1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Copyright (c) Phil Pennock 2012 */
11 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
12 one of the available supported implementations. This file is #included into
13 tls.c when USE_GNUTLS has been set.
15 The code herein is a revamp of GnuTLS integration using the current APIs; the
16 original tls-gnu.c was based on a patch which was contributed by Nikos
17 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
20 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
21 which is not widely deployed by OS vendors. Will note issues below, which may
22 assist in updating the code in the future. Another sources of hints is
23 mod_gnutls for Apache (SNI callback registration and handling).
25 Keeping client and server variables more split than before and is currently
26 the norm, in anticipation of TLS in ACL callouts.
28 I wanted to switch to gnutls_certificate_set_verify_function() so that
29 certificate rejection could happen during handshake where it belongs, rather
30 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
31 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
33 (I wasn't looking for libraries quite that old, when updating to get rid of
34 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
35 require current GnuTLS, then we'll drop support for the ancient libraries).
38 #include <gnutls/gnutls.h>
39 /* needed for cert checks in verification and DN extraction: */
40 #include <gnutls/x509.h>
41 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
42 #include <gnutls/crypto.h>
44 /* needed to disable PKCS11 autoload unless requested */
45 #if GNUTLS_VERSION_NUMBER >= 0x020c00
46 # include <gnutls/pkcs11.h>
47 # define SUPPORT_PARAM_TO_PK_BITS
49 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
50 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
53 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
54 # warning "GnuTLS library version too old; tls:cert event unsupported"
55 # define DISABLE_EVENT
57 #if GNUTLS_VERSION_NUMBER >= 0x030000
58 # define SUPPORT_SELFSIGN /* Uncertain what version is first usable but 2.12.23 is not */
60 #if GNUTLS_VERSION_NUMBER >= 0x030306
61 # define SUPPORT_CA_DIR
63 # undef SUPPORT_CA_DIR
65 #if GNUTLS_VERSION_NUMBER >= 0x030014
66 # define SUPPORT_SYSDEFAULT_CABUNDLE
68 #if GNUTLS_VERSION_NUMBER >= 0x030104
69 # define GNUTLS_CERT_VFY_STATUS_PRINT
71 #if GNUTLS_VERSION_NUMBER >= 0x030109
74 #if GNUTLS_VERSION_NUMBER >= 0x03010a
75 # define SUPPORT_GNUTLS_SESS_DESC
77 #if GNUTLS_VERSION_NUMBER >= 0x030300
78 # define GNUTLS_AUTO_GLOBAL_INIT
79 # define GNUTLS_AUTO_PKCS11_MANUAL
81 #if (GNUTLS_VERSION_NUMBER >= 0x030404) \
82 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
84 # define EXIM_HAVE_OCSP
87 #if GNUTLS_VERSION_NUMBER >= 0x030500
88 # define SUPPORT_GNUTLS_KEYLOG
90 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
91 # define SUPPORT_SRV_OCSP_STACK
93 #if GNUTLS_VERSION_NUMBER >= 0x030600
94 # define GNUTLS_AUTO_DHPARAMS
96 #if GNUTLS_VERSION_NUMBER >= 0x030603
97 # define EXIM_HAVE_TLS1_3
98 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
99 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
103 # if GNUTLS_VERSION_NUMBER >= 0x030000
104 # define DANESSL_USAGE_DANE_TA 2
105 # define DANESSL_USAGE_DANE_EE 3
107 # error GnuTLS version too early for DANE
109 # if GNUTLS_VERSION_NUMBER < 0x999999
110 # define GNUTLS_BROKEN_DANE_VALIDATION
114 #ifndef DISABLE_TLS_RESUME
115 # if GNUTLS_VERSION_NUMBER >= 0x030603
116 # define EXIM_HAVE_TLS_RESUME
118 # warning "GnuTLS library version too old; resumption unsupported"
122 #if GNUTLS_VERSION_NUMBER >= 0x030200
123 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
124 # define EXIM_HAVE_ALPN
129 # include <gnutls/ocsp.h>
132 # include <gnutls/dane.h>
135 #include "tls-cipher-stdname.c"
142 # ifndef DISABLE_TLS_RESUME
143 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
145 # ifdef EXIM_HAVE_TLS1_3
146 builtin_macro_create(US"_HAVE_TLS1_3");
148 # ifdef EXIM_HAVE_OCSP
149 builtin_macro_create(US"_HAVE_TLS_OCSP");
151 # ifdef SUPPORT_SRV_OCSP_STACK
152 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
154 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
155 builtin_macro_create(US"_HAVE_TLS_CA_CACHE");
157 # ifdef EXIM_HAVE_ALPN
158 builtin_macro_create(US"_HAVE_TLS_ALPN");
167 gnutls_global_set_audit_log_function()
170 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
173 /* Local static variables for GnuTLS */
175 /* Values for verify_requirement */
177 enum peer_verify_requirement
178 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
180 /* This holds most state for server or client; with this, we can set up an
181 outbound TLS-enabled connection in an ACL callout, while not stomping all
182 over the TLS variables available for expansion.
184 Some of these correspond to variables in globals.c; those variables will
185 be set to point to content in one of these instances, as appropriate for
186 the stage of the process lifetime.
188 Not handled here: global tlsp->tls_channelbinding.
191 typedef struct exim_gnutls_state {
192 gnutls_session_t session;
194 exim_tlslib_state lib_state;
195 #define x509_cred libdata0
196 #define pri_cache libdata1
198 enum peer_verify_requirement verify_requirement;
202 BOOL peer_cert_verified:1;
203 BOOL peer_dane_verified:1;
204 BOOL trigger_sni_changes:1;
205 BOOL have_set_peerdn:1;
206 BOOL xfer_eof:1; /*XXX never gets set! */
212 const struct host_item *host; /* NULL if server */
213 gnutls_x509_crt_t peercert;
216 uschar *received_sni;
218 const uschar *tls_certificate;
219 const uschar *tls_privatekey;
220 const uschar *tls_sni; /* client send only, not received */
221 const uschar *tls_verify_certificates;
222 const uschar *tls_crl;
223 const uschar *tls_require_ciphers;
225 uschar *exp_tls_certificate;
226 uschar *exp_tls_privatekey;
227 uschar *exp_tls_verify_certificates;
229 uschar *exp_tls_require_ciphers;
230 const uschar *exp_tls_verify_cert_hostnames;
231 #ifndef DISABLE_EVENT
232 uschar *event_action;
235 char * const * dane_data;
236 const int * dane_data_len;
239 tls_support *tlsp; /* set in tls_init() */
244 } exim_gnutls_state_st;
246 static const exim_gnutls_state_st exim_gnutls_state_init = {
247 /* all elements not explicitly intialised here get 0/NULL/FALSE */
252 /* Not only do we have our own APIs which don't pass around state, assuming
253 it's held in globals, GnuTLS doesn't appear to let us register callback data
254 for callbacks, or as part of the session, so we have to keep a "this is the
255 context we're currently dealing with" pointer and rely upon being
256 single-threaded to keep from processing data on an inbound TLS connection while
257 talking to another TLS connection for an outbound check. This does mean that
258 there's no way for heart-beats to be responded to, for the duration of the
260 XXX But see gnutls_session_get_ptr()
263 static exim_gnutls_state_st state_server = {
264 /* all elements not explicitly intialised here get 0/NULL/FALSE */
269 #ifndef GNUTLS_AUTO_DHPARAMS
270 /* dh_params are initialised once within the lifetime of a process using TLS;
271 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
272 don't want to repeat this. */
274 static gnutls_dh_params_t dh_server_params = NULL;
277 static int ssl_session_timeout = 7200; /* Two hours */
279 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
281 /* Guard library core initialisation */
283 static BOOL exim_gnutls_base_init_done = FALSE;
286 static BOOL gnutls_buggy_ocsp = FALSE;
287 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
290 #ifdef EXIM_HAVE_ALPN
291 static int server_seen_alpn = -1; /* count of names */
293 #ifdef EXIM_HAVE_TLS_RESUME
294 static gnutls_datum_t server_sessticket_key;
298 /* ------------------------------------------------------------------------ */
301 #define MAX_HOST_LEN 255
303 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
304 the library logging; a value less than 0 disables the calls to set up logging
305 callbacks. GNuTLS also looks for an environment variable - except not for
306 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
307 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
308 but the env var must be added to /etc/sudoers too. */
309 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
310 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
313 #ifndef EXIM_CLIENT_DH_MIN_BITS
314 # define EXIM_CLIENT_DH_MIN_BITS 1024
317 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
318 can ask for a bit-strength. Without that, we stick to the constant we had
320 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
321 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
324 #define Expand_check_tlsvar(Varname, errstr) \
325 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
327 #if GNUTLS_VERSION_NUMBER >= 0x020c00
328 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
329 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
330 # define HAVE_GNUTLS_RND
331 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
332 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
333 * isn't available sometimes, so this needs to become a conditional
334 * compilation; the sanest way to deal with this being a problem on
335 * older OSes is to block it in the Local/Makefile with this compiler
337 # ifndef AVOID_GNUTLS_PKCS11
338 # define HAVE_GNUTLS_PKCS11
339 # endif /* AVOID_GNUTLS_PKCS11 */
345 /* ------------------------------------------------------------------------ */
346 /* Callback declarations */
348 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
349 static void exim_gnutls_logger_cb(int level, const char *message);
352 static int exim_sni_handling_cb(gnutls_session_t session);
354 #ifdef EXIM_HAVE_TLS_RESUME
356 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
357 unsigned incoming, const gnutls_datum_t * msg);
361 /*************************************************
363 *************************************************/
365 /* Called from lots of places when errors occur before actually starting to do
366 the TLS handshake, that is, while the session is still in clear. Always returns
367 DEFER for a server and FAIL for a client so that most calls can use "return
368 tls_error(...)" to do this processing and then give an appropriate return. A
369 single function is used for both server and client, because it is called from
370 some shared functions.
373 prefix text to include in the logged error
374 msg additional error string (may be NULL)
375 usually obtained from gnutls_strerror()
376 host NULL if setting up a server;
377 the connected host if setting up a client
378 errstr pointer to returned error string
380 Returns: OK/DEFER/FAIL
384 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
388 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
389 return host ? FAIL : DEFER;
394 tls_error_gnu(exim_gnutls_state_st * state, const uschar *prefix, int err,
397 return tls_error(prefix,
398 state && err == GNUTLS_E_FATAL_ALERT_RECEIVED
399 ? US gnutls_alert_get_name(gnutls_alert_get(state->session))
400 : US gnutls_strerror(err),
401 state ? state->host : NULL,
406 tls_error_sys(const uschar *prefix, int err, const host_item *host,
409 return tls_error(prefix, US strerror(err), host, errstr);
413 /* ------------------------------------------------------------------------ */
419 tls_is_buggy_ocsp(void)
422 uschar maj, mid, mic;
424 s = CUS gnutls_check_version(NULL);
428 while (*s && *s != '.') s++;
436 while (*s && *s != '.') s++;
438 return mic <= (mid == 3 ? 16 : 3);
448 tls_g_init(uschar ** errstr)
451 DEBUG(D_tls) debug_printf("GnuTLS global init required\n");
453 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
454 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
455 which loads modules from a config file, which sounds good and may be wanted
456 by some sysadmin, but also means in common configurations that GNOME keyring
457 environment variables are used and so breaks for users calling mailq.
458 To prevent this, we init PKCS11 first, which is the documented approach. */
460 if (!gnutls_allow_auto_pkcs11)
461 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
462 return tls_error_gnu(NULL, US"gnutls_pkcs11_init", rc, errstr);
465 #ifndef GNUTLS_AUTO_GLOBAL_INIT
466 if ((rc = gnutls_global_init()))
467 return tls_error_gnu(NULL, US"gnutls_global_init", rc, errstr);
470 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
473 gnutls_global_set_log_function(exim_gnutls_logger_cb);
474 /* arbitrarily chosen level; bump up to 9 for more */
475 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
480 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
481 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
484 exim_gnutls_base_init_done = TRUE;
490 /* Daemon-call before each connection. Nothing to do for GnuTLS. */
493 tls_per_lib_daemon_tick(void)
497 /* Daemon one-time initialisation */
500 tls_per_lib_daemon_init(void)
502 uschar * dummy_errstr;
503 static BOOL once = FALSE;
505 if (!exim_gnutls_base_init_done)
506 tls_g_init(&dummy_errstr);
512 #ifdef EXIM_HAVE_TLS_RESUME
513 /* We are dependent on the GnuTLS implementation of the Session Ticket
514 encryption; both the strength and the key rotation period. We hope that
515 the strength at least matches that of the ciphersuite (but GnuTLS does not
518 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
519 if (f.running_in_test_harness) ssl_session_timeout = 6;
522 tls_daemon_creds_reload();
526 /* ------------------------------------------------------------------------ */
528 /*************************************************
529 * Deal with logging errors during I/O *
530 *************************************************/
532 /* We have to get the identity of the peer from saved data.
535 state the current GnuTLS exim state container
536 rc the GnuTLS error code, or 0 if it's a local error
537 when text identifying read or write
538 text local error text when rc is 0
544 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
549 msg = rc == GNUTLS_E_FATAL_ALERT_RECEIVED
550 ? string_sprintf("A TLS fatal alert has been received: %s",
551 US gnutls_alert_get_name(gnutls_alert_get(state->session)))
552 #ifdef GNUTLS_E_PREMATURE_TERMINATION
553 : rc == GNUTLS_E_PREMATURE_TERMINATION && errno
554 ? string_sprintf("%s: syscall: %s", US gnutls_strerror(rc), strerror(errno))
556 : US gnutls_strerror(rc);
558 (void) tls_error(when, msg, state->host, &errstr);
561 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
562 state->host->name, state->host->address, errstr);
565 uschar * conn_info = smtp_get_connection_info();
566 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
567 /* I'd like to get separated H= here, but too hard for now */
568 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
575 /*************************************************
576 * Set various Exim expansion vars *
577 *************************************************/
579 #define exim_gnutls_cert_err(Label) \
582 if (rc != GNUTLS_E_SUCCESS) \
584 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
585 (Label), gnutls_strerror(rc)); \
591 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
595 rc = gnutls_x509_crt_init(crtp);
596 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
598 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
599 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
604 #undef exim_gnutls_cert_err
607 /* We set various Exim global variables from the state, once a session has
608 been established. With TLS callouts, may need to change this to stack
609 variables, or just re-call it with the server state after client callout
612 Make sure anything set here is unset in tls_getc().
616 tls_bits strength indicator
617 tls_certificate_verified bool indicator
618 tls_channelbinding for some SASL mechanisms
621 tls_peercert pointer to library internal
623 tls_sni a (UTF-8) string
624 tls_ourcert pointer to library internal
627 state the relevant exim_gnutls_state_st *
631 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
633 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
636 gnutls_datum_t channel;
638 tls_support * tlsp = state->tlsp;
640 tlsp->active.sock = state->fd_out;
641 tlsp->active.tls_ctx = state;
643 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
645 tlsp->certificate_verified = state->peer_cert_verified;
647 tlsp->dane_verified = state->peer_dane_verified;
650 /* note that tls_channelbinding is not saved to the spool file, since it's
651 only available for use for authenticators while this TLS session is running. */
653 tlsp->channelbinding = NULL;
654 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
657 if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
658 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
661 /* Declare the taintedness of the binding info. On server, untainted; on
662 client, tainted - being the Finish msg from the server. */
664 old_pool = store_pool;
665 store_pool = POOL_PERM;
666 tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size,
668 store_pool = old_pool;
669 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n");
673 /* peercert is set in peer_status() */
674 tlsp->peerdn = state->peerdn;
676 /* do not corrupt sni sent by client; record sni rxd by server */
678 tlsp->sni = state->received_sni;
680 /* record our certificate */
682 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
683 gnutls_x509_crt_t crt;
685 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
692 #ifndef GNUTLS_AUTO_DHPARAMS
693 /*************************************************
694 * Setup up DH parameters *
695 *************************************************/
697 /* Generating the D-H parameters may take a long time. They only need to
698 be re-generated every so often, depending on security policy. What we do is to
699 keep these parameters in a file in the spool directory. If the file does not
700 exist, we generate them. This means that it is easy to cause a regeneration.
702 The new file is written as a temporary file and renamed, so that an incomplete
703 file is never present. If two processes both compute some new parameters, you
704 waste a bit of effort, but it doesn't seem worth messing around with locking to
707 Returns: OK/DEFER/FAIL
711 init_server_dh(uschar ** errstr)
714 unsigned int dh_bits;
715 gnutls_datum_t m = {.data = NULL, .size = 0};
716 uschar filename_buf[PATH_MAX];
717 uschar *filename = NULL;
719 uschar *exp_tls_dhparam;
720 BOOL use_file_in_spool = FALSE;
721 host_item *host = NULL; /* dummy for macros */
723 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params\n");
725 if ((rc = gnutls_dh_params_init(&dh_server_params)))
726 return tls_error_gnu(NULL, US"gnutls_dh_params_init", rc, errstr);
728 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
731 if (!exp_tls_dhparam)
733 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
734 m.data = US std_dh_prime_default();
735 m.size = Ustrlen(m.data);
737 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
738 use_file_in_spool = TRUE;
739 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
741 DEBUG(D_tls) debug_printf("Requested no DH parameters\n");
744 else if (exp_tls_dhparam[0] != '/')
746 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
747 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
748 m.size = Ustrlen(m.data);
751 filename = exp_tls_dhparam;
755 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
756 return tls_error_gnu(NULL, US"gnutls_dh_params_import_pkcs3", rc, errstr);
757 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
761 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
762 /* If you change this constant, also change dh_param_fn_ext so that we can use a
763 different filename and ensure we have sufficient bits. */
765 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
766 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
768 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits\n",
771 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
773 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits\n",
777 /* Some clients have hard-coded limits. */
778 if (dh_bits > tls_dh_max_bits)
781 debug_printf("tls_dh_max_bits clamping override, using %d bits instead\n",
783 dh_bits = tls_dh_max_bits;
786 if (use_file_in_spool)
788 if (!string_format(filename_buf, sizeof(filename_buf),
789 "%s/gnutls-params-%d", spool_directory, dh_bits))
790 return tls_error(US"overlong filename", NULL, NULL, errstr);
791 filename = filename_buf;
794 /* Open the cache file for reading and if successful, read it and set up the
797 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
803 if (fstat(fd, &statbuf) < 0) /* EIO */
807 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
809 if (!S_ISREG(statbuf.st_mode))
812 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
814 if (!(fp = fdopen(fd, "rb")))
818 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
819 saved_errno, NULL, errstr);
822 m.size = statbuf.st_size;
823 if (!(m.data = store_malloc(m.size)))
826 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
828 if (!(sz = fread(m.data, m.size, 1, fp)))
833 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
837 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
840 return tls_error_gnu(NULL, US"gnutls_dh_params_import_pkcs3", rc, errstr);
841 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
844 /* If the file does not exist, fall through to compute new data and cache it.
845 If there was any other opening error, it is serious. */
847 else if (errno == ENOENT)
851 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
854 return tls_error(string_open_failed("\"%s\" for reading", filename),
857 /* If ret < 0, either the cache file does not exist, or the data it contains
858 is not useful. One particular case of this is when upgrading from an older
859 release of Exim in which the data was stored in a different format. We don't
860 try to be clever and support both formats; we just regenerate new data in this
866 unsigned int dh_bits_gen = dh_bits;
868 if ((PATH_MAX - Ustrlen(filename)) < 10)
869 return tls_error(US"Filename too long to generate replacement",
870 filename, NULL, errstr);
872 temp_fn = string_copy(US"exim-dh.XXXXXXX");
873 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
874 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
875 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
877 /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But
878 there's no way to ask GnuTLS how many bits there really are. We can ask
879 how many bits were used in a TLS session, but that's it! The prime itself
880 is hidden behind too much abstraction. So we ask for less, and proceed on
881 a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */
883 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
885 dh_bits_gen = dh_bits - 10;
887 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
892 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
894 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
895 return tls_error_gnu(NULL, US"gnutls_dh_params_generate2", rc, errstr);
897 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
898 and I confirmed that a NULL call to get the size first is how the GnuTLS
899 sample apps handle this. */
903 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
904 GNUTLS_X509_FMT_PEM, m.data, &sz))
905 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
906 return tls_error_gnu(NULL, US"gnutls_dh_params_export_pkcs3(NULL) sizing",
909 if (!(m.data = store_malloc(m.size)))
910 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
912 /* this will return a size 1 less than the allocation size above */
913 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
917 return tls_error_gnu(NULL, US"gnutls_dh_params_export_pkcs3() real", rc, errstr);
919 m.size = sz; /* shrink by 1, probably */
921 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
924 return tls_error_sys(US"TLS cache write D-H params failed",
925 errno, NULL, errstr);
928 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
929 return tls_error_sys(US"TLS cache write D-H params final newline failed",
930 errno, NULL, errstr);
932 if ((rc = close(fd)))
933 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
935 if (Urename(temp_fn, filename) < 0)
936 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
937 temp_fn, filename), errno, NULL, errstr);
939 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
942 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
950 /* Create and install a selfsigned certificate, for use in server mode. */
953 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
955 gnutls_x509_crt_t cert = NULL;
957 gnutls_x509_privkey_t pkey = NULL;
958 const uschar * where;
961 #ifndef SUPPORT_SELFSIGN
962 where = US"library too old";
963 rc = GNUTLS_E_NO_CERTIFICATE_FOUND;
967 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
968 where = US"initialising pkey";
969 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
971 where = US"initialising cert";
972 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
974 where = US"generating pkey"; /* Hangs on 2.12.23 */
975 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
976 #ifdef SUPPORT_PARAM_TO_PK_BITS
977 # ifndef GNUTLS_SEC_PARAM_MEDIUM
978 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
980 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
987 where = US"configuring cert";
989 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
990 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
991 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
992 || (rc = gnutls_x509_crt_set_expiration_time(cert, (long)2 * 60 * 60)) /* 2 hour */
993 || (rc = gnutls_x509_crt_set_key(cert, pkey))
995 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
996 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
997 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
998 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
999 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
1000 GNUTLS_OID_X520_COMMON_NAME, 0,
1001 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
1005 where = US"signing cert";
1006 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
1008 where = US"installing selfsign cert";
1010 if ((rc = gnutls_certificate_set_x509_key(state->lib_state.x509_cred,
1017 if (cert) gnutls_x509_crt_deinit(cert);
1018 if (pkey) gnutls_x509_privkey_deinit(pkey);
1022 rc = tls_error_gnu(state, where, rc, errstr);
1029 /* Add certificate and key, from files.
1032 Zero or negative: good. Negate value for certificate index if < 0.
1033 Greater than zero: FAIL or DEFER code.
1037 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
1038 const uschar * certfile, const uschar * keyfile, uschar ** errstr)
1040 int rc = gnutls_certificate_set_x509_key_file(state->lib_state.x509_cred,
1041 CCS certfile, CCS keyfile, GNUTLS_X509_FMT_PEM);
1043 return tls_error_gnu(state,
1044 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
1050 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1051 /* Load an OCSP proof from file for sending by the server. Called
1052 on getting a status-request handshake message, for earlier versions
1056 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1057 gnutls_datum_t * ocsp_response)
1060 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
1062 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1064 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1066 tls_in.ocsp = OCSP_NOT_RESP;
1067 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1070 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1076 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1077 /* Make a note that we saw a status-request */
1079 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
1080 const uschar * data, unsigned size)
1082 /* The values for tls_id are documented here:
1083 https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1086 case 5: /* Status Request */
1087 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
1088 tls_in.ocsp = OCSP_NOT_RESP;
1090 #ifdef EXIM_HAVE_ALPN
1091 case 16: /* Application Layer Protocol Notification */
1092 /* The format of "data" here doesn't seem to be documented, but appears
1093 to be a 2-byte field with a (redundant, given the "size" arg) total length
1094 then a sequence of one-byte size then string (not nul-term) names. The
1095 latter is as described in OpenSSL documentation. */
1097 DEBUG(D_tls) debug_printf("Seen ALPN extension from client (s=%u):", size);
1098 for (const uschar * s = data+2; s-data < size-1; s += *s + 1)
1101 DEBUG(D_tls) debug_printf(" '%.*s'", (int)*s, s+1);
1103 DEBUG(D_tls) debug_printf("\n");
1104 if (server_seen_alpn > 1)
1106 DEBUG(D_tls) debug_printf("TLS: too many ALPNs presented in handshake\n");
1107 return GNUTLS_E_NO_APPLICATION_PROTOCOL;
1115 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
1117 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
1118 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1120 /* Call fn for each extension seen. 3.6.3 onwards */
1121 return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
1122 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
1126 # ifdef notdef_crashes
1127 /* Make a note that we saw a status-response */
1129 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
1130 const unsigned char *data, unsigned size)
1132 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
1133 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1134 if (FALSE && tls_id == 5) /* status_request */
1136 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
1137 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1138 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1144 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
1146 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
1147 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1149 /* Call fn for each extension seen. 3.6.3 onwards */
1150 # ifdef notdef_crashes
1152 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
1155 #endif /*SUPPORT_GNUTLS_EXT_RAW_PARSE*/
1157 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
1158 "Handshake Protocol: Certificate" record.
1159 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
1161 This is different to tls1.2 - where it is a separate record (wireshark term) / handshake message (gnutls term).
1164 #if defined(EXIM_HAVE_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1165 /* Callback for certificate-status, on server. We sent stapled OCSP. */
1167 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
1168 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1170 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
1171 # ifdef SUPPORT_SRV_OCSP_STACK
1172 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1173 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1175 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1180 /* Callback for handshake messages, on server */
1182 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1183 unsigned incoming, const gnutls_datum_t * msg)
1185 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
1188 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1189 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1190 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1191 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1192 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1194 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1195 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1196 # ifdef EXIM_HAVE_TLS_RESUME
1197 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1198 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1207 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1209 tls_server_testharness_ocsp_fiddle(void)
1211 extern char ** environ;
1212 if (environ) for (uschar ** p = USS environ; *p; p++)
1213 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1215 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1216 exim_testharness_disable_ocsp_validity_check = TRUE;
1221 /**************************************************
1222 * One-time init credentials for server and client *
1223 **************************************************/
1226 creds_basic_init(gnutls_certificate_credentials_t x509_cred, BOOL server)
1228 #ifdef SUPPORT_SRV_OCSP_STACK
1229 gnutls_certificate_set_flags(x509_cred, GNUTLS_CERTIFICATE_API_V2);
1231 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1232 if (server && tls_ocsp_file)
1234 if (f.running_in_test_harness)
1235 tls_server_testharness_ocsp_fiddle();
1237 if (exim_testharness_disable_ocsp_validity_check)
1238 gnutls_certificate_set_flags(x509_cred,
1239 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1244 debug_printf("TLS: basic cred init, %s\n", server ? "server" : "client");
1248 creds_load_server_certs(exim_gnutls_state_st * state, const uschar * cert,
1249 const uschar * pkey, const uschar * ocsp, uschar ** errstr)
1251 const uschar * clist = cert;
1252 const uschar * klist = pkey;
1253 const uschar * olist;
1254 int csep = 0, ksep = 0, osep = 0, cnt = 0, rc;
1255 uschar * cfile, * kfile, * ofile;
1256 #ifndef DISABLE_OCSP
1257 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1258 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1261 if (!expand_check(ocsp, US"tls_ocsp_file", &ofile, errstr))
1266 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1268 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1269 return tls_error(US"cert/key setup: out of keys", NULL, NULL, errstr);
1270 else if ((rc = tls_add_certfile(state, NULL, cfile, kfile, errstr)) > 0)
1274 int gnutls_cert_index = -rc;
1275 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1276 gnutls_cert_index, cfile);
1278 #ifndef DISABLE_OCSP
1281 /* Set the OCSP stapling server info */
1282 if (gnutls_buggy_ocsp)
1285 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1287 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1289 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1290 gnutls_cert_index, ofile);
1291 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1292 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1294 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1297 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1299 ocsp_fmt = GNUTLS_X509_FMT_DER;
1303 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1304 state->lib_state.x509_cred, CCS ofile, gnutls_cert_index,
1306 return tls_error_gnu(state,
1307 US"gnutls_certificate_set_ocsp_status_request_file2",
1310 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1312 /* Arrange callbacks for OCSP request observability */
1315 gnutls_handshake_set_hook_function(state->session,
1316 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1318 state->lib_state.ocsp_hook = TRUE;
1322 # if defined(SUPPORT_SRV_OCSP_STACK)
1323 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1324 state->lib_state.x509_cred, gnutls_cert_index,
1325 server_ocsp_stapling_cb, ofile)))
1326 return tls_error_gnu(state,
1327 US"gnutls_certificate_set_ocsp_status_request_function2",
1335 debug_printf("oops; multiple OCSP files not supported\n");
1338 gnutls_certificate_set_ocsp_status_request_function(
1339 state->lib_state.x509_cred, server_ocsp_stapling_cb, ofile);
1341 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1344 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1346 #endif /* DISABLE_OCSP */
1352 creds_load_client_certs(exim_gnutls_state_st * state, const host_item * host,
1353 const uschar * cert, const uschar * pkey, uschar ** errstr)
1355 int rc = tls_add_certfile(state, host, cert, pkey, errstr);
1356 if (rc > 0) return rc;
1357 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1362 creds_load_cabundle(exim_gnutls_state_st * state, const uschar * bundle,
1363 const host_item * host, uschar ** errstr)
1366 struct stat statbuf;
1368 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1369 if (Ustrcmp(bundle, "system") == 0 || Ustrncmp(bundle, "system,", 7) == 0)
1370 cert_count = gnutls_certificate_set_x509_system_trust(state->lib_state.x509_cred);
1374 if (Ustat(bundle, &statbuf) < 0)
1376 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1377 "(tls_verify_certificates): %s", bundle, strerror(errno));
1381 #ifndef SUPPORT_CA_DIR
1382 /* The test suite passes in /dev/null; we could check for that path explicitly,
1383 but who knows if someone has some weird FIFO which always dumps some certs, or
1384 other weirdness. The thing we really want to check is that it's not a
1385 directory, since while OpenSSL supports that, GnuTLS does not.
1386 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1387 if (S_ISDIR(statbuf.st_mode))
1389 log_write(0, LOG_MAIN|LOG_PANIC,
1390 "tls_verify_certificates \"%s\" is a directory", bundle);
1395 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1396 bundle, statbuf.st_size);
1398 if (statbuf.st_size == 0)
1401 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1407 #ifdef SUPPORT_CA_DIR
1408 (statbuf.st_mode & S_IFMT) == S_IFDIR
1410 gnutls_certificate_set_x509_trust_dir(state->lib_state.x509_cred,
1411 CS bundle, GNUTLS_X509_FMT_PEM)
1414 gnutls_certificate_set_x509_trust_file(state->lib_state.x509_cred,
1415 CS bundle, GNUTLS_X509_FMT_PEM);
1417 #ifdef SUPPORT_CA_DIR
1418 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1419 when using the directory-of-certs config model. */
1421 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1423 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1425 state->lib_state.ca_rdn_emulate = TRUE;
1430 return tls_error_gnu(state, US"setting certificate trust", cert_count, errstr);
1432 debug_printf("Added %d certificate authorities\n", cert_count);
1439 creds_load_crl(exim_gnutls_state_st * state, const uschar * crl, uschar ** errstr)
1442 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", crl);
1443 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->lib_state.x509_cred,
1444 CS crl, GNUTLS_X509_FMT_PEM)) < 0)
1445 return tls_error_gnu(state, US"gnutls_certificate_set_x509_crl_file",
1446 cert_count, errstr);
1448 DEBUG(D_tls) debug_printf("Processed %d CRLs\n", cert_count);
1454 creds_load_pristring(exim_gnutls_state_st * state, const uschar * p,
1455 const char ** errpos)
1459 p = exim_default_gnutls_priority;
1461 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1463 return gnutls_priority_init( (gnutls_priority_t *) &state->lib_state.pri_cache,
1468 tls_server_creds_init(void)
1470 uschar * dummy_errstr;
1471 unsigned lifetime = 0;
1473 state_server.lib_state = null_tls_preload;
1474 if (gnutls_certificate_allocate_credentials(
1475 (gnutls_certificate_credentials_t *) &state_server.lib_state.x509_cred))
1477 state_server.lib_state.x509_cred = NULL;
1480 creds_basic_init(state_server.lib_state.x509_cred, TRUE);
1482 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1483 /* If tls_certificate has any $ indicating expansions, it is not good.
1484 If tls_privatekey is set but has $, not good. Likewise for tls_ocsp_file.
1485 If all good (and tls_certificate set), load the cert(s). */
1487 if ( opt_set_and_noexpand(tls_certificate)
1488 # ifndef DISABLE_OCSP
1489 && opt_unset_or_noexpand(tls_ocsp_file)
1491 && opt_unset_or_noexpand(tls_privatekey))
1493 /* Set watches on the filenames. The implementation does de-duplication
1494 so we can just blindly do them all.
1497 if ( tls_set_watch(tls_certificate, TRUE)
1498 # ifndef DISABLE_OCSP
1499 && tls_set_watch(tls_ocsp_file, TRUE)
1501 && tls_set_watch(tls_privatekey, TRUE))
1503 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1504 if (creds_load_server_certs(&state_server, tls_certificate,
1505 tls_privatekey && *tls_privatekey ? tls_privatekey : tls_certificate,
1506 # ifdef DISABLE_OCSP
1511 &dummy_errstr) == 0)
1512 state_server.lib_state.conn_certs = TRUE;
1515 else if ( !tls_certificate && !tls_privatekey
1516 # ifndef DISABLE_OCSP
1520 { /* Generate & preload a selfsigned cert. No files to watch. */
1521 if ((tls_install_selfsign(&state_server, &dummy_errstr)) == OK)
1523 state_server.lib_state.conn_certs = TRUE;
1524 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1528 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1530 /* If tls_verify_certificates is non-empty and has no $, load CAs.
1531 If none was configured and we can't handle "system", treat as empty. */
1533 if ( opt_set_and_noexpand(tls_verify_certificates)
1534 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1535 && Ustrcmp(tls_verify_certificates, "system") != 0
1539 if (tls_set_watch(tls_verify_certificates, FALSE))
1541 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1542 if (creds_load_cabundle(&state_server, tls_verify_certificates,
1543 NULL, &dummy_errstr) != OK)
1545 state_server.lib_state.cabundle = TRUE;
1547 /* If CAs loaded and tls_crl is non-empty and has no $, load it */
1549 if (opt_set_and_noexpand(tls_crl))
1551 if (tls_set_watch(tls_crl, FALSE))
1553 DEBUG(D_tls) debug_printf("TLS: preloading CRL for server\n");
1554 if (creds_load_crl(&state_server, tls_crl, &dummy_errstr) != OK)
1556 state_server.lib_state.crl = TRUE;
1560 DEBUG(D_tls) debug_printf("TLS: not preloading CRL for server\n");
1564 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1565 #endif /* EXIM_HAVE_INOTIFY */
1567 /* If tls_require_ciphers is non-empty and has no $, load the
1568 ciphers priority cache. If unset, load with the default.
1569 (server-only as the client one depends on non/DANE) */
1571 if (!tls_require_ciphers || opt_set_and_noexpand(tls_require_ciphers))
1573 const char * dummy_errpos;
1574 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server: %s\n",
1575 tls_require_ciphers);
1576 if ( creds_load_pristring(&state_server, tls_require_ciphers, &dummy_errpos)
1578 state_server.lib_state.pri_string = TRUE;
1581 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1586 /* Preload whatever creds are static, onto a transport. The client can then
1587 just copy the pointer as it starts up. */
1590 tls_client_creds_init(transport_instance * t, BOOL watch)
1592 smtp_transport_options_block * ob = t->options_block;
1593 exim_gnutls_state_st tpt_dummy_state;
1594 host_item * dummy_host = (host_item *)1;
1595 uschar * dummy_errstr;
1597 if ( !exim_gnutls_base_init_done
1598 && tls_g_init(&dummy_errstr) != OK)
1601 ob->tls_preload = null_tls_preload;
1602 if (gnutls_certificate_allocate_credentials(
1603 (struct gnutls_certificate_credentials_st **)&ob->tls_preload.x509_cred))
1605 ob->tls_preload.x509_cred = NULL;
1608 creds_basic_init(ob->tls_preload.x509_cred, FALSE);
1610 tpt_dummy_state.session = NULL;
1611 tpt_dummy_state.lib_state = ob->tls_preload;
1613 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1614 if ( opt_set_and_noexpand(ob->tls_certificate)
1615 && opt_unset_or_noexpand(ob->tls_privatekey))
1618 || ( tls_set_watch(ob->tls_certificate, FALSE)
1619 && tls_set_watch(ob->tls_privatekey, FALSE)
1622 const uschar * pkey = ob->tls_privatekey;
1625 debug_printf("TLS: preloading client certs for transport '%s'\n", t->name);
1627 /* The state->lib_state.x509_cred is used for the certs load, and is the sole
1628 structure element used. So we can set up a dummy. The hoat arg only
1629 selects a retcode in case of fail, so any value */
1631 if (creds_load_client_certs(&tpt_dummy_state, dummy_host,
1632 ob->tls_certificate, pkey ? pkey : ob->tls_certificate,
1633 &dummy_errstr) == OK)
1634 ob->tls_preload.conn_certs = TRUE;
1639 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1641 /* If tls_verify_certificates is non-empty and has no $, load CAs.
1642 If none was configured and we can't handle "system", treat as empty. */
1644 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1645 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1646 && Ustrcmp(ob->tls_verify_certificates, "system") != 0
1650 if (!watch || tls_set_watch(ob->tls_verify_certificates, FALSE))
1653 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1654 if (creds_load_cabundle(&tpt_dummy_state, ob->tls_verify_certificates,
1655 dummy_host, &dummy_errstr) != OK)
1657 ob->tls_preload.cabundle = TRUE;
1659 if (opt_set_and_noexpand(ob->tls_crl))
1661 if (!watch || tls_set_watch(ob->tls_crl, FALSE))
1663 DEBUG(D_tls) debug_printf("TLS: preloading CRL for transport '%s'\n", t->name);
1664 if (creds_load_crl(&tpt_dummy_state, ob->tls_crl, &dummy_errstr) != OK)
1666 ob->tls_preload.crl = TRUE;
1670 DEBUG(D_tls) debug_printf("TLS: not preloading CRL, for transport '%s'\n", t->name);
1675 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1677 /* We do not preload tls_require_ciphers to to the transport as it implicitly
1678 depends on DANE or plain usage. */
1684 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1685 /* Invalidate the creds cached, by dropping the current ones.
1686 Call when we notice one of the source files has changed. */
1689 tls_server_creds_invalidate(void)
1691 if (state_server.lib_state.pri_cache)
1692 gnutls_priority_deinit(state_server.lib_state.pri_cache);
1693 state_server.lib_state.pri_cache = NULL;
1695 if (state_server.lib_state.x509_cred)
1696 gnutls_certificate_free_credentials(state_server.lib_state.x509_cred);
1697 state_server.lib_state = null_tls_preload;
1702 tls_client_creds_invalidate(transport_instance * t)
1704 smtp_transport_options_block * ob = t->options_block;
1705 if (ob->tls_preload.x509_cred)
1706 gnutls_certificate_free_credentials(ob->tls_preload.x509_cred);
1707 ob->tls_preload = null_tls_preload;
1712 /*************************************************
1713 * Variables re-expanded post-SNI *
1714 *************************************************/
1716 /* Called from both server and client code, via tls_init(), and also from
1717 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1719 We can tell the two apart by state->received_sni being non-NULL in callback.
1721 The callback should not call us unless state->trigger_sni_changes is true,
1722 which we are responsible for setting on the first pass through.
1725 state exim_gnutls_state_st *
1726 errstr error string pointer
1728 Returns: OK/DEFER/FAIL
1732 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1735 const host_item *host = state->host; /* macro should be reconsidered? */
1736 const uschar *saved_tls_certificate = NULL;
1737 const uschar *saved_tls_privatekey = NULL;
1738 const uschar *saved_tls_verify_certificates = NULL;
1739 const uschar *saved_tls_crl = NULL;
1742 /* We check for tls_sni *before* expansion. */
1743 if (!host) /* server */
1744 if (!state->received_sni)
1746 if ( state->tls_certificate
1747 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1748 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1749 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1752 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI\n");
1753 state->trigger_sni_changes = TRUE;
1756 else /* SNI callback case */
1758 /* useful for debugging */
1759 saved_tls_certificate = state->exp_tls_certificate;
1760 saved_tls_privatekey = state->exp_tls_privatekey;
1761 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1762 saved_tls_crl = state->exp_tls_crl;
1765 if (!state->lib_state.x509_cred)
1767 if ((rc = gnutls_certificate_allocate_credentials(
1768 (gnutls_certificate_credentials_t *) &state->lib_state.x509_cred)))
1769 return tls_error_gnu(state, US"gnutls_certificate_allocate_credentials",
1771 creds_basic_init(state->lib_state.x509_cred, !host);
1775 /* remember: Expand_check_tlsvar() is expand_check() but fiddling with
1776 state members, assuming consistent naming; and expand_check() returns
1777 false if expansion failed, unless expansion was forced to fail. */
1779 /* check if we at least have a certificate, before doing expensive
1782 if (!state->lib_state.conn_certs)
1784 if (!Expand_check_tlsvar(tls_certificate, errstr))
1787 /* certificate is mandatory in server, optional in client */
1789 if ( !state->exp_tls_certificate
1790 || !*state->exp_tls_certificate
1793 return tls_install_selfsign(state, errstr);
1795 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1797 if (state->tls_privatekey && !Expand_check_tlsvar(tls_privatekey, errstr))
1800 /* tls_privatekey is optional, defaulting to same file as certificate */
1802 if (!state->tls_privatekey || !*state->tls_privatekey)
1804 state->tls_privatekey = state->tls_certificate;
1805 state->exp_tls_privatekey = state->exp_tls_certificate;
1808 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1811 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1812 state->exp_tls_certificate, state->exp_tls_privatekey);
1814 if (state->received_sni)
1815 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1816 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1819 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1820 load = FALSE; /* avoid re-loading the same certs */
1822 else /* unload the pre-SNI certs before loading new ones */
1824 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair\n");
1825 gnutls_certificate_free_keys(state->lib_state.x509_cred);
1830 ? creds_load_client_certs(state, host, state->exp_tls_certificate,
1831 state->exp_tls_privatekey, errstr)
1832 : creds_load_server_certs(state, state->exp_tls_certificate,
1833 state->exp_tls_privatekey,
1846 debug_printf("%s certs were preloaded\n", host ? "client" : "server");
1848 if (!state->tls_privatekey) state->tls_privatekey = state->tls_certificate;
1849 state->exp_tls_certificate = US state->tls_certificate;
1850 state->exp_tls_privatekey = US state->tls_privatekey;
1852 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1853 if (state->lib_state.ocsp_hook)
1854 gnutls_handshake_set_hook_function(state->session,
1855 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1860 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1861 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1862 error message is provided. However, if we just refrain from setting anything up
1863 in that case, certificate verification fails, which seems to be the correct
1865 If none was configured and we can't handle "system", treat as empty. */
1867 if (!state->lib_state.cabundle)
1869 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1871 if (!Expand_check_tlsvar(tls_verify_certificates, errstr))
1873 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1874 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1875 state->exp_tls_verify_certificates = NULL;
1877 if (state->tls_crl && *state->tls_crl)
1878 if (!Expand_check_tlsvar(tls_crl, errstr))
1881 if (!(state->exp_tls_verify_certificates &&
1882 *state->exp_tls_verify_certificates))
1885 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1886 /* With no tls_verify_certificates, we ignore tls_crl too */
1893 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1896 rc = creds_load_cabundle(state, state->exp_tls_verify_certificates, host, errstr);
1897 if (rc != OK) return rc;
1902 debug_printf("%s CA bundle was preloaded\n", host ? "client" : "server");
1903 state->exp_tls_verify_certificates = US state->tls_verify_certificates;
1905 #ifdef SUPPORT_CA_DIR
1906 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1907 when using the directory-of-certs config model. */
1908 if (state->lib_state.ca_rdn_emulate)
1909 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1914 if (!state->lib_state.crl)
1916 if ( state->tls_crl && *state->tls_crl
1917 && state->exp_tls_crl && *state->exp_tls_crl)
1918 return creds_load_crl(state, state->exp_tls_crl, errstr);
1923 debug_printf("%s CRL was preloaded\n", host ? "client" : "server");
1924 state->exp_tls_crl = US state->tls_crl;
1933 /*************************************************
1934 * Set X.509 state variables *
1935 *************************************************/
1937 /* In GnuTLS, the registered cert/key are not replaced by a later
1938 set of a cert/key, so for SNI support we need a whole new x509_cred
1939 structure. Which means various other non-re-expanded pieces of state
1940 need to be re-set in the new struct, so the setting logic is pulled
1944 state exim_gnutls_state_st *
1945 errstr error string pointer
1947 Returns: OK/DEFER/FAIL
1951 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1954 const host_item *host = state->host; /* macro should be reconsidered? */
1956 #ifndef GNUTLS_AUTO_DHPARAMS
1957 /* Create D-H parameters, or read them from the cache file. This function does
1958 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1959 client-side params. */
1963 if (!dh_server_params)
1964 if ((rc = init_server_dh(errstr)) != OK) return rc;
1966 /* Unnecessary & discouraged with 3.6.0 or later */
1967 gnutls_certificate_set_dh_params(state->lib_state.x509_cred, dh_server_params);
1971 /* Link the credentials to the session. */
1973 if ((rc = gnutls_credentials_set(state->session,
1974 GNUTLS_CRD_CERTIFICATE, state->lib_state.x509_cred)))
1975 return tls_error_gnu(state, US"gnutls_credentials_set", rc, errstr);
1980 /*************************************************
1981 * Initialize for GnuTLS *
1982 *************************************************/
1985 /* Called from both server and client code. In the case of a server, errors
1986 before actual TLS negotiation return DEFER.
1989 host connected host, if client; NULL if server
1990 ob tranport options block, if client; NULL if server
1991 require_ciphers tls_require_ciphers setting
1992 caller_state returned state-info structure
1993 errstr error string pointer
1995 Returns: OK/DEFER/FAIL
2000 const host_item *host,
2001 smtp_transport_options_block * ob,
2002 const uschar * require_ciphers,
2003 exim_gnutls_state_st **caller_state,
2007 exim_gnutls_state_st * state;
2011 if ( !exim_gnutls_base_init_done
2012 && (rc = tls_g_init(errstr)) != OK)
2017 /* For client-side sessions we allocate a context. This lets us run
2018 several in parallel. */
2020 int old_pool = store_pool;
2021 store_pool = POOL_PERM;
2022 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
2023 store_pool = old_pool;
2025 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2026 state->lib_state = ob->tls_preload;
2028 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
2029 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
2031 state->tls_certificate = ob->tls_certificate;
2032 state->tls_privatekey = ob->tls_privatekey;
2033 state->tls_sni = ob->tls_sni;
2034 state->tls_verify_certificates = ob->tls_verify_certificates;
2035 state->tls_crl = ob->tls_crl;
2039 /* Server operations always use the one state_server context. It is not
2040 shared because we have forked a fresh process for every receive. However it
2041 can get re-used for successive TLS sessions on a single TCP connection. */
2043 state = &state_server;
2045 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
2046 rc = gnutls_init(&state->session, GNUTLS_SERVER);
2048 state->tls_certificate = tls_certificate;
2049 state->tls_privatekey = tls_privatekey;
2050 state->tls_sni = NULL;
2051 state->tls_verify_certificates = tls_verify_certificates;
2052 state->tls_crl = tls_crl;
2055 return tls_error_gnu(state, US"gnutls_init", rc, errstr);
2057 state->tls_require_ciphers = require_ciphers;
2060 /* This handles the variables that might get re-expanded after TLS SNI;
2061 tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
2064 debug_printf("Expanding various TLS configuration options for session credentials\n");
2065 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
2067 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
2068 requires a new structure afterwards. */
2070 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
2072 /* set SNI in client, only */
2075 if (!expand_check(state->tls_sni, US"tls_out_sni", &state->tlsp->sni, errstr))
2077 if (state->tlsp->sni && *state->tlsp->sni)
2080 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
2081 sz = Ustrlen(state->tlsp->sni);
2082 if ((rc = gnutls_server_name_set(state->session,
2083 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
2084 return tls_error_gnu(state, US"gnutls_server_name_set", rc, errstr);
2087 else if (state->tls_sni)
2088 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
2089 "have an SNI set for a server [%s]\n", state->tls_sni);
2091 if (!state->lib_state.pri_string)
2093 const uschar * p = NULL;
2094 const char * errpos;
2096 /* This is the priority string support,
2097 http://www.gnutls.org/manual/html_node/Priority-Strings.html
2098 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
2099 This was backwards incompatible, but means Exim no longer needs to track
2100 all algorithms and provide string forms for them. */
2102 if (state->tls_require_ciphers && *state->tls_require_ciphers)
2104 if (!Expand_check_tlsvar(tls_require_ciphers, errstr))
2106 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
2108 p = state->exp_tls_require_ciphers;
2109 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
2113 if ((rc = creds_load_pristring(state, p, &errpos)))
2114 return tls_error_gnu(state, string_sprintf(
2115 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
2116 p, (long)(errpos - CS p), errpos),
2121 DEBUG(D_tls) debug_printf("cipher list preloaded\n");
2122 state->exp_tls_require_ciphers = US state->tls_require_ciphers;
2126 if ((rc = gnutls_priority_set(state->session, state->lib_state.pri_cache)))
2127 return tls_error_gnu(state, US"gnutls_priority_set", rc, errstr);
2129 /* This also sets the server ticket expiration time to the same, and
2130 the STEK rotation time to 3x. */
2132 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
2134 /* Reduce security in favour of increased compatibility, if the admin
2135 decides to make that trade-off. */
2136 if (gnutls_compat_mode)
2138 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
2139 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
2140 gnutls_session_enable_compatibility_mode(state->session);
2142 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
2146 *caller_state = state;
2152 /*************************************************
2153 * Extract peer information *
2154 *************************************************/
2156 static const uschar *
2157 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
2158 gnutls_mac_algorithm_t mac)
2161 gnutls_kx_algorithm_t kx_i;
2162 gnutls_cipher_algorithm_t cipher_i;
2163 gnutls_mac_algorithm_t mac_i;
2166 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
2168 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
2169 return cipher_stdname(cs_id[0], cs_id[1]);
2175 /* Called from both server and client code.
2176 Only this is allowed to set state->peerdn and state->have_set_peerdn
2177 and we use that to detect double-calls.
2179 NOTE: the state blocks last while the TLS connection is up, which is fine
2180 for logging in the server side, but for the client side, we log after teardown
2181 in src/deliver.c. While the session is up, we can twist about states and
2182 repoint tls_* globals, but those variables used for logging or other variable
2183 expansion that happens _after_ delivery need to have a longer life-time.
2185 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
2186 doing this more than once per generation of a state context. We set them in
2187 the state context, and repoint tls_* to them. After the state goes away, the
2188 tls_* copies of the pointers remain valid and client delivery logging is happy.
2190 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
2194 state exim_gnutls_state_st *
2195 errstr pointer to error string
2197 Returns: OK/DEFER/FAIL
2201 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
2203 gnutls_session_t session = state->session;
2204 const gnutls_datum_t * cert_list;
2206 unsigned int cert_list_size = 0;
2207 gnutls_protocol_t protocol;
2208 gnutls_cipher_algorithm_t cipher;
2209 gnutls_kx_algorithm_t kx;
2210 gnutls_mac_algorithm_t mac;
2211 gnutls_certificate_type_t ct;
2212 gnutls_x509_crt_t crt;
2216 if (state->have_set_peerdn)
2218 state->have_set_peerdn = TRUE;
2220 state->peerdn = NULL;
2223 cipher = gnutls_cipher_get(session);
2224 protocol = gnutls_protocol_get_version(session);
2225 mac = gnutls_mac_get(session);
2227 #ifdef GNUTLS_TLS1_3
2228 protocol >= GNUTLS_TLS1_3 ? 0 :
2230 gnutls_kx_get(session);
2232 old_pool = store_pool;
2234 tls_support * tlsp = state->tlsp;
2235 store_pool = POOL_PERM;
2237 #ifdef SUPPORT_GNUTLS_SESS_DESC
2240 uschar * s = US gnutls_session_get_desc(session), c;
2242 /* Nikos M suggests we use this by preference. It returns like:
2243 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
2245 For partial back-compat, put a colon after the TLS version, replace the
2246 )-( grouping with __, replace in-group - with _ and append the :keysize. */
2248 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
2250 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
2252 tlsp->ver = string_copyn(g->s, g->ptr);
2253 for (uschar * p = US tlsp->ver; *p; p++)
2254 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
2256 g = string_catn(g, US":", 1);
2257 if (*s) s++; /* now on _ between groups */
2260 for (*++s && ++s; (c = *s) && c != ')'; s++)
2261 g = string_catn(g, c == '-' ? US"_" : s, 1);
2262 /* now on ) closing group */
2263 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
2264 /* now on _ between groups */
2266 g = string_catn(g, US":", 1);
2267 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
2268 state->ciphersuite = string_from_gstring(g);
2271 state->ciphersuite = string_sprintf("%s:%s:%d",
2272 gnutls_protocol_get_name(protocol),
2273 gnutls_cipher_suite_get_name(kx, cipher, mac),
2274 (int) gnutls_cipher_get_key_size(cipher) * 8);
2276 /* I don't see a way that spaces could occur, in the current GnuTLS
2277 code base, but it was a concern in the old code and perhaps older GnuTLS
2278 releases did return "TLS 1.0"; play it safe, just in case. */
2280 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
2281 tlsp->ver = string_copyn(state->ciphersuite,
2282 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
2285 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
2287 tlsp->cipher = state->ciphersuite;
2288 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
2290 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
2292 store_pool = old_pool;
2295 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
2297 if (!cert_list || cert_list_size == 0)
2299 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
2300 cert_list, cert_list_size);
2301 if (state->verify_requirement >= VERIFY_REQUIRED)
2302 return tls_error(US"certificate verification failed",
2303 US"no certificate received from peer", state->host, errstr);
2307 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
2309 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
2311 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
2312 if (state->verify_requirement >= VERIFY_REQUIRED)
2313 return tls_error(US"certificate verification not possible, unhandled type",
2314 ctn, state->host, errstr);
2318 #define exim_gnutls_peer_err(Label) \
2320 if (rc != GNUTLS_E_SUCCESS) \
2322 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
2323 (Label), gnutls_strerror(rc)); \
2324 if (state->verify_requirement >= VERIFY_REQUIRED) \
2325 return tls_error_gnu(state, (Label), rc, errstr); \
2330 rc = import_cert(&cert_list[0], &crt);
2331 exim_gnutls_peer_err(US"cert 0");
2333 state->tlsp->peercert = state->peercert = crt;
2336 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
2337 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
2339 exim_gnutls_peer_err(US"getting size for cert DN failed");
2340 return FAIL; /* should not happen */
2342 dn_buf = store_get_perm(sz, TRUE); /* tainted */
2343 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
2344 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
2346 state->peerdn = dn_buf;
2349 #undef exim_gnutls_peer_err
2355 /*************************************************
2356 * Verify peer certificate *
2357 *************************************************/
2359 /* Called from both server and client code.
2360 *Should* be using a callback registered with
2361 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
2362 the peer information, but that's too new for some OSes.
2365 state exim_gnutls_state_st *
2366 errstr where to put an error message
2369 FALSE if the session should be rejected
2370 TRUE if the cert is okay or we just don't care
2374 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
2379 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
2381 rc = peer_status(state, errstr);
2383 if (state->verify_requirement == VERIFY_NONE)
2386 if (rc != OK || !state->peerdn)
2388 verify = GNUTLS_CERT_INVALID;
2389 *errstr = US"certificate not supplied";
2395 if (state->verify_requirement == VERIFY_DANE && state->host)
2397 /* Using dane_verify_session_crt() would be easy, as it does it all for us
2398 including talking to a DNS resolver. But we want to do that bit ourselves
2399 as the testsuite intercepts and fakes its own DNS environment. */
2404 const gnutls_datum_t * certlist =
2405 gnutls_certificate_get_peers(state->session, &lsize);
2406 int usage = tls_out.tlsa_usage;
2408 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2409 /* Split the TLSA records into two sets, TA and EE selectors. Run the
2410 dane-verification separately so that we know which selector verified;
2411 then we know whether to do name-verification (needed for TA but not EE). */
2413 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
2414 { /* a mixed-usage bundle */
2419 for (nrec = 0; state->dane_data_len[nrec]; ) nrec++;
2422 dd = store_get(nrec * sizeof(uschar *), FALSE);
2423 ddl = store_get(nrec * sizeof(int), FALSE);
2426 if ((rc = dane_state_init(&s, 0)))
2429 for (usage = DANESSL_USAGE_DANE_EE;
2430 usage >= DANESSL_USAGE_DANE_TA; usage--)
2431 { /* take records with this usage */
2432 for (j = i = 0; i < nrec; i++)
2433 if (state->dane_data[i][0] == usage)
2435 dd[j] = state->dane_data[i];
2436 ddl[j++] = state->dane_data_len[i];
2443 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
2446 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
2447 gnutls_certificate_type_get(state->session),
2449 usage == DANESSL_USAGE_DANE_EE
2450 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2454 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
2456 else if (verify == 0) /* verification passed */
2464 if (rc) goto tlsa_prob;
2469 if ( (rc = dane_state_init(&s, 0))
2470 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
2472 || (rc = dane_verify_crt_raw(s, certlist, lsize,
2473 gnutls_certificate_type_get(state->session),
2475 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2476 usage == (1 << DANESSL_USAGE_DANE_EE)
2477 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2486 if (verify != 0) /* verification failed */
2489 (void) dane_verification_status_print(verify, &str, 0);
2490 *errstr = US str.data; /* don't bother to free */
2494 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2495 /* If a TA-mode TLSA record was used for verification we must additionally
2496 verify the cert name (but not the CA chain). For EE-mode, skip it. */
2498 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2501 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2504 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2505 /* Assume that the name on the A-record is the one that should be matching
2506 the cert. An alternate view is that the domain part of the email address
2507 is also permissible. */
2509 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2510 CS state->host->name))
2512 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2517 #endif /*SUPPORT_DANE*/
2519 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2522 /* Handle the result of verification. INVALID is set if any others are. */
2524 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2526 state->peer_cert_verified = FALSE;
2529 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2534 if (gnutls_certificate_verification_status_print(verify,
2535 gnutls_certificate_type_get(state->session), &txt, 0)
2536 == GNUTLS_E_SUCCESS)
2538 debug_printf("%s\n", txt.data);
2539 gnutls_free(txt.data);
2543 *errstr = verify & GNUTLS_CERT_REVOKED
2544 ? US"certificate revoked" : US"certificate invalid";
2548 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2549 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2551 if (state->verify_requirement >= VERIFY_REQUIRED)
2554 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2559 /* Client side, check the server's certificate name versus the name on the
2560 A-record for the connection we made. What to do for server side - what name
2561 to use for client? We document that there is no such checking for server
2564 if ( state->exp_tls_verify_cert_hostnames
2565 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2566 CS state->exp_tls_verify_cert_hostnames)
2570 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2571 if (state->verify_requirement >= VERIFY_REQUIRED)
2576 state->peer_cert_verified = TRUE;
2577 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2578 state->peerdn ? state->peerdn : US"<unset>");
2582 state->tlsp->peerdn = state->peerdn;
2587 *errstr = string_sprintf("TLSA record problem: %s",
2588 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2592 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2599 /* ------------------------------------------------------------------------ */
2602 /* Logging function which can be registered with
2603 * gnutls_global_set_log_function()
2604 * gnutls_global_set_log_level() 0..9
2606 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2608 exim_gnutls_logger_cb(int level, const char *message)
2610 size_t len = strlen(message);
2613 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2616 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2617 message[len-1] == '\n' ? "" : "\n");
2622 /* Called after client hello, should handle SNI work.
2623 This will always set tls_sni (state->received_sni) if available,
2624 and may trigger presenting different certificates,
2625 if state->trigger_sni_changes is TRUE.
2627 Should be registered with
2628 gnutls_handshake_set_post_client_hello_function()
2630 "This callback must return 0 on success or a gnutls error code to terminate the
2633 For inability to get SNI information, we return 0.
2634 We only return non-zero if re-setup failed.
2635 Only used for server-side TLS.
2639 exim_sni_handling_cb(gnutls_session_t session)
2641 char sni_name[MAX_HOST_LEN];
2642 size_t data_len = MAX_HOST_LEN;
2643 exim_gnutls_state_st *state = &state_server;
2644 unsigned int sni_type;
2646 uschar * dummy_errstr;
2648 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2649 if (rc != GNUTLS_E_SUCCESS)
2652 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2653 debug_printf("TLS: no SNI presented in handshake\n");
2655 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2656 gnutls_strerror(rc), rc);
2660 if (sni_type != GNUTLS_NAME_DNS)
2662 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2666 /* We now have a UTF-8 string in sni_name */
2667 old_pool = store_pool;
2668 store_pool = POOL_PERM;
2669 state->received_sni = string_copy_taint(US sni_name, TRUE);
2670 store_pool = old_pool;
2672 /* We set this one now so that variable expansions below will work */
2673 state->tlsp->sni = state->received_sni;
2675 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2676 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2678 if (!state->trigger_sni_changes)
2681 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2683 /* If the setup of certs/etc failed before handshake, TLS would not have
2684 been offered. The best we can do now is abort. */
2685 return GNUTLS_E_APPLICATION_ERROR_MIN;
2688 rc = tls_set_remaining_x509(state, &dummy_errstr);
2689 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2696 #ifndef DISABLE_EVENT
2698 We use this callback to get observability and detail-level control
2699 for an exim TLS connection (either direction), raising a tls:cert event
2700 for each cert in the chain presented by the peer. Any event
2701 can deny verification.
2703 Return 0 for the handshake to continue or non-zero to terminate.
2707 verify_cb(gnutls_session_t session)
2709 const gnutls_datum_t * cert_list;
2710 unsigned int cert_list_size = 0;
2711 gnutls_x509_crt_t crt;
2714 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2716 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2717 while (cert_list_size--)
2719 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2721 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2722 cert_list_size, gnutls_strerror(rc));
2726 state->tlsp->peercert = crt;
2727 if ((yield = event_raise(state->event_action,
2728 US"tls:cert", string_sprintf("%d", cert_list_size))))
2730 log_write(0, LOG_MAIN,
2731 "SSL verify denied by event-action: depth=%d: %s",
2732 cert_list_size, yield);
2733 return 1; /* reject */
2735 state->tlsp->peercert = NULL;
2745 ddump(gnutls_datum_t * d)
2747 gstring * g = string_get((d->size+1) * 2);
2748 uschar * s = d->data;
2749 for (unsigned i = d->size; i > 0; i--, s++)
2751 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2752 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2758 post_handshake_debug(exim_gnutls_state_st * state)
2760 #ifdef SUPPORT_GNUTLS_SESS_DESC
2761 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2764 #ifdef SUPPORT_GNUTLS_KEYLOG
2765 # ifdef EXIM_HAVE_TLS1_3
2766 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2771 gnutls_datum_t c, s;
2773 /* For TLS1.2 we only want the client random and the master secret */
2774 gnutls_session_get_random(state->session, &c, &s);
2775 gnutls_session_get_master_secret(state->session, &s);
2778 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2781 debug_printf("To get keying info for TLS1.3 is hard:\n"
2782 " Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,\n"
2783 " and make sure it is writable by the Exim runtime user.\n"
2784 " Add SSLKEYLOGFILE to keep_environment in the exim config.\n"
2785 " Start Exim as root.\n"
2786 " If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2787 " (works for TLS1.2 also, and saves cut-paste into file).\n"
2788 " Trying to use add_environment for this will not work\n");
2793 #ifdef EXIM_HAVE_TLS_RESUME
2795 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2796 unsigned incoming, const gnutls_datum_t * msg)
2798 DEBUG(D_tls) debug_printf("newticket cb\n");
2799 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2804 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2806 /* Should the server offer session resumption? */
2807 tls_in.resumption = RESUME_SUPPORTED;
2808 if (verify_check_host(&tls_resumption_hosts) == OK)
2811 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2812 an offered resumption is unacceptable. We lose one resumption per ticket
2813 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2814 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2815 least they go out in a single packet. */
2817 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2818 &server_sessticket_key)))
2819 tls_in.resumption |= RESUME_SERVER_TICKET;
2822 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2824 /* Try to tell if we see a ticket request */
2825 gnutls_handshake_set_hook_function(state->session,
2826 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2831 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2833 if (gnutls_session_resumption_requested(state->session))
2835 /* This tells us the client sent a full ticket. We use a
2836 callback on session-ticket request, elsewhere, to tell
2837 if a client asked for a ticket. */
2839 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2840 DEBUG(D_tls) debug_printf("client requested resumption\n");
2842 if (gnutls_session_is_resumed(state->session))
2844 tls_in.resumption |= RESUME_USED;
2845 DEBUG(D_tls) debug_printf("Session resumed\n");
2848 #endif /* EXIM_HAVE_TLS_RESUME */
2851 #ifdef EXIM_HAVE_ALPN
2852 /* Expand and convert an Exim list to a gnutls_datum list. False return for fail.
2853 NULL plist return for silent no-ALPN.
2857 tls_alpn_plist(const uschar * tls_alpn, const gnutls_datum_t ** plist, unsigned * plen,
2862 if (!expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr))
2867 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
2872 const uschar * list = exp_alpn;
2878 while (string_nextinlist(&list, &sep, NULL, 0)) cnt++;
2880 p = store_get(sizeof(gnutls_datum_t) * cnt, is_tainted(exp_alpn));
2882 for (int i = 0; s = string_nextinlist(&list, &sep, NULL, 0); i++)
2883 { p[i].data = s; p[i].size = Ustrlen(s); }
2884 *plist = (*plen = cnt) ? p : NULL;
2890 tls_server_set_acceptable_alpns(exim_gnutls_state_st * state, uschar ** errstr)
2893 const gnutls_datum_t * plist;
2896 if (tls_alpn_plist(tls_alpn, &plist, &plen, errstr) && plist)
2898 /* This seems to be only mandatory if the client sends an ALPN extension;
2899 not trying ALPN is ok. Need to decide how to support server-side must-alpn. */
2901 server_seen_alpn = 0;
2902 if (!(rc = gnutls_alpn_set_protocols(state->session, plist, plen,
2903 GNUTLS_ALPN_MANDATORY)))
2904 gnutls_handshake_set_hook_function(state->session,
2905 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2908 debug_printf("setting alpn protocols: %s\n", US gnutls_strerror(rc));
2911 #endif /* EXIM_HAVE_ALPN */
2913 /* ------------------------------------------------------------------------ */
2914 /* Exported functions */
2919 /*************************************************
2920 * Start a TLS session in a server *
2921 *************************************************/
2923 /* This is called when Exim is running as a server, after having received
2924 the STARTTLS command. It must respond to that command, and then negotiate
2928 errstr pointer to error string
2930 Returns: OK on success
2931 DEFER for errors before the start of the negotiation
2932 FAIL for errors during the negotiation; the server can't
2937 tls_server_start(uschar ** errstr)
2940 exim_gnutls_state_st * state = NULL;
2942 /* Check for previous activation */
2943 if (tls_in.active.sock >= 0)
2945 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2946 smtp_printf("554 Already in TLS\r\n", FALSE);
2950 /* Initialize the library. If it fails, it will already have logged the error
2951 and sent an SMTP response. */
2953 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2956 #ifdef MEASURE_TIMING
2958 gettimeofday(&t0, NULL);
2961 if ((rc = tls_init(NULL, NULL,
2962 tls_require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2964 #ifdef MEASURE_TIMING
2965 report_time_since(&t0, US"server tls_init (delta)");
2969 #ifdef EXIM_HAVE_ALPN
2970 tls_server_set_acceptable_alpns(state, errstr);
2973 #ifdef EXIM_HAVE_TLS_RESUME
2974 tls_server_resume_prehandshake(state);
2977 /* If this is a host for which certificate verification is mandatory or
2978 optional, set up appropriately. */
2980 if (verify_check_host(&tls_verify_hosts) == OK)
2983 debug_printf("TLS: a client certificate will be required\n");
2984 state->verify_requirement = VERIFY_REQUIRED;
2985 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2987 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2990 debug_printf("TLS: a client certificate will be requested but not required\n");
2991 state->verify_requirement = VERIFY_OPTIONAL;
2992 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2997 debug_printf("TLS: a client certificate will not be requested\n");
2998 state->verify_requirement = VERIFY_NONE;
2999 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3002 #ifndef DISABLE_EVENT
3005 state->event_action = event_action;
3006 gnutls_session_set_ptr(state->session, state);
3007 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3011 /* Register SNI handling; always, even if not in tls_certificate, so that the
3012 expansion variable $tls_sni is always available. */
3014 gnutls_handshake_set_post_client_hello_function(state->session,
3015 exim_sni_handling_cb);
3017 /* Set context and tell client to go ahead, except in the case of TLS startup
3018 on connection, where outputting anything now upsets the clients and tends to
3019 make them disconnect. We need to have an explicit fflush() here, to force out
3020 the response. Other smtp_printf() calls do not need it, because in non-TLS
3021 mode, the fflush() happens when smtp_getc() is called. */
3023 if (!state->tlsp->on_connect)
3025 smtp_printf("220 TLS go ahead\r\n", FALSE);
3029 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3030 that the GnuTLS library doesn't.
3031 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
3032 to set (and clear down afterwards) up a pull-timeout callback function that does
3033 a select, so we're no better off unless avoiding signals becomes an issue. */
3035 gnutls_transport_set_ptr2(state->session,
3036 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
3037 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
3038 state->fd_in = fileno(smtp_in);
3039 state->fd_out = fileno(smtp_out);
3041 sigalrm_seen = FALSE;
3042 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3044 rc = gnutls_handshake(state->session);
3045 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3048 if (rc != GNUTLS_E_SUCCESS)
3050 /* It seems that, except in the case of a timeout, we have to close the
3051 connection right here; otherwise if the other end is running OpenSSL it hangs
3052 until the server times out. */
3056 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
3057 gnutls_db_remove_session(state->session);
3061 tls_error_gnu(state, US"gnutls_handshake", rc, errstr);
3062 (void) gnutls_alert_send_appropriate(state->session, rc);
3063 gnutls_deinit(state->session);
3064 gnutls_certificate_free_credentials(state->lib_state.x509_cred);
3065 state->lib_state = null_tls_preload;
3067 shutdown(state->fd_out, SHUT_WR);
3068 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
3069 (void)fclose(smtp_out);
3070 (void)fclose(smtp_in);
3071 smtp_out = smtp_in = NULL;
3077 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3078 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3079 tls_in.ext_master_secret = TRUE;
3082 #ifdef EXIM_HAVE_TLS_RESUME
3083 tls_server_resume_posthandshake(state);
3086 DEBUG(D_tls) post_handshake_debug(state);
3088 #ifdef EXIM_HAVE_ALPN
3089 if (server_seen_alpn > 0)
3092 { /* The client offered ALPN. See what was negotiated. */
3093 gnutls_datum_t p = {.size = 0};
3094 int rc = gnutls_alpn_get_selected_protocol(state->session, &p);
3096 debug_printf("ALPN negotiated: %.*s\n", (int)p.size, p.data);
3098 debug_printf("getting alpn protocol: %s\n", US gnutls_strerror(rc));
3102 else if (server_seen_alpn == 0)
3103 if (verify_check_host(&hosts_require_alpn) == OK)
3105 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_NO_APPLICATION_PROTOCOL);
3106 tls_error(US"handshake", US"ALPN required but not negotiated", NULL, errstr);
3110 DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n");
3112 DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n");
3115 /* Verify after the fact */
3117 if (!verify_certificate(state, errstr))
3119 if (state->verify_requirement != VERIFY_OPTIONAL)
3121 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
3125 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
3129 /* Sets various Exim expansion variables; always safe within server */
3131 extract_exim_vars_from_tls_state(state);
3133 /* TLS has been set up. Adjust the input functions to read via TLS,
3134 and initialize appropriately. */
3136 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3138 receive_getc = tls_getc;
3139 receive_getbuf = tls_getbuf;
3140 receive_get_cache = tls_get_cache;
3141 receive_hasc = tls_hasc;
3142 receive_ungetc = tls_ungetc;
3143 receive_feof = tls_feof;
3144 receive_ferror = tls_ferror;
3145 receive_smtp_buffered = tls_smtp_buffered;
3154 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
3155 smtp_transport_options_block * ob)
3157 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3159 state->exp_tls_verify_cert_hostnames =
3161 string_domain_utf8_to_alabel(host->certname, NULL);
3166 debug_printf("TLS: server cert verification includes hostname: \"%s\"\n",
3167 state->exp_tls_verify_cert_hostnames);
3175 /* Given our list of RRs from the TLSA lookup, build a lookup block in
3176 GnuTLS-DANE's preferred format. Hang it on the state str for later
3177 use in DANE verification.
3179 We point at the dnsa data not copy it, so it must remain valid until
3180 after verification is done.*/
3183 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
3187 const char ** dane_data;
3188 int * dane_data_len;
3191 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3192 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3193 ) if (rr->type == T_TLSA) i++;
3195 dane_data = store_get(i * sizeof(uschar *), FALSE);
3196 dane_data_len = store_get(i * sizeof(int), FALSE);
3199 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3200 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3201 ) if (rr->type == T_TLSA && rr->size > 3)
3203 const uschar * p = rr->data;
3204 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
3205 uint8_t usage = p[0], sel = p[1], type = p[2];
3208 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
3210 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
3211 || (sel != 0 && sel != 1)
3216 case 0: /* Full: cannot check at present */
3218 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
3220 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
3225 tls_out.tlsa_usage |= 1<<usage;
3226 dane_data[i] = CS p;
3227 dane_data_len[i++] = rr->size;
3230 if (!i) return FALSE;
3232 dane_data[i] = NULL;
3233 dane_data_len[i] = 0;
3235 state->dane_data = (char * const *)dane_data;
3236 state->dane_data_len = dane_data_len;
3243 #ifdef EXIM_HAVE_TLS_RESUME
3244 /* On the client, get any stashed session for the given IP from hints db
3245 and apply it to the ssl-connection for attempted resumption. Although
3246 there is a gnutls_session_ticket_enable_client() interface it is
3247 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
3248 by deafult". There seems to be no way to disable them, so even hosts not
3249 enabled by the transport option will be sent a ticket request. We will
3250 however avoid storing and retrieving session information. */
3253 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
3254 host_item * host, smtp_transport_options_block * ob)
3256 tlsp->resumption = RESUME_SUPPORTED;
3257 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3259 dbdata_tls_session * dt;
3261 open_db dbblock, * dbm_file;
3264 debug_printf("check for resumable session for %s\n", host->address);
3265 tlsp->host_resumable = TRUE;
3266 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3267 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
3269 /* Key for the db is the IP. We'd like to filter the retrieved session
3270 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
3272 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
3273 if (!(rc = gnutls_session_set_data(session,
3274 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
3276 DEBUG(D_tls) debug_printf("good session\n");
3277 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3279 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
3280 US gnutls_strerror(rc));
3281 dbfn_close(dbm_file);
3288 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
3290 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
3291 but this flag is not set until the second. TLS 1.3 it's the other way about.
3292 Keep both calls as the session data cannot be extracted before handshake
3295 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
3300 DEBUG(D_tls) debug_printf("server offered session ticket\n");
3301 tlsp->ticket_received = TRUE;
3302 tlsp->resumption |= RESUME_SERVER_TICKET;
3304 if (tlsp->host_resumable)
3305 if (!(rc = gnutls_session_get_data2(session, &tkt)))
3307 open_db dbblock, * dbm_file;
3308 int dlen = sizeof(dbdata_tls_session) + tkt.size;
3309 dbdata_tls_session * dt = store_get(dlen, TRUE);
3311 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
3312 memcpy(dt->session, tkt.data, tkt.size);
3313 gnutls_free(tkt.data);
3315 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3317 /* key for the db is the IP */
3318 dbfn_delete(dbm_file, host->address);
3319 dbfn_write(dbm_file, host->address, dt, dlen);
3320 dbfn_close(dbm_file);
3323 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
3327 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
3332 /* With a TLS1.3 session, the ticket(s) are not seen until
3333 the first data read is attempted. And there's often two of them.
3334 Pick them up with this callback. We are also called for 1.2
3338 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
3339 unsigned incoming, const gnutls_datum_t * msg)
3341 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
3342 tls_support * tlsp = state->tlsp;
3344 DEBUG(D_tls) debug_printf("newticket cb\n");
3346 if (!tlsp->ticket_received)
3347 tls_save_session(tlsp, sess, state->host);
3353 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
3354 tls_support * tlsp, host_item * host,
3355 smtp_transport_options_block * ob)
3357 gnutls_session_set_ptr(state->session, state);
3358 gnutls_handshake_set_hook_function(state->session,
3359 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
3361 tls_retrieve_session(tlsp, state->session, host, ob);
3365 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
3366 tls_support * tlsp, host_item * host)
3368 if (gnutls_session_is_resumed(state->session))
3370 DEBUG(D_tls) debug_printf("Session resumed\n");
3371 tlsp->resumption |= RESUME_USED;
3374 tls_save_session(tlsp, state->session, host);
3376 #endif /* !DISABLE_TLS_RESUME */
3379 /*************************************************
3380 * Start a TLS session in a client *
3381 *************************************************/
3383 /* Called from the smtp transport after STARTTLS has been accepted.
3386 cctx connection context
3387 conn_args connection details
3388 cookie datum for randomness (not used)
3389 tlsp record details of channel configuration here; must be non-NULL
3390 errstr error string pointer
3392 Returns: TRUE for success with TLS session context set in smtp context,
3397 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3398 void * cookie ARG_UNUSED,
3399 tls_support * tlsp, uschar ** errstr)
3401 host_item * host = conn_args->host; /* for msgs and option-tests */
3402 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3403 smtp_transport_options_block * ob = tb
3404 ? (smtp_transport_options_block *)tb->options_block
3405 : &smtp_transport_option_defaults;
3407 exim_gnutls_state_st * state = NULL;
3408 uschar * cipher_list = NULL;
3410 #ifndef DISABLE_OCSP
3412 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3413 BOOL request_ocsp = require_ocsp ? TRUE
3414 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3417 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
3420 /* If dane is flagged, have either request or require dane for this host, and
3421 a TLSA record found. Therefore, dane verify required. Which implies cert must
3422 be requested and supplied, dane verify must pass, and cert verify irrelevant
3423 (incl. hostnames), and (caller handled) require_tls and sni=$domain */
3425 if (conn_args->dane && ob->dane_require_tls_ciphers)
3427 /* not using Expand_check_tlsvar because not yet in state */
3428 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3429 &cipher_list, errstr))
3431 cipher_list = cipher_list && *cipher_list
3432 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
3437 cipher_list = ob->tls_require_ciphers;
3440 #ifdef MEASURE_TIMING
3442 gettimeofday(&t0, NULL);
3445 if (tls_init(host, ob, cipher_list, &state, tlsp, errstr) != OK)
3448 #ifdef MEASURE_TIMING
3449 report_time_since(&t0, US"client tls_init (delta)");
3454 #ifdef EXIM_HAVE_ALPN
3456 const gnutls_datum_t * plist;
3459 if (!tls_alpn_plist(ob->tls_alpn, &plist, &plen, errstr))
3462 if (gnutls_alpn_set_protocols(state->session, plist, plen, 0) != 0)
3464 tls_error(US"alpn init", NULL, state->host, errstr);
3468 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
3471 log_write(0, LOG_MAIN, "ALPN unusable with this GnuTLS library version; ignoring \"%s\"\n",
3476 int dh_min_bits = ob->tls_dh_min_bits;
3477 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
3480 debug_printf("WARNING: tls_dh_min_bits far too low,"
3481 " clamping %d up to %d\n",
3482 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
3483 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
3486 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
3487 " acceptable bits to %d\n",
3489 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
3492 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
3493 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
3494 the specified host patterns if one of them is defined */
3497 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
3500 debug_printf("TLS: server certificate DANE required\n");
3501 state->verify_requirement = VERIFY_DANE;
3502 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3506 if ( ( state->exp_tls_verify_certificates
3507 && !ob->tls_verify_hosts
3508 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
3510 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3513 tls_client_setup_hostname_checks(host, state, ob);
3515 debug_printf("TLS: server certificate verification required\n");
3516 state->verify_requirement = VERIFY_REQUIRED;
3517 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3519 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3521 tls_client_setup_hostname_checks(host, state, ob);
3523 debug_printf("TLS: server certificate verification optional\n");
3524 state->verify_requirement = VERIFY_OPTIONAL;
3525 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
3530 debug_printf("TLS: server certificate verification not required\n");
3531 state->verify_requirement = VERIFY_NONE;
3532 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3535 #ifndef DISABLE_OCSP
3536 /* supported since GnuTLS 3.1.3 */
3539 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
3540 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
3541 NULL, 0, NULL)) != OK)
3543 tls_error_gnu(state, US"cert-status-req", rc, errstr);
3546 tlsp->ocsp = OCSP_NOT_RESP;
3550 #ifdef EXIM_HAVE_TLS_RESUME
3551 tls_client_resume_prehandshake(state, tlsp, host, ob);
3554 #ifndef DISABLE_EVENT
3555 if (tb && tb->event_action)
3557 state->event_action = tb->event_action;
3558 gnutls_session_set_ptr(state->session, state);
3559 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3563 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
3564 state->fd_in = cctx->sock;
3565 state->fd_out = cctx->sock;
3567 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
3568 /* There doesn't seem to be a built-in timeout on connection. */
3570 sigalrm_seen = FALSE;
3571 ALARM(ob->command_timeout);
3573 rc = gnutls_handshake(state->session);
3574 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3577 if (rc != GNUTLS_E_SUCCESS)
3581 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
3582 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
3585 tls_error_gnu(state, US"gnutls_handshake", rc, errstr);
3589 DEBUG(D_tls) post_handshake_debug(state);
3593 if (!verify_certificate(state, errstr))
3595 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
3599 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3600 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3601 tlsp->ext_master_secret = TRUE;
3604 #ifndef DISABLE_OCSP
3609 gnutls_datum_t stapling;
3610 gnutls_ocsp_resp_t resp;
3611 gnutls_datum_t printed;
3615 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
3616 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
3618 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
3621 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
3622 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
3623 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
3626 debug_printf("%.4096s", printed.data);
3627 gnutls_free(printed.data);
3630 (void) tls_error_gnu(state, US"ocsp decode", rc, errstr);
3632 (void) tls_error_gnu(state, US"ocsp decode", rc, errstr);
3635 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3637 tlsp->ocsp = OCSP_FAILED;
3638 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3644 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3645 tlsp->ocsp = OCSP_VFIED;
3650 #ifdef EXIM_HAVE_TLS_RESUME
3651 tls_client_resume_posthandshake(state, tlsp, host);
3654 #ifdef EXIM_HAVE_ALPN
3655 if (ob->tls_alpn) /* We requested. See what was negotiated. */
3657 gnutls_datum_t p = {.size = 0};
3659 if (gnutls_alpn_get_selected_protocol(state->session, &p) == 0)
3660 { DEBUG(D_tls) debug_printf("ALPN negotiated: '%.*s'\n", (int)p.size, p.data); }
3661 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
3663 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_NO_APPLICATION_PROTOCOL);
3664 tls_error(US"handshake", US"ALPN required but not negotiated", state->host, errstr);
3668 DEBUG(D_tls) debug_printf("No ALPN negotiated");
3672 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3674 extract_exim_vars_from_tls_state(state);
3676 cctx->tls_ctx = state;
3685 ct_ctx client TLS context pointer, or NULL for the one global server context
3689 tls_shutdown_wr(void * ct_ctx)
3691 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3692 tls_support * tlsp = state->tlsp;
3694 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3696 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3698 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
3699 gnutls_bye(state->session, GNUTLS_SHUT_WR);
3702 /*************************************************
3703 * Close down a TLS session *
3704 *************************************************/
3706 /* This is also called from within a delivery subprocess forked from the
3707 daemon, to shut down the TLS library, without actually doing a shutdown (which
3708 would tamper with the TLS session in the parent process).
3711 ct_ctx client context pointer, or NULL for the one global server context
3712 do_shutdown 0 no data-flush or TLS close-alert
3713 1 if TLS close-alert is to be sent,
3714 2 if also response to be waited for (2s timeout)
3720 tls_close(void * ct_ctx, int do_shutdown)
3722 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3723 tls_support * tlsp = state->tlsp;
3725 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3729 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3730 do_shutdown > 1 ? " (with response-wait)" : "");
3732 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3735 gnutls_bye(state->session, do_shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3739 if (!ct_ctx) /* server */
3741 receive_getc = smtp_getc;
3742 receive_getbuf = smtp_getbuf;
3743 receive_get_cache = smtp_get_cache;
3744 receive_hasc = smtp_hasc;
3745 receive_ungetc = smtp_ungetc;
3746 receive_feof = smtp_feof;
3747 receive_ferror = smtp_ferror;
3748 receive_smtp_buffered = smtp_buffered;
3751 gnutls_deinit(state->session);
3752 gnutls_certificate_free_credentials(state->lib_state.x509_cred);
3753 state->lib_state = null_tls_preload;
3755 tlsp->active.sock = -1;
3756 tlsp->active.tls_ctx = NULL;
3757 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3758 tlsp->channelbinding = NULL;
3761 if (state->xfer_buffer) store_free(state->xfer_buffer);
3768 tls_refill(unsigned lim)
3770 exim_gnutls_state_st * state = &state_server;
3773 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, buffersize=%u)\n",
3774 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3776 sigalrm_seen = FALSE;
3777 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3781 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3782 MIN(ssl_xfer_buffer_size, lim));
3783 while (inbytes == GNUTLS_E_AGAIN);
3785 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3787 if (had_command_timeout) /* set by signal handler */
3788 smtp_command_timeout_exit(); /* does not return */
3789 if (had_command_sigterm)
3790 smtp_command_sigterm_exit();
3791 if (had_data_timeout)
3792 smtp_data_timeout_exit();
3793 if (had_data_sigint)
3794 smtp_data_sigint_exit();
3796 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3797 TLS session has been closed down, not that the socket itself has been closed
3798 down. Revert to non-TLS handling. */
3802 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3803 state->xfer_error = TRUE;
3807 else if (inbytes == 0)
3809 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3810 tls_close(NULL, TLS_NO_SHUTDOWN);
3814 /* Handle genuine errors */
3816 else if (inbytes < 0)
3818 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3819 record_io_error(state, (int) inbytes, US"recv", NULL);
3820 state->xfer_error = TRUE;
3823 #ifndef DISABLE_DKIM
3824 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3826 state->xfer_buffer_hwm = (int) inbytes;
3827 state->xfer_buffer_lwm = 0;
3831 /*************************************************
3832 * TLS version of getc *
3833 *************************************************/
3835 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3836 it refills the buffer via the GnuTLS reading function.
3837 Only used by the server-side TLS.
3839 This feeds DKIM and should be used for all message-body reads.
3841 Arguments: lim Maximum amount to read/buffer
3842 Returns: the next character or EOF
3846 tls_getc(unsigned lim)
3848 exim_gnutls_state_st * state = &state_server;
3850 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3851 if (!tls_refill(lim))
3852 return state->xfer_error ? EOF : smtp_getc(lim);
3854 /* Something in the buffer; return next uschar */
3856 return state->xfer_buffer[state->xfer_buffer_lwm++];
3862 exim_gnutls_state_st * state = &state_server;
3863 return state->xfer_buffer_lwm < state->xfer_buffer_hwm;
3867 tls_getbuf(unsigned * len)
3869 exim_gnutls_state_st * state = &state_server;
3873 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3874 if (!tls_refill(*len))
3876 if (!state->xfer_error) return smtp_getbuf(len);
3881 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3883 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3884 state->xfer_buffer_lwm += size;
3890 /* Get up to the given number of bytes from any cached data, and feed to dkim. */
3892 tls_get_cache(unsigned lim)
3894 #ifndef DISABLE_DKIM
3895 exim_gnutls_state_st * state = &state_server;
3896 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3900 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3906 tls_could_read(void)
3908 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3909 || gnutls_record_check_pending(state_server.session) > 0;
3913 /*************************************************
3914 * Read bytes from TLS channel *
3915 *************************************************/
3917 /* This does not feed DKIM, so if the caller uses this for reading message body,
3918 then the caller must feed DKIM.
3921 ct_ctx client context pointer, or NULL for the one global server context
3925 Returns: the number of bytes read
3926 -1 after a failed read, including EOF
3930 tls_read(void * ct_ctx, uschar *buff, size_t len)
3932 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3938 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3940 debug_printf("*** PROBABLY A BUG *** " \
3941 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3942 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3945 debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, len=" SIZE_T_FMT ")\n",
3946 state->session, buff, len);
3950 inbytes = gnutls_record_recv(state->session, buff, len);
3951 while (inbytes == GNUTLS_E_AGAIN);
3953 if (inbytes > 0) return inbytes;
3956 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3960 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3961 record_io_error(state, (int)inbytes, US"recv", NULL);
3970 /*************************************************
3971 * Write bytes down TLS channel *
3972 *************************************************/
3976 ct_ctx client context pointer, or NULL for the one global server context
3979 more more data expected soon
3981 Calling with len zero and more unset will flush buffered writes. The buff
3982 argument can be null for that case.
3984 Returns: the number of bytes after a successful write,
3985 -1 after a failed write
3989 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
3993 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3996 if (more && !state->corked)
3998 DEBUG(D_tls) debug_printf("gnutls_record_cork(session=%p)\n", state->session);
3999 gnutls_record_cork(state->session);
4000 state->corked = TRUE;
4004 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
4005 buff, left, more ? ", more" : "");
4009 DEBUG(D_tls) debug_printf("gnutls_record_send(session=%p, buffer=%p, left=" SIZE_T_FMT ")\n",
4010 state->session, buff, left);
4014 outbytes = gnutls_record_send(state->session, buff, left);
4015 while (outbytes == GNUTLS_E_AGAIN);
4017 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
4021 #ifdef GNUTLS_E_PREMATURE_TERMINATION
4022 if ( outbytes == GNUTLS_E_PREMATURE_TERMINATION && errno == ECONNRESET
4023 && !ct_ctx && f.smtp_in_quit
4025 { /* Outlook, dammit */
4026 if (LOGGING(protocol_detail))
4027 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4028 " SMTP response and TLS close\n", sender_host_address);
4030 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4031 " client reset TCP before TLS close\n", sender_host_address);
4036 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
4037 record_io_error(state, outbytes, US"send", NULL);
4043 record_io_error(state, 0, US"send", US"TLS channel closed on write");
4054 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
4060 if (!more && state->corked)
4062 DEBUG(D_tls) debug_printf("gnutls_record_uncork(session=%p)\n", state->session);
4064 /* We can't use GNUTLS_RECORD_WAIT here, as it retries on
4065 GNUTLS_E_AGAIN || GNUTLS_E_INTR, which would break our timeout set by alarm().
4066 The GNUTLS_E_AGAIN should not happen ever, as our sockets are blocking anyway.
4067 But who knows. (That all relies on the fact that GNUTLS_E_INTR and GNUTLS_E_AGAIN
4068 match the EINTR and EAGAIN errno values.) */
4069 outbytes = gnutls_record_uncork(state->session, 0);
4070 while (outbytes == GNUTLS_E_AGAIN);
4074 record_io_error(state, len, US"uncork", NULL);
4078 state->corked = FALSE;
4088 /*************************************************
4089 * Random number generation *
4090 *************************************************/
4092 /* Pseudo-random number generation. The result is not expected to be
4093 cryptographically strong but not so weak that someone will shoot themselves
4094 in the foot using it as a nonce in input in some email header scheme or
4095 whatever weirdness they'll twist this into. The result should handle fork()
4096 and avoid repeating sequences. OpenSSL handles that for us.
4100 Returns a random number in range [0, max-1]
4103 #ifdef HAVE_GNUTLS_RND
4105 vaguely_random_number(int max)
4109 uschar smallbuf[sizeof(r)];
4114 needed_len = sizeof(r);
4115 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4116 asked for a number less than 10. */
4118 for (r = max, i = 0; r; ++i)
4124 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
4127 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback\n");
4128 return vaguely_random_number_fallback(max);
4131 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4134 /* We don't particularly care about weighted results; if someone wants
4135 * smooth distribution and cares enough then they should submit a patch then. */
4138 #else /* HAVE_GNUTLS_RND */
4140 vaguely_random_number(int max)
4142 return vaguely_random_number_fallback(max);
4144 #endif /* HAVE_GNUTLS_RND */
4149 /*************************************************
4150 * Let tls_require_ciphers be checked at startup *
4151 *************************************************/
4153 /* The tls_require_ciphers option, if set, must be something which the
4156 Returns: NULL on success, or error message
4160 tls_validate_require_cipher(void)
4163 uschar *expciphers = NULL;
4164 gnutls_priority_t priority_cache;
4166 uschar * dummy_errstr;
4168 #ifdef GNUTLS_AUTO_GLOBAL_INIT
4169 # define validate_check_rc(Label) do { \
4170 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \
4171 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4172 # define return_deinit(Label) do { return (Label); } while (0)
4174 # define validate_check_rc(Label) do { \
4175 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
4176 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4177 # define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
4180 if (exim_gnutls_base_init_done)
4181 log_write(0, LOG_MAIN|LOG_PANIC,
4182 "already initialised GnuTLS, Exim developer bug");
4184 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
4185 if (!gnutls_allow_auto_pkcs11)
4187 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
4188 validate_check_rc(US"gnutls_pkcs11_init");
4191 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4192 rc = gnutls_global_init();
4193 validate_check_rc(US"gnutls_global_init()");
4195 exim_gnutls_base_init_done = TRUE;
4197 if (!(tls_require_ciphers && *tls_require_ciphers))
4198 return_deinit(NULL);
4200 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4202 return_deinit(US"failed to expand tls_require_ciphers");
4204 if (!(expciphers && *expciphers))
4205 return_deinit(NULL);
4208 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4210 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
4211 validate_check_rc(string_sprintf(
4212 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
4213 expciphers, (long)(errpos - CS expciphers), errpos));
4215 #undef return_deinit
4216 #undef validate_check_rc
4217 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4218 gnutls_global_deinit();
4227 /*************************************************
4228 * Report the library versions. *
4229 *************************************************/
4231 /* See a description in tls-openssl.c for an explanation of why this exists.
4233 Arguments: a FILE* to print the results to
4238 tls_version_report(FILE *f)
4240 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
4243 gnutls_check_version(NULL));
4246 #endif /*!MACRO_PREDEF*/
4249 /* End of tls-gnu.c */