1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2012 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
46 gnutls_global_set_audit_log_function()
49 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
52 /* Local static variables for GnuTLS */
54 /* Values for verify_requirement */
56 enum peer_verify_requirement { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
58 /* This holds most state for server or client; with this, we can set up an
59 outbound TLS-enabled connection in an ACL callout, while not stomping all
60 over the TLS variables available for expansion.
62 Some of these correspond to variables in globals.c; those variables will
63 be set to point to content in one of these instances, as appropriate for
64 the stage of the process lifetime.
66 Not handled here: globals tls_active, tls_bits, tls_cipher, tls_peerdn,
67 tls_certificate_verified, tls_channelbinding_b64, tls_sni.
70 typedef struct exim_gnutls_state {
71 gnutls_session_t session;
72 gnutls_certificate_credentials_t x509_cred;
73 gnutls_priority_t priority_cache;
74 enum peer_verify_requirement verify_requirement;
77 BOOL peer_cert_verified;
78 BOOL trigger_sni_changes;
80 const struct host_item *host;
85 const uschar *tls_certificate;
86 const uschar *tls_privatekey;
87 const uschar *tls_sni; /* client send only, not received */
88 const uschar *tls_verify_certificates;
89 const uschar *tls_crl;
90 const uschar *tls_require_ciphers;
91 uschar *exp_tls_certificate;
92 uschar *exp_tls_privatekey;
94 uschar *exp_tls_verify_certificates;
96 uschar *exp_tls_require_ciphers;
103 } exim_gnutls_state_st;
105 static const exim_gnutls_state_st exim_gnutls_state_init = {
106 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
107 NULL, NULL, NULL, NULL,
108 NULL, NULL, NULL, NULL, NULL, NULL,
109 NULL, NULL, NULL, NULL, NULL, NULL,
113 /* Not only do we have our own APIs which don't pass around state, assuming
114 it's held in globals, GnuTLS doesn't appear to let us register callback data
115 for callbacks, or as part of the session, so we have to keep a "this is the
116 context we're currently dealing with" pointer and rely upon being
117 single-threaded to keep from processing data on an inbound TLS connection while
118 talking to another TLS connection for an outbound check. This does mean that
119 there's no way for heart-beats to be responded to, for the duration of the
120 second connection. */
122 static exim_gnutls_state_st state_server, state_client;
123 static exim_gnutls_state_st *current_global_tls_state;
125 /* dh_params are initialised once within the lifetime of a process using TLS;
126 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
127 don't want to repeat this. */
129 static gnutls_dh_params_t dh_server_params = NULL;
131 /* No idea how this value was chosen; preserving it. Default is 3600. */
133 static const int ssl_session_timeout = 200;
135 static const char * const exim_default_gnutls_priority = "NORMAL";
137 /* Guard library core initialisation */
139 static BOOL exim_gnutls_base_init_done = FALSE;
142 /* ------------------------------------------------------------------------ */
145 #define MAX_HOST_LEN 255
147 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
148 the library logging; a value less than 0 disables the calls to set up logging
150 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
151 #define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
154 #ifndef EXIM_CLIENT_DH_MIN_BITS
155 #define EXIM_CLIENT_DH_MIN_BITS 1024
158 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
159 can ask for a bit-strength. Without that, we stick to the constant we had
161 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
162 #define EXIM_SERVER_DH_BITS_PRE2_12 1024
165 #define exim_gnutls_err_check(Label) do { \
166 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
168 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
170 #if GNUTLS_VERSION_NUMBER >= 0x020c00
171 #define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
172 #define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
173 #define HAVE_GNUTLS_RND
179 /* ------------------------------------------------------------------------ */
180 /* Callback declarations */
182 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
183 static void exim_gnutls_logger_cb(int level, const char *message);
186 static int exim_sni_handling_cb(gnutls_session_t session);
191 /* ------------------------------------------------------------------------ */
192 /* Static functions */
194 /*************************************************
196 *************************************************/
198 /* Called from lots of places when errors occur before actually starting to do
199 the TLS handshake, that is, while the session is still in clear. Always returns
200 DEFER for a server and FAIL for a client so that most calls can use "return
201 tls_error(...)" to do this processing and then give an appropriate return. A
202 single function is used for both server and client, because it is called from
203 some shared functions.
206 prefix text to include in the logged error
207 msg additional error string (may be NULL)
208 usually obtained from gnutls_strerror()
209 host NULL if setting up a server;
210 the connected host if setting up a client
212 Returns: OK/DEFER/FAIL
216 tls_error(const uschar *prefix, const char *msg, const host_item *host)
220 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
221 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
226 uschar *conn_info = smtp_get_connection_info();
227 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
229 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
230 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
238 /*************************************************
239 * Deal with logging errors during I/O *
240 *************************************************/
242 /* We have to get the identity of the peer from saved data.
245 state the current GnuTLS exim state container
246 rc the GnuTLS error code, or 0 if it's a local error
247 when text identifying read or write
248 text local error text when ec is 0
254 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
258 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
259 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
260 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
262 msg = gnutls_strerror(rc);
264 tls_error(when, msg, state->host);
270 /*************************************************
271 * Set various Exim expansion vars *
272 *************************************************/
274 /* We set various Exim global variables from the state, once a session has
275 been established. With TLS callouts, may need to change this to stack
276 variables, or just re-call it with the server state after client callout
279 Make sure anything set here is inset in tls_getc().
283 tls_bits strength indicator
284 tls_certificate_verified bool indicator
285 tls_channelbinding_b64 for some SASL mechanisms
288 tls_sni a (UTF-8) string
290 current_global_tls_state for API limitations
293 state the relevant exim_gnutls_state_st *
297 extract_exim_vars_from_tls_state(exim_gnutls_state_st *state)
299 gnutls_cipher_algorithm_t cipher;
300 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
303 gnutls_datum_t channel;
306 current_global_tls_state = state;
308 tls_active = state->fd_out;
310 cipher = gnutls_cipher_get(state->session);
311 /* returns size in "bytes" */
312 tls_bits = gnutls_cipher_get_key_size(cipher) * 8;
314 tls_cipher = state->ciphersuite;
316 DEBUG(D_tls) debug_printf("cipher: %s\n", tls_cipher);
318 tls_certificate_verified = state->peer_cert_verified;
320 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
321 only available for use for authenticators while this TLS session is running. */
323 tls_channelbinding_b64 = NULL;
324 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
327 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
329 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
331 old_pool = store_pool;
332 store_pool = POOL_PERM;
333 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
334 store_pool = old_pool;
335 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
339 tls_peerdn = state->peerdn;
341 tls_sni = state->received_sni;
347 /*************************************************
348 * Setup up DH parameters *
349 *************************************************/
351 /* Generating the D-H parameters may take a long time. They only need to
352 be re-generated every so often, depending on security policy. What we do is to
353 keep these parameters in a file in the spool directory. If the file does not
354 exist, we generate them. This means that it is easy to cause a regeneration.
356 The new file is written as a temporary file and renamed, so that an incomplete
357 file is never present. If two processes both compute some new parameters, you
358 waste a bit of effort, but it doesn't seem worth messing around with locking to
361 Returns: OK/DEFER/FAIL
368 unsigned int dh_bits;
370 uschar filename_buf[PATH_MAX];
371 uschar *filename = NULL;
373 uschar *exp_tls_dhparam;
374 BOOL use_file_in_spool = FALSE;
375 BOOL use_fixed_file = FALSE;
376 host_item *host = NULL; /* dummy for macros */
378 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
380 rc = gnutls_dh_params_init(&dh_server_params);
381 exim_gnutls_err_check(US"gnutls_dh_params_init");
386 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
389 if (!exp_tls_dhparam)
391 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
392 m.data = US std_dh_prime_default();
393 m.size = Ustrlen(m.data);
395 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
396 use_file_in_spool = TRUE;
397 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
399 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
402 else if (exp_tls_dhparam[0] != '/')
404 m.data = US std_dh_prime_named(exp_tls_dhparam);
406 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
407 m.size = Ustrlen(m.data);
411 use_fixed_file = TRUE;
412 filename = exp_tls_dhparam;
417 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
418 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
419 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
423 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
424 /* If you change this constant, also change dh_param_fn_ext so that we can use a
425 different filename and ensure we have sufficient bits. */
426 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
428 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
430 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
433 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
435 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
439 /* Some clients have hard-coded limits. */
440 if (dh_bits > tls_dh_max_bits)
443 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
445 dh_bits = tls_dh_max_bits;
448 if (use_file_in_spool)
450 if (!string_format(filename_buf, sizeof(filename_buf),
451 "%s/gnutls-params-%d", spool_directory, dh_bits))
452 return tls_error(US"overlong filename", NULL, NULL);
453 filename = filename_buf;
456 /* Open the cache file for reading and if successful, read it and set up the
459 fd = Uopen(filename, O_RDONLY, 0);
466 if (fstat(fd, &statbuf) < 0) /* EIO */
470 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
472 if (!S_ISREG(statbuf.st_mode))
475 return tls_error(US"TLS cache not a file", NULL, NULL);
477 fp = fdopen(fd, "rb");
482 return tls_error(US"fdopen(TLS cache stat fd) failed",
483 strerror(saved_errno), NULL);
486 m.size = statbuf.st_size;
487 m.data = malloc(m.size);
491 return tls_error(US"malloc failed", strerror(errno), NULL);
493 sz = fread(m.data, m.size, 1, fp);
499 return tls_error(US"fread failed", strerror(saved_errno), NULL);
503 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
505 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
506 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
509 /* If the file does not exist, fall through to compute new data and cache it.
510 If there was any other opening error, it is serious. */
512 else if (errno == ENOENT)
516 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
519 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
522 /* If ret < 0, either the cache file does not exist, or the data it contains
523 is not useful. One particular case of this is when upgrading from an older
524 release of Exim in which the data was stored in a different format. We don't
525 try to be clever and support both formats; we just regenerate new data in this
531 unsigned int dh_bits_gen = dh_bits;
533 if ((PATH_MAX - Ustrlen(filename)) < 10)
534 return tls_error(US"Filename too long to generate replacement",
537 temp_fn = string_copy(US "%s.XXXXXXX");
538 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
540 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
541 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
543 /* GnuTLS overshoots!
544 * If we ask for 2236, we might get 2237 or more.
545 * But there's no way to ask GnuTLS how many bits there really are.
546 * We can ask how many bits were used in a TLS session, but that's it!
547 * The prime itself is hidden behind too much abstraction.
548 * So we ask for less, and proceed on a wing and a prayer.
549 * First attempt, subtracted 3 for 2233 and got 2240.
551 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
553 dh_bits_gen = dh_bits - 10;
555 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
560 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
562 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
563 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
565 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
566 and I confirmed that a NULL call to get the size first is how the GnuTLS
567 sample apps handle this. */
571 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
573 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
574 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
576 m.data = malloc(m.size);
578 return tls_error(US"memory allocation failed", strerror(errno), NULL);
579 /* this will return a size 1 less than the allocation size above */
580 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
582 if (rc != GNUTLS_E_SUCCESS)
585 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
587 m.size = sz; /* shrink by 1, probably */
589 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
593 return tls_error(US"TLS cache write D-H params failed",
594 strerror(errno), NULL);
597 sz = write_to_fd_buf(fd, US"\n", 1);
599 return tls_error(US"TLS cache write D-H params final newline failed",
600 strerror(errno), NULL);
604 return tls_error(US"TLS cache write close() failed",
605 strerror(errno), NULL);
607 if (Urename(temp_fn, filename) < 0)
608 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
609 temp_fn, filename), strerror(errno), NULL);
611 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
614 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
621 /*************************************************
622 * Variables re-expanded post-SNI *
623 *************************************************/
625 /* Called from both server and client code, via tls_init(), and also from
626 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
628 We can tell the two apart by state->received_sni being non-NULL in callback.
630 The callback should not call us unless state->trigger_sni_changes is true,
631 which we are responsible for setting on the first pass through.
634 state exim_gnutls_state_st *
636 Returns: OK/DEFER/FAIL
640 tls_expand_session_files(exim_gnutls_state_st *state)
644 const host_item *host = state->host; /* macro should be reconsidered? */
645 uschar *saved_tls_certificate = NULL;
646 uschar *saved_tls_privatekey = NULL;
647 uschar *saved_tls_verify_certificates = NULL;
648 uschar *saved_tls_crl = NULL;
651 /* We check for tls_sni *before* expansion. */
654 if (!state->received_sni)
656 if (state->tls_certificate && Ustrstr(state->tls_certificate, US"tls_sni"))
658 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
659 state->trigger_sni_changes = TRUE;
664 /* useful for debugging */
665 saved_tls_certificate = state->exp_tls_certificate;
666 saved_tls_privatekey = state->exp_tls_privatekey;
667 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
668 saved_tls_crl = state->exp_tls_crl;
672 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
673 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
675 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
676 state members, assuming consistent naming; and expand_check() returns
677 false if expansion failed, unless expansion was forced to fail. */
679 /* check if we at least have a certificate, before doing expensive
682 if (!expand_check_tlsvar(tls_certificate))
685 /* certificate is mandatory in server, optional in client */
687 if ((state->exp_tls_certificate == NULL) ||
688 (*state->exp_tls_certificate == '\0'))
690 if (state->host == NULL)
691 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
693 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
696 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
699 /* tls_privatekey is optional, defaulting to same file as certificate */
701 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
703 state->tls_privatekey = state->tls_certificate;
704 state->exp_tls_privatekey = state->exp_tls_certificate;
708 if (state->exp_tls_certificate && *state->exp_tls_certificate)
710 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
711 state->exp_tls_certificate, state->exp_tls_privatekey);
713 if (state->received_sni)
715 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
716 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
718 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
722 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
726 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
727 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
728 GNUTLS_X509_FMT_PEM);
729 exim_gnutls_err_check(
730 string_sprintf("cert/key setup: cert=%s key=%s",
731 state->exp_tls_certificate, state->exp_tls_privatekey));
732 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
733 } /* tls_certificate */
735 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
736 provided. Experiment shows that, if the certificate file is empty, an unhelpful
737 error message is provided. However, if we just refrain from setting anything up
738 in that case, certificate verification fails, which seems to be the correct
741 if (state->tls_verify_certificates && *state->tls_verify_certificates)
743 if (!expand_check_tlsvar(tls_verify_certificates))
745 if (state->tls_crl && *state->tls_crl)
746 if (!expand_check_tlsvar(tls_crl))
749 if (!(state->exp_tls_verify_certificates &&
750 *state->exp_tls_verify_certificates))
753 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
754 /* With no tls_verify_certificates, we ignore tls_crl too */
761 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
765 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
767 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
768 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
773 /* The test suite passes in /dev/null; we could check for that path explicitly,
774 but who knows if someone has some weird FIFO which always dumps some certs, or
775 other weirdness. The thing we really want to check is that it's not a
776 directory, since while OpenSSL supports that, GnuTLS does not.
777 So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
778 if (S_ISDIR(statbuf.st_mode))
781 debug_printf("verify certificates path is a dir: \"%s\"\n",
782 state->exp_tls_verify_certificates);
783 log_write(0, LOG_MAIN|LOG_PANIC,
784 "tls_verify_certificates \"%s\" is a directory",
785 state->exp_tls_verify_certificates);
789 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
790 state->exp_tls_verify_certificates, statbuf.st_size);
792 if (statbuf.st_size == 0)
795 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
799 cert_count = gnutls_certificate_set_x509_trust_file(state->x509_cred,
800 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
804 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
806 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
808 if (state->tls_crl && *state->tls_crl &&
809 state->exp_tls_crl && *state->exp_tls_crl)
811 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
812 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
813 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
817 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
819 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
828 /*************************************************
829 * Set X.509 state variables *
830 *************************************************/
832 /* In GnuTLS, the registered cert/key are not replaced by a later
833 set of a cert/key, so for SNI support we need a whole new x509_cred
834 structure. Which means various other non-re-expanded pieces of state
835 need to be re-set in the new struct, so the setting logic is pulled
839 state exim_gnutls_state_st *
841 Returns: OK/DEFER/FAIL
845 tls_set_remaining_x509(exim_gnutls_state_st *state)
848 const host_item *host = state->host; /* macro should be reconsidered? */
850 /* Create D-H parameters, or read them from the cache file. This function does
851 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
852 client-side params. */
856 if (!dh_server_params)
858 rc = init_server_dh();
859 if (rc != OK) return rc;
861 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
864 /* Link the credentials to the session. */
866 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
867 exim_gnutls_err_check(US"gnutls_credentials_set");
872 /*************************************************
873 * Initialize for GnuTLS *
874 *************************************************/
876 /* Called from both server and client code. In the case of a server, errors
877 before actual TLS negotiation return DEFER.
880 host connected host, if client; NULL if server
881 certificate certificate file
882 privatekey private key file
883 sni TLS SNI to send, sometimes when client; else NULL
886 require_ciphers tls_require_ciphers setting
888 Returns: OK/DEFER/FAIL
893 const host_item *host,
894 const uschar *certificate,
895 const uschar *privatekey,
899 const uschar *require_ciphers,
900 exim_gnutls_state_st **caller_state)
902 exim_gnutls_state_st *state;
907 BOOL want_default_priorities;
909 if (!exim_gnutls_base_init_done)
911 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
913 rc = gnutls_global_init();
914 exim_gnutls_err_check(US"gnutls_global_init");
916 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
919 gnutls_global_set_log_function(exim_gnutls_logger_cb);
920 /* arbitrarily chosen level; bump upto 9 for more */
921 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
925 exim_gnutls_base_init_done = TRUE;
930 state = &state_client;
931 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
932 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
933 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
937 state = &state_server;
938 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
939 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
940 rc = gnutls_init(&state->session, GNUTLS_SERVER);
942 exim_gnutls_err_check(US"gnutls_init");
946 state->tls_certificate = certificate;
947 state->tls_privatekey = privatekey;
948 state->tls_require_ciphers = require_ciphers;
949 state->tls_sni = sni;
950 state->tls_verify_certificates = cas;
951 state->tls_crl = crl;
953 /* This handles the variables that might get re-expanded after TLS SNI;
954 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
957 debug_printf("Expanding various TLS configuration options for session credentials.\n");
958 rc = tls_expand_session_files(state);
959 if (rc != OK) return rc;
961 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
962 requires a new structure afterwards. */
964 rc = tls_set_remaining_x509(state);
965 if (rc != OK) return rc;
967 /* set SNI in client, only */
970 if (!expand_check_tlsvar(tls_sni))
972 if (state->exp_tls_sni && *state->exp_tls_sni)
975 debug_printf("Setting TLS client SNI to \"%s\"\n", state->exp_tls_sni);
976 sz = Ustrlen(state->exp_tls_sni);
977 rc = gnutls_server_name_set(state->session,
978 GNUTLS_NAME_DNS, state->exp_tls_sni, sz);
979 exim_gnutls_err_check(US"gnutls_server_name_set");
982 else if (state->tls_sni)
983 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
984 "have an SNI set for a client [%s]\n", state->tls_sni);
986 /* This is the priority string support,
987 http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html
988 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
989 This was backwards incompatible, but means Exim no longer needs to track
990 all algorithms and provide string forms for them. */
992 want_default_priorities = TRUE;
994 if (state->tls_require_ciphers && *state->tls_require_ciphers)
996 if (!expand_check_tlsvar(tls_require_ciphers))
998 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1000 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1001 state->exp_tls_require_ciphers);
1003 rc = gnutls_priority_init(&state->priority_cache,
1004 CS state->exp_tls_require_ciphers, &errpos);
1005 want_default_priorities = FALSE;
1006 p = state->exp_tls_require_ciphers;
1009 if (want_default_priorities)
1012 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1013 exim_default_gnutls_priority);
1014 rc = gnutls_priority_init(&state->priority_cache,
1015 exim_default_gnutls_priority, &errpos);
1016 p = US exim_default_gnutls_priority;
1019 exim_gnutls_err_check(string_sprintf(
1020 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1021 p, errpos - CS p, errpos));
1023 rc = gnutls_priority_set(state->session, state->priority_cache);
1024 exim_gnutls_err_check(US"gnutls_priority_set");
1026 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1028 /* Reduce security in favour of increased compatibility, if the admin
1029 decides to make that trade-off. */
1030 if (gnutls_compat_mode)
1032 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1033 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1034 gnutls_session_enable_compatibility_mode(state->session);
1036 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1040 *caller_state = state;
1041 /* needs to happen before callbacks during handshake */
1042 current_global_tls_state = state;
1049 /*************************************************
1050 * Extract peer information *
1051 *************************************************/
1053 /* Called from both server and client code.
1054 Only this is allowed to set state->peerdn and state->have_set_peerdn
1055 and we use that to detect double-calls.
1057 NOTE: the state blocks last while the TLS connection is up, which is fine
1058 for logging in the server side, but for the client side, we log after teardown
1059 in src/deliver.c. While the session is up, we can twist about states and
1060 repoint tls_* globals, but those variables used for logging or other variable
1061 expansion that happens _after_ delivery need to have a longer life-time.
1063 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1064 doing this more than once per generation of a state context. We set them in
1065 the state context, and repoint tls_* to them. After the state goes away, the
1066 tls_* copies of the pointers remain valid and client delivery logging is happy.
1068 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1072 state exim_gnutls_state_st *
1074 Returns: OK/DEFER/FAIL
1078 peer_status(exim_gnutls_state_st *state)
1080 uschar cipherbuf[256];
1081 const gnutls_datum *cert_list;
1083 unsigned int cert_list_size = 0;
1084 gnutls_protocol_t protocol;
1085 gnutls_cipher_algorithm_t cipher;
1086 gnutls_kx_algorithm_t kx;
1087 gnutls_mac_algorithm_t mac;
1088 gnutls_certificate_type_t ct;
1089 gnutls_x509_crt_t crt;
1093 if (state->have_set_peerdn)
1095 state->have_set_peerdn = TRUE;
1097 state->peerdn = NULL;
1100 cipher = gnutls_cipher_get(state->session);
1101 protocol = gnutls_protocol_get_version(state->session);
1102 mac = gnutls_mac_get(state->session);
1103 kx = gnutls_kx_get(state->session);
1105 string_format(cipherbuf, sizeof(cipherbuf),
1107 gnutls_protocol_get_name(protocol),
1108 gnutls_cipher_suite_get_name(kx, cipher, mac),
1109 (int) gnutls_cipher_get_key_size(cipher) * 8);
1111 /* I don't see a way that spaces could occur, in the current GnuTLS
1112 code base, but it was a concern in the old code and perhaps older GnuTLS
1113 releases did return "TLS 1.0"; play it safe, just in case. */
1114 for (p = cipherbuf; *p != '\0'; ++p)
1117 old_pool = store_pool;
1118 store_pool = POOL_PERM;
1119 state->ciphersuite = string_copy(cipherbuf);
1120 store_pool = old_pool;
1121 tls_cipher = state->ciphersuite;
1124 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1126 if (cert_list == NULL || cert_list_size == 0)
1128 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1129 cert_list, cert_list_size);
1130 if (state->verify_requirement == VERIFY_REQUIRED)
1131 return tls_error(US"certificate verification failed",
1132 "no certificate received from peer", state->host);
1136 ct = gnutls_certificate_type_get(state->session);
1137 if (ct != GNUTLS_CRT_X509)
1139 const char *ctn = gnutls_certificate_type_get_name(ct);
1141 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1142 if (state->verify_requirement == VERIFY_REQUIRED)
1143 return tls_error(US"certificate verification not possible, unhandled type",
1148 #define exim_gnutls_peer_err(Label) do { \
1149 if (rc != GNUTLS_E_SUCCESS) { \
1150 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1151 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1152 return OK; } } while (0)
1154 rc = gnutls_x509_crt_init(&crt);
1155 exim_gnutls_peer_err(US"gnutls_x509_crt_init (crt)");
1157 rc = gnutls_x509_crt_import(crt, &cert_list[0], GNUTLS_X509_FMT_DER);
1158 exim_gnutls_peer_err(US"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1160 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1161 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1163 exim_gnutls_peer_err(US"getting size for cert DN failed");
1164 return FAIL; /* should not happen */
1166 dn_buf = store_get_perm(sz);
1167 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1168 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1169 state->peerdn = dn_buf;
1172 #undef exim_gnutls_peer_err
1178 /*************************************************
1179 * Verify peer certificate *
1180 *************************************************/
1182 /* Called from both server and client code.
1183 *Should* be using a callback registered with
1184 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1185 the peer information, but that's too new for some OSes.
1188 state exim_gnutls_state_st *
1189 error where to put an error message
1192 FALSE if the session should be rejected
1193 TRUE if the cert is okay or we just don't care
1197 verify_certificate(exim_gnutls_state_st *state, const char **error)
1200 unsigned int verify;
1204 rc = peer_status(state);
1207 verify = GNUTLS_CERT_INVALID;
1208 *error = "not supplied";
1212 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1215 /* Handle the result of verification. INVALID seems to be set as well
1216 as REVOKED, but leave the test for both. */
1218 if ((rc < 0) || (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
1220 state->peer_cert_verified = FALSE;
1222 *error = ((verify & GNUTLS_CERT_REVOKED) != 0) ? "revoked" : "invalid";
1225 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
1226 *error, state->peerdn ? state->peerdn : US"<unset>");
1228 if (state->verify_requirement == VERIFY_REQUIRED)
1230 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1234 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1238 state->peer_cert_verified = TRUE;
1239 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=%s\n",
1240 state->peerdn ? state->peerdn : US"<unset>");
1243 tls_peerdn = state->peerdn;
1251 /* ------------------------------------------------------------------------ */
1254 /* Logging function which can be registered with
1255 * gnutls_global_set_log_function()
1256 * gnutls_global_set_log_level() 0..9
1258 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1260 exim_gnutls_logger_cb(int level, const char *message)
1262 size_t len = strlen(message);
1265 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1268 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1269 message[len-1] == '\n' ? "" : "\n");
1274 /* Called after client hello, should handle SNI work.
1275 This will always set tls_sni (state->received_sni) if available,
1276 and may trigger presenting different certificates,
1277 if state->trigger_sni_changes is TRUE.
1279 Should be registered with
1280 gnutls_handshake_set_post_client_hello_function()
1282 "This callback must return 0 on success or a gnutls error code to terminate the
1285 For inability to get SNI information, we return 0.
1286 We only return non-zero if re-setup failed.
1290 exim_sni_handling_cb(gnutls_session_t session)
1292 char sni_name[MAX_HOST_LEN];
1293 size_t data_len = MAX_HOST_LEN;
1294 exim_gnutls_state_st *state = current_global_tls_state;
1295 unsigned int sni_type;
1298 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1299 if (rc != GNUTLS_E_SUCCESS)
1302 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1303 debug_printf("TLS: no SNI presented in handshake.\n");
1305 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1306 gnutls_strerror(rc), rc);
1311 if (sni_type != GNUTLS_NAME_DNS)
1313 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1317 /* We now have a UTF-8 string in sni_name */
1318 old_pool = store_pool;
1319 store_pool = POOL_PERM;
1320 state->received_sni = string_copyn(US sni_name, data_len);
1321 store_pool = old_pool;
1323 /* We set this one now so that variable expansions below will work */
1324 tls_sni = state->received_sni;
1326 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1327 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1329 if (!state->trigger_sni_changes)
1332 rc = tls_expand_session_files(state);
1335 /* If the setup of certs/etc failed before handshake, TLS would not have
1336 been offered. The best we can do now is abort. */
1337 return GNUTLS_E_APPLICATION_ERROR_MIN;
1340 rc = tls_set_remaining_x509(state);
1341 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1349 /* ------------------------------------------------------------------------ */
1350 /* Exported functions */
1355 /*************************************************
1356 * Start a TLS session in a server *
1357 *************************************************/
1359 /* This is called when Exim is running as a server, after having received
1360 the STARTTLS command. It must respond to that command, and then negotiate
1364 require_ciphers list of allowed ciphers or NULL
1366 Returns: OK on success
1367 DEFER for errors before the start of the negotiation
1368 FAIL for errors during the negotation; the server can't
1373 tls_server_start(const uschar *require_ciphers)
1377 exim_gnutls_state_st *state = NULL;
1379 /* Check for previous activation */
1380 /* nb: this will not be TLS callout safe, needs reworking as part of that. */
1382 if (tls_active >= 0)
1384 tls_error(US"STARTTLS received after TLS started", "", NULL);
1385 smtp_printf("554 Already in TLS\r\n");
1389 /* Initialize the library. If it fails, it will already have logged the error
1390 and sent an SMTP response. */
1392 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1394 rc = tls_init(NULL, tls_certificate, tls_privatekey,
1395 NULL, tls_verify_certificates, tls_crl,
1396 require_ciphers, &state);
1397 if (rc != OK) return rc;
1399 /* If this is a host for which certificate verification is mandatory or
1400 optional, set up appropriately. */
1402 if (verify_check_host(&tls_verify_hosts) == OK)
1404 DEBUG(D_tls) debug_printf("TLS: a client certificate will be required.\n");
1405 state->verify_requirement = VERIFY_REQUIRED;
1406 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1408 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1410 DEBUG(D_tls) debug_printf("TLS: a client certificate will be requested but not required.\n");
1411 state->verify_requirement = VERIFY_OPTIONAL;
1412 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1416 DEBUG(D_tls) debug_printf("TLS: a client certificate will not be requested.\n");
1417 state->verify_requirement = VERIFY_NONE;
1418 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1421 /* Register SNI handling; always, even if not in tls_certificate, so that the
1422 expansion variable $tls_sni is always available. */
1424 gnutls_handshake_set_post_client_hello_function(state->session,
1425 exim_sni_handling_cb);
1427 /* Set context and tell client to go ahead, except in the case of TLS startup
1428 on connection, where outputting anything now upsets the clients and tends to
1429 make them disconnect. We need to have an explicit fflush() here, to force out
1430 the response. Other smtp_printf() calls do not need it, because in non-TLS
1431 mode, the fflush() happens when smtp_getc() is called. */
1433 if (!tls_on_connect)
1435 smtp_printf("220 TLS go ahead\r\n");
1439 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1440 that the GnuTLS library doesn't. */
1442 gnutls_transport_set_ptr2(state->session,
1443 (gnutls_transport_ptr)fileno(smtp_in),
1444 (gnutls_transport_ptr)fileno(smtp_out));
1445 state->fd_in = fileno(smtp_in);
1446 state->fd_out = fileno(smtp_out);
1448 sigalrm_seen = FALSE;
1449 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1452 rc = gnutls_handshake(state->session);
1453 } while ((rc == GNUTLS_E_AGAIN) ||
1454 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1457 if (rc != GNUTLS_E_SUCCESS)
1459 tls_error(US"gnutls_handshake",
1460 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
1461 /* It seems that, except in the case of a timeout, we have to close the
1462 connection right here; otherwise if the other end is running OpenSSL it hangs
1463 until the server times out. */
1467 (void)fclose(smtp_out);
1468 (void)fclose(smtp_in);
1474 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1476 /* Verify after the fact */
1478 if (state->verify_requirement != VERIFY_NONE)
1480 if (!verify_certificate(state, &error))
1482 if (state->verify_requirement == VERIFY_OPTIONAL)
1485 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1490 tls_error(US"certificate verification failed", error, NULL);
1496 /* Figure out peer DN, and if authenticated, etc. */
1498 rc = peer_status(state);
1499 if (rc != OK) return rc;
1501 /* Sets various Exim expansion variables; always safe within server */
1503 extract_exim_vars_from_tls_state(state);
1505 /* TLS has been set up. Adjust the input functions to read via TLS,
1506 and initialize appropriately. */
1508 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1510 receive_getc = tls_getc;
1511 receive_ungetc = tls_ungetc;
1512 receive_feof = tls_feof;
1513 receive_ferror = tls_ferror;
1514 receive_smtp_buffered = tls_smtp_buffered;
1522 /*************************************************
1523 * Start a TLS session in a client *
1524 *************************************************/
1526 /* Called from the smtp transport after STARTTLS has been accepted.
1529 fd the fd of the connection
1530 host connected host (for messages)
1531 addr the first address (not used)
1532 dhparam DH parameter file (ignored, we're a client)
1533 certificate certificate file
1534 privatekey private key file
1535 sni TLS SNI to send to remote host
1536 verify_certs file for certificate verify
1537 verify_crl CRL for verify
1538 require_ciphers list of allowed ciphers or NULL
1539 dh_min_bits minimum number of bits acceptable in server's DH prime
1540 timeout startup timeout
1542 Returns: OK/DEFER/FAIL (because using common functions),
1543 but for a client, DEFER and FAIL have the same meaning
1547 tls_client_start(int fd, host_item *host,
1548 address_item *addr ARG_UNUSED, uschar *dhparam ARG_UNUSED,
1549 uschar *certificate, uschar *privatekey, uschar *sni,
1550 uschar *verify_certs, uschar *verify_crl,
1551 uschar *require_ciphers, int dh_min_bits, int timeout)
1555 exim_gnutls_state_st *state = NULL;
1557 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
1559 rc = tls_init(host, certificate, privatekey,
1560 sni, verify_certs, verify_crl, require_ciphers, &state);
1561 if (rc != OK) return rc;
1563 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1566 debug_printf("WARNING: tls_dh_min_bits far too low, clamping %d up to %d\n",
1567 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1568 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1571 DEBUG(D_tls) debug_printf("Setting D-H prime minimum acceptable bits to %d\n",
1573 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1575 if (verify_certs == NULL)
1577 DEBUG(D_tls) debug_printf("TLS: server certificate verification not required\n");
1578 state->verify_requirement = VERIFY_NONE;
1579 /* we still ask for it, to log it, etc */
1580 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1584 DEBUG(D_tls) debug_printf("TLS: server certificate verification required\n");
1585 state->verify_requirement = VERIFY_REQUIRED;
1586 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1589 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)fd);
1593 /* There doesn't seem to be a built-in timeout on connection. */
1595 sigalrm_seen = FALSE;
1599 rc = gnutls_handshake(state->session);
1600 } while ((rc == GNUTLS_E_AGAIN) ||
1601 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1604 if (rc != GNUTLS_E_SUCCESS)
1605 return tls_error(US"gnutls_handshake",
1606 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1608 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1612 if (state->verify_requirement != VERIFY_NONE &&
1613 !verify_certificate(state, &error))
1614 return tls_error(US"certificate verification failed", error, state->host);
1616 /* Figure out peer DN, and if authenticated, etc. */
1618 rc = peer_status(state);
1619 if (rc != OK) return rc;
1621 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
1623 extract_exim_vars_from_tls_state(state);
1631 /*************************************************
1632 * Close down a TLS session *
1633 *************************************************/
1635 /* This is also called from within a delivery subprocess forked from the
1636 daemon, to shut down the TLS library, without actually doing a shutdown (which
1637 would tamper with the TLS session in the parent process).
1639 Arguments: TRUE if gnutls_bye is to be called
1644 tls_close(BOOL shutdown)
1646 exim_gnutls_state_st *state = current_global_tls_state;
1648 if (tls_active < 0) return; /* TLS was not active */
1652 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1653 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1656 gnutls_deinit(state->session);
1658 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1660 if ((state_server.session == NULL) && (state_client.session == NULL))
1662 gnutls_global_deinit();
1663 exim_gnutls_base_init_done = FALSE;
1672 /*************************************************
1673 * TLS version of getc *
1674 *************************************************/
1676 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
1677 it refills the buffer via the GnuTLS reading function.
1679 This feeds DKIM and should be used for all message-body reads.
1682 Returns: the next character or EOF
1688 exim_gnutls_state_st *state = current_global_tls_state;
1689 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
1693 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1694 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
1696 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1697 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
1698 ssl_xfer_buffer_size);
1701 /* A zero-byte return appears to mean that the TLS session has been
1702 closed down, not that the socket itself has been closed down. Revert to
1703 non-TLS handling. */
1707 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1709 receive_getc = smtp_getc;
1710 receive_ungetc = smtp_ungetc;
1711 receive_feof = smtp_feof;
1712 receive_ferror = smtp_ferror;
1713 receive_smtp_buffered = smtp_buffered;
1715 gnutls_deinit(state->session);
1716 state->session = NULL;
1719 tls_certificate_verified = FALSE;
1720 tls_channelbinding_b64 = NULL;
1727 /* Handle genuine errors */
1729 else if (inbytes < 0)
1731 record_io_error(state, (int) inbytes, US"recv", NULL);
1732 state->xfer_error = 1;
1735 #ifndef DISABLE_DKIM
1736 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
1738 state->xfer_buffer_hwm = (int) inbytes;
1739 state->xfer_buffer_lwm = 0;
1742 /* Something in the buffer; return next uschar */
1744 return state->xfer_buffer[state->xfer_buffer_lwm++];
1750 /*************************************************
1751 * Read bytes from TLS channel *
1752 *************************************************/
1754 /* This does not feed DKIM, so if the caller uses this for reading message body,
1755 then the caller must feed DKIM.
1760 Returns: the number of bytes read
1761 -1 after a failed read
1765 tls_read(uschar *buff, size_t len)
1767 exim_gnutls_state_st *state = current_global_tls_state;
1773 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
1775 debug_printf("*** PROBABLY A BUG *** " \
1776 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1777 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
1780 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
1781 state->session, buff, len);
1783 inbytes = gnutls_record_recv(state->session, buff, len);
1784 if (inbytes > 0) return inbytes;
1787 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1789 else record_io_error(state, (int)inbytes, US"recv", NULL);
1797 /*************************************************
1798 * Write bytes down TLS channel *
1799 *************************************************/
1806 Returns: the number of bytes after a successful write,
1807 -1 after a failed write
1811 tls_write(const uschar *buff, size_t len)
1815 exim_gnutls_state_st *state = current_global_tls_state;
1817 DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
1820 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
1822 outbytes = gnutls_record_send(state->session, buff, left);
1824 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
1827 record_io_error(state, outbytes, US"send", NULL);
1832 record_io_error(state, 0, US"send", US"TLS channel closed on write");
1843 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
1854 /*************************************************
1855 * Random number generation *
1856 *************************************************/
1858 /* Pseudo-random number generation. The result is not expected to be
1859 cryptographically strong but not so weak that someone will shoot themselves
1860 in the foot using it as a nonce in input in some email header scheme or
1861 whatever weirdness they'll twist this into. The result should handle fork()
1862 and avoid repeating sequences. OpenSSL handles that for us.
1866 Returns a random number in range [0, max-1]
1869 #ifdef HAVE_GNUTLS_RND
1871 vaguely_random_number(int max)
1876 uschar smallbuf[sizeof(r)];
1881 needed_len = sizeof(r);
1882 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
1883 * asked for a number less than 10. */
1884 for (r = max, i = 0; r; ++i)
1890 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
1893 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
1894 return vaguely_random_number_fallback(max);
1897 for (p = smallbuf; needed_len; --needed_len, ++p)
1903 /* We don't particularly care about weighted results; if someone wants
1904 * smooth distribution and cares enough then they should submit a patch then. */
1907 #else /* HAVE_GNUTLS_RND */
1909 vaguely_random_number(int max)
1911 return vaguely_random_number_fallback(max);
1913 #endif /* HAVE_GNUTLS_RND */
1918 /*************************************************
1919 * Let tls_require_ciphers be checked at startup *
1920 *************************************************/
1922 /* The tls_require_ciphers option, if set, must be something which the
1925 Returns: NULL on success, or error message
1929 tls_validate_require_cipher(void)
1932 uschar *expciphers = NULL;
1933 gnutls_priority_t priority_cache;
1936 #define validate_check_rc(Label) do { \
1937 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
1938 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
1939 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
1941 if (exim_gnutls_base_init_done)
1942 log_write(0, LOG_MAIN|LOG_PANIC,
1943 "already initialised GnuTLS, Exim developer bug");
1945 rc = gnutls_global_init();
1946 validate_check_rc(US"gnutls_global_init()");
1947 exim_gnutls_base_init_done = TRUE;
1949 if (!(tls_require_ciphers && *tls_require_ciphers))
1950 return_deinit(NULL);
1952 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
1953 return_deinit(US"failed to expand tls_require_ciphers");
1955 if (!(expciphers && *expciphers))
1956 return_deinit(NULL);
1959 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
1961 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
1962 validate_check_rc(string_sprintf(
1963 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
1964 expciphers, errpos - CS expciphers, errpos));
1966 #undef return_deinit
1967 #undef validate_check_rc
1968 gnutls_global_deinit();
1976 /*************************************************
1977 * Report the library versions. *
1978 *************************************************/
1980 /* See a description in tls-openssl.c for an explanation of why this exists.
1982 Arguments: a FILE* to print the results to
1987 tls_version_report(FILE *f)
1989 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
1992 gnutls_check_version(NULL));
1995 /* End of tls-gnu.c */