1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2012 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
46 gnutls_global_set_audit_log_function()
49 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
52 /* Local static variables for GnuTLS */
54 /* Values for verify_requirement */
56 enum peer_verify_requirement { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
58 /* This holds most state for server or client; with this, we can set up an
59 outbound TLS-enabled connection in an ACL callout, while not stomping all
60 over the TLS variables available for expansion.
62 Some of these correspond to variables in globals.c; those variables will
63 be set to point to content in one of these instances, as appropriate for
64 the stage of the process lifetime.
66 Not handled here: global tls_channelbinding_b64.
69 typedef struct exim_gnutls_state {
70 gnutls_session_t session;
71 gnutls_certificate_credentials_t x509_cred;
72 gnutls_priority_t priority_cache;
73 enum peer_verify_requirement verify_requirement;
76 BOOL peer_cert_verified;
77 BOOL trigger_sni_changes;
79 const struct host_item *host;
84 const uschar *tls_certificate;
85 const uschar *tls_privatekey;
86 const uschar *tls_sni; /* client send only, not received */
87 const uschar *tls_verify_certificates;
88 const uschar *tls_crl;
89 const uschar *tls_require_ciphers;
90 uschar *exp_tls_certificate;
91 uschar *exp_tls_privatekey;
93 uschar *exp_tls_verify_certificates;
95 uschar *exp_tls_require_ciphers;
97 tls_support *tlsp; /* set in tls_init() */
104 } exim_gnutls_state_st;
106 static const exim_gnutls_state_st exim_gnutls_state_init = {
107 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
108 NULL, NULL, NULL, NULL,
109 NULL, NULL, NULL, NULL, NULL, NULL,
110 NULL, NULL, NULL, NULL, NULL, NULL,
115 /* Not only do we have our own APIs which don't pass around state, assuming
116 it's held in globals, GnuTLS doesn't appear to let us register callback data
117 for callbacks, or as part of the session, so we have to keep a "this is the
118 context we're currently dealing with" pointer and rely upon being
119 single-threaded to keep from processing data on an inbound TLS connection while
120 talking to another TLS connection for an outbound check. This does mean that
121 there's no way for heart-beats to be responded to, for the duration of the
122 second connection. */
124 static exim_gnutls_state_st state_server, state_client;
126 /* dh_params are initialised once within the lifetime of a process using TLS;
127 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
128 don't want to repeat this. */
130 static gnutls_dh_params_t dh_server_params = NULL;
132 /* No idea how this value was chosen; preserving it. Default is 3600. */
134 static const int ssl_session_timeout = 200;
136 static const char * const exim_default_gnutls_priority = "NORMAL";
138 /* Guard library core initialisation */
140 static BOOL exim_gnutls_base_init_done = FALSE;
143 /* ------------------------------------------------------------------------ */
146 #define MAX_HOST_LEN 255
148 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
149 the library logging; a value less than 0 disables the calls to set up logging
151 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
152 #define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
155 #ifndef EXIM_CLIENT_DH_MIN_BITS
156 #define EXIM_CLIENT_DH_MIN_BITS 1024
159 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
160 can ask for a bit-strength. Without that, we stick to the constant we had
162 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
163 #define EXIM_SERVER_DH_BITS_PRE2_12 1024
166 #define exim_gnutls_err_check(Label) do { \
167 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
169 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
171 #if GNUTLS_VERSION_NUMBER >= 0x020c00
172 #define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
173 #define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
174 #define HAVE_GNUTLS_RND
180 /* ------------------------------------------------------------------------ */
181 /* Callback declarations */
183 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
184 static void exim_gnutls_logger_cb(int level, const char *message);
187 static int exim_sni_handling_cb(gnutls_session_t session);
192 /* ------------------------------------------------------------------------ */
193 /* Static functions */
195 /*************************************************
197 *************************************************/
199 /* Called from lots of places when errors occur before actually starting to do
200 the TLS handshake, that is, while the session is still in clear. Always returns
201 DEFER for a server and FAIL for a client so that most calls can use "return
202 tls_error(...)" to do this processing and then give an appropriate return. A
203 single function is used for both server and client, because it is called from
204 some shared functions.
207 prefix text to include in the logged error
208 msg additional error string (may be NULL)
209 usually obtained from gnutls_strerror()
210 host NULL if setting up a server;
211 the connected host if setting up a client
213 Returns: OK/DEFER/FAIL
217 tls_error(const uschar *prefix, const char *msg, const host_item *host)
221 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
222 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
227 uschar *conn_info = smtp_get_connection_info();
228 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
230 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
231 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
239 /*************************************************
240 * Deal with logging errors during I/O *
241 *************************************************/
243 /* We have to get the identity of the peer from saved data.
246 state the current GnuTLS exim state container
247 rc the GnuTLS error code, or 0 if it's a local error
248 when text identifying read or write
249 text local error text when ec is 0
255 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
259 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
260 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
261 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
263 msg = gnutls_strerror(rc);
265 tls_error(when, msg, state->host);
271 /*************************************************
272 * Set various Exim expansion vars *
273 *************************************************/
275 /* We set various Exim global variables from the state, once a session has
276 been established. With TLS callouts, may need to change this to stack
277 variables, or just re-call it with the server state after client callout
280 Make sure anything set here is inset in tls_getc().
284 tls_bits strength indicator
285 tls_certificate_verified bool indicator
286 tls_channelbinding_b64 for some SASL mechanisms
289 tls_sni a (UTF-8) string
292 state the relevant exim_gnutls_state_st *
296 extract_exim_vars_from_tls_state(exim_gnutls_state_st *state, BOOL is_server)
298 gnutls_cipher_algorithm_t cipher;
299 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
302 gnutls_datum_t channel;
305 state->tlsp->active = state->fd_out;
307 cipher = gnutls_cipher_get(state->session);
308 /* returns size in "bytes" */
309 state->tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
311 state->tlsp->cipher = state->ciphersuite;
313 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
315 state->tlsp->certificate_verified = state->peer_cert_verified;
317 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
318 only available for use for authenticators while this TLS session is running. */
320 tls_channelbinding_b64 = NULL;
321 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
324 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
326 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
328 old_pool = store_pool;
329 store_pool = POOL_PERM;
330 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
331 store_pool = old_pool;
332 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
336 state->tlsp->peerdn = state->peerdn;
337 state->tlsp->sni = state->received_sni;
343 /*************************************************
344 * Setup up DH parameters *
345 *************************************************/
347 /* Generating the D-H parameters may take a long time. They only need to
348 be re-generated every so often, depending on security policy. What we do is to
349 keep these parameters in a file in the spool directory. If the file does not
350 exist, we generate them. This means that it is easy to cause a regeneration.
352 The new file is written as a temporary file and renamed, so that an incomplete
353 file is never present. If two processes both compute some new parameters, you
354 waste a bit of effort, but it doesn't seem worth messing around with locking to
357 Returns: OK/DEFER/FAIL
364 unsigned int dh_bits;
366 uschar filename_buf[PATH_MAX];
367 uschar *filename = NULL;
369 uschar *exp_tls_dhparam;
370 BOOL use_file_in_spool = FALSE;
371 BOOL use_fixed_file = FALSE;
372 host_item *host = NULL; /* dummy for macros */
374 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
376 rc = gnutls_dh_params_init(&dh_server_params);
377 exim_gnutls_err_check(US"gnutls_dh_params_init");
382 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
385 if (!exp_tls_dhparam)
387 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
388 m.data = US std_dh_prime_default();
389 m.size = Ustrlen(m.data);
391 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
392 use_file_in_spool = TRUE;
393 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
395 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
398 else if (exp_tls_dhparam[0] != '/')
400 m.data = US std_dh_prime_named(exp_tls_dhparam);
402 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
403 m.size = Ustrlen(m.data);
407 use_fixed_file = TRUE;
408 filename = exp_tls_dhparam;
413 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
414 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
415 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
419 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
420 /* If you change this constant, also change dh_param_fn_ext so that we can use a
421 different filename and ensure we have sufficient bits. */
422 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
424 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
426 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
429 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
431 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
435 /* Some clients have hard-coded limits. */
436 if (dh_bits > tls_dh_max_bits)
439 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
441 dh_bits = tls_dh_max_bits;
444 if (use_file_in_spool)
446 if (!string_format(filename_buf, sizeof(filename_buf),
447 "%s/gnutls-params-%d", spool_directory, dh_bits))
448 return tls_error(US"overlong filename", NULL, NULL);
449 filename = filename_buf;
452 /* Open the cache file for reading and if successful, read it and set up the
455 fd = Uopen(filename, O_RDONLY, 0);
462 if (fstat(fd, &statbuf) < 0) /* EIO */
466 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
468 if (!S_ISREG(statbuf.st_mode))
471 return tls_error(US"TLS cache not a file", NULL, NULL);
473 fp = fdopen(fd, "rb");
478 return tls_error(US"fdopen(TLS cache stat fd) failed",
479 strerror(saved_errno), NULL);
482 m.size = statbuf.st_size;
483 m.data = malloc(m.size);
487 return tls_error(US"malloc failed", strerror(errno), NULL);
489 sz = fread(m.data, m.size, 1, fp);
495 return tls_error(US"fread failed", strerror(saved_errno), NULL);
499 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
501 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
502 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
505 /* If the file does not exist, fall through to compute new data and cache it.
506 If there was any other opening error, it is serious. */
508 else if (errno == ENOENT)
512 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
515 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
518 /* If ret < 0, either the cache file does not exist, or the data it contains
519 is not useful. One particular case of this is when upgrading from an older
520 release of Exim in which the data was stored in a different format. We don't
521 try to be clever and support both formats; we just regenerate new data in this
527 unsigned int dh_bits_gen = dh_bits;
529 if ((PATH_MAX - Ustrlen(filename)) < 10)
530 return tls_error(US"Filename too long to generate replacement",
533 temp_fn = string_copy(US "%s.XXXXXXX");
534 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
536 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
537 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
539 /* GnuTLS overshoots!
540 * If we ask for 2236, we might get 2237 or more.
541 * But there's no way to ask GnuTLS how many bits there really are.
542 * We can ask how many bits were used in a TLS session, but that's it!
543 * The prime itself is hidden behind too much abstraction.
544 * So we ask for less, and proceed on a wing and a prayer.
545 * First attempt, subtracted 3 for 2233 and got 2240.
547 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
549 dh_bits_gen = dh_bits - 10;
551 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
556 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
558 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
559 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
561 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
562 and I confirmed that a NULL call to get the size first is how the GnuTLS
563 sample apps handle this. */
567 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
569 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
570 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
572 m.data = malloc(m.size);
574 return tls_error(US"memory allocation failed", strerror(errno), NULL);
575 /* this will return a size 1 less than the allocation size above */
576 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
578 if (rc != GNUTLS_E_SUCCESS)
581 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
583 m.size = sz; /* shrink by 1, probably */
585 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
589 return tls_error(US"TLS cache write D-H params failed",
590 strerror(errno), NULL);
593 sz = write_to_fd_buf(fd, US"\n", 1);
595 return tls_error(US"TLS cache write D-H params final newline failed",
596 strerror(errno), NULL);
600 return tls_error(US"TLS cache write close() failed",
601 strerror(errno), NULL);
603 if (Urename(temp_fn, filename) < 0)
604 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
605 temp_fn, filename), strerror(errno), NULL);
607 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
610 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
617 /*************************************************
618 * Variables re-expanded post-SNI *
619 *************************************************/
621 /* Called from both server and client code, via tls_init(), and also from
622 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
624 We can tell the two apart by state->received_sni being non-NULL in callback.
626 The callback should not call us unless state->trigger_sni_changes is true,
627 which we are responsible for setting on the first pass through.
630 state exim_gnutls_state_st *
632 Returns: OK/DEFER/FAIL
636 tls_expand_session_files(exim_gnutls_state_st *state)
640 const host_item *host = state->host; /* macro should be reconsidered? */
641 uschar *saved_tls_certificate = NULL;
642 uschar *saved_tls_privatekey = NULL;
643 uschar *saved_tls_verify_certificates = NULL;
644 uschar *saved_tls_crl = NULL;
647 /* We check for tls_sni *before* expansion. */
650 if (!state->received_sni)
652 if (state->tls_certificate &&
653 (Ustrstr(state->tls_certificate, US"tls_sni") ||
654 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
655 Ustrstr(state->tls_certificate, US"tls_out_sni")
658 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
659 state->trigger_sni_changes = TRUE;
664 /* useful for debugging */
665 saved_tls_certificate = state->exp_tls_certificate;
666 saved_tls_privatekey = state->exp_tls_privatekey;
667 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
668 saved_tls_crl = state->exp_tls_crl;
672 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
673 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
675 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
676 state members, assuming consistent naming; and expand_check() returns
677 false if expansion failed, unless expansion was forced to fail. */
679 /* check if we at least have a certificate, before doing expensive
682 if (!expand_check_tlsvar(tls_certificate))
685 /* certificate is mandatory in server, optional in client */
687 if ((state->exp_tls_certificate == NULL) ||
688 (*state->exp_tls_certificate == '\0'))
690 if (state->host == NULL)
691 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
693 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
696 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
699 /* tls_privatekey is optional, defaulting to same file as certificate */
701 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
703 state->tls_privatekey = state->tls_certificate;
704 state->exp_tls_privatekey = state->exp_tls_certificate;
708 if (state->exp_tls_certificate && *state->exp_tls_certificate)
710 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
711 state->exp_tls_certificate, state->exp_tls_privatekey);
713 if (state->received_sni)
715 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
716 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
718 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
722 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
726 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
727 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
728 GNUTLS_X509_FMT_PEM);
729 exim_gnutls_err_check(
730 string_sprintf("cert/key setup: cert=%s key=%s",
731 state->exp_tls_certificate, state->exp_tls_privatekey));
732 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
733 } /* tls_certificate */
735 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
736 provided. Experiment shows that, if the certificate file is empty, an unhelpful
737 error message is provided. However, if we just refrain from setting anything up
738 in that case, certificate verification fails, which seems to be the correct
741 if (state->tls_verify_certificates && *state->tls_verify_certificates)
743 if (!expand_check_tlsvar(tls_verify_certificates))
745 if (state->tls_crl && *state->tls_crl)
746 if (!expand_check_tlsvar(tls_crl))
749 if (!(state->exp_tls_verify_certificates &&
750 *state->exp_tls_verify_certificates))
753 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
754 /* With no tls_verify_certificates, we ignore tls_crl too */
761 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
765 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
767 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
768 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
773 /* The test suite passes in /dev/null; we could check for that path explicitly,
774 but who knows if someone has some weird FIFO which always dumps some certs, or
775 other weirdness. The thing we really want to check is that it's not a
776 directory, since while OpenSSL supports that, GnuTLS does not.
777 So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
778 if (S_ISDIR(statbuf.st_mode))
781 debug_printf("verify certificates path is a dir: \"%s\"\n",
782 state->exp_tls_verify_certificates);
783 log_write(0, LOG_MAIN|LOG_PANIC,
784 "tls_verify_certificates \"%s\" is a directory",
785 state->exp_tls_verify_certificates);
789 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
790 state->exp_tls_verify_certificates, statbuf.st_size);
792 if (statbuf.st_size == 0)
795 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
799 cert_count = gnutls_certificate_set_x509_trust_file(state->x509_cred,
800 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
804 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
806 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
808 if (state->tls_crl && *state->tls_crl &&
809 state->exp_tls_crl && *state->exp_tls_crl)
811 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
812 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
813 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
817 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
819 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
828 /*************************************************
829 * Set X.509 state variables *
830 *************************************************/
832 /* In GnuTLS, the registered cert/key are not replaced by a later
833 set of a cert/key, so for SNI support we need a whole new x509_cred
834 structure. Which means various other non-re-expanded pieces of state
835 need to be re-set in the new struct, so the setting logic is pulled
839 state exim_gnutls_state_st *
841 Returns: OK/DEFER/FAIL
845 tls_set_remaining_x509(exim_gnutls_state_st *state)
848 const host_item *host = state->host; /* macro should be reconsidered? */
850 /* Create D-H parameters, or read them from the cache file. This function does
851 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
852 client-side params. */
856 if (!dh_server_params)
858 rc = init_server_dh();
859 if (rc != OK) return rc;
861 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
864 /* Link the credentials to the session. */
866 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
867 exim_gnutls_err_check(US"gnutls_credentials_set");
872 /*************************************************
873 * Initialize for GnuTLS *
874 *************************************************/
876 /* Called from both server and client code. In the case of a server, errors
877 before actual TLS negotiation return DEFER.
880 host connected host, if client; NULL if server
881 certificate certificate file
882 privatekey private key file
883 sni TLS SNI to send, sometimes when client; else NULL
886 require_ciphers tls_require_ciphers setting
887 caller_state returned state-info structure
889 Returns: OK/DEFER/FAIL
894 const host_item *host,
895 const uschar *certificate,
896 const uschar *privatekey,
900 const uschar *require_ciphers,
901 exim_gnutls_state_st **caller_state)
903 exim_gnutls_state_st *state;
908 BOOL want_default_priorities;
910 if (!exim_gnutls_base_init_done)
912 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
914 rc = gnutls_global_init();
915 exim_gnutls_err_check(US"gnutls_global_init");
917 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
920 gnutls_global_set_log_function(exim_gnutls_logger_cb);
921 /* arbitrarily chosen level; bump upto 9 for more */
922 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
926 exim_gnutls_base_init_done = TRUE;
931 state = &state_client;
932 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
933 state->tlsp = &tls_out;
934 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
935 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
939 state = &state_server;
940 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
941 state->tlsp = &tls_in;
942 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
943 rc = gnutls_init(&state->session, GNUTLS_SERVER);
945 exim_gnutls_err_check(US"gnutls_init");
949 state->tls_certificate = certificate;
950 state->tls_privatekey = privatekey;
951 state->tls_require_ciphers = require_ciphers;
952 state->tls_sni = sni;
953 state->tls_verify_certificates = cas;
954 state->tls_crl = crl;
956 /* This handles the variables that might get re-expanded after TLS SNI;
957 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
960 debug_printf("Expanding various TLS configuration options for session credentials.\n");
961 rc = tls_expand_session_files(state);
962 if (rc != OK) return rc;
964 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
965 requires a new structure afterwards. */
967 rc = tls_set_remaining_x509(state);
968 if (rc != OK) return rc;
970 /* set SNI in client, only */
973 if (!expand_check(state->tlsp->sni, "tls_out_sni", &state->exp_tls_sni))
975 if (state->exp_tls_sni && *state->exp_tls_sni)
978 debug_printf("Setting TLS client SNI to \"%s\"\n", state->exp_tls_sni);
979 sz = Ustrlen(state->exp_tls_sni);
980 rc = gnutls_server_name_set(state->session,
981 GNUTLS_NAME_DNS, state->exp_tls_sni, sz);
982 exim_gnutls_err_check(US"gnutls_server_name_set");
985 else if (state->tls_sni)
986 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
987 "have an SNI set for a client [%s]\n", state->tls_sni);
989 /* This is the priority string support,
990 http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html
991 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
992 This was backwards incompatible, but means Exim no longer needs to track
993 all algorithms and provide string forms for them. */
995 want_default_priorities = TRUE;
997 if (state->tls_require_ciphers && *state->tls_require_ciphers)
999 if (!expand_check_tlsvar(tls_require_ciphers))
1001 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1003 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1004 state->exp_tls_require_ciphers);
1006 rc = gnutls_priority_init(&state->priority_cache,
1007 CS state->exp_tls_require_ciphers, &errpos);
1008 want_default_priorities = FALSE;
1009 p = state->exp_tls_require_ciphers;
1012 if (want_default_priorities)
1015 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1016 exim_default_gnutls_priority);
1017 rc = gnutls_priority_init(&state->priority_cache,
1018 exim_default_gnutls_priority, &errpos);
1019 p = US exim_default_gnutls_priority;
1022 exim_gnutls_err_check(string_sprintf(
1023 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1024 p, errpos - CS p, errpos));
1026 rc = gnutls_priority_set(state->session, state->priority_cache);
1027 exim_gnutls_err_check(US"gnutls_priority_set");
1029 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1031 /* Reduce security in favour of increased compatibility, if the admin
1032 decides to make that trade-off. */
1033 if (gnutls_compat_mode)
1035 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1036 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1037 gnutls_session_enable_compatibility_mode(state->session);
1039 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1043 *caller_state = state;
1050 /*************************************************
1051 * Extract peer information *
1052 *************************************************/
1054 /* Called from both server and client code.
1055 Only this is allowed to set state->peerdn and state->have_set_peerdn
1056 and we use that to detect double-calls.
1058 NOTE: the state blocks last while the TLS connection is up, which is fine
1059 for logging in the server side, but for the client side, we log after teardown
1060 in src/deliver.c. While the session is up, we can twist about states and
1061 repoint tls_* globals, but those variables used for logging or other variable
1062 expansion that happens _after_ delivery need to have a longer life-time.
1064 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1065 doing this more than once per generation of a state context. We set them in
1066 the state context, and repoint tls_* to them. After the state goes away, the
1067 tls_* copies of the pointers remain valid and client delivery logging is happy.
1069 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1073 state exim_gnutls_state_st *
1075 Returns: OK/DEFER/FAIL
1079 peer_status(exim_gnutls_state_st *state)
1081 uschar cipherbuf[256];
1082 const gnutls_datum *cert_list;
1084 unsigned int cert_list_size = 0;
1085 gnutls_protocol_t protocol;
1086 gnutls_cipher_algorithm_t cipher;
1087 gnutls_kx_algorithm_t kx;
1088 gnutls_mac_algorithm_t mac;
1089 gnutls_certificate_type_t ct;
1090 gnutls_x509_crt_t crt;
1094 if (state->have_set_peerdn)
1096 state->have_set_peerdn = TRUE;
1098 state->peerdn = NULL;
1101 cipher = gnutls_cipher_get(state->session);
1102 protocol = gnutls_protocol_get_version(state->session);
1103 mac = gnutls_mac_get(state->session);
1104 kx = gnutls_kx_get(state->session);
1106 string_format(cipherbuf, sizeof(cipherbuf),
1108 gnutls_protocol_get_name(protocol),
1109 gnutls_cipher_suite_get_name(kx, cipher, mac),
1110 (int) gnutls_cipher_get_key_size(cipher) * 8);
1112 /* I don't see a way that spaces could occur, in the current GnuTLS
1113 code base, but it was a concern in the old code and perhaps older GnuTLS
1114 releases did return "TLS 1.0"; play it safe, just in case. */
1115 for (p = cipherbuf; *p != '\0'; ++p)
1118 old_pool = store_pool;
1119 store_pool = POOL_PERM;
1120 state->ciphersuite = string_copy(cipherbuf);
1121 store_pool = old_pool;
1122 state->tlsp->cipher = state->ciphersuite;
1125 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1127 if (cert_list == NULL || cert_list_size == 0)
1129 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1130 cert_list, cert_list_size);
1131 if (state->verify_requirement == VERIFY_REQUIRED)
1132 return tls_error(US"certificate verification failed",
1133 "no certificate received from peer", state->host);
1137 ct = gnutls_certificate_type_get(state->session);
1138 if (ct != GNUTLS_CRT_X509)
1140 const char *ctn = gnutls_certificate_type_get_name(ct);
1142 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1143 if (state->verify_requirement == VERIFY_REQUIRED)
1144 return tls_error(US"certificate verification not possible, unhandled type",
1149 #define exim_gnutls_peer_err(Label) do { \
1150 if (rc != GNUTLS_E_SUCCESS) { \
1151 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1152 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1153 return OK; } } while (0)
1155 rc = gnutls_x509_crt_init(&crt);
1156 exim_gnutls_peer_err(US"gnutls_x509_crt_init (crt)");
1158 rc = gnutls_x509_crt_import(crt, &cert_list[0], GNUTLS_X509_FMT_DER);
1159 exim_gnutls_peer_err(US"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1161 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1162 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1164 exim_gnutls_peer_err(US"getting size for cert DN failed");
1165 return FAIL; /* should not happen */
1167 dn_buf = store_get_perm(sz);
1168 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1169 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1170 state->peerdn = dn_buf;
1173 #undef exim_gnutls_peer_err
1179 /*************************************************
1180 * Verify peer certificate *
1181 *************************************************/
1183 /* Called from both server and client code.
1184 *Should* be using a callback registered with
1185 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1186 the peer information, but that's too new for some OSes.
1189 state exim_gnutls_state_st *
1190 error where to put an error message
1193 FALSE if the session should be rejected
1194 TRUE if the cert is okay or we just don't care
1198 verify_certificate(exim_gnutls_state_st *state, const char **error)
1201 unsigned int verify;
1205 rc = peer_status(state);
1208 verify = GNUTLS_CERT_INVALID;
1209 *error = "not supplied";
1213 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1216 /* Handle the result of verification. INVALID seems to be set as well
1217 as REVOKED, but leave the test for both. */
1219 if ((rc < 0) || (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
1221 state->peer_cert_verified = FALSE;
1223 *error = ((verify & GNUTLS_CERT_REVOKED) != 0) ? "revoked" : "invalid";
1226 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
1227 *error, state->peerdn ? state->peerdn : US"<unset>");
1229 if (state->verify_requirement == VERIFY_REQUIRED)
1231 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1235 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1239 state->peer_cert_verified = TRUE;
1240 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=%s\n",
1241 state->peerdn ? state->peerdn : US"<unset>");
1244 state->tlsp->peerdn = state->peerdn;
1252 /* ------------------------------------------------------------------------ */
1255 /* Logging function which can be registered with
1256 * gnutls_global_set_log_function()
1257 * gnutls_global_set_log_level() 0..9
1259 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1261 exim_gnutls_logger_cb(int level, const char *message)
1263 size_t len = strlen(message);
1266 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1269 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1270 message[len-1] == '\n' ? "" : "\n");
1275 /* Called after client hello, should handle SNI work.
1276 This will always set tls_sni (state->received_sni) if available,
1277 and may trigger presenting different certificates,
1278 if state->trigger_sni_changes is TRUE.
1280 Should be registered with
1281 gnutls_handshake_set_post_client_hello_function()
1283 "This callback must return 0 on success or a gnutls error code to terminate the
1286 For inability to get SNI information, we return 0.
1287 We only return non-zero if re-setup failed.
1288 Only used for server-side TLS.
1292 exim_sni_handling_cb(gnutls_session_t session)
1294 char sni_name[MAX_HOST_LEN];
1295 size_t data_len = MAX_HOST_LEN;
1296 exim_gnutls_state_st *state = &state_server;
1297 unsigned int sni_type;
1300 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1301 if (rc != GNUTLS_E_SUCCESS)
1304 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1305 debug_printf("TLS: no SNI presented in handshake.\n");
1307 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1308 gnutls_strerror(rc), rc);
1313 if (sni_type != GNUTLS_NAME_DNS)
1315 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1319 /* We now have a UTF-8 string in sni_name */
1320 old_pool = store_pool;
1321 store_pool = POOL_PERM;
1322 state->received_sni = string_copyn(US sni_name, data_len);
1323 store_pool = old_pool;
1325 /* We set this one now so that variable expansions below will work */
1326 state->tlsp->sni = state->received_sni;
1328 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1329 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1331 if (!state->trigger_sni_changes)
1334 rc = tls_expand_session_files(state);
1337 /* If the setup of certs/etc failed before handshake, TLS would not have
1338 been offered. The best we can do now is abort. */
1339 return GNUTLS_E_APPLICATION_ERROR_MIN;
1342 rc = tls_set_remaining_x509(state);
1343 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1351 /* ------------------------------------------------------------------------ */
1352 /* Exported functions */
1357 /*************************************************
1358 * Start a TLS session in a server *
1359 *************************************************/
1361 /* This is called when Exim is running as a server, after having received
1362 the STARTTLS command. It must respond to that command, and then negotiate
1366 require_ciphers list of allowed ciphers or NULL
1368 Returns: OK on success
1369 DEFER for errors before the start of the negotiation
1370 FAIL for errors during the negotation; the server can't
1375 tls_server_start(const uschar *require_ciphers)
1379 exim_gnutls_state_st *state = NULL;
1381 /* Check for previous activation */
1382 if (tls_in.active >= 0)
1384 tls_error(US"STARTTLS received after TLS started", "", NULL);
1385 smtp_printf("554 Already in TLS\r\n");
1389 /* Initialize the library. If it fails, it will already have logged the error
1390 and sent an SMTP response. */
1392 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1394 rc = tls_init(NULL, tls_certificate, tls_privatekey,
1395 NULL, tls_verify_certificates, tls_crl,
1396 require_ciphers, &state);
1397 if (rc != OK) return rc;
1399 /* If this is a host for which certificate verification is mandatory or
1400 optional, set up appropriately. */
1402 if (verify_check_host(&tls_verify_hosts) == OK)
1404 DEBUG(D_tls) debug_printf("TLS: a client certificate will be required.\n");
1405 state->verify_requirement = VERIFY_REQUIRED;
1406 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1408 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1410 DEBUG(D_tls) debug_printf("TLS: a client certificate will be requested but not required.\n");
1411 state->verify_requirement = VERIFY_OPTIONAL;
1412 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1416 DEBUG(D_tls) debug_printf("TLS: a client certificate will not be requested.\n");
1417 state->verify_requirement = VERIFY_NONE;
1418 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1421 /* Register SNI handling; always, even if not in tls_certificate, so that the
1422 expansion variable $tls_sni is always available. */
1424 gnutls_handshake_set_post_client_hello_function(state->session,
1425 exim_sni_handling_cb);
1427 /* Set context and tell client to go ahead, except in the case of TLS startup
1428 on connection, where outputting anything now upsets the clients and tends to
1429 make them disconnect. We need to have an explicit fflush() here, to force out
1430 the response. Other smtp_printf() calls do not need it, because in non-TLS
1431 mode, the fflush() happens when smtp_getc() is called. */
1433 if (!state->tlsp->on_connect)
1435 smtp_printf("220 TLS go ahead\r\n");
1436 fflush(smtp_out); /*XXX JGH */
1439 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1440 that the GnuTLS library doesn't. */
1442 gnutls_transport_set_ptr2(state->session,
1443 (gnutls_transport_ptr)fileno(smtp_in),
1444 (gnutls_transport_ptr)fileno(smtp_out));
1445 state->fd_in = fileno(smtp_in);
1446 state->fd_out = fileno(smtp_out);
1448 sigalrm_seen = FALSE;
1449 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1452 rc = gnutls_handshake(state->session);
1453 } while ((rc == GNUTLS_E_AGAIN) ||
1454 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1457 if (rc != GNUTLS_E_SUCCESS)
1459 tls_error(US"gnutls_handshake",
1460 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
1461 /* It seems that, except in the case of a timeout, we have to close the
1462 connection right here; otherwise if the other end is running OpenSSL it hangs
1463 until the server times out. */
1467 (void)fclose(smtp_out);
1468 (void)fclose(smtp_in);
1474 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1476 /* Verify after the fact */
1478 if (state->verify_requirement != VERIFY_NONE)
1480 if (!verify_certificate(state, &error))
1482 if (state->verify_requirement == VERIFY_OPTIONAL)
1485 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1490 tls_error(US"certificate verification failed", error, NULL);
1496 /* Figure out peer DN, and if authenticated, etc. */
1498 rc = peer_status(state);
1499 if (rc != OK) return rc;
1501 /* Sets various Exim expansion variables; always safe within server */
1503 extract_exim_vars_from_tls_state(state, TRUE);
1505 /* TLS has been set up. Adjust the input functions to read via TLS,
1506 and initialize appropriately. */
1508 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1510 receive_getc = tls_getc;
1511 receive_ungetc = tls_ungetc;
1512 receive_feof = tls_feof;
1513 receive_ferror = tls_ferror;
1514 receive_smtp_buffered = tls_smtp_buffered;
1522 /*************************************************
1523 * Start a TLS session in a client *
1524 *************************************************/
1526 /* Called from the smtp transport after STARTTLS has been accepted.
1529 fd the fd of the connection
1530 host connected host (for messages)
1531 addr the first address (not used)
1532 dhparam DH parameter file (ignored, we're a client)
1533 certificate certificate file
1534 privatekey private key file
1535 sni TLS SNI to send to remote host
1536 verify_certs file for certificate verify
1537 verify_crl CRL for verify
1538 require_ciphers list of allowed ciphers or NULL
1539 dh_min_bits minimum number of bits acceptable in server's DH prime
1540 timeout startup timeout
1542 Returns: OK/DEFER/FAIL (because using common functions),
1543 but for a client, DEFER and FAIL have the same meaning
1547 tls_client_start(int fd, host_item *host,
1548 address_item *addr ARG_UNUSED, uschar *dhparam ARG_UNUSED,
1549 uschar *certificate, uschar *privatekey, uschar *sni,
1550 uschar *verify_certs, uschar *verify_crl,
1551 uschar *require_ciphers, int dh_min_bits, int timeout)
1555 exim_gnutls_state_st *state = NULL;
1557 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
1559 rc = tls_init(host, certificate, privatekey,
1560 sni, verify_certs, verify_crl, require_ciphers, &state);
1561 if (rc != OK) return rc;
1563 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1566 debug_printf("WARNING: tls_dh_min_bits far too low, clamping %d up to %d\n",
1567 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1568 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1571 DEBUG(D_tls) debug_printf("Setting D-H prime minimum acceptable bits to %d\n",
1573 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1575 if (verify_certs == NULL)
1577 DEBUG(D_tls) debug_printf("TLS: server certificate verification not required\n");
1578 state->verify_requirement = VERIFY_NONE;
1579 /* we still ask for it, to log it, etc */
1580 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1584 DEBUG(D_tls) debug_printf("TLS: server certificate verification required\n");
1585 state->verify_requirement = VERIFY_REQUIRED;
1586 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1589 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)fd);
1593 /* There doesn't seem to be a built-in timeout on connection. */
1595 sigalrm_seen = FALSE;
1599 rc = gnutls_handshake(state->session);
1600 } while ((rc == GNUTLS_E_AGAIN) ||
1601 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1604 if (rc != GNUTLS_E_SUCCESS)
1605 return tls_error(US"gnutls_handshake",
1606 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1608 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1612 if (state->verify_requirement != VERIFY_NONE &&
1613 !verify_certificate(state, &error))
1614 return tls_error(US"certificate verification failed", error, state->host);
1616 /* Figure out peer DN, and if authenticated, etc. */
1618 rc = peer_status(state);
1619 if (rc != OK) return rc;
1621 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
1623 extract_exim_vars_from_tls_state(state, FALSE);
1631 /*************************************************
1632 * Close down a TLS session *
1633 *************************************************/
1635 /* This is also called from within a delivery subprocess forked from the
1636 daemon, to shut down the TLS library, without actually doing a shutdown (which
1637 would tamper with the TLS session in the parent process).
1639 Arguments: TRUE if gnutls_bye is to be called
1644 tls_close(BOOL is_server, BOOL shutdown)
1646 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
1648 if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
1652 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1653 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1656 gnutls_deinit(state->session);
1658 state->tlsp->active = -1;
1659 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1661 if ((state_server.session == NULL) && (state_client.session == NULL))
1663 gnutls_global_deinit();
1664 exim_gnutls_base_init_done = FALSE;
1672 /*************************************************
1673 * TLS version of getc *
1674 *************************************************/
1676 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
1677 it refills the buffer via the GnuTLS reading function.
1678 Only used by the server-side TLS.
1680 This feeds DKIM and should be used for all message-body reads.
1683 Returns: the next character or EOF
1689 exim_gnutls_state_st *state = &state_server;
1690 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
1694 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1695 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
1697 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1698 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
1699 ssl_xfer_buffer_size);
1702 /* A zero-byte return appears to mean that the TLS session has been
1703 closed down, not that the socket itself has been closed down. Revert to
1704 non-TLS handling. */
1708 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1710 receive_getc = smtp_getc;
1711 receive_ungetc = smtp_ungetc;
1712 receive_feof = smtp_feof;
1713 receive_ferror = smtp_ferror;
1714 receive_smtp_buffered = smtp_buffered;
1716 gnutls_deinit(state->session);
1717 state->session = NULL;
1718 state->tlsp->active = -1;
1719 state->tlsp->bits = 0;
1720 state->tlsp->certificate_verified = FALSE;
1721 tls_channelbinding_b64 = NULL; /*XXX JGH */
1722 state->tlsp->cipher = NULL;
1723 state->tlsp->peerdn = NULL;
1728 /* Handle genuine errors */
1730 else if (inbytes < 0)
1732 record_io_error(state, (int) inbytes, US"recv", NULL);
1733 state->xfer_error = 1;
1736 #ifndef DISABLE_DKIM
1737 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
1739 state->xfer_buffer_hwm = (int) inbytes;
1740 state->xfer_buffer_lwm = 0;
1743 /* Something in the buffer; return next uschar */
1745 return state->xfer_buffer[state->xfer_buffer_lwm++];
1751 /*************************************************
1752 * Read bytes from TLS channel *
1753 *************************************************/
1755 /* This does not feed DKIM, so if the caller uses this for reading message body,
1756 then the caller must feed DKIM.
1762 Returns: the number of bytes read
1763 -1 after a failed read
1767 tls_read(BOOL is_server, uschar *buff, size_t len)
1769 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
1775 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
1777 debug_printf("*** PROBABLY A BUG *** " \
1778 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1779 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
1782 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
1783 state->session, buff, len);
1785 inbytes = gnutls_record_recv(state->session, buff, len);
1786 if (inbytes > 0) return inbytes;
1789 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1791 else record_io_error(state, (int)inbytes, US"recv", NULL);
1799 /*************************************************
1800 * Write bytes down TLS channel *
1801 *************************************************/
1805 is_server channel specifier
1809 Returns: the number of bytes after a successful write,
1810 -1 after a failed write
1814 tls_write(BOOL is_server, const uschar *buff, size_t len)
1818 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
1820 DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
1823 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
1825 outbytes = gnutls_record_send(state->session, buff, left);
1827 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
1830 record_io_error(state, outbytes, US"send", NULL);
1835 record_io_error(state, 0, US"send", US"TLS channel closed on write");
1846 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
1857 /*************************************************
1858 * Random number generation *
1859 *************************************************/
1861 /* Pseudo-random number generation. The result is not expected to be
1862 cryptographically strong but not so weak that someone will shoot themselves
1863 in the foot using it as a nonce in input in some email header scheme or
1864 whatever weirdness they'll twist this into. The result should handle fork()
1865 and avoid repeating sequences. OpenSSL handles that for us.
1869 Returns a random number in range [0, max-1]
1872 #ifdef HAVE_GNUTLS_RND
1874 vaguely_random_number(int max)
1879 uschar smallbuf[sizeof(r)];
1884 needed_len = sizeof(r);
1885 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
1886 * asked for a number less than 10. */
1887 for (r = max, i = 0; r; ++i)
1893 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
1896 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
1897 return vaguely_random_number_fallback(max);
1900 for (p = smallbuf; needed_len; --needed_len, ++p)
1906 /* We don't particularly care about weighted results; if someone wants
1907 * smooth distribution and cares enough then they should submit a patch then. */
1910 #else /* HAVE_GNUTLS_RND */
1912 vaguely_random_number(int max)
1914 return vaguely_random_number_fallback(max);
1916 #endif /* HAVE_GNUTLS_RND */
1921 /*************************************************
1922 * Let tls_require_ciphers be checked at startup *
1923 *************************************************/
1925 /* The tls_require_ciphers option, if set, must be something which the
1928 Returns: NULL on success, or error message
1932 tls_validate_require_cipher(void)
1935 uschar *expciphers = NULL;
1936 gnutls_priority_t priority_cache;
1939 #define validate_check_rc(Label) do { \
1940 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
1941 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
1942 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
1944 if (exim_gnutls_base_init_done)
1945 log_write(0, LOG_MAIN|LOG_PANIC,
1946 "already initialised GnuTLS, Exim developer bug");
1948 rc = gnutls_global_init();
1949 validate_check_rc(US"gnutls_global_init()");
1950 exim_gnutls_base_init_done = TRUE;
1952 if (!(tls_require_ciphers && *tls_require_ciphers))
1953 return_deinit(NULL);
1955 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
1956 return_deinit(US"failed to expand tls_require_ciphers");
1958 if (!(expciphers && *expciphers))
1959 return_deinit(NULL);
1962 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
1964 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
1965 validate_check_rc(string_sprintf(
1966 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
1967 expciphers, errpos - CS expciphers, errpos));
1969 #undef return_deinit
1970 #undef validate_check_rc
1971 gnutls_global_deinit();
1979 /*************************************************
1980 * Report the library versions. *
1981 *************************************************/
1983 /* See a description in tls-openssl.c for an explanation of why this exists.
1985 Arguments: a FILE* to print the results to
1990 tls_version_report(FILE *f)
1992 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
1995 gnutls_check_version(NULL));
1998 /* End of tls-gnu.c */