1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2012 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
46 gnutls_global_set_audit_log_function()
49 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
52 /* Local static variables for GnuTLS */
54 /* Values for verify_requirement */
56 enum peer_verify_requirement { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
58 /* This holds most state for server or client; with this, we can set up an
59 outbound TLS-enabled connection in an ACL callout, while not stomping all
60 over the TLS variables available for expansion.
62 Some of these correspond to variables in globals.c; those variables will
63 be set to point to content in one of these instances, as appropriate for
64 the stage of the process lifetime.
66 Not handled here: globals tls_active, tls_bits, tls_cipher, tls_peerdn,
67 tls_certificate_verified, tls_channelbinding_b64, tls_sni.
70 typedef struct exim_gnutls_state {
71 gnutls_session_t session;
72 gnutls_certificate_credentials_t x509_cred;
73 gnutls_priority_t priority_cache;
74 enum peer_verify_requirement verify_requirement;
77 BOOL peer_cert_verified;
78 BOOL trigger_sni_changes;
79 const struct host_item *host;
83 const uschar *tls_certificate;
84 const uschar *tls_privatekey;
85 const uschar *tls_sni; /* client send only, not received */
86 const uschar *tls_verify_certificates;
87 const uschar *tls_crl;
88 const uschar *tls_require_ciphers;
89 uschar *exp_tls_certificate;
90 uschar *exp_tls_privatekey;
92 uschar *exp_tls_verify_certificates;
94 uschar *exp_tls_require_ciphers;
102 uschar cipherbuf[256];
103 } exim_gnutls_state_st;
105 static const exim_gnutls_state_st exim_gnutls_state_init = {
106 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE,
108 NULL, NULL, NULL, NULL, NULL, NULL,
109 NULL, NULL, NULL, NULL, NULL, NULL,
114 /* Not only do we have our own APIs which don't pass around state, assuming
115 it's held in globals, GnuTLS doesn't appear to let us register callback data
116 for callbacks, or as part of the session, so we have to keep a "this is the
117 context we're currently dealing with" pointer and rely upon being
118 single-threaded to keep from processing data on an inbound TLS connection while
119 talking to another TLS connection for an outbound check. This does mean that
120 there's no way for heart-beats to be responded to, for the duration of the
121 second connection. */
123 static exim_gnutls_state_st state_server, state_client;
124 static exim_gnutls_state_st *current_global_tls_state;
126 /* dh_params are initialised once within the lifetime of a process using TLS;
127 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
128 don't want to repeat this. */
130 static gnutls_dh_params_t dh_server_params = NULL;
132 /* No idea how this value was chosen; preserving it. Default is 3600. */
134 static const int ssl_session_timeout = 200;
136 static const char * const exim_default_gnutls_priority = "NORMAL";
138 /* Guard library core initialisation */
140 static BOOL exim_gnutls_base_init_done = FALSE;
143 /* ------------------------------------------------------------------------ */
146 #define MAX_HOST_LEN 255
148 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
149 the library logging; a value less than 0 disables the calls to set up logging
151 #define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
153 #define EXIM_CLIENT_DH_MIN_BITS 1024
155 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
156 can ask for a bit-strength. Without that, we stick to the constant we had
158 #define EXIM_SERVER_DH_BITS_PRE2_12 1024
160 #define exim_gnutls_err_check(Label) do { \
161 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
163 #define exim_gnutls_err_debugreturn0(Label) do { \
164 if (rc != GNUTLS_E_SUCCESS) { \
165 DEBUG(D_tls) debug_printf("TLS failure: %s: %s", (Label), gnutls_strerror(rc)); \
166 return 0; } } while (0)
168 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
170 #if GNUTLS_VERSION_NUMBER >= 0x020c00
171 #define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
172 #define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
173 #define HAVE_GNUTLS_RND
179 /* ------------------------------------------------------------------------ */
180 /* Callback declarations */
182 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
183 static void exim_gnutls_logger_cb(int level, const char *message);
186 static int exim_sni_handling_cb(gnutls_session_t session);
191 /* ------------------------------------------------------------------------ */
192 /* Static functions */
194 /*************************************************
196 *************************************************/
198 /* Called from lots of places when errors occur before actually starting to do
199 the TLS handshake, that is, while the session is still in clear. Always returns
200 DEFER for a server and FAIL for a client so that most calls can use "return
201 tls_error(...)" to do this processing and then give an appropriate return. A
202 single function is used for both server and client, because it is called from
203 some shared functions.
206 prefix text to include in the logged error
207 msg additional error string (may be NULL)
208 usually obtained from gnutls_strerror()
209 host NULL if setting up a server;
210 the connected host if setting up a client
212 Returns: OK/DEFER/FAIL
216 tls_error(const uschar *prefix, const char *msg, const host_item *host)
220 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
221 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
226 uschar *conn_info = smtp_get_connection_info();
227 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
229 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
230 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
238 /*************************************************
239 * Deal with logging errors during I/O *
240 *************************************************/
242 /* We have to get the identity of the peer from saved data.
245 state the current GnuTLS exim state container
246 rc the GnuTLS error code, or 0 if it's a local error
247 when text identifying read or write
248 text local error text when ec is 0
254 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
258 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
259 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
260 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
262 msg = gnutls_strerror(rc);
264 tls_error(when, msg, state->host);
270 /*************************************************
271 * Set various Exim expansion vars *
272 *************************************************/
274 /* We set various Exim global variables from the state, once a session has
275 been established. With TLS callouts, may need to change this to stack
276 variables, or just re-call it with the server state after client callout
279 Make sure anything set here is inset in tls_getc().
283 tls_bits strength indicator
284 tls_certificate_verified bool indicator
285 tls_channelbinding_b64 for some SASL mechanisms
288 tls_sni a (UTF-8) string
290 current_global_tls_state for API limitations
293 state the relevant exim_gnutls_state_st *
297 extract_exim_vars_from_tls_state(exim_gnutls_state_st *state)
299 gnutls_protocol_t protocol;
300 gnutls_cipher_algorithm_t cipher;
301 gnutls_kx_algorithm_t kx;
302 gnutls_mac_algorithm_t mac;
304 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
307 gnutls_datum_t channel;
310 current_global_tls_state = state;
312 tls_active = state->fd_out;
314 cipher = gnutls_cipher_get(state->session);
315 /* returns size in "bytes" */
316 tls_bits = gnutls_cipher_get_key_size(cipher) * 8;
318 if (!*state->cipherbuf)
320 protocol = gnutls_protocol_get_version(state->session);
321 mac = gnutls_mac_get(state->session);
322 kx = gnutls_kx_get(state->session);
324 string_format(state->cipherbuf, sizeof(state->cipherbuf),
326 gnutls_protocol_get_name(protocol),
327 gnutls_cipher_suite_get_name(kx, cipher, mac),
330 /* I don't see a way that spaces could occur, in the current GnuTLS
331 code base, but it was a concern in the old code and perhaps older GnuTLS
332 releases did return "TLS 1.0"; play it safe, just in case. */
333 for (p = state->cipherbuf; *p != '\0'; ++p)
337 tls_cipher = state->cipherbuf;
339 DEBUG(D_tls) debug_printf("cipher: %s\n", tls_cipher);
341 tls_certificate_verified = state->peer_cert_verified;
343 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
344 only available for use for authenticators while this TLS session is running. */
346 tls_channelbinding_b64 = NULL;
347 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
350 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
352 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
354 old_pool = store_pool;
355 store_pool = POOL_PERM;
356 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
357 store_pool = old_pool;
358 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
362 tls_peerdn = state->peerdn;
364 tls_sni = state->received_sni;
370 /*************************************************
371 * Setup up DH parameters *
372 *************************************************/
374 /* Generating the D-H parameters may take a long time. They only need to
375 be re-generated every so often, depending on security policy. What we do is to
376 keep these parameters in a file in the spool directory. If the file does not
377 exist, we generate them. This means that it is easy to cause a regeneration.
379 The new file is written as a temporary file and renamed, so that an incomplete
380 file is never present. If two processes both compute some new parameters, you
381 waste a bit of effort, but it doesn't seem worth messing around with locking to
385 host NULL for server, server for client (for error handling)
387 Returns: OK/DEFER/FAIL
394 unsigned int dh_bits;
396 uschar filename[PATH_MAX];
398 host_item *host = NULL; /* dummy for macros */
400 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
402 rc = gnutls_dh_params_init(&dh_server_params);
403 exim_gnutls_err_check(US"gnutls_dh_params_init");
405 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
406 /* If you change this constant, also change dh_param_fn_ext so that we can use a
407 different filename and ensure we have sufficient bits. */
408 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
410 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
412 debug_printf("GnuTLS tells us that for D-H PL, NORMAL is %d bits.\n",
415 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
417 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
421 if (!string_format(filename, sizeof(filename),
422 "%s/gnutls-params-%d", spool_directory, dh_bits))
423 return tls_error(US"overlong filename", NULL, NULL);
425 /* Open the cache file for reading and if successful, read it and set up the
428 fd = Uopen(filename, O_RDONLY, 0);
435 if (fstat(fd, &statbuf) < 0) /* EIO */
439 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
441 if (!S_ISREG(statbuf.st_mode))
444 return tls_error(US"TLS cache not a file", NULL, NULL);
446 fp = fdopen(fd, "rb");
451 return tls_error(US"fdopen(TLS cache stat fd) failed",
452 strerror(saved_errno), NULL);
455 m.size = statbuf.st_size;
456 m.data = malloc(m.size);
460 return tls_error(US"malloc failed", strerror(errno), NULL);
462 sz = fread(m.data, m.size, 1, fp);
468 return tls_error(US"fread failed", strerror(saved_errno), NULL);
472 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
474 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
475 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
478 /* If the file does not exist, fall through to compute new data and cache it.
479 If there was any other opening error, it is serious. */
481 else if (errno == ENOENT)
485 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
488 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
491 /* If ret < 0, either the cache file does not exist, or the data it contains
492 is not useful. One particular case of this is when upgrading from an older
493 release of Exim in which the data was stored in a different format. We don't
494 try to be clever and support both formats; we just regenerate new data in this
501 if ((PATH_MAX - Ustrlen(filename)) < 10)
502 return tls_error(US"Filename too long to generate replacement",
505 temp_fn = string_copy(US "%s.XXXXXXX");
506 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
508 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
509 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
511 DEBUG(D_tls) debug_printf("generating %d bits Diffie-Hellman key ...\n", dh_bits);
512 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits);
513 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
515 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
516 and I confirmed that a NULL call to get the size first is how the GnuTLS
517 sample apps handle this. */
521 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
523 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
524 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
526 m.data = malloc(m.size);
528 return tls_error(US"memory allocation failed", strerror(errno), NULL);
529 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
531 if (rc != GNUTLS_E_SUCCESS)
534 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
537 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
541 return tls_error(US"TLS cache write D-H params failed",
542 strerror(errno), NULL);
545 sz = write_to_fd_buf(fd, US"\n", 1);
547 return tls_error(US"TLS cache write D-H params final newline failed",
548 strerror(errno), NULL);
552 return tls_error(US"TLS cache write close() failed",
553 strerror(errno), NULL);
555 if (Urename(temp_fn, filename) < 0)
556 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
557 temp_fn, filename), strerror(errno), NULL);
559 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
562 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
569 /*************************************************
570 * Variables re-expanded post-SNI *
571 *************************************************/
573 /* Called from both server and client code, via tls_init(), and also from
574 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
576 We can tell the two apart by state->received_sni being non-NULL in callback.
578 The callback should not call us unless state->trigger_sni_changes is true,
579 which we are responsible for setting on the first pass through.
582 state exim_gnutls_state_st *
584 Returns: OK/DEFER/FAIL
588 tls_expand_session_files(exim_gnutls_state_st *state)
591 const host_item *host = state->host; /* macro should be reconsidered? */
592 uschar *saved_tls_certificate = NULL;
593 uschar *saved_tls_privatekey = NULL;
594 uschar *saved_tls_verify_certificates = NULL;
595 uschar *saved_tls_crl = NULL;
598 /* We check for tls_sni *before* expansion. */
601 if (!state->received_sni)
603 if (Ustrstr(state->tls_certificate, US"tls_sni"))
605 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
606 state->trigger_sni_changes = TRUE;
611 saved_tls_certificate = state->exp_tls_certificate;
612 saved_tls_privatekey = state->exp_tls_privatekey;
613 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
614 saved_tls_crl = state->exp_tls_crl;
618 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
619 state members, assuming consistent naming; and expand_check() returns
620 false if expansion failed, unless expansion was forced to fail. */
622 /* check if we at least have a certificate, before doing expensive
625 if (!expand_check_tlsvar(tls_certificate))
628 /* certificate is mandatory in server, optional in client */
630 if ((state->exp_tls_certificate == NULL) ||
631 (*state->exp_tls_certificate == '\0'))
633 if (state->host == NULL)
634 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
636 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
639 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
642 /* tls_privatekey is optional, defaulting to same file as certificate */
644 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
646 state->tls_privatekey = state->tls_certificate;
647 state->exp_tls_privatekey = state->exp_tls_certificate;
651 if (state->exp_tls_certificate && *state->exp_tls_certificate)
654 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
655 state->exp_tls_certificate, state->exp_tls_privatekey);
657 if (state->received_sni)
659 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
660 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
662 DEBUG(D_tls) debug_printf("cert and key unchanged with SNI.\n");
667 DEBUG(D_tls) debug_printf("SNI changed cert/key pair.\n");
673 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
674 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
675 GNUTLS_X509_FMT_PEM);
676 exim_gnutls_err_check(
677 string_sprintf("cert/key setup: cert=%s key=%s",
678 state->exp_tls_certificate, state->exp_tls_privatekey));
682 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
683 provided. Experiment shows that, if the certificate file is empty, an unhelpful
684 error message is provided. However, if we just refrain from setting anything up
685 in that case, certificate verification fails, which seems to be the correct
688 if (state->tls_verify_certificates && *state->tls_verify_certificates)
691 BOOL setit_vc = TRUE, setit_crl = TRUE;
693 if (!expand_check_tlsvar(tls_verify_certificates))
695 if (state->tls_crl && *state->tls_crl)
696 if (!expand_check_tlsvar(tls_crl))
699 if (state->received_sni)
701 if (Ustrcmp(state->exp_tls_verify_certificates, saved_tls_verify_certificates) == 0)
703 if (Ustrcmp(state->exp_tls_crl, saved_tls_crl) == 0)
707 /* nb: early exit; change if add more expansions to this function */
708 if (!(setit_vc || setit_crl))
711 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
713 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
714 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
719 if (!S_ISREG(statbuf.st_mode))
722 debug_printf("verify certificates path is not a file: \"%s\"\n%s\n",
723 state->exp_tls_verify_certificates,
724 S_ISDIR(statbuf.st_mode)
725 ? " it's a directory, that's OpenSSL, this is GnuTLS"
726 : " (not a directory either)");
727 log_write(0, LOG_MAIN|LOG_PANIC,
728 "tls_verify_certificates \"%s\" is not a file",
729 state->exp_tls_verify_certificates);
733 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
734 state->exp_tls_verify_certificates, statbuf.st_size);
736 /* If the CA cert file is empty, there's no point in loading the CRL file,
737 as we aren't verifying, so checking for revocation is pointless. */
739 if (statbuf.st_size > 0)
743 cert_count = gnutls_certificate_set_x509_trust_file(state->x509_cred,
744 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
748 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
750 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
753 if (setit_crl && state->tls_crl && *state->tls_crl)
755 if (state->exp_tls_crl && *state->exp_tls_crl)
757 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
758 rc = gnutls_certificate_set_x509_crl_file(state->x509_cred,
759 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
760 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
763 } /* statbuf.st_size */
764 } /* tls_verify_certificates */
767 /* also above, during verify_certificates/crl, during SNI, if unchanged */
773 /*************************************************
774 * Initialize for GnuTLS *
775 *************************************************/
777 /* Called from both server and client code. In the case of a server, errors
778 before actual TLS negotiation return DEFER.
781 host connected host, if client; NULL if server
782 certificate certificate file
783 privatekey private key file
784 sni TLS SNI to send, sometimes when client; else NULL
787 require_ciphers tls_require_ciphers setting
789 Returns: OK/DEFER/FAIL
794 const host_item *host,
795 const uschar *certificate,
796 const uschar *privatekey,
800 const uschar *require_ciphers,
801 exim_gnutls_state_st **caller_state)
803 exim_gnutls_state_st *state;
808 BOOL want_default_priorities;
810 if (!exim_gnutls_base_init_done)
812 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
814 rc = gnutls_global_init();
815 exim_gnutls_err_check(US"gnutls_global_init");
817 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
820 gnutls_global_set_log_function(exim_gnutls_logger_cb);
821 /* arbitrarily chosen level; bump upto 9 for more */
822 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
826 exim_gnutls_base_init_done = TRUE;
831 state = &state_client;
832 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
833 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
834 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
838 state = &state_server;
839 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
840 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
841 rc = gnutls_init(&state->session, GNUTLS_SERVER);
843 exim_gnutls_err_check(US"gnutls_init");
847 state->tls_certificate = certificate;
848 state->tls_privatekey = privatekey;
849 state->tls_sni = sni;
850 state->tls_verify_certificates = cas;
851 state->tls_crl = crl;
853 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
854 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
856 /* This handles the variables that might get re-expanded after TLS SNI;
857 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
860 debug_printf("Expanding various TLS configuration options for session credentials.\n");
861 rc = tls_expand_session_files(state);
862 if (rc != OK) return rc;
864 /* Create D-H parameters, or read them from the cache file. This function does
865 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
866 client-side params. */
870 rc = init_server_dh();
871 if (rc != OK) return rc;
872 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
875 /* Link the credentials to the session. */
877 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
878 exim_gnutls_err_check(US"gnutls_credentials_set");
880 /* set SNI in client, only */
883 if (!expand_check_tlsvar(tls_sni))
885 if (state->exp_tls_sni && *state->exp_tls_sni)
888 debug_printf("Setting TLS client SNI to \"%s\"\n", state->exp_tls_sni);
889 sz = Ustrlen(state->exp_tls_sni);
890 rc = gnutls_server_name_set(state->session,
891 GNUTLS_NAME_DNS, state->exp_tls_sni, sz);
892 exim_gnutls_err_check(US"gnutls_server_name_set");
895 else if (state->tls_sni)
896 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
897 "have an SNI set for a client [%s]\n", state->tls_sni);
899 /* This is the priority string support,
900 http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html
901 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
902 This was backwards incompatible, but means Exim no longer needs to track
903 all algorithms and provide string forms for them. */
905 want_default_priorities = TRUE;
907 if (state->tls_require_ciphers && *state->tls_require_ciphers)
909 if (!expand_check_tlsvar(tls_require_ciphers))
911 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
913 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
914 state->exp_tls_require_ciphers);
916 rc = gnutls_priority_init(&state->priority_cache,
917 CS state->exp_tls_require_ciphers, &errpos);
918 want_default_priorities = FALSE;
919 p = state->exp_tls_require_ciphers;
922 if (want_default_priorities)
924 rc = gnutls_priority_init(&state->priority_cache,
925 exim_default_gnutls_priority, &errpos);
926 p = US exim_default_gnutls_priority;
929 exim_gnutls_err_check(string_sprintf(
930 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
931 p, errpos - CS p, errpos));
933 rc = gnutls_priority_set(state->session, state->priority_cache);
934 exim_gnutls_err_check(US"gnutls_priority_set");
936 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
938 /* Reduce security in favour of increased compatibility, if the admin
939 decides to make that trade-off. */
940 if (gnutls_compat_mode)
942 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
943 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
944 gnutls_session_enable_compatibility_mode(state->session);
946 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
950 *caller_state = state;
951 /* needs to happen before callbacks during handshake */
952 current_global_tls_state = state;
959 /*************************************************
960 * Extract peer information *
961 *************************************************/
963 /* Called from both server and client code.
964 Only this is allowed to set state->peerdn and we use that to detect double-calls.
967 state exim_gnutls_state_st *
969 Returns: OK/DEFER/FAIL
973 peer_status(exim_gnutls_state_st *state)
975 const gnutls_datum *cert_list;
977 unsigned int cert_list_size = 0;
978 gnutls_certificate_type_t ct;
979 gnutls_x509_crt_t crt;
986 state->peerdn = US"unknown";
988 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
990 if (cert_list == NULL || cert_list_size == 0)
992 state->peerdn = US"unknown (no certificate)";
993 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
994 cert_list, cert_list_size);
995 if (state->verify_requirement == VERIFY_REQUIRED)
996 return tls_error(US"certificate verification failed",
997 "no certificate received from peer", state->host);
1001 ct = gnutls_certificate_type_get(state->session);
1002 if (ct != GNUTLS_CRT_X509)
1004 const char *ctn = gnutls_certificate_type_get_name(ct);
1005 state->peerdn = string_sprintf("unknown (type %s)", ctn);
1007 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1008 if (state->verify_requirement == VERIFY_REQUIRED)
1009 return tls_error(US"certificate verification not possible, unhandled type",
1014 #define exim_gnutls_peer_err(Label) do { \
1015 if (rc != GNUTLS_E_SUCCESS) { \
1016 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1017 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1018 return OK; } } while (0)
1020 rc = gnutls_x509_crt_init(&crt);
1021 exim_gnutls_peer_err(US"gnutls_x509_crt_init (crt)");
1023 rc = gnutls_x509_crt_import(crt, &cert_list[0], GNUTLS_X509_FMT_DER);
1024 exim_gnutls_peer_err(US"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1026 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1027 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1029 exim_gnutls_peer_err(US"getting size for cert DN failed");
1030 return FAIL; /* should not happen */
1032 dn_buf = store_get_perm(sz);
1033 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1034 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1035 state->peerdn = dn_buf;
1038 #undef exim_gnutls_peer_err
1044 /*************************************************
1045 * Verify peer certificate *
1046 *************************************************/
1048 /* Called from both server and client code.
1049 *Should* be using a callback registered with
1050 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1051 the peer information, but that's too new for some OSes.
1054 state exim_gnutls_state_st *
1055 error where to put an error message
1058 FALSE if the session should be rejected
1059 TRUE if the cert is okay or we just don't care
1063 verify_certificate(exim_gnutls_state_st *state, const char **error)
1066 unsigned int verify;
1070 rc = peer_status(state);
1073 verify = GNUTLS_CERT_INVALID;
1074 *error = "not supplied";
1078 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1081 /* Handle the result of verification. INVALID seems to be set as well
1082 as REVOKED, but leave the test for both. */
1084 if ((rc < 0) || (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
1086 state->peer_cert_verified = FALSE;
1088 *error = ((verify & GNUTLS_CERT_REVOKED) != 0) ? "revoked" : "invalid";
1091 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
1092 *error, state->peerdn);
1094 if (state->verify_requirement == VERIFY_REQUIRED)
1096 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1100 debug_printf("TLS verify failure overriden (host in tls_try_verify_hosts)\n");
1104 state->peer_cert_verified = TRUE;
1105 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=%s\n", state->peerdn);
1108 tls_peerdn = state->peerdn;
1116 /* ------------------------------------------------------------------------ */
1119 /* Logging function which can be registered with
1120 * gnutls_global_set_log_function()
1121 * gnutls_global_set_log_level() 0..9
1123 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1125 exim_gnutls_logger_cb(int level, const char *message)
1127 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s\n", level, message);
1132 /* Called after client hello, should handle SNI work.
1133 This will always set tls_sni (state->received_sni) if available,
1134 and may trigger presenting different certificates,
1135 if state->trigger_sni_changes is TRUE.
1137 Should be registered with
1138 gnutls_handshake_set_post_client_hello_function()
1140 "This callback must return 0 on success or a gnutls error code to terminate the
1143 For inability to get SNI information, we return 0.
1144 We only return non-zero if re-setup failed.
1148 exim_sni_handling_cb(gnutls_session_t session)
1150 char sni_name[MAX_HOST_LEN];
1151 size_t data_len = MAX_HOST_LEN;
1152 exim_gnutls_state_st *state = current_global_tls_state;
1153 unsigned int sni_type;
1156 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1157 exim_gnutls_err_debugreturn0("gnutls_server_name_get()");
1158 if (sni_type != GNUTLS_NAME_DNS)
1160 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1164 /* We now have a UTF-8 string in sni_name */
1165 old_pool = store_pool;
1166 store_pool = POOL_PERM;
1167 state->received_sni = string_copyn(US sni_name, data_len);
1168 store_pool = old_pool;
1170 /* We set this one now so that variable expansions below will work */
1171 tls_sni = state->received_sni;
1173 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1174 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1176 if (!state->trigger_sni_changes)
1179 rc = tls_expand_session_files(state);
1182 /* If the setup of certs/etc failed before handshake, TLS would not have
1183 been offered. The best we can do now is abort. */
1184 return GNUTLS_E_APPLICATION_ERROR_MIN;
1187 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1188 return (rc == GNUTLS_E_SUCCESS) ? 0 : rc;
1194 /* ------------------------------------------------------------------------ */
1195 /* Exported functions */
1200 /*************************************************
1201 * Start a TLS session in a server *
1202 *************************************************/
1204 /* This is called when Exim is running as a server, after having received
1205 the STARTTLS command. It must respond to that command, and then negotiate
1209 require_ciphers list of allowed ciphers or NULL
1211 Returns: OK on success
1212 DEFER for errors before the start of the negotiation
1213 FAIL for errors during the negotation; the server can't
1218 tls_server_start(const uschar *require_ciphers)
1222 exim_gnutls_state_st *state = NULL;
1224 /* Check for previous activation */
1225 /* nb: this will not be TLS callout safe, needs reworking as part of that. */
1227 if (tls_active >= 0)
1229 tls_error(US"STARTTLS received after TLS started", "", NULL);
1230 smtp_printf("554 Already in TLS\r\n");
1234 /* Initialize the library. If it fails, it will already have logged the error
1235 and sent an SMTP response. */
1237 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1239 rc = tls_init(NULL, tls_certificate, tls_privatekey,
1240 NULL, tls_verify_certificates, tls_crl,
1241 require_ciphers, &state);
1242 if (rc != OK) return rc;
1244 /* If this is a host for which certificate verification is mandatory or
1245 optional, set up appropriately. */
1247 if (verify_check_host(&tls_verify_hosts) == OK)
1249 DEBUG(D_tls) debug_printf("TLS: a client certificate will be required.\n");
1250 state->verify_requirement = VERIFY_REQUIRED;
1251 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1253 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1255 DEBUG(D_tls) debug_printf("TLS: a client certificate will be requested but not required.\n");
1256 state->verify_requirement = VERIFY_OPTIONAL;
1257 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1261 DEBUG(D_tls) debug_printf("TLS: a client certificate will not be requested.\n");
1262 state->verify_requirement = VERIFY_NONE;
1263 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1266 /* Register SNI handling; always, even if not in tls_certificate, so that the
1267 expansion variable $tls_sni is always available. */
1269 gnutls_handshake_set_post_client_hello_function(state->session,
1270 exim_sni_handling_cb);
1272 /* Set context and tell client to go ahead, except in the case of TLS startup
1273 on connection, where outputting anything now upsets the clients and tends to
1274 make them disconnect. We need to have an explicit fflush() here, to force out
1275 the response. Other smtp_printf() calls do not need it, because in non-TLS
1276 mode, the fflush() happens when smtp_getc() is called. */
1278 if (!tls_on_connect)
1280 smtp_printf("220 TLS go ahead\r\n");
1284 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1285 that the GnuTLS library doesn't. */
1287 gnutls_transport_set_ptr2(state->session,
1288 (gnutls_transport_ptr)fileno(smtp_in),
1289 (gnutls_transport_ptr)fileno(smtp_out));
1290 state->fd_in = fileno(smtp_in);
1291 state->fd_out = fileno(smtp_out);
1293 sigalrm_seen = FALSE;
1294 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1297 rc = gnutls_handshake(state->session);
1298 } while ((rc == GNUTLS_E_AGAIN) || (rc == GNUTLS_E_INTERRUPTED));
1301 if (rc != GNUTLS_E_SUCCESS)
1303 tls_error(US"gnutls_handshake",
1304 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
1305 /* It seems that, except in the case of a timeout, we have to close the
1306 connection right here; otherwise if the other end is running OpenSSL it hangs
1307 until the server times out. */
1311 (void)fclose(smtp_out);
1312 (void)fclose(smtp_in);
1318 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1320 /* Verify after the fact */
1322 if (state->verify_requirement != VERIFY_NONE)
1324 if (!verify_certificate(state, &error))
1326 if (state->verify_requirement == VERIFY_OPTIONAL)
1329 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1334 tls_error(US"certificate verification failed", error, NULL);
1340 /* Figure out peer DN, and if authenticated, etc. */
1342 rc = peer_status(state);
1343 if (rc != OK) return rc;
1345 /* Sets various Exim expansion variables; always safe within server */
1347 extract_exim_vars_from_tls_state(state);
1349 /* TLS has been set up. Adjust the input functions to read via TLS,
1350 and initialize appropriately. */
1352 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1354 receive_getc = tls_getc;
1355 receive_ungetc = tls_ungetc;
1356 receive_feof = tls_feof;
1357 receive_ferror = tls_ferror;
1358 receive_smtp_buffered = tls_smtp_buffered;
1366 /*************************************************
1367 * Start a TLS session in a client *
1368 *************************************************/
1370 /* Called from the smtp transport after STARTTLS has been accepted.
1373 fd the fd of the connection
1374 host connected host (for messages)
1375 addr the first address (not used)
1376 dhparam DH parameter file (ignored, we're a client)
1377 certificate certificate file
1378 privatekey private key file
1379 sni TLS SNI to send to remote host
1380 verify_certs file for certificate verify
1381 verify_crl CRL for verify
1382 require_ciphers list of allowed ciphers or NULL
1383 timeout startup timeout
1385 Returns: OK/DEFER/FAIL (because using common functions),
1386 but for a client, DEFER and FAIL have the same meaning
1390 tls_client_start(int fd, host_item *host,
1391 address_item *addr ARG_UNUSED, uschar *dhparam ARG_UNUSED,
1392 uschar *certificate, uschar *privatekey, uschar *sni,
1393 uschar *verify_certs, uschar *verify_crl,
1394 uschar *require_ciphers, int timeout)
1398 exim_gnutls_state_st *state = NULL;
1400 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
1402 rc = tls_init(host, certificate, privatekey,
1403 sni, verify_certs, verify_crl, require_ciphers, &state);
1404 if (rc != OK) return rc;
1406 gnutls_dh_set_prime_bits(state->session, EXIM_CLIENT_DH_MIN_BITS);
1408 if (verify_certs == NULL)
1410 DEBUG(D_tls) debug_printf("TLS: server certificate verification not required\n");
1411 state->verify_requirement = VERIFY_NONE;
1412 /* we still ask for it, to log it, etc */
1413 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1417 DEBUG(D_tls) debug_printf("TLS: server certificate verification required\n");
1418 state->verify_requirement = VERIFY_REQUIRED;
1419 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1422 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)fd);
1426 /* There doesn't seem to be a built-in timeout on connection. */
1428 sigalrm_seen = FALSE;
1432 rc = gnutls_handshake(state->session);
1433 } while ((rc == GNUTLS_E_AGAIN) || (rc == GNUTLS_E_INTERRUPTED));
1436 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1440 if (state->verify_requirement != VERIFY_NONE &&
1441 !verify_certificate(state, &error))
1442 return tls_error(US"certificate verification failed", error, state->host);
1444 /* Figure out peer DN, and if authenticated, etc. */
1446 rc = peer_status(state);
1447 if (rc != OK) return rc;
1449 /* Sets various Exim expansion variables; always safe within server */
1451 extract_exim_vars_from_tls_state(state);
1459 /*************************************************
1460 * Close down a TLS session *
1461 *************************************************/
1463 /* This is also called from within a delivery subprocess forked from the
1464 daemon, to shut down the TLS library, without actually doing a shutdown (which
1465 would tamper with the TLS session in the parent process).
1467 Arguments: TRUE if gnutls_bye is to be called
1472 tls_close(BOOL shutdown)
1474 exim_gnutls_state_st *state = current_global_tls_state;
1476 if (tls_active < 0) return; /* TLS was not active */
1480 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1481 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1484 gnutls_deinit(state->session);
1486 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1488 if ((state_server.session == NULL) && (state_client.session == NULL))
1490 gnutls_global_deinit();
1491 exim_gnutls_base_init_done = FALSE;
1500 /*************************************************
1501 * TLS version of getc *
1502 *************************************************/
1504 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
1505 it refills the buffer via the GnuTLS reading function.
1507 This feeds DKIM and should be used for all message-body reads.
1510 Returns: the next character or EOF
1516 exim_gnutls_state_st *state = current_global_tls_state;
1517 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
1521 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1522 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
1524 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1525 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
1526 ssl_xfer_buffer_size);
1529 /* A zero-byte return appears to mean that the TLS session has been
1530 closed down, not that the socket itself has been closed down. Revert to
1531 non-TLS handling. */
1535 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1537 receive_getc = smtp_getc;
1538 receive_ungetc = smtp_ungetc;
1539 receive_feof = smtp_feof;
1540 receive_ferror = smtp_ferror;
1541 receive_smtp_buffered = smtp_buffered;
1543 gnutls_deinit(state->session);
1544 state->session = NULL;
1547 tls_certificate_verified = FALSE;
1548 tls_channelbinding_b64 = NULL;
1555 /* Handle genuine errors */
1557 else if (inbytes < 0)
1559 record_io_error(state, (int) inbytes, US"recv", NULL);
1560 state->xfer_error = 1;
1563 #ifndef DISABLE_DKIM
1564 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
1566 state->xfer_buffer_hwm = (int) inbytes;
1567 state->xfer_buffer_lwm = 0;
1570 /* Something in the buffer; return next uschar */
1572 return state->xfer_buffer[state->xfer_buffer_lwm++];
1578 /*************************************************
1579 * Read bytes from TLS channel *
1580 *************************************************/
1582 /* This does not feed DKIM, so if the caller uses this for reading message body,
1583 then the caller must feed DKIM.
1588 Returns: the number of bytes read
1589 -1 after a failed read
1593 tls_read(uschar *buff, size_t len)
1595 exim_gnutls_state_st *state = current_global_tls_state;
1601 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
1603 debug_printf("*** PROBABLY A BUG *** " \
1604 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1605 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
1608 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
1609 state->session, buff, len);
1611 inbytes = gnutls_record_recv(state->session, buff, len);
1612 if (inbytes > 0) return inbytes;
1615 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1617 else record_io_error(state, (int)inbytes, US"recv", NULL);
1625 /*************************************************
1626 * Write bytes down TLS channel *
1627 *************************************************/
1634 Returns: the number of bytes after a successful write,
1635 -1 after a failed write
1639 tls_write(const uschar *buff, size_t len)
1643 exim_gnutls_state_st *state = current_global_tls_state;
1645 DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
1648 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
1650 outbytes = gnutls_record_send(state->session, buff, left);
1652 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
1655 record_io_error(state, outbytes, US"send", NULL);
1660 record_io_error(state, 0, US"send", US"TLS channel closed on write");
1671 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
1682 /*************************************************
1683 * Random number generation *
1684 *************************************************/
1686 /* Pseudo-random number generation. The result is not expected to be
1687 cryptographically strong but not so weak that someone will shoot themselves
1688 in the foot using it as a nonce in input in some email header scheme or
1689 whatever weirdness they'll twist this into. The result should handle fork()
1690 and avoid repeating sequences. OpenSSL handles that for us.
1694 Returns a random number in range [0, max-1]
1697 #ifdef HAVE_GNUTLS_RND
1699 vaguely_random_number(int max)
1704 uschar smallbuf[sizeof(r)];
1709 needed_len = sizeof(r);
1710 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
1711 * asked for a number less than 10. */
1712 for (r = max, i = 0; r; ++i)
1718 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
1721 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
1722 return vaguely_random_number_fallback(max);
1725 for (p = smallbuf; needed_len; --needed_len, ++p)
1731 /* We don't particularly care about weighted results; if someone wants
1732 * smooth distribution and cares enough then they should submit a patch then. */
1735 #else /* HAVE_GNUTLS_RND */
1737 vaguely_random_number(int max)
1739 return vaguely_random_number_fallback(max);
1741 #endif /* HAVE_GNUTLS_RND */
1746 /*************************************************
1747 * Report the library versions. *
1748 *************************************************/
1750 /* See a description in tls-openssl.c for an explanation of why this exists.
1752 Arguments: a FILE* to print the results to
1757 tls_version_report(FILE *f)
1759 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
1762 gnutls_check_version(NULL));
1765 /* End of tls-gnu.c */