1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2017 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42 /* needed to disable PKCS11 autoload unless requested */
43 #if GNUTLS_VERSION_NUMBER >= 0x020c00
44 # include <gnutls/pkcs11.h>
45 # define SUPPORT_PARAM_TO_PK_BITS
47 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
48 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
51 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
52 # warning "GnuTLS library version too old; tls:cert event unsupported"
53 # define DISABLE_EVENT
55 #if GNUTLS_VERSION_NUMBER >= 0x030306
56 # define SUPPORT_CA_DIR
58 # undef SUPPORT_CA_DIR
60 #if GNUTLS_VERSION_NUMBER >= 0x030014
61 # define SUPPORT_SYSDEFAULT_CABUNDLE
63 #if GNUTLS_VERSION_NUMBER >= 0x030109
66 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
67 # define SUPPORT_SRV_OCSP_STACK
69 #if GNUTLS_VERSION_NUMBER >= 0x030000 && defined(EXPERIMENTAL_DANE)
74 # include <gnutls/ocsp.h>
77 # include <gnutls/dane.h>
83 gnutls_global_set_audit_log_function()
86 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
89 /* Local static variables for GnuTLS */
91 /* Values for verify_requirement */
93 enum peer_verify_requirement
94 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
96 /* This holds most state for server or client; with this, we can set up an
97 outbound TLS-enabled connection in an ACL callout, while not stomping all
98 over the TLS variables available for expansion.
100 Some of these correspond to variables in globals.c; those variables will
101 be set to point to content in one of these instances, as appropriate for
102 the stage of the process lifetime.
104 Not handled here: global tls_channelbinding_b64.
107 typedef struct exim_gnutls_state {
108 gnutls_session_t session;
109 gnutls_certificate_credentials_t x509_cred;
110 gnutls_priority_t priority_cache;
111 enum peer_verify_requirement verify_requirement;
114 BOOL peer_cert_verified;
115 BOOL peer_dane_verified;
116 BOOL trigger_sni_changes;
117 BOOL have_set_peerdn;
118 const struct host_item *host;
119 gnutls_x509_crt_t peercert;
122 uschar *received_sni;
124 const uschar *tls_certificate;
125 const uschar *tls_privatekey;
126 const uschar *tls_sni; /* client send only, not received */
127 const uschar *tls_verify_certificates;
128 const uschar *tls_crl;
129 const uschar *tls_require_ciphers;
131 uschar *exp_tls_certificate;
132 uschar *exp_tls_privatekey;
133 uschar *exp_tls_verify_certificates;
135 uschar *exp_tls_require_ciphers;
136 const uschar *exp_tls_verify_cert_hostnames;
137 #ifndef DISABLE_EVENT
138 uschar *event_action;
141 char * const * dane_data;
142 const int * dane_data_len;
145 tls_support *tlsp; /* set in tls_init() */
152 } exim_gnutls_state_st;
154 static const exim_gnutls_state_st exim_gnutls_state_init = {
157 .priority_cache = NULL,
158 .verify_requirement = VERIFY_NONE,
161 .peer_cert_verified = FALSE,
162 .peer_dane_verified = FALSE,
163 .trigger_sni_changes =FALSE,
164 .have_set_peerdn = FALSE,
169 .received_sni = NULL,
171 .tls_certificate = NULL,
172 .tls_privatekey = NULL,
174 .tls_verify_certificates = NULL,
176 .tls_require_ciphers =NULL,
178 .exp_tls_certificate = NULL,
179 .exp_tls_privatekey = NULL,
180 .exp_tls_verify_certificates = NULL,
182 .exp_tls_require_ciphers = NULL,
183 .exp_tls_verify_cert_hostnames = NULL,
184 #ifndef DISABLE_EVENT
185 .event_action = NULL,
190 .xfer_buffer_lwm = 0,
191 .xfer_buffer_hwm = 0,
196 /* Not only do we have our own APIs which don't pass around state, assuming
197 it's held in globals, GnuTLS doesn't appear to let us register callback data
198 for callbacks, or as part of the session, so we have to keep a "this is the
199 context we're currently dealing with" pointer and rely upon being
200 single-threaded to keep from processing data on an inbound TLS connection while
201 talking to another TLS connection for an outbound check. This does mean that
202 there's no way for heart-beats to be responded to, for the duration of the
204 XXX But see gnutls_session_get_ptr()
207 static exim_gnutls_state_st state_server, state_client;
209 /* dh_params are initialised once within the lifetime of a process using TLS;
210 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
211 don't want to repeat this. */
213 static gnutls_dh_params_t dh_server_params = NULL;
215 /* No idea how this value was chosen; preserving it. Default is 3600. */
217 static const int ssl_session_timeout = 200;
219 static const char * const exim_default_gnutls_priority = "NORMAL";
221 /* Guard library core initialisation */
223 static BOOL exim_gnutls_base_init_done = FALSE;
226 static BOOL gnutls_buggy_ocsp = FALSE;
230 /* ------------------------------------------------------------------------ */
233 #define MAX_HOST_LEN 255
235 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
236 the library logging; a value less than 0 disables the calls to set up logging
237 callbacks. Possibly GNuTLS also looks for an environment variable
238 "GNUTLS_DEBUG_LEVEL". */
239 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
240 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
243 #ifndef EXIM_CLIENT_DH_MIN_BITS
244 # define EXIM_CLIENT_DH_MIN_BITS 1024
247 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
248 can ask for a bit-strength. Without that, we stick to the constant we had
250 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
251 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
254 #define exim_gnutls_err_check(rc, Label) do { \
255 if ((rc) != GNUTLS_E_SUCCESS) \
256 return tls_error((Label), gnutls_strerror(rc), host, errstr); \
259 #define expand_check_tlsvar(Varname, errstr) \
260 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
262 #if GNUTLS_VERSION_NUMBER >= 0x020c00
263 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
264 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
265 # define HAVE_GNUTLS_RND
266 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
267 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
268 * isn't available sometimes, so this needs to become a conditional
269 * compilation; the sanest way to deal with this being a problem on
270 * older OSes is to block it in the Local/Makefile with this compiler
272 # ifndef AVOID_GNUTLS_PKCS11
273 # define HAVE_GNUTLS_PKCS11
274 # endif /* AVOID_GNUTLS_PKCS11 */
280 /* ------------------------------------------------------------------------ */
281 /* Callback declarations */
283 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
284 static void exim_gnutls_logger_cb(int level, const char *message);
287 static int exim_sni_handling_cb(gnutls_session_t session);
290 static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
291 gnutls_datum_t * ocsp_response);
296 /* ------------------------------------------------------------------------ */
297 /* Static functions */
299 /*************************************************
301 *************************************************/
303 /* Called from lots of places when errors occur before actually starting to do
304 the TLS handshake, that is, while the session is still in clear. Always returns
305 DEFER for a server and FAIL for a client so that most calls can use "return
306 tls_error(...)" to do this processing and then give an appropriate return. A
307 single function is used for both server and client, because it is called from
308 some shared functions.
311 prefix text to include in the logged error
312 msg additional error string (may be NULL)
313 usually obtained from gnutls_strerror()
314 host NULL if setting up a server;
315 the connected host if setting up a client
316 errstr pointer to returned error string
318 Returns: OK/DEFER/FAIL
322 tls_error(const uschar *prefix, const char *msg, const host_item *host,
326 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : "");
327 return host ? FAIL : DEFER;
333 /*************************************************
334 * Deal with logging errors during I/O *
335 *************************************************/
337 /* We have to get the identity of the peer from saved data.
340 state the current GnuTLS exim state container
341 rc the GnuTLS error code, or 0 if it's a local error
342 when text identifying read or write
343 text local error text when ec is 0
349 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
354 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
355 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
356 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
358 msg = gnutls_strerror(rc);
360 (void) tls_error(when, msg, state->host, &errstr);
363 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
364 state->host->name, state->host->address, errstr);
367 uschar * conn_info = smtp_get_connection_info();
368 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
369 /* I'd like to get separated H= here, but too hard for now */
370 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
377 /*************************************************
378 * Set various Exim expansion vars *
379 *************************************************/
381 #define exim_gnutls_cert_err(Label) \
384 if (rc != GNUTLS_E_SUCCESS) \
386 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
387 (Label), gnutls_strerror(rc)); \
393 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
397 rc = gnutls_x509_crt_init(crtp);
398 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
400 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
401 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
406 #undef exim_gnutls_cert_err
409 /* We set various Exim global variables from the state, once a session has
410 been established. With TLS callouts, may need to change this to stack
411 variables, or just re-call it with the server state after client callout
414 Make sure anything set here is unset in tls_getc().
418 tls_bits strength indicator
419 tls_certificate_verified bool indicator
420 tls_channelbinding_b64 for some SASL mechanisms
422 tls_peercert pointer to library internal
424 tls_sni a (UTF-8) string
425 tls_ourcert pointer to library internal
428 state the relevant exim_gnutls_state_st *
432 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
434 gnutls_cipher_algorithm_t cipher;
435 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
438 gnutls_datum_t channel;
440 tls_support * tlsp = state->tlsp;
442 tlsp->active = state->fd_out;
444 cipher = gnutls_cipher_get(state->session);
445 /* returns size in "bytes" */
446 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
448 tlsp->cipher = state->ciphersuite;
450 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
452 tlsp->certificate_verified = state->peer_cert_verified;
454 tlsp->dane_verified = state->peer_dane_verified;
457 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
458 only available for use for authenticators while this TLS session is running. */
460 tls_channelbinding_b64 = NULL;
461 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
464 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
466 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
468 old_pool = store_pool;
469 store_pool = POOL_PERM;
470 tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
471 store_pool = old_pool;
472 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
476 /* peercert is set in peer_status() */
477 tlsp->peerdn = state->peerdn;
478 tlsp->sni = state->received_sni;
480 /* record our certificate */
482 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
483 gnutls_x509_crt_t crt;
485 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
492 /*************************************************
493 * Setup up DH parameters *
494 *************************************************/
496 /* Generating the D-H parameters may take a long time. They only need to
497 be re-generated every so often, depending on security policy. What we do is to
498 keep these parameters in a file in the spool directory. If the file does not
499 exist, we generate them. This means that it is easy to cause a regeneration.
501 The new file is written as a temporary file and renamed, so that an incomplete
502 file is never present. If two processes both compute some new parameters, you
503 waste a bit of effort, but it doesn't seem worth messing around with locking to
506 Returns: OK/DEFER/FAIL
510 init_server_dh(uschar ** errstr)
513 unsigned int dh_bits;
515 uschar filename_buf[PATH_MAX];
516 uschar *filename = NULL;
518 uschar *exp_tls_dhparam;
519 BOOL use_file_in_spool = FALSE;
520 BOOL use_fixed_file = FALSE;
521 host_item *host = NULL; /* dummy for macros */
523 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
525 rc = gnutls_dh_params_init(&dh_server_params);
526 exim_gnutls_err_check(rc, US"gnutls_dh_params_init");
531 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
534 if (!exp_tls_dhparam)
536 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
537 m.data = US std_dh_prime_default();
538 m.size = Ustrlen(m.data);
540 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
541 use_file_in_spool = TRUE;
542 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
544 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
547 else if (exp_tls_dhparam[0] != '/')
549 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
550 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL, errstr);
551 m.size = Ustrlen(m.data);
555 use_fixed_file = TRUE;
556 filename = exp_tls_dhparam;
561 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
562 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
563 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
567 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
568 /* If you change this constant, also change dh_param_fn_ext so that we can use a
569 different filename and ensure we have sufficient bits. */
570 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
572 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
574 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
577 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
579 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
583 /* Some clients have hard-coded limits. */
584 if (dh_bits > tls_dh_max_bits)
587 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
589 dh_bits = tls_dh_max_bits;
592 if (use_file_in_spool)
594 if (!string_format(filename_buf, sizeof(filename_buf),
595 "%s/gnutls-params-%d", spool_directory, dh_bits))
596 return tls_error(US"overlong filename", NULL, NULL, errstr);
597 filename = filename_buf;
600 /* Open the cache file for reading and if successful, read it and set up the
603 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
609 if (fstat(fd, &statbuf) < 0) /* EIO */
613 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL, errstr);
615 if (!S_ISREG(statbuf.st_mode))
618 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
620 if (!(fp = fdopen(fd, "rb")))
624 return tls_error(US"fdopen(TLS cache stat fd) failed",
625 strerror(saved_errno), NULL, errstr);
628 m.size = statbuf.st_size;
629 if (!(m.data = malloc(m.size)))
632 return tls_error(US"malloc failed", strerror(errno), NULL, errstr);
634 if (!(sz = fread(m.data, m.size, 1, fp)))
639 return tls_error(US"fread failed", strerror(saved_errno), NULL, errstr);
643 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
645 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
646 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
649 /* If the file does not exist, fall through to compute new data and cache it.
650 If there was any other opening error, it is serious. */
652 else if (errno == ENOENT)
656 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
659 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
662 /* If ret < 0, either the cache file does not exist, or the data it contains
663 is not useful. One particular case of this is when upgrading from an older
664 release of Exim in which the data was stored in a different format. We don't
665 try to be clever and support both formats; we just regenerate new data in this
671 unsigned int dh_bits_gen = dh_bits;
673 if ((PATH_MAX - Ustrlen(filename)) < 10)
674 return tls_error(US"Filename too long to generate replacement",
675 CS filename, NULL, errstr);
677 temp_fn = string_copy(US "%s.XXXXXXX");
678 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
679 return tls_error(US"Unable to open temp file", strerror(errno), NULL, errstr);
680 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
682 /* GnuTLS overshoots!
683 * If we ask for 2236, we might get 2237 or more.
684 * But there's no way to ask GnuTLS how many bits there really are.
685 * We can ask how many bits were used in a TLS session, but that's it!
686 * The prime itself is hidden behind too much abstraction.
687 * So we ask for less, and proceed on a wing and a prayer.
688 * First attempt, subtracted 3 for 2233 and got 2240.
690 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
692 dh_bits_gen = dh_bits - 10;
694 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
699 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
701 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
702 exim_gnutls_err_check(rc, US"gnutls_dh_params_generate2");
704 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
705 and I confirmed that a NULL call to get the size first is how the GnuTLS
706 sample apps handle this. */
710 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
712 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
713 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3(NULL) sizing");
715 if (!(m.data = malloc(m.size)))
716 return tls_error(US"memory allocation failed", strerror(errno), NULL, errstr);
718 /* this will return a size 1 less than the allocation size above */
719 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
721 if (rc != GNUTLS_E_SUCCESS)
724 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3() real");
726 m.size = sz; /* shrink by 1, probably */
728 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
731 return tls_error(US"TLS cache write D-H params failed",
732 strerror(errno), NULL, errstr);
735 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
736 return tls_error(US"TLS cache write D-H params final newline failed",
737 strerror(errno), NULL, errstr);
739 if ((rc = close(fd)))
740 return tls_error(US"TLS cache write close() failed", strerror(errno), NULL, errstr);
742 if (Urename(temp_fn, filename) < 0)
743 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
744 temp_fn, filename), strerror(errno), NULL, errstr);
746 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
749 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
756 /* Create and install a selfsigned certificate, for use in server mode */
759 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
761 gnutls_x509_crt_t cert = NULL;
763 gnutls_x509_privkey_t pkey = NULL;
764 const uschar * where;
767 where = US"initialising pkey";
768 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
770 where = US"initialising cert";
771 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
773 where = US"generating pkey";
774 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
775 #ifdef SUPPORT_PARAM_TO_PK_BITS
776 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_LOW),
783 where = US"configuring cert";
785 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
786 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
787 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
788 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
789 || (rc = gnutls_x509_crt_set_key(cert, pkey))
791 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
792 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
793 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
794 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
795 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
796 GNUTLS_OID_X520_COMMON_NAME, 0,
797 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
801 where = US"signing cert";
802 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
804 where = US"installing selfsign cert";
806 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
812 if (cert) gnutls_x509_crt_deinit(cert);
813 if (pkey) gnutls_x509_privkey_deinit(pkey);
817 rc = tls_error(where, gnutls_strerror(rc), NULL, errstr);
824 /* Add certificate and key, from files.
827 Zero or negative: good. Negate value for certificate index if < 0.
828 Greater than zero: FAIL or DEFER code.
832 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
833 uschar * certfile, uschar * keyfile, uschar ** errstr)
835 int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
836 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
839 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
840 gnutls_strerror(rc), host, errstr);
845 /*************************************************
846 * Variables re-expanded post-SNI *
847 *************************************************/
849 /* Called from both server and client code, via tls_init(), and also from
850 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
852 We can tell the two apart by state->received_sni being non-NULL in callback.
854 The callback should not call us unless state->trigger_sni_changes is true,
855 which we are responsible for setting on the first pass through.
858 state exim_gnutls_state_st *
859 errstr error string pointer
861 Returns: OK/DEFER/FAIL
865 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
869 const host_item *host = state->host; /* macro should be reconsidered? */
870 uschar *saved_tls_certificate = NULL;
871 uschar *saved_tls_privatekey = NULL;
872 uschar *saved_tls_verify_certificates = NULL;
873 uschar *saved_tls_crl = NULL;
876 /* We check for tls_sni *before* expansion. */
877 if (!host) /* server */
878 if (!state->received_sni)
880 if ( state->tls_certificate
881 && ( Ustrstr(state->tls_certificate, US"tls_sni")
882 || Ustrstr(state->tls_certificate, US"tls_in_sni")
883 || Ustrstr(state->tls_certificate, US"tls_out_sni")
886 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
887 state->trigger_sni_changes = TRUE;
892 /* useful for debugging */
893 saved_tls_certificate = state->exp_tls_certificate;
894 saved_tls_privatekey = state->exp_tls_privatekey;
895 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
896 saved_tls_crl = state->exp_tls_crl;
899 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
900 exim_gnutls_err_check(rc, US"gnutls_certificate_allocate_credentials");
902 #ifdef SUPPORT_SRV_OCSP_STACK
903 gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
906 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
907 state members, assuming consistent naming; and expand_check() returns
908 false if expansion failed, unless expansion was forced to fail. */
910 /* check if we at least have a certificate, before doing expensive
913 if (!expand_check_tlsvar(tls_certificate, errstr))
916 /* certificate is mandatory in server, optional in client */
918 if ( !state->exp_tls_certificate
919 || !*state->exp_tls_certificate
922 return tls_install_selfsign(state, errstr);
924 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
926 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
929 /* tls_privatekey is optional, defaulting to same file as certificate */
931 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
933 state->tls_privatekey = state->tls_certificate;
934 state->exp_tls_privatekey = state->exp_tls_certificate;
938 if (state->exp_tls_certificate && *state->exp_tls_certificate)
940 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
941 state->exp_tls_certificate, state->exp_tls_privatekey);
943 if (state->received_sni)
944 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
945 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
948 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
952 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
955 if (!host) /* server */
957 const uschar * clist = state->exp_tls_certificate;
958 const uschar * klist = state->exp_tls_privatekey;
959 const uschar * olist;
960 int csep = 0, ksep = 0, osep = 0, cnt = 0;
961 uschar * cfile, * kfile, * ofile;
964 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
969 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
971 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
972 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
973 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
977 int gnutls_cert_index = -rc;
978 DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile);
980 /* Set the OCSP stapling server info */
984 if (gnutls_buggy_ocsp)
987 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
989 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
991 /* Use the full callback method for stapling just to get
992 observability. More efficient would be to read the file once only,
993 if it never changed (due to SNI). Would need restart on file update,
994 or watch datestamp. */
996 # ifdef SUPPORT_SRV_OCSP_STACK
997 rc = gnutls_certificate_set_ocsp_status_request_function2(
998 state->x509_cred, gnutls_cert_index,
999 server_ocsp_stapling_cb, ofile);
1001 exim_gnutls_err_check(rc,
1002 US"gnutls_certificate_set_ocsp_status_request_function2");
1007 debug_printf("oops; multiple OCSP files not supported\n");
1010 gnutls_certificate_set_ocsp_status_request_function(
1011 state->x509_cred, server_ocsp_stapling_cb, ofile);
1014 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile);
1017 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1023 if (0 < (rc = tls_add_certfile(state, host,
1024 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1026 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1029 } /* tls_certificate */
1032 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1033 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1034 error message is provided. However, if we just refrain from setting anything up
1035 in that case, certificate verification fails, which seems to be the correct
1038 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1040 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
1042 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1043 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1044 state->exp_tls_verify_certificates = NULL;
1046 if (state->tls_crl && *state->tls_crl)
1047 if (!expand_check_tlsvar(tls_crl, errstr))
1050 if (!(state->exp_tls_verify_certificates &&
1051 *state->exp_tls_verify_certificates))
1054 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1055 /* With no tls_verify_certificates, we ignore tls_crl too */
1062 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1066 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1067 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1068 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1072 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1074 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1075 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1080 #ifndef SUPPORT_CA_DIR
1081 /* The test suite passes in /dev/null; we could check for that path explicitly,
1082 but who knows if someone has some weird FIFO which always dumps some certs, or
1083 other weirdness. The thing we really want to check is that it's not a
1084 directory, since while OpenSSL supports that, GnuTLS does not.
1085 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1086 if (S_ISDIR(statbuf.st_mode))
1089 debug_printf("verify certificates path is a dir: \"%s\"\n",
1090 state->exp_tls_verify_certificates);
1091 log_write(0, LOG_MAIN|LOG_PANIC,
1092 "tls_verify_certificates \"%s\" is a directory",
1093 state->exp_tls_verify_certificates);
1098 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1099 state->exp_tls_verify_certificates, statbuf.st_size);
1101 if (statbuf.st_size == 0)
1104 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1110 #ifdef SUPPORT_CA_DIR
1111 (statbuf.st_mode & S_IFMT) == S_IFDIR
1113 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1114 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1117 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1118 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1124 exim_gnutls_err_check(rc, US"setting certificate trust");
1126 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
1128 if (state->tls_crl && *state->tls_crl &&
1129 state->exp_tls_crl && *state->exp_tls_crl)
1131 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1132 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1133 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1137 exim_gnutls_err_check(rc, US"gnutls_certificate_set_x509_crl_file");
1139 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1148 /*************************************************
1149 * Set X.509 state variables *
1150 *************************************************/
1152 /* In GnuTLS, the registered cert/key are not replaced by a later
1153 set of a cert/key, so for SNI support we need a whole new x509_cred
1154 structure. Which means various other non-re-expanded pieces of state
1155 need to be re-set in the new struct, so the setting logic is pulled
1159 state exim_gnutls_state_st *
1160 errstr error string pointer
1162 Returns: OK/DEFER/FAIL
1166 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1169 const host_item *host = state->host; /* macro should be reconsidered? */
1171 /* Create D-H parameters, or read them from the cache file. This function does
1172 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1173 client-side params. */
1177 if (!dh_server_params)
1179 rc = init_server_dh(errstr);
1180 if (rc != OK) return rc;
1182 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1185 /* Link the credentials to the session. */
1187 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1188 exim_gnutls_err_check(rc, US"gnutls_credentials_set");
1193 /*************************************************
1194 * Initialize for GnuTLS *
1195 *************************************************/
1198 #ifndef DISABLE_OCSP
1201 tls_is_buggy_ocsp(void)
1204 uschar maj, mid, mic;
1206 s = CUS gnutls_check_version(NULL);
1210 while (*s && *s != '.') s++;
1211 mid = atoi(CCS ++s);
1218 while (*s && *s != '.') s++;
1219 mic = atoi(CCS ++s);
1220 return mic <= (mid == 3 ? 16 : 3);
1229 /* Called from both server and client code. In the case of a server, errors
1230 before actual TLS negotiation return DEFER.
1233 host connected host, if client; NULL if server
1234 certificate certificate file
1235 privatekey private key file
1236 sni TLS SNI to send, sometimes when client; else NULL
1239 require_ciphers tls_require_ciphers setting
1240 caller_state returned state-info structure
1241 errstr error string pointer
1243 Returns: OK/DEFER/FAIL
1248 const host_item *host,
1249 const uschar *certificate,
1250 const uschar *privatekey,
1254 const uschar *require_ciphers,
1255 exim_gnutls_state_st **caller_state,
1258 exim_gnutls_state_st *state;
1263 BOOL want_default_priorities;
1265 if (!exim_gnutls_base_init_done)
1267 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1269 #ifdef HAVE_GNUTLS_PKCS11
1270 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1271 which loads modules from a config file, which sounds good and may be wanted
1272 by some sysadmin, but also means in common configurations that GNOME keyring
1273 environment variables are used and so breaks for users calling mailq.
1274 To prevent this, we init PKCS11 first, which is the documented approach. */
1275 if (!gnutls_allow_auto_pkcs11)
1277 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1278 exim_gnutls_err_check(rc, US"gnutls_pkcs11_init");
1282 rc = gnutls_global_init();
1283 exim_gnutls_err_check(rc, US"gnutls_global_init");
1285 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1288 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1289 /* arbitrarily chosen level; bump upto 9 for more */
1290 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1294 #ifndef DISABLE_OCSP
1295 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1296 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1299 exim_gnutls_base_init_done = TRUE;
1304 state = &state_client;
1305 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1306 state->tlsp = &tls_out;
1307 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1308 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1312 state = &state_server;
1313 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1314 state->tlsp = &tls_in;
1315 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1316 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1318 exim_gnutls_err_check(rc, US"gnutls_init");
1322 state->tls_certificate = certificate;
1323 state->tls_privatekey = privatekey;
1324 state->tls_require_ciphers = require_ciphers;
1325 state->tls_sni = sni;
1326 state->tls_verify_certificates = cas;
1327 state->tls_crl = crl;
1329 /* This handles the variables that might get re-expanded after TLS SNI;
1330 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1333 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1334 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1336 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1337 requires a new structure afterwards. */
1339 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
1341 /* set SNI in client, only */
1344 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
1346 if (state->tlsp->sni && *state->tlsp->sni)
1349 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1350 sz = Ustrlen(state->tlsp->sni);
1351 rc = gnutls_server_name_set(state->session,
1352 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
1353 exim_gnutls_err_check(rc, US"gnutls_server_name_set");
1356 else if (state->tls_sni)
1357 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1358 "have an SNI set for a server [%s]\n", state->tls_sni);
1360 /* This is the priority string support,
1361 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1362 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1363 This was backwards incompatible, but means Exim no longer needs to track
1364 all algorithms and provide string forms for them. */
1366 want_default_priorities = TRUE;
1368 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1370 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
1372 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1374 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1375 state->exp_tls_require_ciphers);
1377 rc = gnutls_priority_init(&state->priority_cache,
1378 CS state->exp_tls_require_ciphers, &errpos);
1379 want_default_priorities = FALSE;
1380 p = state->exp_tls_require_ciphers;
1383 if (want_default_priorities)
1386 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1387 exim_default_gnutls_priority);
1388 rc = gnutls_priority_init(&state->priority_cache,
1389 exim_default_gnutls_priority, &errpos);
1390 p = US exim_default_gnutls_priority;
1393 exim_gnutls_err_check(rc, string_sprintf(
1394 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1395 p, errpos - CS p, errpos));
1397 rc = gnutls_priority_set(state->session, state->priority_cache);
1398 exim_gnutls_err_check(rc, US"gnutls_priority_set");
1400 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1402 /* Reduce security in favour of increased compatibility, if the admin
1403 decides to make that trade-off. */
1404 if (gnutls_compat_mode)
1406 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1407 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1408 gnutls_session_enable_compatibility_mode(state->session);
1410 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1414 *caller_state = state;
1420 /*************************************************
1421 * Extract peer information *
1422 *************************************************/
1424 /* Called from both server and client code.
1425 Only this is allowed to set state->peerdn and state->have_set_peerdn
1426 and we use that to detect double-calls.
1428 NOTE: the state blocks last while the TLS connection is up, which is fine
1429 for logging in the server side, but for the client side, we log after teardown
1430 in src/deliver.c. While the session is up, we can twist about states and
1431 repoint tls_* globals, but those variables used for logging or other variable
1432 expansion that happens _after_ delivery need to have a longer life-time.
1434 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1435 doing this more than once per generation of a state context. We set them in
1436 the state context, and repoint tls_* to them. After the state goes away, the
1437 tls_* copies of the pointers remain valid and client delivery logging is happy.
1439 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1443 state exim_gnutls_state_st *
1444 errstr pointer to error string
1446 Returns: OK/DEFER/FAIL
1450 peer_status(exim_gnutls_state_st *state, uschar ** errstr)
1452 uschar cipherbuf[256];
1453 const gnutls_datum_t *cert_list;
1455 unsigned int cert_list_size = 0;
1456 gnutls_protocol_t protocol;
1457 gnutls_cipher_algorithm_t cipher;
1458 gnutls_kx_algorithm_t kx;
1459 gnutls_mac_algorithm_t mac;
1460 gnutls_certificate_type_t ct;
1461 gnutls_x509_crt_t crt;
1465 if (state->have_set_peerdn)
1467 state->have_set_peerdn = TRUE;
1469 state->peerdn = NULL;
1472 cipher = gnutls_cipher_get(state->session);
1473 protocol = gnutls_protocol_get_version(state->session);
1474 mac = gnutls_mac_get(state->session);
1475 kx = gnutls_kx_get(state->session);
1477 string_format(cipherbuf, sizeof(cipherbuf),
1479 gnutls_protocol_get_name(protocol),
1480 gnutls_cipher_suite_get_name(kx, cipher, mac),
1481 (int) gnutls_cipher_get_key_size(cipher) * 8);
1483 /* I don't see a way that spaces could occur, in the current GnuTLS
1484 code base, but it was a concern in the old code and perhaps older GnuTLS
1485 releases did return "TLS 1.0"; play it safe, just in case. */
1486 for (p = cipherbuf; *p != '\0'; ++p)
1489 old_pool = store_pool;
1490 store_pool = POOL_PERM;
1491 state->ciphersuite = string_copy(cipherbuf);
1492 store_pool = old_pool;
1493 state->tlsp->cipher = state->ciphersuite;
1496 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1498 if (cert_list == NULL || cert_list_size == 0)
1500 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1501 cert_list, cert_list_size);
1502 if (state->verify_requirement >= VERIFY_REQUIRED)
1503 return tls_error(US"certificate verification failed",
1504 "no certificate received from peer", state->host, errstr);
1508 ct = gnutls_certificate_type_get(state->session);
1509 if (ct != GNUTLS_CRT_X509)
1511 const char *ctn = gnutls_certificate_type_get_name(ct);
1513 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1514 if (state->verify_requirement >= VERIFY_REQUIRED)
1515 return tls_error(US"certificate verification not possible, unhandled type",
1516 ctn, state->host, errstr);
1520 #define exim_gnutls_peer_err(Label) \
1522 if (rc != GNUTLS_E_SUCCESS) \
1524 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1525 (Label), gnutls_strerror(rc)); \
1526 if (state->verify_requirement >= VERIFY_REQUIRED) \
1527 return tls_error((Label), gnutls_strerror(rc), state->host, errstr); \
1532 rc = import_cert(&cert_list[0], &crt);
1533 exim_gnutls_peer_err(US"cert 0");
1535 state->tlsp->peercert = state->peercert = crt;
1538 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1539 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1541 exim_gnutls_peer_err(US"getting size for cert DN failed");
1542 return FAIL; /* should not happen */
1544 dn_buf = store_get_perm(sz);
1545 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1546 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1548 state->peerdn = dn_buf;
1551 #undef exim_gnutls_peer_err
1557 /*************************************************
1558 * Verify peer certificate *
1559 *************************************************/
1561 /* Called from both server and client code.
1562 *Should* be using a callback registered with
1563 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1564 the peer information, but that's too new for some OSes.
1567 state exim_gnutls_state_st *
1568 errstr where to put an error message
1571 FALSE if the session should be rejected
1572 TRUE if the cert is okay or we just don't care
1576 verify_certificate(exim_gnutls_state_st *state, uschar ** errstr)
1581 if (state->verify_requirement == VERIFY_NONE)
1586 if ((rc = peer_status(state, errstr)) != OK)
1588 verify = GNUTLS_CERT_INVALID;
1589 *errstr = US"certificate not supplied";
1595 if (state->verify_requirement == VERIFY_DANE && state->host)
1597 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1598 including talking to a DNS resolver. But we want to do that bit ourselves
1599 as the testsuite intercepts and fakes its own DNS environment. */
1603 const gnutls_datum_t * certlist;
1606 certlist = gnutls_certificate_get_peers(state->session, &lsize);
1608 if ( (rc = dane_state_init(&s, 0))
1609 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1611 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1612 gnutls_certificate_type_get(state->session),
1617 *errstr = string_sprintf("TLSA record problem: %s", dane_strerror(rc));
1623 (void) dane_verification_status_print(verify, &str, 0);
1624 *errstr = US str.data; /* don't bother to free */
1627 state->peer_dane_verified = TRUE;
1631 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1634 /* Handle the result of verification. INVALID is set if any others are. */
1637 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1640 state->peer_cert_verified = FALSE;
1642 *errstr = verify & GNUTLS_CERT_REVOKED
1643 ? US"certificate revoked" : US"certificate invalid";
1646 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1647 *errstr, state->peerdn ? state->peerdn : US"<unset>");
1649 if (state->verify_requirement >= VERIFY_REQUIRED)
1652 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1657 if (state->exp_tls_verify_cert_hostnames)
1660 const uschar * list = state->exp_tls_verify_cert_hostnames;
1662 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1663 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1668 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1669 if (state->verify_requirement >= VERIFY_REQUIRED)
1674 state->peer_cert_verified = TRUE;
1675 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1676 state->peerdn ? state->peerdn : US"<unset>");
1679 state->tlsp->peerdn = state->peerdn;
1683 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1690 /* ------------------------------------------------------------------------ */
1693 /* Logging function which can be registered with
1694 * gnutls_global_set_log_function()
1695 * gnutls_global_set_log_level() 0..9
1697 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1699 exim_gnutls_logger_cb(int level, const char *message)
1701 size_t len = strlen(message);
1704 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1707 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1708 message[len-1] == '\n' ? "" : "\n");
1713 /* Called after client hello, should handle SNI work.
1714 This will always set tls_sni (state->received_sni) if available,
1715 and may trigger presenting different certificates,
1716 if state->trigger_sni_changes is TRUE.
1718 Should be registered with
1719 gnutls_handshake_set_post_client_hello_function()
1721 "This callback must return 0 on success or a gnutls error code to terminate the
1724 For inability to get SNI information, we return 0.
1725 We only return non-zero if re-setup failed.
1726 Only used for server-side TLS.
1730 exim_sni_handling_cb(gnutls_session_t session)
1732 char sni_name[MAX_HOST_LEN];
1733 size_t data_len = MAX_HOST_LEN;
1734 exim_gnutls_state_st *state = &state_server;
1735 unsigned int sni_type;
1737 uschar * dummy_errstr;
1739 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1740 if (rc != GNUTLS_E_SUCCESS)
1743 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1744 debug_printf("TLS: no SNI presented in handshake.\n");
1746 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1747 gnutls_strerror(rc), rc);
1752 if (sni_type != GNUTLS_NAME_DNS)
1754 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1758 /* We now have a UTF-8 string in sni_name */
1759 old_pool = store_pool;
1760 store_pool = POOL_PERM;
1761 state->received_sni = string_copyn(US sni_name, data_len);
1762 store_pool = old_pool;
1764 /* We set this one now so that variable expansions below will work */
1765 state->tlsp->sni = state->received_sni;
1767 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1768 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1770 if (!state->trigger_sni_changes)
1773 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
1775 /* If the setup of certs/etc failed before handshake, TLS would not have
1776 been offered. The best we can do now is abort. */
1777 return GNUTLS_E_APPLICATION_ERROR_MIN;
1780 rc = tls_set_remaining_x509(state, &dummy_errstr);
1781 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1788 #ifndef DISABLE_OCSP
1791 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1792 gnutls_datum_t * ocsp_response)
1795 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
1797 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1799 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1801 tls_in.ocsp = OCSP_NOT_RESP;
1802 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1805 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1812 #ifndef DISABLE_EVENT
1814 We use this callback to get observability and detail-level control
1815 for an exim TLS connection (either direction), raising a tls:cert event
1816 for each cert in the chain presented by the peer. Any event
1817 can deny verification.
1819 Return 0 for the handshake to continue or non-zero to terminate.
1823 verify_cb(gnutls_session_t session)
1825 const gnutls_datum_t * cert_list;
1826 unsigned int cert_list_size = 0;
1827 gnutls_x509_crt_t crt;
1830 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1832 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1834 while (cert_list_size--)
1836 rc = import_cert(&cert_list[cert_list_size], &crt);
1837 if (rc != GNUTLS_E_SUCCESS)
1839 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1840 cert_list_size, gnutls_strerror(rc));
1844 state->tlsp->peercert = crt;
1845 if ((yield = event_raise(state->event_action,
1846 US"tls:cert", string_sprintf("%d", cert_list_size))))
1848 log_write(0, LOG_MAIN,
1849 "SSL verify denied by event-action: depth=%d: %s",
1850 cert_list_size, yield);
1851 return 1; /* reject */
1853 state->tlsp->peercert = NULL;
1863 /* ------------------------------------------------------------------------ */
1864 /* Exported functions */
1869 /*************************************************
1870 * Start a TLS session in a server *
1871 *************************************************/
1873 /* This is called when Exim is running as a server, after having received
1874 the STARTTLS command. It must respond to that command, and then negotiate
1878 require_ciphers list of allowed ciphers or NULL
1879 errstr pointer to error string
1881 Returns: OK on success
1882 DEFER for errors before the start of the negotiation
1883 FAIL for errors during the negotiation; the server can't
1888 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
1891 exim_gnutls_state_st * state = NULL;
1893 /* Check for previous activation */
1894 if (tls_in.active >= 0)
1896 tls_error(US"STARTTLS received after TLS started", "", NULL, errstr);
1897 smtp_printf("554 Already in TLS\r\n", FALSE);
1901 /* Initialize the library. If it fails, it will already have logged the error
1902 and sent an SMTP response. */
1904 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1906 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
1907 NULL, tls_verify_certificates, tls_crl,
1908 require_ciphers, &state, errstr)) != OK) return rc;
1910 /* If this is a host for which certificate verification is mandatory or
1911 optional, set up appropriately. */
1913 if (verify_check_host(&tls_verify_hosts) == OK)
1916 debug_printf("TLS: a client certificate will be required.\n");
1917 state->verify_requirement = VERIFY_REQUIRED;
1918 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1920 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1923 debug_printf("TLS: a client certificate will be requested but not required.\n");
1924 state->verify_requirement = VERIFY_OPTIONAL;
1925 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1930 debug_printf("TLS: a client certificate will not be requested.\n");
1931 state->verify_requirement = VERIFY_NONE;
1932 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1935 #ifndef DISABLE_EVENT
1938 state->event_action = event_action;
1939 gnutls_session_set_ptr(state->session, state);
1940 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1944 /* Register SNI handling; always, even if not in tls_certificate, so that the
1945 expansion variable $tls_sni is always available. */
1947 gnutls_handshake_set_post_client_hello_function(state->session,
1948 exim_sni_handling_cb);
1950 /* Set context and tell client to go ahead, except in the case of TLS startup
1951 on connection, where outputting anything now upsets the clients and tends to
1952 make them disconnect. We need to have an explicit fflush() here, to force out
1953 the response. Other smtp_printf() calls do not need it, because in non-TLS
1954 mode, the fflush() happens when smtp_getc() is called. */
1956 if (!state->tlsp->on_connect)
1958 smtp_printf("220 TLS go ahead\r\n", FALSE);
1962 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1963 that the GnuTLS library doesn't. */
1965 gnutls_transport_set_ptr2(state->session,
1966 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
1967 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
1968 state->fd_in = fileno(smtp_in);
1969 state->fd_out = fileno(smtp_out);
1971 sigalrm_seen = FALSE;
1972 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1974 rc = gnutls_handshake(state->session);
1975 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
1978 if (rc != GNUTLS_E_SUCCESS)
1980 /* It seems that, except in the case of a timeout, we have to close the
1981 connection right here; otherwise if the other end is running OpenSSL it hangs
1982 until the server times out. */
1986 tls_error(US"gnutls_handshake", "timed out", NULL, errstr);
1987 gnutls_db_remove_session(state->session);
1991 tls_error(US"gnutls_handshake", gnutls_strerror(rc), NULL, errstr);
1992 (void) gnutls_alert_send_appropriate(state->session, rc);
1993 gnutls_deinit(state->session);
1994 gnutls_certificate_free_credentials(state->x509_cred);
1996 shutdown(state->fd_out, SHUT_WR);
1997 for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--; /* drain skt */
1998 (void)fclose(smtp_out);
1999 (void)fclose(smtp_in);
2000 smtp_out = smtp_in = NULL;
2006 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2008 /* Verify after the fact */
2010 if (!verify_certificate(state, errstr))
2012 if (state->verify_requirement != VERIFY_OPTIONAL)
2014 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
2018 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
2022 /* Figure out peer DN, and if authenticated, etc. */
2024 if ((rc = peer_status(state, NULL)) != OK) return rc;
2026 /* Sets various Exim expansion variables; always safe within server */
2028 extract_exim_vars_from_tls_state(state);
2030 /* TLS has been set up. Adjust the input functions to read via TLS,
2031 and initialize appropriately. */
2033 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2035 receive_getc = tls_getc;
2036 receive_getbuf = tls_getbuf;
2037 receive_get_cache = tls_get_cache;
2038 receive_ungetc = tls_ungetc;
2039 receive_feof = tls_feof;
2040 receive_ferror = tls_ferror;
2041 receive_smtp_buffered = tls_smtp_buffered;
2050 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2051 smtp_transport_options_block * ob)
2053 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
2055 state->exp_tls_verify_cert_hostnames =
2057 string_domain_utf8_to_alabel(host->name, NULL);
2062 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2063 state->exp_tls_verify_cert_hostnames);
2071 /* Given our list of RRs from the TLSA lookup, build a lookup block in
2072 GnuTLS-DANE's preferred format. Hang it on the state str for later
2073 use in DANE verification.
2075 We point at the dnsa data not copy it, so it must remain valid until
2076 after verification is done.*/
2079 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2084 const char ** dane_data;
2085 int * dane_data_len;
2087 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 1;
2089 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2090 ) if (rr->type == T_TLSA) i++;
2092 dane_data = store_get(i * sizeof(uschar *));
2093 dane_data_len = store_get(i * sizeof(int));
2095 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 0;
2097 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2098 ) if (rr->type == T_TLSA)
2100 const uschar * p = rr->data;
2103 tls_out.tlsa_usage |= 1<<usage;
2105 dane_data_len[i++] = rr->size;
2107 dane_data[i] = NULL;
2108 dane_data_len[i] = 0;
2110 state->dane_data = (char * const *)dane_data;
2111 state->dane_data_len = dane_data_len;
2117 /*************************************************
2118 * Start a TLS session in a client *
2119 *************************************************/
2121 /* Called from the smtp transport after STARTTLS has been accepted.
2124 fd the fd of the connection
2125 host connected host (for messages)
2126 addr the first address (not used)
2127 tb transport (always smtp)
2128 tlsa_dnsa non-NULL, either request or require dane for this host, and
2129 a TLSA record found. Therefore, dane verify required.
2130 Which implies cert must be requested and supplied, dane
2131 verify must pass, and cert verify irrelevant (incl.
2132 hostnames), and (caller handled) require_tls
2133 errstr error string pointer
2135 Returns: OK/DEFER/FAIL (because using common functions),
2136 but for a client, DEFER and FAIL have the same meaning
2140 tls_client_start(int fd, host_item *host,
2141 address_item *addr ARG_UNUSED,
2142 transport_instance * tb,
2143 #ifdef EXPERIMENTAL_DANE
2144 dns_answer * tlsa_dnsa,
2148 smtp_transport_options_block *ob =
2149 (smtp_transport_options_block *)tb->options_block;
2151 exim_gnutls_state_st * state = NULL;
2152 #ifndef DISABLE_OCSP
2154 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
2155 BOOL request_ocsp = require_ocsp ? TRUE
2156 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2159 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
2161 if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2162 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2163 ob->tls_require_ciphers, &state, errstr)) != OK)
2167 int dh_min_bits = ob->tls_dh_min_bits;
2168 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2171 debug_printf("WARNING: tls_dh_min_bits far too low,"
2172 " clamping %d up to %d\n",
2173 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2174 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2177 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2178 " acceptable bits to %d\n",
2180 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2183 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
2184 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2185 the specified host patterns if one of them is defined */
2191 debug_printf("TLS: server certificate DANE required.\n");
2192 state->verify_requirement = VERIFY_DANE;
2193 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2194 dane_tlsa_load(state, tlsa_dnsa);
2198 if ( ( state->exp_tls_verify_certificates
2199 && !ob->tls_verify_hosts
2200 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2202 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
2205 tls_client_setup_hostname_checks(host, state, ob);
2207 debug_printf("TLS: server certificate verification required.\n");
2208 state->verify_requirement = VERIFY_REQUIRED;
2209 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2211 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
2213 tls_client_setup_hostname_checks(host, state, ob);
2215 debug_printf("TLS: server certificate verification optional.\n");
2216 state->verify_requirement = VERIFY_OPTIONAL;
2217 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2222 debug_printf("TLS: server certificate verification not required.\n");
2223 state->verify_requirement = VERIFY_NONE;
2224 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2227 #ifndef DISABLE_OCSP
2228 /* supported since GnuTLS 3.1.3 */
2231 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2232 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2233 NULL, 0, NULL)) != OK)
2234 return tls_error(US"cert-status-req",
2235 gnutls_strerror(rc), state->host, errstr);
2236 tls_out.ocsp = OCSP_NOT_RESP;
2240 #ifndef DISABLE_EVENT
2241 if (tb->event_action)
2243 state->event_action = tb->event_action;
2244 gnutls_session_set_ptr(state->session, state);
2245 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2249 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
2253 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2254 /* There doesn't seem to be a built-in timeout on connection. */
2256 sigalrm_seen = FALSE;
2257 alarm(ob->command_timeout);
2260 rc = gnutls_handshake(state->session);
2261 } while ((rc == GNUTLS_E_AGAIN) ||
2262 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
2265 if (rc != GNUTLS_E_SUCCESS)
2268 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
2269 return tls_error(US"gnutls_handshake", "timed out", state->host, errstr);
2272 return tls_error(US"gnutls_handshake", gnutls_strerror(rc), state->host, errstr);
2274 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2278 if (!verify_certificate(state, errstr))
2279 return tls_error(US"certificate verification failed", *errstr, state->host, errstr);
2281 #ifndef DISABLE_OCSP
2286 gnutls_datum_t stapling;
2287 gnutls_ocsp_resp_t resp;
2288 gnutls_datum_t printed;
2289 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2290 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2291 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2292 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2295 debug_printf("%.4096s", printed.data);
2296 gnutls_free(printed.data);
2299 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host, errstr);
2302 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
2304 tls_out.ocsp = OCSP_FAILED;
2305 return tls_error(US"certificate status check failed", NULL, state->host, errstr);
2307 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
2308 tls_out.ocsp = OCSP_VFIED;
2312 /* Figure out peer DN, and if authenticated, etc. */
2314 if ((rc = peer_status(state, errstr)) != OK)
2317 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
2319 extract_exim_vars_from_tls_state(state);
2327 /*************************************************
2328 * Close down a TLS session *
2329 *************************************************/
2331 /* This is also called from within a delivery subprocess forked from the
2332 daemon, to shut down the TLS library, without actually doing a shutdown (which
2333 would tamper with the TLS session in the parent process).
2335 Arguments: TRUE if gnutls_bye is to be called
2340 tls_close(BOOL is_server, BOOL shutdown)
2342 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2344 if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
2348 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
2349 gnutls_bye(state->session, GNUTLS_SHUT_WR);
2352 gnutls_deinit(state->session);
2353 gnutls_certificate_free_credentials(state->x509_cred);
2356 state->tlsp->active = -1;
2357 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2359 if ((state_server.session == NULL) && (state_client.session == NULL))
2361 gnutls_global_deinit();
2362 exim_gnutls_base_init_done = FALSE;
2370 tls_refill(unsigned lim)
2372 exim_gnutls_state_st * state = &state_server;
2375 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2376 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2378 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2379 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2380 MIN(ssl_xfer_buffer_size, lim));
2383 /* Timeouts do not get this far; see command_timeout_handler().
2384 A zero-byte return appears to mean that the TLS session has been
2385 closed down, not that the socket itself has been closed down. Revert to
2386 non-TLS handling. */
2390 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
2391 state->xfer_error = 1;
2395 else if (inbytes == 0)
2397 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2399 receive_getc = smtp_getc;
2400 receive_getbuf = smtp_getbuf;
2401 receive_get_cache = smtp_get_cache;
2402 receive_ungetc = smtp_ungetc;
2403 receive_feof = smtp_feof;
2404 receive_ferror = smtp_ferror;
2405 receive_smtp_buffered = smtp_buffered;
2407 gnutls_deinit(state->session);
2408 gnutls_certificate_free_credentials(state->x509_cred);
2410 state->session = NULL;
2411 state->tlsp->active = -1;
2412 state->tlsp->bits = 0;
2413 state->tlsp->certificate_verified = FALSE;
2414 tls_channelbinding_b64 = NULL;
2415 state->tlsp->cipher = NULL;
2416 state->tlsp->peercert = NULL;
2417 state->tlsp->peerdn = NULL;
2422 /* Handle genuine errors */
2424 else if (inbytes < 0)
2426 record_io_error(state, (int) inbytes, US"recv", NULL);
2427 state->xfer_error = 1;
2430 #ifndef DISABLE_DKIM
2431 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2433 state->xfer_buffer_hwm = (int) inbytes;
2434 state->xfer_buffer_lwm = 0;
2438 /*************************************************
2439 * TLS version of getc *
2440 *************************************************/
2442 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2443 it refills the buffer via the GnuTLS reading function.
2444 Only used by the server-side TLS.
2446 This feeds DKIM and should be used for all message-body reads.
2448 Arguments: lim Maximum amount to read/bufffer
2449 Returns: the next character or EOF
2453 tls_getc(unsigned lim)
2455 exim_gnutls_state_st * state = &state_server;
2457 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2458 if (!tls_refill(lim))
2459 return state->xfer_error ? EOF : smtp_getc(lim);
2461 /* Something in the buffer; return next uschar */
2463 return state->xfer_buffer[state->xfer_buffer_lwm++];
2467 tls_getbuf(unsigned * len)
2469 exim_gnutls_state_st * state = &state_server;
2473 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2474 if (!tls_refill(*len))
2476 if (!state->xfer_error) return smtp_getbuf(len);
2481 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
2483 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
2484 state->xfer_buffer_lwm += size;
2493 #ifndef DISABLE_DKIM
2494 exim_gnutls_state_st * state = &state_server;
2495 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2497 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
2503 tls_could_read(void)
2505 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
2506 || gnutls_record_check_pending(state_server.session) > 0;
2512 /*************************************************
2513 * Read bytes from TLS channel *
2514 *************************************************/
2516 /* This does not feed DKIM, so if the caller uses this for reading message body,
2517 then the caller must feed DKIM.
2523 Returns: the number of bytes read
2524 -1 after a failed read
2528 tls_read(BOOL is_server, uschar *buff, size_t len)
2530 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2536 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2538 debug_printf("*** PROBABLY A BUG *** " \
2539 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2540 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2543 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2544 state->session, buff, len);
2546 inbytes = gnutls_record_recv(state->session, buff, len);
2547 if (inbytes > 0) return inbytes;
2550 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2552 else record_io_error(state, (int)inbytes, US"recv", NULL);
2560 /*************************************************
2561 * Write bytes down TLS channel *
2562 *************************************************/
2566 is_server channel specifier
2569 more more data expected soon
2571 Returns: the number of bytes after a successful write,
2572 -1 after a failed write
2576 tls_write(BOOL is_server, const uschar *buff, size_t len, BOOL more)
2580 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2582 static BOOL corked = FALSE;
2584 if (more && !corked) gnutls_record_cork(state->session);
2587 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
2588 buff, left, more ? ", more" : "");
2592 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2594 outbytes = gnutls_record_send(state->session, buff, left);
2596 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
2599 record_io_error(state, outbytes, US"send", NULL);
2604 record_io_error(state, 0, US"send", US"TLS channel closed on write");
2615 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2623 if (!more) (void) gnutls_record_uncork(state->session, 0);
2634 /*************************************************
2635 * Random number generation *
2636 *************************************************/
2638 /* Pseudo-random number generation. The result is not expected to be
2639 cryptographically strong but not so weak that someone will shoot themselves
2640 in the foot using it as a nonce in input in some email header scheme or
2641 whatever weirdness they'll twist this into. The result should handle fork()
2642 and avoid repeating sequences. OpenSSL handles that for us.
2646 Returns a random number in range [0, max-1]
2649 #ifdef HAVE_GNUTLS_RND
2651 vaguely_random_number(int max)
2656 uschar smallbuf[sizeof(r)];
2661 needed_len = sizeof(r);
2662 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2663 * asked for a number less than 10. */
2664 for (r = max, i = 0; r; ++i)
2670 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2673 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2674 return vaguely_random_number_fallback(max);
2677 for (p = smallbuf; needed_len; --needed_len, ++p)
2683 /* We don't particularly care about weighted results; if someone wants
2684 * smooth distribution and cares enough then they should submit a patch then. */
2687 #else /* HAVE_GNUTLS_RND */
2689 vaguely_random_number(int max)
2691 return vaguely_random_number_fallback(max);
2693 #endif /* HAVE_GNUTLS_RND */
2698 /*************************************************
2699 * Let tls_require_ciphers be checked at startup *
2700 *************************************************/
2702 /* The tls_require_ciphers option, if set, must be something which the
2705 Returns: NULL on success, or error message
2709 tls_validate_require_cipher(void)
2712 uschar *expciphers = NULL;
2713 gnutls_priority_t priority_cache;
2715 uschar * dummy_errstr;
2717 #define validate_check_rc(Label) do { \
2718 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2719 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2720 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2722 if (exim_gnutls_base_init_done)
2723 log_write(0, LOG_MAIN|LOG_PANIC,
2724 "already initialised GnuTLS, Exim developer bug");
2726 #ifdef HAVE_GNUTLS_PKCS11
2727 if (!gnutls_allow_auto_pkcs11)
2729 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2730 validate_check_rc(US"gnutls_pkcs11_init");
2733 rc = gnutls_global_init();
2734 validate_check_rc(US"gnutls_global_init()");
2735 exim_gnutls_base_init_done = TRUE;
2737 if (!(tls_require_ciphers && *tls_require_ciphers))
2738 return_deinit(NULL);
2740 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
2742 return_deinit(US"failed to expand tls_require_ciphers");
2744 if (!(expciphers && *expciphers))
2745 return_deinit(NULL);
2748 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2750 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2751 validate_check_rc(string_sprintf(
2752 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2753 expciphers, errpos - CS expciphers, errpos));
2755 #undef return_deinit
2756 #undef validate_check_rc
2757 gnutls_global_deinit();
2765 /*************************************************
2766 * Report the library versions. *
2767 *************************************************/
2769 /* See a description in tls-openssl.c for an explanation of why this exists.
2771 Arguments: a FILE* to print the results to
2776 tls_version_report(FILE *f)
2778 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2781 gnutls_check_version(NULL));
2786 /* End of tls-gnu.c */