1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) Phil Pennock 2012 */
7 /* Copyright (c) The Exim Maintainers 2020 - 2021 */
8 /* See the file NOTICE for conditions of use and distribution. */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
43 /* needed to disable PKCS11 autoload unless requested */
44 #if GNUTLS_VERSION_NUMBER >= 0x020c00
45 # include <gnutls/pkcs11.h>
46 # define SUPPORT_PARAM_TO_PK_BITS
48 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
52 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
53 # warning "GnuTLS library version too old; tls:cert event unsupported"
54 # define DISABLE_EVENT
56 #if GNUTLS_VERSION_NUMBER >= 0x030000
57 # define SUPPORT_SELFSIGN /* Uncertain what version is first usable but 2.12.23 is not */
59 #if GNUTLS_VERSION_NUMBER >= 0x030306
60 # define SUPPORT_CA_DIR
62 # undef SUPPORT_CA_DIR
64 #if GNUTLS_VERSION_NUMBER >= 0x030014
65 # define SUPPORT_SYSDEFAULT_CABUNDLE
67 #if GNUTLS_VERSION_NUMBER >= 0x030104
68 # define GNUTLS_CERT_VFY_STATUS_PRINT
70 #if GNUTLS_VERSION_NUMBER >= 0x030109
73 #if GNUTLS_VERSION_NUMBER >= 0x03010a
74 # define SUPPORT_GNUTLS_SESS_DESC
76 #if GNUTLS_VERSION_NUMBER >= 0x030300
77 # define GNUTLS_AUTO_GLOBAL_INIT
78 # define GNUTLS_AUTO_PKCS11_MANUAL
80 #if (GNUTLS_VERSION_NUMBER >= 0x030404) \
81 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
83 # define EXIM_HAVE_OCSP
86 #if GNUTLS_VERSION_NUMBER >= 0x030500
87 # define SUPPORT_GNUTLS_KEYLOG
89 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
90 # define SUPPORT_SRV_OCSP_STACK
92 #if GNUTLS_VERSION_NUMBER >= 0x030603
93 # define EXIM_HAVE_TLS1_3
94 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
95 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
99 # if GNUTLS_VERSION_NUMBER >= 0x030000
100 # define DANESSL_USAGE_DANE_TA 2
101 # define DANESSL_USAGE_DANE_EE 3
103 # error GnuTLS version too early for DANE
105 # if GNUTLS_VERSION_NUMBER < 0x999999
106 # define GNUTLS_BROKEN_DANE_VALIDATION
110 #ifndef DISABLE_TLS_RESUME
111 # if GNUTLS_VERSION_NUMBER >= 0x030603
112 # define EXIM_HAVE_TLS_RESUME
114 # warning "GnuTLS library version too old; resumption unsupported"
118 #if GNUTLS_VERSION_NUMBER >= 0x030200
119 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
120 # define EXIM_HAVE_ALPN
125 # include <gnutls/ocsp.h>
128 # include <gnutls/dane.h>
131 #include "tls-cipher-stdname.c"
138 # ifndef DISABLE_TLS_RESUME
139 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
141 # ifdef EXIM_HAVE_TLS1_3
142 builtin_macro_create(US"_HAVE_TLS1_3");
144 # ifdef EXIM_HAVE_OCSP
145 builtin_macro_create(US"_HAVE_TLS_OCSP");
147 # ifdef SUPPORT_SRV_OCSP_STACK
148 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
150 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
151 builtin_macro_create(US"_HAVE_TLS_CA_CACHE");
153 # ifdef EXIM_HAVE_ALPN
154 builtin_macro_create(US"_HAVE_TLS_ALPN");
163 gnutls_global_set_audit_log_function()
166 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
169 /* Local static variables for GnuTLS */
171 /* Values for verify_requirement */
173 enum peer_verify_requirement
174 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
176 /* This holds most state for server or client; with this, we can set up an
177 outbound TLS-enabled connection in an ACL callout, while not stomping all
178 over the TLS variables available for expansion.
180 Some of these correspond to variables in globals.c; those variables will
181 be set to point to content in one of these instances, as appropriate for
182 the stage of the process lifetime.
184 Not handled here: global tlsp->tls_channelbinding.
187 typedef struct exim_gnutls_state {
188 gnutls_session_t session;
190 exim_tlslib_state lib_state;
191 #define x509_cred libdata0
192 #define pri_cache libdata1
194 enum peer_verify_requirement verify_requirement;
198 BOOL peer_cert_verified:1;
199 BOOL peer_dane_verified:1;
200 BOOL trigger_sni_changes:1;
201 BOOL have_set_peerdn:1;
202 BOOL xfer_eof:1; /*XXX never gets set! */
208 const struct host_item *host; /* NULL if server */
209 gnutls_x509_crt_t peercert;
212 uschar *received_sni;
214 const uschar *tls_certificate;
215 const uschar *tls_privatekey;
216 const uschar *tls_sni; /* client send only, not received */
217 const uschar *tls_verify_certificates;
218 const uschar *tls_crl;
219 const uschar *tls_require_ciphers;
221 uschar *exp_tls_certificate;
222 uschar *exp_tls_privatekey;
223 uschar *exp_tls_verify_certificates;
225 uschar *exp_tls_require_ciphers;
226 const uschar *exp_tls_verify_cert_hostnames;
227 #ifndef DISABLE_EVENT
228 uschar *event_action;
231 char * const * dane_data;
232 const int * dane_data_len;
235 tls_support *tlsp; /* set in tls_init() */
240 } exim_gnutls_state_st;
242 static const exim_gnutls_state_st exim_gnutls_state_init = {
243 /* all elements not explicitly intialised here get 0/NULL/FALSE */
248 /* Not only do we have our own APIs which don't pass around state, assuming
249 it's held in globals, GnuTLS doesn't appear to let us register callback data
250 for callbacks, or as part of the session, so we have to keep a "this is the
251 context we're currently dealing with" pointer and rely upon being
252 single-threaded to keep from processing data on an inbound TLS connection while
253 talking to another TLS connection for an outbound check. This does mean that
254 there's no way for heart-beats to be responded to, for the duration of the
256 XXX But see gnutls_session_get_ptr()
259 static exim_gnutls_state_st state_server = {
260 /* all elements not explicitly intialised here get 0/NULL/FALSE */
265 /* dh_params are initialised once within the lifetime of a process using TLS;
266 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
267 don't want to repeat this. */
269 static gnutls_dh_params_t dh_server_params = NULL;
271 static int ssl_session_timeout = 7200; /* Two hours */
273 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
275 /* Guard library core initialisation */
277 static BOOL exim_gnutls_base_init_done = FALSE;
280 static BOOL gnutls_buggy_ocsp = FALSE;
281 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
284 #ifdef EXIM_HAVE_ALPN
285 static int server_seen_alpn = -1; /* count of names */
287 #ifdef EXIM_HAVE_TLS_RESUME
288 static gnutls_datum_t server_sessticket_key;
292 /* ------------------------------------------------------------------------ */
295 #define MAX_HOST_LEN 255
297 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
298 the library logging; a value less than 0 disables the calls to set up logging
299 callbacks. GNuTLS also looks for an environment variable - except not for
300 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
301 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
302 but the env var must be added to /etc/sudoers too. */
303 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
304 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
307 #ifndef EXIM_CLIENT_DH_MIN_BITS
308 # define EXIM_CLIENT_DH_MIN_BITS 1024
311 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
312 can ask for a bit-strength. Without that, we stick to the constant we had
314 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
315 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
318 #define Expand_check_tlsvar(Varname, errstr) \
319 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
321 #if GNUTLS_VERSION_NUMBER >= 0x020c00
322 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
323 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
324 # define HAVE_GNUTLS_RND
325 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
326 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
327 * isn't available sometimes, so this needs to become a conditional
328 * compilation; the sanest way to deal with this being a problem on
329 * older OSes is to block it in the Local/Makefile with this compiler
331 # ifndef AVOID_GNUTLS_PKCS11
332 # define HAVE_GNUTLS_PKCS11
333 # endif /* AVOID_GNUTLS_PKCS11 */
336 #if GNUTLS_VERSION_NUMBER >= 0x030404
337 # define HAVE_GNUTLS_PRF_RFC5705
342 /* ------------------------------------------------------------------------ */
343 /* Callback declarations */
345 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
346 static void exim_gnutls_logger_cb(int level, const char *message);
349 static int exim_sni_handling_cb(gnutls_session_t session);
351 #ifdef EXIM_HAVE_TLS_RESUME
353 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
354 unsigned incoming, const gnutls_datum_t * msg);
358 /*************************************************
360 *************************************************/
362 /* Called from lots of places when errors occur before actually starting to do
363 the TLS handshake, that is, while the session is still in clear. Always returns
364 DEFER for a server and FAIL for a client so that most calls can use "return
365 tls_error(...)" to do this processing and then give an appropriate return. A
366 single function is used for both server and client, because it is called from
367 some shared functions.
370 prefix text to include in the logged error
371 msg additional error string (may be NULL)
372 usually obtained from gnutls_strerror()
373 host NULL if setting up a server;
374 the connected host if setting up a client
375 errstr pointer to returned error string
377 Returns: OK/DEFER/FAIL
381 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
385 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
386 return host ? FAIL : DEFER;
391 tls_error_gnu(exim_gnutls_state_st * state, const uschar *prefix, int err,
394 return tls_error(prefix,
395 state && err == GNUTLS_E_FATAL_ALERT_RECEIVED
396 ? US gnutls_alert_get_name(gnutls_alert_get(state->session))
397 : US gnutls_strerror(err),
398 state ? state->host : NULL,
403 tls_error_sys(const uschar *prefix, int err, const host_item *host,
406 return tls_error(prefix, US strerror(err), host, errstr);
410 /* ------------------------------------------------------------------------ */
416 tls_is_buggy_ocsp(void)
419 uschar maj, mid, mic;
421 s = CUS gnutls_check_version(NULL);
425 while (*s && *s != '.') s++;
433 while (*s && *s != '.') s++;
435 return mic <= (mid == 3 ? 16 : 3);
445 tls_g_init(uschar ** errstr)
448 DEBUG(D_tls) debug_printf("GnuTLS global init required\n");
450 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
451 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
452 which loads modules from a config file, which sounds good and may be wanted
453 by some sysadmin, but also means in common configurations that GNOME keyring
454 environment variables are used and so breaks for users calling mailq.
455 To prevent this, we init PKCS11 first, which is the documented approach. */
457 if (!gnutls_allow_auto_pkcs11)
458 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
459 return tls_error_gnu(NULL, US"gnutls_pkcs11_init", rc, errstr);
462 #ifndef GNUTLS_AUTO_GLOBAL_INIT
463 if ((rc = gnutls_global_init()))
464 return tls_error_gnu(NULL, US"gnutls_global_init", rc, errstr);
467 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
470 gnutls_global_set_log_function(exim_gnutls_logger_cb);
471 /* arbitrarily chosen level; bump up to 9 for more */
472 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
477 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
478 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
481 exim_gnutls_base_init_done = TRUE;
487 /* Daemon-call before each connection. Nothing to do for GnuTLS. */
490 tls_per_lib_daemon_tick(void)
494 /* Daemon one-time initialisation */
497 tls_per_lib_daemon_init(void)
499 uschar * dummy_errstr;
500 static BOOL once = FALSE;
502 if (!exim_gnutls_base_init_done)
503 tls_g_init(&dummy_errstr);
509 #ifdef EXIM_HAVE_TLS_RESUME
510 /* We are dependent on the GnuTLS implementation of the Session Ticket
511 encryption; both the strength and the key rotation period. We hope that
512 the strength at least matches that of the ciphersuite (but GnuTLS does not
515 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
516 if (f.running_in_test_harness) ssl_session_timeout = 6;
519 tls_daemon_creds_reload();
523 /* ------------------------------------------------------------------------ */
525 /*************************************************
526 * Deal with logging errors during I/O *
527 *************************************************/
529 /* We have to get the identity of the peer from saved data.
532 state the current GnuTLS exim state container
533 rc the GnuTLS error code, or 0 if it's a local error
534 when text identifying read or write
535 text local error text when rc is 0
541 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
546 msg = rc == GNUTLS_E_FATAL_ALERT_RECEIVED
547 ? string_sprintf("A TLS fatal alert has been received: %s",
548 US gnutls_alert_get_name(gnutls_alert_get(state->session)))
549 #ifdef GNUTLS_E_PREMATURE_TERMINATION
550 : rc == GNUTLS_E_PREMATURE_TERMINATION && errno
551 ? string_sprintf("%s: syscall: %s", US gnutls_strerror(rc), strerror(errno))
553 : US gnutls_strerror(rc);
555 (void) tls_error(when, msg, state->host, &errstr);
558 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
559 state->host->name, state->host->address, errstr);
562 uschar * conn_info = smtp_get_connection_info();
563 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
564 /* I'd like to get separated H= here, but too hard for now */
565 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
572 /*************************************************
573 * Set various Exim expansion vars *
574 *************************************************/
576 #define exim_gnutls_cert_err(Label) \
579 if (rc != GNUTLS_E_SUCCESS) \
581 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
582 (Label), gnutls_strerror(rc)); \
588 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
592 rc = gnutls_x509_crt_init(crtp);
593 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
595 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
596 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
601 #undef exim_gnutls_cert_err
604 /* We set various Exim global variables from the state, once a session has
605 been established. With TLS callouts, may need to change this to stack
606 variables, or just re-call it with the server state after client callout
609 Make sure anything set here is unset in tls_getc().
613 tls_bits strength indicator
614 tls_certificate_verified bool indicator
615 tls_channelbinding for some SASL mechanisms
618 tls_peercert pointer to library internal
620 tls_sni a (UTF-8) string
621 tls_ourcert pointer to library internal
624 state the relevant exim_gnutls_state_st *
628 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
630 tls_support * tlsp = state->tlsp;
632 tlsp->active.sock = state->fd_out;
633 tlsp->active.tls_ctx = state;
635 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
637 tlsp->certificate_verified = state->peer_cert_verified;
639 tlsp->dane_verified = state->peer_dane_verified;
642 /* note that tls_channelbinding is not saved to the spool file, since it's
643 only available for use for authenticators while this TLS session is running. */
645 tlsp->channelbinding = NULL;
646 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
648 gnutls_datum_t channel = {.data = NULL, .size = 0};
652 # ifdef HAVE_GNUTLS_PRF_RFC5705
653 if (gnutls_protocol_get_version(state->session) >= GNUTLS_TLS1_3)
655 buf = store_get(32, !!state->host);
656 rc = gnutls_prf_rfc5705(state->session,
657 (size_t)24, "EXPORTER-Channel-Binding", (size_t)0, "",
664 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
667 { DEBUG(D_tls) debug_printf("extracting channel binding: %s\n", gnutls_strerror(rc)); }
670 int old_pool = store_pool;
671 /* Declare the taintedness of the binding info. On server, untainted; on
672 client, tainted - being the Finish msg from the server. */
674 store_pool = POOL_PERM;
675 tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size,
677 store_pool = old_pool;
678 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n");
683 /* peercert is set in peer_status() */
684 tlsp->peerdn = state->peerdn;
686 /* do not corrupt sni sent by client; record sni rxd by server */
688 tlsp->sni = state->received_sni;
690 /* record our certificate */
692 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
693 gnutls_x509_crt_t crt;
695 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
702 /*************************************************
703 * Setup up DH parameters *
704 *************************************************/
706 /* Generating the D-H parameters may take a long time. They only need to
707 be re-generated every so often, depending on security policy. What we do is to
708 keep these parameters in a file in the spool directory. If the file does not
709 exist, we generate them. This means that it is easy to cause a regeneration.
711 The new file is written as a temporary file and renamed, so that an incomplete
712 file is never present. If two processes both compute some new parameters, you
713 waste a bit of effort, but it doesn't seem worth messing around with locking to
716 Returns: OK/DEFER/FAIL
720 init_server_dh(uschar ** errstr)
723 unsigned int dh_bits;
725 uschar filename_buf[PATH_MAX];
726 uschar *filename = NULL;
728 uschar *exp_tls_dhparam;
729 BOOL use_file_in_spool = FALSE;
730 host_item *host = NULL; /* dummy for macros */
732 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params\n");
734 if ((rc = gnutls_dh_params_init(&dh_server_params)))
735 return tls_error_gnu(NULL, US"gnutls_dh_params_init", rc, errstr);
740 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
743 if (!exp_tls_dhparam)
745 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
746 m.data = US std_dh_prime_default();
747 m.size = Ustrlen(m.data);
749 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
750 use_file_in_spool = TRUE;
751 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
753 DEBUG(D_tls) debug_printf("Requested no DH parameters\n");
756 else if (exp_tls_dhparam[0] != '/')
758 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
759 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
760 m.size = Ustrlen(m.data);
763 filename = exp_tls_dhparam;
767 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
768 return tls_error_gnu(NULL, US"gnutls_dh_params_import_pkcs3", rc, errstr);
769 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
773 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
774 /* If you change this constant, also change dh_param_fn_ext so that we can use a
775 different filename and ensure we have sufficient bits. */
777 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
778 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
780 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits\n",
783 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
785 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits\n",
789 /* Some clients have hard-coded limits. */
790 if (dh_bits > tls_dh_max_bits)
793 debug_printf("tls_dh_max_bits clamping override, using %d bits instead\n",
795 dh_bits = tls_dh_max_bits;
798 if (use_file_in_spool)
800 if (!string_format(filename_buf, sizeof(filename_buf),
801 "%s/gnutls-params-%d", spool_directory, dh_bits))
802 return tls_error(US"overlong filename", NULL, NULL, errstr);
803 filename = filename_buf;
806 /* Open the cache file for reading and if successful, read it and set up the
809 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
815 if (fstat(fd, &statbuf) < 0) /* EIO */
819 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
821 if (!S_ISREG(statbuf.st_mode))
824 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
826 if (!(fp = fdopen(fd, "rb")))
830 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
831 saved_errno, NULL, errstr);
834 m.size = statbuf.st_size;
835 if (!(m.data = store_malloc(m.size)))
838 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
840 if (!(sz = fread(m.data, m.size, 1, fp)))
845 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
849 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
852 return tls_error_gnu(NULL, US"gnutls_dh_params_import_pkcs3", rc, errstr);
853 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
856 /* If the file does not exist, fall through to compute new data and cache it.
857 If there was any other opening error, it is serious. */
859 else if (errno == ENOENT)
863 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
866 return tls_error(string_open_failed("\"%s\" for reading", filename),
869 /* If ret < 0, either the cache file does not exist, or the data it contains
870 is not useful. One particular case of this is when upgrading from an older
871 release of Exim in which the data was stored in a different format. We don't
872 try to be clever and support both formats; we just regenerate new data in this
878 unsigned int dh_bits_gen = dh_bits;
880 if ((PATH_MAX - Ustrlen(filename)) < 10)
881 return tls_error(US"Filename too long to generate replacement",
882 filename, NULL, errstr);
884 temp_fn = string_copy(US"exim-dh.XXXXXXX");
885 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
886 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
887 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
889 /* GnuTLS overshoots!
890 * If we ask for 2236, we might get 2237 or more.
891 * But there's no way to ask GnuTLS how many bits there really are.
892 * We can ask how many bits were used in a TLS session, but that's it!
893 * The prime itself is hidden behind too much abstraction.
894 * So we ask for less, and proceed on a wing and a prayer.
895 * First attempt, subtracted 3 for 2233 and got 2240.
897 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
899 dh_bits_gen = dh_bits - 10;
901 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
906 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
908 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
909 return tls_error_gnu(NULL, US"gnutls_dh_params_generate2", rc, errstr);
911 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
912 and I confirmed that a NULL call to get the size first is how the GnuTLS
913 sample apps handle this. */
917 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
918 GNUTLS_X509_FMT_PEM, m.data, &sz))
919 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
920 return tls_error_gnu(NULL, US"gnutls_dh_params_export_pkcs3(NULL) sizing",
923 if (!(m.data = store_malloc(m.size)))
924 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
926 /* this will return a size 1 less than the allocation size above */
927 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
931 return tls_error_gnu(NULL, US"gnutls_dh_params_export_pkcs3() real", rc, errstr);
933 m.size = sz; /* shrink by 1, probably */
935 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
938 return tls_error_sys(US"TLS cache write D-H params failed",
939 errno, NULL, errstr);
942 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
943 return tls_error_sys(US"TLS cache write D-H params final newline failed",
944 errno, NULL, errstr);
946 if ((rc = close(fd)))
947 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
949 if (Urename(temp_fn, filename) < 0)
950 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
951 temp_fn, filename), errno, NULL, errstr);
953 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
956 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
963 /* Create and install a selfsigned certificate, for use in server mode. */
966 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
968 gnutls_x509_crt_t cert = NULL;
970 gnutls_x509_privkey_t pkey = NULL;
971 const uschar * where;
974 #ifndef SUPPORT_SELFSIGN
975 where = US"library too old";
976 rc = GNUTLS_E_NO_CERTIFICATE_FOUND;
980 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
981 where = US"initialising pkey";
982 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
984 where = US"initialising cert";
985 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
987 where = US"generating pkey"; /* Hangs on 2.12.23 */
988 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
989 #ifdef SUPPORT_PARAM_TO_PK_BITS
990 # ifndef GNUTLS_SEC_PARAM_MEDIUM
991 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
993 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
1000 where = US"configuring cert";
1002 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
1003 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
1004 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
1005 || (rc = gnutls_x509_crt_set_expiration_time(cert, (long)2 * 60 * 60)) /* 2 hour */
1006 || (rc = gnutls_x509_crt_set_key(cert, pkey))
1008 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
1009 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
1010 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
1011 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
1012 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
1013 GNUTLS_OID_X520_COMMON_NAME, 0,
1014 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
1018 where = US"signing cert";
1019 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
1021 where = US"installing selfsign cert";
1023 if ((rc = gnutls_certificate_set_x509_key(state->lib_state.x509_cred,
1030 if (cert) gnutls_x509_crt_deinit(cert);
1031 if (pkey) gnutls_x509_privkey_deinit(pkey);
1035 rc = tls_error_gnu(state, where, rc, errstr);
1042 /* Add certificate and key, from files.
1045 Zero or negative: good. Negate value for certificate index if < 0.
1046 Greater than zero: FAIL or DEFER code.
1050 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
1051 const uschar * certfile, const uschar * keyfile, uschar ** errstr)
1053 int rc = gnutls_certificate_set_x509_key_file(state->lib_state.x509_cred,
1054 CCS certfile, CCS keyfile, GNUTLS_X509_FMT_PEM);
1056 return tls_error_gnu(state,
1057 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
1063 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1064 /* Load an OCSP proof from file for sending by the server. Called
1065 on getting a status-request handshake message, for earlier versions
1069 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1070 gnutls_datum_t * ocsp_response)
1073 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
1075 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1077 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1079 tls_in.ocsp = OCSP_NOT_RESP;
1080 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1083 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1089 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1090 /* Make a note that we saw a status-request */
1092 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
1093 const uschar * data, unsigned size)
1095 /* The values for tls_id are documented here:
1096 https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1099 case 5: /* Status Request */
1100 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
1101 tls_in.ocsp = OCSP_NOT_RESP;
1103 #ifdef EXIM_HAVE_ALPN
1104 case 16: /* Application Layer Protocol Notification */
1105 /* The format of "data" here doesn't seem to be documented, but appears
1106 to be a 2-byte field with a (redundant, given the "size" arg) total length
1107 then a sequence of one-byte size then string (not nul-term) names. The
1108 latter is as described in OpenSSL documentation. */
1110 DEBUG(D_tls) debug_printf("Seen ALPN extension from client (s=%u):", size);
1111 for (const uschar * s = data+2; s-data < size-1; s += *s + 1)
1114 DEBUG(D_tls) debug_printf(" '%.*s'", (int)*s, s+1);
1116 DEBUG(D_tls) debug_printf("\n");
1117 if (server_seen_alpn > 1)
1119 DEBUG(D_tls) debug_printf("TLS: too many ALPNs presented in handshake\n");
1120 return GNUTLS_E_NO_APPLICATION_PROTOCOL;
1128 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
1130 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
1131 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1133 /* Call fn for each extension seen. 3.6.3 onwards */
1134 return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
1135 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
1139 # ifdef notdef_crashes
1140 /* Make a note that we saw a status-response */
1142 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
1143 const unsigned char *data, unsigned size)
1145 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
1146 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1147 if (FALSE && tls_id == 5) /* status_request */
1149 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
1150 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1151 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1157 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
1159 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
1160 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1162 /* Call fn for each extension seen. 3.6.3 onwards */
1163 # ifdef notdef_crashes
1165 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
1168 #endif /*SUPPORT_GNUTLS_EXT_RAW_PARSE*/
1170 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
1171 "Handshake Protocol: Certificate" record.
1172 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
1174 This is different to tls1.2 - where it is a separate record (wireshark term) / handshake message (gnutls term).
1177 #if defined(EXIM_HAVE_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1178 /* Callback for certificate-status, on server. We sent stapled OCSP. */
1180 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
1181 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1183 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
1184 # ifdef SUPPORT_SRV_OCSP_STACK
1185 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1186 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1188 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1193 /* Callback for handshake messages, on server */
1195 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1196 unsigned incoming, const gnutls_datum_t * msg)
1198 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
1201 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1202 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1203 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1204 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1205 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1207 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1208 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1209 # ifdef EXIM_HAVE_TLS_RESUME
1210 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1211 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1220 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1222 tls_server_testharness_ocsp_fiddle(void)
1224 extern char ** environ;
1225 if (environ) for (uschar ** p = USS environ; *p; p++)
1226 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1228 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1229 exim_testharness_disable_ocsp_validity_check = TRUE;
1234 /**************************************************
1235 * One-time init credentials for server and client *
1236 **************************************************/
1239 creds_basic_init(gnutls_certificate_credentials_t x509_cred, BOOL server)
1241 #ifdef SUPPORT_SRV_OCSP_STACK
1242 gnutls_certificate_set_flags(x509_cred, GNUTLS_CERTIFICATE_API_V2);
1244 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1245 if (server && tls_ocsp_file)
1247 if (f.running_in_test_harness)
1248 tls_server_testharness_ocsp_fiddle();
1250 if (exim_testharness_disable_ocsp_validity_check)
1251 gnutls_certificate_set_flags(x509_cred,
1252 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1257 debug_printf("TLS: basic cred init, %s\n", server ? "server" : "client");
1261 creds_load_server_certs(exim_gnutls_state_st * state, const uschar * cert,
1262 const uschar * pkey, const uschar * ocsp, uschar ** errstr)
1264 const uschar * clist = cert;
1265 const uschar * klist = pkey;
1266 const uschar * olist;
1267 int csep = 0, ksep = 0, osep = 0, cnt = 0, rc;
1268 uschar * cfile, * kfile, * ofile;
1269 #ifndef DISABLE_OCSP
1270 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1271 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1274 if (!expand_check(ocsp, US"tls_ocsp_file", &ofile, errstr))
1279 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1281 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1282 return tls_error(US"cert/key setup: out of keys", NULL, NULL, errstr);
1283 else if ((rc = tls_add_certfile(state, NULL, cfile, kfile, errstr)) > 0)
1287 int gnutls_cert_index = -rc;
1288 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1289 gnutls_cert_index, cfile);
1291 #ifndef DISABLE_OCSP
1294 /* Set the OCSP stapling server info */
1295 if (gnutls_buggy_ocsp)
1298 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1300 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1302 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1303 gnutls_cert_index, ofile);
1304 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1305 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1307 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1310 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1312 ocsp_fmt = GNUTLS_X509_FMT_DER;
1316 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1317 state->lib_state.x509_cred, CCS ofile, gnutls_cert_index,
1319 return tls_error_gnu(state,
1320 US"gnutls_certificate_set_ocsp_status_request_file2",
1323 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1325 /* Arrange callbacks for OCSP request observability */
1328 gnutls_handshake_set_hook_function(state->session,
1329 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1331 state->lib_state.ocsp_hook = TRUE;
1335 # if defined(SUPPORT_SRV_OCSP_STACK)
1336 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1337 state->lib_state.x509_cred, gnutls_cert_index,
1338 server_ocsp_stapling_cb, ofile)))
1339 return tls_error_gnu(state,
1340 US"gnutls_certificate_set_ocsp_status_request_function2",
1348 debug_printf("oops; multiple OCSP files not supported\n");
1351 gnutls_certificate_set_ocsp_status_request_function(
1352 state->lib_state.x509_cred, server_ocsp_stapling_cb, ofile);
1354 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1357 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1359 #endif /* DISABLE_OCSP */
1365 creds_load_client_certs(exim_gnutls_state_st * state, const host_item * host,
1366 const uschar * cert, const uschar * pkey, uschar ** errstr)
1368 int rc = tls_add_certfile(state, host, cert, pkey, errstr);
1369 if (rc > 0) return rc;
1370 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1375 creds_load_cabundle(exim_gnutls_state_st * state, const uschar * bundle,
1376 const host_item * host, uschar ** errstr)
1379 struct stat statbuf;
1381 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1382 if (Ustrcmp(bundle, "system") == 0 || Ustrncmp(bundle, "system,", 7) == 0)
1383 cert_count = gnutls_certificate_set_x509_system_trust(state->lib_state.x509_cred);
1387 if (Ustat(bundle, &statbuf) < 0)
1389 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1390 "(tls_verify_certificates): %s", bundle, strerror(errno));
1394 #ifndef SUPPORT_CA_DIR
1395 /* The test suite passes in /dev/null; we could check for that path explicitly,
1396 but who knows if someone has some weird FIFO which always dumps some certs, or
1397 other weirdness. The thing we really want to check is that it's not a
1398 directory, since while OpenSSL supports that, GnuTLS does not.
1399 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1400 if (S_ISDIR(statbuf.st_mode))
1402 log_write(0, LOG_MAIN|LOG_PANIC,
1403 "tls_verify_certificates \"%s\" is a directory", bundle);
1408 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1409 bundle, statbuf.st_size);
1411 if (statbuf.st_size == 0)
1414 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1420 #ifdef SUPPORT_CA_DIR
1421 (statbuf.st_mode & S_IFMT) == S_IFDIR
1423 gnutls_certificate_set_x509_trust_dir(state->lib_state.x509_cred,
1424 CS bundle, GNUTLS_X509_FMT_PEM)
1427 gnutls_certificate_set_x509_trust_file(state->lib_state.x509_cred,
1428 CS bundle, GNUTLS_X509_FMT_PEM);
1430 #ifdef SUPPORT_CA_DIR
1431 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1432 when using the directory-of-certs config model. */
1434 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1436 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1438 state->lib_state.ca_rdn_emulate = TRUE;
1443 return tls_error_gnu(state, US"setting certificate trust", cert_count, errstr);
1445 debug_printf("Added %d certificate authorities\n", cert_count);
1452 creds_load_crl(exim_gnutls_state_st * state, const uschar * crl, uschar ** errstr)
1455 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", crl);
1456 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->lib_state.x509_cred,
1457 CS crl, GNUTLS_X509_FMT_PEM)) < 0)
1458 return tls_error_gnu(state, US"gnutls_certificate_set_x509_crl_file",
1459 cert_count, errstr);
1461 DEBUG(D_tls) debug_printf("Processed %d CRLs\n", cert_count);
1467 creds_load_pristring(exim_gnutls_state_st * state, const uschar * p,
1468 const char ** errpos)
1472 p = exim_default_gnutls_priority;
1474 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1476 return gnutls_priority_init( (gnutls_priority_t *) &state->lib_state.pri_cache,
1481 tls_server_creds_init(void)
1483 uschar * dummy_errstr;
1484 unsigned lifetime = 0;
1486 state_server.lib_state = null_tls_preload;
1487 if (gnutls_certificate_allocate_credentials(
1488 (gnutls_certificate_credentials_t *) &state_server.lib_state.x509_cred))
1490 state_server.lib_state.x509_cred = NULL;
1493 creds_basic_init(state_server.lib_state.x509_cred, TRUE);
1495 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1496 /* If tls_certificate has any $ indicating expansions, it is not good.
1497 If tls_privatekey is set but has $, not good. Likewise for tls_ocsp_file.
1498 If all good (and tls_certificate set), load the cert(s). */
1500 if ( opt_set_and_noexpand(tls_certificate)
1501 # ifndef DISABLE_OCSP
1502 && opt_unset_or_noexpand(tls_ocsp_file)
1504 && opt_unset_or_noexpand(tls_privatekey))
1506 /* Set watches on the filenames. The implementation does de-duplication
1507 so we can just blindly do them all.
1510 if ( tls_set_watch(tls_certificate, TRUE)
1511 # ifndef DISABLE_OCSP
1512 && tls_set_watch(tls_ocsp_file, TRUE)
1514 && tls_set_watch(tls_privatekey, TRUE))
1516 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1517 if (creds_load_server_certs(&state_server, tls_certificate,
1518 tls_privatekey && *tls_privatekey ? tls_privatekey : tls_certificate,
1519 # ifdef DISABLE_OCSP
1524 &dummy_errstr) == 0)
1525 state_server.lib_state.conn_certs = TRUE;
1528 else if ( !tls_certificate && !tls_privatekey
1529 # ifndef DISABLE_OCSP
1533 { /* Generate & preload a selfsigned cert. No files to watch. */
1534 if ((tls_install_selfsign(&state_server, &dummy_errstr)) == OK)
1536 state_server.lib_state.conn_certs = TRUE;
1537 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1541 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1543 /* If tls_verify_certificates is non-empty and has no $, load CAs.
1544 If none was configured and we can't handle "system", treat as empty. */
1546 if ( opt_set_and_noexpand(tls_verify_certificates)
1547 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1548 && Ustrcmp(tls_verify_certificates, "system") != 0
1552 if (tls_set_watch(tls_verify_certificates, FALSE))
1554 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1555 if (creds_load_cabundle(&state_server, tls_verify_certificates,
1556 NULL, &dummy_errstr) != OK)
1558 state_server.lib_state.cabundle = TRUE;
1560 /* If CAs loaded and tls_crl is non-empty and has no $, load it */
1562 if (opt_set_and_noexpand(tls_crl))
1564 if (tls_set_watch(tls_crl, FALSE))
1566 DEBUG(D_tls) debug_printf("TLS: preloading CRL for server\n");
1567 if (creds_load_crl(&state_server, tls_crl, &dummy_errstr) != OK)
1569 state_server.lib_state.crl = TRUE;
1573 DEBUG(D_tls) debug_printf("TLS: not preloading CRL for server\n");
1577 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1578 #endif /* EXIM_HAVE_INOTIFY */
1580 /* If tls_require_ciphers is non-empty and has no $, load the
1581 ciphers priority cache. If unset, load with the default.
1582 (server-only as the client one depends on non/DANE) */
1584 if (!tls_require_ciphers || opt_set_and_noexpand(tls_require_ciphers))
1586 const char * dummy_errpos;
1587 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server: %s\n",
1588 tls_require_ciphers);
1589 if ( creds_load_pristring(&state_server, tls_require_ciphers, &dummy_errpos)
1591 state_server.lib_state.pri_string = TRUE;
1594 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1599 /* Preload whatever creds are static, onto a transport. The client can then
1600 just copy the pointer as it starts up. */
1603 tls_client_creds_init(transport_instance * t, BOOL watch)
1605 smtp_transport_options_block * ob = t->options_block;
1606 exim_gnutls_state_st tpt_dummy_state;
1607 host_item * dummy_host = (host_item *)1;
1608 uschar * dummy_errstr;
1610 if ( !exim_gnutls_base_init_done
1611 && tls_g_init(&dummy_errstr) != OK)
1614 ob->tls_preload = null_tls_preload;
1615 if (gnutls_certificate_allocate_credentials(
1616 (struct gnutls_certificate_credentials_st **)&ob->tls_preload.x509_cred))
1618 ob->tls_preload.x509_cred = NULL;
1621 creds_basic_init(ob->tls_preload.x509_cred, FALSE);
1623 tpt_dummy_state.session = NULL;
1624 tpt_dummy_state.lib_state = ob->tls_preload;
1626 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1627 if ( opt_set_and_noexpand(ob->tls_certificate)
1628 && opt_unset_or_noexpand(ob->tls_privatekey))
1631 || ( tls_set_watch(ob->tls_certificate, FALSE)
1632 && tls_set_watch(ob->tls_privatekey, FALSE)
1635 const uschar * pkey = ob->tls_privatekey;
1638 debug_printf("TLS: preloading client certs for transport '%s'\n", t->name);
1640 /* The state->lib_state.x509_cred is used for the certs load, and is the sole
1641 structure element used. So we can set up a dummy. The hoat arg only
1642 selects a retcode in case of fail, so any value */
1644 if (creds_load_client_certs(&tpt_dummy_state, dummy_host,
1645 ob->tls_certificate, pkey ? pkey : ob->tls_certificate,
1646 &dummy_errstr) == OK)
1647 ob->tls_preload.conn_certs = TRUE;
1652 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1654 /* If tls_verify_certificates is non-empty and has no $, load CAs.
1655 If none was configured and we can't handle "system", treat as empty. */
1657 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1658 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1659 && Ustrcmp(ob->tls_verify_certificates, "system") != 0
1663 if (!watch || tls_set_watch(ob->tls_verify_certificates, FALSE))
1666 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1667 if (creds_load_cabundle(&tpt_dummy_state, ob->tls_verify_certificates,
1668 dummy_host, &dummy_errstr) != OK)
1670 ob->tls_preload.cabundle = TRUE;
1672 if (opt_set_and_noexpand(ob->tls_crl))
1674 if (!watch || tls_set_watch(ob->tls_crl, FALSE))
1676 DEBUG(D_tls) debug_printf("TLS: preloading CRL for transport '%s'\n", t->name);
1677 if (creds_load_crl(&tpt_dummy_state, ob->tls_crl, &dummy_errstr) != OK)
1679 ob->tls_preload.crl = TRUE;
1683 DEBUG(D_tls) debug_printf("TLS: not preloading CRL, for transport '%s'\n", t->name);
1688 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1690 /* We do not preload tls_require_ciphers to to the transport as it implicitly
1691 depends on DANE or plain usage. */
1697 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1698 /* Invalidate the creds cached, by dropping the current ones.
1699 Call when we notice one of the source files has changed. */
1702 tls_server_creds_invalidate(void)
1704 if (state_server.lib_state.pri_cache)
1705 gnutls_priority_deinit(state_server.lib_state.pri_cache);
1706 state_server.lib_state.pri_cache = NULL;
1708 if (state_server.lib_state.x509_cred)
1709 gnutls_certificate_free_credentials(state_server.lib_state.x509_cred);
1710 state_server.lib_state = null_tls_preload;
1715 tls_client_creds_invalidate(transport_instance * t)
1717 smtp_transport_options_block * ob = t->options_block;
1718 if (ob->tls_preload.x509_cred)
1719 gnutls_certificate_free_credentials(ob->tls_preload.x509_cred);
1720 ob->tls_preload = null_tls_preload;
1725 /*************************************************
1726 * Variables re-expanded post-SNI *
1727 *************************************************/
1729 /* Called from both server and client code, via tls_init(), and also from
1730 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1732 We can tell the two apart by state->received_sni being non-NULL in callback.
1734 The callback should not call us unless state->trigger_sni_changes is true,
1735 which we are responsible for setting on the first pass through.
1738 state exim_gnutls_state_st *
1739 errstr error string pointer
1741 Returns: OK/DEFER/FAIL
1745 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1748 const host_item *host = state->host; /* macro should be reconsidered? */
1749 const uschar *saved_tls_certificate = NULL;
1750 const uschar *saved_tls_privatekey = NULL;
1751 const uschar *saved_tls_verify_certificates = NULL;
1752 const uschar *saved_tls_crl = NULL;
1755 /* We check for tls_sni *before* expansion. */
1756 if (!host) /* server */
1757 if (!state->received_sni)
1759 if ( state->tls_certificate
1760 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1761 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1762 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1765 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI\n");
1766 state->trigger_sni_changes = TRUE;
1769 else /* SNI callback case */
1771 /* useful for debugging */
1772 saved_tls_certificate = state->exp_tls_certificate;
1773 saved_tls_privatekey = state->exp_tls_privatekey;
1774 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1775 saved_tls_crl = state->exp_tls_crl;
1778 if (!state->lib_state.x509_cred)
1780 if ((rc = gnutls_certificate_allocate_credentials(
1781 (gnutls_certificate_credentials_t *) &state->lib_state.x509_cred)))
1782 return tls_error_gnu(state, US"gnutls_certificate_allocate_credentials",
1784 creds_basic_init(state->lib_state.x509_cred, !host);
1788 /* remember: Expand_check_tlsvar() is expand_check() but fiddling with
1789 state members, assuming consistent naming; and expand_check() returns
1790 false if expansion failed, unless expansion was forced to fail. */
1792 /* check if we at least have a certificate, before doing expensive
1795 if (!state->lib_state.conn_certs)
1797 if (!Expand_check_tlsvar(tls_certificate, errstr))
1800 /* certificate is mandatory in server, optional in client */
1802 if ( !state->exp_tls_certificate
1803 || !*state->exp_tls_certificate
1806 return tls_install_selfsign(state, errstr);
1808 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1810 if (state->tls_privatekey && !Expand_check_tlsvar(tls_privatekey, errstr))
1813 /* tls_privatekey is optional, defaulting to same file as certificate */
1815 if (!state->tls_privatekey || !*state->tls_privatekey)
1817 state->tls_privatekey = state->tls_certificate;
1818 state->exp_tls_privatekey = state->exp_tls_certificate;
1821 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1824 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1825 state->exp_tls_certificate, state->exp_tls_privatekey);
1827 if (state->received_sni)
1828 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1829 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1832 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1833 load = FALSE; /* avoid re-loading the same certs */
1835 else /* unload the pre-SNI certs before loading new ones */
1837 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair\n");
1838 gnutls_certificate_free_keys(state->lib_state.x509_cred);
1843 ? creds_load_client_certs(state, host, state->exp_tls_certificate,
1844 state->exp_tls_privatekey, errstr)
1845 : creds_load_server_certs(state, state->exp_tls_certificate,
1846 state->exp_tls_privatekey,
1859 debug_printf("%s certs were preloaded\n", host ? "client" : "server");
1861 if (!state->tls_privatekey) state->tls_privatekey = state->tls_certificate;
1862 state->exp_tls_certificate = US state->tls_certificate;
1863 state->exp_tls_privatekey = US state->tls_privatekey;
1865 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1866 if (state->lib_state.ocsp_hook)
1867 gnutls_handshake_set_hook_function(state->session,
1868 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1873 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1874 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1875 error message is provided. However, if we just refrain from setting anything up
1876 in that case, certificate verification fails, which seems to be the correct
1878 If none was configured and we can't handle "system", treat as empty. */
1880 if (!state->lib_state.cabundle)
1882 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1884 if (!Expand_check_tlsvar(tls_verify_certificates, errstr))
1886 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1887 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1888 state->exp_tls_verify_certificates = NULL;
1890 if (state->tls_crl && *state->tls_crl)
1891 if (!Expand_check_tlsvar(tls_crl, errstr))
1894 if (!(state->exp_tls_verify_certificates &&
1895 *state->exp_tls_verify_certificates))
1898 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1899 /* With no tls_verify_certificates, we ignore tls_crl too */
1906 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1909 rc = creds_load_cabundle(state, state->exp_tls_verify_certificates, host, errstr);
1910 if (rc != OK) return rc;
1915 debug_printf("%s CA bundle was preloaded\n", host ? "client" : "server");
1916 state->exp_tls_verify_certificates = US state->tls_verify_certificates;
1918 #ifdef SUPPORT_CA_DIR
1919 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1920 when using the directory-of-certs config model. */
1921 if (state->lib_state.ca_rdn_emulate)
1922 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1927 if (!state->lib_state.crl)
1929 if ( state->tls_crl && *state->tls_crl
1930 && state->exp_tls_crl && *state->exp_tls_crl)
1931 return creds_load_crl(state, state->exp_tls_crl, errstr);
1936 debug_printf("%s CRL was preloaded\n", host ? "client" : "server");
1937 state->exp_tls_crl = US state->tls_crl;
1946 /*************************************************
1947 * Set X.509 state variables *
1948 *************************************************/
1950 /* In GnuTLS, the registered cert/key are not replaced by a later
1951 set of a cert/key, so for SNI support we need a whole new x509_cred
1952 structure. Which means various other non-re-expanded pieces of state
1953 need to be re-set in the new struct, so the setting logic is pulled
1957 state exim_gnutls_state_st *
1958 errstr error string pointer
1960 Returns: OK/DEFER/FAIL
1964 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1967 const host_item *host = state->host; /* macro should be reconsidered? */
1969 /* Create D-H parameters, or read them from the cache file. This function does
1970 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1971 client-side params. */
1975 if (!dh_server_params)
1976 if ((rc = init_server_dh(errstr)) != OK) return rc;
1978 /* Unnecessary & discouraged with 3.6.0 or later, according to docs. But without it,
1979 no DHE- ciphers are advertised. */
1980 gnutls_certificate_set_dh_params(state->lib_state.x509_cred, dh_server_params);
1983 /* Link the credentials to the session. */
1985 if ((rc = gnutls_credentials_set(state->session,
1986 GNUTLS_CRD_CERTIFICATE, state->lib_state.x509_cred)))
1987 return tls_error_gnu(state, US"gnutls_credentials_set", rc, errstr);
1992 /*************************************************
1993 * Initialize for GnuTLS *
1994 *************************************************/
1997 /* Called from both server and client code. In the case of a server, errors
1998 before actual TLS negotiation return DEFER.
2001 host connected host, if client; NULL if server
2002 ob tranport options block, if client; NULL if server
2003 require_ciphers tls_require_ciphers setting
2004 caller_state returned state-info structure
2005 errstr error string pointer
2007 Returns: OK/DEFER/FAIL
2012 const host_item *host,
2013 smtp_transport_options_block * ob,
2014 const uschar * require_ciphers,
2015 exim_gnutls_state_st **caller_state,
2019 exim_gnutls_state_st * state;
2023 if ( !exim_gnutls_base_init_done
2024 && (rc = tls_g_init(errstr)) != OK)
2029 /* For client-side sessions we allocate a context. This lets us run
2030 several in parallel. */
2032 int old_pool = store_pool;
2033 store_pool = POOL_PERM;
2034 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
2035 store_pool = old_pool;
2037 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2038 state->lib_state = ob->tls_preload;
2040 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
2041 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
2043 state->tls_certificate = ob->tls_certificate;
2044 state->tls_privatekey = ob->tls_privatekey;
2045 state->tls_sni = ob->tls_sni;
2046 state->tls_verify_certificates = ob->tls_verify_certificates;
2047 state->tls_crl = ob->tls_crl;
2051 /* Server operations always use the one state_server context. It is not
2052 shared because we have forked a fresh process for every receive. However it
2053 can get re-used for successive TLS sessions on a single TCP connection. */
2055 state = &state_server;
2057 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
2058 rc = gnutls_init(&state->session, GNUTLS_SERVER);
2060 state->tls_certificate = tls_certificate;
2061 state->tls_privatekey = tls_privatekey;
2062 state->tls_sni = NULL;
2063 state->tls_verify_certificates = tls_verify_certificates;
2064 state->tls_crl = tls_crl;
2067 return tls_error_gnu(state, US"gnutls_init", rc, errstr);
2069 state->tls_require_ciphers = require_ciphers;
2072 /* This handles the variables that might get re-expanded after TLS SNI;
2073 tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
2076 debug_printf("Expanding various TLS configuration options for session credentials\n");
2077 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
2079 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
2080 requires a new structure afterwards. */
2082 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
2084 /* set SNI in client, only */
2087 if (!expand_check(state->tls_sni, US"tls_out_sni", &state->tlsp->sni, errstr))
2089 if (state->tlsp->sni && *state->tlsp->sni)
2092 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
2093 sz = Ustrlen(state->tlsp->sni);
2094 if ((rc = gnutls_server_name_set(state->session,
2095 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
2096 return tls_error_gnu(state, US"gnutls_server_name_set", rc, errstr);
2099 else if (state->tls_sni)
2100 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
2101 "have an SNI set for a server [%s]\n", state->tls_sni);
2103 if (!state->lib_state.pri_string)
2105 const uschar * p = NULL;
2106 const char * errpos;
2108 /* This is the priority string support,
2109 http://www.gnutls.org/manual/html_node/Priority-Strings.html
2110 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
2111 This was backwards incompatible, but means Exim no longer needs to track
2112 all algorithms and provide string forms for them. */
2114 if (state->tls_require_ciphers && *state->tls_require_ciphers)
2116 if (!Expand_check_tlsvar(tls_require_ciphers, errstr))
2118 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
2120 p = state->exp_tls_require_ciphers;
2121 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
2125 if ((rc = creds_load_pristring(state, p, &errpos)))
2126 return tls_error_gnu(state, string_sprintf(
2127 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
2128 p, (long)(errpos - CS p), errpos),
2133 DEBUG(D_tls) debug_printf("cipher list preloaded\n");
2134 state->exp_tls_require_ciphers = US state->tls_require_ciphers;
2138 if ((rc = gnutls_priority_set(state->session, state->lib_state.pri_cache)))
2139 return tls_error_gnu(state, US"gnutls_priority_set", rc, errstr);
2141 /* This also sets the server ticket expiration time to the same, and
2142 the STEK rotation time to 3x. */
2144 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
2146 /* Reduce security in favour of increased compatibility, if the admin
2147 decides to make that trade-off. */
2148 if (gnutls_compat_mode)
2150 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
2151 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
2152 gnutls_session_enable_compatibility_mode(state->session);
2154 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
2158 *caller_state = state;
2164 /*************************************************
2165 * Extract peer information *
2166 *************************************************/
2168 static const uschar *
2169 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
2170 gnutls_mac_algorithm_t mac)
2173 gnutls_kx_algorithm_t kx_i;
2174 gnutls_cipher_algorithm_t cipher_i;
2175 gnutls_mac_algorithm_t mac_i;
2178 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
2180 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
2181 return cipher_stdname(cs_id[0], cs_id[1]);
2187 /* Called from both server and client code.
2188 Only this is allowed to set state->peerdn and state->have_set_peerdn
2189 and we use that to detect double-calls.
2191 NOTE: the state blocks last while the TLS connection is up, which is fine
2192 for logging in the server side, but for the client side, we log after teardown
2193 in src/deliver.c. While the session is up, we can twist about states and
2194 repoint tls_* globals, but those variables used for logging or other variable
2195 expansion that happens _after_ delivery need to have a longer life-time.
2197 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
2198 doing this more than once per generation of a state context. We set them in
2199 the state context, and repoint tls_* to them. After the state goes away, the
2200 tls_* copies of the pointers remain valid and client delivery logging is happy.
2202 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
2206 state exim_gnutls_state_st *
2207 errstr pointer to error string
2209 Returns: OK/DEFER/FAIL
2213 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
2215 gnutls_session_t session = state->session;
2216 const gnutls_datum_t * cert_list;
2218 unsigned int cert_list_size = 0;
2219 gnutls_protocol_t protocol;
2220 gnutls_cipher_algorithm_t cipher;
2221 gnutls_kx_algorithm_t kx;
2222 gnutls_mac_algorithm_t mac;
2223 gnutls_certificate_type_t ct;
2224 gnutls_x509_crt_t crt;
2228 if (state->have_set_peerdn)
2230 state->have_set_peerdn = TRUE;
2232 state->peerdn = NULL;
2235 cipher = gnutls_cipher_get(session);
2236 protocol = gnutls_protocol_get_version(session);
2237 mac = gnutls_mac_get(session);
2239 #ifdef GNUTLS_TLS1_3
2240 protocol >= GNUTLS_TLS1_3 ? 0 :
2242 gnutls_kx_get(session);
2244 old_pool = store_pool;
2246 tls_support * tlsp = state->tlsp;
2247 store_pool = POOL_PERM;
2249 #ifdef SUPPORT_GNUTLS_SESS_DESC
2252 uschar * s = US gnutls_session_get_desc(session), c;
2254 /* Nikos M suggests we use this by preference. It returns like:
2255 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
2257 For partial back-compat, put a colon after the TLS version, replace the
2258 )-( grouping with __, replace in-group - with _ and append the :keysize. */
2260 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
2262 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
2264 tlsp->ver = string_copyn(g->s, g->ptr);
2265 for (uschar * p = US tlsp->ver; *p; p++)
2266 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
2268 g = string_catn(g, US":", 1);
2269 if (*s) s++; /* now on _ between groups */
2272 for (*++s && ++s; (c = *s) && c != ')'; s++)
2273 g = string_catn(g, c == '-' ? US"_" : s, 1);
2274 /* now on ) closing group */
2275 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
2276 /* now on _ between groups */
2278 g = string_catn(g, US":", 1);
2279 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
2280 state->ciphersuite = string_from_gstring(g);
2283 state->ciphersuite = string_sprintf("%s:%s:%d",
2284 gnutls_protocol_get_name(protocol),
2285 gnutls_cipher_suite_get_name(kx, cipher, mac),
2286 (int) gnutls_cipher_get_key_size(cipher) * 8);
2288 /* I don't see a way that spaces could occur, in the current GnuTLS
2289 code base, but it was a concern in the old code and perhaps older GnuTLS
2290 releases did return "TLS 1.0"; play it safe, just in case. */
2292 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
2293 tlsp->ver = string_copyn(state->ciphersuite,
2294 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
2297 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
2299 tlsp->cipher = state->ciphersuite;
2300 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
2302 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
2304 store_pool = old_pool;
2307 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
2309 if (!cert_list || cert_list_size == 0)
2311 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
2312 cert_list, cert_list_size);
2313 if (state->verify_requirement >= VERIFY_REQUIRED)
2314 return tls_error(US"certificate verification failed",
2315 US"no certificate received from peer", state->host, errstr);
2319 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
2321 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
2323 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
2324 if (state->verify_requirement >= VERIFY_REQUIRED)
2325 return tls_error(US"certificate verification not possible, unhandled type",
2326 ctn, state->host, errstr);
2330 #define exim_gnutls_peer_err(Label) \
2332 if (rc != GNUTLS_E_SUCCESS) \
2334 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
2335 (Label), gnutls_strerror(rc)); \
2336 if (state->verify_requirement >= VERIFY_REQUIRED) \
2337 return tls_error_gnu(state, (Label), rc, errstr); \
2342 rc = import_cert(&cert_list[0], &crt);
2343 exim_gnutls_peer_err(US"cert 0");
2345 state->tlsp->peercert = state->peercert = crt;
2348 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
2349 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
2351 exim_gnutls_peer_err(US"getting size for cert DN failed");
2352 return FAIL; /* should not happen */
2354 dn_buf = store_get_perm(sz, TRUE); /* tainted */
2355 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
2356 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
2358 state->peerdn = dn_buf;
2361 #undef exim_gnutls_peer_err
2367 /*************************************************
2368 * Verify peer certificate *
2369 *************************************************/
2371 /* Called from both server and client code.
2372 *Should* be using a callback registered with
2373 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
2374 the peer information, but that's too new for some OSes.
2377 state exim_gnutls_state_st *
2378 errstr where to put an error message
2381 FALSE if the session should be rejected
2382 TRUE if the cert is okay or we just don't care
2386 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
2391 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
2393 rc = peer_status(state, errstr);
2395 if (state->verify_requirement == VERIFY_NONE)
2398 if (rc != OK || !state->peerdn)
2400 verify = GNUTLS_CERT_INVALID;
2401 *errstr = US"certificate not supplied";
2407 if (state->verify_requirement == VERIFY_DANE && state->host)
2409 /* Using dane_verify_session_crt() would be easy, as it does it all for us
2410 including talking to a DNS resolver. But we want to do that bit ourselves
2411 as the testsuite intercepts and fakes its own DNS environment. */
2416 const gnutls_datum_t * certlist =
2417 gnutls_certificate_get_peers(state->session, &lsize);
2418 int usage = tls_out.tlsa_usage;
2420 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2421 /* Split the TLSA records into two sets, TA and EE selectors. Run the
2422 dane-verification separately so that we know which selector verified;
2423 then we know whether to do name-verification (needed for TA but not EE). */
2425 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
2426 { /* a mixed-usage bundle */
2431 for (nrec = 0; state->dane_data_len[nrec]; ) nrec++;
2434 dd = store_get(nrec * sizeof(uschar *), FALSE);
2435 ddl = store_get(nrec * sizeof(int), FALSE);
2438 if ((rc = dane_state_init(&s, 0)))
2441 for (usage = DANESSL_USAGE_DANE_EE;
2442 usage >= DANESSL_USAGE_DANE_TA; usage--)
2443 { /* take records with this usage */
2444 for (j = i = 0; i < nrec; i++)
2445 if (state->dane_data[i][0] == usage)
2447 dd[j] = state->dane_data[i];
2448 ddl[j++] = state->dane_data_len[i];
2455 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
2458 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
2459 gnutls_certificate_type_get(state->session),
2461 usage == DANESSL_USAGE_DANE_EE
2462 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2466 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
2468 else if (verify == 0) /* verification passed */
2476 if (rc) goto tlsa_prob;
2481 if ( (rc = dane_state_init(&s, 0))
2482 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
2484 || (rc = dane_verify_crt_raw(s, certlist, lsize,
2485 gnutls_certificate_type_get(state->session),
2487 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2488 usage == (1 << DANESSL_USAGE_DANE_EE)
2489 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2498 if (verify != 0) /* verification failed */
2501 (void) dane_verification_status_print(verify, &str, 0);
2502 *errstr = US str.data; /* don't bother to free */
2506 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2507 /* If a TA-mode TLSA record was used for verification we must additionally
2508 verify the cert name (but not the CA chain). For EE-mode, skip it. */
2510 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2513 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2516 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2517 /* Assume that the name on the A-record is the one that should be matching
2518 the cert. An alternate view is that the domain part of the email address
2519 is also permissible. */
2521 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2522 CS state->host->name))
2524 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2529 #endif /*SUPPORT_DANE*/
2531 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2534 /* Handle the result of verification. INVALID is set if any others are. */
2536 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2538 state->peer_cert_verified = FALSE;
2541 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2546 if (gnutls_certificate_verification_status_print(verify,
2547 gnutls_certificate_type_get(state->session), &txt, 0)
2548 == GNUTLS_E_SUCCESS)
2550 debug_printf("%s\n", txt.data);
2551 gnutls_free(txt.data);
2555 *errstr = verify & GNUTLS_CERT_REVOKED
2556 ? US"certificate revoked" : US"certificate invalid";
2560 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2561 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2563 if (state->verify_requirement >= VERIFY_REQUIRED)
2566 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2571 /* Client side, check the server's certificate name versus the name on the
2572 A-record for the connection we made. What to do for server side - what name
2573 to use for client? We document that there is no such checking for server
2576 if ( state->exp_tls_verify_cert_hostnames
2577 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2578 CS state->exp_tls_verify_cert_hostnames)
2582 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2583 if (state->verify_requirement >= VERIFY_REQUIRED)
2588 state->peer_cert_verified = TRUE;
2589 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2590 state->peerdn ? state->peerdn : US"<unset>");
2594 state->tlsp->peerdn = state->peerdn;
2599 *errstr = string_sprintf("TLSA record problem: %s",
2600 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2604 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2611 /* ------------------------------------------------------------------------ */
2614 /* Logging function which can be registered with
2615 * gnutls_global_set_log_function()
2616 * gnutls_global_set_log_level() 0..9
2618 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2620 exim_gnutls_logger_cb(int level, const char *message)
2622 size_t len = strlen(message);
2625 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2628 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2629 message[len-1] == '\n' ? "" : "\n");
2634 /* Called after client hello, should handle SNI work.
2635 This will always set tls_sni (state->received_sni) if available,
2636 and may trigger presenting different certificates,
2637 if state->trigger_sni_changes is TRUE.
2639 Should be registered with
2640 gnutls_handshake_set_post_client_hello_function()
2642 "This callback must return 0 on success or a gnutls error code to terminate the
2645 For inability to get SNI information, we return 0.
2646 We only return non-zero if re-setup failed.
2647 Only used for server-side TLS.
2651 exim_sni_handling_cb(gnutls_session_t session)
2653 char sni_name[MAX_HOST_LEN];
2654 size_t data_len = MAX_HOST_LEN;
2655 exim_gnutls_state_st *state = &state_server;
2656 unsigned int sni_type;
2658 uschar * dummy_errstr;
2660 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2661 if (rc != GNUTLS_E_SUCCESS)
2664 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2665 debug_printf("TLS: no SNI presented in handshake\n");
2667 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2668 gnutls_strerror(rc), rc);
2672 if (sni_type != GNUTLS_NAME_DNS)
2674 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2678 /* We now have a UTF-8 string in sni_name */
2679 old_pool = store_pool;
2680 store_pool = POOL_PERM;
2681 state->received_sni = string_copy_taint(US sni_name, TRUE);
2682 store_pool = old_pool;
2684 /* We set this one now so that variable expansions below will work */
2685 state->tlsp->sni = state->received_sni;
2687 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2688 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2690 if (!state->trigger_sni_changes)
2693 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2695 /* If the setup of certs/etc failed before handshake, TLS would not have
2696 been offered. The best we can do now is abort. */
2697 return GNUTLS_E_APPLICATION_ERROR_MIN;
2700 rc = tls_set_remaining_x509(state, &dummy_errstr);
2701 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2708 #ifndef DISABLE_EVENT
2710 We use this callback to get observability and detail-level control
2711 for an exim TLS connection (either direction), raising a tls:cert event
2712 for each cert in the chain presented by the peer. Any event
2713 can deny verification.
2715 Return 0 for the handshake to continue or non-zero to terminate.
2719 verify_cb(gnutls_session_t session)
2721 const gnutls_datum_t * cert_list;
2722 unsigned int cert_list_size = 0;
2723 gnutls_x509_crt_t crt;
2726 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2728 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2729 while (cert_list_size--)
2731 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2733 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2734 cert_list_size, gnutls_strerror(rc));
2738 state->tlsp->peercert = crt;
2739 if ((yield = event_raise(state->event_action,
2740 US"tls:cert", string_sprintf("%d", cert_list_size), &errno)))
2742 log_write(0, LOG_MAIN,
2743 "SSL verify denied by event-action: depth=%d: %s",
2744 cert_list_size, yield);
2745 return 1; /* reject */
2747 state->tlsp->peercert = NULL;
2757 ddump(gnutls_datum_t * d)
2759 gstring * g = string_get((d->size+1) * 2);
2760 uschar * s = d->data;
2761 for (unsigned i = d->size; i > 0; i--, s++)
2763 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2764 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2770 post_handshake_debug(exim_gnutls_state_st * state)
2772 #ifdef SUPPORT_GNUTLS_SESS_DESC
2773 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2776 #ifdef SUPPORT_GNUTLS_KEYLOG
2777 # ifdef EXIM_HAVE_TLS1_3
2778 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2783 gnutls_datum_t c, s;
2785 /* For TLS1.2 we only want the client random and the master secret */
2786 gnutls_session_get_random(state->session, &c, &s);
2787 gnutls_session_get_master_secret(state->session, &s);
2790 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2793 debug_printf("To get keying info for TLS1.3 is hard:\n"
2794 " Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,\n"
2795 " and make sure it is writable by the Exim runtime user.\n"
2796 " Add SSLKEYLOGFILE to keep_environment in the exim config.\n"
2797 " Start Exim as root.\n"
2798 " If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2799 " (works for TLS1.2 also, and saves cut-paste into file).\n"
2800 " Trying to use add_environment for this will not work\n");
2805 #ifdef EXIM_HAVE_TLS_RESUME
2807 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2808 unsigned incoming, const gnutls_datum_t * msg)
2810 DEBUG(D_tls) debug_printf("newticket cb\n");
2811 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2816 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2818 /* Should the server offer session resumption? */
2819 tls_in.resumption = RESUME_SUPPORTED;
2820 if (verify_check_host(&tls_resumption_hosts) == OK)
2823 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2824 an offered resumption is unacceptable. We lose one resumption per ticket
2825 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2826 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2827 least they go out in a single packet. */
2829 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2830 &server_sessticket_key)))
2831 tls_in.resumption |= RESUME_SERVER_TICKET;
2834 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2836 /* Try to tell if we see a ticket request */
2837 gnutls_handshake_set_hook_function(state->session,
2838 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2843 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2845 if (gnutls_session_resumption_requested(state->session))
2847 /* This tells us the client sent a full ticket. We use a
2848 callback on session-ticket request, elsewhere, to tell
2849 if a client asked for a ticket. */
2851 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2852 DEBUG(D_tls) debug_printf("client requested resumption\n");
2854 if (gnutls_session_is_resumed(state->session))
2856 tls_in.resumption |= RESUME_USED;
2857 DEBUG(D_tls) debug_printf("Session resumed\n");
2860 #endif /* EXIM_HAVE_TLS_RESUME */
2863 #ifdef EXIM_HAVE_ALPN
2864 /* Expand and convert an Exim list to a gnutls_datum list. False return for fail.
2865 NULL plist return for silent no-ALPN.
2869 tls_alpn_plist(const uschar * tls_alpn, const gnutls_datum_t ** plist, unsigned * plen,
2874 if (!expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr))
2879 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
2884 const uschar * list = exp_alpn;
2890 while (string_nextinlist(&list, &sep, NULL, 0)) cnt++;
2892 p = store_get(sizeof(gnutls_datum_t) * cnt, is_tainted(exp_alpn));
2894 for (int i = 0; s = string_nextinlist(&list, &sep, NULL, 0); i++)
2895 { p[i].data = s; p[i].size = Ustrlen(s); }
2896 *plist = (*plen = cnt) ? p : NULL;
2902 tls_server_set_acceptable_alpns(exim_gnutls_state_st * state, uschar ** errstr)
2905 const gnutls_datum_t * plist;
2908 if (tls_alpn_plist(tls_alpn, &plist, &plen, errstr) && plist)
2910 /* This seems to be only mandatory if the client sends an ALPN extension;
2911 not trying ALPN is ok. Need to decide how to support server-side must-alpn. */
2913 server_seen_alpn = 0;
2914 if (!(rc = gnutls_alpn_set_protocols(state->session, plist, plen,
2915 GNUTLS_ALPN_MANDATORY)))
2916 gnutls_handshake_set_hook_function(state->session,
2917 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2920 debug_printf("setting alpn protocols: %s\n", US gnutls_strerror(rc));
2923 #endif /* EXIM_HAVE_ALPN */
2925 /* ------------------------------------------------------------------------ */
2926 /* Exported functions */
2931 /*************************************************
2932 * Start a TLS session in a server *
2933 *************************************************/
2935 /* This is called when Exim is running as a server, after having received
2936 the STARTTLS command. It must respond to that command, and then negotiate
2940 errstr pointer to error string
2942 Returns: OK on success
2943 DEFER for errors before the start of the negotiation
2944 FAIL for errors during the negotiation; the server can't
2949 tls_server_start(uschar ** errstr)
2952 exim_gnutls_state_st * state = NULL;
2954 /* Check for previous activation */
2955 if (tls_in.active.sock >= 0)
2957 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2958 smtp_printf("554 Already in TLS\r\n", FALSE);
2962 /* Initialize the library. If it fails, it will already have logged the error
2963 and sent an SMTP response. */
2965 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2968 #ifdef MEASURE_TIMING
2970 gettimeofday(&t0, NULL);
2973 if ((rc = tls_init(NULL, NULL,
2974 tls_require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2976 #ifdef MEASURE_TIMING
2977 report_time_since(&t0, US"server tls_init (delta)");
2981 #ifdef EXIM_HAVE_ALPN
2982 tls_server_set_acceptable_alpns(state, errstr);
2985 #ifdef EXIM_HAVE_TLS_RESUME
2986 tls_server_resume_prehandshake(state);
2989 /* If this is a host for which certificate verification is mandatory or
2990 optional, set up appropriately. */
2992 if (verify_check_host(&tls_verify_hosts) == OK)
2995 debug_printf("TLS: a client certificate will be required\n");
2996 state->verify_requirement = VERIFY_REQUIRED;
2997 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2999 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3002 debug_printf("TLS: a client certificate will be requested but not required\n");
3003 state->verify_requirement = VERIFY_OPTIONAL;
3004 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
3009 debug_printf("TLS: a client certificate will not be requested\n");
3010 state->verify_requirement = VERIFY_NONE;
3011 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3014 #ifndef DISABLE_EVENT
3017 state->event_action = event_action;
3018 gnutls_session_set_ptr(state->session, state);
3019 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3023 /* Register SNI handling; always, even if not in tls_certificate, so that the
3024 expansion variable $tls_sni is always available. */
3026 gnutls_handshake_set_post_client_hello_function(state->session,
3027 exim_sni_handling_cb);
3029 /* Set context and tell client to go ahead, except in the case of TLS startup
3030 on connection, where outputting anything now upsets the clients and tends to
3031 make them disconnect. We need to have an explicit fflush() here, to force out
3032 the response. Other smtp_printf() calls do not need it, because in non-TLS
3033 mode, the fflush() happens when smtp_getc() is called. */
3035 if (!state->tlsp->on_connect)
3037 smtp_printf("220 TLS go ahead\r\n", FALSE);
3041 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3042 that the GnuTLS library doesn't.
3043 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
3044 to set (and clear down afterwards) up a pull-timeout callback function that does
3045 a select, so we're no better off unless avoiding signals becomes an issue. */
3047 gnutls_transport_set_ptr2(state->session,
3048 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
3049 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
3050 state->fd_in = fileno(smtp_in);
3051 state->fd_out = fileno(smtp_out);
3053 sigalrm_seen = FALSE;
3054 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3056 rc = gnutls_handshake(state->session);
3057 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3060 if (rc != GNUTLS_E_SUCCESS)
3062 DEBUG(D_tls) debug_printf(" error %d from gnutls_handshake: %s\n",
3063 rc, gnutls_strerror(rc));
3065 /* It seems that, except in the case of a timeout, we have to close the
3066 connection right here; otherwise if the other end is running OpenSSL it hangs
3067 until the server times out. */
3071 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
3072 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3073 gnutls_db_remove_session(state->session);
3077 tls_error_gnu(state, US"gnutls_handshake", rc, errstr);
3078 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3079 (void) gnutls_alert_send_appropriate(state->session, rc);
3080 gnutls_deinit(state->session);
3081 gnutls_certificate_free_credentials(state->lib_state.x509_cred);
3082 state->lib_state = null_tls_preload;
3084 shutdown(state->fd_out, SHUT_WR);
3085 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
3086 (void)fclose(smtp_out);
3087 (void)fclose(smtp_in);
3088 smtp_out = smtp_in = NULL;
3094 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3095 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3096 tls_in.ext_master_secret = TRUE;
3099 #ifdef EXIM_HAVE_TLS_RESUME
3100 tls_server_resume_posthandshake(state);
3103 DEBUG(D_tls) post_handshake_debug(state);
3105 #ifdef EXIM_HAVE_ALPN
3106 if (server_seen_alpn > 0)
3109 { /* The client offered ALPN. See what was negotiated. */
3110 gnutls_datum_t p = {.size = 0};
3111 int rc = gnutls_alpn_get_selected_protocol(state->session, &p);
3113 debug_printf("ALPN negotiated: %.*s\n", (int)p.size, p.data);
3115 debug_printf("getting alpn protocol: %s\n", US gnutls_strerror(rc));
3119 else if (server_seen_alpn == 0)
3120 if (verify_check_host(&hosts_require_alpn) == OK)
3122 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_NO_APPLICATION_PROTOCOL);
3123 tls_error(US"handshake", US"ALPN required but not negotiated", NULL, errstr);
3127 DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n");
3129 DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n");
3132 /* Verify after the fact */
3134 if (!verify_certificate(state, errstr))
3136 if (state->verify_requirement != VERIFY_OPTIONAL)
3138 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
3142 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
3146 /* Sets various Exim expansion variables; always safe within server */
3148 extract_exim_vars_from_tls_state(state);
3150 /* TLS has been set up. Adjust the input functions to read via TLS,
3151 and initialize appropriately. */
3153 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3155 receive_getc = tls_getc;
3156 receive_getbuf = tls_getbuf;
3157 receive_get_cache = tls_get_cache;
3158 receive_hasc = tls_hasc;
3159 receive_ungetc = tls_ungetc;
3160 receive_feof = tls_feof;
3161 receive_ferror = tls_ferror;
3170 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
3171 smtp_transport_options_block * ob)
3173 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3175 state->exp_tls_verify_cert_hostnames =
3177 string_domain_utf8_to_alabel(host->certname, NULL);
3182 debug_printf("TLS: server cert verification includes hostname: \"%s\"\n",
3183 state->exp_tls_verify_cert_hostnames);
3191 /* Given our list of RRs from the TLSA lookup, build a lookup block in
3192 GnuTLS-DANE's preferred format. Hang it on the state str for later
3193 use in DANE verification.
3195 We point at the dnsa data not copy it, so it must remain valid until
3196 after verification is done.*/
3199 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
3203 const char ** dane_data;
3204 int * dane_data_len;
3207 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3208 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3209 ) if (rr->type == T_TLSA) i++;
3211 dane_data = store_get(i * sizeof(uschar *), FALSE);
3212 dane_data_len = store_get(i * sizeof(int), FALSE);
3215 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3216 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3217 ) if (rr->type == T_TLSA && rr->size > 3)
3219 const uschar * p = rr->data;
3220 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
3221 uint8_t usage = p[0], sel = p[1], type = p[2];
3224 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
3226 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
3227 || (sel != 0 && sel != 1)
3232 case 0: /* Full: cannot check at present */
3234 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
3236 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
3241 tls_out.tlsa_usage |= 1<<usage;
3242 dane_data[i] = CS p;
3243 dane_data_len[i++] = rr->size;
3246 if (!i) return FALSE;
3248 dane_data[i] = NULL;
3249 dane_data_len[i] = 0;
3251 state->dane_data = (char * const *)dane_data;
3252 state->dane_data_len = dane_data_len;
3259 #ifdef EXIM_HAVE_TLS_RESUME
3260 /* On the client, get any stashed session for the given IP from hints db
3261 and apply it to the ssl-connection for attempted resumption. Although
3262 there is a gnutls_session_ticket_enable_client() interface it is
3263 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
3264 by deafult". There seems to be no way to disable them, so even hosts not
3265 enabled by the transport option will be sent a ticket request. We will
3266 however avoid storing and retrieving session information. */
3269 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
3270 host_item * host, smtp_transport_options_block * ob)
3272 tlsp->resumption = RESUME_SUPPORTED;
3273 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3275 dbdata_tls_session * dt;
3277 open_db dbblock, * dbm_file;
3280 debug_printf("check for resumable session for %s\n", host->address);
3281 tlsp->host_resumable = TRUE;
3282 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3283 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
3285 /* Key for the db is the IP. We'd like to filter the retrieved session
3286 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
3288 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
3289 if (!(rc = gnutls_session_set_data(session,
3290 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
3292 DEBUG(D_tls) debug_printf("good session\n");
3293 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3295 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
3296 US gnutls_strerror(rc));
3297 dbfn_close(dbm_file);
3304 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
3306 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
3307 but this flag is not set until the second. TLS 1.3 it's the other way about.
3308 Keep both calls as the session data cannot be extracted before handshake
3311 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
3316 DEBUG(D_tls) debug_printf("server offered session ticket\n");
3317 tlsp->ticket_received = TRUE;
3318 tlsp->resumption |= RESUME_SERVER_TICKET;
3320 if (tlsp->host_resumable)
3321 if (!(rc = gnutls_session_get_data2(session, &tkt)))
3323 open_db dbblock, * dbm_file;
3324 int dlen = sizeof(dbdata_tls_session) + tkt.size;
3325 dbdata_tls_session * dt = store_get(dlen, TRUE);
3327 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
3328 memcpy(dt->session, tkt.data, tkt.size);
3329 gnutls_free(tkt.data);
3331 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3333 /* key for the db is the IP */
3334 dbfn_delete(dbm_file, host->address);
3335 dbfn_write(dbm_file, host->address, dt, dlen);
3336 dbfn_close(dbm_file);
3339 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
3343 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
3348 /* With a TLS1.3 session, the ticket(s) are not seen until
3349 the first data read is attempted. And there's often two of them.
3350 Pick them up with this callback. We are also called for 1.2
3354 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
3355 unsigned incoming, const gnutls_datum_t * msg)
3357 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
3358 tls_support * tlsp = state->tlsp;
3360 DEBUG(D_tls) debug_printf("newticket cb\n");
3362 if (!tlsp->ticket_received)
3363 tls_save_session(tlsp, sess, state->host);
3369 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
3370 tls_support * tlsp, host_item * host,
3371 smtp_transport_options_block * ob)
3373 gnutls_session_set_ptr(state->session, state);
3374 gnutls_handshake_set_hook_function(state->session,
3375 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
3377 tls_retrieve_session(tlsp, state->session, host, ob);
3381 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
3382 tls_support * tlsp, host_item * host)
3384 if (gnutls_session_is_resumed(state->session))
3386 DEBUG(D_tls) debug_printf("Session resumed\n");
3387 tlsp->resumption |= RESUME_USED;
3390 tls_save_session(tlsp, state->session, host);
3392 #endif /* !DISABLE_TLS_RESUME */
3395 /*************************************************
3396 * Start a TLS session in a client *
3397 *************************************************/
3399 /* Called from the smtp transport after STARTTLS has been accepted.
3402 cctx connection context
3403 conn_args connection details
3404 cookie datum for randomness (not used)
3405 tlsp record details of channel configuration here; must be non-NULL
3406 errstr error string pointer
3408 Returns: TRUE for success with TLS session context set in smtp context,
3413 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3414 void * cookie ARG_UNUSED,
3415 tls_support * tlsp, uschar ** errstr)
3417 host_item * host = conn_args->host; /* for msgs and option-tests */
3418 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3419 smtp_transport_options_block * ob = tb
3420 ? (smtp_transport_options_block *)tb->options_block
3421 : &smtp_transport_option_defaults;
3423 exim_gnutls_state_st * state = NULL;
3424 uschar * cipher_list = NULL;
3426 #ifndef DISABLE_OCSP
3428 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3429 BOOL request_ocsp = require_ocsp ? TRUE
3430 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3433 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
3436 /* If dane is flagged, have either request or require dane for this host, and
3437 a TLSA record found. Therefore, dane verify required. Which implies cert must
3438 be requested and supplied, dane verify must pass, and cert verify irrelevant
3439 (incl. hostnames), and (caller handled) require_tls and sni=$domain */
3441 if (conn_args->dane && ob->dane_require_tls_ciphers)
3443 /* not using Expand_check_tlsvar because not yet in state */
3444 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3445 &cipher_list, errstr))
3447 cipher_list = cipher_list && *cipher_list
3448 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
3453 cipher_list = ob->tls_require_ciphers;
3456 #ifdef MEASURE_TIMING
3458 gettimeofday(&t0, NULL);
3461 if (tls_init(host, ob, cipher_list, &state, tlsp, errstr) != OK)
3464 #ifdef MEASURE_TIMING
3465 report_time_since(&t0, US"client tls_init (delta)");
3470 #ifdef EXIM_HAVE_ALPN
3472 const gnutls_datum_t * plist;
3475 if (!tls_alpn_plist(ob->tls_alpn, &plist, &plen, errstr))
3478 if (gnutls_alpn_set_protocols(state->session, plist, plen, 0) != 0)
3480 tls_error(US"alpn init", NULL, state->host, errstr);
3484 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
3487 log_write(0, LOG_MAIN, "ALPN unusable with this GnuTLS library version; ignoring \"%s\"\n",
3492 int dh_min_bits = ob->tls_dh_min_bits;
3493 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
3496 debug_printf("WARNING: tls_dh_min_bits far too low,"
3497 " clamping %d up to %d\n",
3498 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
3499 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
3502 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
3503 " acceptable bits to %d\n",
3505 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
3508 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
3509 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
3510 the specified host patterns if one of them is defined */
3513 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
3516 debug_printf("TLS: server certificate DANE required\n");
3517 state->verify_requirement = VERIFY_DANE;
3518 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3522 if ( ( state->exp_tls_verify_certificates
3523 && !ob->tls_verify_hosts
3524 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
3526 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3529 tls_client_setup_hostname_checks(host, state, ob);
3531 debug_printf("TLS: server certificate verification required\n");
3532 state->verify_requirement = VERIFY_REQUIRED;
3533 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3535 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3537 tls_client_setup_hostname_checks(host, state, ob);
3539 debug_printf("TLS: server certificate verification optional\n");
3540 state->verify_requirement = VERIFY_OPTIONAL;
3541 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
3546 debug_printf("TLS: server certificate verification not required\n");
3547 state->verify_requirement = VERIFY_NONE;
3548 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3551 #ifndef DISABLE_OCSP
3552 /* supported since GnuTLS 3.1.3 */
3555 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
3556 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
3557 NULL, 0, NULL)) != OK)
3559 tls_error_gnu(state, US"cert-status-req", rc, errstr);
3562 tlsp->ocsp = OCSP_NOT_RESP;
3566 #ifdef EXIM_HAVE_TLS_RESUME
3567 tls_client_resume_prehandshake(state, tlsp, host, ob);
3570 #ifndef DISABLE_EVENT
3571 if (tb && tb->event_action)
3573 state->event_action = tb->event_action;
3574 gnutls_session_set_ptr(state->session, state);
3575 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3579 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
3580 state->fd_in = cctx->sock;
3581 state->fd_out = cctx->sock;
3583 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
3584 /* There doesn't seem to be a built-in timeout on connection. */
3586 sigalrm_seen = FALSE;
3587 ALARM(ob->command_timeout);
3589 rc = gnutls_handshake(state->session);
3590 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3593 if (rc != GNUTLS_E_SUCCESS)
3597 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
3598 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
3601 tls_error_gnu(state, US"gnutls_handshake", rc, errstr);
3605 DEBUG(D_tls) post_handshake_debug(state);
3609 if (!verify_certificate(state, errstr))
3611 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
3615 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3616 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3617 tlsp->ext_master_secret = TRUE;
3620 #ifndef DISABLE_OCSP
3625 gnutls_datum_t stapling;
3626 gnutls_ocsp_resp_t resp;
3627 gnutls_datum_t printed;
3631 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
3632 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
3634 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
3637 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
3638 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
3639 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
3642 debug_printf("%.4096s", printed.data);
3643 gnutls_free(printed.data);
3646 (void) tls_error_gnu(state, US"ocsp decode", rc, errstr);
3648 (void) tls_error_gnu(state, US"ocsp decode", rc, errstr);
3651 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3653 tlsp->ocsp = OCSP_FAILED;
3654 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3660 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3661 tlsp->ocsp = OCSP_VFIED;
3666 #ifdef EXIM_HAVE_TLS_RESUME
3667 tls_client_resume_posthandshake(state, tlsp, host);
3670 #ifdef EXIM_HAVE_ALPN
3671 if (ob->tls_alpn) /* We requested. See what was negotiated. */
3673 gnutls_datum_t p = {.size = 0};
3675 if (gnutls_alpn_get_selected_protocol(state->session, &p) == 0)
3676 { DEBUG(D_tls) debug_printf("ALPN negotiated: '%.*s'\n", (int)p.size, p.data); }
3677 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
3679 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_NO_APPLICATION_PROTOCOL);
3680 tls_error(US"handshake", US"ALPN required but not negotiated", state->host, errstr);
3684 DEBUG(D_tls) debug_printf("No ALPN negotiated");
3688 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3690 extract_exim_vars_from_tls_state(state);
3692 cctx->tls_ctx = state;
3701 ct_ctx client TLS context pointer, or NULL for the one global server context
3705 tls_shutdown_wr(void * ct_ctx)
3707 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3708 tls_support * tlsp = state->tlsp;
3710 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3712 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3714 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
3715 gnutls_bye(state->session, GNUTLS_SHUT_WR);
3718 /*************************************************
3719 * Close down a TLS session *
3720 *************************************************/
3722 /* This is also called from within a delivery subprocess forked from the
3723 daemon, to shut down the TLS library, without actually doing a shutdown (which
3724 would tamper with the TLS session in the parent process).
3727 ct_ctx client context pointer, or NULL for the one global server context
3728 do_shutdown 0 no data-flush or TLS close-alert
3729 1 if TLS close-alert is to be sent,
3730 2 if also response to be waited for (2s timeout)
3736 tls_close(void * ct_ctx, int do_shutdown)
3738 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3739 tls_support * tlsp = state->tlsp;
3741 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3745 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3746 do_shutdown > 1 ? " (with response-wait)" : "");
3748 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3750 #ifdef EXIM_TCP_CORK
3751 if (do_shutdown > 1)
3752 (void) setsockopt(tlsp->active.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
3756 gnutls_bye(state->session, do_shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3760 if (!ct_ctx) /* server */
3762 receive_getc = smtp_getc;
3763 receive_getbuf = smtp_getbuf;
3764 receive_get_cache = smtp_get_cache;
3765 receive_hasc = smtp_hasc;
3766 receive_ungetc = smtp_ungetc;
3767 receive_feof = smtp_feof;
3768 receive_ferror = smtp_ferror;
3771 gnutls_deinit(state->session);
3772 gnutls_certificate_free_credentials(state->lib_state.x509_cred);
3773 state->lib_state = null_tls_preload;
3775 tlsp->active.sock = -1;
3776 tlsp->active.tls_ctx = NULL;
3777 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3778 tlsp->channelbinding = NULL;
3781 if (state->xfer_buffer) store_free(state->xfer_buffer);
3788 tls_refill(unsigned lim)
3790 exim_gnutls_state_st * state = &state_server;
3793 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, buffersize=%u)\n",
3794 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3796 sigalrm_seen = FALSE;
3797 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3801 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3802 MIN(ssl_xfer_buffer_size, lim));
3803 while (inbytes == GNUTLS_E_AGAIN);
3805 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3807 if (had_command_timeout) /* set by signal handler */
3808 smtp_command_timeout_exit(); /* does not return */
3809 if (had_command_sigterm)
3810 smtp_command_sigterm_exit();
3811 if (had_data_timeout)
3812 smtp_data_timeout_exit();
3813 if (had_data_sigint)
3814 smtp_data_sigint_exit();
3816 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3817 TLS session has been closed down, not that the socket itself has been closed
3818 down. Revert to non-TLS handling. */
3822 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3823 state->xfer_error = TRUE;
3827 else if (inbytes == 0)
3829 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3830 tls_close(NULL, TLS_NO_SHUTDOWN);
3834 /* Handle genuine errors */
3836 else if (inbytes < 0)
3838 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3839 record_io_error(state, (int) inbytes, US"recv", NULL);
3840 state->xfer_error = TRUE;
3843 #ifndef DISABLE_DKIM
3844 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3846 state->xfer_buffer_hwm = (int) inbytes;
3847 state->xfer_buffer_lwm = 0;
3851 /*************************************************
3852 * TLS version of getc *
3853 *************************************************/
3855 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3856 it refills the buffer via the GnuTLS reading function.
3857 Only used by the server-side TLS.
3859 This feeds DKIM and should be used for all message-body reads.
3861 Arguments: lim Maximum amount to read/buffer
3862 Returns: the next character or EOF
3866 tls_getc(unsigned lim)
3868 exim_gnutls_state_st * state = &state_server;
3870 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3871 if (!tls_refill(lim))
3872 return state->xfer_error ? EOF : smtp_getc(lim);
3874 /* Something in the buffer; return next uschar */
3876 return state->xfer_buffer[state->xfer_buffer_lwm++];
3882 exim_gnutls_state_st * state = &state_server;
3883 return state->xfer_buffer_lwm < state->xfer_buffer_hwm;
3887 tls_getbuf(unsigned * len)
3889 exim_gnutls_state_st * state = &state_server;
3893 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3894 if (!tls_refill(*len))
3896 if (!state->xfer_error) return smtp_getbuf(len);
3901 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3903 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3904 state->xfer_buffer_lwm += size;
3910 /* Get up to the given number of bytes from any cached data, and feed to dkim. */
3912 tls_get_cache(unsigned lim)
3914 #ifndef DISABLE_DKIM
3915 exim_gnutls_state_st * state = &state_server;
3916 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3920 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3926 tls_could_getc(void)
3928 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3929 || gnutls_record_check_pending(state_server.session) > 0;
3933 /*************************************************
3934 * Read bytes from TLS channel *
3935 *************************************************/
3937 /* This does not feed DKIM, so if the caller uses this for reading message body,
3938 then the caller must feed DKIM.
3941 ct_ctx client context pointer, or NULL for the one global server context
3945 Returns: the number of bytes read
3946 -1 after a failed read, including EOF
3950 tls_read(void * ct_ctx, uschar *buff, size_t len)
3952 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3958 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3960 debug_printf("*** PROBABLY A BUG *** " \
3961 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3962 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3965 debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, len=" SIZE_T_FMT ")\n",
3966 state->session, buff, len);
3970 inbytes = gnutls_record_recv(state->session, buff, len);
3971 while (inbytes == GNUTLS_E_AGAIN);
3973 if (inbytes > 0) return inbytes;
3976 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3980 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3981 record_io_error(state, (int)inbytes, US"recv", NULL);
3990 /*************************************************
3991 * Write bytes down TLS channel *
3992 *************************************************/
3996 ct_ctx client context pointer, or NULL for the one global server context
3999 more more data expected soon
4001 Calling with len zero and more unset will flush buffered writes. The buff
4002 argument can be null for that case.
4004 Returns: the number of bytes after a successful write,
4005 -1 after a failed write
4009 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4013 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
4016 if (more && !state->corked)
4018 DEBUG(D_tls) debug_printf("gnutls_record_cork(session=%p)\n", state->session);
4019 gnutls_record_cork(state->session);
4020 state->corked = TRUE;
4024 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
4025 buff, left, more ? ", more" : "");
4029 DEBUG(D_tls) debug_printf("gnutls_record_send(session=%p, buffer=%p, left=" SIZE_T_FMT ")\n",
4030 state->session, buff, left);
4034 outbytes = gnutls_record_send(state->session, buff, left);
4035 while (outbytes == GNUTLS_E_AGAIN);
4037 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
4041 #ifdef GNUTLS_E_PREMATURE_TERMINATION
4042 if ( outbytes == GNUTLS_E_PREMATURE_TERMINATION && errno == ECONNRESET
4043 && !ct_ctx && f.smtp_in_quit
4045 { /* Outlook, dammit */
4046 if (LOGGING(protocol_detail))
4047 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4048 " SMTP response and TLS close\n", sender_host_address);
4050 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4051 " client reset TCP before TLS close\n", sender_host_address);
4056 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
4057 record_io_error(state, outbytes, US"send", NULL);
4063 record_io_error(state, 0, US"send", US"TLS channel closed on write");
4074 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
4080 if (!more && state->corked)
4082 DEBUG(D_tls) debug_printf("gnutls_record_uncork(session=%p)\n", state->session);
4084 /* We can't use GNUTLS_RECORD_WAIT here, as it retries on
4085 GNUTLS_E_AGAIN || GNUTLS_E_INTR, which would break our timeout set by alarm().
4086 The GNUTLS_E_AGAIN should not happen ever, as our sockets are blocking anyway.
4087 But who knows. (That all relies on the fact that GNUTLS_E_INTR and GNUTLS_E_AGAIN
4088 match the EINTR and EAGAIN errno values.) */
4089 outbytes = gnutls_record_uncork(state->session, 0);
4090 while (outbytes == GNUTLS_E_AGAIN);
4094 record_io_error(state, len, US"uncork", NULL);
4098 state->corked = FALSE;
4108 /*************************************************
4109 * Random number generation *
4110 *************************************************/
4112 /* Pseudo-random number generation. The result is not expected to be
4113 cryptographically strong but not so weak that someone will shoot themselves
4114 in the foot using it as a nonce in input in some email header scheme or
4115 whatever weirdness they'll twist this into. The result should handle fork()
4116 and avoid repeating sequences. OpenSSL handles that for us.
4120 Returns a random number in range [0, max-1]
4123 #ifdef HAVE_GNUTLS_RND
4125 vaguely_random_number(int max)
4129 uschar smallbuf[sizeof(r)];
4134 needed_len = sizeof(r);
4135 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4136 asked for a number less than 10. */
4138 for (r = max, i = 0; r; ++i)
4144 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
4147 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback\n");
4148 return vaguely_random_number_fallback(max);
4151 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4154 /* We don't particularly care about weighted results; if someone wants
4155 * smooth distribution and cares enough then they should submit a patch then. */
4158 #else /* HAVE_GNUTLS_RND */
4160 vaguely_random_number(int max)
4162 return vaguely_random_number_fallback(max);
4164 #endif /* HAVE_GNUTLS_RND */
4169 /*************************************************
4170 * Let tls_require_ciphers be checked at startup *
4171 *************************************************/
4173 /* The tls_require_ciphers option, if set, must be something which the
4176 Returns: NULL on success, or error message
4180 tls_validate_require_cipher(void)
4183 uschar *expciphers = NULL;
4184 gnutls_priority_t priority_cache;
4186 uschar * dummy_errstr;
4188 #ifdef GNUTLS_AUTO_GLOBAL_INIT
4189 # define validate_check_rc(Label) do { \
4190 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \
4191 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4192 # define return_deinit(Label) do { return (Label); } while (0)
4194 # define validate_check_rc(Label) do { \
4195 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
4196 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4197 # define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
4200 if (exim_gnutls_base_init_done)
4201 log_write(0, LOG_MAIN|LOG_PANIC,
4202 "already initialised GnuTLS, Exim developer bug");
4204 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
4205 if (!gnutls_allow_auto_pkcs11)
4207 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
4208 validate_check_rc(US"gnutls_pkcs11_init");
4211 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4212 rc = gnutls_global_init();
4213 validate_check_rc(US"gnutls_global_init()");
4215 exim_gnutls_base_init_done = TRUE;
4217 if (!(tls_require_ciphers && *tls_require_ciphers))
4218 return_deinit(NULL);
4220 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4222 return_deinit(US"failed to expand tls_require_ciphers");
4224 if (!(expciphers && *expciphers))
4225 return_deinit(NULL);
4228 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4230 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
4231 validate_check_rc(string_sprintf(
4232 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
4233 expciphers, (long)(errpos - CS expciphers), errpos));
4235 #undef return_deinit
4236 #undef validate_check_rc
4237 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4238 gnutls_global_deinit();
4247 /*************************************************
4248 * Report the library versions. *
4249 *************************************************/
4251 /* See a description in tls-openssl.c for an explanation of why this exists.
4253 Arguments: string to append to
4258 tls_version_report(gstring * g)
4260 return string_fmt_append(g,
4261 "Library version: GnuTLS: Compile: %s\n"
4264 gnutls_check_version(NULL));
4267 #endif /*!MACRO_PREDEF*/
4270 /* End of tls-gnu.c */