1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2017 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42 /* needed to disable PKCS11 autoload unless requested */
43 #if GNUTLS_VERSION_NUMBER >= 0x020c00
44 # include <gnutls/pkcs11.h>
45 # define SUPPORT_PARAM_TO_PK_BITS
47 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
48 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
51 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
52 # warning "GnuTLS library version too old; tls:cert event unsupported"
53 # define DISABLE_EVENT
55 #if GNUTLS_VERSION_NUMBER >= 0x030306
56 # define SUPPORT_CA_DIR
58 # undef SUPPORT_CA_DIR
60 #if GNUTLS_VERSION_NUMBER >= 0x030014
61 # define SUPPORT_SYSDEFAULT_CABUNDLE
63 #if GNUTLS_VERSION_NUMBER >= 0x030109
68 # include <gnutls/ocsp.h>
74 gnutls_global_set_audit_log_function()
77 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
80 /* Local static variables for GnuTLS */
82 /* Values for verify_requirement */
84 enum peer_verify_requirement
85 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
87 /* This holds most state for server or client; with this, we can set up an
88 outbound TLS-enabled connection in an ACL callout, while not stomping all
89 over the TLS variables available for expansion.
91 Some of these correspond to variables in globals.c; those variables will
92 be set to point to content in one of these instances, as appropriate for
93 the stage of the process lifetime.
95 Not handled here: global tls_channelbinding_b64.
98 typedef struct exim_gnutls_state {
99 gnutls_session_t session;
100 gnutls_certificate_credentials_t x509_cred;
101 gnutls_priority_t priority_cache;
102 enum peer_verify_requirement verify_requirement;
105 BOOL peer_cert_verified;
106 BOOL trigger_sni_changes;
107 BOOL have_set_peerdn;
108 const struct host_item *host;
109 gnutls_x509_crt_t peercert;
112 uschar *received_sni;
114 const uschar *tls_certificate;
115 const uschar *tls_privatekey;
116 const uschar *tls_sni; /* client send only, not received */
117 const uschar *tls_verify_certificates;
118 const uschar *tls_crl;
119 const uschar *tls_require_ciphers;
121 uschar *exp_tls_certificate;
122 uschar *exp_tls_privatekey;
123 uschar *exp_tls_verify_certificates;
125 uschar *exp_tls_require_ciphers;
126 uschar *exp_tls_ocsp_file;
127 const uschar *exp_tls_verify_cert_hostnames;
128 #ifndef DISABLE_EVENT
129 uschar *event_action;
132 tls_support *tlsp; /* set in tls_init() */
139 } exim_gnutls_state_st;
141 static const exim_gnutls_state_st exim_gnutls_state_init = {
144 .priority_cache = NULL,
145 .verify_requirement = VERIFY_NONE,
148 .peer_cert_verified = FALSE,
149 .trigger_sni_changes =FALSE,
150 .have_set_peerdn = FALSE,
155 .received_sni = NULL,
157 .tls_certificate = NULL,
158 .tls_privatekey = NULL,
160 .tls_verify_certificates = NULL,
162 .tls_require_ciphers =NULL,
164 .exp_tls_certificate = NULL,
165 .exp_tls_privatekey = NULL,
166 .exp_tls_verify_certificates = NULL,
168 .exp_tls_require_ciphers = NULL,
169 .exp_tls_ocsp_file = NULL,
170 .exp_tls_verify_cert_hostnames = NULL,
171 #ifndef DISABLE_EVENT
172 .event_action = NULL,
177 .xfer_buffer_lwm = 0,
178 .xfer_buffer_hwm = 0,
183 /* Not only do we have our own APIs which don't pass around state, assuming
184 it's held in globals, GnuTLS doesn't appear to let us register callback data
185 for callbacks, or as part of the session, so we have to keep a "this is the
186 context we're currently dealing with" pointer and rely upon being
187 single-threaded to keep from processing data on an inbound TLS connection while
188 talking to another TLS connection for an outbound check. This does mean that
189 there's no way for heart-beats to be responded to, for the duration of the
191 XXX But see gnutls_session_get_ptr()
194 static exim_gnutls_state_st state_server, state_client;
196 /* dh_params are initialised once within the lifetime of a process using TLS;
197 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
198 don't want to repeat this. */
200 static gnutls_dh_params_t dh_server_params = NULL;
202 /* No idea how this value was chosen; preserving it. Default is 3600. */
204 static const int ssl_session_timeout = 200;
206 static const char * const exim_default_gnutls_priority = "NORMAL";
208 /* Guard library core initialisation */
210 static BOOL exim_gnutls_base_init_done = FALSE;
213 static BOOL gnutls_buggy_ocsp = FALSE;
217 /* ------------------------------------------------------------------------ */
220 #define MAX_HOST_LEN 255
222 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
223 the library logging; a value less than 0 disables the calls to set up logging
225 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
226 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
229 #ifndef EXIM_CLIENT_DH_MIN_BITS
230 # define EXIM_CLIENT_DH_MIN_BITS 1024
233 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
234 can ask for a bit-strength. Without that, we stick to the constant we had
236 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
237 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
240 #define exim_gnutls_err_check(Label) do { \
241 if (rc != GNUTLS_E_SUCCESS) \
242 return tls_error((Label), gnutls_strerror(rc), host, errstr); \
245 #define expand_check_tlsvar(Varname, errstr) \
246 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
248 #if GNUTLS_VERSION_NUMBER >= 0x020c00
249 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
250 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
251 # define HAVE_GNUTLS_RND
252 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
253 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
254 * isn't available sometimes, so this needs to become a conditional
255 * compilation; the sanest way to deal with this being a problem on
256 * older OSes is to block it in the Local/Makefile with this compiler
258 # ifndef AVOID_GNUTLS_PKCS11
259 # define HAVE_GNUTLS_PKCS11
260 # endif /* AVOID_GNUTLS_PKCS11 */
266 /* ------------------------------------------------------------------------ */
267 /* Callback declarations */
269 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
270 static void exim_gnutls_logger_cb(int level, const char *message);
273 static int exim_sni_handling_cb(gnutls_session_t session);
276 static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
277 gnutls_datum_t * ocsp_response);
282 /* ------------------------------------------------------------------------ */
283 /* Static functions */
285 /*************************************************
287 *************************************************/
289 /* Called from lots of places when errors occur before actually starting to do
290 the TLS handshake, that is, while the session is still in clear. Always returns
291 DEFER for a server and FAIL for a client so that most calls can use "return
292 tls_error(...)" to do this processing and then give an appropriate return. A
293 single function is used for both server and client, because it is called from
294 some shared functions.
297 prefix text to include in the logged error
298 msg additional error string (may be NULL)
299 usually obtained from gnutls_strerror()
300 host NULL if setting up a server;
301 the connected host if setting up a client
302 errstr pointer to returned error string
304 Returns: OK/DEFER/FAIL
308 tls_error(const uschar *prefix, const char *msg, const host_item *host,
312 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : "");
313 return host ? FAIL : DEFER;
319 /*************************************************
320 * Deal with logging errors during I/O *
321 *************************************************/
323 /* We have to get the identity of the peer from saved data.
326 state the current GnuTLS exim state container
327 rc the GnuTLS error code, or 0 if it's a local error
328 when text identifying read or write
329 text local error text when ec is 0
335 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
340 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
341 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
342 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
344 msg = gnutls_strerror(rc);
346 (void) tls_error(when, msg, state->host, &errstr);
349 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
350 state->host->name, state->host->address, errstr);
353 uschar * conn_info = smtp_get_connection_info();
354 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
355 /* I'd like to get separated H= here, but too hard for now */
356 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
363 /*************************************************
364 * Set various Exim expansion vars *
365 *************************************************/
367 #define exim_gnutls_cert_err(Label) \
370 if (rc != GNUTLS_E_SUCCESS) \
372 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
373 (Label), gnutls_strerror(rc)); \
379 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
383 rc = gnutls_x509_crt_init(crtp);
384 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
386 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
387 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
392 #undef exim_gnutls_cert_err
395 /* We set various Exim global variables from the state, once a session has
396 been established. With TLS callouts, may need to change this to stack
397 variables, or just re-call it with the server state after client callout
400 Make sure anything set here is unset in tls_getc().
404 tls_bits strength indicator
405 tls_certificate_verified bool indicator
406 tls_channelbinding_b64 for some SASL mechanisms
408 tls_peercert pointer to library internal
410 tls_sni a (UTF-8) string
411 tls_ourcert pointer to library internal
414 state the relevant exim_gnutls_state_st *
418 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
420 gnutls_cipher_algorithm_t cipher;
421 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
424 gnutls_datum_t channel;
426 tls_support * tlsp = state->tlsp;
428 tlsp->active = state->fd_out;
430 cipher = gnutls_cipher_get(state->session);
431 /* returns size in "bytes" */
432 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
434 tlsp->cipher = state->ciphersuite;
436 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
438 tlsp->certificate_verified = state->peer_cert_verified;
440 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
441 only available for use for authenticators while this TLS session is running. */
443 tls_channelbinding_b64 = NULL;
444 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
447 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
449 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
451 old_pool = store_pool;
452 store_pool = POOL_PERM;
453 tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
454 store_pool = old_pool;
455 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
459 /* peercert is set in peer_status() */
460 tlsp->peerdn = state->peerdn;
461 tlsp->sni = state->received_sni;
463 /* record our certificate */
465 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
466 gnutls_x509_crt_t crt;
468 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
475 /*************************************************
476 * Setup up DH parameters *
477 *************************************************/
479 /* Generating the D-H parameters may take a long time. They only need to
480 be re-generated every so often, depending on security policy. What we do is to
481 keep these parameters in a file in the spool directory. If the file does not
482 exist, we generate them. This means that it is easy to cause a regeneration.
484 The new file is written as a temporary file and renamed, so that an incomplete
485 file is never present. If two processes both compute some new parameters, you
486 waste a bit of effort, but it doesn't seem worth messing around with locking to
489 Returns: OK/DEFER/FAIL
493 init_server_dh(uschar ** errstr)
496 unsigned int dh_bits;
498 uschar filename_buf[PATH_MAX];
499 uschar *filename = NULL;
501 uschar *exp_tls_dhparam;
502 BOOL use_file_in_spool = FALSE;
503 BOOL use_fixed_file = FALSE;
504 host_item *host = NULL; /* dummy for macros */
506 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
508 rc = gnutls_dh_params_init(&dh_server_params);
509 exim_gnutls_err_check(US"gnutls_dh_params_init");
514 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
517 if (!exp_tls_dhparam)
519 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
520 m.data = US std_dh_prime_default();
521 m.size = Ustrlen(m.data);
523 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
524 use_file_in_spool = TRUE;
525 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
527 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
530 else if (exp_tls_dhparam[0] != '/')
532 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
533 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL, errstr);
534 m.size = Ustrlen(m.data);
538 use_fixed_file = TRUE;
539 filename = exp_tls_dhparam;
544 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
545 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
546 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
550 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
551 /* If you change this constant, also change dh_param_fn_ext so that we can use a
552 different filename and ensure we have sufficient bits. */
553 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
555 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
557 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
560 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
562 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
566 /* Some clients have hard-coded limits. */
567 if (dh_bits > tls_dh_max_bits)
570 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
572 dh_bits = tls_dh_max_bits;
575 if (use_file_in_spool)
577 if (!string_format(filename_buf, sizeof(filename_buf),
578 "%s/gnutls-params-%d", spool_directory, dh_bits))
579 return tls_error(US"overlong filename", NULL, NULL, errstr);
580 filename = filename_buf;
583 /* Open the cache file for reading and if successful, read it and set up the
586 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
592 if (fstat(fd, &statbuf) < 0) /* EIO */
596 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL, errstr);
598 if (!S_ISREG(statbuf.st_mode))
601 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
603 if (!(fp = fdopen(fd, "rb")))
607 return tls_error(US"fdopen(TLS cache stat fd) failed",
608 strerror(saved_errno), NULL, errstr);
611 m.size = statbuf.st_size;
612 if (!(m.data = malloc(m.size)))
615 return tls_error(US"malloc failed", strerror(errno), NULL, errstr);
617 if (!(sz = fread(m.data, m.size, 1, fp)))
622 return tls_error(US"fread failed", strerror(saved_errno), NULL, errstr);
626 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
628 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
629 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
632 /* If the file does not exist, fall through to compute new data and cache it.
633 If there was any other opening error, it is serious. */
635 else if (errno == ENOENT)
639 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
642 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
645 /* If ret < 0, either the cache file does not exist, or the data it contains
646 is not useful. One particular case of this is when upgrading from an older
647 release of Exim in which the data was stored in a different format. We don't
648 try to be clever and support both formats; we just regenerate new data in this
654 unsigned int dh_bits_gen = dh_bits;
656 if ((PATH_MAX - Ustrlen(filename)) < 10)
657 return tls_error(US"Filename too long to generate replacement",
658 CS filename, NULL, errstr);
660 temp_fn = string_copy(US "%s.XXXXXXX");
661 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
662 return tls_error(US"Unable to open temp file", strerror(errno), NULL, errstr);
663 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
665 /* GnuTLS overshoots!
666 * If we ask for 2236, we might get 2237 or more.
667 * But there's no way to ask GnuTLS how many bits there really are.
668 * We can ask how many bits were used in a TLS session, but that's it!
669 * The prime itself is hidden behind too much abstraction.
670 * So we ask for less, and proceed on a wing and a prayer.
671 * First attempt, subtracted 3 for 2233 and got 2240.
673 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
675 dh_bits_gen = dh_bits - 10;
677 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
682 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
684 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
685 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
687 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
688 and I confirmed that a NULL call to get the size first is how the GnuTLS
689 sample apps handle this. */
693 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
695 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
696 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
698 if (!(m.data = malloc(m.size)))
699 return tls_error(US"memory allocation failed", strerror(errno), NULL, errstr);
701 /* this will return a size 1 less than the allocation size above */
702 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
704 if (rc != GNUTLS_E_SUCCESS)
707 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
709 m.size = sz; /* shrink by 1, probably */
711 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
714 return tls_error(US"TLS cache write D-H params failed",
715 strerror(errno), NULL, errstr);
718 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
719 return tls_error(US"TLS cache write D-H params final newline failed",
720 strerror(errno), NULL, errstr);
722 if ((rc = close(fd)))
723 return tls_error(US"TLS cache write close() failed", strerror(errno), NULL, errstr);
725 if (Urename(temp_fn, filename) < 0)
726 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
727 temp_fn, filename), strerror(errno), NULL, errstr);
729 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
732 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
739 /* Create and install a selfsigned certificate, for use in server mode */
742 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
744 gnutls_x509_crt_t cert = NULL;
746 gnutls_x509_privkey_t pkey = NULL;
747 const uschar * where;
750 where = US"initialising pkey";
751 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
753 where = US"initialising cert";
754 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
756 where = US"generating pkey";
757 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
758 #ifdef SUPPORT_PARAM_TO_PK_BITS
759 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_LOW),
766 where = US"configuring cert";
768 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
769 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
770 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
771 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
772 || (rc = gnutls_x509_crt_set_key(cert, pkey))
774 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
775 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
776 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
777 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
778 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
779 GNUTLS_OID_X520_COMMON_NAME, 0,
780 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
784 where = US"signing cert";
785 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
787 where = US"installing selfsign cert";
789 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
795 if (cert) gnutls_x509_crt_deinit(cert);
796 if (pkey) gnutls_x509_privkey_deinit(pkey);
800 rc = tls_error(where, gnutls_strerror(rc), NULL, errstr);
808 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
809 uschar * certfile, uschar * keyfile, uschar ** errstr)
811 int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
812 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
813 exim_gnutls_err_check(
814 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile));
819 /*************************************************
820 * Variables re-expanded post-SNI *
821 *************************************************/
823 /* Called from both server and client code, via tls_init(), and also from
824 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
826 We can tell the two apart by state->received_sni being non-NULL in callback.
828 The callback should not call us unless state->trigger_sni_changes is true,
829 which we are responsible for setting on the first pass through.
832 state exim_gnutls_state_st *
833 errstr error string pointer
835 Returns: OK/DEFER/FAIL
839 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
843 const host_item *host = state->host; /* macro should be reconsidered? */
844 uschar *saved_tls_certificate = NULL;
845 uschar *saved_tls_privatekey = NULL;
846 uschar *saved_tls_verify_certificates = NULL;
847 uschar *saved_tls_crl = NULL;
850 /* We check for tls_sni *before* expansion. */
851 if (!host) /* server */
852 if (!state->received_sni)
854 if ( state->tls_certificate
855 && ( Ustrstr(state->tls_certificate, US"tls_sni")
856 || Ustrstr(state->tls_certificate, US"tls_in_sni")
857 || Ustrstr(state->tls_certificate, US"tls_out_sni")
860 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
861 state->trigger_sni_changes = TRUE;
866 /* useful for debugging */
867 saved_tls_certificate = state->exp_tls_certificate;
868 saved_tls_privatekey = state->exp_tls_privatekey;
869 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
870 saved_tls_crl = state->exp_tls_crl;
873 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
874 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
876 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
877 state members, assuming consistent naming; and expand_check() returns
878 false if expansion failed, unless expansion was forced to fail. */
880 /* check if we at least have a certificate, before doing expensive
883 if (!expand_check_tlsvar(tls_certificate, errstr))
886 /* certificate is mandatory in server, optional in client */
888 if ( !state->exp_tls_certificate
889 || !*state->exp_tls_certificate
892 return tls_install_selfsign(state, errstr);
894 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
896 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
899 /* tls_privatekey is optional, defaulting to same file as certificate */
901 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
903 state->tls_privatekey = state->tls_certificate;
904 state->exp_tls_privatekey = state->exp_tls_certificate;
908 if (state->exp_tls_certificate && *state->exp_tls_certificate)
910 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
911 state->exp_tls_certificate, state->exp_tls_privatekey);
913 if (state->received_sni)
914 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
915 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
918 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
922 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
925 if (!host) /* server */
927 const uschar * clist = state->exp_tls_certificate;
928 const uschar * klist = state->exp_tls_privatekey;
929 int csep = 0, ksep = 0;
930 uschar * cfile, * kfile;
932 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
933 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
934 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
935 else if ((rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
938 DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile);
942 if ((rc = tls_add_certfile(state, host,
943 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
945 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
948 } /* tls_certificate */
951 /* Set the OCSP stapling server info */
954 if ( !host /* server */
958 if (gnutls_buggy_ocsp)
960 DEBUG(D_tls) debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
964 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file",
965 &state->exp_tls_ocsp_file, errstr))
968 /* Use the full callback method for stapling just to get observability.
969 More efficient would be to read the file once only, if it never changed
970 (due to SNI). Would need restart on file update, or watch datestamp. */
972 gnutls_certificate_set_ocsp_status_request_function(state->x509_cred,
973 server_ocsp_stapling_cb, state->exp_tls_ocsp_file);
975 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", state->exp_tls_ocsp_file);
981 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
982 provided. Experiment shows that, if the certificate file is empty, an unhelpful
983 error message is provided. However, if we just refrain from setting anything up
984 in that case, certificate verification fails, which seems to be the correct
987 if (state->tls_verify_certificates && *state->tls_verify_certificates)
989 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
991 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
992 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
993 state->exp_tls_verify_certificates = NULL;
995 if (state->tls_crl && *state->tls_crl)
996 if (!expand_check_tlsvar(tls_crl, errstr))
999 if (!(state->exp_tls_verify_certificates &&
1000 *state->exp_tls_verify_certificates))
1003 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1004 /* With no tls_verify_certificates, we ignore tls_crl too */
1011 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1015 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1016 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1017 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1021 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1023 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1024 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1029 #ifndef SUPPORT_CA_DIR
1030 /* The test suite passes in /dev/null; we could check for that path explicitly,
1031 but who knows if someone has some weird FIFO which always dumps some certs, or
1032 other weirdness. The thing we really want to check is that it's not a
1033 directory, since while OpenSSL supports that, GnuTLS does not.
1034 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1035 if (S_ISDIR(statbuf.st_mode))
1038 debug_printf("verify certificates path is a dir: \"%s\"\n",
1039 state->exp_tls_verify_certificates);
1040 log_write(0, LOG_MAIN|LOG_PANIC,
1041 "tls_verify_certificates \"%s\" is a directory",
1042 state->exp_tls_verify_certificates);
1047 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1048 state->exp_tls_verify_certificates, statbuf.st_size);
1050 if (statbuf.st_size == 0)
1053 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1059 #ifdef SUPPORT_CA_DIR
1060 (statbuf.st_mode & S_IFMT) == S_IFDIR
1062 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1063 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1066 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1067 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1073 exim_gnutls_err_check(US"setting certificate trust");
1075 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
1077 if (state->tls_crl && *state->tls_crl &&
1078 state->exp_tls_crl && *state->exp_tls_crl)
1080 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1081 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1082 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1086 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
1088 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1097 /*************************************************
1098 * Set X.509 state variables *
1099 *************************************************/
1101 /* In GnuTLS, the registered cert/key are not replaced by a later
1102 set of a cert/key, so for SNI support we need a whole new x509_cred
1103 structure. Which means various other non-re-expanded pieces of state
1104 need to be re-set in the new struct, so the setting logic is pulled
1108 state exim_gnutls_state_st *
1109 errstr error string pointer
1111 Returns: OK/DEFER/FAIL
1115 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1118 const host_item *host = state->host; /* macro should be reconsidered? */
1120 /* Create D-H parameters, or read them from the cache file. This function does
1121 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1122 client-side params. */
1126 if (!dh_server_params)
1128 rc = init_server_dh(errstr);
1129 if (rc != OK) return rc;
1131 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1134 /* Link the credentials to the session. */
1136 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1137 exim_gnutls_err_check(US"gnutls_credentials_set");
1142 /*************************************************
1143 * Initialize for GnuTLS *
1144 *************************************************/
1147 #ifndef DISABLE_OCSP
1150 tls_is_buggy_ocsp(void)
1153 uschar maj, mid, mic;
1155 s = CUS gnutls_check_version(NULL);
1159 while (*s && *s != '.') s++;
1160 mid = atoi(CCS ++s);
1167 while (*s && *s != '.') s++;
1168 mic = atoi(CCS ++s);
1169 return mic <= (mid == 3 ? 16 : 3);
1178 /* Called from both server and client code. In the case of a server, errors
1179 before actual TLS negotiation return DEFER.
1182 host connected host, if client; NULL if server
1183 certificate certificate file
1184 privatekey private key file
1185 sni TLS SNI to send, sometimes when client; else NULL
1188 require_ciphers tls_require_ciphers setting
1189 caller_state returned state-info structure
1190 errstr error string pointer
1192 Returns: OK/DEFER/FAIL
1197 const host_item *host,
1198 const uschar *certificate,
1199 const uschar *privatekey,
1203 const uschar *require_ciphers,
1204 exim_gnutls_state_st **caller_state,
1207 exim_gnutls_state_st *state;
1212 BOOL want_default_priorities;
1214 if (!exim_gnutls_base_init_done)
1216 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1218 #ifdef HAVE_GNUTLS_PKCS11
1219 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1220 which loads modules from a config file, which sounds good and may be wanted
1221 by some sysadmin, but also means in common configurations that GNOME keyring
1222 environment variables are used and so breaks for users calling mailq.
1223 To prevent this, we init PKCS11 first, which is the documented approach. */
1224 if (!gnutls_allow_auto_pkcs11)
1226 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1227 exim_gnutls_err_check(US"gnutls_pkcs11_init");
1231 rc = gnutls_global_init();
1232 exim_gnutls_err_check(US"gnutls_global_init");
1234 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1237 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1238 /* arbitrarily chosen level; bump upto 9 for more */
1239 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1243 #ifndef DISABLE_OCSP
1244 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1245 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1248 exim_gnutls_base_init_done = TRUE;
1253 state = &state_client;
1254 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1255 state->tlsp = &tls_out;
1256 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1257 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1261 state = &state_server;
1262 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1263 state->tlsp = &tls_in;
1264 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1265 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1267 exim_gnutls_err_check(US"gnutls_init");
1271 state->tls_certificate = certificate;
1272 state->tls_privatekey = privatekey;
1273 state->tls_require_ciphers = require_ciphers;
1274 state->tls_sni = sni;
1275 state->tls_verify_certificates = cas;
1276 state->tls_crl = crl;
1278 /* This handles the variables that might get re-expanded after TLS SNI;
1279 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1282 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1283 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1285 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1286 requires a new structure afterwards. */
1288 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
1290 /* set SNI in client, only */
1293 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
1295 if (state->tlsp->sni && *state->tlsp->sni)
1298 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1299 sz = Ustrlen(state->tlsp->sni);
1300 rc = gnutls_server_name_set(state->session,
1301 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
1302 exim_gnutls_err_check(US"gnutls_server_name_set");
1305 else if (state->tls_sni)
1306 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1307 "have an SNI set for a server [%s]\n", state->tls_sni);
1309 /* This is the priority string support,
1310 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1311 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1312 This was backwards incompatible, but means Exim no longer needs to track
1313 all algorithms and provide string forms for them. */
1315 want_default_priorities = TRUE;
1317 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1319 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
1321 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1323 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1324 state->exp_tls_require_ciphers);
1326 rc = gnutls_priority_init(&state->priority_cache,
1327 CS state->exp_tls_require_ciphers, &errpos);
1328 want_default_priorities = FALSE;
1329 p = state->exp_tls_require_ciphers;
1332 if (want_default_priorities)
1335 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1336 exim_default_gnutls_priority);
1337 rc = gnutls_priority_init(&state->priority_cache,
1338 exim_default_gnutls_priority, &errpos);
1339 p = US exim_default_gnutls_priority;
1342 exim_gnutls_err_check(string_sprintf(
1343 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1344 p, errpos - CS p, errpos));
1346 rc = gnutls_priority_set(state->session, state->priority_cache);
1347 exim_gnutls_err_check(US"gnutls_priority_set");
1349 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1351 /* Reduce security in favour of increased compatibility, if the admin
1352 decides to make that trade-off. */
1353 if (gnutls_compat_mode)
1355 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1356 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1357 gnutls_session_enable_compatibility_mode(state->session);
1359 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1363 *caller_state = state;
1369 /*************************************************
1370 * Extract peer information *
1371 *************************************************/
1373 /* Called from both server and client code.
1374 Only this is allowed to set state->peerdn and state->have_set_peerdn
1375 and we use that to detect double-calls.
1377 NOTE: the state blocks last while the TLS connection is up, which is fine
1378 for logging in the server side, but for the client side, we log after teardown
1379 in src/deliver.c. While the session is up, we can twist about states and
1380 repoint tls_* globals, but those variables used for logging or other variable
1381 expansion that happens _after_ delivery need to have a longer life-time.
1383 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1384 doing this more than once per generation of a state context. We set them in
1385 the state context, and repoint tls_* to them. After the state goes away, the
1386 tls_* copies of the pointers remain valid and client delivery logging is happy.
1388 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1392 state exim_gnutls_state_st *
1393 errstr pointer to error string
1395 Returns: OK/DEFER/FAIL
1399 peer_status(exim_gnutls_state_st *state, uschar ** errstr)
1401 uschar cipherbuf[256];
1402 const gnutls_datum_t *cert_list;
1404 unsigned int cert_list_size = 0;
1405 gnutls_protocol_t protocol;
1406 gnutls_cipher_algorithm_t cipher;
1407 gnutls_kx_algorithm_t kx;
1408 gnutls_mac_algorithm_t mac;
1409 gnutls_certificate_type_t ct;
1410 gnutls_x509_crt_t crt;
1414 if (state->have_set_peerdn)
1416 state->have_set_peerdn = TRUE;
1418 state->peerdn = NULL;
1421 cipher = gnutls_cipher_get(state->session);
1422 protocol = gnutls_protocol_get_version(state->session);
1423 mac = gnutls_mac_get(state->session);
1424 kx = gnutls_kx_get(state->session);
1426 string_format(cipherbuf, sizeof(cipherbuf),
1428 gnutls_protocol_get_name(protocol),
1429 gnutls_cipher_suite_get_name(kx, cipher, mac),
1430 (int) gnutls_cipher_get_key_size(cipher) * 8);
1432 /* I don't see a way that spaces could occur, in the current GnuTLS
1433 code base, but it was a concern in the old code and perhaps older GnuTLS
1434 releases did return "TLS 1.0"; play it safe, just in case. */
1435 for (p = cipherbuf; *p != '\0'; ++p)
1438 old_pool = store_pool;
1439 store_pool = POOL_PERM;
1440 state->ciphersuite = string_copy(cipherbuf);
1441 store_pool = old_pool;
1442 state->tlsp->cipher = state->ciphersuite;
1445 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1447 if (cert_list == NULL || cert_list_size == 0)
1449 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1450 cert_list, cert_list_size);
1451 if (state->verify_requirement >= VERIFY_REQUIRED)
1452 return tls_error(US"certificate verification failed",
1453 "no certificate received from peer", state->host, errstr);
1457 ct = gnutls_certificate_type_get(state->session);
1458 if (ct != GNUTLS_CRT_X509)
1460 const char *ctn = gnutls_certificate_type_get_name(ct);
1462 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1463 if (state->verify_requirement >= VERIFY_REQUIRED)
1464 return tls_error(US"certificate verification not possible, unhandled type",
1465 ctn, state->host, errstr);
1469 #define exim_gnutls_peer_err(Label) \
1471 if (rc != GNUTLS_E_SUCCESS) \
1473 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1474 (Label), gnutls_strerror(rc)); \
1475 if (state->verify_requirement >= VERIFY_REQUIRED) \
1476 return tls_error((Label), gnutls_strerror(rc), state->host, errstr); \
1481 rc = import_cert(&cert_list[0], &crt);
1482 exim_gnutls_peer_err(US"cert 0");
1484 state->tlsp->peercert = state->peercert = crt;
1487 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1488 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1490 exim_gnutls_peer_err(US"getting size for cert DN failed");
1491 return FAIL; /* should not happen */
1493 dn_buf = store_get_perm(sz);
1494 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1495 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1497 state->peerdn = dn_buf;
1500 #undef exim_gnutls_peer_err
1506 /*************************************************
1507 * Verify peer certificate *
1508 *************************************************/
1510 /* Called from both server and client code.
1511 *Should* be using a callback registered with
1512 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1513 the peer information, but that's too new for some OSes.
1516 state exim_gnutls_state_st *
1517 errstr where to put an error message
1520 FALSE if the session should be rejected
1521 TRUE if the cert is okay or we just don't care
1525 verify_certificate(exim_gnutls_state_st *state, uschar ** errstr)
1528 unsigned int verify;
1532 if ((rc = peer_status(state, errstr)) != OK)
1534 verify = GNUTLS_CERT_INVALID;
1535 *errstr = US"certificate not supplied";
1538 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1540 /* Handle the result of verification. INVALID seems to be set as well
1541 as REVOKED, but leave the test for both. */
1544 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1547 state->peer_cert_verified = FALSE;
1549 *errstr = verify & GNUTLS_CERT_REVOKED
1550 ? US"certificate revoked" : US"certificate invalid";
1553 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1554 *errstr, state->peerdn ? state->peerdn : US"<unset>");
1556 if (state->verify_requirement >= VERIFY_REQUIRED)
1558 gnutls_alert_send(state->session,
1559 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1563 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1568 if (state->exp_tls_verify_cert_hostnames)
1571 const uschar * list = state->exp_tls_verify_cert_hostnames;
1573 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1574 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1579 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1580 if (state->verify_requirement >= VERIFY_REQUIRED)
1582 gnutls_alert_send(state->session,
1583 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1589 state->peer_cert_verified = TRUE;
1590 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1591 state->peerdn ? state->peerdn : US"<unset>");
1594 state->tlsp->peerdn = state->peerdn;
1602 /* ------------------------------------------------------------------------ */
1605 /* Logging function which can be registered with
1606 * gnutls_global_set_log_function()
1607 * gnutls_global_set_log_level() 0..9
1609 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1611 exim_gnutls_logger_cb(int level, const char *message)
1613 size_t len = strlen(message);
1616 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1619 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1620 message[len-1] == '\n' ? "" : "\n");
1625 /* Called after client hello, should handle SNI work.
1626 This will always set tls_sni (state->received_sni) if available,
1627 and may trigger presenting different certificates,
1628 if state->trigger_sni_changes is TRUE.
1630 Should be registered with
1631 gnutls_handshake_set_post_client_hello_function()
1633 "This callback must return 0 on success or a gnutls error code to terminate the
1636 For inability to get SNI information, we return 0.
1637 We only return non-zero if re-setup failed.
1638 Only used for server-side TLS.
1642 exim_sni_handling_cb(gnutls_session_t session)
1644 char sni_name[MAX_HOST_LEN];
1645 size_t data_len = MAX_HOST_LEN;
1646 exim_gnutls_state_st *state = &state_server;
1647 unsigned int sni_type;
1649 uschar * dummy_errstr;
1651 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1652 if (rc != GNUTLS_E_SUCCESS)
1655 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1656 debug_printf("TLS: no SNI presented in handshake.\n");
1658 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1659 gnutls_strerror(rc), rc);
1664 if (sni_type != GNUTLS_NAME_DNS)
1666 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1670 /* We now have a UTF-8 string in sni_name */
1671 old_pool = store_pool;
1672 store_pool = POOL_PERM;
1673 state->received_sni = string_copyn(US sni_name, data_len);
1674 store_pool = old_pool;
1676 /* We set this one now so that variable expansions below will work */
1677 state->tlsp->sni = state->received_sni;
1679 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1680 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1682 if (!state->trigger_sni_changes)
1685 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
1687 /* If the setup of certs/etc failed before handshake, TLS would not have
1688 been offered. The best we can do now is abort. */
1689 return GNUTLS_E_APPLICATION_ERROR_MIN;
1692 rc = tls_set_remaining_x509(state, &dummy_errstr);
1693 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1700 #ifndef DISABLE_OCSP
1703 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1704 gnutls_datum_t * ocsp_response)
1708 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1710 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1712 tls_in.ocsp = OCSP_NOT_RESP;
1713 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1716 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1723 #ifndef DISABLE_EVENT
1725 We use this callback to get observability and detail-level control
1726 for an exim TLS connection (either direction), raising a tls:cert event
1727 for each cert in the chain presented by the peer. Any event
1728 can deny verification.
1730 Return 0 for the handshake to continue or non-zero to terminate.
1734 verify_cb(gnutls_session_t session)
1736 const gnutls_datum_t * cert_list;
1737 unsigned int cert_list_size = 0;
1738 gnutls_x509_crt_t crt;
1741 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1743 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1745 while (cert_list_size--)
1747 rc = import_cert(&cert_list[cert_list_size], &crt);
1748 if (rc != GNUTLS_E_SUCCESS)
1750 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1751 cert_list_size, gnutls_strerror(rc));
1755 state->tlsp->peercert = crt;
1756 if ((yield = event_raise(state->event_action,
1757 US"tls:cert", string_sprintf("%d", cert_list_size))))
1759 log_write(0, LOG_MAIN,
1760 "SSL verify denied by event-action: depth=%d: %s",
1761 cert_list_size, yield);
1762 return 1; /* reject */
1764 state->tlsp->peercert = NULL;
1774 /* ------------------------------------------------------------------------ */
1775 /* Exported functions */
1780 /*************************************************
1781 * Start a TLS session in a server *
1782 *************************************************/
1784 /* This is called when Exim is running as a server, after having received
1785 the STARTTLS command. It must respond to that command, and then negotiate
1789 require_ciphers list of allowed ciphers or NULL
1790 errstr pointer to error string
1792 Returns: OK on success
1793 DEFER for errors before the start of the negotiation
1794 FAIL for errors during the negotiation; the server can't
1799 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
1802 exim_gnutls_state_st * state = NULL;
1804 /* Check for previous activation */
1805 if (tls_in.active >= 0)
1807 tls_error(US"STARTTLS received after TLS started", "", NULL, errstr);
1808 smtp_printf("554 Already in TLS\r\n", FALSE);
1812 /* Initialize the library. If it fails, it will already have logged the error
1813 and sent an SMTP response. */
1815 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1817 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
1818 NULL, tls_verify_certificates, tls_crl,
1819 require_ciphers, &state, errstr)) != OK) return rc;
1821 /* If this is a host for which certificate verification is mandatory or
1822 optional, set up appropriately. */
1824 if (verify_check_host(&tls_verify_hosts) == OK)
1827 debug_printf("TLS: a client certificate will be required.\n");
1828 state->verify_requirement = VERIFY_REQUIRED;
1829 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1831 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1834 debug_printf("TLS: a client certificate will be requested but not required.\n");
1835 state->verify_requirement = VERIFY_OPTIONAL;
1836 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1841 debug_printf("TLS: a client certificate will not be requested.\n");
1842 state->verify_requirement = VERIFY_NONE;
1843 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1846 #ifndef DISABLE_EVENT
1849 state->event_action = event_action;
1850 gnutls_session_set_ptr(state->session, state);
1851 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1855 /* Register SNI handling; always, even if not in tls_certificate, so that the
1856 expansion variable $tls_sni is always available. */
1858 gnutls_handshake_set_post_client_hello_function(state->session,
1859 exim_sni_handling_cb);
1861 /* Set context and tell client to go ahead, except in the case of TLS startup
1862 on connection, where outputting anything now upsets the clients and tends to
1863 make them disconnect. We need to have an explicit fflush() here, to force out
1864 the response. Other smtp_printf() calls do not need it, because in non-TLS
1865 mode, the fflush() happens when smtp_getc() is called. */
1867 if (!state->tlsp->on_connect)
1869 smtp_printf("220 TLS go ahead\r\n", FALSE);
1873 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1874 that the GnuTLS library doesn't. */
1876 gnutls_transport_set_ptr2(state->session,
1877 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
1878 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
1879 state->fd_in = fileno(smtp_in);
1880 state->fd_out = fileno(smtp_out);
1882 sigalrm_seen = FALSE;
1883 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1885 rc = gnutls_handshake(state->session);
1886 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
1889 if (rc != GNUTLS_E_SUCCESS)
1891 /* It seems that, except in the case of a timeout, we have to close the
1892 connection right here; otherwise if the other end is running OpenSSL it hangs
1893 until the server times out. */
1897 tls_error(US"gnutls_handshake", "timed out", NULL, errstr);
1898 gnutls_db_remove_session(state->session);
1902 tls_error(US"gnutls_handshake", gnutls_strerror(rc), NULL, errstr);
1903 (void) gnutls_alert_send_appropriate(state->session, rc);
1904 gnutls_deinit(state->session);
1905 gnutls_certificate_free_credentials(state->x509_cred);
1907 shutdown(state->fd_out, SHUT_WR);
1908 for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--; /* drain skt */
1909 (void)fclose(smtp_out);
1910 (void)fclose(smtp_in);
1911 smtp_out = smtp_in = NULL;
1917 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1919 /* Verify after the fact */
1921 if ( state->verify_requirement != VERIFY_NONE
1922 && !verify_certificate(state, errstr))
1924 if (state->verify_requirement != VERIFY_OPTIONAL)
1926 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
1930 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1934 /* Figure out peer DN, and if authenticated, etc. */
1936 if ((rc = peer_status(state, NULL)) != OK) return rc;
1938 /* Sets various Exim expansion variables; always safe within server */
1940 extract_exim_vars_from_tls_state(state);
1942 /* TLS has been set up. Adjust the input functions to read via TLS,
1943 and initialize appropriately. */
1945 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1947 receive_getc = tls_getc;
1948 receive_getbuf = tls_getbuf;
1949 receive_get_cache = tls_get_cache;
1950 receive_ungetc = tls_ungetc;
1951 receive_feof = tls_feof;
1952 receive_ferror = tls_ferror;
1953 receive_smtp_buffered = tls_smtp_buffered;
1962 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
1963 smtp_transport_options_block * ob)
1965 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
1967 state->exp_tls_verify_cert_hostnames =
1969 string_domain_utf8_to_alabel(host->name, NULL);
1974 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
1975 state->exp_tls_verify_cert_hostnames);
1980 /*************************************************
1981 * Start a TLS session in a client *
1982 *************************************************/
1984 /* Called from the smtp transport after STARTTLS has been accepted.
1987 fd the fd of the connection
1988 host connected host (for messages)
1989 addr the first address (not used)
1990 tb transport (always smtp)
1992 errstr error string pointer
1994 Returns: OK/DEFER/FAIL (because using common functions),
1995 but for a client, DEFER and FAIL have the same meaning
1999 tls_client_start(int fd, host_item *host,
2000 address_item *addr ARG_UNUSED,
2001 transport_instance * tb,
2002 #ifdef EXPERIMENTAL_DANE
2003 dns_answer * tlsa_dnsa ARG_UNUSED,
2007 smtp_transport_options_block *ob =
2008 (smtp_transport_options_block *)tb->options_block;
2010 exim_gnutls_state_st *state = NULL;
2011 #ifndef DISABLE_OCSP
2013 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
2014 BOOL request_ocsp = require_ocsp ? TRUE
2015 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2018 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
2020 if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2021 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2022 ob->tls_require_ciphers, &state, errstr)) != OK)
2026 int dh_min_bits = ob->tls_dh_min_bits;
2027 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2030 debug_printf("WARNING: tls_dh_min_bits far too low,"
2031 " clamping %d up to %d\n",
2032 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2033 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2036 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2037 " acceptable bits to %d\n",
2039 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2042 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
2043 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2044 the specified host patterns if one of them is defined */
2046 if ( ( state->exp_tls_verify_certificates
2047 && !ob->tls_verify_hosts
2048 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2050 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
2053 tls_client_setup_hostname_checks(host, state, ob);
2055 debug_printf("TLS: server certificate verification required.\n");
2056 state->verify_requirement = VERIFY_REQUIRED;
2057 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2059 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
2061 tls_client_setup_hostname_checks(host, state, ob);
2063 debug_printf("TLS: server certificate verification optional.\n");
2064 state->verify_requirement = VERIFY_OPTIONAL;
2065 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2070 debug_printf("TLS: server certificate verification not required.\n");
2071 state->verify_requirement = VERIFY_NONE;
2072 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2075 #ifndef DISABLE_OCSP
2076 /* supported since GnuTLS 3.1.3 */
2079 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2080 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2081 NULL, 0, NULL)) != OK)
2082 return tls_error(US"cert-status-req",
2083 gnutls_strerror(rc), state->host, errstr);
2084 tls_out.ocsp = OCSP_NOT_RESP;
2088 #ifndef DISABLE_EVENT
2089 if (tb->event_action)
2091 state->event_action = tb->event_action;
2092 gnutls_session_set_ptr(state->session, state);
2093 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2097 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
2101 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2102 /* There doesn't seem to be a built-in timeout on connection. */
2104 sigalrm_seen = FALSE;
2105 alarm(ob->command_timeout);
2108 rc = gnutls_handshake(state->session);
2109 } while ((rc == GNUTLS_E_AGAIN) ||
2110 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
2113 if (rc != GNUTLS_E_SUCCESS)
2116 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
2117 return tls_error(US"gnutls_handshake", "timed out", state->host, errstr);
2120 return tls_error(US"gnutls_handshake", gnutls_strerror(rc), state->host, errstr);
2122 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2126 if (state->verify_requirement != VERIFY_NONE &&
2127 !verify_certificate(state, errstr))
2128 return tls_error(US"certificate verification failed", *errstr, state->host, errstr);
2130 #ifndef DISABLE_OCSP
2135 gnutls_datum_t stapling;
2136 gnutls_ocsp_resp_t resp;
2137 gnutls_datum_t printed;
2138 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2139 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2140 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2141 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2144 debug_printf("%.4096s", printed.data);
2145 gnutls_free(printed.data);
2148 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host, errstr);
2151 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
2153 tls_out.ocsp = OCSP_FAILED;
2154 return tls_error(US"certificate status check failed", NULL, state->host, errstr);
2156 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
2157 tls_out.ocsp = OCSP_VFIED;
2161 /* Figure out peer DN, and if authenticated, etc. */
2163 if ((rc = peer_status(state, errstr)) != OK)
2166 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
2168 extract_exim_vars_from_tls_state(state);
2176 /*************************************************
2177 * Close down a TLS session *
2178 *************************************************/
2180 /* This is also called from within a delivery subprocess forked from the
2181 daemon, to shut down the TLS library, without actually doing a shutdown (which
2182 would tamper with the TLS session in the parent process).
2184 Arguments: TRUE if gnutls_bye is to be called
2189 tls_close(BOOL is_server, BOOL shutdown)
2191 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2193 if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
2197 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
2198 gnutls_bye(state->session, GNUTLS_SHUT_WR);
2201 gnutls_deinit(state->session);
2202 gnutls_certificate_free_credentials(state->x509_cred);
2205 state->tlsp->active = -1;
2206 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2208 if ((state_server.session == NULL) && (state_client.session == NULL))
2210 gnutls_global_deinit();
2211 exim_gnutls_base_init_done = FALSE;
2219 tls_refill(unsigned lim)
2221 exim_gnutls_state_st * state = &state_server;
2224 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2225 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2227 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2228 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2229 MIN(ssl_xfer_buffer_size, lim));
2232 /* Timeouts do not get this far; see command_timeout_handler().
2233 A zero-byte return appears to mean that the TLS session has been
2234 closed down, not that the socket itself has been closed down. Revert to
2235 non-TLS handling. */
2239 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
2240 state->xfer_error = 1;
2244 else if (inbytes == 0)
2246 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2248 receive_getc = smtp_getc;
2249 receive_getbuf = smtp_getbuf;
2250 receive_get_cache = smtp_get_cache;
2251 receive_ungetc = smtp_ungetc;
2252 receive_feof = smtp_feof;
2253 receive_ferror = smtp_ferror;
2254 receive_smtp_buffered = smtp_buffered;
2256 gnutls_deinit(state->session);
2257 gnutls_certificate_free_credentials(state->x509_cred);
2259 state->session = NULL;
2260 state->tlsp->active = -1;
2261 state->tlsp->bits = 0;
2262 state->tlsp->certificate_verified = FALSE;
2263 tls_channelbinding_b64 = NULL;
2264 state->tlsp->cipher = NULL;
2265 state->tlsp->peercert = NULL;
2266 state->tlsp->peerdn = NULL;
2271 /* Handle genuine errors */
2273 else if (inbytes < 0)
2275 record_io_error(state, (int) inbytes, US"recv", NULL);
2276 state->xfer_error = 1;
2279 #ifndef DISABLE_DKIM
2280 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2282 state->xfer_buffer_hwm = (int) inbytes;
2283 state->xfer_buffer_lwm = 0;
2287 /*************************************************
2288 * TLS version of getc *
2289 *************************************************/
2291 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2292 it refills the buffer via the GnuTLS reading function.
2293 Only used by the server-side TLS.
2295 This feeds DKIM and should be used for all message-body reads.
2297 Arguments: lim Maximum amount to read/bufffer
2298 Returns: the next character or EOF
2302 tls_getc(unsigned lim)
2304 exim_gnutls_state_st * state = &state_server;
2306 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2307 if (!tls_refill(lim))
2308 return state->xfer_error ? EOF : smtp_getc(lim);
2310 /* Something in the buffer; return next uschar */
2312 return state->xfer_buffer[state->xfer_buffer_lwm++];
2316 tls_getbuf(unsigned * len)
2318 exim_gnutls_state_st * state = &state_server;
2322 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2323 if (!tls_refill(*len))
2325 if (!state->xfer_error) return smtp_getbuf(len);
2330 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
2332 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
2333 state->xfer_buffer_lwm += size;
2342 #ifndef DISABLE_DKIM
2343 exim_gnutls_state_st * state = &state_server;
2344 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2346 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
2352 tls_could_read(void)
2354 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
2355 || gnutls_record_check_pending(state_server.session) > 0;
2361 /*************************************************
2362 * Read bytes from TLS channel *
2363 *************************************************/
2365 /* This does not feed DKIM, so if the caller uses this for reading message body,
2366 then the caller must feed DKIM.
2372 Returns: the number of bytes read
2373 -1 after a failed read
2377 tls_read(BOOL is_server, uschar *buff, size_t len)
2379 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2385 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2387 debug_printf("*** PROBABLY A BUG *** " \
2388 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2389 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2392 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2393 state->session, buff, len);
2395 inbytes = gnutls_record_recv(state->session, buff, len);
2396 if (inbytes > 0) return inbytes;
2399 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2401 else record_io_error(state, (int)inbytes, US"recv", NULL);
2409 /*************************************************
2410 * Write bytes down TLS channel *
2411 *************************************************/
2415 is_server channel specifier
2418 more more data expected soon
2420 Returns: the number of bytes after a successful write,
2421 -1 after a failed write
2425 tls_write(BOOL is_server, const uschar *buff, size_t len, BOOL more)
2429 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2431 static BOOL corked = FALSE;
2433 if (more && !corked) gnutls_record_cork(state->session);
2436 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
2437 buff, left, more ? ", more" : "");
2441 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2443 outbytes = gnutls_record_send(state->session, buff, left);
2445 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
2448 record_io_error(state, outbytes, US"send", NULL);
2453 record_io_error(state, 0, US"send", US"TLS channel closed on write");
2464 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2472 if (!more) (void) gnutls_record_uncork(state->session, 0);
2483 /*************************************************
2484 * Random number generation *
2485 *************************************************/
2487 /* Pseudo-random number generation. The result is not expected to be
2488 cryptographically strong but not so weak that someone will shoot themselves
2489 in the foot using it as a nonce in input in some email header scheme or
2490 whatever weirdness they'll twist this into. The result should handle fork()
2491 and avoid repeating sequences. OpenSSL handles that for us.
2495 Returns a random number in range [0, max-1]
2498 #ifdef HAVE_GNUTLS_RND
2500 vaguely_random_number(int max)
2505 uschar smallbuf[sizeof(r)];
2510 needed_len = sizeof(r);
2511 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2512 * asked for a number less than 10. */
2513 for (r = max, i = 0; r; ++i)
2519 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2522 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2523 return vaguely_random_number_fallback(max);
2526 for (p = smallbuf; needed_len; --needed_len, ++p)
2532 /* We don't particularly care about weighted results; if someone wants
2533 * smooth distribution and cares enough then they should submit a patch then. */
2536 #else /* HAVE_GNUTLS_RND */
2538 vaguely_random_number(int max)
2540 return vaguely_random_number_fallback(max);
2542 #endif /* HAVE_GNUTLS_RND */
2547 /*************************************************
2548 * Let tls_require_ciphers be checked at startup *
2549 *************************************************/
2551 /* The tls_require_ciphers option, if set, must be something which the
2554 Returns: NULL on success, or error message
2558 tls_validate_require_cipher(void)
2561 uschar *expciphers = NULL;
2562 gnutls_priority_t priority_cache;
2564 uschar * dummy_errstr;
2566 #define validate_check_rc(Label) do { \
2567 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2568 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2569 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2571 if (exim_gnutls_base_init_done)
2572 log_write(0, LOG_MAIN|LOG_PANIC,
2573 "already initialised GnuTLS, Exim developer bug");
2575 #ifdef HAVE_GNUTLS_PKCS11
2576 if (!gnutls_allow_auto_pkcs11)
2578 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2579 validate_check_rc(US"gnutls_pkcs11_init");
2582 rc = gnutls_global_init();
2583 validate_check_rc(US"gnutls_global_init()");
2584 exim_gnutls_base_init_done = TRUE;
2586 if (!(tls_require_ciphers && *tls_require_ciphers))
2587 return_deinit(NULL);
2589 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
2591 return_deinit(US"failed to expand tls_require_ciphers");
2593 if (!(expciphers && *expciphers))
2594 return_deinit(NULL);
2597 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2599 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2600 validate_check_rc(string_sprintf(
2601 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2602 expciphers, errpos - CS expciphers, errpos));
2604 #undef return_deinit
2605 #undef validate_check_rc
2606 gnutls_global_deinit();
2614 /*************************************************
2615 * Report the library versions. *
2616 *************************************************/
2618 /* See a description in tls-openssl.c for an explanation of why this exists.
2620 Arguments: a FILE* to print the results to
2625 tls_version_report(FILE *f)
2627 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2630 gnutls_check_version(NULL));
2635 /* End of tls-gnu.c */