gnutls_state_st *
1049 errstr error string pointer
1051 Returns: OK/DEFER/FAIL
1055 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1058 const host_item *host = state->host; /* macro should be reconsidered? */
1060 /* Create D-H parameters, or read them from the cache file. This function does
1061 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1062 client-side params. */
1066 if (!dh_server_params)
1068 rc = init_server_dh(errstr);
1069 if (rc != OK) return rc;
1071 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1074 /* Link the credentials to the session. */
1076 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1077 exim_gnutls_err_check(US"gnutls_credentials_set");
1082 /*************************************************
1083 * Initialize for GnuTLS *
1084 *************************************************/
1087 #ifndef DISABLE_OCSP
1090 tls_is_buggy_ocsp(void)
1093 uschar maj, mid, mic;
1095 s = CUS gnutls_check_version(NULL);
1099 while (*s && *s != '.') s++;
1100 mid = atoi(CCS ++s);
1107 while (*s && *s != '.') s++;
1108 mic = atoi(CCS ++s);
1109 return mic <= (mid == 3 ? 16 : 3);
1118 /* Called from both server and client code. In the case of a server, errors
1119 before actual TLS negotiation return DEFER.
1122 host connected host, if client; NULL if server
1123 certificate certificate file
1124 privatekey private key file
1125 sni TLS SNI to send, sometimes when client; else NULL
1128 require_ciphers tls_require_ciphers setting
1129 caller_state returned state-info structure
1130 errstr error string pointer
1132 Returns: OK/DEFER/FAIL
1137 const host_item *host,
1138 const uschar *certificate,
1139 const uschar *privatekey,
1143 const uschar *require_ciphers,
1144 exim_gnutls_state_st **caller_state,
1147 exim_gnutls_state_st *state;
1152 BOOL want_default_priorities;
1154 if (!exim_gnutls_base_init_done)
1156 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1158 #ifdef HAVE_GNUTLS_PKCS11
1159 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1160 which loads modules from a config file, which sounds good and may be wanted
1161 by some sysadmin, but also means in common configurations that GNOME keyring
1162 environment variables are used and so breaks for users calling mailq.
1163 To prevent this, we init PKCS11 first, which is the documented approach. */
1164 if (!gnutls_allow_auto_pkcs11)
1166 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1167 exim_gnutls_err_check(US"gnutls_pkcs11_init");
1171 rc = gnutls_global_init();
1172 exim_gnutls_err_check(US"gnutls_global_init");
1174 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1177 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1178 /* arbitrarily chosen level; bump upto 9 for more */
1179 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1183 #ifndef DISABLE_OCSP
1184 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1185 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1188 exim_gnutls_base_init_done = TRUE;
1193 state = &state_client;
1194 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1195 state->tlsp = &tls_out;
1196 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1197 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1201 state = &state_server;
1202 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1203 state->tlsp = &tls_in;
1204 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1205 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1207 exim_gnutls_err_check(US"gnutls_init");
1211 state->tls_certificate = certificate;
1212 state->tls_privatekey = privatekey;
1213 state->tls_require_ciphers = require_ciphers;
1214 state->tls_sni = sni;
1215 state->tls_verify_certificates = cas;
1216 state->tls_crl = crl;
1218 /* This handles the variables that might get re-expanded after TLS SNI;
1219 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1222 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1223 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1225 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1226 requires a new structure afterwards. */
1228 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
1230 /* set SNI in client, only */
1233 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
1235 if (state->tlsp->sni && *state->tlsp->sni)
1238 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1239 sz = Ustrlen(state->tlsp->sni);
1240 rc = gnutls_server_name_set(state->session,
1241 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
1242 exim_gnutls_err_check(US"gnutls_server_name_set");
1245 else if (state->tls_sni)
1246 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1247 "have an SNI set for a client [%s]\n", state->tls_sni);
1249 /* This is the priority string support,
1250 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1251 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1252 This was backwards incompatible, but means Exim no longer needs to track
1253 all algorithms and provide string forms for them. */
1255 want_default_priorities = TRUE;
1257 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1259 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
1261 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1263 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1264 state->exp_tls_require_ciphers);
1266 rc = gnutls_priority_init(&state->priority_cache,
1267 CS state->exp_tls_require_ciphers, &errpos);
1268 want_default_priorities = FALSE;
1269 p = state->exp_tls_require_ciphers;
1272 if (want_default_priorities)
1275 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1276 exim_default_gnutls_priority);
1277 rc = gnutls_priority_init(&state->priority_cache,
1278 exim_default_gnutls_priority, &errpos);
1279 p = US exim_default_gnutls_priority;
1282 exim_gnutls_err_check(string_sprintf(
1283 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1284 p, errpos - CS p, errpos));
1286 rc = gnutls_priority_set(state->session, state->priority_cache);
1287 exim_gnutls_err_check(US"gnutls_priority_set");
1289 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1291 /* Reduce security in favour of increased compatibility, if the admin
1292 decides to make that trade-off. */
1293 if (gnutls_compat_mode)
1295 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1296 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1297 gnutls_session_enable_compatibility_mode(state->session);
1299 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1303 *caller_state = state;
1309 /*************************************************
1310 * Extract peer information *
1311 *************************************************/
1313 /* Called from both server and client code.
1314 Only this is allowed to set state->peerdn and state->have_set_peerdn
1315 and we use that to detect double-calls.
1317 NOTE: the state blocks last while the TLS connection is up, which is fine
1318 for logging in the server side, but for the client side, we log after teardown
1319 in src/deliver.c. While the session is up, we can twist about states and
1320 repoint tls_* globals, but those variables used for logging or other variable
1321 expansion that happens _after_ delivery need to have a longer life-time.
1323 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1324 doing this more than once per generation of a state context. We set them in
1325 the state context, and repoint tls_* to them. After the state goes away, the
1326 tls_* copies of the pointers remain valid and client delivery logging is happy.
1328 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1332 state exim_gnutls_state_st *
1333 errstr pointer to error string
1335 Returns: OK/DEFER/FAIL
1339 peer_status(exim_gnutls_state_st *state, uschar ** errstr)
1341 uschar cipherbuf[256];
1342 const gnutls_datum_t *cert_list;
1344 unsigned int cert_list_size = 0;
1345 gnutls_protocol_t protocol;
1346 gnutls_cipher_algorithm_t cipher;
1347 gnutls_kx_algorithm_t kx;
1348 gnutls_mac_algorithm_t mac;
1349 gnutls_certificate_type_t ct;
1350 gnutls_x509_crt_t crt;
1354 if (state->have_set_peerdn)
1356 state->have_set_peerdn = TRUE;
1358 state->peerdn = NULL;
1361 cipher = gnutls_cipher_get(state->session);
1362 protocol = gnutls_protocol_get_version(state->session);
1363 mac = gnutls_mac_get(state->session);
1364 kx = gnutls_kx_get(state->session);
1366 string_format(cipherbuf, sizeof(cipherbuf),
1368 gnutls_protocol_get_name(protocol),
1369 gnutls_cipher_suite_get_name(kx, cipher, mac),
1370 (int) gnutls_cipher_get_key_size(cipher) * 8);
1372 /* I don't see a way that spaces could occur, in the current GnuTLS
1373 code base, but it was a concern in the old code and perhaps older GnuTLS
1374 releases did return "TLS 1.0"; play it safe, just in case. */
1375 for (p = cipherbuf; *p != '\0'; ++p)
1378 old_pool = store_pool;
1379 store_pool = POOL_PERM;
1380 state->ciphersuite = string_copy(cipherbuf);
1381 store_pool = old_pool;
1382 state->tlsp->cipher = state->ciphersuite;
1385 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1387 if (cert_list == NULL || cert_list_size == 0)
1389 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1390 cert_list, cert_list_size);
1391 if (state->verify_requirement >= VERIFY_REQUIRED)
1392 return tls_error(US"certificate verification failed",
1393 "no certificate received from peer", state->host, errstr);
1397 ct = gnutls_certificate_type_get(state->session);
1398 if (ct != GNUTLS_CRT_X509)
1400 const char *ctn = gnutls_certificate_type_get_name(ct);
1402 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1403 if (state->verify_requirement >= VERIFY_REQUIRED)
1404 return tls_error(US"certificate verification not possible, unhandled type",
1405 ctn, state->host, errstr);
1409 #define exim_gnutls_peer_err(Label) \
1411 if (rc != GNUTLS_E_SUCCESS) \
1413 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1414 (Label), gnutls_strerror(rc)); \
1415 if (state->verify_requirement >= VERIFY_REQUIRED) \
1416 return tls_error((Label), gnutls_strerror(rc), state->host, errstr); \
1421 rc = import_cert(&cert_list[0], &crt);
1422 exim_gnutls_peer_err(US"cert 0");
1424 state->tlsp->peercert = state->peercert = crt;
1427 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1428 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1430 exim_gnutls_peer_err(US"getting size for cert DN failed");
1431 return FAIL; /* should not happen */
1433 dn_buf = store_get_perm(sz);
1434 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1435 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1437 state->peerdn = dn_buf;
1440 #undef exim_gnutls_peer_err
1446 /*************************************************
1447 * Verify peer certificate *
1448 *************************************************/
1450 /* Called from both server and client code.
1451 *Should* be using a callback registered with
1452 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1453 the peer information, but that's too new for some OSes.
1456 state exim_gnutls_state_st *
1457 errstr where to put an error message
1460 FALSE if the session should be rejected
1461 TRUE if the cert is okay or we just don't care
1465 verify_certificate(exim_gnutls_state_st *state, uschar ** errstr)
1468 unsigned int verify;
1472 if ((rc = peer_status(state, errstr)) != OK)
1474 verify = GNUTLS_CERT_INVALID;
1475 *errstr = US"certificate not supplied";
1478 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1480 /* Handle the result of verification. INVALID seems to be set as well
1481 as REVOKED, but leave the test for both. */
1484 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1487 state->peer_cert_verified = FALSE;
1489 *errstr = verify & GNUTLS_CERT_REVOKED
1490 ? US"certificate revoked" : US"certificate invalid";
1493 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1494 *errstr, state->peerdn ? state->peerdn : US"<unset>");
1496 if (state->verify_requirement >= VERIFY_REQUIRED)
1498 gnutls_alert_send(state->session,
1499 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1503 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1508 if (state->exp_tls_verify_cert_hostnames)
1511 const uschar * list = state->exp_tls_verify_cert_hostnames;
1513 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1514 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1519 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1520 if (state->verify_requirement >= VERIFY_REQUIRED)
1522 gnutls_alert_send(state->session,
1523 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1529 state->peer_cert_verified = TRUE;
1530 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1531 state->peerdn ? state->peerdn : US"<unset>");
1534 state->tlsp->peerdn = state->peerdn;
1542 /* ------------------------------------------------------------------------ */
1545 /* Logging function which can be registered with
1546 * gnutls_global_set_log_function()
1547 * gnutls_global_set_log_level() 0..9
1549 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1551 exim_gnutls_logger_cb(int level, const char *message)
1553 size_t len = strlen(message);
1556 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1559 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1560 message[len-1] == '\n' ? "" : "\n");
1565 /* Called after client hello, should handle SNI work.
1566 This will always set tls_sni (state->received_sni) if available,
1567 and may trigger presenting different certificates,
1568 if state->trigger_sni_changes is TRUE.
1570 Should be registered with
1571 gnutls_handshake_set_post_client_hello_function()
1573 "This callback must return 0 on success or a gnutls error code to terminate the
1576 For inability to get SNI information, we return 0.
1577 We only return non-zero if re-setup failed.
1578 Only used for server-side TLS.
1582 exim_sni_handling_cb(gnutls_session_t session)
1584 char sni_name[MAX_HOST_LEN];
1585 size_t data_len = MAX_HOST_LEN;
1586 exim_gnutls_state_st *state = &state_server;
1587 unsigned int sni_type;
1589 uschar * dummy_errstr;
1591 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1592 if (rc != GNUTLS_E_SUCCESS)
1595 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1596 debug_printf("TLS: no SNI presented in handshake.\n");
1598 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1599 gnutls_strerror(rc), rc);
1604 if (sni_type != GNUTLS_NAME_DNS)
1606 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1610 /* We now have a UTF-8 string in sni_name */
1611 old_pool = store_pool;
1612 store_pool = POOL_PERM;
1613 state->received_sni = string_copyn(US sni_name, data_len);
1614 store_pool = old_pool;
1616 /* We set this one now so that variable expansions below will work */
1617 state->tlsp->sni = state->received_sni;
1619 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1620 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1622 if (!state->trigger_sni_changes)
1625 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
1627 /* If the setup of certs/etc failed before handshake, TLS would not have
1628 been offered. The best we can do now is abort. */
1629 return GNUTLS_E_APPLICATION_ERROR_MIN;
1632 rc = tls_set_remaining_x509(state, &dummy_errstr);
1633 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1640 #ifndef DISABLE_OCSP
1643 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1644 gnutls_datum_t * ocsp_response)
1648 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1650 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1652 tls_in.ocsp = OCSP_NOT_RESP;
1653 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1656 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1663 #ifndef DISABLE_EVENT
1665 We use this callback to get observability and detail-level control
1666 for an exim TLS connection (either direction), raising a tls:cert event
1667 for each cert in the chain presented by the peer. Any event
1668 can deny verification.
1670 Return 0 for the handshake to continue or non-zero to terminate.
1674 verify_cb(gnutls_session_t session)
1676 const gnutls_datum_t * cert_list;
1677 unsigned int cert_list_size = 0;
1678 gnutls_x509_crt_t crt;
1681 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1683 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1685 while (cert_list_size--)
1687 rc = import_cert(&cert_list[cert_list_size], &crt);
1688 if (rc != GNUTLS_E_SUCCESS)
1690 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1691 cert_list_size, gnutls_strerror(rc));
1695 state->tlsp->peercert = crt;
1696 if ((yield = event_raise(state->event_action,
1697 US"tls:cert", string_sprintf("%d", cert_list_size))))
1699 log_write(0, LOG_MAIN,
1700 "SSL verify denied by event-action: depth=%d: %s",
1701 cert_list_size, yield);
1702 return 1; /* reject */
1704 state->tlsp->peercert = NULL;
1714 /* ------------------------------------------------------------------------ */
1715 /* Exported functions */
1720 /*************************************************
1721 * Start a TLS session in a server *
1722 *************************************************/
1724 /* This is called when Exim is running as a server, after having received
1725 the STARTTLS command. It must respond to that command, and then negotiate
1729 require_ciphers list of allowed ciphers or NULL
1730 errstr pointer to error string
1732 Returns: OK on success
1733 DEFER for errors before the start of the negotiation
1734 FAIL for errors during the negotiation; the server can't
1739 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
1742 exim_gnutls_state_st * state = NULL;
1744 /* Check for previous activation */
1745 if (tls_in.active >= 0)
1747 tls_error(US"STARTTLS received after TLS started", "", NULL, errstr);
1748 smtp_printf("554 Already in TLS\r\n");
1752 /* Initialize the library. If it fails, it will already have logged the error
1753 and sent an SMTP response. */
1755 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1757 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
1758 NULL, tls_verify_certificates, tls_crl,
1759 require_ciphers, &state, errstr)) != OK) return rc;
1761 /* If this is a host for which certificate verification is mandatory or
1762 optional, set up appropriately. */
1764 if (verify_check_host(&tls_verify_hosts) == OK)
1767 debug_printf("TLS: a client certificate will be required.\n");
1768 state->verify_requirement = VERIFY_REQUIRED;
1769 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1771 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1774 debug_printf("TLS: a client certificate will be requested but not required.\n");
1775 state->verify_requirement = VERIFY_OPTIONAL;
1776 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1781 debug_printf("TLS: a client certificate will not be requested.\n");
1782 state->verify_requirement = VERIFY_NONE;
1783 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1786 #ifndef DISABLE_EVENT
1789 state->event_action = event_action;
1790 gnutls_session_set_ptr(state->session, state);
1791 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1795 /* Register SNI handling; always, even if not in tls_certificate, so that the
1796 expansion variable $tls_sni is always available. */
1798 gnutls_handshake_set_post_client_hello_function(state->session,
1799 exim_sni_handling_cb);
1801 /* Set context and tell client to go ahead, except in the case of TLS startup
1802 on connection, where outputting anything now upsets the clients and tends to
1803 make them disconnect. We need to have an explicit fflush() here, to force out
1804 the response. Other smtp_printf() calls do not need it, because in non-TLS
1805 mode, the fflush() happens when smtp_getc() is called. */
1807 if (!state->tlsp->on_connect)
1809 smtp_printf("220 TLS go ahead\r\n");
1813 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1814 that the GnuTLS library doesn't. */
1816 gnutls_transport_set_ptr2(state->session,
1817 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
1818 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
1819 state->fd_in = fileno(smtp_in);
1820 state->fd_out = fileno(smtp_out);
1822 sigalrm_seen = FALSE;
1823 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1825 rc = gnutls_handshake(state->session);
1826 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
1829 if (rc != GNUTLS_E_SUCCESS)
1831 /* It seems that, except in the case of a timeout, we have to close the
1832 connection right here; otherwise if the other end is running OpenSSL it hangs
1833 until the server times out. */
1837 tls_error(US"gnutls_handshake", "timed out", NULL, errstr);
1838 gnutls_db_remove_session(state->session);
1842 tls_error(US"gnutls_handshake", gnutls_strerror(rc), NULL, errstr);
1843 (void) gnutls_alert_send_appropriate(state->session, rc);
1844 gnutls_deinit(state->session);
1845 gnutls_certificate_free_credentials(state->x509_cred);
1847 shutdown(state->fd_out, SHUT_WR);
1848 for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--; /* drain skt */
1849 (void)fclose(smtp_out);
1850 (void)fclose(smtp_in);
1851 smtp_out = smtp_in = NULL;
1857 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1859 /* Verify after the fact */
1861 if ( state->verify_requirement != VERIFY_NONE
1862 && !verify_certificate(state, errstr))
1864 if (state->verify_requirement != VERIFY_OPTIONAL)
1866 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
1870 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1874 /* Figure out peer DN, and if authenticated, etc. */
1876 if ((rc = peer_status(state, NULL)) != OK) return rc;
1878 /* Sets various Exim expansion variables; always safe within server */
1880 extract_exim_vars_from_tls_state(state);
1882 /* TLS has been set up. Adjust the input functions to read via TLS,
1883 and initialize appropriately. */
1885 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1887 receive_getc = tls_getc;
1888 receive_get_cache = tls_get_cache;
1889 receive_ungetc = tls_ungetc;
1890 receive_feof = tls_feof;
1891 receive_ferror = tls_ferror;
1892 receive_smtp_buffered = tls_smtp_buffered;
1901 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
1902 smtp_transport_options_block * ob)
1904 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
1906 state->exp_tls_verify_cert_hostnames =
1908 string_domain_utf8_to_alabel(host->name, NULL);
1913 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
1914 state->exp_tls_verify_cert_hostnames);
1919 /*************************************************
1920 * Start a TLS session in a client *
1921 *************************************************/
1923 /* Called from the smtp transport after STARTTLS has been accepted.
1926 fd the fd of the connection
1927 host connected host (for messages)
1928 addr the first address (not used)
1929 tb transport (always smtp)
1931 errstr error string pointer
1933 Returns: OK/DEFER/FAIL (because using common functions),
1934 but for a client, DEFER and FAIL have the same meaning
1938 tls_client_start(int fd, host_item *host,
1939 address_item *addr ARG_UNUSED,
1940 transport_instance * tb,
1941 #ifdef EXPERIMENTAL_DANE
1942 dns_answer * tlsa_dnsa ARG_UNUSED,
1946 smtp_transport_options_block *ob =
1947 (smtp_transport_options_block *)tb->options_block;
1949 exim_gnutls_state_st *state = NULL;
1950 #ifndef DISABLE_OCSP
1952 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
1953 BOOL request_ocsp = require_ocsp ? TRUE
1954 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
1957 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
1959 if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
1960 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
1961 ob->tls_require_ciphers, &state, errstr)) != OK)
1965 int dh_min_bits = ob->tls_dh_min_bits;
1966 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1969 debug_printf("WARNING: tls_dh_min_bits far too low,"
1970 " clamping %d up to %d\n",
1971 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1972 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1975 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
1976 " acceptable bits to %d\n",
1978 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1981 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
1982 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
1983 the specified host patterns if one of them is defined */
1985 if ( ( state->exp_tls_verify_certificates
1986 && !ob->tls_verify_hosts
1987 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
1989 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
1992 tls_client_setup_hostname_checks(host, state, ob);
1994 debug_printf("TLS: server certificate verification required.\n");
1995 state->verify_requirement = VERIFY_REQUIRED;
1996 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1998 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
2000 tls_client_setup_hostname_checks(host, state, ob);
2002 debug_printf("TLS: server certificate verification optional.\n");
2003 state->verify_requirement = VERIFY_OPTIONAL;
2004 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2009 debug_printf("TLS: server certificate verification not required.\n");
2010 state->verify_requirement = VERIFY_NONE;
2011 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2014 #ifndef DISABLE_OCSP
2015 /* supported since GnuTLS 3.1.3 */
2018 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2019 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2020 NULL, 0, NULL)) != OK)
2021 return tls_error(US"cert-status-req",
2022 gnutls_strerror(rc), state->host, errstr);
2023 tls_out.ocsp = OCSP_NOT_RESP;
2027 #ifndef DISABLE_EVENT
2028 if (tb->event_action)
2030 state->event_action = tb->event_action;
2031 gnutls_session_set_ptr(state->session, state);
2032 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2036 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
2040 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2041 /* There doesn't seem to be a built-in timeout on connection. */
2043 sigalrm_seen = FALSE;
2044 alarm(ob->command_timeout);
2047 rc = gnutls_handshake(state->session);
2048 } while ((rc == GNUTLS_E_AGAIN) ||
2049 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
2052 if (rc != GNUTLS_E_SUCCESS)
2055 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
2056 return tls_error(US"gnutls_handshake", "timed out", state->host, errstr);
2059 return tls_error(US"gnutls_handshake", gnutls_strerror(rc), state->host, errstr);
2061 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2065 if (state->verify_requirement != VERIFY_NONE &&
2066 !verify_certificate(state, errstr))
2067 return tls_error(US"certificate verification failed", *errstr, state->host, errstr);
2069 #ifndef DISABLE_OCSP
2074 gnutls_datum_t stapling;
2075 gnutls_ocsp_resp_t resp;
2076 gnutls_datum_t printed;
2077 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2078 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2079 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2080 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2083 debug_printf("%.4096s", printed.data);
2084 gnutls_free(printed.data);
2087 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host, errstr);
2090 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
2092 tls_out.ocsp = OCSP_FAILED;
2093 return tls_error(US"certificate status check failed", NULL, state->host, errstr);
2095 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
2096 tls_out.ocsp = OCSP_VFIED;
2100 /* Figure out peer DN, and if authenticated, etc. */
2102 if ((rc = peer_status(state, errstr)) != OK)
2105 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
2107 extract_exim_vars_from_tls_state(state);
2115 /*************************************************
2116 * Close down a TLS session *
2117 *************************************************/
2119 /* This is also called from within a delivery subprocess forked from the
2120 daemon, to shut down the TLS library, without actually doing a shutdown (which
2121 would tamper with the TLS session in the parent process).
2123 Arguments: TRUE if gnutls_bye is to be called
2128 tls_close(BOOL is_server, BOOL shutdown)
2130 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2132 if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
2136 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
2137 gnutls_bye(state->session, GNUTLS_SHUT_WR);
2140 gnutls_deinit(state->session);
2141 gnutls_certificate_free_credentials(state->x509_cred);
2144 state->tlsp->active = -1;
2145 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2147 if ((state_server.session == NULL) && (state_client.session == NULL))
2149 gnutls_global_deinit();
2150 exim_gnutls_base_init_done = FALSE;
2157 /*************************************************
2158 * TLS version of getc *
2159 *************************************************/
2161 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2162 it refills the buffer via the GnuTLS reading function.
2163 Only used by the server-side TLS.
2165 This feeds DKIM and should be used for all message-body reads.
2167 Arguments: lim Maximum amount to read/bufffer
2168 Returns: the next character or EOF
2172 tls_getc(unsigned lim)
2174 exim_gnutls_state_st *state = &state_server;
2175 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2179 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2180 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2182 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2183 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2184 MIN(ssl_xfer_buffer_size, lim));
2187 /* Timeouts do not get this far; see command_timeout_handler().
2188 A zero-byte return appears to mean that the TLS session has been
2189 closed down, not that the socket itself has been closed down. Revert to
2190 non-TLS handling. */
2194 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
2195 state->xfer_error = 1;
2199 else if (inbytes == 0)
2201 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2203 receive_getc = smtp_getc;
2204 receive_get_cache = smtp_get_cache;
2205 receive_ungetc = smtp_ungetc;
2206 receive_feof = smtp_feof;
2207 receive_ferror = smtp_ferror;
2208 receive_smtp_buffered = smtp_buffered;
2210 gnutls_deinit(state->session);
2211 gnutls_certificate_free_credentials(state->x509_cred);
2213 state->session = NULL;
2214 state->tlsp->active = -1;
2215 state->tlsp->bits = 0;
2216 state->tlsp->certificate_verified = FALSE;
2217 tls_channelbinding_b64 = NULL;
2218 state->tlsp->cipher = NULL;
2219 state->tlsp->peercert = NULL;
2220 state->tlsp->peerdn = NULL;
2222 return smtp_getc(lim);
2225 /* Handle genuine errors */
2227 else if (inbytes < 0)
2229 record_io_error(state, (int) inbytes, US"recv", NULL);
2230 state->xfer_error = 1;
2233 #ifndef DISABLE_DKIM
2234 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2236 state->xfer_buffer_hwm = (int) inbytes;
2237 state->xfer_buffer_lwm = 0;
2240 /* Something in the buffer; return next uschar */
2242 return state->xfer_buffer[state->xfer_buffer_lwm++];
2248 #ifndef DISABLE_DKIM
2249 exim_gnutls_state_st * state = &state_server;
2250 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2252 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
2259 /*************************************************
2260 * Read bytes from TLS channel *
2261 *************************************************/
2263 /* This does not feed DKIM, so if the caller uses this for reading message body,
2264 then the caller must feed DKIM.
2270 Returns: the number of bytes read
2271 -1 after a failed read
2275 tls_read(BOOL is_server, uschar *buff, size_t len)
2277 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2283 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2285 debug_printf("*** PROBABLY A BUG *** " \
2286 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2287 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2290 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2291 state->session, buff, len);
2293 inbytes = gnutls_record_recv(state->session, buff, len);
2294 if (inbytes > 0) return inbytes;
2297 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2299 else record_io_error(state, (int)inbytes, US"recv", NULL);
2307 /*************************************************
2308 * Write bytes down TLS channel *
2309 *************************************************/
2313 is_server channel specifier
2317 Returns: the number of bytes after a successful write,
2318 -1 after a failed write
2322 tls_write(BOOL is_server, const uschar *buff, size_t len)
2326 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2328 DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
2331 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2333 outbytes = gnutls_record_send(state->session, buff, left);
2335 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
2338 record_io_error(state, outbytes, US"send", NULL);
2343 record_io_error(state, 0, US"send", US"TLS channel closed on write");
2354 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2365 /*************************************************
2366 * Random number generation *
2367 *************************************************/
2369 /* Pseudo-random number generation. The result is not expected to be
2370 cryptographically strong but not so weak that someone will shoot themselves
2371 in the foot using it as a nonce in input in some email header scheme or
2372 whatever weirdness they'll twist this into. The result should handle fork()
2373 and avoid repeating sequences. OpenSSL handles that for us.
2377 Returns a random number in range [0, max-1]
2380 #ifdef HAVE_GNUTLS_RND
2382 vaguely_random_number(int max)
2387 uschar smallbuf[sizeof(r)];
2392 needed_len = sizeof(r);
2393 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2394 * asked for a number less than 10. */
2395 for (r = max, i = 0; r; ++i)
2401 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2404 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2405 return vaguely_random_number_fallback(max);
2408 for (p = smallbuf; needed_len; --needed_len, ++p)
2414 /* We don't particularly care about weighted results; if someone wants
2415 * smooth distribution and cares enough then they should submit a patch then. */
2418 #else /* HAVE_GNUTLS_RND */
2420 vaguely_random_number(int max)
2422 return vaguely_random_number_fallback(max);
2424 #endif /* HAVE_GNUTLS_RND */
2429 /*************************************************
2430 * Let tls_require_ciphers be checked at startup *
2431 *************************************************/
2433 /* The tls_require_ciphers option, if set, must be something which the
2436 Returns: NULL on success, or error message
2440 tls_validate_require_cipher(void)
2443 uschar *expciphers = NULL;
2444 gnutls_priority_t priority_cache;
2446 uschar * dummy_errstr;
2448 #define validate_check_rc(Label) do { \
2449 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2450 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2451 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2453 if (exim_gnutls_base_init_done)
2454 log_write(0, LOG_MAIN|LOG_PANIC,
2455 "already initialised GnuTLS, Exim developer bug");
2457 #ifdef HAVE_GNUTLS_PKCS11
2458 if (!gnutls_allow_auto_pkcs11)
2460 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2461 validate_check_rc(US"gnutls_pkcs11_init");
2464 rc = gnutls_global_init();
2465 validate_check_rc(US"gnutls_global_init()");
2466 exim_gnutls_base_init_done = TRUE;
2468 if (!(tls_require_ciphers && *tls_require_ciphers))
2469 return_deinit(NULL);
2471 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
2473 return_deinit(US"failed to expand tls_require_ciphers");
2475 if (!(expciphers && *expciphers))
2476 return_deinit(NULL);
2479 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2481 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2482 validate_check_rc(string_sprintf(
2483 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2484 expciphers, errpos - CS expciphers, errpos));
2486 #undef return_deinit
2487 #undef validate_check_rc
2488 gnutls_global_deinit();
2496 /*************************************************
2497 * Report the library versions. *
2498 *************************************************/
2500 /* See a description in tls-openssl.c for an explanation of why this exists.
2502 Arguments: a FILE* to print the results to
2507 tls_version_report(FILE *f)
2509 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2512 gnutls_check_version(NULL));
2517 /* End of tls-gnu.c */