1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
43 /* needed to disable PKCS11 autoload unless requested */
44 #if GNUTLS_VERSION_NUMBER >= 0x020c00
45 # include <gnutls/pkcs11.h>
46 # define SUPPORT_PARAM_TO_PK_BITS
48 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
52 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
53 # warning "GnuTLS library version too old; tls:cert event unsupported"
54 # define DISABLE_EVENT
56 #if GNUTLS_VERSION_NUMBER >= 0x030306
57 # define SUPPORT_CA_DIR
59 # undef SUPPORT_CA_DIR
61 #if GNUTLS_VERSION_NUMBER >= 0x030014
62 # define SUPPORT_SYSDEFAULT_CABUNDLE
64 #if GNUTLS_VERSION_NUMBER >= 0x030104
65 # define GNUTLS_CERT_VFY_STATUS_PRINT
67 #if GNUTLS_VERSION_NUMBER >= 0x030109
70 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
71 # define SUPPORT_SRV_OCSP_STACK
75 # if GNUTLS_VERSION_NUMBER >= 0x030000
76 # define DANESSL_USAGE_DANE_TA 2
77 # define DANESSL_USAGE_DANE_EE 3
79 # error GnuTLS version too early for DANE
81 # if GNUTLS_VERSION_NUMBER < 0x999999
82 # define GNUTLS_BROKEN_DANE_VALIDATION
87 # include <gnutls/ocsp.h>
90 # include <gnutls/dane.h>
96 gnutls_global_set_audit_log_function()
99 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
102 /* Local static variables for GnuTLS */
104 /* Values for verify_requirement */
106 enum peer_verify_requirement
107 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
109 /* This holds most state for server or client; with this, we can set up an
110 outbound TLS-enabled connection in an ACL callout, while not stomping all
111 over the TLS variables available for expansion.
113 Some of these correspond to variables in globals.c; those variables will
114 be set to point to content in one of these instances, as appropriate for
115 the stage of the process lifetime.
117 Not handled here: global tls_channelbinding_b64.
120 typedef struct exim_gnutls_state {
121 gnutls_session_t session;
122 gnutls_certificate_credentials_t x509_cred;
123 gnutls_priority_t priority_cache;
124 enum peer_verify_requirement verify_requirement;
127 BOOL peer_cert_verified;
128 BOOL peer_dane_verified;
129 BOOL trigger_sni_changes;
130 BOOL have_set_peerdn;
131 const struct host_item *host; /* NULL if server */
132 gnutls_x509_crt_t peercert;
135 uschar *received_sni;
137 const uschar *tls_certificate;
138 const uschar *tls_privatekey;
139 const uschar *tls_sni; /* client send only, not received */
140 const uschar *tls_verify_certificates;
141 const uschar *tls_crl;
142 const uschar *tls_require_ciphers;
144 uschar *exp_tls_certificate;
145 uschar *exp_tls_privatekey;
146 uschar *exp_tls_verify_certificates;
148 uschar *exp_tls_require_ciphers;
149 const uschar *exp_tls_verify_cert_hostnames;
150 #ifndef DISABLE_EVENT
151 uschar *event_action;
154 char * const * dane_data;
155 const int * dane_data_len;
158 tls_support *tlsp; /* set in tls_init() */
163 BOOL xfer_eof; /*XXX never gets set! */
165 } exim_gnutls_state_st;
167 static const exim_gnutls_state_st exim_gnutls_state_init = {
170 .priority_cache = NULL,
171 .verify_requirement = VERIFY_NONE,
174 .peer_cert_verified = FALSE,
175 .peer_dane_verified = FALSE,
176 .trigger_sni_changes =FALSE,
177 .have_set_peerdn = FALSE,
182 .received_sni = NULL,
184 .tls_certificate = NULL,
185 .tls_privatekey = NULL,
187 .tls_verify_certificates = NULL,
189 .tls_require_ciphers =NULL,
191 .exp_tls_certificate = NULL,
192 .exp_tls_privatekey = NULL,
193 .exp_tls_verify_certificates = NULL,
195 .exp_tls_require_ciphers = NULL,
196 .exp_tls_verify_cert_hostnames = NULL,
197 #ifndef DISABLE_EVENT
198 .event_action = NULL,
203 .xfer_buffer_lwm = 0,
204 .xfer_buffer_hwm = 0,
209 /* Not only do we have our own APIs which don't pass around state, assuming
210 it's held in globals, GnuTLS doesn't appear to let us register callback data
211 for callbacks, or as part of the session, so we have to keep a "this is the
212 context we're currently dealing with" pointer and rely upon being
213 single-threaded to keep from processing data on an inbound TLS connection while
214 talking to another TLS connection for an outbound check. This does mean that
215 there's no way for heart-beats to be responded to, for the duration of the
217 XXX But see gnutls_session_get_ptr()
220 static exim_gnutls_state_st state_server;
222 /* dh_params are initialised once within the lifetime of a process using TLS;
223 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
224 don't want to repeat this. */
226 static gnutls_dh_params_t dh_server_params = NULL;
228 /* No idea how this value was chosen; preserving it. Default is 3600. */
230 static const int ssl_session_timeout = 200;
232 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
234 /* Guard library core initialisation */
236 static BOOL exim_gnutls_base_init_done = FALSE;
239 static BOOL gnutls_buggy_ocsp = FALSE;
243 /* ------------------------------------------------------------------------ */
246 #define MAX_HOST_LEN 255
248 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
249 the library logging; a value less than 0 disables the calls to set up logging
250 callbacks. Possibly GNuTLS also looks for an environment variable
251 "GNUTLS_DEBUG_LEVEL". */
252 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
253 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
256 #ifndef EXIM_CLIENT_DH_MIN_BITS
257 # define EXIM_CLIENT_DH_MIN_BITS 1024
260 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
261 can ask for a bit-strength. Without that, we stick to the constant we had
263 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
264 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
267 #define exim_gnutls_err_check(rc, Label) do { \
268 if ((rc) != GNUTLS_E_SUCCESS) \
269 return tls_error((Label), US gnutls_strerror(rc), host, errstr); \
272 #define expand_check_tlsvar(Varname, errstr) \
273 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
275 #if GNUTLS_VERSION_NUMBER >= 0x020c00
276 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
277 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
278 # define HAVE_GNUTLS_RND
279 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
280 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
281 * isn't available sometimes, so this needs to become a conditional
282 * compilation; the sanest way to deal with this being a problem on
283 * older OSes is to block it in the Local/Makefile with this compiler
285 # ifndef AVOID_GNUTLS_PKCS11
286 # define HAVE_GNUTLS_PKCS11
287 # endif /* AVOID_GNUTLS_PKCS11 */
293 /* ------------------------------------------------------------------------ */
294 /* Callback declarations */
296 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
297 static void exim_gnutls_logger_cb(int level, const char *message);
300 static int exim_sni_handling_cb(gnutls_session_t session);
303 static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
304 gnutls_datum_t * ocsp_response);
309 /* ------------------------------------------------------------------------ */
310 /* Static functions */
312 /*************************************************
314 *************************************************/
316 /* Called from lots of places when errors occur before actually starting to do
317 the TLS handshake, that is, while the session is still in clear. Always returns
318 DEFER for a server and FAIL for a client so that most calls can use "return
319 tls_error(...)" to do this processing and then give an appropriate return. A
320 single function is used for both server and client, because it is called from
321 some shared functions.
324 prefix text to include in the logged error
325 msg additional error string (may be NULL)
326 usually obtained from gnutls_strerror()
327 host NULL if setting up a server;
328 the connected host if setting up a client
329 errstr pointer to returned error string
331 Returns: OK/DEFER/FAIL
335 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
339 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
340 return host ? FAIL : DEFER;
346 /*************************************************
347 * Deal with logging errors during I/O *
348 *************************************************/
350 /* We have to get the identity of the peer from saved data.
353 state the current GnuTLS exim state container
354 rc the GnuTLS error code, or 0 if it's a local error
355 when text identifying read or write
356 text local error text when ec is 0
362 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
367 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
368 msg = string_sprintf("%s: %s", US gnutls_strerror(rc),
369 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
371 msg = US gnutls_strerror(rc);
373 (void) tls_error(when, msg, state->host, &errstr);
376 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
377 state->host->name, state->host->address, errstr);
380 uschar * conn_info = smtp_get_connection_info();
381 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
382 /* I'd like to get separated H= here, but too hard for now */
383 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
390 /*************************************************
391 * Set various Exim expansion vars *
392 *************************************************/
394 #define exim_gnutls_cert_err(Label) \
397 if (rc != GNUTLS_E_SUCCESS) \
399 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
400 (Label), gnutls_strerror(rc)); \
406 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
410 rc = gnutls_x509_crt_init(crtp);
411 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
413 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
414 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
419 #undef exim_gnutls_cert_err
422 /* We set various Exim global variables from the state, once a session has
423 been established. With TLS callouts, may need to change this to stack
424 variables, or just re-call it with the server state after client callout
427 Make sure anything set here is unset in tls_getc().
431 tls_bits strength indicator
432 tls_certificate_verified bool indicator
433 tls_channelbinding_b64 for some SASL mechanisms
435 tls_peercert pointer to library internal
437 tls_sni a (UTF-8) string
438 tls_ourcert pointer to library internal
441 state the relevant exim_gnutls_state_st *
445 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
447 gnutls_cipher_algorithm_t cipher;
448 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
451 gnutls_datum_t channel;
453 tls_support * tlsp = state->tlsp;
455 tlsp->active.sock = state->fd_out;
456 tlsp->active.tls_ctx = state;
458 cipher = gnutls_cipher_get(state->session);
459 /* returns size in "bytes" */
460 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
462 tlsp->cipher = state->ciphersuite;
464 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
466 tlsp->certificate_verified = state->peer_cert_verified;
468 tlsp->dane_verified = state->peer_dane_verified;
471 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
472 only available for use for authenticators while this TLS session is running. */
474 tls_channelbinding_b64 = NULL;
475 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
478 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
480 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
482 old_pool = store_pool;
483 store_pool = POOL_PERM;
484 tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
485 store_pool = old_pool;
486 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
490 /* peercert is set in peer_status() */
491 tlsp->peerdn = state->peerdn;
492 tlsp->sni = state->received_sni;
494 /* record our certificate */
496 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
497 gnutls_x509_crt_t crt;
499 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
506 /*************************************************
507 * Setup up DH parameters *
508 *************************************************/
510 /* Generating the D-H parameters may take a long time. They only need to
511 be re-generated every so often, depending on security policy. What we do is to
512 keep these parameters in a file in the spool directory. If the file does not
513 exist, we generate them. This means that it is easy to cause a regeneration.
515 The new file is written as a temporary file and renamed, so that an incomplete
516 file is never present. If two processes both compute some new parameters, you
517 waste a bit of effort, but it doesn't seem worth messing around with locking to
520 Returns: OK/DEFER/FAIL
524 init_server_dh(uschar ** errstr)
527 unsigned int dh_bits;
529 uschar filename_buf[PATH_MAX];
530 uschar *filename = NULL;
532 uschar *exp_tls_dhparam;
533 BOOL use_file_in_spool = FALSE;
534 BOOL use_fixed_file = FALSE;
535 host_item *host = NULL; /* dummy for macros */
537 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
539 rc = gnutls_dh_params_init(&dh_server_params);
540 exim_gnutls_err_check(rc, US"gnutls_dh_params_init");
545 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
548 if (!exp_tls_dhparam)
550 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
551 m.data = US std_dh_prime_default();
552 m.size = Ustrlen(m.data);
554 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
555 use_file_in_spool = TRUE;
556 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
558 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
561 else if (exp_tls_dhparam[0] != '/')
563 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
564 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
565 m.size = Ustrlen(m.data);
569 use_fixed_file = TRUE;
570 filename = exp_tls_dhparam;
575 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
576 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
577 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
581 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
582 /* If you change this constant, also change dh_param_fn_ext so that we can use a
583 different filename and ensure we have sufficient bits. */
584 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
586 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
588 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
591 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
593 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
597 /* Some clients have hard-coded limits. */
598 if (dh_bits > tls_dh_max_bits)
601 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
603 dh_bits = tls_dh_max_bits;
606 if (use_file_in_spool)
608 if (!string_format(filename_buf, sizeof(filename_buf),
609 "%s/gnutls-params-%d", spool_directory, dh_bits))
610 return tls_error(US"overlong filename", NULL, NULL, errstr);
611 filename = filename_buf;
614 /* Open the cache file for reading and if successful, read it and set up the
617 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
623 if (fstat(fd, &statbuf) < 0) /* EIO */
627 return tls_error(US"TLS cache stat failed", US strerror(saved_errno), NULL, errstr);
629 if (!S_ISREG(statbuf.st_mode))
632 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
634 if (!(fp = fdopen(fd, "rb")))
638 return tls_error(US"fdopen(TLS cache stat fd) failed",
639 US strerror(saved_errno), NULL, errstr);
642 m.size = statbuf.st_size;
643 if (!(m.data = malloc(m.size)))
646 return tls_error(US"malloc failed", US strerror(errno), NULL, errstr);
648 if (!(sz = fread(m.data, m.size, 1, fp)))
653 return tls_error(US"fread failed", US strerror(saved_errno), NULL, errstr);
657 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
659 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
660 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
663 /* If the file does not exist, fall through to compute new data and cache it.
664 If there was any other opening error, it is serious. */
666 else if (errno == ENOENT)
670 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
673 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
676 /* If ret < 0, either the cache file does not exist, or the data it contains
677 is not useful. One particular case of this is when upgrading from an older
678 release of Exim in which the data was stored in a different format. We don't
679 try to be clever and support both formats; we just regenerate new data in this
685 unsigned int dh_bits_gen = dh_bits;
687 if ((PATH_MAX - Ustrlen(filename)) < 10)
688 return tls_error(US"Filename too long to generate replacement",
689 filename, NULL, errstr);
691 temp_fn = string_copy(US"%s.XXXXXXX");
692 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
693 return tls_error(US"Unable to open temp file", US strerror(errno), NULL, errstr);
694 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
696 /* GnuTLS overshoots!
697 * If we ask for 2236, we might get 2237 or more.
698 * But there's no way to ask GnuTLS how many bits there really are.
699 * We can ask how many bits were used in a TLS session, but that's it!
700 * The prime itself is hidden behind too much abstraction.
701 * So we ask for less, and proceed on a wing and a prayer.
702 * First attempt, subtracted 3 for 2233 and got 2240.
704 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
706 dh_bits_gen = dh_bits - 10;
708 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
713 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
715 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
716 exim_gnutls_err_check(rc, US"gnutls_dh_params_generate2");
718 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
719 and I confirmed that a NULL call to get the size first is how the GnuTLS
720 sample apps handle this. */
724 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
726 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
727 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3(NULL) sizing");
729 if (!(m.data = malloc(m.size)))
730 return tls_error(US"memory allocation failed", US strerror(errno), NULL, errstr);
732 /* this will return a size 1 less than the allocation size above */
733 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
735 if (rc != GNUTLS_E_SUCCESS)
738 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3() real");
740 m.size = sz; /* shrink by 1, probably */
742 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
745 return tls_error(US"TLS cache write D-H params failed",
746 US strerror(errno), NULL, errstr);
749 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
750 return tls_error(US"TLS cache write D-H params final newline failed",
751 US strerror(errno), NULL, errstr);
753 if ((rc = close(fd)))
754 return tls_error(US"TLS cache write close() failed", US strerror(errno), NULL, errstr);
756 if (Urename(temp_fn, filename) < 0)
757 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
758 temp_fn, filename), US strerror(errno), NULL, errstr);
760 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
763 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
770 /* Create and install a selfsigned certificate, for use in server mode */
773 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
775 gnutls_x509_crt_t cert = NULL;
777 gnutls_x509_privkey_t pkey = NULL;
778 const uschar * where;
781 where = US"initialising pkey";
782 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
784 where = US"initialising cert";
785 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
787 where = US"generating pkey";
788 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
789 #ifdef SUPPORT_PARAM_TO_PK_BITS
790 # ifndef GNUTLS_SEC_PARAM_MEDIUM
791 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
793 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
800 where = US"configuring cert";
802 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
803 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
804 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
805 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
806 || (rc = gnutls_x509_crt_set_key(cert, pkey))
808 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
809 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
810 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
811 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
812 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
813 GNUTLS_OID_X520_COMMON_NAME, 0,
814 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
818 where = US"signing cert";
819 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
821 where = US"installing selfsign cert";
823 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
829 if (cert) gnutls_x509_crt_deinit(cert);
830 if (pkey) gnutls_x509_privkey_deinit(pkey);
834 rc = tls_error(where, US gnutls_strerror(rc), NULL, errstr);
841 /* Add certificate and key, from files.
844 Zero or negative: good. Negate value for certificate index if < 0.
845 Greater than zero: FAIL or DEFER code.
849 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
850 uschar * certfile, uschar * keyfile, uschar ** errstr)
852 int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
853 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
856 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
857 US gnutls_strerror(rc), host, errstr);
862 /*************************************************
863 * Variables re-expanded post-SNI *
864 *************************************************/
866 /* Called from both server and client code, via tls_init(), and also from
867 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
869 We can tell the two apart by state->received_sni being non-NULL in callback.
871 The callback should not call us unless state->trigger_sni_changes is true,
872 which we are responsible for setting on the first pass through.
875 state exim_gnutls_state_st *
876 errstr error string pointer
878 Returns: OK/DEFER/FAIL
882 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
886 const host_item *host = state->host; /* macro should be reconsidered? */
887 uschar *saved_tls_certificate = NULL;
888 uschar *saved_tls_privatekey = NULL;
889 uschar *saved_tls_verify_certificates = NULL;
890 uschar *saved_tls_crl = NULL;
893 /* We check for tls_sni *before* expansion. */
894 if (!host) /* server */
895 if (!state->received_sni)
897 if ( state->tls_certificate
898 && ( Ustrstr(state->tls_certificate, US"tls_sni")
899 || Ustrstr(state->tls_certificate, US"tls_in_sni")
900 || Ustrstr(state->tls_certificate, US"tls_out_sni")
903 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
904 state->trigger_sni_changes = TRUE;
909 /* useful for debugging */
910 saved_tls_certificate = state->exp_tls_certificate;
911 saved_tls_privatekey = state->exp_tls_privatekey;
912 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
913 saved_tls_crl = state->exp_tls_crl;
916 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
917 exim_gnutls_err_check(rc, US"gnutls_certificate_allocate_credentials");
919 #ifdef SUPPORT_SRV_OCSP_STACK
920 gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
923 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
924 state members, assuming consistent naming; and expand_check() returns
925 false if expansion failed, unless expansion was forced to fail. */
927 /* check if we at least have a certificate, before doing expensive
930 if (!expand_check_tlsvar(tls_certificate, errstr))
933 /* certificate is mandatory in server, optional in client */
935 if ( !state->exp_tls_certificate
936 || !*state->exp_tls_certificate
939 return tls_install_selfsign(state, errstr);
941 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
943 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
946 /* tls_privatekey is optional, defaulting to same file as certificate */
948 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
950 state->tls_privatekey = state->tls_certificate;
951 state->exp_tls_privatekey = state->exp_tls_certificate;
955 if (state->exp_tls_certificate && *state->exp_tls_certificate)
957 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
958 state->exp_tls_certificate, state->exp_tls_privatekey);
960 if (state->received_sni)
961 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
962 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
965 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
969 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
972 if (!host) /* server */
974 const uschar * clist = state->exp_tls_certificate;
975 const uschar * klist = state->exp_tls_privatekey;
976 const uschar * olist;
977 int csep = 0, ksep = 0, osep = 0, cnt = 0;
978 uschar * cfile, * kfile, * ofile;
981 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
986 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
988 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
989 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
990 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
994 int gnutls_cert_index = -rc;
995 DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile);
997 /* Set the OCSP stapling server info */
1001 if (gnutls_buggy_ocsp)
1004 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1006 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1008 /* Use the full callback method for stapling just to get
1009 observability. More efficient would be to read the file once only,
1010 if it never changed (due to SNI). Would need restart on file update,
1011 or watch datestamp. */
1013 # ifdef SUPPORT_SRV_OCSP_STACK
1014 rc = gnutls_certificate_set_ocsp_status_request_function2(
1015 state->x509_cred, gnutls_cert_index,
1016 server_ocsp_stapling_cb, ofile);
1018 exim_gnutls_err_check(rc,
1019 US"gnutls_certificate_set_ocsp_status_request_function2");
1024 debug_printf("oops; multiple OCSP files not supported\n");
1027 gnutls_certificate_set_ocsp_status_request_function(
1028 state->x509_cred, server_ocsp_stapling_cb, ofile);
1031 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile);
1034 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1040 if (0 < (rc = tls_add_certfile(state, host,
1041 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1043 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1046 } /* tls_certificate */
1049 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1050 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1051 error message is provided. However, if we just refrain from setting anything up
1052 in that case, certificate verification fails, which seems to be the correct
1055 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1057 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
1059 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1060 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1061 state->exp_tls_verify_certificates = NULL;
1063 if (state->tls_crl && *state->tls_crl)
1064 if (!expand_check_tlsvar(tls_crl, errstr))
1067 if (!(state->exp_tls_verify_certificates &&
1068 *state->exp_tls_verify_certificates))
1071 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1072 /* With no tls_verify_certificates, we ignore tls_crl too */
1079 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1083 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1084 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1085 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1089 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1091 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1092 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1097 #ifndef SUPPORT_CA_DIR
1098 /* The test suite passes in /dev/null; we could check for that path explicitly,
1099 but who knows if someone has some weird FIFO which always dumps some certs, or
1100 other weirdness. The thing we really want to check is that it's not a
1101 directory, since while OpenSSL supports that, GnuTLS does not.
1102 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1103 if (S_ISDIR(statbuf.st_mode))
1106 debug_printf("verify certificates path is a dir: \"%s\"\n",
1107 state->exp_tls_verify_certificates);
1108 log_write(0, LOG_MAIN|LOG_PANIC,
1109 "tls_verify_certificates \"%s\" is a directory",
1110 state->exp_tls_verify_certificates);
1115 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1116 state->exp_tls_verify_certificates, statbuf.st_size);
1118 if (statbuf.st_size == 0)
1121 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1127 #ifdef SUPPORT_CA_DIR
1128 (statbuf.st_mode & S_IFMT) == S_IFDIR
1130 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1131 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1134 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1135 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1141 exim_gnutls_err_check(rc, US"setting certificate trust");
1143 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
1145 if (state->tls_crl && *state->tls_crl &&
1146 state->exp_tls_crl && *state->exp_tls_crl)
1148 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1149 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1150 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1154 exim_gnutls_err_check(rc, US"gnutls_certificate_set_x509_crl_file");
1156 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1165 /*************************************************
1166 * Set X.509 state variables *
1167 *************************************************/
1169 /* In GnuTLS, the registered cert/key are not replaced by a later
1170 set of a cert/key, so for SNI support we need a whole new x509_cred
1171 structure. Which means various other non-re-expanded pieces of state
1172 need to be re-set in the new struct, so the setting logic is pulled
1176 state exim_gnutls_state_st *
1177 errstr error string pointer
1179 Returns: OK/DEFER/FAIL
1183 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1186 const host_item *host = state->host; /* macro should be reconsidered? */
1188 /* Create D-H parameters, or read them from the cache file. This function does
1189 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1190 client-side params. */
1194 if (!dh_server_params)
1196 rc = init_server_dh(errstr);
1197 if (rc != OK) return rc;
1199 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1202 /* Link the credentials to the session. */
1204 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1205 exim_gnutls_err_check(rc, US"gnutls_credentials_set");
1210 /*************************************************
1211 * Initialize for GnuTLS *
1212 *************************************************/
1215 #ifndef DISABLE_OCSP
1218 tls_is_buggy_ocsp(void)
1221 uschar maj, mid, mic;
1223 s = CUS gnutls_check_version(NULL);
1227 while (*s && *s != '.') s++;
1228 mid = atoi(CCS ++s);
1235 while (*s && *s != '.') s++;
1236 mic = atoi(CCS ++s);
1237 return mic <= (mid == 3 ? 16 : 3);
1246 /* Called from both server and client code. In the case of a server, errors
1247 before actual TLS negotiation return DEFER.
1250 host connected host, if client; NULL if server
1251 certificate certificate file
1252 privatekey private key file
1253 sni TLS SNI to send, sometimes when client; else NULL
1256 require_ciphers tls_require_ciphers setting
1257 caller_state returned state-info structure
1258 errstr error string pointer
1260 Returns: OK/DEFER/FAIL
1265 const host_item *host,
1266 const uschar *certificate,
1267 const uschar *privatekey,
1271 const uschar *require_ciphers,
1272 exim_gnutls_state_st **caller_state,
1276 exim_gnutls_state_st *state;
1282 if (!exim_gnutls_base_init_done)
1284 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1286 #ifdef HAVE_GNUTLS_PKCS11
1287 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1288 which loads modules from a config file, which sounds good and may be wanted
1289 by some sysadmin, but also means in common configurations that GNOME keyring
1290 environment variables are used and so breaks for users calling mailq.
1291 To prevent this, we init PKCS11 first, which is the documented approach. */
1292 if (!gnutls_allow_auto_pkcs11)
1294 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1295 exim_gnutls_err_check(rc, US"gnutls_pkcs11_init");
1299 rc = gnutls_global_init();
1300 exim_gnutls_err_check(rc, US"gnutls_global_init");
1302 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1305 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1306 /* arbitrarily chosen level; bump up to 9 for more */
1307 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1311 #ifndef DISABLE_OCSP
1312 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1313 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1316 exim_gnutls_base_init_done = TRUE;
1321 /* For client-side sessions we allocate a context. This lets us run
1322 several in parallel. */
1323 int old_pool = store_pool;
1324 store_pool = POOL_PERM;
1325 state = store_get(sizeof(exim_gnutls_state_st));
1326 store_pool = old_pool;
1328 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1330 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1331 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1335 state = &state_server;
1336 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1338 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1339 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1341 exim_gnutls_err_check(rc, US"gnutls_init");
1345 state->tls_certificate = certificate;
1346 state->tls_privatekey = privatekey;
1347 state->tls_require_ciphers = require_ciphers;
1348 state->tls_sni = sni;
1349 state->tls_verify_certificates = cas;
1350 state->tls_crl = crl;
1352 /* This handles the variables that might get re-expanded after TLS SNI;
1353 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1356 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1357 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1359 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1360 requires a new structure afterwards. */
1362 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
1364 /* set SNI in client, only */
1367 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
1369 if (state->tlsp->sni && *state->tlsp->sni)
1372 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1373 sz = Ustrlen(state->tlsp->sni);
1374 rc = gnutls_server_name_set(state->session,
1375 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
1376 exim_gnutls_err_check(rc, US"gnutls_server_name_set");
1379 else if (state->tls_sni)
1380 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1381 "have an SNI set for a server [%s]\n", state->tls_sni);
1383 /* This is the priority string support,
1384 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1385 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1386 This was backwards incompatible, but means Exim no longer needs to track
1387 all algorithms and provide string forms for them. */
1390 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1392 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
1394 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1396 p = state->exp_tls_require_ciphers;
1397 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
1402 p = exim_default_gnutls_priority;
1404 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1406 rc = gnutls_priority_init(&state->priority_cache, CCS p, &errpos);
1408 exim_gnutls_err_check(rc, string_sprintf(
1409 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1410 p, errpos - CS p, errpos));
1412 rc = gnutls_priority_set(state->session, state->priority_cache);
1413 exim_gnutls_err_check(rc, US"gnutls_priority_set");
1415 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1417 /* Reduce security in favour of increased compatibility, if the admin
1418 decides to make that trade-off. */
1419 if (gnutls_compat_mode)
1421 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1422 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1423 gnutls_session_enable_compatibility_mode(state->session);
1425 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1429 *caller_state = state;
1435 /*************************************************
1436 * Extract peer information *
1437 *************************************************/
1439 /* Called from both server and client code.
1440 Only this is allowed to set state->peerdn and state->have_set_peerdn
1441 and we use that to detect double-calls.
1443 NOTE: the state blocks last while the TLS connection is up, which is fine
1444 for logging in the server side, but for the client side, we log after teardown
1445 in src/deliver.c. While the session is up, we can twist about states and
1446 repoint tls_* globals, but those variables used for logging or other variable
1447 expansion that happens _after_ delivery need to have a longer life-time.
1449 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1450 doing this more than once per generation of a state context. We set them in
1451 the state context, and repoint tls_* to them. After the state goes away, the
1452 tls_* copies of the pointers remain valid and client delivery logging is happy.
1454 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1458 state exim_gnutls_state_st *
1459 errstr pointer to error string
1461 Returns: OK/DEFER/FAIL
1465 peer_status(exim_gnutls_state_st *state, uschar ** errstr)
1467 uschar cipherbuf[256];
1468 const gnutls_datum_t *cert_list;
1470 unsigned int cert_list_size = 0;
1471 gnutls_protocol_t protocol;
1472 gnutls_cipher_algorithm_t cipher;
1473 gnutls_kx_algorithm_t kx;
1474 gnutls_mac_algorithm_t mac;
1475 gnutls_certificate_type_t ct;
1476 gnutls_x509_crt_t crt;
1480 if (state->have_set_peerdn)
1482 state->have_set_peerdn = TRUE;
1484 state->peerdn = NULL;
1487 cipher = gnutls_cipher_get(state->session);
1488 protocol = gnutls_protocol_get_version(state->session);
1489 mac = gnutls_mac_get(state->session);
1490 kx = gnutls_kx_get(state->session);
1492 string_format(cipherbuf, sizeof(cipherbuf),
1494 gnutls_protocol_get_name(protocol),
1495 gnutls_cipher_suite_get_name(kx, cipher, mac),
1496 (int) gnutls_cipher_get_key_size(cipher) * 8);
1498 /* I don't see a way that spaces could occur, in the current GnuTLS
1499 code base, but it was a concern in the old code and perhaps older GnuTLS
1500 releases did return "TLS 1.0"; play it safe, just in case. */
1501 for (p = cipherbuf; *p != '\0'; ++p)
1504 old_pool = store_pool;
1505 store_pool = POOL_PERM;
1506 state->ciphersuite = string_copy(cipherbuf);
1507 store_pool = old_pool;
1508 state->tlsp->cipher = state->ciphersuite;
1511 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1513 if (cert_list == NULL || cert_list_size == 0)
1515 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1516 cert_list, cert_list_size);
1517 if (state->verify_requirement >= VERIFY_REQUIRED)
1518 return tls_error(US"certificate verification failed",
1519 US"no certificate received from peer", state->host, errstr);
1523 ct = gnutls_certificate_type_get(state->session);
1524 if (ct != GNUTLS_CRT_X509)
1526 const uschar *ctn = US gnutls_certificate_type_get_name(ct);
1528 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1529 if (state->verify_requirement >= VERIFY_REQUIRED)
1530 return tls_error(US"certificate verification not possible, unhandled type",
1531 ctn, state->host, errstr);
1535 #define exim_gnutls_peer_err(Label) \
1537 if (rc != GNUTLS_E_SUCCESS) \
1539 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1540 (Label), gnutls_strerror(rc)); \
1541 if (state->verify_requirement >= VERIFY_REQUIRED) \
1542 return tls_error((Label), US gnutls_strerror(rc), state->host, errstr); \
1547 rc = import_cert(&cert_list[0], &crt);
1548 exim_gnutls_peer_err(US"cert 0");
1550 state->tlsp->peercert = state->peercert = crt;
1553 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1554 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1556 exim_gnutls_peer_err(US"getting size for cert DN failed");
1557 return FAIL; /* should not happen */
1559 dn_buf = store_get_perm(sz);
1560 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1561 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1563 state->peerdn = dn_buf;
1566 #undef exim_gnutls_peer_err
1572 /*************************************************
1573 * Verify peer certificate *
1574 *************************************************/
1576 /* Called from both server and client code.
1577 *Should* be using a callback registered with
1578 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1579 the peer information, but that's too new for some OSes.
1582 state exim_gnutls_state_st *
1583 errstr where to put an error message
1586 FALSE if the session should be rejected
1587 TRUE if the cert is okay or we just don't care
1591 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
1596 if (state->verify_requirement == VERIFY_NONE)
1599 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
1602 if ((rc = peer_status(state, errstr)) != OK)
1604 verify = GNUTLS_CERT_INVALID;
1605 *errstr = US"certificate not supplied";
1611 if (state->verify_requirement == VERIFY_DANE && state->host)
1613 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1614 including talking to a DNS resolver. But we want to do that bit ourselves
1615 as the testsuite intercepts and fakes its own DNS environment. */
1620 const gnutls_datum_t * certlist =
1621 gnutls_certificate_get_peers(state->session, &lsize);
1622 int usage = tls_out.tlsa_usage;
1624 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1625 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1626 dane-verification separately so that we know which selector verified;
1627 then we know whether to do name-verification (needed for TA but not EE). */
1629 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
1630 { /* a mixed-usage bundle */
1635 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1638 dd = store_get(nrec * sizeof(uschar *));
1639 ddl = store_get(nrec * sizeof(int));
1642 if ((rc = dane_state_init(&s, 0)))
1645 for (usage = DANESSL_USAGE_DANE_EE;
1646 usage >= DANESSL_USAGE_DANE_TA; usage--)
1647 { /* take records with this usage */
1648 for (j = i = 0; i < nrec; i++)
1649 if (state->dane_data[i][0] == usage)
1651 dd[j] = state->dane_data[i];
1652 ddl[j++] = state->dane_data_len[i];
1659 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1662 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1663 gnutls_certificate_type_get(state->session),
1665 usage == DANESSL_USAGE_DANE_EE
1666 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1670 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1672 else if (verify == 0) /* verification passed */
1680 if (rc) goto tlsa_prob;
1685 if ( (rc = dane_state_init(&s, 0))
1686 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1688 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1689 gnutls_certificate_type_get(state->session),
1691 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1692 usage == (1 << DANESSL_USAGE_DANE_EE)
1693 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1702 if (verify != 0) /* verification failed */
1705 (void) dane_verification_status_print(verify, &str, 0);
1706 *errstr = US str.data; /* don't bother to free */
1710 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1711 /* If a TA-mode TLSA record was used for verification we must additionally
1712 verify the cert name (but not the CA chain). For EE-mode, skip it. */
1714 if (usage & (1 << DANESSL_USAGE_DANE_EE))
1717 state->peer_dane_verified = state->peer_cert_verified = TRUE;
1720 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1721 /* Assume that the name on the A-record is the one that should be matching
1722 the cert. An alternate view is that the domain part of the email address
1723 is also permissible. */
1725 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1726 CS state->host->name))
1728 state->peer_dane_verified = state->peer_cert_verified = TRUE;
1733 #endif /*SUPPORT_DANE*/
1735 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1738 /* Handle the result of verification. INVALID is set if any others are. */
1740 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
1742 state->peer_cert_verified = FALSE;
1745 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
1750 if (gnutls_certificate_verification_status_print(verify,
1751 gnutls_certificate_type_get(state->session), &txt, 0)
1752 == GNUTLS_E_SUCCESS)
1754 debug_printf("%s\n", txt.data);
1755 gnutls_free(txt.data);
1759 *errstr = verify & GNUTLS_CERT_REVOKED
1760 ? US"certificate revoked" : US"certificate invalid";
1764 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1765 *errstr, state->peerdn ? state->peerdn : US"<unset>");
1767 if (state->verify_requirement >= VERIFY_REQUIRED)
1770 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1775 /* Client side, check the server's certificate name versus the name on the
1776 A-record for the connection we made. What to do for server side - what name
1777 to use for client? We document that there is no such checking for server
1780 if ( state->exp_tls_verify_cert_hostnames
1781 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1782 CS state->exp_tls_verify_cert_hostnames)
1786 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1787 if (state->verify_requirement >= VERIFY_REQUIRED)
1792 state->peer_cert_verified = TRUE;
1793 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1794 state->peerdn ? state->peerdn : US"<unset>");
1798 state->tlsp->peerdn = state->peerdn;
1803 *errstr = string_sprintf("TLSA record problem: %s",
1804 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
1808 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1815 /* ------------------------------------------------------------------------ */
1818 /* Logging function which can be registered with
1819 * gnutls_global_set_log_function()
1820 * gnutls_global_set_log_level() 0..9
1822 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1824 exim_gnutls_logger_cb(int level, const char *message)
1826 size_t len = strlen(message);
1829 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1832 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1833 message[len-1] == '\n' ? "" : "\n");
1838 /* Called after client hello, should handle SNI work.
1839 This will always set tls_sni (state->received_sni) if available,
1840 and may trigger presenting different certificates,
1841 if state->trigger_sni_changes is TRUE.
1843 Should be registered with
1844 gnutls_handshake_set_post_client_hello_function()
1846 "This callback must return 0 on success or a gnutls error code to terminate the
1849 For inability to get SNI information, we return 0.
1850 We only return non-zero if re-setup failed.
1851 Only used for server-side TLS.
1855 exim_sni_handling_cb(gnutls_session_t session)
1857 char sni_name[MAX_HOST_LEN];
1858 size_t data_len = MAX_HOST_LEN;
1859 exim_gnutls_state_st *state = &state_server;
1860 unsigned int sni_type;
1862 uschar * dummy_errstr;
1864 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1865 if (rc != GNUTLS_E_SUCCESS)
1868 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1869 debug_printf("TLS: no SNI presented in handshake.\n");
1871 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1872 gnutls_strerror(rc), rc);
1877 if (sni_type != GNUTLS_NAME_DNS)
1879 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1883 /* We now have a UTF-8 string in sni_name */
1884 old_pool = store_pool;
1885 store_pool = POOL_PERM;
1886 state->received_sni = string_copyn(US sni_name, data_len);
1887 store_pool = old_pool;
1889 /* We set this one now so that variable expansions below will work */
1890 state->tlsp->sni = state->received_sni;
1892 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1893 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1895 if (!state->trigger_sni_changes)
1898 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
1900 /* If the setup of certs/etc failed before handshake, TLS would not have
1901 been offered. The best we can do now is abort. */
1902 return GNUTLS_E_APPLICATION_ERROR_MIN;
1905 rc = tls_set_remaining_x509(state, &dummy_errstr);
1906 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1913 #ifndef DISABLE_OCSP
1916 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1917 gnutls_datum_t * ocsp_response)
1920 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
1922 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1924 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1926 tls_in.ocsp = OCSP_NOT_RESP;
1927 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1930 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1937 #ifndef DISABLE_EVENT
1939 We use this callback to get observability and detail-level control
1940 for an exim TLS connection (either direction), raising a tls:cert event
1941 for each cert in the chain presented by the peer. Any event
1942 can deny verification.
1944 Return 0 for the handshake to continue or non-zero to terminate.
1948 verify_cb(gnutls_session_t session)
1950 const gnutls_datum_t * cert_list;
1951 unsigned int cert_list_size = 0;
1952 gnutls_x509_crt_t crt;
1955 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1957 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
1958 while (cert_list_size--)
1960 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
1962 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1963 cert_list_size, gnutls_strerror(rc));
1967 state->tlsp->peercert = crt;
1968 if ((yield = event_raise(state->event_action,
1969 US"tls:cert", string_sprintf("%d", cert_list_size))))
1971 log_write(0, LOG_MAIN,
1972 "SSL verify denied by event-action: depth=%d: %s",
1973 cert_list_size, yield);
1974 return 1; /* reject */
1976 state->tlsp->peercert = NULL;
1986 /* ------------------------------------------------------------------------ */
1987 /* Exported functions */
1992 /*************************************************
1993 * Start a TLS session in a server *
1994 *************************************************/
1996 /* This is called when Exim is running as a server, after having received
1997 the STARTTLS command. It must respond to that command, and then negotiate
2001 require_ciphers list of allowed ciphers or NULL
2002 errstr pointer to error string
2004 Returns: OK on success
2005 DEFER for errors before the start of the negotiation
2006 FAIL for errors during the negotiation; the server can't
2011 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
2014 exim_gnutls_state_st * state = NULL;
2016 /* Check for previous activation */
2017 if (tls_in.active.sock >= 0)
2019 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2020 smtp_printf("554 Already in TLS\r\n", FALSE);
2024 /* Initialize the library. If it fails, it will already have logged the error
2025 and sent an SMTP response. */
2027 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2029 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
2030 NULL, tls_verify_certificates, tls_crl,
2031 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2033 /* If this is a host for which certificate verification is mandatory or
2034 optional, set up appropriately. */
2036 if (verify_check_host(&tls_verify_hosts) == OK)
2039 debug_printf("TLS: a client certificate will be required.\n");
2040 state->verify_requirement = VERIFY_REQUIRED;
2041 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2043 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2046 debug_printf("TLS: a client certificate will be requested but not required.\n");
2047 state->verify_requirement = VERIFY_OPTIONAL;
2048 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2053 debug_printf("TLS: a client certificate will not be requested.\n");
2054 state->verify_requirement = VERIFY_NONE;
2055 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2058 #ifndef DISABLE_EVENT
2061 state->event_action = event_action;
2062 gnutls_session_set_ptr(state->session, state);
2063 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2067 /* Register SNI handling; always, even if not in tls_certificate, so that the
2068 expansion variable $tls_sni is always available. */
2070 gnutls_handshake_set_post_client_hello_function(state->session,
2071 exim_sni_handling_cb);
2073 /* Set context and tell client to go ahead, except in the case of TLS startup
2074 on connection, where outputting anything now upsets the clients and tends to
2075 make them disconnect. We need to have an explicit fflush() here, to force out
2076 the response. Other smtp_printf() calls do not need it, because in non-TLS
2077 mode, the fflush() happens when smtp_getc() is called. */
2079 if (!state->tlsp->on_connect)
2081 smtp_printf("220 TLS go ahead\r\n", FALSE);
2085 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2086 that the GnuTLS library doesn't.
2087 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2088 to set (and clear down afterwards) up a pull-timeout callback function that does
2089 a select, so we're no better off unless avoiding signals becomes an issue. */
2091 gnutls_transport_set_ptr2(state->session,
2092 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2093 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
2094 state->fd_in = fileno(smtp_in);
2095 state->fd_out = fileno(smtp_out);
2097 sigalrm_seen = FALSE;
2098 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2100 rc = gnutls_handshake(state->session);
2101 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2104 if (rc != GNUTLS_E_SUCCESS)
2106 /* It seems that, except in the case of a timeout, we have to close the
2107 connection right here; otherwise if the other end is running OpenSSL it hangs
2108 until the server times out. */
2112 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
2113 gnutls_db_remove_session(state->session);
2117 tls_error(US"gnutls_handshake", US gnutls_strerror(rc), NULL, errstr);
2118 (void) gnutls_alert_send_appropriate(state->session, rc);
2119 gnutls_deinit(state->session);
2120 gnutls_certificate_free_credentials(state->x509_cred);
2122 shutdown(state->fd_out, SHUT_WR);
2123 for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--; /* drain skt */
2124 (void)fclose(smtp_out);
2125 (void)fclose(smtp_in);
2126 smtp_out = smtp_in = NULL;
2132 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2134 /* Verify after the fact */
2136 if (!verify_certificate(state, errstr))
2138 if (state->verify_requirement != VERIFY_OPTIONAL)
2140 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
2144 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
2148 /* Figure out peer DN, and if authenticated, etc. */
2150 if ((rc = peer_status(state, NULL)) != OK) return rc;
2152 /* Sets various Exim expansion variables; always safe within server */
2154 extract_exim_vars_from_tls_state(state);
2156 /* TLS has been set up. Adjust the input functions to read via TLS,
2157 and initialize appropriately. */
2159 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2161 receive_getc = tls_getc;
2162 receive_getbuf = tls_getbuf;
2163 receive_get_cache = tls_get_cache;
2164 receive_ungetc = tls_ungetc;
2165 receive_feof = tls_feof;
2166 receive_ferror = tls_ferror;
2167 receive_smtp_buffered = tls_smtp_buffered;
2176 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2177 smtp_transport_options_block * ob)
2179 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2181 state->exp_tls_verify_cert_hostnames =
2183 string_domain_utf8_to_alabel(host->name, NULL);
2188 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2189 state->exp_tls_verify_cert_hostnames);
2197 /* Given our list of RRs from the TLSA lookup, build a lookup block in
2198 GnuTLS-DANE's preferred format. Hang it on the state str for later
2199 use in DANE verification.
2201 We point at the dnsa data not copy it, so it must remain valid until
2202 after verification is done.*/
2205 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2210 const char ** dane_data;
2211 int * dane_data_len;
2213 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 1;
2215 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2216 ) if (rr->type == T_TLSA) i++;
2218 dane_data = store_get(i * sizeof(uschar *));
2219 dane_data_len = store_get(i * sizeof(int));
2221 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 0;
2223 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2224 ) if (rr->type == T_TLSA && rr->size > 3)
2226 const uschar * p = rr->data;
2227 uint8_t usage = p[0], sel = p[1], type = p[2];
2230 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2232 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2233 || (sel != 0 && sel != 1)
2238 case 0: /* Full: cannot check at present */
2240 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2242 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2247 tls_out.tlsa_usage |= 1<<usage;
2248 dane_data[i] = CS p;
2249 dane_data_len[i++] = rr->size;
2252 if (!i) return FALSE;
2254 dane_data[i] = NULL;
2255 dane_data_len[i] = 0;
2257 state->dane_data = (char * const *)dane_data;
2258 state->dane_data_len = dane_data_len;
2265 /*************************************************
2266 * Start a TLS session in a client *
2267 *************************************************/
2269 /* Called from the smtp transport after STARTTLS has been accepted.
2272 fd the fd of the connection
2273 host connected host (for messages and option-tests)
2274 addr the first address (not used)
2275 tb transport (always smtp)
2276 tlsa_dnsa non-NULL, either request or require dane for this host, and
2277 a TLSA record found. Therefore, dane verify required.
2278 Which implies cert must be requested and supplied, dane
2279 verify must pass, and cert verify irrelevant (incl.
2280 hostnames), and (caller handled) require_tls
2281 tlsp record details of channel configuration
2282 errstr error string pointer
2284 Returns: Pointer to TLS session context, or NULL on error
2288 tls_client_start(int fd, host_item *host,
2289 address_item *addr ARG_UNUSED,
2290 transport_instance * tb,
2292 dns_answer * tlsa_dnsa,
2294 tls_support * tlsp, uschar ** errstr)
2296 smtp_transport_options_block *ob = tb
2297 ? (smtp_transport_options_block *)tb->options_block
2298 : &smtp_transport_option_defaults;
2300 exim_gnutls_state_st * state = NULL;
2301 uschar *cipher_list = NULL;
2303 #ifndef DISABLE_OCSP
2305 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
2306 BOOL request_ocsp = require_ocsp ? TRUE
2307 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2310 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
2313 if (tlsa_dnsa && ob->dane_require_tls_ciphers)
2315 /* not using expand_check_tlsvar because not yet in state */
2316 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2317 &cipher_list, errstr))
2319 cipher_list = cipher_list && *cipher_list
2320 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
2325 cipher_list = ob->tls_require_ciphers;
2327 if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2328 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2329 cipher_list, &state, tlsp, errstr) != OK)
2333 int dh_min_bits = ob->tls_dh_min_bits;
2334 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2337 debug_printf("WARNING: tls_dh_min_bits far too low,"
2338 " clamping %d up to %d\n",
2339 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2340 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2343 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2344 " acceptable bits to %d\n",
2346 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2349 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
2350 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2351 the specified host patterns if one of them is defined */
2354 if (tlsa_dnsa && dane_tlsa_load(state, tlsa_dnsa))
2357 debug_printf("TLS: server certificate DANE required.\n");
2358 state->verify_requirement = VERIFY_DANE;
2359 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2363 if ( ( state->exp_tls_verify_certificates
2364 && !ob->tls_verify_hosts
2365 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2367 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
2370 tls_client_setup_hostname_checks(host, state, ob);
2372 debug_printf("TLS: server certificate verification required.\n");
2373 state->verify_requirement = VERIFY_REQUIRED;
2374 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2376 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
2378 tls_client_setup_hostname_checks(host, state, ob);
2380 debug_printf("TLS: server certificate verification optional.\n");
2381 state->verify_requirement = VERIFY_OPTIONAL;
2382 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2387 debug_printf("TLS: server certificate verification not required.\n");
2388 state->verify_requirement = VERIFY_NONE;
2389 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2392 #ifndef DISABLE_OCSP
2393 /* supported since GnuTLS 3.1.3 */
2396 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2397 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2398 NULL, 0, NULL)) != OK)
2400 tls_error(US"cert-status-req", US gnutls_strerror(rc), state->host, errstr);
2403 tlsp->ocsp = OCSP_NOT_RESP;
2407 #ifndef DISABLE_EVENT
2408 if (tb && tb->event_action)
2410 state->event_action = tb->event_action;
2411 gnutls_session_set_ptr(state->session, state);
2412 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2416 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
2420 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2421 /* There doesn't seem to be a built-in timeout on connection. */
2423 sigalrm_seen = FALSE;
2424 ALARM(ob->command_timeout);
2426 rc = gnutls_handshake(state->session);
2427 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2430 if (rc != GNUTLS_E_SUCCESS)
2434 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
2435 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
2438 tls_error(US"gnutls_handshake", US gnutls_strerror(rc), state->host, errstr);
2442 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2446 if (!verify_certificate(state, errstr))
2448 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
2452 #ifndef DISABLE_OCSP
2457 gnutls_datum_t stapling;
2458 gnutls_ocsp_resp_t resp;
2459 gnutls_datum_t printed;
2460 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2461 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2462 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2463 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2466 debug_printf("%.4096s", printed.data);
2467 gnutls_free(printed.data);
2470 (void) tls_error(US"ocsp decode", US gnutls_strerror(rc), state->host, errstr);
2473 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
2475 tlsp->ocsp = OCSP_FAILED;
2476 tls_error(US"certificate status check failed", NULL, state->host, errstr);
2479 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
2480 tlsp->ocsp = OCSP_VFIED;
2484 /* Figure out peer DN, and if authenticated, etc. */
2486 if (peer_status(state, errstr) != OK)
2489 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
2491 extract_exim_vars_from_tls_state(state);
2499 /*************************************************
2500 * Close down a TLS session *
2501 *************************************************/
2503 /* This is also called from within a delivery subprocess forked from the
2504 daemon, to shut down the TLS library, without actually doing a shutdown (which
2505 would tamper with the TLS session in the parent process).
2508 ct_ctx client context pointer, or NULL for the one global server context
2509 shutdown 1 if TLS close-alert is to be sent,
2510 2 if also response to be waited for
2516 tls_close(void * ct_ctx, int shutdown)
2518 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
2520 if (!state->tlsp || state->tlsp->active.sock < 0) return; /* TLS was not active */
2524 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
2525 shutdown > 1 ? " (with response-wait)" : "");
2528 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
2532 gnutls_deinit(state->session);
2533 gnutls_certificate_free_credentials(state->x509_cred);
2536 state->tlsp->active.sock = -1;
2537 state->tlsp->active.tls_ctx = NULL;
2538 if (state->xfer_buffer) store_free(state->xfer_buffer);
2539 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2546 tls_refill(unsigned lim)
2548 exim_gnutls_state_st * state = &state_server;
2551 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2552 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2554 sigalrm_seen = FALSE;
2555 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2558 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2559 MIN(ssl_xfer_buffer_size, lim));
2560 while (inbytes == GNUTLS_E_AGAIN);
2562 if (smtp_receive_timeout > 0) ALARM_CLR(0);
2564 if (had_command_timeout) /* set by signal handler */
2565 smtp_command_timeout_exit(); /* does not return */
2566 if (had_command_sigterm)
2567 smtp_command_sigterm_exit();
2568 if (had_data_timeout)
2569 smtp_data_timeout_exit();
2570 if (had_data_sigint)
2571 smtp_data_sigint_exit();
2573 /* Timeouts do not get this far. A zero-byte return appears to mean that the
2574 TLS session has been closed down, not that the socket itself has been closed
2575 down. Revert to non-TLS handling. */
2579 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
2580 state->xfer_error = TRUE;
2584 else if (inbytes == 0)
2586 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2588 receive_getc = smtp_getc;
2589 receive_getbuf = smtp_getbuf;
2590 receive_get_cache = smtp_get_cache;
2591 receive_ungetc = smtp_ungetc;
2592 receive_feof = smtp_feof;
2593 receive_ferror = smtp_ferror;
2594 receive_smtp_buffered = smtp_buffered;
2596 gnutls_deinit(state->session);
2597 gnutls_certificate_free_credentials(state->x509_cred);
2599 state->session = NULL;
2600 state->tlsp->active.sock = -1;
2601 state->tlsp->active.tls_ctx = NULL;
2602 state->tlsp->bits = 0;
2603 state->tlsp->certificate_verified = FALSE;
2604 tls_channelbinding_b64 = NULL;
2605 state->tlsp->cipher = NULL;
2606 state->tlsp->peercert = NULL;
2607 state->tlsp->peerdn = NULL;
2612 /* Handle genuine errors */
2614 else if (inbytes < 0)
2616 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv(\n", __FUNCTION__);
2617 record_io_error(state, (int) inbytes, US"recv", NULL);
2618 state->xfer_error = TRUE;
2621 #ifndef DISABLE_DKIM
2622 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2624 state->xfer_buffer_hwm = (int) inbytes;
2625 state->xfer_buffer_lwm = 0;
2629 /*************************************************
2630 * TLS version of getc *
2631 *************************************************/
2633 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2634 it refills the buffer via the GnuTLS reading function.
2635 Only used by the server-side TLS.
2637 This feeds DKIM and should be used for all message-body reads.
2639 Arguments: lim Maximum amount to read/buffer
2640 Returns: the next character or EOF
2644 tls_getc(unsigned lim)
2646 exim_gnutls_state_st * state = &state_server;
2648 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2649 if (!tls_refill(lim))
2650 return state->xfer_error ? EOF : smtp_getc(lim);
2652 /* Something in the buffer; return next uschar */
2654 return state->xfer_buffer[state->xfer_buffer_lwm++];
2658 tls_getbuf(unsigned * len)
2660 exim_gnutls_state_st * state = &state_server;
2664 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2665 if (!tls_refill(*len))
2667 if (!state->xfer_error) return smtp_getbuf(len);
2672 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
2674 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
2675 state->xfer_buffer_lwm += size;
2684 #ifndef DISABLE_DKIM
2685 exim_gnutls_state_st * state = &state_server;
2686 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2688 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
2694 tls_could_read(void)
2696 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
2697 || gnutls_record_check_pending(state_server.session) > 0;
2703 /*************************************************
2704 * Read bytes from TLS channel *
2705 *************************************************/
2707 /* This does not feed DKIM, so if the caller uses this for reading message body,
2708 then the caller must feed DKIM.
2711 ct_ctx client context pointer, or NULL for the one global server context
2715 Returns: the number of bytes read
2716 -1 after a failed read, including EOF
2720 tls_read(void * ct_ctx, uschar *buff, size_t len)
2722 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
2728 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2730 debug_printf("*** PROBABLY A BUG *** " \
2731 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2732 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2735 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2736 state->session, buff, len);
2739 inbytes = gnutls_record_recv(state->session, buff, len);
2740 while (inbytes == GNUTLS_E_AGAIN);
2742 if (inbytes > 0) return inbytes;
2745 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2749 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv(\n", __FUNCTION__);
2750 record_io_error(state, (int)inbytes, US"recv", NULL);
2759 /*************************************************
2760 * Write bytes down TLS channel *
2761 *************************************************/
2765 ct_ctx client context pointer, or NULL for the one global server context
2768 more more data expected soon
2770 Returns: the number of bytes after a successful write,
2771 -1 after a failed write
2775 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
2779 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
2781 static BOOL corked = FALSE;
2783 if (more && !corked) gnutls_record_cork(state->session);
2786 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
2787 buff, left, more ? ", more" : "");
2791 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2795 outbytes = gnutls_record_send(state->session, buff, left);
2796 while (outbytes == GNUTLS_E_AGAIN);
2798 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
2801 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
2802 record_io_error(state, outbytes, US"send", NULL);
2807 record_io_error(state, 0, US"send", US"TLS channel closed on write");
2818 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2826 if (!more) (void) gnutls_record_uncork(state->session, 0);
2837 /*************************************************
2838 * Random number generation *
2839 *************************************************/
2841 /* Pseudo-random number generation. The result is not expected to be
2842 cryptographically strong but not so weak that someone will shoot themselves
2843 in the foot using it as a nonce in input in some email header scheme or
2844 whatever weirdness they'll twist this into. The result should handle fork()
2845 and avoid repeating sequences. OpenSSL handles that for us.
2849 Returns a random number in range [0, max-1]
2852 #ifdef HAVE_GNUTLS_RND
2854 vaguely_random_number(int max)
2859 uschar smallbuf[sizeof(r)];
2864 needed_len = sizeof(r);
2865 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2866 * asked for a number less than 10. */
2867 for (r = max, i = 0; r; ++i)
2873 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2876 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2877 return vaguely_random_number_fallback(max);
2880 for (p = smallbuf; needed_len; --needed_len, ++p)
2886 /* We don't particularly care about weighted results; if someone wants
2887 * smooth distribution and cares enough then they should submit a patch then. */
2890 #else /* HAVE_GNUTLS_RND */
2892 vaguely_random_number(int max)
2894 return vaguely_random_number_fallback(max);
2896 #endif /* HAVE_GNUTLS_RND */
2901 /*************************************************
2902 * Let tls_require_ciphers be checked at startup *
2903 *************************************************/
2905 /* The tls_require_ciphers option, if set, must be something which the
2908 Returns: NULL on success, or error message
2912 tls_validate_require_cipher(void)
2915 uschar *expciphers = NULL;
2916 gnutls_priority_t priority_cache;
2918 uschar * dummy_errstr;
2920 #define validate_check_rc(Label) do { \
2921 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2922 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2923 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2925 if (exim_gnutls_base_init_done)
2926 log_write(0, LOG_MAIN|LOG_PANIC,
2927 "already initialised GnuTLS, Exim developer bug");
2929 #ifdef HAVE_GNUTLS_PKCS11
2930 if (!gnutls_allow_auto_pkcs11)
2932 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2933 validate_check_rc(US"gnutls_pkcs11_init");
2936 rc = gnutls_global_init();
2937 validate_check_rc(US"gnutls_global_init()");
2938 exim_gnutls_base_init_done = TRUE;
2940 if (!(tls_require_ciphers && *tls_require_ciphers))
2941 return_deinit(NULL);
2943 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
2945 return_deinit(US"failed to expand tls_require_ciphers");
2947 if (!(expciphers && *expciphers))
2948 return_deinit(NULL);
2951 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2953 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2954 validate_check_rc(string_sprintf(
2955 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2956 expciphers, errpos - CS expciphers, errpos));
2958 #undef return_deinit
2959 #undef validate_check_rc
2960 gnutls_global_deinit();
2968 /*************************************************
2969 * Report the library versions. *
2970 *************************************************/
2972 /* See a description in tls-openssl.c for an explanation of why this exists.
2974 Arguments: a FILE* to print the results to
2979 tls_version_report(FILE *f)
2981 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2984 gnutls_check_version(NULL));
2989 /* End of tls-gnu.c */