1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2018 */
7 /* Copyright (c) Phil Pennock 2012 */
8 /* See the file NOTICE for conditions of use and distribution. */
9 /* SPDX-License-Identifier: GPL-2.0-or-later */
11 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
12 one of the available supported implementations. This file is #included into
13 tls.c when USE_GNUTLS has been set.
15 The code herein is a revamp of GnuTLS integration using the current APIs; the
16 original tls-gnu.c was based on a patch which was contributed by Nikos
17 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
20 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
21 which is not widely deployed by OS vendors. Will note issues below, which may
22 assist in updating the code in the future. Another sources of hints is
23 mod_gnutls for Apache (SNI callback registration and handling).
25 Keeping client and server variables more split than before and is currently
26 the norm, in anticipation of TLS in ACL callouts.
28 I wanted to switch to gnutls_certificate_set_verify_function() so that
29 certificate rejection could happen during handshake where it belongs, rather
30 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
31 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
33 (I wasn't looking for libraries quite that old, when updating to get rid of
34 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
35 require current GnuTLS, then we'll drop support for the ancient libraries).
38 #include <gnutls/gnutls.h>
39 /* needed for cert checks in verification and DN extraction: */
40 #include <gnutls/x509.h>
41 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
42 #include <gnutls/crypto.h>
44 /* needed to disable PKCS11 autoload unless requested */
45 #if GNUTLS_VERSION_NUMBER >= 0x020c00
46 # include <gnutls/pkcs11.h>
47 # define SUPPORT_PARAM_TO_PK_BITS
49 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
50 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
53 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
54 # warning "GnuTLS library version too old; tls:cert event unsupported"
55 # define DISABLE_EVENT
57 #if GNUTLS_VERSION_NUMBER >= 0x030000
58 # define SUPPORT_SELFSIGN /* Uncertain what version is first usable but 2.12.23 is not */
60 #if GNUTLS_VERSION_NUMBER >= 0x030306
61 # define SUPPORT_CA_DIR
63 # undef SUPPORT_CA_DIR
65 #if GNUTLS_VERSION_NUMBER >= 0x030014
66 # define SUPPORT_SYSDEFAULT_CABUNDLE
68 #if GNUTLS_VERSION_NUMBER >= 0x030104
69 # define GNUTLS_CERT_VFY_STATUS_PRINT
71 #if GNUTLS_VERSION_NUMBER >= 0x030109
74 #if GNUTLS_VERSION_NUMBER >= 0x03010a
75 # define SUPPORT_GNUTLS_SESS_DESC
77 #if GNUTLS_VERSION_NUMBER >= 0x030300
78 # define GNUTLS_AUTO_GLOBAL_INIT
79 # define GNUTLS_AUTO_PKCS11_MANUAL
81 #if (GNUTLS_VERSION_NUMBER >= 0x030404) \
82 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
84 # define EXIM_HAVE_OCSP
87 #if GNUTLS_VERSION_NUMBER >= 0x030500
88 # define SUPPORT_GNUTLS_KEYLOG
90 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
91 # define SUPPORT_SRV_OCSP_STACK
93 #if GNUTLS_VERSION_NUMBER >= 0x030603
94 # define EXIM_HAVE_TLS1_3
95 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
96 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
100 # if GNUTLS_VERSION_NUMBER >= 0x030000
101 # define DANESSL_USAGE_DANE_TA 2
102 # define DANESSL_USAGE_DANE_EE 3
104 # error GnuTLS version too early for DANE
106 # if GNUTLS_VERSION_NUMBER < 0x999999
107 # define GNUTLS_BROKEN_DANE_VALIDATION
111 #ifndef DISABLE_TLS_RESUME
112 # if GNUTLS_VERSION_NUMBER >= 0x030603
113 # define EXIM_HAVE_TLS_RESUME
115 # warning "GnuTLS library version too old; resumption unsupported"
119 #if GNUTLS_VERSION_NUMBER >= 0x030200
120 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
121 # define EXIM_HAVE_ALPN
125 #if GNUTLS_VERSION_NUMBER >= 0x030702
126 # define HAVE_GNUTLS_EXPORTER
130 # include <gnutls/ocsp.h>
133 # include <gnutls/dane.h>
136 #include "tls-cipher-stdname.c"
143 # ifndef DISABLE_TLS_RESUME
144 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
146 # ifdef EXIM_HAVE_TLS1_3
147 builtin_macro_create(US"_HAVE_TLS1_3");
149 # ifdef EXIM_HAVE_OCSP
150 builtin_macro_create(US"_HAVE_TLS_OCSP");
152 # ifdef SUPPORT_SRV_OCSP_STACK
153 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
155 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
156 builtin_macro_create(US"_HAVE_TLS_CA_CACHE");
158 # ifdef EXIM_HAVE_ALPN
159 builtin_macro_create(US"_HAVE_TLS_ALPN");
168 gnutls_global_set_audit_log_function()
171 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
174 /* Local static variables for GnuTLS */
176 /* Values for verify_requirement */
178 enum peer_verify_requirement
179 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
181 /* This holds most state for server or client; with this, we can set up an
182 outbound TLS-enabled connection in an ACL callout, while not stomping all
183 over the TLS variables available for expansion.
185 Some of these correspond to variables in globals.c; those variables will
186 be set to point to content in one of these instances, as appropriate for
187 the stage of the process lifetime.
189 Not handled here: global tlsp->tls_channelbinding.
192 typedef struct exim_gnutls_state {
193 gnutls_session_t session;
195 exim_tlslib_state lib_state;
196 #define x509_cred libdata0
197 #define pri_cache libdata1
199 enum peer_verify_requirement verify_requirement;
203 BOOL peer_cert_verified:1;
204 BOOL peer_dane_verified:1;
205 BOOL trigger_sni_changes:1;
206 BOOL have_set_peerdn:1;
207 BOOL xfer_eof:1; /*XXX never gets set! */
213 const struct host_item *host; /* NULL if server */
214 gnutls_x509_crt_t peercert;
217 uschar *received_sni;
219 const uschar *tls_certificate;
220 const uschar *tls_privatekey;
221 const uschar *tls_sni; /* client send only, not received */
222 const uschar *tls_verify_certificates;
223 const uschar *tls_crl;
224 const uschar *tls_require_ciphers;
226 uschar *exp_tls_certificate;
227 uschar *exp_tls_privatekey;
228 uschar *exp_tls_verify_certificates;
230 uschar *exp_tls_require_ciphers;
231 const uschar *exp_tls_verify_cert_hostnames;
232 #ifndef DISABLE_EVENT
233 uschar *event_action;
236 char * const * dane_data;
237 const int * dane_data_len;
240 tls_support *tlsp; /* set in tls_init() */
245 } exim_gnutls_state_st;
247 static const exim_gnutls_state_st exim_gnutls_state_init = {
248 /* all elements not explicitly intialised here get 0/NULL/FALSE */
253 /* Not only do we have our own APIs which don't pass around state, assuming
254 it's held in globals, GnuTLS doesn't appear to let us register callback data
255 for callbacks, or as part of the session, so we have to keep a "this is the
256 context we're currently dealing with" pointer and rely upon being
257 single-threaded to keep from processing data on an inbound TLS connection while
258 talking to another TLS connection for an outbound check. This does mean that
259 there's no way for heart-beats to be responded to, for the duration of the
261 XXX But see gnutls_session_get_ptr()
264 static exim_gnutls_state_st state_server = {
265 /* all elements not explicitly intialised here get 0/NULL/FALSE */
270 /* dh_params are initialised once within the lifetime of a process using TLS;
271 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
272 don't want to repeat this. */
274 static gnutls_dh_params_t dh_server_params = NULL;
276 static int ssl_session_timeout = 7200; /* Two hours */
278 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
280 /* Guard library core initialisation */
282 static BOOL exim_gnutls_base_init_done = FALSE;
285 static BOOL gnutls_buggy_ocsp = FALSE;
286 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
289 #ifdef EXIM_HAVE_ALPN
290 static int server_seen_alpn = -1; /* count of names */
292 #ifdef EXIM_HAVE_TLS_RESUME
293 static gnutls_datum_t server_sessticket_key;
297 /* ------------------------------------------------------------------------ */
300 #define MAX_HOST_LEN 255
302 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
303 the library logging; a value less than 0 disables the calls to set up logging
304 callbacks. GNuTLS also looks for an environment variable - except not for
305 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
306 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
307 but the env var must be added to /etc/sudoers too. */
308 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
309 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
312 #ifndef EXIM_CLIENT_DH_MIN_BITS
313 # define EXIM_CLIENT_DH_MIN_BITS 1024
316 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
317 can ask for a bit-strength. Without that, we stick to the constant we had
319 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
320 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
323 #define Expand_check_tlsvar(Varname, errstr) \
324 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
326 #if GNUTLS_VERSION_NUMBER >= 0x020c00
327 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
328 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
329 # define HAVE_GNUTLS_RND
330 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
331 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
332 * isn't available sometimes, so this needs to become a conditional
333 * compilation; the sanest way to deal with this being a problem on
334 * older OSes is to block it in the Local/Makefile with this compiler
336 # ifndef AVOID_GNUTLS_PKCS11
337 # define HAVE_GNUTLS_PKCS11
338 # endif /* AVOID_GNUTLS_PKCS11 */
341 #if GNUTLS_VERSION_NUMBER >= 0x030404
342 # define HAVE_GNUTLS_PRF_RFC5705
347 /* ------------------------------------------------------------------------ */
348 /* Callback declarations */
350 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
351 static void exim_gnutls_logger_cb(int level, const char *message);
354 static int exim_sni_handling_cb(gnutls_session_t session);
356 #ifdef EXIM_HAVE_TLS_RESUME
358 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
359 unsigned incoming, const gnutls_datum_t * msg);
363 /*************************************************
365 *************************************************/
367 /* Called from lots of places when errors occur before actually starting to do
368 the TLS handshake, that is, while the session is still in clear. Always returns
369 DEFER for a server and FAIL for a client so that most calls can use "return
370 tls_error(...)" to do this processing and then give an appropriate return. A
371 single function is used for both server and client, because it is called from
372 some shared functions.
375 prefix text to include in the logged error
376 msg additional error string (may be NULL)
377 usually obtained from gnutls_strerror()
378 host NULL if setting up a server;
379 the connected host if setting up a client
380 errstr pointer to returned error string
386 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
390 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
391 return host ? FAIL : DEFER;
395 /* Returns: DEFER/FAIL */
397 tls_error_gnu(exim_gnutls_state_st * state, const uschar *prefix, int err,
400 return tls_error(prefix,
401 state && err == GNUTLS_E_FATAL_ALERT_RECEIVED
402 ? string_sprintf("rxd alert: %s",
403 US gnutls_alert_get_name(gnutls_alert_get(state->session)))
404 : US gnutls_strerror(err),
405 state ? state->host : NULL,
410 tls_error_sys(const uschar *prefix, int err, const host_item *host,
413 return tls_error(prefix, US strerror(err), host, errstr);
417 /* ------------------------------------------------------------------------ */
423 tls_is_buggy_ocsp(void)
426 uschar maj, mid, mic;
428 s = CUS gnutls_check_version(NULL);
432 while (*s && *s != '.') s++;
440 while (*s && *s != '.') s++;
442 return mic <= (mid == 3 ? 16 : 3);
452 tls_g_init(uschar ** errstr)
455 DEBUG(D_tls) debug_printf("GnuTLS global init required\n");
457 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
458 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
459 which loads modules from a config file, which sounds good and may be wanted
460 by some sysadmin, but also means in common configurations that GNOME keyring
461 environment variables are used and so breaks for users calling mailq.
462 To prevent this, we init PKCS11 first, which is the documented approach. */
464 if (!gnutls_allow_auto_pkcs11)
465 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
466 return tls_error_gnu(NULL, US"gnutls_pkcs11_init", rc, errstr);
469 #ifndef GNUTLS_AUTO_GLOBAL_INIT
470 if ((rc = gnutls_global_init()))
471 return tls_error_gnu(NULL, US"gnutls_global_init", rc, errstr);
474 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
477 gnutls_global_set_log_function(exim_gnutls_logger_cb);
478 /* arbitrarily chosen level; bump up to 9 for more */
479 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
484 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
485 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
488 exim_gnutls_base_init_done = TRUE;
494 /* Daemon-call before each connection. Nothing to do for GnuTLS. */
497 tls_per_lib_daemon_tick(void)
501 /* Daemon one-time initialisation */
504 tls_per_lib_daemon_init(void)
506 uschar * dummy_errstr;
507 static BOOL once = FALSE;
509 if (!exim_gnutls_base_init_done)
510 tls_g_init(&dummy_errstr);
516 #ifdef EXIM_HAVE_TLS_RESUME
517 /* We are dependent on the GnuTLS implementation of the Session Ticket
518 encryption; both the strength and the key rotation period. We hope that
519 the strength at least matches that of the ciphersuite (but GnuTLS does not
522 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
523 if (f.running_in_test_harness) ssl_session_timeout = 6;
526 tls_daemon_creds_reload();
530 /* ------------------------------------------------------------------------ */
532 /*************************************************
533 * Deal with logging errors during I/O *
534 *************************************************/
536 /* We have to get the identity of the peer from saved data.
539 state the current GnuTLS exim state container
540 rc the GnuTLS error code, or 0 if it's a local error
541 when text identifying read or write
542 text local error text when rc is 0
548 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
553 msg = rc == GNUTLS_E_FATAL_ALERT_RECEIVED
554 ? string_sprintf("A TLS fatal alert has been received: %s",
555 US gnutls_alert_get_name(gnutls_alert_get(state->session)))
556 #ifdef GNUTLS_E_PREMATURE_TERMINATION
557 : rc == GNUTLS_E_PREMATURE_TERMINATION && errno
558 ? string_sprintf("%s: syscall: %s", US gnutls_strerror(rc), strerror(errno))
560 : US gnutls_strerror(rc);
562 (void) tls_error(when, msg, state->host, &errstr);
565 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
566 state->host->name, state->host->address, errstr);
569 uschar * conn_info = smtp_get_connection_info();
570 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
571 /* I'd like to get separated H= here, but too hard for now */
572 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
579 /*************************************************
580 * Set various Exim expansion vars *
581 *************************************************/
583 #define exim_gnutls_cert_err(Label) \
586 if (rc != GNUTLS_E_SUCCESS) \
588 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
589 (Label), gnutls_strerror(rc)); \
595 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
599 rc = gnutls_x509_crt_init(crtp);
600 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
602 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
603 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
608 #undef exim_gnutls_cert_err
611 /* We set various Exim global variables from the state, once a session has
612 been established. With TLS callouts, may need to change this to stack
613 variables, or just re-call it with the server state after client callout
616 Make sure anything set here is unset in tls_getc().
620 tls_bits strength indicator
621 tls_certificate_verified bool indicator
622 tls_channelbinding for some SASL mechanisms
625 tls_peercert pointer to library internal
627 tls_sni a (UTF-8) string
628 tls_ourcert pointer to library internal
631 state the relevant exim_gnutls_state_st *
635 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
637 tls_support * tlsp = state->tlsp;
639 tlsp->active.sock = state->fd_out;
640 tlsp->active.tls_ctx = state;
642 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
644 tlsp->certificate_verified = state->peer_cert_verified;
646 tlsp->dane_verified = state->peer_dane_verified;
649 /* note that tls_channelbinding is not saved to the spool file, since it's
650 only available for use for authenticators while this TLS session is running. */
652 tlsp->channelbinding = NULL;
653 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
655 gnutls_datum_t channel = {.data = NULL, .size = 0};
658 # ifdef HAVE_GNUTLS_EXPORTER
659 if (gnutls_protocol_get_version(state->session) >= GNUTLS_TLS1_3)
661 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_EXPORTER, &channel);
662 tlsp->channelbind_exporter = TRUE;
665 # elif defined(HAVE_GNUTLS_PRF_RFC5705)
666 /* Older libraries may not have GNUTLS_TLS1_3 defined! */
667 if (gnutls_protocol_get_version(state->session) > GNUTLS_TLS1_2)
669 uschar * buf = store_get(32, state->host ? GET_TAINTED : GET_UNTAINTED);
670 rc = gnutls_prf_rfc5705(state->session,
671 (size_t)24, "EXPORTER-Channel-Binding", (size_t)0, "",
678 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
681 { DEBUG(D_tls) debug_printf("extracting channel binding: %s\n", gnutls_strerror(rc)); }
684 int old_pool = store_pool;
685 /* Declare the taintedness of the binding info. On server, untainted; on
686 client, tainted if we used the Finish msg from the server. */
688 store_pool = POOL_PERM;
689 tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size,
690 !tlsp->channelbind_exporter && state->host ? GET_TAINTED : GET_UNTAINTED);
691 store_pool = old_pool;
692 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n");
697 /* peercert is set in peer_status() */
698 tlsp->peerdn = state->peerdn;
700 /* do not corrupt sni sent by client; record sni rxd by server */
702 tlsp->sni = state->received_sni;
704 /* record our certificate */
706 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
707 gnutls_x509_crt_t crt;
709 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
716 /*************************************************
717 * Setup up DH parameters *
718 *************************************************/
720 /* Generating the D-H parameters may take a long time. They only need to
721 be re-generated every so often, depending on security policy. What we do is to
722 keep these parameters in a file in the spool directory. If the file does not
723 exist, we generate them. This means that it is easy to cause a regeneration.
725 The new file is written as a temporary file and renamed, so that an incomplete
726 file is never present. If two processes both compute some new parameters, you
727 waste a bit of effort, but it doesn't seem worth messing around with locking to
730 Returns: OK/DEFER/FAIL
734 init_server_dh(uschar ** errstr)
737 unsigned int dh_bits;
739 uschar filename_buf[PATH_MAX];
740 uschar *filename = NULL;
742 uschar *exp_tls_dhparam;
743 BOOL use_file_in_spool = FALSE;
744 host_item *host = NULL; /* dummy for macros */
746 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params\n");
748 if ((rc = gnutls_dh_params_init(&dh_server_params)))
749 return tls_error_gnu(NULL, US"gnutls_dh_params_init", rc, errstr);
754 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
757 if (!exp_tls_dhparam)
759 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
760 m.data = US std_dh_prime_default();
761 m.size = Ustrlen(m.data);
763 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
764 use_file_in_spool = TRUE;
765 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
767 DEBUG(D_tls) debug_printf("Requested no DH parameters\n");
770 else if (exp_tls_dhparam[0] != '/')
772 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
773 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
774 m.size = Ustrlen(m.data);
777 filename = exp_tls_dhparam;
781 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
782 return tls_error_gnu(NULL, US"gnutls_dh_params_import_pkcs3", rc, errstr);
783 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
787 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
788 /* If you change this constant, also change dh_param_fn_ext so that we can use a
789 different filename and ensure we have sufficient bits. */
791 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
792 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
794 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits\n",
797 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
799 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits\n",
803 /* Some clients have hard-coded limits. */
804 if (dh_bits > tls_dh_max_bits)
807 debug_printf("tls_dh_max_bits clamping override, using %d bits instead\n",
809 dh_bits = tls_dh_max_bits;
812 if (use_file_in_spool)
814 if (!string_format(filename_buf, sizeof(filename_buf),
815 "%s/gnutls-params-%d", spool_directory, dh_bits))
816 return tls_error(US"overlong filename", NULL, NULL, errstr);
817 filename = filename_buf;
820 /* Open the cache file for reading and if successful, read it and set up the
823 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
829 if (fstat(fd, &statbuf) < 0) /* EIO */
833 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
835 if (!S_ISREG(statbuf.st_mode))
838 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
840 if (!(fp = fdopen(fd, "rb")))
844 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
845 saved_errno, NULL, errstr);
848 m.size = statbuf.st_size;
849 if (!(m.data = store_malloc(m.size)))
852 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
854 if (!(sz = fread(m.data, m.size, 1, fp)))
859 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
863 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
866 return tls_error_gnu(NULL, US"gnutls_dh_params_import_pkcs3", rc, errstr);
867 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
870 /* If the file does not exist, fall through to compute new data and cache it.
871 If there was any other opening error, it is serious. */
873 else if (errno == ENOENT)
877 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
880 return tls_error(string_open_failed("\"%s\" for reading", filename),
883 /* If ret < 0, either the cache file does not exist, or the data it contains
884 is not useful. One particular case of this is when upgrading from an older
885 release of Exim in which the data was stored in a different format. We don't
886 try to be clever and support both formats; we just regenerate new data in this
892 unsigned int dh_bits_gen = dh_bits;
894 if ((PATH_MAX - Ustrlen(filename)) < 10)
895 return tls_error(US"Filename too long to generate replacement",
896 filename, NULL, errstr);
898 temp_fn = string_copy(US"exim-dh.XXXXXXX");
899 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
900 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
901 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
903 /* GnuTLS overshoots!
904 * If we ask for 2236, we might get 2237 or more.
905 * But there's no way to ask GnuTLS how many bits there really are.
906 * We can ask how many bits were used in a TLS session, but that's it!
907 * The prime itself is hidden behind too much abstraction.
908 * So we ask for less, and proceed on a wing and a prayer.
909 * First attempt, subtracted 3 for 2233 and got 2240.
911 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
913 dh_bits_gen = dh_bits - 10;
915 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
920 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
922 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
923 return tls_error_gnu(NULL, US"gnutls_dh_params_generate2", rc, errstr);
925 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
926 and I confirmed that a NULL call to get the size first is how the GnuTLS
927 sample apps handle this. */
931 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
932 GNUTLS_X509_FMT_PEM, m.data, &sz))
933 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
934 return tls_error_gnu(NULL, US"gnutls_dh_params_export_pkcs3(NULL) sizing",
937 if (!(m.data = store_malloc(m.size)))
938 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
940 /* this will return a size 1 less than the allocation size above */
941 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
945 return tls_error_gnu(NULL, US"gnutls_dh_params_export_pkcs3() real", rc, errstr);
947 m.size = sz; /* shrink by 1, probably */
949 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
952 return tls_error_sys(US"TLS cache write D-H params failed",
953 errno, NULL, errstr);
956 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
957 return tls_error_sys(US"TLS cache write D-H params final newline failed",
958 errno, NULL, errstr);
960 if ((rc = close(fd)))
961 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
963 if (Urename(temp_fn, filename) < 0)
964 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
965 temp_fn, filename), errno, NULL, errstr);
967 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
970 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
977 /* Create and install a selfsigned certificate, for use in server mode. */
980 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
982 gnutls_x509_crt_t cert = NULL;
984 gnutls_x509_privkey_t pkey = NULL;
985 const uschar * where;
988 #ifndef SUPPORT_SELFSIGN
989 where = US"library too old";
990 rc = GNUTLS_E_NO_CERTIFICATE_FOUND;
994 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
995 where = US"initialising pkey";
996 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
998 where = US"initialising cert";
999 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
1001 where = US"generating pkey"; /* Hangs on 2.12.23 */
1002 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
1003 #ifdef SUPPORT_PARAM_TO_PK_BITS
1004 # ifndef GNUTLS_SEC_PARAM_MEDIUM
1005 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
1007 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
1014 where = US"configuring cert";
1016 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
1017 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
1018 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
1019 || (rc = gnutls_x509_crt_set_expiration_time(cert, (long)2 * 60 * 60)) /* 2 hour */
1020 || (rc = gnutls_x509_crt_set_key(cert, pkey))
1022 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
1023 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
1024 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
1025 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
1026 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
1027 GNUTLS_OID_X520_COMMON_NAME, 0,
1028 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
1032 where = US"signing cert";
1033 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
1035 where = US"installing selfsign cert";
1037 if ((rc = gnutls_certificate_set_x509_key(state->lib_state.x509_cred,
1044 if (cert) gnutls_x509_crt_deinit(cert);
1045 if (pkey) gnutls_x509_privkey_deinit(pkey);
1049 rc = tls_error_gnu(state, where, rc, errstr);
1056 /* Add certificate and key, from files.
1059 Zero or negative: good. Negate value for certificate index if < 0.
1060 Greater than zero: FAIL or DEFER code.
1064 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
1065 const uschar * certfile, const uschar * keyfile, uschar ** errstr)
1067 int rc = gnutls_certificate_set_x509_key_file(state->lib_state.x509_cred,
1068 CCS certfile, CCS keyfile, GNUTLS_X509_FMT_PEM);
1070 return tls_error_gnu(state,
1071 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
1077 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1078 /* Load an OCSP proof from file for sending by the server. Called
1079 on getting a status-request handshake message, for earlier versions
1083 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1084 gnutls_datum_t * ocsp_response)
1087 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
1089 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1091 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1093 tls_in.ocsp = OCSP_NOT_RESP;
1094 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1097 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1103 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1104 /* Make a note that we saw a status-request */
1106 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
1107 const uschar * data, unsigned size)
1109 /* The values for tls_id are documented here:
1110 https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1113 case 5: /* Status Request */
1114 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
1115 tls_in.ocsp = OCSP_NOT_RESP;
1117 #ifdef EXIM_HAVE_ALPN
1118 case 16: /* Application Layer Protocol Notification */
1119 /* The format of "data" here doesn't seem to be documented, but appears
1120 to be a 2-byte field with a (redundant, given the "size" arg) total length
1121 then a sequence of one-byte size then string (not nul-term) names. The
1122 latter is as described in OpenSSL documentation. */
1124 DEBUG(D_tls) debug_printf("Seen ALPN extension from client (s=%u):", size);
1125 for (const uschar * s = data+2; s-data < size-1; s += *s + 1)
1128 DEBUG(D_tls) debug_printf(" '%.*s'", (int)*s, s+1);
1130 DEBUG(D_tls) debug_printf("\n");
1131 if (server_seen_alpn > 1)
1133 DEBUG(D_tls) debug_printf("TLS: too many ALPNs presented in handshake\n");
1134 return GNUTLS_E_NO_APPLICATION_PROTOCOL;
1142 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
1144 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
1145 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1147 /* Call fn for each extension seen. 3.6.3 onwards */
1148 int rc = gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
1149 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
1150 return rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE ? 0 : rc;
1154 # ifdef notdef_crashes
1155 /* Make a note that we saw a status-response */
1157 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
1158 const unsigned char *data, unsigned size)
1160 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
1161 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1162 if (FALSE && tls_id == 5) /* status_request */
1164 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
1165 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1166 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1172 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
1174 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
1175 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1177 /* Call fn for each extension seen. 3.6.3 onwards */
1178 # ifdef notdef_crashes
1180 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
1183 #endif /*SUPPORT_GNUTLS_EXT_RAW_PARSE*/
1185 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
1186 "Handshake Protocol: Certificate" record.
1187 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
1189 This is different to tls1.2 - where it is a separate record (wireshark term) / handshake message (gnutls term).
1192 #if defined(EXIM_HAVE_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1193 /* Callback for certificate-status, on server. We sent stapled OCSP. */
1195 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
1196 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1198 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
1199 # ifdef SUPPORT_SRV_OCSP_STACK
1200 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1201 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1203 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1208 /* Callback for handshake messages, on server */
1210 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1211 unsigned incoming, const gnutls_datum_t * msg)
1213 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
1216 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1217 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1218 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1219 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1220 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1222 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1223 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1224 # ifdef EXIM_HAVE_TLS_RESUME
1225 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1226 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1235 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1237 tls_server_testharness_ocsp_fiddle(void)
1239 extern char ** environ;
1240 if (environ) for (uschar ** p = USS environ; *p; p++)
1241 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1243 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1244 exim_testharness_disable_ocsp_validity_check = TRUE;
1249 /**************************************************
1250 * One-time init credentials for server and client *
1251 **************************************************/
1254 creds_basic_init(gnutls_certificate_credentials_t x509_cred, BOOL server)
1256 #ifdef SUPPORT_SRV_OCSP_STACK
1257 gnutls_certificate_set_flags(x509_cred, GNUTLS_CERTIFICATE_API_V2);
1259 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1260 if (server && tls_ocsp_file)
1262 if (f.running_in_test_harness)
1263 tls_server_testharness_ocsp_fiddle();
1265 if (exim_testharness_disable_ocsp_validity_check)
1266 gnutls_certificate_set_flags(x509_cred,
1267 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1272 debug_printf("TLS: basic cred init, %s\n", server ? "server" : "client");
1275 /* Returns OK/DEFER/FAIL */
1277 creds_load_server_certs(exim_gnutls_state_st * state, const uschar * cert,
1278 const uschar * pkey, const uschar * ocsp, uschar ** errstr)
1280 const uschar * clist = cert;
1281 const uschar * klist = pkey;
1282 const uschar * olist;
1283 int csep = 0, ksep = 0, osep = 0, cnt = 0, rc;
1284 uschar * cfile, * kfile, * ofile;
1285 #ifndef DISABLE_OCSP
1286 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1287 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1290 if (!expand_check(ocsp, US"tls_ocsp_file", &ofile, errstr))
1295 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1297 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1298 return tls_error(US"cert/key setup: out of keys", NULL, NULL, errstr);
1299 else if ((rc = tls_add_certfile(state, NULL, cfile, kfile, errstr)) > OK)
1303 int gnutls_cert_index = -rc;
1304 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1305 gnutls_cert_index, cfile);
1307 #ifndef DISABLE_OCSP
1310 /* Set the OCSP stapling server info */
1311 if (gnutls_buggy_ocsp)
1314 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1316 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1318 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1319 gnutls_cert_index, ofile);
1320 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1321 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1323 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1326 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1328 ocsp_fmt = GNUTLS_X509_FMT_DER;
1332 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1333 state->lib_state.x509_cred, CCS ofile, gnutls_cert_index,
1335 return tls_error_gnu(state,
1336 US"gnutls_certificate_set_ocsp_status_request_file2",
1339 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1341 /* Arrange callbacks for OCSP request observability */
1344 gnutls_handshake_set_hook_function(state->session,
1345 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1347 state->lib_state.ocsp_hook = TRUE;
1351 # if defined(SUPPORT_SRV_OCSP_STACK)
1352 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1353 state->lib_state.x509_cred, gnutls_cert_index,
1354 server_ocsp_stapling_cb, ofile)))
1355 return tls_error_gnu(state,
1356 US"gnutls_certificate_set_ocsp_status_request_function2",
1364 debug_printf("oops; multiple OCSP files not supported\n");
1367 gnutls_certificate_set_ocsp_status_request_function(
1368 state->lib_state.x509_cred, server_ocsp_stapling_cb, ofile);
1370 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1373 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1375 #endif /* DISABLE_OCSP */
1381 creds_load_client_certs(exim_gnutls_state_st * state, const host_item * host,
1382 const uschar * cert, const uschar * pkey, uschar ** errstr)
1384 int rc = tls_add_certfile(state, host, cert, pkey, errstr);
1385 if (rc > 0) return rc;
1386 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1391 creds_load_cabundle(exim_gnutls_state_st * state, const uschar * bundle,
1392 const host_item * host, uschar ** errstr)
1395 struct stat statbuf;
1397 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1398 if (Ustrcmp(bundle, "system") == 0 || Ustrncmp(bundle, "system,", 7) == 0)
1399 cert_count = gnutls_certificate_set_x509_system_trust(state->lib_state.x509_cred);
1403 if (Ustat(bundle, &statbuf) < 0)
1405 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1406 "(tls_verify_certificates): %s", bundle, strerror(errno));
1410 #ifndef SUPPORT_CA_DIR
1411 /* The test suite passes in /dev/null; we could check for that path explicitly,
1412 but who knows if someone has some weird FIFO which always dumps some certs, or
1413 other weirdness. The thing we really want to check is that it's not a
1414 directory, since while OpenSSL supports that, GnuTLS does not.
1415 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1416 if (S_ISDIR(statbuf.st_mode))
1418 log_write(0, LOG_MAIN|LOG_PANIC,
1419 "tls_verify_certificates \"%s\" is a directory", bundle);
1424 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1425 bundle, statbuf.st_size);
1427 if (statbuf.st_size == 0)
1430 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1436 #ifdef SUPPORT_CA_DIR
1437 (statbuf.st_mode & S_IFMT) == S_IFDIR
1439 gnutls_certificate_set_x509_trust_dir(state->lib_state.x509_cred,
1440 CS bundle, GNUTLS_X509_FMT_PEM)
1443 gnutls_certificate_set_x509_trust_file(state->lib_state.x509_cred,
1444 CS bundle, GNUTLS_X509_FMT_PEM);
1446 #ifdef SUPPORT_CA_DIR
1447 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1448 when using the directory-of-certs config model. */
1450 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1452 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1454 state->lib_state.ca_rdn_emulate = TRUE;
1459 return tls_error_gnu(state, US"setting certificate trust", cert_count, errstr);
1461 debug_printf("Added %d certificate authorities\n", cert_count);
1468 creds_load_crl(exim_gnutls_state_st * state, const uschar * crl, uschar ** errstr)
1471 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", crl);
1472 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->lib_state.x509_cred,
1473 CS crl, GNUTLS_X509_FMT_PEM)) < 0)
1474 return tls_error_gnu(state, US"gnutls_certificate_set_x509_crl_file",
1475 cert_count, errstr);
1477 DEBUG(D_tls) debug_printf("Processed %d CRLs\n", cert_count);
1483 creds_load_pristring(exim_gnutls_state_st * state, const uschar * p,
1484 const char ** errpos)
1488 p = exim_default_gnutls_priority;
1490 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1492 return gnutls_priority_init( (gnutls_priority_t *) &state->lib_state.pri_cache,
1497 tls_server_creds_init(void)
1499 uschar * dummy_errstr;
1500 unsigned lifetime = 0;
1502 state_server.lib_state = null_tls_preload;
1503 if (gnutls_certificate_allocate_credentials(
1504 (gnutls_certificate_credentials_t *) &state_server.lib_state.x509_cred))
1506 state_server.lib_state.x509_cred = NULL;
1509 creds_basic_init(state_server.lib_state.x509_cred, TRUE);
1511 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1512 /* If tls_certificate has any $ indicating expansions, it is not good.
1513 If tls_privatekey is set but has $, not good. Likewise for tls_ocsp_file.
1514 If all good (and tls_certificate set), load the cert(s). */
1516 if ( opt_set_and_noexpand(tls_certificate)
1517 # ifndef DISABLE_OCSP
1518 && opt_unset_or_noexpand(tls_ocsp_file)
1520 && opt_unset_or_noexpand(tls_privatekey))
1522 /* Set watches on the filenames. The implementation does de-duplication
1523 so we can just blindly do them all.
1526 if ( tls_set_watch(tls_certificate, TRUE)
1527 # ifndef DISABLE_OCSP
1528 && tls_set_watch(tls_ocsp_file, TRUE)
1530 && tls_set_watch(tls_privatekey, TRUE))
1532 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1533 if (creds_load_server_certs(&state_server, tls_certificate,
1534 tls_privatekey && *tls_privatekey ? tls_privatekey : tls_certificate,
1535 # ifdef DISABLE_OCSP
1540 &dummy_errstr) == 0)
1541 state_server.lib_state.conn_certs = TRUE;
1544 else if ( !tls_certificate && !tls_privatekey
1545 # ifndef DISABLE_OCSP
1549 { /* Generate & preload a selfsigned cert. No files to watch. */
1550 if ((tls_install_selfsign(&state_server, &dummy_errstr)) == OK)
1552 state_server.lib_state.conn_certs = TRUE;
1553 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1557 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1559 /* If tls_verify_certificates is non-empty and has no $, load CAs.
1560 If none was configured and we can't handle "system", treat as empty. */
1562 if ( opt_set_and_noexpand(tls_verify_certificates)
1563 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1564 && Ustrcmp(tls_verify_certificates, "system") != 0
1568 if (tls_set_watch(tls_verify_certificates, FALSE))
1570 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1571 if (creds_load_cabundle(&state_server, tls_verify_certificates,
1572 NULL, &dummy_errstr) != OK)
1574 state_server.lib_state.cabundle = TRUE;
1576 /* If CAs loaded and tls_crl is non-empty and has no $, load it */
1578 if (opt_set_and_noexpand(tls_crl))
1580 if (tls_set_watch(tls_crl, FALSE))
1582 DEBUG(D_tls) debug_printf("TLS: preloading CRL for server\n");
1583 if (creds_load_crl(&state_server, tls_crl, &dummy_errstr) != OK)
1585 state_server.lib_state.crl = TRUE;
1589 DEBUG(D_tls) debug_printf("TLS: not preloading CRL for server\n");
1593 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1594 #endif /* EXIM_HAVE_INOTIFY */
1596 /* If tls_require_ciphers is non-empty and has no $, load the
1597 ciphers priority cache. If unset, load with the default.
1598 (server-only as the client one depends on non/DANE) */
1600 if (!tls_require_ciphers || opt_set_and_noexpand(tls_require_ciphers))
1602 const char * dummy_errpos;
1603 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server: %s\n",
1604 tls_require_ciphers);
1605 if ( creds_load_pristring(&state_server, tls_require_ciphers, &dummy_errpos)
1607 state_server.lib_state.pri_string = TRUE;
1610 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1615 /* Preload whatever creds are static, onto a transport. The client can then
1616 just copy the pointer as it starts up. */
1618 /*XXX this is not called for a cmdline send. But one needing to use >1 conn would benefit,
1619 and there seems little downside. */
1622 tls_client_creds_init(transport_instance * t, BOOL watch)
1624 smtp_transport_options_block * ob = t->options_block;
1625 exim_gnutls_state_st tpt_dummy_state;
1626 host_item * dummy_host = (host_item *)1;
1627 uschar * dummy_errstr;
1629 if ( !exim_gnutls_base_init_done
1630 && tls_g_init(&dummy_errstr) != OK)
1633 ob->tls_preload = null_tls_preload;
1634 if (gnutls_certificate_allocate_credentials(
1635 (struct gnutls_certificate_credentials_st **)&ob->tls_preload.x509_cred))
1637 ob->tls_preload.x509_cred = NULL;
1640 creds_basic_init(ob->tls_preload.x509_cred, FALSE);
1642 tpt_dummy_state.session = NULL;
1643 tpt_dummy_state.lib_state = ob->tls_preload;
1645 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1646 if ( opt_set_and_noexpand(ob->tls_certificate)
1647 && opt_unset_or_noexpand(ob->tls_privatekey))
1650 || ( tls_set_watch(ob->tls_certificate, FALSE)
1651 && tls_set_watch(ob->tls_privatekey, FALSE)
1654 const uschar * pkey = ob->tls_privatekey;
1657 debug_printf("TLS: preloading client certs for transport '%s'\n", t->name);
1659 /* The state->lib_state.x509_cred is used for the certs load, and is the sole
1660 structure element used. So we can set up a dummy. The hoat arg only
1661 selects a retcode in case of fail, so any value */
1663 if (creds_load_client_certs(&tpt_dummy_state, dummy_host,
1664 ob->tls_certificate, pkey ? pkey : ob->tls_certificate,
1665 &dummy_errstr) == OK)
1666 ob->tls_preload.conn_certs = TRUE;
1671 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1673 /* If tls_verify_certificates is non-empty and has no $, load CAs.
1674 If none was configured and we can't handle "system", treat as empty. */
1676 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1677 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1678 && Ustrcmp(ob->tls_verify_certificates, "system") != 0
1682 if (!watch || tls_set_watch(ob->tls_verify_certificates, FALSE))
1685 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1686 if (creds_load_cabundle(&tpt_dummy_state, ob->tls_verify_certificates,
1687 dummy_host, &dummy_errstr) != OK)
1689 ob->tls_preload.cabundle = TRUE;
1691 if (opt_set_and_noexpand(ob->tls_crl))
1693 if (!watch || tls_set_watch(ob->tls_crl, FALSE))
1695 DEBUG(D_tls) debug_printf("TLS: preloading CRL for transport '%s'\n", t->name);
1696 if (creds_load_crl(&tpt_dummy_state, ob->tls_crl, &dummy_errstr) != OK)
1698 ob->tls_preload.crl = TRUE;
1702 DEBUG(D_tls) debug_printf("TLS: not preloading CRL, for transport '%s'\n", t->name);
1707 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1709 /* We do not preload tls_require_ciphers to to the transport as it implicitly
1710 depends on DANE or plain usage. */
1716 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1717 /* Invalidate the creds cached, by dropping the current ones.
1718 Call when we notice one of the source files has changed. */
1721 tls_server_creds_invalidate(void)
1723 if (state_server.lib_state.pri_cache)
1724 gnutls_priority_deinit(state_server.lib_state.pri_cache);
1725 state_server.lib_state.pri_cache = NULL;
1727 if (state_server.lib_state.x509_cred)
1728 gnutls_certificate_free_credentials(state_server.lib_state.x509_cred);
1729 state_server.lib_state = null_tls_preload;
1734 tls_client_creds_invalidate(transport_instance * t)
1736 smtp_transport_options_block * ob = t->options_block;
1737 if (ob->tls_preload.x509_cred)
1738 gnutls_certificate_free_credentials(ob->tls_preload.x509_cred);
1739 ob->tls_preload = null_tls_preload;
1744 /*************************************************
1745 * Variables re-expanded post-SNI *
1746 *************************************************/
1748 /* Called from both server and client code, via tls_init(), and also from
1749 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1751 We can tell the two apart by state->received_sni being non-NULL in callback.
1753 The callback should not call us unless state->trigger_sni_changes is true,
1754 which we are responsible for setting on the first pass through.
1757 state exim_gnutls_state_st *
1758 errstr error string pointer
1760 Returns: OK/DEFER/FAIL
1764 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1767 const host_item *host = state->host; /* macro should be reconsidered? */
1768 const uschar *saved_tls_certificate = NULL;
1769 const uschar *saved_tls_privatekey = NULL;
1770 const uschar *saved_tls_verify_certificates = NULL;
1771 const uschar *saved_tls_crl = NULL;
1774 /* We check for tls_sni *before* expansion. */
1775 if (!host) /* server */
1776 if (!state->received_sni)
1778 if ( state->tls_certificate
1779 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1780 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1781 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1784 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI\n");
1785 state->trigger_sni_changes = TRUE;
1788 else /* SNI callback case */
1790 /* useful for debugging */
1791 saved_tls_certificate = state->exp_tls_certificate;
1792 saved_tls_privatekey = state->exp_tls_privatekey;
1793 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1794 saved_tls_crl = state->exp_tls_crl;
1797 if (!state->lib_state.x509_cred)
1799 if ((rc = gnutls_certificate_allocate_credentials(
1800 (gnutls_certificate_credentials_t *) &state->lib_state.x509_cred)))
1801 return tls_error_gnu(state, US"gnutls_certificate_allocate_credentials",
1803 creds_basic_init(state->lib_state.x509_cred, !host);
1807 /* remember: Expand_check_tlsvar() is expand_check() but fiddling with
1808 state members, assuming consistent naming; and expand_check() returns
1809 false if expansion failed, unless expansion was forced to fail. */
1811 /* check if we at least have a certificate, before doing expensive
1814 if (!state->lib_state.conn_certs)
1816 if ( !Expand_check_tlsvar(tls_certificate, errstr)
1817 || f.expand_string_forcedfail)
1819 if (f.expand_string_forcedfail)
1820 *errstr = US"expansion of tls_certificate failed";
1824 /* certificate is mandatory in server, optional in client */
1826 if ( !state->exp_tls_certificate
1827 || !*state->exp_tls_certificate
1830 return tls_install_selfsign(state, errstr);
1832 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1834 if ( state->tls_privatekey && !Expand_check_tlsvar(tls_privatekey, errstr)
1835 || f.expand_string_forcedfail
1838 if (f.expand_string_forcedfail)
1839 *errstr = US"expansion of tls_privatekey failed";
1843 /* tls_privatekey is optional, defaulting to same file as certificate */
1845 if (!state->tls_privatekey || !*state->tls_privatekey)
1847 state->tls_privatekey = state->tls_certificate;
1848 state->exp_tls_privatekey = state->exp_tls_certificate;
1851 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1854 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1855 state->exp_tls_certificate, state->exp_tls_privatekey);
1857 if (state->received_sni)
1858 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1859 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1862 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1863 load = FALSE; /* avoid re-loading the same certs */
1865 else /* unload the pre-SNI certs before loading new ones */
1867 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair\n");
1868 gnutls_certificate_free_keys(state->lib_state.x509_cred);
1873 ? creds_load_client_certs(state, host, state->exp_tls_certificate,
1874 state->exp_tls_privatekey, errstr)
1875 : creds_load_server_certs(state, state->exp_tls_certificate,
1876 state->exp_tls_privatekey,
1885 DEBUG(D_tls) debug_printf("load-cert: '%s'\n", *errstr);
1893 debug_printf("%s certs were preloaded\n", host ? "client" : "server");
1895 if (!state->tls_privatekey) state->tls_privatekey = state->tls_certificate;
1896 state->exp_tls_certificate = US state->tls_certificate;
1897 state->exp_tls_privatekey = US state->tls_privatekey;
1899 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1900 if (state->lib_state.ocsp_hook)
1901 gnutls_handshake_set_hook_function(state->session,
1902 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1907 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1908 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1909 error message is provided. However, if we just refrain from setting anything up
1910 in that case, certificate verification fails, which seems to be the correct
1912 If none was configured and we can't handle "system", treat as empty. */
1914 if (!state->lib_state.cabundle)
1916 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1918 if (!Expand_check_tlsvar(tls_verify_certificates, errstr))
1920 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1921 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1922 state->exp_tls_verify_certificates = NULL;
1924 if (state->tls_crl && *state->tls_crl)
1925 if (!Expand_check_tlsvar(tls_crl, errstr))
1928 if (!(state->exp_tls_verify_certificates &&
1929 *state->exp_tls_verify_certificates))
1932 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1933 /* With no tls_verify_certificates, we ignore tls_crl too */
1940 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1943 rc = creds_load_cabundle(state, state->exp_tls_verify_certificates, host, errstr);
1944 if (rc != OK) return rc;
1949 debug_printf("%s CA bundle was preloaded\n", host ? "client" : "server");
1950 state->exp_tls_verify_certificates = US state->tls_verify_certificates;
1952 #ifdef SUPPORT_CA_DIR
1953 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1954 when using the directory-of-certs config model. */
1955 if (state->lib_state.ca_rdn_emulate)
1956 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1961 if (!state->lib_state.crl)
1963 if ( state->tls_crl && *state->tls_crl
1964 && state->exp_tls_crl && *state->exp_tls_crl)
1965 return creds_load_crl(state, state->exp_tls_crl, errstr);
1970 debug_printf("%s CRL was preloaded\n", host ? "client" : "server");
1971 state->exp_tls_crl = US state->tls_crl;
1980 /*************************************************
1981 * Set X.509 state variables *
1982 *************************************************/
1984 /* In GnuTLS, the registered cert/key are not replaced by a later
1985 set of a cert/key, so for SNI support we need a whole new x509_cred
1986 structure. Which means various other non-re-expanded pieces of state
1987 need to be re-set in the new struct, so the setting logic is pulled
1991 state exim_gnutls_state_st *
1992 errstr error string pointer
1994 Returns: OK/DEFER/FAIL
1998 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
2001 const host_item *host = state->host; /* macro should be reconsidered? */
2003 /* Create D-H parameters, or read them from the cache file. This function does
2004 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
2005 client-side params. */
2009 if (!dh_server_params)
2010 if ((rc = init_server_dh(errstr)) != OK) return rc;
2012 /* Unnecessary & discouraged with 3.6.0 or later, according to docs. But without it,
2013 no DHE- ciphers are advertised. */
2014 gnutls_certificate_set_dh_params(state->lib_state.x509_cred, dh_server_params);
2017 /* Link the credentials to the session. */
2019 if ((rc = gnutls_credentials_set(state->session,
2020 GNUTLS_CRD_CERTIFICATE, state->lib_state.x509_cred)))
2021 return tls_error_gnu(state, US"gnutls_credentials_set", rc, errstr);
2026 /*************************************************
2027 * Initialize for GnuTLS *
2028 *************************************************/
2031 /* Called from both server and client code. In the case of a server, errors
2032 before actual TLS negotiation return DEFER.
2035 host connected host, if client; NULL if server
2036 ob tranport options block, if client; NULL if server
2037 require_ciphers tls_require_ciphers setting
2038 caller_state returned state-info structure
2039 errstr error string pointer
2041 Returns: OK/DEFER/FAIL
2046 const host_item *host,
2047 smtp_transport_options_block * ob,
2048 const uschar * require_ciphers,
2049 exim_gnutls_state_st **caller_state,
2053 exim_gnutls_state_st * state;
2057 if ( !exim_gnutls_base_init_done
2058 && (rc = tls_g_init(errstr)) != OK)
2063 /* For client-side sessions we allocate a context. This lets us run
2064 several in parallel. */
2066 int old_pool = store_pool;
2067 store_pool = POOL_PERM;
2068 state = store_get(sizeof(exim_gnutls_state_st), GET_UNTAINTED);
2069 store_pool = old_pool;
2071 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2072 state->lib_state = ob->tls_preload;
2074 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
2075 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
2077 state->tls_certificate = ob->tls_certificate;
2078 state->tls_privatekey = ob->tls_privatekey;
2079 state->tls_sni = ob->tls_sni;
2080 state->tls_verify_certificates = ob->tls_verify_certificates;
2081 state->tls_crl = ob->tls_crl;
2085 /* Server operations always use the one state_server context. It is not
2086 shared because we have forked a fresh process for every receive. However it
2087 can get re-used for successive TLS sessions on a single TCP connection. */
2089 state = &state_server;
2091 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
2092 rc = gnutls_init(&state->session, GNUTLS_SERVER);
2094 state->tls_certificate = tls_certificate;
2095 state->tls_privatekey = tls_privatekey;
2096 state->tls_sni = NULL;
2097 state->tls_verify_certificates = tls_verify_certificates;
2098 state->tls_crl = tls_crl;
2101 return tls_error_gnu(state, US"gnutls_init", rc, errstr);
2103 state->tls_require_ciphers = require_ciphers;
2106 /* This handles the variables that might get re-expanded after TLS SNI;
2107 tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
2110 debug_printf("Expanding various TLS configuration options for session credentials\n");
2111 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
2113 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
2114 requires a new structure afterwards. */
2116 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
2118 /* set SNI in client, only */
2121 if (!expand_check(state->tls_sni, US"tls_out_sni", &state->tlsp->sni, errstr))
2123 if (state->tlsp->sni && *state->tlsp->sni)
2126 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
2127 sz = Ustrlen(state->tlsp->sni);
2128 if ((rc = gnutls_server_name_set(state->session,
2129 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
2130 return tls_error_gnu(state, US"gnutls_server_name_set", rc, errstr);
2133 else if (state->tls_sni)
2134 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
2135 "have an SNI set for a server [%s]\n", state->tls_sni);
2137 if (!state->lib_state.pri_string)
2139 const uschar * p = NULL;
2140 const char * errpos;
2142 /* This is the priority string support,
2143 http://www.gnutls.org/manual/html_node/Priority-Strings.html
2144 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
2145 This was backwards incompatible, but means Exim no longer needs to track
2146 all algorithms and provide string forms for them. */
2148 if (state->tls_require_ciphers && *state->tls_require_ciphers)
2150 if (!Expand_check_tlsvar(tls_require_ciphers, errstr))
2152 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
2154 p = state->exp_tls_require_ciphers;
2155 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
2159 if ((rc = creds_load_pristring(state, p, &errpos)))
2160 return tls_error_gnu(state, string_sprintf(
2161 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
2162 p, (long)(errpos - CS p), errpos),
2167 DEBUG(D_tls) debug_printf("cipher list preloaded\n");
2168 state->exp_tls_require_ciphers = US state->tls_require_ciphers;
2172 if ((rc = gnutls_priority_set(state->session, state->lib_state.pri_cache)))
2173 return tls_error_gnu(state, US"gnutls_priority_set", rc, errstr);
2175 /* This also sets the server ticket expiration time to the same, and
2176 the STEK rotation time to 3x. */
2178 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
2180 /* Reduce security in favour of increased compatibility, if the admin
2181 decides to make that trade-off. */
2182 if (gnutls_compat_mode)
2184 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
2185 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
2186 gnutls_session_enable_compatibility_mode(state->session);
2188 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
2192 *caller_state = state;
2198 /*************************************************
2199 * Extract peer information *
2200 *************************************************/
2202 static const uschar *
2203 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
2204 gnutls_mac_algorithm_t mac)
2207 gnutls_kx_algorithm_t kx_i;
2208 gnutls_cipher_algorithm_t cipher_i;
2209 gnutls_mac_algorithm_t mac_i;
2212 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
2214 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
2215 return cipher_stdname(cs_id[0], cs_id[1]);
2221 /* Called from both server and client code.
2222 Only this is allowed to set state->peerdn and state->have_set_peerdn
2223 and we use that to detect double-calls.
2225 NOTE: the state blocks last while the TLS connection is up, which is fine
2226 for logging in the server side, but for the client side, we log after teardown
2227 in src/deliver.c. While the session is up, we can twist about states and
2228 repoint tls_* globals, but those variables used for logging or other variable
2229 expansion that happens _after_ delivery need to have a longer life-time.
2231 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
2232 doing this more than once per generation of a state context. We set them in
2233 the state context, and repoint tls_* to them. After the state goes away, the
2234 tls_* copies of the pointers remain valid and client delivery logging is happy.
2236 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
2240 state exim_gnutls_state_st *
2241 errstr pointer to error string
2243 Returns: OK/DEFER/FAIL
2247 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
2249 gnutls_session_t session = state->session;
2250 const gnutls_datum_t * cert_list;
2252 unsigned int cert_list_size = 0;
2253 gnutls_protocol_t protocol;
2254 gnutls_cipher_algorithm_t cipher;
2255 gnutls_kx_algorithm_t kx;
2256 gnutls_mac_algorithm_t mac;
2257 gnutls_certificate_type_t ct;
2258 gnutls_x509_crt_t crt;
2262 if (state->have_set_peerdn)
2264 state->have_set_peerdn = TRUE;
2266 state->peerdn = NULL;
2269 cipher = gnutls_cipher_get(session);
2270 protocol = gnutls_protocol_get_version(session);
2271 mac = gnutls_mac_get(session);
2273 #ifdef GNUTLS_TLS1_3
2274 protocol >= GNUTLS_TLS1_3 ? 0 :
2276 gnutls_kx_get(session);
2278 old_pool = store_pool;
2280 tls_support * tlsp = state->tlsp;
2281 store_pool = POOL_PERM;
2283 #ifdef SUPPORT_GNUTLS_SESS_DESC
2286 uschar * s = US gnutls_session_get_desc(session), c;
2288 /* Nikos M suggests we use this by preference. It returns like:
2289 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
2291 For partial back-compat, put a colon after the TLS version, replace the
2292 )-( grouping with __, replace in-group - with _ and append the :keysize. */
2294 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
2296 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
2298 tlsp->ver = string_copyn(g->s, g->ptr);
2299 for (uschar * p = US tlsp->ver; *p; p++)
2300 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
2302 g = string_catn(g, US":", 1);
2303 if (*s) s++; /* now on _ between groups */
2306 for (*++s && ++s; (c = *s) && c != ')'; s++)
2307 g = string_catn(g, c == '-' ? US"_" : s, 1);
2308 /* now on ) closing group */
2309 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
2310 /* now on _ between groups */
2312 g = string_catn(g, US":", 1);
2313 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
2314 state->ciphersuite = string_from_gstring(g);
2317 state->ciphersuite = string_sprintf("%s:%s:%d",
2318 gnutls_protocol_get_name(protocol),
2319 gnutls_cipher_suite_get_name(kx, cipher, mac),
2320 (int) gnutls_cipher_get_key_size(cipher) * 8);
2322 /* I don't see a way that spaces could occur, in the current GnuTLS
2323 code base, but it was a concern in the old code and perhaps older GnuTLS
2324 releases did return "TLS 1.0"; play it safe, just in case. */
2326 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
2327 tlsp->ver = string_copyn(state->ciphersuite,
2328 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
2331 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
2333 tlsp->cipher = state->ciphersuite;
2334 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
2336 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
2338 store_pool = old_pool;
2341 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
2343 if (!cert_list || cert_list_size == 0)
2345 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
2346 cert_list, cert_list_size);
2347 if (state->verify_requirement >= VERIFY_REQUIRED)
2348 return tls_error(US"certificate verification failed",
2349 US"no certificate received from peer", state->host, errstr);
2353 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
2355 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
2357 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
2358 if (state->verify_requirement >= VERIFY_REQUIRED)
2359 return tls_error(US"certificate verification not possible, unhandled type",
2360 ctn, state->host, errstr);
2364 #define exim_gnutls_peer_err(Label) \
2366 if (rc != GNUTLS_E_SUCCESS) \
2368 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
2369 (Label), gnutls_strerror(rc)); \
2370 if (state->verify_requirement >= VERIFY_REQUIRED) \
2371 return tls_error_gnu(state, (Label), rc, errstr); \
2376 rc = import_cert(&cert_list[0], &crt);
2377 exim_gnutls_peer_err(US"cert 0");
2379 state->tlsp->peercert = state->peercert = crt;
2382 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
2383 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
2385 exim_gnutls_peer_err(US"getting size for cert DN failed");
2386 return FAIL; /* should not happen */
2388 dn_buf = store_get_perm(sz, GET_TAINTED);
2389 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
2390 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
2392 state->peerdn = dn_buf;
2395 #undef exim_gnutls_peer_err
2401 /*************************************************
2402 * Verify peer certificate *
2403 *************************************************/
2405 /* Called from both server and client code.
2406 *Should* be using a callback registered with
2407 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
2408 the peer information, but that's too new for some OSes.
2411 state exim_gnutls_state_st *
2412 errstr where to put an error message
2415 FALSE if the session should be rejected
2416 TRUE if the cert is okay or we just don't care
2420 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
2425 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
2427 rc = peer_status(state, errstr);
2429 if (state->verify_requirement == VERIFY_NONE)
2432 if (rc != OK || !state->peerdn)
2434 verify = GNUTLS_CERT_INVALID;
2435 *errstr = US"certificate not supplied";
2441 if (state->verify_requirement == VERIFY_DANE && state->host)
2443 /* Using dane_verify_session_crt() would be easy, as it does it all for us
2444 including talking to a DNS resolver. But we want to do that bit ourselves
2445 as the testsuite intercepts and fakes its own DNS environment. */
2450 const gnutls_datum_t * certlist =
2451 gnutls_certificate_get_peers(state->session, &lsize);
2452 int usage = tls_out.tlsa_usage;
2454 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2455 /* Split the TLSA records into two sets, TA and EE selectors. Run the
2456 dane-verification separately so that we know which selector verified;
2457 then we know whether to do name-verification (needed for TA but not EE). */
2459 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
2460 { /* a mixed-usage bundle */
2465 for (nrec = 0; state->dane_data_len[nrec]; ) nrec++;
2468 dd = store_get(nrec * sizeof(uschar *), GET_UNTAINTED);
2469 ddl = store_get(nrec * sizeof(int), GET_UNTAINTED);
2472 if ((rc = dane_state_init(&s, 0)))
2475 for (usage = DANESSL_USAGE_DANE_EE;
2476 usage >= DANESSL_USAGE_DANE_TA; usage--)
2477 { /* take records with this usage */
2478 for (j = i = 0; i < nrec; i++)
2479 if (state->dane_data[i][0] == usage)
2481 dd[j] = state->dane_data[i];
2482 ddl[j++] = state->dane_data_len[i];
2489 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
2492 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
2493 gnutls_certificate_type_get(state->session),
2495 usage == DANESSL_USAGE_DANE_EE
2496 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2500 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
2502 else if (verify == 0) /* verification passed */
2510 if (rc) goto tlsa_prob;
2515 if ( (rc = dane_state_init(&s, 0))
2516 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
2518 || (rc = dane_verify_crt_raw(s, certlist, lsize,
2519 gnutls_certificate_type_get(state->session),
2521 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2522 usage == (1 << DANESSL_USAGE_DANE_EE)
2523 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2532 if (verify != 0) /* verification failed */
2535 (void) dane_verification_status_print(verify, &str, 0);
2536 *errstr = US str.data; /* don't bother to free */
2540 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2541 /* If a TA-mode TLSA record was used for verification we must additionally
2542 verify the cert name (but not the CA chain). For EE-mode, skip it. */
2544 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2547 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2550 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2551 /* Assume that the name on the A-record is the one that should be matching
2552 the cert. An alternate view is that the domain part of the email address
2553 is also permissible. */
2555 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2556 CS state->host->name))
2558 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2563 #endif /*SUPPORT_DANE*/
2565 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2568 /* Handle the result of verification. INVALID is set if any others are. */
2570 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2572 state->peer_cert_verified = FALSE;
2575 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2580 if (gnutls_certificate_verification_status_print(verify,
2581 gnutls_certificate_type_get(state->session), &txt, 0)
2582 == GNUTLS_E_SUCCESS)
2584 debug_printf("%s\n", txt.data);
2585 gnutls_free(txt.data);
2589 *errstr = verify & GNUTLS_CERT_REVOKED
2590 ? US"certificate revoked" : US"certificate invalid";
2594 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2595 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2597 if (state->verify_requirement >= VERIFY_REQUIRED)
2600 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2605 /* Client side, check the server's certificate name versus the name on the
2606 A-record for the connection we made. What to do for server side - what name
2607 to use for client? We document that there is no such checking for server
2610 if ( state->exp_tls_verify_cert_hostnames
2611 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2612 CS state->exp_tls_verify_cert_hostnames)
2616 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2617 if (state->verify_requirement >= VERIFY_REQUIRED)
2622 state->peer_cert_verified = TRUE;
2623 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2624 state->peerdn ? state->peerdn : US"<unset>");
2628 state->tlsp->peerdn = state->peerdn;
2633 *errstr = string_sprintf("TLSA record problem: %s",
2634 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2638 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2645 /* ------------------------------------------------------------------------ */
2648 /* Logging function which can be registered with
2649 * gnutls_global_set_log_function()
2650 * gnutls_global_set_log_level() 0..9
2652 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2654 exim_gnutls_logger_cb(int level, const char *message)
2656 size_t len = strlen(message);
2659 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2662 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2663 message[len-1] == '\n' ? "" : "\n");
2668 /* Called after client hello, should handle SNI work.
2669 This will always set tls_sni (state->received_sni) if available,
2670 and may trigger presenting different certificates,
2671 if state->trigger_sni_changes is TRUE.
2673 Should be registered with
2674 gnutls_handshake_set_post_client_hello_function()
2676 "This callback must return 0 on success or a gnutls error code to terminate the
2679 For inability to get SNI information, we return 0.
2680 We only return non-zero if re-setup failed.
2681 Only used for server-side TLS.
2685 exim_sni_handling_cb(gnutls_session_t session)
2687 char sni_name[MAX_HOST_LEN];
2688 size_t data_len = MAX_HOST_LEN;
2689 exim_gnutls_state_st *state = &state_server;
2690 unsigned int sni_type;
2692 uschar * dummy_errstr;
2694 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2695 if (rc != GNUTLS_E_SUCCESS)
2698 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2699 debug_printf("TLS: no SNI presented in handshake\n");
2701 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2702 gnutls_strerror(rc), rc);
2706 if (sni_type != GNUTLS_NAME_DNS)
2708 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2712 /* We now have a UTF-8 string in sni_name */
2713 old_pool = store_pool;
2714 store_pool = POOL_PERM;
2715 state->received_sni = string_copy_taint(US sni_name, GET_TAINTED);
2716 store_pool = old_pool;
2718 /* We set this one now so that variable expansions below will work */
2719 state->tlsp->sni = state->received_sni;
2721 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2722 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2724 if (!state->trigger_sni_changes)
2727 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2729 /* If the setup of certs/etc failed before handshake, TLS would not have
2730 been offered. The best we can do now is abort. */
2731 DEBUG(D_tls) debug_printf("expansion for SNI-dependent session files failed\n");
2732 return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
2735 rc = tls_set_remaining_x509(state, &dummy_errstr);
2736 if (rc != OK) return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
2743 #ifndef DISABLE_EVENT
2745 We use this callback to get observability and detail-level control
2746 for an exim TLS connection (either direction), raising a tls:cert event
2747 for each cert in the chain presented by the peer. Any event
2748 can deny verification.
2750 Return 0 for the handshake to continue or non-zero to terminate.
2754 verify_cb(gnutls_session_t session)
2756 const gnutls_datum_t * cert_list;
2757 unsigned int cert_list_size = 0;
2758 gnutls_x509_crt_t crt;
2761 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2763 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2764 while (cert_list_size--)
2766 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2768 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2769 cert_list_size, gnutls_strerror(rc));
2773 state->tlsp->peercert = crt;
2774 if ((yield = event_raise(state->event_action,
2775 US"tls:cert", string_sprintf("%d", cert_list_size), &errno)))
2777 log_write(0, LOG_MAIN,
2778 "SSL verify denied by event-action: depth=%d: %s",
2779 cert_list_size, yield);
2780 return 1; /* reject */
2782 state->tlsp->peercert = NULL;
2792 ddump(gnutls_datum_t * d)
2794 gstring * g = string_get((d->size+1) * 2);
2795 uschar * s = d->data;
2796 for (unsigned i = d->size; i > 0; i--, s++)
2798 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2799 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2805 post_handshake_debug(exim_gnutls_state_st * state)
2807 #ifdef SUPPORT_GNUTLS_SESS_DESC
2808 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2811 #ifdef SUPPORT_GNUTLS_KEYLOG
2812 # ifdef EXIM_HAVE_TLS1_3
2813 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2818 gnutls_datum_t c, s;
2820 /* For TLS1.2 we only want the client random and the master secret */
2821 gnutls_session_get_random(state->session, &c, &s);
2822 gnutls_session_get_master_secret(state->session, &s);
2825 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2828 debug_printf("To get keying info for TLS1.3 is hard:\n"
2829 " Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,\n"
2830 " and make sure it is writable by the Exim runtime user.\n"
2831 " Add SSLKEYLOGFILE to keep_environment in the exim config.\n"
2832 " Start Exim as root.\n"
2833 " If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2834 " (works for TLS1.2 also, and saves cut-paste into file).\n"
2835 " Trying to use add_environment for this will not work\n");
2840 #ifdef EXIM_HAVE_TLS_RESUME
2842 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2843 unsigned incoming, const gnutls_datum_t * msg)
2845 DEBUG(D_tls) debug_printf("newticket cb\n");
2846 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2851 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2853 /* Should the server offer session resumption? */
2854 tls_in.resumption = RESUME_SUPPORTED;
2855 if (verify_check_host(&tls_resumption_hosts) == OK)
2858 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2859 an offered resumption is unacceptable. We lose one resumption per ticket
2860 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2861 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2862 least they go out in a single packet. */
2864 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2865 &server_sessticket_key)))
2866 tls_in.resumption |= RESUME_SERVER_TICKET;
2869 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2871 /* Try to tell if we see a ticket request */
2872 gnutls_handshake_set_hook_function(state->session,
2873 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2878 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2880 if (gnutls_session_resumption_requested(state->session))
2882 /* This tells us the client sent a full ticket. We use a
2883 callback on session-ticket request, elsewhere, to tell
2884 if a client asked for a ticket. */
2886 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2887 DEBUG(D_tls) debug_printf("client requested resumption\n");
2889 if (gnutls_session_is_resumed(state->session))
2891 tls_in.resumption |= RESUME_USED;
2892 DEBUG(D_tls) debug_printf("Session resumed\n");
2895 #endif /* EXIM_HAVE_TLS_RESUME */
2898 #ifdef EXIM_HAVE_ALPN
2899 /* Expand and convert an Exim list to a gnutls_datum list. False return for fail.
2900 NULL plist return for silent no-ALPN.
2904 tls_alpn_plist(uschar ** tls_alpn, const gnutls_datum_t ** plist, unsigned * plen,
2909 if (!expand_check(*tls_alpn, US"tls_alpn", &exp_alpn, errstr))
2914 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
2919 const uschar * list = exp_alpn;
2925 while (string_nextinlist(&list, &sep, NULL, 0)) cnt++;
2927 p = store_get(sizeof(gnutls_datum_t) * cnt, exp_alpn);
2929 for (int i = 0; s = string_nextinlist(&list, &sep, NULL, 0); i++)
2930 { p[i].data = s; p[i].size = Ustrlen(s); }
2931 *plist = (*plen = cnt) ? p : NULL;
2937 tls_server_set_acceptable_alpns(exim_gnutls_state_st * state, uschar ** errstr)
2939 uschar * local_alpn = string_copy(tls_alpn);
2941 const gnutls_datum_t * plist;
2944 if (tls_alpn_plist(&local_alpn, &plist, &plen, errstr) && plist)
2946 /* This seems to be only mandatory if the client sends an ALPN extension;
2947 not trying ALPN is ok. Need to decide how to support server-side must-alpn. */
2949 server_seen_alpn = 0;
2950 if (!(rc = gnutls_alpn_set_protocols(state->session, plist, plen,
2951 GNUTLS_ALPN_MANDATORY)))
2952 gnutls_handshake_set_hook_function(state->session,
2953 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2956 debug_printf("setting alpn protocols: %s\n", US gnutls_strerror(rc));
2959 #endif /* EXIM_HAVE_ALPN */
2961 /* ------------------------------------------------------------------------ */
2962 /* Exported functions */
2967 /*************************************************
2968 * Start a TLS session in a server *
2969 *************************************************/
2971 /* This is called when Exim is running as a server, after having received
2972 the STARTTLS command. It must respond to that command, and then negotiate
2976 errstr pointer to error string
2978 Returns: OK on success
2979 DEFER for errors before the start of the negotiation
2980 FAIL for errors during the negotiation; the server can't
2985 tls_server_start(uschar ** errstr)
2988 exim_gnutls_state_st * state = NULL;
2990 /* Check for previous activation */
2991 if (tls_in.active.sock >= 0)
2993 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2994 smtp_printf("554 Already in TLS\r\n", FALSE);
2998 /* Initialize the library. If it fails, it will already have logged the error
2999 and sent an SMTP response. */
3001 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
3004 #ifdef MEASURE_TIMING
3006 gettimeofday(&t0, NULL);
3009 if ((rc = tls_init(NULL, NULL,
3010 tls_require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
3012 #ifdef MEASURE_TIMING
3013 report_time_since(&t0, US"server tls_init (delta)");
3017 #ifdef EXIM_HAVE_ALPN
3018 tls_server_set_acceptable_alpns(state, errstr);
3021 #ifdef EXIM_HAVE_TLS_RESUME
3022 tls_server_resume_prehandshake(state);
3025 /* If this is a host for which certificate verification is mandatory or
3026 optional, set up appropriately. */
3028 if (verify_check_host(&tls_verify_hosts) == OK)
3031 debug_printf("TLS: a client certificate will be required\n");
3032 state->verify_requirement = VERIFY_REQUIRED;
3033 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3035 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3038 debug_printf("TLS: a client certificate will be requested but not required\n");
3039 state->verify_requirement = VERIFY_OPTIONAL;
3040 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
3045 debug_printf("TLS: a client certificate will not be requested\n");
3046 state->verify_requirement = VERIFY_NONE;
3047 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3050 #ifndef DISABLE_EVENT
3053 state->event_action = event_action;
3054 gnutls_session_set_ptr(state->session, state);
3055 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3059 /* Register SNI handling; always, even if not in tls_certificate, so that the
3060 expansion variable $tls_sni is always available. */
3062 gnutls_handshake_set_post_client_hello_function(state->session,
3063 exim_sni_handling_cb);
3065 /* Set context and tell client to go ahead, except in the case of TLS startup
3066 on connection, where outputting anything now upsets the clients and tends to
3067 make them disconnect. We need to have an explicit fflush() here, to force out
3068 the response. Other smtp_printf() calls do not need it, because in non-TLS
3069 mode, the fflush() happens when smtp_getc() is called. */
3071 if (!state->tlsp->on_connect)
3073 smtp_printf("220 TLS go ahead\r\n", FALSE);
3077 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3078 that the GnuTLS library doesn't.
3079 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
3080 to set (and clear down afterwards) up a pull-timeout callback function that does
3081 a select, so we're no better off unless avoiding signals becomes an issue. */
3083 gnutls_transport_set_ptr2(state->session,
3084 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
3085 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
3086 state->fd_in = fileno(smtp_in);
3087 state->fd_out = fileno(smtp_out);
3089 sigalrm_seen = FALSE;
3090 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3092 rc = gnutls_handshake(state->session);
3093 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3096 if (rc != GNUTLS_E_SUCCESS)
3098 DEBUG(D_tls) debug_printf(" error %d from gnutls_handshake: %s\n",
3099 rc, gnutls_strerror(rc));
3101 /* It seems that, except in the case of a timeout, we have to close the
3102 connection right here; otherwise if the other end is running OpenSSL it hangs
3103 until the server times out. */
3107 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
3108 #ifndef DISABLE_EVENT
3109 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3111 gnutls_db_remove_session(state->session);
3115 tls_error_gnu(state, US"gnutls_handshake", rc, errstr);
3116 #ifndef DISABLE_EVENT
3117 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3119 (void) gnutls_alert_send_appropriate(state->session, rc);
3120 gnutls_deinit(state->session);
3122 shutdown(state->fd_out, SHUT_WR);
3123 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
3124 (void)fclose(smtp_out);
3125 (void)fclose(smtp_in);
3126 smtp_out = smtp_in = NULL;
3132 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3133 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3134 tls_in.ext_master_secret = TRUE;
3137 #ifdef EXIM_HAVE_TLS_RESUME
3138 tls_server_resume_posthandshake(state);
3141 DEBUG(D_tls) post_handshake_debug(state);
3143 #ifdef EXIM_HAVE_ALPN
3144 if (server_seen_alpn > 0)
3147 { /* The client offered ALPN. See what was negotiated. */
3148 gnutls_datum_t p = {.size = 0};
3149 int rc = gnutls_alpn_get_selected_protocol(state->session, &p);
3151 debug_printf("ALPN negotiated: %.*s\n", (int)p.size, p.data);
3153 debug_printf("getting alpn protocol: %s\n", US gnutls_strerror(rc));
3157 else if (server_seen_alpn == 0)
3158 if (verify_check_host(&hosts_require_alpn) == OK)
3160 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_NO_APPLICATION_PROTOCOL);
3161 tls_error(US"handshake", US"ALPN required but not negotiated", NULL, errstr);
3165 DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n");
3167 DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n");
3170 /* Verify after the fact */
3172 if (!verify_certificate(state, errstr))
3174 if (state->verify_requirement != VERIFY_OPTIONAL)
3176 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
3180 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
3184 /* Sets various Exim expansion variables; always safe within server */
3186 extract_exim_vars_from_tls_state(state);
3188 /* TLS has been set up. Adjust the input functions to read via TLS,
3189 and initialize appropriately. */
3191 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3193 receive_getc = tls_getc;
3194 receive_getbuf = tls_getbuf;
3195 receive_get_cache = tls_get_cache;
3196 receive_hasc = tls_hasc;
3197 receive_ungetc = tls_ungetc;
3198 receive_feof = tls_feof;
3199 receive_ferror = tls_ferror;
3208 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
3209 smtp_transport_options_block * ob)
3211 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3213 state->exp_tls_verify_cert_hostnames =
3215 string_domain_utf8_to_alabel(host->certname, NULL);
3220 debug_printf("TLS: server cert verification includes hostname: \"%s\"\n",
3221 state->exp_tls_verify_cert_hostnames);
3229 /* Given our list of RRs from the TLSA lookup, build a lookup block in
3230 GnuTLS-DANE's preferred format. Hang it on the state str for later
3231 use in DANE verification.
3233 We point at the dnsa data not copy it, so it must remain valid until
3234 after verification is done.*/
3237 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
3241 const char ** dane_data;
3242 int * dane_data_len;
3245 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3246 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3247 ) if (rr->type == T_TLSA) i++;
3249 dane_data = store_get(i * sizeof(uschar *), GET_UNTAINTED);
3250 dane_data_len = store_get(i * sizeof(int), GET_UNTAINTED);
3253 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3254 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3255 ) if (rr->type == T_TLSA && rr->size > 3)
3257 const uschar * p = rr->data;
3258 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
3259 uint8_t usage = p[0], sel = p[1], type = p[2];
3262 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
3264 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
3265 || (sel != 0 && sel != 1)
3270 case 0: /* Full: cannot check at present */
3272 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
3274 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
3279 tls_out.tlsa_usage |= 1<<usage;
3280 dane_data[i] = CS p;
3281 dane_data_len[i++] = rr->size;
3284 if (!i) return FALSE;
3286 dane_data[i] = NULL;
3287 dane_data_len[i] = 0;
3289 state->dane_data = (char * const *)dane_data;
3290 state->dane_data_len = dane_data_len;
3297 #ifdef EXIM_HAVE_TLS_RESUME
3298 /* On the client, get any stashed session for the given IP from hints db
3299 and apply it to the ssl-connection for attempted resumption. Although
3300 there is a gnutls_session_ticket_enable_client() interface it is
3301 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
3302 by deafult". There seems to be no way to disable them, so even hosts not
3303 enabled by the transport option will be sent a ticket request. We will
3304 however avoid storing and retrieving session information. */
3307 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
3308 smtp_connect_args * conn_args, smtp_transport_options_block * ob)
3310 tlsp->resumption = RESUME_SUPPORTED;
3312 if (!conn_args->have_lbserver)
3313 { DEBUG(D_tls) debug_printf("resumption not supported on continued-connection\n"); }
3314 else if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, conn_args->host) == OK)
3316 dbdata_tls_session * dt;
3318 open_db dbblock, * dbm_file;
3320 tlsp->host_resumable = TRUE;
3321 tls_client_resmption_key(tlsp, conn_args, ob);
3323 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3324 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
3326 /* We'd like to filter the retrieved session for ticket advisory expiry,
3327 but 3.6.1 seems to give no access to that */
3329 if ((dt = dbfn_read_with_length(dbm_file, tlsp->resume_index, &len)))
3330 if (!(rc = gnutls_session_set_data(session,
3331 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
3333 DEBUG(D_tls) debug_printf("good session\n");
3334 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3336 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
3337 US gnutls_strerror(rc));
3338 dbfn_close(dbm_file);
3345 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
3347 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
3348 but this flag is not set until the second. TLS 1.3 it's the other way about.
3349 Keep both calls as the session data cannot be extracted before handshake
3352 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
3357 DEBUG(D_tls) debug_printf("server offered session ticket\n");
3358 tlsp->ticket_received = TRUE;
3359 tlsp->resumption |= RESUME_SERVER_TICKET;
3361 if (tlsp->host_resumable)
3362 if (!(rc = gnutls_session_get_data2(session, &tkt)))
3364 open_db dbblock, * dbm_file;
3365 int dlen = sizeof(dbdata_tls_session) + tkt.size;
3366 dbdata_tls_session * dt = store_get(dlen, GET_TAINTED);
3368 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
3369 memcpy(dt->session, tkt.data, tkt.size);
3370 gnutls_free(tkt.data);
3372 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3374 /* key for the db is the IP */
3375 dbfn_write(dbm_file, tlsp->resume_index, dt, dlen);
3376 dbfn_close(dbm_file);
3379 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
3383 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
3388 /* With a TLS1.3 session, the ticket(s) are not seen until
3389 the first data read is attempted. And there's often two of them.
3390 Pick them up with this callback. We are also called for 1.2
3394 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
3395 unsigned incoming, const gnutls_datum_t * msg)
3397 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
3398 tls_support * tlsp = state->tlsp;
3400 DEBUG(D_tls) debug_printf("newticket cb\n");
3402 if (!tlsp->ticket_received)
3403 tls_save_session(tlsp, sess, state->host);
3409 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
3410 tls_support * tlsp, smtp_connect_args * conn_args,
3411 smtp_transport_options_block * ob)
3413 gnutls_session_set_ptr(state->session, state);
3414 gnutls_handshake_set_hook_function(state->session,
3415 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
3417 tls_retrieve_session(tlsp, state->session, conn_args, ob);
3421 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
3422 tls_support * tlsp, host_item * host)
3424 if (gnutls_session_is_resumed(state->session))
3426 DEBUG(D_tls) debug_printf("Session resumed\n");
3427 tlsp->resumption |= RESUME_USED;
3430 tls_save_session(tlsp, state->session, host);
3432 #endif /* !DISABLE_TLS_RESUME */
3435 /*************************************************
3436 * Start a TLS session in a client *
3437 *************************************************/
3439 /* Called from the smtp transport after STARTTLS has been accepted.
3442 cctx connection context
3443 conn_args connection details
3444 cookie datum for randomness (not used)
3445 tlsp record details of channel configuration here; must be non-NULL
3446 errstr error string pointer
3448 Returns: TRUE for success with TLS session context set in smtp context,
3453 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3454 void * cookie ARG_UNUSED,
3455 tls_support * tlsp, uschar ** errstr)
3457 host_item * host = conn_args->host; /* for msgs and option-tests */
3458 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3459 smtp_transport_options_block * ob = tb
3460 ? (smtp_transport_options_block *)tb->options_block
3461 : &smtp_transport_option_defaults;
3463 exim_gnutls_state_st * state = NULL;
3464 uschar * cipher_list = NULL;
3466 #ifndef DISABLE_OCSP
3468 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3469 BOOL request_ocsp = require_ocsp ? TRUE
3470 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3473 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
3476 /* If dane is flagged, have either request or require dane for this host, and
3477 a TLSA record found. Therefore, dane verify required. Which implies cert must
3478 be requested and supplied, dane verify must pass, and cert verify irrelevant
3479 (incl. hostnames), and (caller handled) require_tls and sni=$domain */
3481 if (conn_args->dane && ob->dane_require_tls_ciphers)
3483 /* not using Expand_check_tlsvar because not yet in state */
3484 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3485 &cipher_list, errstr))
3487 cipher_list = cipher_list && *cipher_list
3488 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
3493 cipher_list = ob->tls_require_ciphers;
3496 #ifdef MEASURE_TIMING
3498 gettimeofday(&t0, NULL);
3501 if (tls_init(host, ob, cipher_list, &state, tlsp, errstr) != OK)
3504 #ifdef MEASURE_TIMING
3505 report_time_since(&t0, US"client tls_init (delta)");
3510 #ifdef EXIM_HAVE_ALPN
3512 const gnutls_datum_t * plist;
3515 if (!tls_alpn_plist(&ob->tls_alpn, &plist, &plen, errstr))
3518 if (gnutls_alpn_set_protocols(state->session, plist, plen, 0) != 0)
3520 tls_error(US"alpn init", NULL, state->host, errstr);
3524 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
3527 log_write(0, LOG_MAIN, "ALPN unusable with this GnuTLS library version; ignoring \"%s\"\n",
3532 int dh_min_bits = ob->tls_dh_min_bits;
3533 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
3536 debug_printf("WARNING: tls_dh_min_bits far too low,"
3537 " clamping %d up to %d\n",
3538 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
3539 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
3542 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
3543 " acceptable bits to %d\n",
3545 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
3548 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
3549 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
3550 the specified host patterns if one of them is defined */
3553 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
3556 debug_printf("TLS: server certificate DANE required\n");
3557 state->verify_requirement = VERIFY_DANE;
3558 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3562 if ( ( state->exp_tls_verify_certificates
3563 && !ob->tls_verify_hosts
3564 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
3566 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3569 tls_client_setup_hostname_checks(host, state, ob);
3571 debug_printf("TLS: server certificate verification required\n");
3572 state->verify_requirement = VERIFY_REQUIRED;
3573 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3575 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3577 tls_client_setup_hostname_checks(host, state, ob);
3579 debug_printf("TLS: server certificate verification optional\n");
3580 state->verify_requirement = VERIFY_OPTIONAL;
3581 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
3586 debug_printf("TLS: server certificate verification not required\n");
3587 state->verify_requirement = VERIFY_NONE;
3588 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3591 #ifndef DISABLE_OCSP
3592 /* supported since GnuTLS 3.1.3 */
3595 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
3596 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
3597 NULL, 0, NULL)) != OK)
3599 tls_error_gnu(state, US"cert-status-req", rc, errstr);
3602 tlsp->ocsp = OCSP_NOT_RESP;
3606 #ifdef EXIM_HAVE_TLS_RESUME
3607 tls_client_resume_prehandshake(state, tlsp, conn_args, ob);
3610 #ifndef DISABLE_EVENT
3611 if (tb && tb->event_action)
3613 state->event_action = tb->event_action;
3614 gnutls_session_set_ptr(state->session, state);
3615 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3619 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
3620 state->fd_in = cctx->sock;
3621 state->fd_out = cctx->sock;
3623 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
3624 /* There doesn't seem to be a built-in timeout on connection. */
3626 sigalrm_seen = FALSE;
3627 ALARM(ob->command_timeout);
3629 rc = gnutls_handshake(state->session);
3630 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3633 if (rc != GNUTLS_E_SUCCESS)
3637 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
3638 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
3641 tls_error_gnu(state, US"gnutls_handshake", rc, errstr);
3645 DEBUG(D_tls) post_handshake_debug(state);
3649 if (!verify_certificate(state, errstr))
3651 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
3655 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3656 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3657 tlsp->ext_master_secret = TRUE;
3660 #ifndef DISABLE_OCSP
3665 gnutls_datum_t stapling;
3666 gnutls_ocsp_resp_t resp;
3667 gnutls_datum_t printed;
3671 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
3672 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
3674 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
3677 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
3678 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
3679 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
3682 debug_printf("%.4096s", printed.data);
3683 gnutls_free(printed.data);
3686 (void) tls_error_gnu(state, US"ocsp decode", rc, errstr);
3688 (void) tls_error_gnu(state, US"ocsp decode", rc, errstr);
3691 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3693 tlsp->ocsp = OCSP_FAILED;
3694 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3700 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3701 tlsp->ocsp = OCSP_VFIED;
3706 #ifdef EXIM_HAVE_TLS_RESUME
3707 tls_client_resume_posthandshake(state, tlsp, host);
3710 #ifdef EXIM_HAVE_ALPN
3711 if (ob->tls_alpn) /* We requested. See what was negotiated. */
3713 gnutls_datum_t p = {.size = 0};
3715 if (gnutls_alpn_get_selected_protocol(state->session, &p) == 0)
3716 { DEBUG(D_tls) debug_printf("ALPN negotiated: '%.*s'\n", (int)p.size, p.data); }
3717 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
3719 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_NO_APPLICATION_PROTOCOL);
3720 tls_error(US"handshake", US"ALPN required but not negotiated", state->host, errstr);
3724 DEBUG(D_tls) debug_printf("No ALPN negotiated");
3728 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3730 extract_exim_vars_from_tls_state(state);
3732 cctx->tls_ctx = state;
3741 ct_ctx client TLS context pointer, or NULL for the one global server context
3745 tls_shutdown_wr(void * ct_ctx)
3747 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3748 tls_support * tlsp = state->tlsp;
3750 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3752 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3754 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
3755 gnutls_bye(state->session, GNUTLS_SHUT_WR);
3758 /*************************************************
3759 * Close down a TLS session *
3760 *************************************************/
3762 /* This is also called from within a delivery subprocess forked from the
3763 daemon, to shut down the TLS library, without actually doing a shutdown (which
3764 would tamper with the TLS session in the parent process).
3767 ct_ctx client context pointer, or NULL for the one global server context
3768 do_shutdown 0 no data-flush or TLS close-alert
3769 1 if TLS close-alert is to be sent,
3770 2 if also response to be waited for (2s timeout)
3776 tls_close(void * ct_ctx, int do_shutdown)
3778 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3779 tls_support * tlsp = state->tlsp;
3781 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3785 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3786 do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
3788 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3790 #ifdef EXIM_TCP_CORK
3791 if (do_shutdown == TLS_SHUTDOWN_WAIT)
3792 (void) setsockopt(tlsp->active.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
3795 /* The library seems to have no way to only wait for a peer's
3796 shutdown, so handle the same as TLS_SHUTDOWN_WAIT */
3799 gnutls_bye(state->session,
3800 do_shutdown > TLS_SHUTDOWN_NOWAIT ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3804 if (!ct_ctx) /* server */
3806 receive_getc = smtp_getc;
3807 receive_getbuf = smtp_getbuf;
3808 receive_get_cache = smtp_get_cache;
3809 receive_hasc = smtp_hasc;
3810 receive_ungetc = smtp_ungetc;
3811 receive_feof = smtp_feof;
3812 receive_ferror = smtp_ferror;
3815 gnutls_deinit(state->session);
3816 tlsp->active.sock = -1;
3817 tlsp->active.tls_ctx = NULL;
3818 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3819 tlsp->channelbinding = NULL;
3822 if (state->xfer_buffer) store_free(state->xfer_buffer);
3829 tls_refill(unsigned lim)
3831 exim_gnutls_state_st * state = &state_server;
3834 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, buffersize=%u)\n",
3835 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3837 sigalrm_seen = FALSE;
3838 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3842 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3843 MIN(ssl_xfer_buffer_size, lim));
3844 while (inbytes == GNUTLS_E_AGAIN);
3846 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3848 if (had_command_timeout) /* set by signal handler */
3849 smtp_command_timeout_exit(); /* does not return */
3850 if (had_command_sigterm)
3851 smtp_command_sigterm_exit();
3852 if (had_data_timeout)
3853 smtp_data_timeout_exit();
3854 if (had_data_sigint)
3855 smtp_data_sigint_exit();
3857 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3858 TLS session has been closed down, not that the socket itself has been closed
3859 down. Revert to non-TLS handling. */
3863 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3864 state->xfer_error = TRUE;
3868 else if (inbytes == 0)
3870 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3871 tls_close(NULL, TLS_NO_SHUTDOWN);
3875 /* Handle genuine errors */
3877 else if (inbytes < 0)
3879 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3880 record_io_error(state, (int) inbytes, US"recv", NULL);
3881 state->xfer_error = TRUE;
3884 #ifndef DISABLE_DKIM
3885 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3887 state->xfer_buffer_hwm = (int) inbytes;
3888 state->xfer_buffer_lwm = 0;
3892 /*************************************************
3893 * TLS version of getc *
3894 *************************************************/
3896 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3897 it refills the buffer via the GnuTLS reading function.
3898 Only used by the server-side TLS.
3900 This feeds DKIM and should be used for all message-body reads.
3902 Arguments: lim Maximum amount to read/buffer
3903 Returns: the next character or EOF
3907 tls_getc(unsigned lim)
3909 exim_gnutls_state_st * state = &state_server;
3911 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3912 if (!tls_refill(lim))
3913 return state->xfer_error ? EOF : smtp_getc(lim);
3915 /* Something in the buffer; return next uschar */
3917 return state->xfer_buffer[state->xfer_buffer_lwm++];
3923 exim_gnutls_state_st * state = &state_server;
3924 return state->xfer_buffer_lwm < state->xfer_buffer_hwm;
3928 tls_getbuf(unsigned * len)
3930 exim_gnutls_state_st * state = &state_server;
3934 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3935 if (!tls_refill(*len))
3937 if (!state->xfer_error) return smtp_getbuf(len);
3942 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3944 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3945 state->xfer_buffer_lwm += size;
3951 /* Get up to the given number of bytes from any cached data, and feed to dkim. */
3953 tls_get_cache(unsigned lim)
3955 #ifndef DISABLE_DKIM
3956 exim_gnutls_state_st * state = &state_server;
3957 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3961 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3967 tls_could_getc(void)
3969 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3970 || gnutls_record_check_pending(state_server.session) > 0;
3974 /*************************************************
3975 * Read bytes from TLS channel *
3976 *************************************************/
3978 /* This does not feed DKIM, so if the caller uses this for reading message body,
3979 then the caller must feed DKIM.
3982 ct_ctx client context pointer, or NULL for the one global server context
3986 Returns: the number of bytes read
3987 -1 after a failed read, including EOF
3991 tls_read(void * ct_ctx, uschar *buff, size_t len)
3993 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3999 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
4001 debug_printf("*** PROBABLY A BUG *** " \
4002 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
4003 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
4006 debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, len=" SIZE_T_FMT ")\n",
4007 state->session, buff, len);
4011 inbytes = gnutls_record_recv(state->session, buff, len);
4012 while (inbytes == GNUTLS_E_AGAIN);
4014 if (inbytes > 0) return inbytes;
4017 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
4021 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
4022 record_io_error(state, (int)inbytes, US"recv", NULL);
4031 /*************************************************
4032 * Write bytes down TLS channel *
4033 *************************************************/
4037 ct_ctx client context pointer, or NULL for the one global server context
4040 more more data expected soon
4042 Calling with len zero and more unset will flush buffered writes. The buff
4043 argument can be null for that case.
4045 Returns: the number of bytes after a successful write,
4046 -1 after a failed write
4050 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4054 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
4057 if (more && !state->corked)
4059 DEBUG(D_tls) debug_printf("gnutls_record_cork(session=%p)\n", state->session);
4060 gnutls_record_cork(state->session);
4061 state->corked = TRUE;
4065 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
4066 buff, left, more ? ", more" : "");
4070 DEBUG(D_tls) debug_printf("gnutls_record_send(session=%p, buffer=%p, left=" SIZE_T_FMT ")\n",
4071 state->session, buff, left);
4075 outbytes = gnutls_record_send(state->session, buff, left);
4076 while (outbytes == GNUTLS_E_AGAIN);
4078 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
4082 #ifdef GNUTLS_E_PREMATURE_TERMINATION
4083 if ( outbytes == GNUTLS_E_PREMATURE_TERMINATION && errno == ECONNRESET
4084 && !ct_ctx && f.smtp_in_quit
4086 { /* Outlook, dammit */
4087 if (LOGGING(protocol_detail))
4088 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4089 " SMTP response and TLS close\n", sender_host_address);
4091 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4092 " client reset TCP before TLS close\n", sender_host_address);
4097 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
4098 record_io_error(state, outbytes, US"send", NULL);
4104 record_io_error(state, 0, US"send", US"TLS channel closed on write");
4115 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
4121 if (!more && state->corked)
4123 DEBUG(D_tls) debug_printf("gnutls_record_uncork(session=%p)\n", state->session);
4125 /* We can't use GNUTLS_RECORD_WAIT here, as it retries on
4126 GNUTLS_E_AGAIN || GNUTLS_E_INTR, which would break our timeout set by alarm().
4127 The GNUTLS_E_AGAIN should not happen ever, as our sockets are blocking anyway.
4128 But who knows. (That all relies on the fact that GNUTLS_E_INTR and GNUTLS_E_AGAIN
4129 match the EINTR and EAGAIN errno values.) */
4130 outbytes = gnutls_record_uncork(state->session, 0);
4131 while (outbytes == GNUTLS_E_AGAIN);
4135 record_io_error(state, len, US"uncork", NULL);
4139 state->corked = FALSE;
4149 /*************************************************
4150 * Random number generation *
4151 *************************************************/
4153 /* Pseudo-random number generation. The result is not expected to be
4154 cryptographically strong but not so weak that someone will shoot themselves
4155 in the foot using it as a nonce in input in some email header scheme or
4156 whatever weirdness they'll twist this into. The result should handle fork()
4157 and avoid repeating sequences. OpenSSL handles that for us.
4161 Returns a random number in range [0, max-1]
4164 #ifdef HAVE_GNUTLS_RND
4166 vaguely_random_number(int max)
4170 uschar smallbuf[sizeof(r)];
4175 needed_len = sizeof(r);
4176 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4177 asked for a number less than 10. */
4179 for (r = max, i = 0; r; ++i)
4185 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
4188 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback\n");
4189 return vaguely_random_number_fallback(max);
4192 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4195 /* We don't particularly care about weighted results; if someone wants
4196 * smooth distribution and cares enough then they should submit a patch then. */
4199 #else /* HAVE_GNUTLS_RND */
4201 vaguely_random_number(int max)
4203 return vaguely_random_number_fallback(max);
4205 #endif /* HAVE_GNUTLS_RND */
4210 /*************************************************
4211 * Let tls_require_ciphers be checked at startup *
4212 *************************************************/
4214 /* The tls_require_ciphers option, if set, must be something which the
4217 Returns: NULL on success, or error message
4221 tls_validate_require_cipher(void)
4224 uschar *expciphers = NULL;
4225 gnutls_priority_t priority_cache;
4227 uschar * dummy_errstr;
4229 #ifdef GNUTLS_AUTO_GLOBAL_INIT
4230 # define validate_check_rc(Label) do { \
4231 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \
4232 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4233 # define return_deinit(Label) do { return (Label); } while (0)
4235 # define validate_check_rc(Label) do { \
4236 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
4237 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4238 # define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
4241 if (exim_gnutls_base_init_done)
4242 log_write(0, LOG_MAIN|LOG_PANIC,
4243 "already initialised GnuTLS, Exim developer bug");
4245 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
4246 if (!gnutls_allow_auto_pkcs11)
4248 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
4249 validate_check_rc(US"gnutls_pkcs11_init");
4252 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4253 rc = gnutls_global_init();
4254 validate_check_rc(US"gnutls_global_init()");
4256 exim_gnutls_base_init_done = TRUE;
4258 if (!(tls_require_ciphers && *tls_require_ciphers))
4259 return_deinit(NULL);
4261 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4263 return_deinit(US"failed to expand tls_require_ciphers");
4265 if (!(expciphers && *expciphers))
4266 return_deinit(NULL);
4269 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4271 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
4272 validate_check_rc(string_sprintf(
4273 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
4274 expciphers, (long)(errpos - CS expciphers), errpos));
4276 #undef return_deinit
4277 #undef validate_check_rc
4278 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4279 gnutls_global_deinit();
4288 /*************************************************
4289 * Report the library versions. *
4290 *************************************************/
4292 /* See a description in tls-openssl.c for an explanation of why this exists.
4294 Arguments: string to append to
4299 tls_version_report(gstring * g)
4301 return string_fmt_append(g,
4302 "Library version: GnuTLS: Compile: %s\n"
4305 gnutls_check_version(NULL));
4308 #endif /*!MACRO_PREDEF*/
4311 /* End of tls-gnu.c */