1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Copyright (c) Phil Pennock 2012 */
11 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
12 one of the available supported implementations. This file is #included into
13 tls.c when USE_GNUTLS has been set.
15 The code herein is a revamp of GnuTLS integration using the current APIs; the
16 original tls-gnu.c was based on a patch which was contributed by Nikos
17 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
20 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
21 which is not widely deployed by OS vendors. Will note issues below, which may
22 assist in updating the code in the future. Another sources of hints is
23 mod_gnutls for Apache (SNI callback registration and handling).
25 Keeping client and server variables more split than before and is currently
26 the norm, in anticipation of TLS in ACL callouts.
28 I wanted to switch to gnutls_certificate_set_verify_function() so that
29 certificate rejection could happen during handshake where it belongs, rather
30 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
31 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
33 (I wasn't looking for libraries quite that old, when updating to get rid of
34 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
35 require current GnuTLS, then we'll drop support for the ancient libraries).
38 #include <gnutls/gnutls.h>
39 /* needed for cert checks in verification and DN extraction: */
40 #include <gnutls/x509.h>
41 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
42 #include <gnutls/crypto.h>
44 /* needed to disable PKCS11 autoload unless requested */
45 #if GNUTLS_VERSION_NUMBER >= 0x020c00
46 # include <gnutls/pkcs11.h>
47 # define SUPPORT_PARAM_TO_PK_BITS
49 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
50 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
53 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
54 # warning "GnuTLS library version too old; tls:cert event unsupported"
55 # define DISABLE_EVENT
57 #if GNUTLS_VERSION_NUMBER >= 0x030000
58 # define SUPPORT_SELFSIGN /* Uncertain what version is first usable but 2.12.23 is not */
60 #if GNUTLS_VERSION_NUMBER >= 0x030306
61 # define SUPPORT_CA_DIR
63 # undef SUPPORT_CA_DIR
65 #if GNUTLS_VERSION_NUMBER >= 0x030014
66 # define SUPPORT_SYSDEFAULT_CABUNDLE
68 #if GNUTLS_VERSION_NUMBER >= 0x030104
69 # define GNUTLS_CERT_VFY_STATUS_PRINT
71 #if GNUTLS_VERSION_NUMBER >= 0x030109
74 #if GNUTLS_VERSION_NUMBER >= 0x03010a
75 # define SUPPORT_GNUTLS_SESS_DESC
77 #if GNUTLS_VERSION_NUMBER >= 0x030300
78 # define GNUTLS_AUTO_GLOBAL_INIT
79 # define GNUTLS_AUTO_PKCS11_MANUAL
81 #if (GNUTLS_VERSION_NUMBER >= 0x030404) \
82 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
84 # define EXIM_HAVE_OCSP
87 #if GNUTLS_VERSION_NUMBER >= 0x030500
88 # define SUPPORT_GNUTLS_KEYLOG
90 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
91 # define SUPPORT_SRV_OCSP_STACK
93 #if GNUTLS_VERSION_NUMBER >= 0x030600
94 # define GNUTLS_AUTO_DHPARAMS
96 #if GNUTLS_VERSION_NUMBER >= 0x030603
97 # define EXIM_HAVE_TLS1_3
98 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
99 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
103 # if GNUTLS_VERSION_NUMBER >= 0x030000
104 # define DANESSL_USAGE_DANE_TA 2
105 # define DANESSL_USAGE_DANE_EE 3
107 # error GnuTLS version too early for DANE
109 # if GNUTLS_VERSION_NUMBER < 0x999999
110 # define GNUTLS_BROKEN_DANE_VALIDATION
114 #ifdef EXPERIMENTAL_TLS_RESUME
115 # if GNUTLS_VERSION_NUMBER < 0x030603
116 # error GNUTLS version too early for session-resumption
121 # include <gnutls/ocsp.h>
124 # include <gnutls/dane.h>
127 #include "tls-cipher-stdname.c"
134 # ifdef EXPERIMENTAL_TLS_RESUME
135 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
137 # ifdef EXIM_HAVE_TLS1_3
138 builtin_macro_create(US"_HAVE_TLS1_3");
140 # ifdef EXIM_HAVE_OCSP
141 builtin_macro_create(US"_HAVE_TLS_OCSP");
143 # ifdef SUPPORT_SRV_OCSP_STACK
144 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
153 gnutls_global_set_audit_log_function()
156 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
159 /* Local static variables for GnuTLS */
161 /* Values for verify_requirement */
163 enum peer_verify_requirement
164 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
166 /* This holds most state for server or client; with this, we can set up an
167 outbound TLS-enabled connection in an ACL callout, while not stomping all
168 over the TLS variables available for expansion.
170 Some of these correspond to variables in globals.c; those variables will
171 be set to point to content in one of these instances, as appropriate for
172 the stage of the process lifetime.
174 Not handled here: global tlsp->tls_channelbinding.
177 typedef struct exim_gnutls_state {
178 gnutls_session_t session;
179 gnutls_certificate_credentials_t x509_cred;
180 gnutls_priority_t priority_cache;
181 enum peer_verify_requirement verify_requirement;
185 BOOL peer_cert_verified:1;
186 BOOL peer_dane_verified:1;
187 BOOL trigger_sni_changes:1;
188 BOOL have_set_peerdn:1;
189 BOOL xfer_eof:1; /*XXX never gets set! */
195 const struct host_item *host; /* NULL if server */
196 gnutls_x509_crt_t peercert;
199 uschar *received_sni;
201 const uschar *tls_certificate;
202 const uschar *tls_privatekey;
203 const uschar *tls_sni; /* client send only, not received */
204 const uschar *tls_verify_certificates;
205 const uschar *tls_crl;
206 const uschar *tls_require_ciphers;
208 uschar *exp_tls_certificate;
209 uschar *exp_tls_privatekey;
210 uschar *exp_tls_verify_certificates;
212 uschar *exp_tls_require_ciphers;
213 const uschar *exp_tls_verify_cert_hostnames;
214 #ifndef DISABLE_EVENT
215 uschar *event_action;
218 char * const * dane_data;
219 const int * dane_data_len;
222 tls_support *tlsp; /* set in tls_init() */
227 } exim_gnutls_state_st;
229 static const exim_gnutls_state_st exim_gnutls_state_init = {
230 /* all elements not explicitly intialised here get 0/NULL/FALSE */
235 /* Not only do we have our own APIs which don't pass around state, assuming
236 it's held in globals, GnuTLS doesn't appear to let us register callback data
237 for callbacks, or as part of the session, so we have to keep a "this is the
238 context we're currently dealing with" pointer and rely upon being
239 single-threaded to keep from processing data on an inbound TLS connection while
240 talking to another TLS connection for an outbound check. This does mean that
241 there's no way for heart-beats to be responded to, for the duration of the
243 XXX But see gnutls_session_get_ptr()
246 static exim_gnutls_state_st state_server;
248 #ifndef GNUTLS_AUTO_DHPARAMS
249 /* dh_params are initialised once within the lifetime of a process using TLS;
250 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
251 don't want to repeat this. */
253 static gnutls_dh_params_t dh_server_params = NULL;
256 static int ssl_session_timeout = 7200; /* Two hours */
258 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
260 /* Guard library core initialisation */
262 static BOOL exim_gnutls_base_init_done = FALSE;
265 static BOOL gnutls_buggy_ocsp = FALSE;
266 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
269 #ifdef EXPERIMENTAL_TLS_RESUME
270 static gnutls_datum_t server_sessticket_key;
273 /* ------------------------------------------------------------------------ */
276 #define MAX_HOST_LEN 255
278 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
279 the library logging; a value less than 0 disables the calls to set up logging
280 callbacks. GNuTLS also looks for an environment variable - except not for
281 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
282 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
283 but the env var must be added to /etc/sudoers too. */
284 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
285 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
288 #ifndef EXIM_CLIENT_DH_MIN_BITS
289 # define EXIM_CLIENT_DH_MIN_BITS 1024
292 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
293 can ask for a bit-strength. Without that, we stick to the constant we had
295 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
296 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
299 #define expand_check_tlsvar(Varname, errstr) \
300 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
302 #if GNUTLS_VERSION_NUMBER >= 0x020c00
303 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
304 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
305 # define HAVE_GNUTLS_RND
306 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
307 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
308 * isn't available sometimes, so this needs to become a conditional
309 * compilation; the sanest way to deal with this being a problem on
310 * older OSes is to block it in the Local/Makefile with this compiler
312 # ifndef AVOID_GNUTLS_PKCS11
313 # define HAVE_GNUTLS_PKCS11
314 # endif /* AVOID_GNUTLS_PKCS11 */
320 /* ------------------------------------------------------------------------ */
321 /* Callback declarations */
323 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
324 static void exim_gnutls_logger_cb(int level, const char *message);
327 static int exim_sni_handling_cb(gnutls_session_t session);
329 #ifdef EXPERIMENTAL_TLS_RESUME
331 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
332 unsigned incoming, const gnutls_datum_t * msg);
336 /* Daemon one-time initialisation */
338 tls_daemon_init(void)
340 #ifdef EXPERIMENTAL_TLS_RESUME
341 /* We are dependent on the GnuTLS implementation of the Session Ticket
342 encryption; both the strength and the key rotation period. We hope that
343 the strength at least matches that of the ciphersuite (but GnuTLS does not
346 static BOOL once = FALSE;
349 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
350 if (f.running_in_test_harness) ssl_session_timeout = 6;
354 /* ------------------------------------------------------------------------ */
355 /* Static functions */
357 /*************************************************
359 *************************************************/
361 /* Called from lots of places when errors occur before actually starting to do
362 the TLS handshake, that is, while the session is still in clear. Always returns
363 DEFER for a server and FAIL for a client so that most calls can use "return
364 tls_error(...)" to do this processing and then give an appropriate return. A
365 single function is used for both server and client, because it is called from
366 some shared functions.
369 prefix text to include in the logged error
370 msg additional error string (may be NULL)
371 usually obtained from gnutls_strerror()
372 host NULL if setting up a server;
373 the connected host if setting up a client
374 errstr pointer to returned error string
376 Returns: OK/DEFER/FAIL
380 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
384 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
385 return host ? FAIL : DEFER;
390 tls_error_gnu(const uschar *prefix, int err, const host_item *host,
393 return tls_error(prefix, US gnutls_strerror(err), host, errstr);
397 tls_error_sys(const uschar *prefix, int err, const host_item *host,
400 return tls_error(prefix, US strerror(err), host, errstr);
404 /*************************************************
405 * Deal with logging errors during I/O *
406 *************************************************/
408 /* We have to get the identity of the peer from saved data.
411 state the current GnuTLS exim state container
412 rc the GnuTLS error code, or 0 if it's a local error
413 when text identifying read or write
414 text local error text when rc is 0
420 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
425 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
426 msg = string_sprintf("A TLS fatal alert has been received: %s",
427 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
429 msg = US gnutls_strerror(rc);
431 (void) tls_error(when, msg, state->host, &errstr);
434 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
435 state->host->name, state->host->address, errstr);
438 uschar * conn_info = smtp_get_connection_info();
439 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
440 /* I'd like to get separated H= here, but too hard for now */
441 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
448 /*************************************************
449 * Set various Exim expansion vars *
450 *************************************************/
452 #define exim_gnutls_cert_err(Label) \
455 if (rc != GNUTLS_E_SUCCESS) \
457 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
458 (Label), gnutls_strerror(rc)); \
464 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
468 rc = gnutls_x509_crt_init(crtp);
469 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
471 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
472 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
477 #undef exim_gnutls_cert_err
480 /* We set various Exim global variables from the state, once a session has
481 been established. With TLS callouts, may need to change this to stack
482 variables, or just re-call it with the server state after client callout
485 Make sure anything set here is unset in tls_getc().
489 tls_bits strength indicator
490 tls_certificate_verified bool indicator
491 tls_channelbinding for some SASL mechanisms
494 tls_peercert pointer to library internal
496 tls_sni a (UTF-8) string
497 tls_ourcert pointer to library internal
500 state the relevant exim_gnutls_state_st *
504 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
506 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
509 gnutls_datum_t channel;
511 tls_support * tlsp = state->tlsp;
513 tlsp->active.sock = state->fd_out;
514 tlsp->active.tls_ctx = state;
516 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
518 tlsp->certificate_verified = state->peer_cert_verified;
520 tlsp->dane_verified = state->peer_dane_verified;
523 /* note that tls_channelbinding is not saved to the spool file, since it's
524 only available for use for authenticators while this TLS session is running. */
526 tlsp->channelbinding = NULL;
527 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
530 if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
531 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
534 /* Declare the taintedness of the binding info. On server, untainted; on
535 client, tainted - being the Finish msg from the server. */
537 old_pool = store_pool;
538 store_pool = POOL_PERM;
539 tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size,
541 store_pool = old_pool;
542 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n");
546 /* peercert is set in peer_status() */
547 tlsp->peerdn = state->peerdn;
549 /* do not corrupt sni sent by client; record sni rxd by server */
551 tlsp->sni = state->received_sni;
553 /* record our certificate */
555 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
556 gnutls_x509_crt_t crt;
558 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
565 #ifndef GNUTLS_AUTO_DHPARAMS
566 /*************************************************
567 * Setup up DH parameters *
568 *************************************************/
570 /* Generating the D-H parameters may take a long time. They only need to
571 be re-generated every so often, depending on security policy. What we do is to
572 keep these parameters in a file in the spool directory. If the file does not
573 exist, we generate them. This means that it is easy to cause a regeneration.
575 The new file is written as a temporary file and renamed, so that an incomplete
576 file is never present. If two processes both compute some new parameters, you
577 waste a bit of effort, but it doesn't seem worth messing around with locking to
580 Returns: OK/DEFER/FAIL
584 init_server_dh(uschar ** errstr)
587 unsigned int dh_bits;
588 gnutls_datum_t m = {.data = NULL, .size = 0};
589 uschar filename_buf[PATH_MAX];
590 uschar *filename = NULL;
592 uschar *exp_tls_dhparam;
593 BOOL use_file_in_spool = FALSE;
594 host_item *host = NULL; /* dummy for macros */
596 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
598 if ((rc = gnutls_dh_params_init(&dh_server_params)))
599 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
601 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
604 if (!exp_tls_dhparam)
606 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
607 m.data = US std_dh_prime_default();
608 m.size = Ustrlen(m.data);
610 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
611 use_file_in_spool = TRUE;
612 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
614 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
617 else if (exp_tls_dhparam[0] != '/')
619 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
620 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
621 m.size = Ustrlen(m.data);
624 filename = exp_tls_dhparam;
628 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
629 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
630 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
634 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
635 /* If you change this constant, also change dh_param_fn_ext so that we can use a
636 different filename and ensure we have sufficient bits. */
638 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
639 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
641 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
644 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
646 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
650 /* Some clients have hard-coded limits. */
651 if (dh_bits > tls_dh_max_bits)
654 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
656 dh_bits = tls_dh_max_bits;
659 if (use_file_in_spool)
661 if (!string_format(filename_buf, sizeof(filename_buf),
662 "%s/gnutls-params-%d", spool_directory, dh_bits))
663 return tls_error(US"overlong filename", NULL, NULL, errstr);
664 filename = filename_buf;
667 /* Open the cache file for reading and if successful, read it and set up the
670 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
676 if (fstat(fd, &statbuf) < 0) /* EIO */
680 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
682 if (!S_ISREG(statbuf.st_mode))
685 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
687 if (!(fp = fdopen(fd, "rb")))
691 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
692 saved_errno, NULL, errstr);
695 m.size = statbuf.st_size;
696 if (!(m.data = store_malloc(m.size)))
699 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
701 if (!(sz = fread(m.data, m.size, 1, fp)))
706 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
710 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
713 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
714 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
717 /* If the file does not exist, fall through to compute new data and cache it.
718 If there was any other opening error, it is serious. */
720 else if (errno == ENOENT)
724 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
727 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
730 /* If ret < 0, either the cache file does not exist, or the data it contains
731 is not useful. One particular case of this is when upgrading from an older
732 release of Exim in which the data was stored in a different format. We don't
733 try to be clever and support both formats; we just regenerate new data in this
739 unsigned int dh_bits_gen = dh_bits;
741 if ((PATH_MAX - Ustrlen(filename)) < 10)
742 return tls_error(US"Filename too long to generate replacement",
743 filename, NULL, errstr);
745 temp_fn = string_copy(US"%s.XXXXXXX");
746 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
747 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
748 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
750 /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But
751 there's no way to ask GnuTLS how many bits there really are. We can ask
752 how many bits were used in a TLS session, but that's it! The prime itself
753 is hidden behind too much abstraction. So we ask for less, and proceed on
754 a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */
756 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
758 dh_bits_gen = dh_bits - 10;
760 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
765 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
767 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
768 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
770 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
771 and I confirmed that a NULL call to get the size first is how the GnuTLS
772 sample apps handle this. */
776 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
777 GNUTLS_X509_FMT_PEM, m.data, &sz))
778 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
779 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
782 if (!(m.data = store_malloc(m.size)))
783 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
785 /* this will return a size 1 less than the allocation size above */
786 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
790 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
792 m.size = sz; /* shrink by 1, probably */
794 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
797 return tls_error_sys(US"TLS cache write D-H params failed",
798 errno, NULL, errstr);
801 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
802 return tls_error_sys(US"TLS cache write D-H params final newline failed",
803 errno, NULL, errstr);
805 if ((rc = close(fd)))
806 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
808 if (Urename(temp_fn, filename) < 0)
809 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
810 temp_fn, filename), errno, NULL, errstr);
812 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
815 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
823 /* Create and install a selfsigned certificate, for use in server mode */
826 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
828 gnutls_x509_crt_t cert = NULL;
830 gnutls_x509_privkey_t pkey = NULL;
831 const uschar * where;
834 #ifndef SUPPORT_SELFSIGN
835 where = US"library too old";
836 rc = GNUTLS_E_NO_CERTIFICATE_FOUND;
840 where = US"initialising pkey";
841 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
843 where = US"initialising cert";
844 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
846 where = US"generating pkey"; /* Hangs on 2.12.23 */
847 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
848 #ifdef SUPPORT_PARAM_TO_PK_BITS
849 # ifndef GNUTLS_SEC_PARAM_MEDIUM
850 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
852 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
859 where = US"configuring cert";
861 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
862 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
863 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
864 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
865 || (rc = gnutls_x509_crt_set_key(cert, pkey))
867 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
868 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
869 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
870 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
871 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
872 GNUTLS_OID_X520_COMMON_NAME, 0,
873 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
877 where = US"signing cert";
878 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
880 where = US"installing selfsign cert";
882 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
888 if (cert) gnutls_x509_crt_deinit(cert);
889 if (pkey) gnutls_x509_privkey_deinit(pkey);
893 rc = tls_error_gnu(where, rc, NULL, errstr);
900 /* Add certificate and key, from files.
903 Zero or negative: good. Negate value for certificate index if < 0.
904 Greater than zero: FAIL or DEFER code.
908 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
909 uschar * certfile, uschar * keyfile, uschar ** errstr)
911 int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
912 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
914 return tls_error_gnu(
915 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
921 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
922 /* Load an OCSP proof from file for sending by the server. Called
923 on getting a status-request handshake message, for earlier versions
927 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
928 gnutls_datum_t * ocsp_response)
931 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
933 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
935 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
937 tls_in.ocsp = OCSP_NOT_RESP;
938 return GNUTLS_E_NO_CERTIFICATE_STATUS;
941 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
947 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
948 /* Make a note that we saw a status-request */
950 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
951 const unsigned char *data, unsigned size)
953 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
954 if (tls_id == 5) /* status_request */
956 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
957 tls_in.ocsp = OCSP_NOT_RESP;
962 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
964 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
965 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
967 /* Call fn for each extension seen. 3.6.3 onwards */
968 return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
969 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
973 /* Make a note that we saw a status-response */
975 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
976 const unsigned char *data, unsigned size)
978 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
979 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
980 if (FALSE && tls_id == 5) /* status_request */
982 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
983 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
984 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
989 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
991 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
992 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
994 /* Call fn for each extension seen. 3.6.3 onwards */
997 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
1002 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
1003 "Handshake Protocol: Certificate" record.
1004 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
1006 This is different to tls1.2 - where it is a separate record (wireshake term) / handshake message (gnutls term).
1009 #if defined(EXPERIMENTAL_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1010 /* Callback for certificate-status, on server. We sent stapled OCSP. */
1012 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
1013 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1015 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
1016 #ifdef SUPPORT_SRV_OCSP_STACK
1017 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1018 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1020 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1025 /* Callback for handshake messages, on server */
1027 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1028 unsigned incoming, const gnutls_datum_t * msg)
1030 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
1033 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1034 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1035 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1036 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1037 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1039 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1040 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1041 # ifdef EXPERIMENTAL_TLS_RESUME
1042 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1043 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1052 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1054 tls_server_testharness_ocsp_fiddle(void)
1056 extern char ** environ;
1057 if (environ) for (uschar ** p = USS environ; *p; p++)
1058 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1060 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1061 exim_testharness_disable_ocsp_validity_check = TRUE;
1066 /*************************************************
1067 * Variables re-expanded post-SNI *
1068 *************************************************/
1070 /* Called from both server and client code, via tls_init(), and also from
1071 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1073 We can tell the two apart by state->received_sni being non-NULL in callback.
1075 The callback should not call us unless state->trigger_sni_changes is true,
1076 which we are responsible for setting on the first pass through.
1079 state exim_gnutls_state_st *
1080 errstr error string pointer
1082 Returns: OK/DEFER/FAIL
1086 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1088 struct stat statbuf;
1090 const host_item *host = state->host; /* macro should be reconsidered? */
1091 uschar *saved_tls_certificate = NULL;
1092 uschar *saved_tls_privatekey = NULL;
1093 uschar *saved_tls_verify_certificates = NULL;
1094 uschar *saved_tls_crl = NULL;
1097 /* We check for tls_sni *before* expansion. */
1098 if (!host) /* server */
1099 if (!state->received_sni)
1101 if ( state->tls_certificate
1102 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1103 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1104 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1107 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
1108 state->trigger_sni_changes = TRUE;
1113 /* useful for debugging */
1114 saved_tls_certificate = state->exp_tls_certificate;
1115 saved_tls_privatekey = state->exp_tls_privatekey;
1116 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1117 saved_tls_crl = state->exp_tls_crl;
1120 if ((rc = gnutls_certificate_allocate_credentials(&state->x509_cred)))
1121 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
1124 #ifdef SUPPORT_SRV_OCSP_STACK
1125 gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
1127 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1128 if (!host && tls_ocsp_file)
1130 if (f.running_in_test_harness)
1131 tls_server_testharness_ocsp_fiddle();
1133 if (exim_testharness_disable_ocsp_validity_check)
1134 gnutls_certificate_set_flags(state->x509_cred,
1135 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1140 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
1141 state members, assuming consistent naming; and expand_check() returns
1142 false if expansion failed, unless expansion was forced to fail. */
1144 /* check if we at least have a certificate, before doing expensive
1147 if (!expand_check_tlsvar(tls_certificate, errstr))
1150 /* certificate is mandatory in server, optional in client */
1152 if ( !state->exp_tls_certificate
1153 || !*state->exp_tls_certificate
1156 return tls_install_selfsign(state, errstr);
1158 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1160 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
1163 /* tls_privatekey is optional, defaulting to same file as certificate */
1165 if (!state->tls_privatekey || !*state->tls_privatekey)
1167 state->tls_privatekey = state->tls_certificate;
1168 state->exp_tls_privatekey = state->exp_tls_certificate;
1172 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1174 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1175 state->exp_tls_certificate, state->exp_tls_privatekey);
1177 if (state->received_sni)
1178 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1179 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1182 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1186 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
1189 if (!host) /* server */
1191 const uschar * clist = state->exp_tls_certificate;
1192 const uschar * klist = state->exp_tls_privatekey;
1193 const uschar * olist;
1194 int csep = 0, ksep = 0, osep = 0, cnt = 0;
1195 uschar * cfile, * kfile, * ofile;
1196 #ifndef DISABLE_OCSP
1197 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1198 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1201 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
1206 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1208 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1209 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
1210 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
1214 int gnutls_cert_index = -rc;
1215 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1216 gnutls_cert_index, cfile);
1218 #ifndef DISABLE_OCSP
1221 /* Set the OCSP stapling server info */
1222 if (gnutls_buggy_ocsp)
1225 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1227 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1229 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1230 gnutls_cert_index, ofile);
1231 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1232 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1234 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1237 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1239 ocsp_fmt = GNUTLS_X509_FMT_DER;
1243 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1244 state->x509_cred, CCS ofile, gnutls_cert_index,
1246 return tls_error_gnu(
1247 US"gnutls_certificate_set_ocsp_status_request_file2",
1250 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1252 /* Arrange callbacks for OCSP request observability */
1254 gnutls_handshake_set_hook_function(state->session,
1255 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1258 # if defined(SUPPORT_SRV_OCSP_STACK)
1259 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1260 state->x509_cred, gnutls_cert_index,
1261 server_ocsp_stapling_cb, ofile)))
1262 return tls_error_gnu(
1263 US"gnutls_certificate_set_ocsp_status_request_function2",
1271 debug_printf("oops; multiple OCSP files not supported\n");
1274 gnutls_certificate_set_ocsp_status_request_function(
1275 state->x509_cred, server_ocsp_stapling_cb, ofile);
1277 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1280 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1282 #endif /* DISABLE_OCSP */
1287 if (0 < (rc = tls_add_certfile(state, host,
1288 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1290 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1293 } /* tls_certificate */
1296 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1297 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1298 error message is provided. However, if we just refrain from setting anything up
1299 in that case, certificate verification fails, which seems to be the correct
1302 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1304 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
1306 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1307 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1308 state->exp_tls_verify_certificates = NULL;
1310 if (state->tls_crl && *state->tls_crl)
1311 if (!expand_check_tlsvar(tls_crl, errstr))
1314 if (!(state->exp_tls_verify_certificates &&
1315 *state->exp_tls_verify_certificates))
1318 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1319 /* With no tls_verify_certificates, we ignore tls_crl too */
1326 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1330 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1331 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1332 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1336 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1338 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1339 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1344 #ifndef SUPPORT_CA_DIR
1345 /* The test suite passes in /dev/null; we could check for that path explicitly,
1346 but who knows if someone has some weird FIFO which always dumps some certs, or
1347 other weirdness. The thing we really want to check is that it's not a
1348 directory, since while OpenSSL supports that, GnuTLS does not.
1349 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1350 if (S_ISDIR(statbuf.st_mode))
1353 debug_printf("verify certificates path is a dir: \"%s\"\n",
1354 state->exp_tls_verify_certificates);
1355 log_write(0, LOG_MAIN|LOG_PANIC,
1356 "tls_verify_certificates \"%s\" is a directory",
1357 state->exp_tls_verify_certificates);
1362 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1363 state->exp_tls_verify_certificates, statbuf.st_size);
1365 if (statbuf.st_size == 0)
1368 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1374 #ifdef SUPPORT_CA_DIR
1375 (statbuf.st_mode & S_IFMT) == S_IFDIR
1377 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1378 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1381 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1382 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1384 #ifdef SUPPORT_CA_DIR
1385 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1386 when using the directory-of-certs config model. */
1388 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1389 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1394 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1396 debug_printf("Added %d certificate authorities.\n", cert_count);
1398 if (state->tls_crl && *state->tls_crl &&
1399 state->exp_tls_crl && *state->exp_tls_crl)
1401 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1402 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1403 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM)) < 0)
1404 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1405 cert_count, host, errstr);
1407 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1416 /*************************************************
1417 * Set X.509 state variables *
1418 *************************************************/
1420 /* In GnuTLS, the registered cert/key are not replaced by a later
1421 set of a cert/key, so for SNI support we need a whole new x509_cred
1422 structure. Which means various other non-re-expanded pieces of state
1423 need to be re-set in the new struct, so the setting logic is pulled
1427 state exim_gnutls_state_st *
1428 errstr error string pointer
1430 Returns: OK/DEFER/FAIL
1434 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1437 const host_item *host = state->host; /* macro should be reconsidered? */
1439 #ifndef GNUTLS_AUTO_DHPARAMS
1440 /* Create D-H parameters, or read them from the cache file. This function does
1441 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1442 client-side params. */
1446 if (!dh_server_params)
1447 if ((rc = init_server_dh(errstr)) != OK) return rc;
1449 /* Unnecessary & discouraged with 3.6.0 or later */
1450 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1454 /* Link the credentials to the session. */
1456 if ((rc = gnutls_credentials_set(state->session,
1457 GNUTLS_CRD_CERTIFICATE, state->x509_cred)))
1458 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1463 /*************************************************
1464 * Initialize for GnuTLS *
1465 *************************************************/
1468 #ifndef DISABLE_OCSP
1471 tls_is_buggy_ocsp(void)
1474 uschar maj, mid, mic;
1476 s = CUS gnutls_check_version(NULL);
1480 while (*s && *s != '.') s++;
1481 mid = atoi(CCS ++s);
1488 while (*s && *s != '.') s++;
1489 mic = atoi(CCS ++s);
1490 return mic <= (mid == 3 ? 16 : 3);
1499 /* Called from both server and client code. In the case of a server, errors
1500 before actual TLS negotiation return DEFER.
1503 host connected host, if client; NULL if server
1504 certificate certificate file
1505 privatekey private key file
1506 sni TLS SNI to send, sometimes when client; else NULL
1509 require_ciphers tls_require_ciphers setting
1510 caller_state returned state-info structure
1511 errstr error string pointer
1513 Returns: OK/DEFER/FAIL
1518 const host_item *host,
1519 const uschar *certificate,
1520 const uschar *privatekey,
1524 const uschar *require_ciphers,
1525 exim_gnutls_state_st **caller_state,
1529 exim_gnutls_state_st * state;
1532 const char * errpos;
1535 if (!exim_gnutls_base_init_done)
1537 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1539 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
1540 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1541 which loads modules from a config file, which sounds good and may be wanted
1542 by some sysadmin, but also means in common configurations that GNOME keyring
1543 environment variables are used and so breaks for users calling mailq.
1544 To prevent this, we init PKCS11 first, which is the documented approach. */
1545 if (!gnutls_allow_auto_pkcs11)
1546 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
1547 return tls_error_gnu(US"gnutls_pkcs11_init", rc, host, errstr);
1550 #ifndef GNUTLS_AUTO_GLOBAL_INIT
1551 if ((rc = gnutls_global_init()))
1552 return tls_error_gnu(US"gnutls_global_init", rc, host, errstr);
1555 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1558 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1559 /* arbitrarily chosen level; bump up to 9 for more */
1560 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1564 #ifndef DISABLE_OCSP
1565 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1566 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1569 exim_gnutls_base_init_done = TRUE;
1574 /* For client-side sessions we allocate a context. This lets us run
1575 several in parallel. */
1576 int old_pool = store_pool;
1577 store_pool = POOL_PERM;
1578 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
1579 store_pool = old_pool;
1581 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1583 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1584 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1588 state = &state_server;
1589 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1591 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1592 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1595 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
1599 state->tls_certificate = certificate;
1600 state->tls_privatekey = privatekey;
1601 state->tls_require_ciphers = require_ciphers;
1602 state->tls_sni = sni;
1603 state->tls_verify_certificates = cas;
1604 state->tls_crl = crl;
1606 /* This handles the variables that might get re-expanded after TLS SNI;
1607 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1610 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1611 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1613 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1614 requires a new structure afterwards. */
1616 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
1618 /* set SNI in client, only */
1621 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
1623 if (state->tlsp->sni && *state->tlsp->sni)
1626 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1627 sz = Ustrlen(state->tlsp->sni);
1628 if ((rc = gnutls_server_name_set(state->session,
1629 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
1630 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
1633 else if (state->tls_sni)
1634 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1635 "have an SNI set for a server [%s]\n", state->tls_sni);
1637 /* This is the priority string support,
1638 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1639 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1640 This was backwards incompatible, but means Exim no longer needs to track
1641 all algorithms and provide string forms for them. */
1644 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1646 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
1648 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1650 p = state->exp_tls_require_ciphers;
1651 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
1656 p = exim_default_gnutls_priority;
1658 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1661 if ((rc = gnutls_priority_init(&state->priority_cache, CCS p, &errpos)))
1662 return tls_error_gnu(string_sprintf(
1663 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1664 p, errpos - CS p, errpos),
1667 if ((rc = gnutls_priority_set(state->session, state->priority_cache)))
1668 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
1670 /* This also sets the server ticket expiration time to the same, and
1671 the STEK rotation time to 3x. */
1673 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1675 /* Reduce security in favour of increased compatibility, if the admin
1676 decides to make that trade-off. */
1677 if (gnutls_compat_mode)
1679 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1680 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1681 gnutls_session_enable_compatibility_mode(state->session);
1683 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1687 *caller_state = state;
1693 /*************************************************
1694 * Extract peer information *
1695 *************************************************/
1697 static const uschar *
1698 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
1699 gnutls_mac_algorithm_t mac)
1702 gnutls_kx_algorithm_t kx_i;
1703 gnutls_cipher_algorithm_t cipher_i;
1704 gnutls_mac_algorithm_t mac_i;
1707 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
1709 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
1710 return cipher_stdname(cs_id[0], cs_id[1]);
1716 /* Called from both server and client code.
1717 Only this is allowed to set state->peerdn and state->have_set_peerdn
1718 and we use that to detect double-calls.
1720 NOTE: the state blocks last while the TLS connection is up, which is fine
1721 for logging in the server side, but for the client side, we log after teardown
1722 in src/deliver.c. While the session is up, we can twist about states and
1723 repoint tls_* globals, but those variables used for logging or other variable
1724 expansion that happens _after_ delivery need to have a longer life-time.
1726 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1727 doing this more than once per generation of a state context. We set them in
1728 the state context, and repoint tls_* to them. After the state goes away, the
1729 tls_* copies of the pointers remain valid and client delivery logging is happy.
1731 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1735 state exim_gnutls_state_st *
1736 errstr pointer to error string
1738 Returns: OK/DEFER/FAIL
1742 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
1744 gnutls_session_t session = state->session;
1745 const gnutls_datum_t * cert_list;
1747 unsigned int cert_list_size = 0;
1748 gnutls_protocol_t protocol;
1749 gnutls_cipher_algorithm_t cipher;
1750 gnutls_kx_algorithm_t kx;
1751 gnutls_mac_algorithm_t mac;
1752 gnutls_certificate_type_t ct;
1753 gnutls_x509_crt_t crt;
1757 if (state->have_set_peerdn)
1759 state->have_set_peerdn = TRUE;
1761 state->peerdn = NULL;
1764 cipher = gnutls_cipher_get(session);
1765 protocol = gnutls_protocol_get_version(session);
1766 mac = gnutls_mac_get(session);
1768 #ifdef GNUTLS_TLS1_3
1769 protocol >= GNUTLS_TLS1_3 ? 0 :
1771 gnutls_kx_get(session);
1773 old_pool = store_pool;
1775 tls_support * tlsp = state->tlsp;
1776 store_pool = POOL_PERM;
1778 #ifdef SUPPORT_GNUTLS_SESS_DESC
1781 uschar * s = US gnutls_session_get_desc(session), c;
1783 /* Nikos M suggests we use this by preference. It returns like:
1784 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
1786 For partial back-compat, put a colon after the TLS version, replace the
1787 )-( grouping with __, replace in-group - with _ and append the :keysize. */
1789 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
1791 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
1793 tlsp->ver = string_copyn(g->s, g->ptr);
1794 for (uschar * p = US tlsp->ver; *p; p++)
1795 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
1797 g = string_catn(g, US":", 1);
1798 if (*s) s++; /* now on _ between groups */
1801 for (*++s && ++s; (c = *s) && c != ')'; s++)
1802 g = string_catn(g, c == '-' ? US"_" : s, 1);
1803 /* now on ) closing group */
1804 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
1805 /* now on _ between groups */
1807 g = string_catn(g, US":", 1);
1808 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
1809 state->ciphersuite = string_from_gstring(g);
1812 state->ciphersuite = string_sprintf("%s:%s:%d",
1813 gnutls_protocol_get_name(protocol),
1814 gnutls_cipher_suite_get_name(kx, cipher, mac),
1815 (int) gnutls_cipher_get_key_size(cipher) * 8);
1817 /* I don't see a way that spaces could occur, in the current GnuTLS
1818 code base, but it was a concern in the old code and perhaps older GnuTLS
1819 releases did return "TLS 1.0"; play it safe, just in case. */
1821 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
1822 tlsp->ver = string_copyn(state->ciphersuite,
1823 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
1826 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
1828 tlsp->cipher = state->ciphersuite;
1829 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
1831 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
1833 store_pool = old_pool;
1836 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1838 if (!cert_list || cert_list_size == 0)
1840 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1841 cert_list, cert_list_size);
1842 if (state->verify_requirement >= VERIFY_REQUIRED)
1843 return tls_error(US"certificate verification failed",
1844 US"no certificate received from peer", state->host, errstr);
1848 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
1850 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
1852 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1853 if (state->verify_requirement >= VERIFY_REQUIRED)
1854 return tls_error(US"certificate verification not possible, unhandled type",
1855 ctn, state->host, errstr);
1859 #define exim_gnutls_peer_err(Label) \
1861 if (rc != GNUTLS_E_SUCCESS) \
1863 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1864 (Label), gnutls_strerror(rc)); \
1865 if (state->verify_requirement >= VERIFY_REQUIRED) \
1866 return tls_error_gnu((Label), rc, state->host, errstr); \
1871 rc = import_cert(&cert_list[0], &crt);
1872 exim_gnutls_peer_err(US"cert 0");
1874 state->tlsp->peercert = state->peercert = crt;
1877 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1878 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1880 exim_gnutls_peer_err(US"getting size for cert DN failed");
1881 return FAIL; /* should not happen */
1883 dn_buf = store_get_perm(sz, TRUE); /* tainted */
1884 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1885 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1887 state->peerdn = dn_buf;
1890 #undef exim_gnutls_peer_err
1896 /*************************************************
1897 * Verify peer certificate *
1898 *************************************************/
1900 /* Called from both server and client code.
1901 *Should* be using a callback registered with
1902 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1903 the peer information, but that's too new for some OSes.
1906 state exim_gnutls_state_st *
1907 errstr where to put an error message
1910 FALSE if the session should be rejected
1911 TRUE if the cert is okay or we just don't care
1915 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
1920 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
1922 rc = peer_status(state, errstr);
1924 if (state->verify_requirement == VERIFY_NONE)
1927 if (rc != OK || !state->peerdn)
1929 verify = GNUTLS_CERT_INVALID;
1930 *errstr = US"certificate not supplied";
1936 if (state->verify_requirement == VERIFY_DANE && state->host)
1938 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1939 including talking to a DNS resolver. But we want to do that bit ourselves
1940 as the testsuite intercepts and fakes its own DNS environment. */
1945 const gnutls_datum_t * certlist =
1946 gnutls_certificate_get_peers(state->session, &lsize);
1947 int usage = tls_out.tlsa_usage;
1949 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1950 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1951 dane-verification separately so that we know which selector verified;
1952 then we know whether to do name-verification (needed for TA but not EE). */
1954 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
1955 { /* a mixed-usage bundle */
1960 for (nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1963 dd = store_get(nrec * sizeof(uschar *), FALSE);
1964 ddl = store_get(nrec * sizeof(int), FALSE);
1967 if ((rc = dane_state_init(&s, 0)))
1970 for (usage = DANESSL_USAGE_DANE_EE;
1971 usage >= DANESSL_USAGE_DANE_TA; usage--)
1972 { /* take records with this usage */
1973 for (j = i = 0; i < nrec; i++)
1974 if (state->dane_data[i][0] == usage)
1976 dd[j] = state->dane_data[i];
1977 ddl[j++] = state->dane_data_len[i];
1984 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1987 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1988 gnutls_certificate_type_get(state->session),
1990 usage == DANESSL_USAGE_DANE_EE
1991 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1995 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1997 else if (verify == 0) /* verification passed */
2005 if (rc) goto tlsa_prob;
2010 if ( (rc = dane_state_init(&s, 0))
2011 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
2013 || (rc = dane_verify_crt_raw(s, certlist, lsize,
2014 gnutls_certificate_type_get(state->session),
2016 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2017 usage == (1 << DANESSL_USAGE_DANE_EE)
2018 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2027 if (verify != 0) /* verification failed */
2030 (void) dane_verification_status_print(verify, &str, 0);
2031 *errstr = US str.data; /* don't bother to free */
2035 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2036 /* If a TA-mode TLSA record was used for verification we must additionally
2037 verify the cert name (but not the CA chain). For EE-mode, skip it. */
2039 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2042 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2045 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2046 /* Assume that the name on the A-record is the one that should be matching
2047 the cert. An alternate view is that the domain part of the email address
2048 is also permissible. */
2050 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2051 CS state->host->name))
2053 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2058 #endif /*SUPPORT_DANE*/
2060 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2063 /* Handle the result of verification. INVALID is set if any others are. */
2065 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2067 state->peer_cert_verified = FALSE;
2070 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2075 if (gnutls_certificate_verification_status_print(verify,
2076 gnutls_certificate_type_get(state->session), &txt, 0)
2077 == GNUTLS_E_SUCCESS)
2079 debug_printf("%s\n", txt.data);
2080 gnutls_free(txt.data);
2084 *errstr = verify & GNUTLS_CERT_REVOKED
2085 ? US"certificate revoked" : US"certificate invalid";
2089 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2090 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2092 if (state->verify_requirement >= VERIFY_REQUIRED)
2095 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2100 /* Client side, check the server's certificate name versus the name on the
2101 A-record for the connection we made. What to do for server side - what name
2102 to use for client? We document that there is no such checking for server
2105 if ( state->exp_tls_verify_cert_hostnames
2106 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2107 CS state->exp_tls_verify_cert_hostnames)
2111 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2112 if (state->verify_requirement >= VERIFY_REQUIRED)
2117 state->peer_cert_verified = TRUE;
2118 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2119 state->peerdn ? state->peerdn : US"<unset>");
2123 state->tlsp->peerdn = state->peerdn;
2128 *errstr = string_sprintf("TLSA record problem: %s",
2129 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2133 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2140 /* ------------------------------------------------------------------------ */
2143 /* Logging function which can be registered with
2144 * gnutls_global_set_log_function()
2145 * gnutls_global_set_log_level() 0..9
2147 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2149 exim_gnutls_logger_cb(int level, const char *message)
2151 size_t len = strlen(message);
2154 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2157 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2158 message[len-1] == '\n' ? "" : "\n");
2163 /* Called after client hello, should handle SNI work.
2164 This will always set tls_sni (state->received_sni) if available,
2165 and may trigger presenting different certificates,
2166 if state->trigger_sni_changes is TRUE.
2168 Should be registered with
2169 gnutls_handshake_set_post_client_hello_function()
2171 "This callback must return 0 on success or a gnutls error code to terminate the
2174 For inability to get SNI information, we return 0.
2175 We only return non-zero if re-setup failed.
2176 Only used for server-side TLS.
2180 exim_sni_handling_cb(gnutls_session_t session)
2182 char sni_name[MAX_HOST_LEN];
2183 size_t data_len = MAX_HOST_LEN;
2184 exim_gnutls_state_st *state = &state_server;
2185 unsigned int sni_type;
2187 uschar * dummy_errstr;
2189 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2190 if (rc != GNUTLS_E_SUCCESS)
2193 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2194 debug_printf("TLS: no SNI presented in handshake.\n");
2196 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2197 gnutls_strerror(rc), rc);
2201 if (sni_type != GNUTLS_NAME_DNS)
2203 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2207 /* We now have a UTF-8 string in sni_name */
2208 old_pool = store_pool;
2209 store_pool = POOL_PERM;
2210 state->received_sni = string_copy_taint(US sni_name, TRUE);
2211 store_pool = old_pool;
2213 /* We set this one now so that variable expansions below will work */
2214 state->tlsp->sni = state->received_sni;
2216 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2217 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2219 if (!state->trigger_sni_changes)
2222 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2224 /* If the setup of certs/etc failed before handshake, TLS would not have
2225 been offered. The best we can do now is abort. */
2226 return GNUTLS_E_APPLICATION_ERROR_MIN;
2229 rc = tls_set_remaining_x509(state, &dummy_errstr);
2230 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2237 #ifndef DISABLE_EVENT
2239 We use this callback to get observability and detail-level control
2240 for an exim TLS connection (either direction), raising a tls:cert event
2241 for each cert in the chain presented by the peer. Any event
2242 can deny verification.
2244 Return 0 for the handshake to continue or non-zero to terminate.
2248 verify_cb(gnutls_session_t session)
2250 const gnutls_datum_t * cert_list;
2251 unsigned int cert_list_size = 0;
2252 gnutls_x509_crt_t crt;
2255 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2257 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2258 while (cert_list_size--)
2260 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2262 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2263 cert_list_size, gnutls_strerror(rc));
2267 state->tlsp->peercert = crt;
2268 if ((yield = event_raise(state->event_action,
2269 US"tls:cert", string_sprintf("%d", cert_list_size))))
2271 log_write(0, LOG_MAIN,
2272 "SSL verify denied by event-action: depth=%d: %s",
2273 cert_list_size, yield);
2274 return 1; /* reject */
2276 state->tlsp->peercert = NULL;
2286 ddump(gnutls_datum_t * d)
2288 gstring * g = string_get((d->size+1) * 2);
2289 uschar * s = d->data;
2290 for (unsigned i = d->size; i > 0; i--, s++)
2292 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2293 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2299 post_handshake_debug(exim_gnutls_state_st * state)
2301 #ifdef SUPPORT_GNUTLS_SESS_DESC
2302 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2305 #ifdef SUPPORT_GNUTLS_KEYLOG
2306 # ifdef EXIM_HAVE_TLS1_3
2307 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2312 gnutls_datum_t c, s;
2314 /* For TLS1.2 we only want the client random and the master secret */
2315 gnutls_session_get_random(state->session, &c, &s);
2316 gnutls_session_get_master_secret(state->session, &s);
2319 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2322 debug_printf("To get keying info for TLS1.3 is hard:\n"
2323 " Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,\n"
2324 " and make sure it is writable by the Exim runtime user.\n"
2325 " Add SSLKEYLOGFILE to keep_environment in the exim config.\n"
2326 " Start Exim as root.\n"
2327 " If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2328 " (works for TLS1.2 also, and saves cut-paste into file).\n"
2329 " Trying to use add_environment for this will not work\n");
2334 #ifdef EXPERIMENTAL_TLS_RESUME
2336 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2337 unsigned incoming, const gnutls_datum_t * msg)
2339 DEBUG(D_tls) debug_printf("newticket cb\n");
2340 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2345 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2347 /* Should the server offer session resumption? */
2348 tls_in.resumption = RESUME_SUPPORTED;
2349 if (verify_check_host(&tls_resumption_hosts) == OK)
2352 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2353 an offered resumption is unacceptable. We lose one resumption per ticket
2354 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2355 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2356 least they go out in a single packet. */
2358 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2359 &server_sessticket_key)))
2360 tls_in.resumption |= RESUME_SERVER_TICKET;
2363 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2365 /* Try to tell if we see a ticket request */
2366 gnutls_handshake_set_hook_function(state->session,
2367 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2372 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2374 if (gnutls_session_resumption_requested(state->session))
2376 /* This tells us the client sent a full ticket. We use a
2377 callback on session-ticket request, elsewhere, to tell
2378 if a client asked for a ticket. */
2380 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2381 DEBUG(D_tls) debug_printf("client requested resumption\n");
2383 if (gnutls_session_is_resumed(state->session))
2385 tls_in.resumption |= RESUME_USED;
2386 DEBUG(D_tls) debug_printf("Session resumed\n");
2390 /* ------------------------------------------------------------------------ */
2391 /* Exported functions */
2396 /*************************************************
2397 * Start a TLS session in a server *
2398 *************************************************/
2400 /* This is called when Exim is running as a server, after having received
2401 the STARTTLS command. It must respond to that command, and then negotiate
2405 require_ciphers list of allowed ciphers or NULL
2406 errstr pointer to error string
2408 Returns: OK on success
2409 DEFER for errors before the start of the negotiation
2410 FAIL for errors during the negotiation; the server can't
2415 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
2418 exim_gnutls_state_st * state = NULL;
2420 /* Check for previous activation */
2421 if (tls_in.active.sock >= 0)
2423 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2424 smtp_printf("554 Already in TLS\r\n", FALSE);
2428 /* Initialize the library. If it fails, it will already have logged the error
2429 and sent an SMTP response. */
2431 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2434 #ifdef MEASURE_TIMING
2436 gettimeofday(&t0, NULL);
2439 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
2440 NULL, tls_verify_certificates, tls_crl,
2441 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2443 #ifdef MEASURE_TIMING
2444 report_time_since(&t0, US"server tls_init (delta)");
2448 #ifdef EXPERIMENTAL_TLS_RESUME
2449 tls_server_resume_prehandshake(state);
2452 /* If this is a host for which certificate verification is mandatory or
2453 optional, set up appropriately. */
2455 if (verify_check_host(&tls_verify_hosts) == OK)
2458 debug_printf("TLS: a client certificate will be required.\n");
2459 state->verify_requirement = VERIFY_REQUIRED;
2460 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2462 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2465 debug_printf("TLS: a client certificate will be requested but not required.\n");
2466 state->verify_requirement = VERIFY_OPTIONAL;
2467 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2472 debug_printf("TLS: a client certificate will not be requested.\n");
2473 state->verify_requirement = VERIFY_NONE;
2474 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2477 #ifndef DISABLE_EVENT
2480 state->event_action = event_action;
2481 gnutls_session_set_ptr(state->session, state);
2482 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2486 /* Register SNI handling; always, even if not in tls_certificate, so that the
2487 expansion variable $tls_sni is always available. */
2489 gnutls_handshake_set_post_client_hello_function(state->session,
2490 exim_sni_handling_cb);
2492 /* Set context and tell client to go ahead, except in the case of TLS startup
2493 on connection, where outputting anything now upsets the clients and tends to
2494 make them disconnect. We need to have an explicit fflush() here, to force out
2495 the response. Other smtp_printf() calls do not need it, because in non-TLS
2496 mode, the fflush() happens when smtp_getc() is called. */
2498 if (!state->tlsp->on_connect)
2500 smtp_printf("220 TLS go ahead\r\n", FALSE);
2504 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2505 that the GnuTLS library doesn't.
2506 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2507 to set (and clear down afterwards) up a pull-timeout callback function that does
2508 a select, so we're no better off unless avoiding signals becomes an issue. */
2510 gnutls_transport_set_ptr2(state->session,
2511 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2512 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
2513 state->fd_in = fileno(smtp_in);
2514 state->fd_out = fileno(smtp_out);
2516 sigalrm_seen = FALSE;
2517 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2519 rc = gnutls_handshake(state->session);
2520 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2523 if (rc != GNUTLS_E_SUCCESS)
2525 /* It seems that, except in the case of a timeout, we have to close the
2526 connection right here; otherwise if the other end is running OpenSSL it hangs
2527 until the server times out. */
2531 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
2532 gnutls_db_remove_session(state->session);
2536 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
2537 (void) gnutls_alert_send_appropriate(state->session, rc);
2538 gnutls_deinit(state->session);
2539 gnutls_certificate_free_credentials(state->x509_cred);
2541 shutdown(state->fd_out, SHUT_WR);
2542 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
2543 (void)fclose(smtp_out);
2544 (void)fclose(smtp_in);
2545 smtp_out = smtp_in = NULL;
2551 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
2552 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
2553 tls_in.ext_master_secret = TRUE;
2556 #ifdef EXPERIMENTAL_TLS_RESUME
2557 tls_server_resume_posthandshake(state);
2560 DEBUG(D_tls) post_handshake_debug(state);
2562 /* Verify after the fact */
2564 if (!verify_certificate(state, errstr))
2566 if (state->verify_requirement != VERIFY_OPTIONAL)
2568 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
2572 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
2576 /* Sets various Exim expansion variables; always safe within server */
2578 extract_exim_vars_from_tls_state(state);
2580 /* TLS has been set up. Adjust the input functions to read via TLS,
2581 and initialize appropriately. */
2583 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2585 receive_getc = tls_getc;
2586 receive_getbuf = tls_getbuf;
2587 receive_get_cache = tls_get_cache;
2588 receive_ungetc = tls_ungetc;
2589 receive_feof = tls_feof;
2590 receive_ferror = tls_ferror;
2591 receive_smtp_buffered = tls_smtp_buffered;
2600 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2601 smtp_transport_options_block * ob)
2603 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2605 state->exp_tls_verify_cert_hostnames =
2607 string_domain_utf8_to_alabel(host->certname, NULL);
2612 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2613 state->exp_tls_verify_cert_hostnames);
2621 /* Given our list of RRs from the TLSA lookup, build a lookup block in
2622 GnuTLS-DANE's preferred format. Hang it on the state str for later
2623 use in DANE verification.
2625 We point at the dnsa data not copy it, so it must remain valid until
2626 after verification is done.*/
2629 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2633 const char ** dane_data;
2634 int * dane_data_len;
2637 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2638 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2639 ) if (rr->type == T_TLSA) i++;
2641 dane_data = store_get(i * sizeof(uschar *), FALSE);
2642 dane_data_len = store_get(i * sizeof(int), FALSE);
2645 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2646 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2647 ) if (rr->type == T_TLSA && rr->size > 3)
2649 const uschar * p = rr->data;
2650 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
2651 uint8_t usage = p[0], sel = p[1], type = p[2];
2654 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2656 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2657 || (sel != 0 && sel != 1)
2662 case 0: /* Full: cannot check at present */
2664 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2666 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2671 tls_out.tlsa_usage |= 1<<usage;
2672 dane_data[i] = CS p;
2673 dane_data_len[i++] = rr->size;
2676 if (!i) return FALSE;
2678 dane_data[i] = NULL;
2679 dane_data_len[i] = 0;
2681 state->dane_data = (char * const *)dane_data;
2682 state->dane_data_len = dane_data_len;
2689 #ifdef EXPERIMENTAL_TLS_RESUME
2690 /* On the client, get any stashed session for the given IP from hints db
2691 and apply it to the ssl-connection for attempted resumption. Although
2692 there is a gnutls_session_ticket_enable_client() interface it is
2693 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
2694 by deafult". There seems to be no way to disable them, so even hosts not
2695 enabled by the transport option will be sent a ticket request. We will
2696 however avoid storing and retrieving session information. */
2699 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
2700 host_item * host, smtp_transport_options_block * ob)
2702 tlsp->resumption = RESUME_SUPPORTED;
2703 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
2705 dbdata_tls_session * dt;
2707 open_db dbblock, * dbm_file;
2710 debug_printf("check for resumable session for %s\n", host->address);
2711 tlsp->host_resumable = TRUE;
2712 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2713 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
2715 /* Key for the db is the IP. We'd like to filter the retrieved session
2716 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
2718 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
2719 if (!(rc = gnutls_session_set_data(session,
2720 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
2722 DEBUG(D_tls) debug_printf("good session\n");
2723 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2725 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
2726 US gnutls_strerror(rc));
2727 dbfn_close(dbm_file);
2734 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
2736 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
2737 but this flag is not set until the second. TLS 1.3 it's the other way about.
2738 Keep both calls as the session data cannot be extracted before handshake
2741 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
2746 DEBUG(D_tls) debug_printf("server offered session ticket\n");
2747 tlsp->ticket_received = TRUE;
2748 tlsp->resumption |= RESUME_SERVER_TICKET;
2750 if (tlsp->host_resumable)
2751 if (!(rc = gnutls_session_get_data2(session, &tkt)))
2753 open_db dbblock, * dbm_file;
2754 int dlen = sizeof(dbdata_tls_session) + tkt.size;
2755 dbdata_tls_session * dt = store_get(dlen, TRUE);
2757 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
2758 memcpy(dt->session, tkt.data, tkt.size);
2759 gnutls_free(tkt.data);
2761 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
2763 /* key for the db is the IP */
2764 dbfn_delete(dbm_file, host->address);
2765 dbfn_write(dbm_file, host->address, dt, dlen);
2766 dbfn_close(dbm_file);
2769 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
2773 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
2778 /* With a TLS1.3 session, the ticket(s) are not seen until
2779 the first data read is attempted. And there's often two of them.
2780 Pick them up with this callback. We are also called for 1.2
2784 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2785 unsigned incoming, const gnutls_datum_t * msg)
2787 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
2788 tls_support * tlsp = state->tlsp;
2790 DEBUG(D_tls) debug_printf("newticket cb\n");
2792 if (!tlsp->ticket_received)
2793 tls_save_session(tlsp, sess, state->host);
2799 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
2800 tls_support * tlsp, host_item * host,
2801 smtp_transport_options_block * ob)
2803 gnutls_session_set_ptr(state->session, state);
2804 gnutls_handshake_set_hook_function(state->session,
2805 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
2807 tls_retrieve_session(tlsp, state->session, host, ob);
2811 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
2812 tls_support * tlsp, host_item * host)
2814 if (gnutls_session_is_resumed(state->session))
2816 DEBUG(D_tls) debug_printf("Session resumed\n");
2817 tlsp->resumption |= RESUME_USED;
2820 tls_save_session(tlsp, state->session, host);
2822 #endif /* EXPERIMENTAL_TLS_RESUME */
2825 /*************************************************
2826 * Start a TLS session in a client *
2827 *************************************************/
2829 /* Called from the smtp transport after STARTTLS has been accepted.
2832 cctx connection context
2833 conn_args connection details
2834 cookie datum for randomness (not used)
2835 tlsp record details of channel configuration here; must be non-NULL
2836 errstr error string pointer
2838 Returns: TRUE for success with TLS session context set in smtp context,
2843 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2844 void * cookie ARG_UNUSED,
2845 tls_support * tlsp, uschar ** errstr)
2847 host_item * host = conn_args->host; /* for msgs and option-tests */
2848 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
2849 smtp_transport_options_block * ob = tb
2850 ? (smtp_transport_options_block *)tb->options_block
2851 : &smtp_transport_option_defaults;
2853 exim_gnutls_state_st * state = NULL;
2854 uschar * cipher_list = NULL;
2856 #ifndef DISABLE_OCSP
2858 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
2859 BOOL request_ocsp = require_ocsp ? TRUE
2860 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2863 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
2866 /* If dane is flagged, have either request or require dane for this host, and
2867 a TLSA record found. Therefore, dane verify required. Which implies cert must
2868 be requested and supplied, dane verify must pass, and cert verify irrelevant
2869 (incl. hostnames), and (caller handled) require_tls and sni=$domain */
2871 if (conn_args->dane && ob->dane_require_tls_ciphers)
2873 /* not using expand_check_tlsvar because not yet in state */
2874 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2875 &cipher_list, errstr))
2877 cipher_list = cipher_list && *cipher_list
2878 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
2883 cipher_list = ob->tls_require_ciphers;
2886 #ifdef MEASURE_TIMING
2888 gettimeofday(&t0, NULL);
2891 if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2892 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2893 cipher_list, &state, tlsp, errstr) != OK)
2897 #ifdef MEASURE_TIMING
2898 report_time_since(&t0, US"client tls_init (delta)");
2903 int dh_min_bits = ob->tls_dh_min_bits;
2904 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2907 debug_printf("WARNING: tls_dh_min_bits far too low,"
2908 " clamping %d up to %d\n",
2909 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2910 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2913 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2914 " acceptable bits to %d\n",
2916 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2919 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
2920 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2921 the specified host patterns if one of them is defined */
2924 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
2927 debug_printf("TLS: server certificate DANE required.\n");
2928 state->verify_requirement = VERIFY_DANE;
2929 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2933 if ( ( state->exp_tls_verify_certificates
2934 && !ob->tls_verify_hosts
2935 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2937 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
2940 tls_client_setup_hostname_checks(host, state, ob);
2942 debug_printf("TLS: server certificate verification required.\n");
2943 state->verify_requirement = VERIFY_REQUIRED;
2944 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2946 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
2948 tls_client_setup_hostname_checks(host, state, ob);
2950 debug_printf("TLS: server certificate verification optional.\n");
2951 state->verify_requirement = VERIFY_OPTIONAL;
2952 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2957 debug_printf("TLS: server certificate verification not required.\n");
2958 state->verify_requirement = VERIFY_NONE;
2959 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2962 #ifndef DISABLE_OCSP
2963 /* supported since GnuTLS 3.1.3 */
2966 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2967 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2968 NULL, 0, NULL)) != OK)
2970 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
2973 tlsp->ocsp = OCSP_NOT_RESP;
2977 #ifdef EXPERIMENTAL_TLS_RESUME
2978 tls_client_resume_prehandshake(state, tlsp, host, ob);
2981 #ifndef DISABLE_EVENT
2982 if (tb && tb->event_action)
2984 state->event_action = tb->event_action;
2985 gnutls_session_set_ptr(state->session, state);
2986 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2990 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
2991 state->fd_in = cctx->sock;
2992 state->fd_out = cctx->sock;
2994 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2995 /* There doesn't seem to be a built-in timeout on connection. */
2997 sigalrm_seen = FALSE;
2998 ALARM(ob->command_timeout);
3000 rc = gnutls_handshake(state->session);
3001 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3004 if (rc != GNUTLS_E_SUCCESS)
3008 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
3009 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
3012 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
3016 DEBUG(D_tls) post_handshake_debug(state);
3020 if (!verify_certificate(state, errstr))
3022 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
3026 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3027 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3028 tlsp->ext_master_secret = TRUE;
3031 #ifndef DISABLE_OCSP
3036 gnutls_datum_t stapling;
3037 gnutls_ocsp_resp_t resp;
3038 gnutls_datum_t printed;
3042 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
3043 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
3045 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
3048 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
3049 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
3050 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
3053 debug_printf("%.4096s", printed.data);
3054 gnutls_free(printed.data);
3057 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3059 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3062 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3064 tlsp->ocsp = OCSP_FAILED;
3065 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3071 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3072 tlsp->ocsp = OCSP_VFIED;
3077 #ifdef EXPERIMENTAL_TLS_RESUME
3078 tls_client_resume_posthandshake(state, tlsp, host);
3081 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3083 extract_exim_vars_from_tls_state(state);
3085 cctx->tls_ctx = state;
3092 /*************************************************
3093 * Close down a TLS session *
3094 *************************************************/
3096 /* This is also called from within a delivery subprocess forked from the
3097 daemon, to shut down the TLS library, without actually doing a shutdown (which
3098 would tamper with the TLS session in the parent process).
3101 ct_ctx client context pointer, or NULL for the one global server context
3102 shutdown 1 if TLS close-alert is to be sent,
3103 2 if also response to be waited for
3109 tls_close(void * ct_ctx, int shutdown)
3111 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3112 tls_support * tlsp = state->tlsp;
3114 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3118 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3119 shutdown > 1 ? " (with response-wait)" : "");
3122 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3126 if (!ct_ctx) /* server */
3128 receive_getc = smtp_getc;
3129 receive_getbuf = smtp_getbuf;
3130 receive_get_cache = smtp_get_cache;
3131 receive_ungetc = smtp_ungetc;
3132 receive_feof = smtp_feof;
3133 receive_ferror = smtp_ferror;
3134 receive_smtp_buffered = smtp_buffered;
3137 gnutls_deinit(state->session);
3138 gnutls_certificate_free_credentials(state->x509_cred);
3140 tlsp->active.sock = -1;
3141 tlsp->active.tls_ctx = NULL;
3142 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3143 tlsp->channelbinding = NULL;
3146 if (state->xfer_buffer) store_free(state->xfer_buffer);
3147 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
3154 tls_refill(unsigned lim)
3156 exim_gnutls_state_st * state = &state_server;
3159 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, buffersize=%u)\n",
3160 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3162 sigalrm_seen = FALSE;
3163 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3167 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3168 MIN(ssl_xfer_buffer_size, lim));
3169 while (inbytes == GNUTLS_E_AGAIN);
3171 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3173 if (had_command_timeout) /* set by signal handler */
3174 smtp_command_timeout_exit(); /* does not return */
3175 if (had_command_sigterm)
3176 smtp_command_sigterm_exit();
3177 if (had_data_timeout)
3178 smtp_data_timeout_exit();
3179 if (had_data_sigint)
3180 smtp_data_sigint_exit();
3182 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3183 TLS session has been closed down, not that the socket itself has been closed
3184 down. Revert to non-TLS handling. */
3188 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3189 state->xfer_error = TRUE;
3193 else if (inbytes == 0)
3195 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3196 tls_close(NULL, TLS_NO_SHUTDOWN);
3200 /* Handle genuine errors */
3202 else if (inbytes < 0)
3204 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3205 record_io_error(state, (int) inbytes, US"recv", NULL);
3206 state->xfer_error = TRUE;
3209 #ifndef DISABLE_DKIM
3210 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3212 state->xfer_buffer_hwm = (int) inbytes;
3213 state->xfer_buffer_lwm = 0;
3217 /*************************************************
3218 * TLS version of getc *
3219 *************************************************/
3221 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3222 it refills the buffer via the GnuTLS reading function.
3223 Only used by the server-side TLS.
3225 This feeds DKIM and should be used for all message-body reads.
3227 Arguments: lim Maximum amount to read/buffer
3228 Returns: the next character or EOF
3232 tls_getc(unsigned lim)
3234 exim_gnutls_state_st * state = &state_server;
3236 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3237 if (!tls_refill(lim))
3238 return state->xfer_error ? EOF : smtp_getc(lim);
3240 /* Something in the buffer; return next uschar */
3242 return state->xfer_buffer[state->xfer_buffer_lwm++];
3246 tls_getbuf(unsigned * len)
3248 exim_gnutls_state_st * state = &state_server;
3252 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3253 if (!tls_refill(*len))
3255 if (!state->xfer_error) return smtp_getbuf(len);
3260 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3262 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3263 state->xfer_buffer_lwm += size;
3272 #ifndef DISABLE_DKIM
3273 exim_gnutls_state_st * state = &state_server;
3274 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3276 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3282 tls_could_read(void)
3284 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3285 || gnutls_record_check_pending(state_server.session) > 0;
3291 /*************************************************
3292 * Read bytes from TLS channel *
3293 *************************************************/
3295 /* This does not feed DKIM, so if the caller uses this for reading message body,
3296 then the caller must feed DKIM.
3299 ct_ctx client context pointer, or NULL for the one global server context
3303 Returns: the number of bytes read
3304 -1 after a failed read, including EOF
3308 tls_read(void * ct_ctx, uschar *buff, size_t len)
3310 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3316 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3318 debug_printf("*** PROBABLY A BUG *** " \
3319 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3320 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3323 debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, len=" SIZE_T_FMT ")\n",
3324 state->session, buff, len);
3328 inbytes = gnutls_record_recv(state->session, buff, len);
3329 while (inbytes == GNUTLS_E_AGAIN);
3331 if (inbytes > 0) return inbytes;
3334 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3338 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3339 record_io_error(state, (int)inbytes, US"recv", NULL);
3348 /*************************************************
3349 * Write bytes down TLS channel *
3350 *************************************************/
3354 ct_ctx client context pointer, or NULL for the one global server context
3357 more more data expected soon
3359 Calling with len zero and more unset will flush buffered writes. The buff
3360 argument can be null for that case.
3362 Returns: the number of bytes after a successful write,
3363 -1 after a failed write
3367 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
3371 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3374 if (more && !state->corked)
3376 DEBUG(D_tls) debug_printf("gnutls_record_cork(session=%p)\n", state->session);
3377 gnutls_record_cork(state->session);
3378 state->corked = TRUE;
3382 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
3383 buff, left, more ? ", more" : "");
3387 DEBUG(D_tls) debug_printf("gnutls_record_send(session=%p, buffer=%p, left=" SIZE_T_FMT ")\n",
3388 state->session, buff, left);
3392 outbytes = gnutls_record_send(state->session, buff, left);
3393 while (outbytes == GNUTLS_E_AGAIN);
3395 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
3399 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
3400 record_io_error(state, outbytes, US"send", NULL);
3405 record_io_error(state, 0, US"send", US"TLS channel closed on write");
3416 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
3422 if (!more && state->corked)
3424 DEBUG(D_tls) debug_printf("gnutls_record_uncork(session=%p)\n", state->session);
3426 /* We can't use GNUTLS_RECORD_WAIT here, as it retries on
3427 GNUTLS_E_AGAIN || GNUTLS_E_INTR, which would break our timeout set by alarm().
3428 The GNUTLS_E_AGAIN should not happen ever, as our sockets are blocking anyway.
3429 But who knows. (That all relies on the fact that GNUTLS_E_INTR and GNUTLS_E_AGAIN
3430 match the EINTR and EAGAIN errno values.) */
3431 outbytes = gnutls_record_uncork(state->session, 0);
3432 while (outbytes == GNUTLS_E_AGAIN);
3436 record_io_error(state, len, US"uncork", NULL);
3440 state->corked = FALSE;
3450 /*************************************************
3451 * Random number generation *
3452 *************************************************/
3454 /* Pseudo-random number generation. The result is not expected to be
3455 cryptographically strong but not so weak that someone will shoot themselves
3456 in the foot using it as a nonce in input in some email header scheme or
3457 whatever weirdness they'll twist this into. The result should handle fork()
3458 and avoid repeating sequences. OpenSSL handles that for us.
3462 Returns a random number in range [0, max-1]
3465 #ifdef HAVE_GNUTLS_RND
3467 vaguely_random_number(int max)
3471 uschar smallbuf[sizeof(r)];
3476 needed_len = sizeof(r);
3477 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
3478 asked for a number less than 10. */
3480 for (r = max, i = 0; r; ++i)
3486 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
3489 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
3490 return vaguely_random_number_fallback(max);
3493 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
3496 /* We don't particularly care about weighted results; if someone wants
3497 * smooth distribution and cares enough then they should submit a patch then. */
3500 #else /* HAVE_GNUTLS_RND */
3502 vaguely_random_number(int max)
3504 return vaguely_random_number_fallback(max);
3506 #endif /* HAVE_GNUTLS_RND */
3511 /*************************************************
3512 * Let tls_require_ciphers be checked at startup *
3513 *************************************************/
3515 /* The tls_require_ciphers option, if set, must be something which the
3518 Returns: NULL on success, or error message
3522 tls_validate_require_cipher(void)
3525 uschar *expciphers = NULL;
3526 gnutls_priority_t priority_cache;
3528 uschar * dummy_errstr;
3530 #ifdef GNUTLS_AUTO_GLOBAL_INIT
3531 # define validate_check_rc(Label) do { \
3532 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \
3533 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3534 # define return_deinit(Label) do { return (Label); } while (0)
3536 # define validate_check_rc(Label) do { \
3537 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
3538 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3539 # define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
3542 if (exim_gnutls_base_init_done)
3543 log_write(0, LOG_MAIN|LOG_PANIC,
3544 "already initialised GnuTLS, Exim developer bug");
3546 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
3547 if (!gnutls_allow_auto_pkcs11)
3549 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
3550 validate_check_rc(US"gnutls_pkcs11_init");
3553 #ifndef GNUTLS_AUTO_GLOBAL_INIT
3554 rc = gnutls_global_init();
3555 validate_check_rc(US"gnutls_global_init()");
3557 exim_gnutls_base_init_done = TRUE;
3559 if (!(tls_require_ciphers && *tls_require_ciphers))
3560 return_deinit(NULL);
3562 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
3564 return_deinit(US"failed to expand tls_require_ciphers");
3566 if (!(expciphers && *expciphers))
3567 return_deinit(NULL);
3570 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
3572 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
3573 validate_check_rc(string_sprintf(
3574 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
3575 expciphers, errpos - CS expciphers, errpos));
3577 #undef return_deinit
3578 #undef validate_check_rc
3579 #ifndef GNUTLS_AUTO_GLOBAL_INIT
3580 gnutls_global_deinit();
3589 /*************************************************
3590 * Report the library versions. *
3591 *************************************************/
3593 /* See a description in tls-openssl.c for an explanation of why this exists.
3595 Arguments: a FILE* to print the results to
3600 tls_version_report(FILE *f)
3602 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
3605 gnutls_check_version(NULL));
3608 #endif /*!MACRO_PREDEF*/
3611 /* End of tls-gnu.c */