1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2018 */
7 /* Copyright (c) Phil Pennock 2012 */
8 /* See the file NOTICE for conditions of use and distribution. */
9 /* SPDX-License-Identifier: GPL-2.0-or-later */
11 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
12 one of the available supported implementations. This file is #included into
13 tls.c when USE_GNUTLS has been set.
15 The code herein is a revamp of GnuTLS integration using the current APIs; the
16 original tls-gnu.c was based on a patch which was contributed by Nikos
17 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
20 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
21 which is not widely deployed by OS vendors. Will note issues below, which may
22 assist in updating the code in the future. Another sources of hints is
23 mod_gnutls for Apache (SNI callback registration and handling).
25 Keeping client and server variables more split than before and is currently
26 the norm, in anticipation of TLS in ACL callouts.
28 I wanted to switch to gnutls_certificate_set_verify_function() so that
29 certificate rejection could happen during handshake where it belongs, rather
30 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
31 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
33 (I wasn't looking for libraries quite that old, when updating to get rid of
34 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
35 require current GnuTLS, then we'll drop support for the ancient libraries).
38 #include <gnutls/gnutls.h>
39 /* needed for cert checks in verification and DN extraction: */
40 #include <gnutls/x509.h>
41 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
42 #include <gnutls/crypto.h>
44 /* needed to disable PKCS11 autoload unless requested */
45 #if GNUTLS_VERSION_NUMBER >= 0x020c00
46 # include <gnutls/pkcs11.h>
47 # define SUPPORT_PARAM_TO_PK_BITS
49 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
50 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
53 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
54 # warning "GnuTLS library version too old; tls:cert event unsupported"
55 # define DISABLE_EVENT
57 #if GNUTLS_VERSION_NUMBER >= 0x030000
58 # define SUPPORT_SELFSIGN /* Uncertain what version is first usable but 2.12.23 is not */
60 #if GNUTLS_VERSION_NUMBER >= 0x030306
61 # define SUPPORT_CA_DIR
63 # undef SUPPORT_CA_DIR
65 #if GNUTLS_VERSION_NUMBER >= 0x030014
66 # define SUPPORT_SYSDEFAULT_CABUNDLE
68 #if GNUTLS_VERSION_NUMBER >= 0x030104
69 # define GNUTLS_CERT_VFY_STATUS_PRINT
71 #if GNUTLS_VERSION_NUMBER >= 0x030109
74 #if GNUTLS_VERSION_NUMBER >= 0x03010a
75 # define SUPPORT_GNUTLS_SESS_DESC
77 #if GNUTLS_VERSION_NUMBER >= 0x030300
78 # define GNUTLS_AUTO_GLOBAL_INIT
79 # define GNUTLS_AUTO_PKCS11_MANUAL
81 #if (GNUTLS_VERSION_NUMBER >= 0x030404) \
82 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
84 # define EXIM_HAVE_OCSP
87 #if GNUTLS_VERSION_NUMBER >= 0x030500
88 # define SUPPORT_GNUTLS_KEYLOG
90 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
91 # define SUPPORT_SRV_OCSP_STACK
93 #if GNUTLS_VERSION_NUMBER >= 0x030603
94 # define EXIM_HAVE_TLS1_3
95 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
96 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
100 # if GNUTLS_VERSION_NUMBER >= 0x030000
101 # define DANESSL_USAGE_DANE_TA 2
102 # define DANESSL_USAGE_DANE_EE 3
104 # error GnuTLS version too early for DANE
106 # if GNUTLS_VERSION_NUMBER < 0x999999
107 # define GNUTLS_BROKEN_DANE_VALIDATION
111 #ifndef DISABLE_TLS_RESUME
112 # if GNUTLS_VERSION_NUMBER >= 0x030603
113 # define EXIM_HAVE_TLS_RESUME
115 # warning "GnuTLS library version too old; resumption unsupported"
119 #if GNUTLS_VERSION_NUMBER >= 0x030200
120 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
121 # define EXIM_HAVE_ALPN
125 #if GNUTLS_VERSION_NUMBER >= 0x030702
126 # define HAVE_GNUTLS_EXPORTER
130 # include <gnutls/ocsp.h>
133 # include <gnutls/dane.h>
136 #include "tls-cipher-stdname.c"
143 # ifndef DISABLE_TLS_RESUME
144 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
146 # ifdef EXIM_HAVE_TLS1_3
147 builtin_macro_create(US"_HAVE_TLS1_3");
149 # ifdef EXIM_HAVE_OCSP
150 builtin_macro_create(US"_HAVE_TLS_OCSP");
152 # ifdef SUPPORT_SRV_OCSP_STACK
153 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
155 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
156 builtin_macro_create(US"_HAVE_TLS_CA_CACHE");
158 # ifdef EXIM_HAVE_ALPN
159 builtin_macro_create(US"_HAVE_TLS_ALPN");
168 gnutls_global_set_audit_log_function()
171 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
174 /* Local static variables for GnuTLS */
176 /* Values for verify_requirement */
178 enum peer_verify_requirement
179 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
181 /* This holds most state for server or client; with this, we can set up an
182 outbound TLS-enabled connection in an ACL callout, while not stomping all
183 over the TLS variables available for expansion.
185 Some of these correspond to variables in globals.c; those variables will
186 be set to point to content in one of these instances, as appropriate for
187 the stage of the process lifetime.
189 Not handled here: global tlsp->tls_channelbinding.
192 typedef struct exim_gnutls_state {
193 gnutls_session_t session;
195 exim_tlslib_state lib_state;
196 #define x509_cred libdata0
197 #define pri_cache libdata1
199 enum peer_verify_requirement verify_requirement;
203 BOOL peer_cert_verified:1;
204 BOOL peer_dane_verified:1;
205 BOOL trigger_sni_changes:1;
206 BOOL have_set_peerdn:1;
207 BOOL xfer_eof:1; /*XXX never gets set! */
213 const struct host_item *host; /* NULL if server */
214 gnutls_x509_crt_t peercert;
217 uschar *received_sni;
219 const uschar *tls_certificate;
220 const uschar *tls_privatekey;
221 const uschar *tls_sni; /* client send only, not received */
222 const uschar *tls_verify_certificates;
223 const uschar *tls_crl;
224 const uschar *tls_require_ciphers;
226 uschar *exp_tls_certificate;
227 uschar *exp_tls_privatekey;
228 uschar *exp_tls_verify_certificates;
230 uschar *exp_tls_require_ciphers;
231 const uschar *exp_tls_verify_cert_hostnames;
232 #ifndef DISABLE_EVENT
233 uschar *event_action;
236 char * const * dane_data;
237 const int * dane_data_len;
240 tls_support *tlsp; /* set in tls_init() */
245 } exim_gnutls_state_st;
247 static const exim_gnutls_state_st exim_gnutls_state_init = {
248 /* all elements not explicitly intialised here get 0/NULL/FALSE */
253 /* Not only do we have our own APIs which don't pass around state, assuming
254 it's held in globals, GnuTLS doesn't appear to let us register callback data
255 for callbacks, or as part of the session, so we have to keep a "this is the
256 context we're currently dealing with" pointer and rely upon being
257 single-threaded to keep from processing data on an inbound TLS connection while
258 talking to another TLS connection for an outbound check. This does mean that
259 there's no way for heart-beats to be responded to, for the duration of the
261 XXX But see gnutls_session_get_ptr()
264 static exim_gnutls_state_st state_server = {
265 /* all elements not explicitly intialised here get 0/NULL/FALSE */
270 /* dh_params are initialised once within the lifetime of a process using TLS;
271 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
272 don't want to repeat this. */
274 static gnutls_dh_params_t dh_server_params = NULL;
276 static int ssl_session_timeout = 7200; /* Two hours */
278 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
280 /* Guard library core initialisation */
282 static BOOL exim_gnutls_base_init_done = FALSE;
285 static BOOL gnutls_buggy_ocsp = FALSE;
286 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
289 #ifdef EXIM_HAVE_ALPN
290 static int server_seen_alpn = -1; /* count of names */
292 #ifdef EXIM_HAVE_TLS_RESUME
293 static gnutls_datum_t server_sessticket_key;
297 /* ------------------------------------------------------------------------ */
300 #define MAX_HOST_LEN 255
302 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
303 the library logging; a value less than 0 disables the calls to set up logging
304 callbacks. GNuTLS also looks for an environment variable - except not for
305 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
306 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
307 but the env var must be added to /etc/sudoers too. */
308 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
309 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
312 #ifndef EXIM_CLIENT_DH_MIN_BITS
313 # define EXIM_CLIENT_DH_MIN_BITS 1024
316 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
317 can ask for a bit-strength. Without that, we stick to the constant we had
319 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
320 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
323 #define Expand_check_tlsvar(Varname, errstr) \
324 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
326 #if GNUTLS_VERSION_NUMBER >= 0x020c00
327 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
328 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
329 # define HAVE_GNUTLS_RND
330 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
331 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
332 * isn't available sometimes, so this needs to become a conditional
333 * compilation; the sanest way to deal with this being a problem on
334 * older OSes is to block it in the Local/Makefile with this compiler
336 # ifndef AVOID_GNUTLS_PKCS11
337 # define HAVE_GNUTLS_PKCS11
338 # endif /* AVOID_GNUTLS_PKCS11 */
341 #if GNUTLS_VERSION_NUMBER >= 0x030404
342 # define HAVE_GNUTLS_PRF_RFC5705
347 /* ------------------------------------------------------------------------ */
348 /* Callback declarations */
350 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
351 static void exim_gnutls_logger_cb(int level, const char *message);
354 static int exim_sni_handling_cb(gnutls_session_t session);
356 #ifdef EXIM_HAVE_TLS_RESUME
358 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
359 unsigned incoming, const gnutls_datum_t * msg);
363 /*************************************************
365 *************************************************/
367 /* Called from lots of places when errors occur before actually starting to do
368 the TLS handshake, that is, while the session is still in clear. Always returns
369 DEFER for a server and FAIL for a client so that most calls can use "return
370 tls_error(...)" to do this processing and then give an appropriate return. A
371 single function is used for both server and client, because it is called from
372 some shared functions.
375 prefix text to include in the logged error
376 msg additional error string (may be NULL)
377 usually obtained from gnutls_strerror()
378 host NULL if setting up a server;
379 the connected host if setting up a client
380 errstr pointer to returned error string
382 Returns: OK/DEFER/FAIL
386 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
390 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
391 return host ? FAIL : DEFER;
396 tls_error_gnu(exim_gnutls_state_st * state, const uschar *prefix, int err,
399 return tls_error(prefix,
400 state && err == GNUTLS_E_FATAL_ALERT_RECEIVED
401 ? string_sprintf("rxd alert: %s",
402 US gnutls_alert_get_name(gnutls_alert_get(state->session)))
403 : US gnutls_strerror(err),
404 state ? state->host : NULL,
409 tls_error_sys(const uschar *prefix, int err, const host_item *host,
412 return tls_error(prefix, US strerror(err), host, errstr);
416 /* ------------------------------------------------------------------------ */
422 tls_is_buggy_ocsp(void)
425 uschar maj, mid, mic;
427 s = CUS gnutls_check_version(NULL);
431 while (*s && *s != '.') s++;
439 while (*s && *s != '.') s++;
441 return mic <= (mid == 3 ? 16 : 3);
451 tls_g_init(uschar ** errstr)
454 DEBUG(D_tls) debug_printf("GnuTLS global init required\n");
456 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
457 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
458 which loads modules from a config file, which sounds good and may be wanted
459 by some sysadmin, but also means in common configurations that GNOME keyring
460 environment variables are used and so breaks for users calling mailq.
461 To prevent this, we init PKCS11 first, which is the documented approach. */
463 if (!gnutls_allow_auto_pkcs11)
464 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
465 return tls_error_gnu(NULL, US"gnutls_pkcs11_init", rc, errstr);
468 #ifndef GNUTLS_AUTO_GLOBAL_INIT
469 if ((rc = gnutls_global_init()))
470 return tls_error_gnu(NULL, US"gnutls_global_init", rc, errstr);
473 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
476 gnutls_global_set_log_function(exim_gnutls_logger_cb);
477 /* arbitrarily chosen level; bump up to 9 for more */
478 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
483 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
484 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
487 exim_gnutls_base_init_done = TRUE;
493 /* Daemon-call before each connection. Nothing to do for GnuTLS. */
496 tls_per_lib_daemon_tick(void)
500 /* Daemon one-time initialisation */
503 tls_per_lib_daemon_init(void)
505 uschar * dummy_errstr;
506 static BOOL once = FALSE;
508 if (!exim_gnutls_base_init_done)
509 tls_g_init(&dummy_errstr);
515 #ifdef EXIM_HAVE_TLS_RESUME
516 /* We are dependent on the GnuTLS implementation of the Session Ticket
517 encryption; both the strength and the key rotation period. We hope that
518 the strength at least matches that of the ciphersuite (but GnuTLS does not
521 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
522 if (f.running_in_test_harness) ssl_session_timeout = 6;
525 tls_daemon_creds_reload();
529 /* ------------------------------------------------------------------------ */
531 /*************************************************
532 * Deal with logging errors during I/O *
533 *************************************************/
535 /* We have to get the identity of the peer from saved data.
538 state the current GnuTLS exim state container
539 rc the GnuTLS error code, or 0 if it's a local error
540 when text identifying read or write
541 text local error text when rc is 0
547 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
552 msg = rc == GNUTLS_E_FATAL_ALERT_RECEIVED
553 ? string_sprintf("A TLS fatal alert has been received: %s",
554 US gnutls_alert_get_name(gnutls_alert_get(state->session)))
555 #ifdef GNUTLS_E_PREMATURE_TERMINATION
556 : rc == GNUTLS_E_PREMATURE_TERMINATION && errno
557 ? string_sprintf("%s: syscall: %s", US gnutls_strerror(rc), strerror(errno))
559 : US gnutls_strerror(rc);
561 (void) tls_error(when, msg, state->host, &errstr);
564 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
565 state->host->name, state->host->address, errstr);
568 uschar * conn_info = smtp_get_connection_info();
569 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
570 /* I'd like to get separated H= here, but too hard for now */
571 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
578 /*************************************************
579 * Set various Exim expansion vars *
580 *************************************************/
582 #define exim_gnutls_cert_err(Label) \
585 if (rc != GNUTLS_E_SUCCESS) \
587 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
588 (Label), gnutls_strerror(rc)); \
594 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
598 rc = gnutls_x509_crt_init(crtp);
599 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
601 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
602 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
607 #undef exim_gnutls_cert_err
610 /* We set various Exim global variables from the state, once a session has
611 been established. With TLS callouts, may need to change this to stack
612 variables, or just re-call it with the server state after client callout
615 Make sure anything set here is unset in tls_getc().
619 tls_bits strength indicator
620 tls_certificate_verified bool indicator
621 tls_channelbinding for some SASL mechanisms
624 tls_peercert pointer to library internal
626 tls_sni a (UTF-8) string
627 tls_ourcert pointer to library internal
630 state the relevant exim_gnutls_state_st *
634 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
636 tls_support * tlsp = state->tlsp;
638 tlsp->active.sock = state->fd_out;
639 tlsp->active.tls_ctx = state;
641 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
643 tlsp->certificate_verified = state->peer_cert_verified;
645 tlsp->dane_verified = state->peer_dane_verified;
648 /* note that tls_channelbinding is not saved to the spool file, since it's
649 only available for use for authenticators while this TLS session is running. */
651 tlsp->channelbinding = NULL;
652 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
654 gnutls_datum_t channel = {.data = NULL, .size = 0};
657 # ifdef HAVE_GNUTLS_EXPORTER
658 if (gnutls_protocol_get_version(state->session) >= GNUTLS_TLS1_3)
660 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_EXPORTER, &channel);
661 tlsp->channelbind_exporter = TRUE;
664 # elif defined(HAVE_GNUTLS_PRF_RFC5705)
665 /* Older libraries may not have GNUTLS_TLS1_3 defined! */
666 if (gnutls_protocol_get_version(state->session) > GNUTLS_TLS1_2)
668 uschar * buf = store_get(32, state->host ? GET_TAINTED : GET_UNTAINTED);
669 rc = gnutls_prf_rfc5705(state->session,
670 (size_t)24, "EXPORTER-Channel-Binding", (size_t)0, "",
677 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
680 { DEBUG(D_tls) debug_printf("extracting channel binding: %s\n", gnutls_strerror(rc)); }
683 int old_pool = store_pool;
684 /* Declare the taintedness of the binding info. On server, untainted; on
685 client, tainted if we used the Finish msg from the server. */
687 store_pool = POOL_PERM;
688 tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size,
689 !tlsp->channelbind_exporter && state->host ? GET_TAINTED : GET_UNTAINTED);
690 store_pool = old_pool;
691 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n");
696 /* peercert is set in peer_status() */
697 tlsp->peerdn = state->peerdn;
699 /* do not corrupt sni sent by client; record sni rxd by server */
701 tlsp->sni = state->received_sni;
703 /* record our certificate */
705 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
706 gnutls_x509_crt_t crt;
708 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
715 /*************************************************
716 * Setup up DH parameters *
717 *************************************************/
719 /* Generating the D-H parameters may take a long time. They only need to
720 be re-generated every so often, depending on security policy. What we do is to
721 keep these parameters in a file in the spool directory. If the file does not
722 exist, we generate them. This means that it is easy to cause a regeneration.
724 The new file is written as a temporary file and renamed, so that an incomplete
725 file is never present. If two processes both compute some new parameters, you
726 waste a bit of effort, but it doesn't seem worth messing around with locking to
729 Returns: OK/DEFER/FAIL
733 init_server_dh(uschar ** errstr)
736 unsigned int dh_bits;
738 uschar filename_buf[PATH_MAX];
739 uschar *filename = NULL;
741 uschar *exp_tls_dhparam;
742 BOOL use_file_in_spool = FALSE;
743 host_item *host = NULL; /* dummy for macros */
745 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params\n");
747 if ((rc = gnutls_dh_params_init(&dh_server_params)))
748 return tls_error_gnu(NULL, US"gnutls_dh_params_init", rc, errstr);
753 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
756 if (!exp_tls_dhparam)
758 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
759 m.data = US std_dh_prime_default();
760 m.size = Ustrlen(m.data);
762 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
763 use_file_in_spool = TRUE;
764 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
766 DEBUG(D_tls) debug_printf("Requested no DH parameters\n");
769 else if (exp_tls_dhparam[0] != '/')
771 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
772 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
773 m.size = Ustrlen(m.data);
776 filename = exp_tls_dhparam;
780 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
781 return tls_error_gnu(NULL, US"gnutls_dh_params_import_pkcs3", rc, errstr);
782 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
786 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
787 /* If you change this constant, also change dh_param_fn_ext so that we can use a
788 different filename and ensure we have sufficient bits. */
790 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
791 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
793 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits\n",
796 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
798 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits\n",
802 /* Some clients have hard-coded limits. */
803 if (dh_bits > tls_dh_max_bits)
806 debug_printf("tls_dh_max_bits clamping override, using %d bits instead\n",
808 dh_bits = tls_dh_max_bits;
811 if (use_file_in_spool)
813 if (!string_format(filename_buf, sizeof(filename_buf),
814 "%s/gnutls-params-%d", spool_directory, dh_bits))
815 return tls_error(US"overlong filename", NULL, NULL, errstr);
816 filename = filename_buf;
819 /* Open the cache file for reading and if successful, read it and set up the
822 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
828 if (fstat(fd, &statbuf) < 0) /* EIO */
832 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
834 if (!S_ISREG(statbuf.st_mode))
837 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
839 if (!(fp = fdopen(fd, "rb")))
843 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
844 saved_errno, NULL, errstr);
847 m.size = statbuf.st_size;
848 if (!(m.data = store_malloc(m.size)))
851 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
853 if (!(sz = fread(m.data, m.size, 1, fp)))
858 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
862 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
865 return tls_error_gnu(NULL, US"gnutls_dh_params_import_pkcs3", rc, errstr);
866 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
869 /* If the file does not exist, fall through to compute new data and cache it.
870 If there was any other opening error, it is serious. */
872 else if (errno == ENOENT)
876 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
879 return tls_error(string_open_failed("\"%s\" for reading", filename),
882 /* If ret < 0, either the cache file does not exist, or the data it contains
883 is not useful. One particular case of this is when upgrading from an older
884 release of Exim in which the data was stored in a different format. We don't
885 try to be clever and support both formats; we just regenerate new data in this
891 unsigned int dh_bits_gen = dh_bits;
893 if ((PATH_MAX - Ustrlen(filename)) < 10)
894 return tls_error(US"Filename too long to generate replacement",
895 filename, NULL, errstr);
897 temp_fn = string_copy(US"exim-dh.XXXXXXX");
898 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
899 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
900 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
902 /* GnuTLS overshoots!
903 * If we ask for 2236, we might get 2237 or more.
904 * But there's no way to ask GnuTLS how many bits there really are.
905 * We can ask how many bits were used in a TLS session, but that's it!
906 * The prime itself is hidden behind too much abstraction.
907 * So we ask for less, and proceed on a wing and a prayer.
908 * First attempt, subtracted 3 for 2233 and got 2240.
910 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
912 dh_bits_gen = dh_bits - 10;
914 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
919 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
921 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
922 return tls_error_gnu(NULL, US"gnutls_dh_params_generate2", rc, errstr);
924 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
925 and I confirmed that a NULL call to get the size first is how the GnuTLS
926 sample apps handle this. */
930 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
931 GNUTLS_X509_FMT_PEM, m.data, &sz))
932 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
933 return tls_error_gnu(NULL, US"gnutls_dh_params_export_pkcs3(NULL) sizing",
936 if (!(m.data = store_malloc(m.size)))
937 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
939 /* this will return a size 1 less than the allocation size above */
940 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
944 return tls_error_gnu(NULL, US"gnutls_dh_params_export_pkcs3() real", rc, errstr);
946 m.size = sz; /* shrink by 1, probably */
948 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
951 return tls_error_sys(US"TLS cache write D-H params failed",
952 errno, NULL, errstr);
955 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
956 return tls_error_sys(US"TLS cache write D-H params final newline failed",
957 errno, NULL, errstr);
959 if ((rc = close(fd)))
960 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
962 if (Urename(temp_fn, filename) < 0)
963 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
964 temp_fn, filename), errno, NULL, errstr);
966 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
969 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
976 /* Create and install a selfsigned certificate, for use in server mode. */
979 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
981 gnutls_x509_crt_t cert = NULL;
983 gnutls_x509_privkey_t pkey = NULL;
984 const uschar * where;
987 #ifndef SUPPORT_SELFSIGN
988 where = US"library too old";
989 rc = GNUTLS_E_NO_CERTIFICATE_FOUND;
993 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
994 where = US"initialising pkey";
995 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
997 where = US"initialising cert";
998 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
1000 where = US"generating pkey"; /* Hangs on 2.12.23 */
1001 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
1002 #ifdef SUPPORT_PARAM_TO_PK_BITS
1003 # ifndef GNUTLS_SEC_PARAM_MEDIUM
1004 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
1006 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
1013 where = US"configuring cert";
1015 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
1016 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
1017 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
1018 || (rc = gnutls_x509_crt_set_expiration_time(cert, (long)2 * 60 * 60)) /* 2 hour */
1019 || (rc = gnutls_x509_crt_set_key(cert, pkey))
1021 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
1022 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
1023 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
1024 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
1025 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
1026 GNUTLS_OID_X520_COMMON_NAME, 0,
1027 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
1031 where = US"signing cert";
1032 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
1034 where = US"installing selfsign cert";
1036 if ((rc = gnutls_certificate_set_x509_key(state->lib_state.x509_cred,
1043 if (cert) gnutls_x509_crt_deinit(cert);
1044 if (pkey) gnutls_x509_privkey_deinit(pkey);
1048 rc = tls_error_gnu(state, where, rc, errstr);
1055 /* Add certificate and key, from files.
1058 Zero or negative: good. Negate value for certificate index if < 0.
1059 Greater than zero: FAIL or DEFER code.
1063 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
1064 const uschar * certfile, const uschar * keyfile, uschar ** errstr)
1066 int rc = gnutls_certificate_set_x509_key_file(state->lib_state.x509_cred,
1067 CCS certfile, CCS keyfile, GNUTLS_X509_FMT_PEM);
1069 return tls_error_gnu(state,
1070 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
1076 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1077 /* Load an OCSP proof from file for sending by the server. Called
1078 on getting a status-request handshake message, for earlier versions
1082 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1083 gnutls_datum_t * ocsp_response)
1086 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
1088 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1090 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1092 tls_in.ocsp = OCSP_NOT_RESP;
1093 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1096 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1102 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1103 /* Make a note that we saw a status-request */
1105 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
1106 const uschar * data, unsigned size)
1108 /* The values for tls_id are documented here:
1109 https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1112 case 5: /* Status Request */
1113 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
1114 tls_in.ocsp = OCSP_NOT_RESP;
1116 #ifdef EXIM_HAVE_ALPN
1117 case 16: /* Application Layer Protocol Notification */
1118 /* The format of "data" here doesn't seem to be documented, but appears
1119 to be a 2-byte field with a (redundant, given the "size" arg) total length
1120 then a sequence of one-byte size then string (not nul-term) names. The
1121 latter is as described in OpenSSL documentation. */
1123 DEBUG(D_tls) debug_printf("Seen ALPN extension from client (s=%u):", size);
1124 for (const uschar * s = data+2; s-data < size-1; s += *s + 1)
1127 DEBUG(D_tls) debug_printf(" '%.*s'", (int)*s, s+1);
1129 DEBUG(D_tls) debug_printf("\n");
1130 if (server_seen_alpn > 1)
1132 DEBUG(D_tls) debug_printf("TLS: too many ALPNs presented in handshake\n");
1133 return GNUTLS_E_NO_APPLICATION_PROTOCOL;
1141 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
1143 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
1144 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1146 /* Call fn for each extension seen. 3.6.3 onwards */
1147 int rc = gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
1148 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
1149 return rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE ? 0 : rc;
1153 # ifdef notdef_crashes
1154 /* Make a note that we saw a status-response */
1156 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
1157 const unsigned char *data, unsigned size)
1159 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
1160 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1161 if (FALSE && tls_id == 5) /* status_request */
1163 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
1164 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1165 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1171 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
1173 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
1174 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1176 /* Call fn for each extension seen. 3.6.3 onwards */
1177 # ifdef notdef_crashes
1179 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
1182 #endif /*SUPPORT_GNUTLS_EXT_RAW_PARSE*/
1184 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
1185 "Handshake Protocol: Certificate" record.
1186 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
1188 This is different to tls1.2 - where it is a separate record (wireshark term) / handshake message (gnutls term).
1191 #if defined(EXIM_HAVE_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1192 /* Callback for certificate-status, on server. We sent stapled OCSP. */
1194 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
1195 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1197 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
1198 # ifdef SUPPORT_SRV_OCSP_STACK
1199 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1200 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1202 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1207 /* Callback for handshake messages, on server */
1209 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1210 unsigned incoming, const gnutls_datum_t * msg)
1212 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
1215 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1216 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1217 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1218 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1219 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1221 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1222 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1223 # ifdef EXIM_HAVE_TLS_RESUME
1224 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1225 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1234 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1236 tls_server_testharness_ocsp_fiddle(void)
1238 extern char ** environ;
1239 if (environ) for (uschar ** p = USS environ; *p; p++)
1240 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1242 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1243 exim_testharness_disable_ocsp_validity_check = TRUE;
1248 /**************************************************
1249 * One-time init credentials for server and client *
1250 **************************************************/
1253 creds_basic_init(gnutls_certificate_credentials_t x509_cred, BOOL server)
1255 #ifdef SUPPORT_SRV_OCSP_STACK
1256 gnutls_certificate_set_flags(x509_cred, GNUTLS_CERTIFICATE_API_V2);
1258 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1259 if (server && tls_ocsp_file)
1261 if (f.running_in_test_harness)
1262 tls_server_testharness_ocsp_fiddle();
1264 if (exim_testharness_disable_ocsp_validity_check)
1265 gnutls_certificate_set_flags(x509_cred,
1266 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1271 debug_printf("TLS: basic cred init, %s\n", server ? "server" : "client");
1275 creds_load_server_certs(exim_gnutls_state_st * state, const uschar * cert,
1276 const uschar * pkey, const uschar * ocsp, uschar ** errstr)
1278 const uschar * clist = cert;
1279 const uschar * klist = pkey;
1280 const uschar * olist;
1281 int csep = 0, ksep = 0, osep = 0, cnt = 0, rc;
1282 uschar * cfile, * kfile, * ofile;
1283 #ifndef DISABLE_OCSP
1284 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1285 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1288 if (!expand_check(ocsp, US"tls_ocsp_file", &ofile, errstr))
1293 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1295 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1296 return tls_error(US"cert/key setup: out of keys", NULL, NULL, errstr);
1297 else if ((rc = tls_add_certfile(state, NULL, cfile, kfile, errstr)) != OK)
1301 int gnutls_cert_index = -rc;
1302 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1303 gnutls_cert_index, cfile);
1305 #ifndef DISABLE_OCSP
1308 /* Set the OCSP stapling server info */
1309 if (gnutls_buggy_ocsp)
1312 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1314 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1316 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1317 gnutls_cert_index, ofile);
1318 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1319 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1321 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1324 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1326 ocsp_fmt = GNUTLS_X509_FMT_DER;
1330 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1331 state->lib_state.x509_cred, CCS ofile, gnutls_cert_index,
1333 return tls_error_gnu(state,
1334 US"gnutls_certificate_set_ocsp_status_request_file2",
1337 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1339 /* Arrange callbacks for OCSP request observability */
1342 gnutls_handshake_set_hook_function(state->session,
1343 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1345 state->lib_state.ocsp_hook = TRUE;
1349 # if defined(SUPPORT_SRV_OCSP_STACK)
1350 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1351 state->lib_state.x509_cred, gnutls_cert_index,
1352 server_ocsp_stapling_cb, ofile)))
1353 return tls_error_gnu(state,
1354 US"gnutls_certificate_set_ocsp_status_request_function2",
1362 debug_printf("oops; multiple OCSP files not supported\n");
1365 gnutls_certificate_set_ocsp_status_request_function(
1366 state->lib_state.x509_cred, server_ocsp_stapling_cb, ofile);
1368 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1371 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1373 #endif /* DISABLE_OCSP */
1379 creds_load_client_certs(exim_gnutls_state_st * state, const host_item * host,
1380 const uschar * cert, const uschar * pkey, uschar ** errstr)
1382 int rc = tls_add_certfile(state, host, cert, pkey, errstr);
1383 if (rc > 0) return rc;
1384 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1389 creds_load_cabundle(exim_gnutls_state_st * state, const uschar * bundle,
1390 const host_item * host, uschar ** errstr)
1393 struct stat statbuf;
1395 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1396 if (Ustrcmp(bundle, "system") == 0 || Ustrncmp(bundle, "system,", 7) == 0)
1397 cert_count = gnutls_certificate_set_x509_system_trust(state->lib_state.x509_cred);
1401 if (Ustat(bundle, &statbuf) < 0)
1403 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1404 "(tls_verify_certificates): %s", bundle, strerror(errno));
1408 #ifndef SUPPORT_CA_DIR
1409 /* The test suite passes in /dev/null; we could check for that path explicitly,
1410 but who knows if someone has some weird FIFO which always dumps some certs, or
1411 other weirdness. The thing we really want to check is that it's not a
1412 directory, since while OpenSSL supports that, GnuTLS does not.
1413 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1414 if (S_ISDIR(statbuf.st_mode))
1416 log_write(0, LOG_MAIN|LOG_PANIC,
1417 "tls_verify_certificates \"%s\" is a directory", bundle);
1422 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1423 bundle, statbuf.st_size);
1425 if (statbuf.st_size == 0)
1428 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1434 #ifdef SUPPORT_CA_DIR
1435 (statbuf.st_mode & S_IFMT) == S_IFDIR
1437 gnutls_certificate_set_x509_trust_dir(state->lib_state.x509_cred,
1438 CS bundle, GNUTLS_X509_FMT_PEM)
1441 gnutls_certificate_set_x509_trust_file(state->lib_state.x509_cred,
1442 CS bundle, GNUTLS_X509_FMT_PEM);
1444 #ifdef SUPPORT_CA_DIR
1445 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1446 when using the directory-of-certs config model. */
1448 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1450 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1452 state->lib_state.ca_rdn_emulate = TRUE;
1457 return tls_error_gnu(state, US"setting certificate trust", cert_count, errstr);
1459 debug_printf("Added %d certificate authorities\n", cert_count);
1466 creds_load_crl(exim_gnutls_state_st * state, const uschar * crl, uschar ** errstr)
1469 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", crl);
1470 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->lib_state.x509_cred,
1471 CS crl, GNUTLS_X509_FMT_PEM)) < 0)
1472 return tls_error_gnu(state, US"gnutls_certificate_set_x509_crl_file",
1473 cert_count, errstr);
1475 DEBUG(D_tls) debug_printf("Processed %d CRLs\n", cert_count);
1481 creds_load_pristring(exim_gnutls_state_st * state, const uschar * p,
1482 const char ** errpos)
1486 p = exim_default_gnutls_priority;
1488 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1490 return gnutls_priority_init( (gnutls_priority_t *) &state->lib_state.pri_cache,
1495 tls_server_creds_init(void)
1497 uschar * dummy_errstr;
1498 unsigned lifetime = 0;
1500 state_server.lib_state = null_tls_preload;
1501 if (gnutls_certificate_allocate_credentials(
1502 (gnutls_certificate_credentials_t *) &state_server.lib_state.x509_cred))
1504 state_server.lib_state.x509_cred = NULL;
1507 creds_basic_init(state_server.lib_state.x509_cred, TRUE);
1509 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1510 /* If tls_certificate has any $ indicating expansions, it is not good.
1511 If tls_privatekey is set but has $, not good. Likewise for tls_ocsp_file.
1512 If all good (and tls_certificate set), load the cert(s). */
1514 if ( opt_set_and_noexpand(tls_certificate)
1515 # ifndef DISABLE_OCSP
1516 && opt_unset_or_noexpand(tls_ocsp_file)
1518 && opt_unset_or_noexpand(tls_privatekey))
1520 /* Set watches on the filenames. The implementation does de-duplication
1521 so we can just blindly do them all.
1524 if ( tls_set_watch(tls_certificate, TRUE)
1525 # ifndef DISABLE_OCSP
1526 && tls_set_watch(tls_ocsp_file, TRUE)
1528 && tls_set_watch(tls_privatekey, TRUE))
1530 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1531 if (creds_load_server_certs(&state_server, tls_certificate,
1532 tls_privatekey && *tls_privatekey ? tls_privatekey : tls_certificate,
1533 # ifdef DISABLE_OCSP
1538 &dummy_errstr) == 0)
1539 state_server.lib_state.conn_certs = TRUE;
1542 else if ( !tls_certificate && !tls_privatekey
1543 # ifndef DISABLE_OCSP
1547 { /* Generate & preload a selfsigned cert. No files to watch. */
1548 if ((tls_install_selfsign(&state_server, &dummy_errstr)) == OK)
1550 state_server.lib_state.conn_certs = TRUE;
1551 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1555 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1557 /* If tls_verify_certificates is non-empty and has no $, load CAs.
1558 If none was configured and we can't handle "system", treat as empty. */
1560 if ( opt_set_and_noexpand(tls_verify_certificates)
1561 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1562 && Ustrcmp(tls_verify_certificates, "system") != 0
1566 if (tls_set_watch(tls_verify_certificates, FALSE))
1568 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1569 if (creds_load_cabundle(&state_server, tls_verify_certificates,
1570 NULL, &dummy_errstr) != OK)
1572 state_server.lib_state.cabundle = TRUE;
1574 /* If CAs loaded and tls_crl is non-empty and has no $, load it */
1576 if (opt_set_and_noexpand(tls_crl))
1578 if (tls_set_watch(tls_crl, FALSE))
1580 DEBUG(D_tls) debug_printf("TLS: preloading CRL for server\n");
1581 if (creds_load_crl(&state_server, tls_crl, &dummy_errstr) != OK)
1583 state_server.lib_state.crl = TRUE;
1587 DEBUG(D_tls) debug_printf("TLS: not preloading CRL for server\n");
1591 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1592 #endif /* EXIM_HAVE_INOTIFY */
1594 /* If tls_require_ciphers is non-empty and has no $, load the
1595 ciphers priority cache. If unset, load with the default.
1596 (server-only as the client one depends on non/DANE) */
1598 if (!tls_require_ciphers || opt_set_and_noexpand(tls_require_ciphers))
1600 const char * dummy_errpos;
1601 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server: %s\n",
1602 tls_require_ciphers);
1603 if ( creds_load_pristring(&state_server, tls_require_ciphers, &dummy_errpos)
1605 state_server.lib_state.pri_string = TRUE;
1608 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1613 /* Preload whatever creds are static, onto a transport. The client can then
1614 just copy the pointer as it starts up. */
1616 /*XXX this is not called for a cmdline send. But one needing to use >1 conn would benefit,
1617 and there seems little downside. */
1620 tls_client_creds_init(transport_instance * t, BOOL watch)
1622 smtp_transport_options_block * ob = t->options_block;
1623 exim_gnutls_state_st tpt_dummy_state;
1624 host_item * dummy_host = (host_item *)1;
1625 uschar * dummy_errstr;
1627 if ( !exim_gnutls_base_init_done
1628 && tls_g_init(&dummy_errstr) != OK)
1631 ob->tls_preload = null_tls_preload;
1632 if (gnutls_certificate_allocate_credentials(
1633 (struct gnutls_certificate_credentials_st **)&ob->tls_preload.x509_cred))
1635 ob->tls_preload.x509_cred = NULL;
1638 creds_basic_init(ob->tls_preload.x509_cred, FALSE);
1640 tpt_dummy_state.session = NULL;
1641 tpt_dummy_state.lib_state = ob->tls_preload;
1643 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1644 if ( opt_set_and_noexpand(ob->tls_certificate)
1645 && opt_unset_or_noexpand(ob->tls_privatekey))
1648 || ( tls_set_watch(ob->tls_certificate, FALSE)
1649 && tls_set_watch(ob->tls_privatekey, FALSE)
1652 const uschar * pkey = ob->tls_privatekey;
1655 debug_printf("TLS: preloading client certs for transport '%s'\n", t->name);
1657 /* The state->lib_state.x509_cred is used for the certs load, and is the sole
1658 structure element used. So we can set up a dummy. The hoat arg only
1659 selects a retcode in case of fail, so any value */
1661 if (creds_load_client_certs(&tpt_dummy_state, dummy_host,
1662 ob->tls_certificate, pkey ? pkey : ob->tls_certificate,
1663 &dummy_errstr) == OK)
1664 ob->tls_preload.conn_certs = TRUE;
1669 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1671 /* If tls_verify_certificates is non-empty and has no $, load CAs.
1672 If none was configured and we can't handle "system", treat as empty. */
1674 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1675 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1676 && Ustrcmp(ob->tls_verify_certificates, "system") != 0
1680 if (!watch || tls_set_watch(ob->tls_verify_certificates, FALSE))
1683 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1684 if (creds_load_cabundle(&tpt_dummy_state, ob->tls_verify_certificates,
1685 dummy_host, &dummy_errstr) != OK)
1687 ob->tls_preload.cabundle = TRUE;
1689 if (opt_set_and_noexpand(ob->tls_crl))
1691 if (!watch || tls_set_watch(ob->tls_crl, FALSE))
1693 DEBUG(D_tls) debug_printf("TLS: preloading CRL for transport '%s'\n", t->name);
1694 if (creds_load_crl(&tpt_dummy_state, ob->tls_crl, &dummy_errstr) != OK)
1696 ob->tls_preload.crl = TRUE;
1700 DEBUG(D_tls) debug_printf("TLS: not preloading CRL, for transport '%s'\n", t->name);
1705 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1707 /* We do not preload tls_require_ciphers to to the transport as it implicitly
1708 depends on DANE or plain usage. */
1714 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1715 /* Invalidate the creds cached, by dropping the current ones.
1716 Call when we notice one of the source files has changed. */
1719 tls_server_creds_invalidate(void)
1721 if (state_server.lib_state.pri_cache)
1722 gnutls_priority_deinit(state_server.lib_state.pri_cache);
1723 state_server.lib_state.pri_cache = NULL;
1725 if (state_server.lib_state.x509_cred)
1726 gnutls_certificate_free_credentials(state_server.lib_state.x509_cred);
1727 state_server.lib_state = null_tls_preload;
1732 tls_client_creds_invalidate(transport_instance * t)
1734 smtp_transport_options_block * ob = t->options_block;
1735 if (ob->tls_preload.x509_cred)
1736 gnutls_certificate_free_credentials(ob->tls_preload.x509_cred);
1737 ob->tls_preload = null_tls_preload;
1742 /*************************************************
1743 * Variables re-expanded post-SNI *
1744 *************************************************/
1746 /* Called from both server and client code, via tls_init(), and also from
1747 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1749 We can tell the two apart by state->received_sni being non-NULL in callback.
1751 The callback should not call us unless state->trigger_sni_changes is true,
1752 which we are responsible for setting on the first pass through.
1755 state exim_gnutls_state_st *
1756 errstr error string pointer
1758 Returns: OK/DEFER/FAIL
1762 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1765 const host_item *host = state->host; /* macro should be reconsidered? */
1766 const uschar *saved_tls_certificate = NULL;
1767 const uschar *saved_tls_privatekey = NULL;
1768 const uschar *saved_tls_verify_certificates = NULL;
1769 const uschar *saved_tls_crl = NULL;
1772 /* We check for tls_sni *before* expansion. */
1773 if (!host) /* server */
1774 if (!state->received_sni)
1776 if ( state->tls_certificate
1777 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1778 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1779 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1782 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI\n");
1783 state->trigger_sni_changes = TRUE;
1786 else /* SNI callback case */
1788 /* useful for debugging */
1789 saved_tls_certificate = state->exp_tls_certificate;
1790 saved_tls_privatekey = state->exp_tls_privatekey;
1791 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1792 saved_tls_crl = state->exp_tls_crl;
1795 if (!state->lib_state.x509_cred)
1797 if ((rc = gnutls_certificate_allocate_credentials(
1798 (gnutls_certificate_credentials_t *) &state->lib_state.x509_cred)))
1799 return tls_error_gnu(state, US"gnutls_certificate_allocate_credentials",
1801 creds_basic_init(state->lib_state.x509_cred, !host);
1805 /* remember: Expand_check_tlsvar() is expand_check() but fiddling with
1806 state members, assuming consistent naming; and expand_check() returns
1807 false if expansion failed, unless expansion was forced to fail. */
1809 /* check if we at least have a certificate, before doing expensive
1812 if (!state->lib_state.conn_certs)
1814 if ( !Expand_check_tlsvar(tls_certificate, errstr)
1815 || f.expand_string_forcedfail)
1817 if (f.expand_string_forcedfail)
1818 *errstr = US"expansion of tls_certificate failed";
1822 /* certificate is mandatory in server, optional in client */
1824 if ( !state->exp_tls_certificate
1825 || !*state->exp_tls_certificate
1828 return tls_install_selfsign(state, errstr);
1830 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1832 if ( state->tls_privatekey && !Expand_check_tlsvar(tls_privatekey, errstr)
1833 || f.expand_string_forcedfail
1836 if (f.expand_string_forcedfail)
1837 *errstr = US"expansion of tls_privatekey failed";
1841 /* tls_privatekey is optional, defaulting to same file as certificate */
1843 if (!state->tls_privatekey || !*state->tls_privatekey)
1845 state->tls_privatekey = state->tls_certificate;
1846 state->exp_tls_privatekey = state->exp_tls_certificate;
1849 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1852 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1853 state->exp_tls_certificate, state->exp_tls_privatekey);
1855 if (state->received_sni)
1856 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1857 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1860 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1861 load = FALSE; /* avoid re-loading the same certs */
1863 else /* unload the pre-SNI certs before loading new ones */
1865 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair\n");
1866 gnutls_certificate_free_keys(state->lib_state.x509_cred);
1871 ? creds_load_client_certs(state, host, state->exp_tls_certificate,
1872 state->exp_tls_privatekey, errstr)
1873 : creds_load_server_certs(state, state->exp_tls_certificate,
1874 state->exp_tls_privatekey,
1883 DEBUG(D_tls) debug_printf("load-cert: '%s'\n", *errstr);
1891 debug_printf("%s certs were preloaded\n", host ? "client" : "server");
1893 if (!state->tls_privatekey) state->tls_privatekey = state->tls_certificate;
1894 state->exp_tls_certificate = US state->tls_certificate;
1895 state->exp_tls_privatekey = US state->tls_privatekey;
1897 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1898 if (state->lib_state.ocsp_hook)
1899 gnutls_handshake_set_hook_function(state->session,
1900 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1905 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1906 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1907 error message is provided. However, if we just refrain from setting anything up
1908 in that case, certificate verification fails, which seems to be the correct
1910 If none was configured and we can't handle "system", treat as empty. */
1912 if (!state->lib_state.cabundle)
1914 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1916 if (!Expand_check_tlsvar(tls_verify_certificates, errstr))
1918 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1919 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1920 state->exp_tls_verify_certificates = NULL;
1922 if (state->tls_crl && *state->tls_crl)
1923 if (!Expand_check_tlsvar(tls_crl, errstr))
1926 if (!(state->exp_tls_verify_certificates &&
1927 *state->exp_tls_verify_certificates))
1930 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1931 /* With no tls_verify_certificates, we ignore tls_crl too */
1938 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1941 rc = creds_load_cabundle(state, state->exp_tls_verify_certificates, host, errstr);
1942 if (rc != OK) return rc;
1947 debug_printf("%s CA bundle was preloaded\n", host ? "client" : "server");
1948 state->exp_tls_verify_certificates = US state->tls_verify_certificates;
1950 #ifdef SUPPORT_CA_DIR
1951 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1952 when using the directory-of-certs config model. */
1953 if (state->lib_state.ca_rdn_emulate)
1954 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1959 if (!state->lib_state.crl)
1961 if ( state->tls_crl && *state->tls_crl
1962 && state->exp_tls_crl && *state->exp_tls_crl)
1963 return creds_load_crl(state, state->exp_tls_crl, errstr);
1968 debug_printf("%s CRL was preloaded\n", host ? "client" : "server");
1969 state->exp_tls_crl = US state->tls_crl;
1978 /*************************************************
1979 * Set X.509 state variables *
1980 *************************************************/
1982 /* In GnuTLS, the registered cert/key are not replaced by a later
1983 set of a cert/key, so for SNI support we need a whole new x509_cred
1984 structure. Which means various other non-re-expanded pieces of state
1985 need to be re-set in the new struct, so the setting logic is pulled
1989 state exim_gnutls_state_st *
1990 errstr error string pointer
1992 Returns: OK/DEFER/FAIL
1996 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1999 const host_item *host = state->host; /* macro should be reconsidered? */
2001 /* Create D-H parameters, or read them from the cache file. This function does
2002 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
2003 client-side params. */
2007 if (!dh_server_params)
2008 if ((rc = init_server_dh(errstr)) != OK) return rc;
2010 /* Unnecessary & discouraged with 3.6.0 or later, according to docs. But without it,
2011 no DHE- ciphers are advertised. */
2012 gnutls_certificate_set_dh_params(state->lib_state.x509_cred, dh_server_params);
2015 /* Link the credentials to the session. */
2017 if ((rc = gnutls_credentials_set(state->session,
2018 GNUTLS_CRD_CERTIFICATE, state->lib_state.x509_cred)))
2019 return tls_error_gnu(state, US"gnutls_credentials_set", rc, errstr);
2024 /*************************************************
2025 * Initialize for GnuTLS *
2026 *************************************************/
2029 /* Called from both server and client code. In the case of a server, errors
2030 before actual TLS negotiation return DEFER.
2033 host connected host, if client; NULL if server
2034 ob tranport options block, if client; NULL if server
2035 require_ciphers tls_require_ciphers setting
2036 caller_state returned state-info structure
2037 errstr error string pointer
2039 Returns: OK/DEFER/FAIL
2044 const host_item *host,
2045 smtp_transport_options_block * ob,
2046 const uschar * require_ciphers,
2047 exim_gnutls_state_st **caller_state,
2051 exim_gnutls_state_st * state;
2055 if ( !exim_gnutls_base_init_done
2056 && (rc = tls_g_init(errstr)) != OK)
2061 /* For client-side sessions we allocate a context. This lets us run
2062 several in parallel. */
2064 int old_pool = store_pool;
2065 store_pool = POOL_PERM;
2066 state = store_get(sizeof(exim_gnutls_state_st), GET_UNTAINTED);
2067 store_pool = old_pool;
2069 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2070 state->lib_state = ob->tls_preload;
2072 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
2073 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
2075 state->tls_certificate = ob->tls_certificate;
2076 state->tls_privatekey = ob->tls_privatekey;
2077 state->tls_sni = ob->tls_sni;
2078 state->tls_verify_certificates = ob->tls_verify_certificates;
2079 state->tls_crl = ob->tls_crl;
2083 /* Server operations always use the one state_server context. It is not
2084 shared because we have forked a fresh process for every receive. However it
2085 can get re-used for successive TLS sessions on a single TCP connection. */
2087 state = &state_server;
2089 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
2090 rc = gnutls_init(&state->session, GNUTLS_SERVER);
2092 state->tls_certificate = tls_certificate;
2093 state->tls_privatekey = tls_privatekey;
2094 state->tls_sni = NULL;
2095 state->tls_verify_certificates = tls_verify_certificates;
2096 state->tls_crl = tls_crl;
2099 return tls_error_gnu(state, US"gnutls_init", rc, errstr);
2101 state->tls_require_ciphers = require_ciphers;
2104 /* This handles the variables that might get re-expanded after TLS SNI;
2105 tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
2108 debug_printf("Expanding various TLS configuration options for session credentials\n");
2109 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
2111 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
2112 requires a new structure afterwards. */
2114 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
2116 /* set SNI in client, only */
2119 if (!expand_check(state->tls_sni, US"tls_out_sni", &state->tlsp->sni, errstr))
2121 if (state->tlsp->sni && *state->tlsp->sni)
2124 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
2125 sz = Ustrlen(state->tlsp->sni);
2126 if ((rc = gnutls_server_name_set(state->session,
2127 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
2128 return tls_error_gnu(state, US"gnutls_server_name_set", rc, errstr);
2131 else if (state->tls_sni)
2132 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
2133 "have an SNI set for a server [%s]\n", state->tls_sni);
2135 if (!state->lib_state.pri_string)
2137 const uschar * p = NULL;
2138 const char * errpos;
2140 /* This is the priority string support,
2141 http://www.gnutls.org/manual/html_node/Priority-Strings.html
2142 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
2143 This was backwards incompatible, but means Exim no longer needs to track
2144 all algorithms and provide string forms for them. */
2146 if (state->tls_require_ciphers && *state->tls_require_ciphers)
2148 if (!Expand_check_tlsvar(tls_require_ciphers, errstr))
2150 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
2152 p = state->exp_tls_require_ciphers;
2153 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
2157 if ((rc = creds_load_pristring(state, p, &errpos)))
2158 return tls_error_gnu(state, string_sprintf(
2159 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
2160 p, (long)(errpos - CS p), errpos),
2165 DEBUG(D_tls) debug_printf("cipher list preloaded\n");
2166 state->exp_tls_require_ciphers = US state->tls_require_ciphers;
2170 if ((rc = gnutls_priority_set(state->session, state->lib_state.pri_cache)))
2171 return tls_error_gnu(state, US"gnutls_priority_set", rc, errstr);
2173 /* This also sets the server ticket expiration time to the same, and
2174 the STEK rotation time to 3x. */
2176 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
2178 /* Reduce security in favour of increased compatibility, if the admin
2179 decides to make that trade-off. */
2180 if (gnutls_compat_mode)
2182 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
2183 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
2184 gnutls_session_enable_compatibility_mode(state->session);
2186 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
2190 *caller_state = state;
2196 /*************************************************
2197 * Extract peer information *
2198 *************************************************/
2200 static const uschar *
2201 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
2202 gnutls_mac_algorithm_t mac)
2205 gnutls_kx_algorithm_t kx_i;
2206 gnutls_cipher_algorithm_t cipher_i;
2207 gnutls_mac_algorithm_t mac_i;
2210 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
2212 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
2213 return cipher_stdname(cs_id[0], cs_id[1]);
2219 /* Called from both server and client code.
2220 Only this is allowed to set state->peerdn and state->have_set_peerdn
2221 and we use that to detect double-calls.
2223 NOTE: the state blocks last while the TLS connection is up, which is fine
2224 for logging in the server side, but for the client side, we log after teardown
2225 in src/deliver.c. While the session is up, we can twist about states and
2226 repoint tls_* globals, but those variables used for logging or other variable
2227 expansion that happens _after_ delivery need to have a longer life-time.
2229 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
2230 doing this more than once per generation of a state context. We set them in
2231 the state context, and repoint tls_* to them. After the state goes away, the
2232 tls_* copies of the pointers remain valid and client delivery logging is happy.
2234 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
2238 state exim_gnutls_state_st *
2239 errstr pointer to error string
2241 Returns: OK/DEFER/FAIL
2245 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
2247 gnutls_session_t session = state->session;
2248 const gnutls_datum_t * cert_list;
2250 unsigned int cert_list_size = 0;
2251 gnutls_protocol_t protocol;
2252 gnutls_cipher_algorithm_t cipher;
2253 gnutls_kx_algorithm_t kx;
2254 gnutls_mac_algorithm_t mac;
2255 gnutls_certificate_type_t ct;
2256 gnutls_x509_crt_t crt;
2260 if (state->have_set_peerdn)
2262 state->have_set_peerdn = TRUE;
2264 state->peerdn = NULL;
2267 cipher = gnutls_cipher_get(session);
2268 protocol = gnutls_protocol_get_version(session);
2269 mac = gnutls_mac_get(session);
2271 #ifdef GNUTLS_TLS1_3
2272 protocol >= GNUTLS_TLS1_3 ? 0 :
2274 gnutls_kx_get(session);
2276 old_pool = store_pool;
2278 tls_support * tlsp = state->tlsp;
2279 store_pool = POOL_PERM;
2281 #ifdef SUPPORT_GNUTLS_SESS_DESC
2284 uschar * s = US gnutls_session_get_desc(session), c;
2286 /* Nikos M suggests we use this by preference. It returns like:
2287 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
2289 For partial back-compat, put a colon after the TLS version, replace the
2290 )-( grouping with __, replace in-group - with _ and append the :keysize. */
2292 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
2294 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
2296 tlsp->ver = string_copyn(g->s, g->ptr);
2297 for (uschar * p = US tlsp->ver; *p; p++)
2298 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
2300 g = string_catn(g, US":", 1);
2301 if (*s) s++; /* now on _ between groups */
2304 for (*++s && ++s; (c = *s) && c != ')'; s++)
2305 g = string_catn(g, c == '-' ? US"_" : s, 1);
2306 /* now on ) closing group */
2307 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
2308 /* now on _ between groups */
2310 g = string_catn(g, US":", 1);
2311 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
2312 state->ciphersuite = string_from_gstring(g);
2315 state->ciphersuite = string_sprintf("%s:%s:%d",
2316 gnutls_protocol_get_name(protocol),
2317 gnutls_cipher_suite_get_name(kx, cipher, mac),
2318 (int) gnutls_cipher_get_key_size(cipher) * 8);
2320 /* I don't see a way that spaces could occur, in the current GnuTLS
2321 code base, but it was a concern in the old code and perhaps older GnuTLS
2322 releases did return "TLS 1.0"; play it safe, just in case. */
2324 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
2325 tlsp->ver = string_copyn(state->ciphersuite,
2326 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
2329 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
2331 tlsp->cipher = state->ciphersuite;
2332 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
2334 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
2336 store_pool = old_pool;
2339 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
2341 if (!cert_list || cert_list_size == 0)
2343 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
2344 cert_list, cert_list_size);
2345 if (state->verify_requirement >= VERIFY_REQUIRED)
2346 return tls_error(US"certificate verification failed",
2347 US"no certificate received from peer", state->host, errstr);
2351 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
2353 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
2355 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
2356 if (state->verify_requirement >= VERIFY_REQUIRED)
2357 return tls_error(US"certificate verification not possible, unhandled type",
2358 ctn, state->host, errstr);
2362 #define exim_gnutls_peer_err(Label) \
2364 if (rc != GNUTLS_E_SUCCESS) \
2366 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
2367 (Label), gnutls_strerror(rc)); \
2368 if (state->verify_requirement >= VERIFY_REQUIRED) \
2369 return tls_error_gnu(state, (Label), rc, errstr); \
2374 rc = import_cert(&cert_list[0], &crt);
2375 exim_gnutls_peer_err(US"cert 0");
2377 state->tlsp->peercert = state->peercert = crt;
2380 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
2381 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
2383 exim_gnutls_peer_err(US"getting size for cert DN failed");
2384 return FAIL; /* should not happen */
2386 dn_buf = store_get_perm(sz, GET_TAINTED);
2387 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
2388 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
2390 state->peerdn = dn_buf;
2393 #undef exim_gnutls_peer_err
2399 /*************************************************
2400 * Verify peer certificate *
2401 *************************************************/
2403 /* Called from both server and client code.
2404 *Should* be using a callback registered with
2405 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
2406 the peer information, but that's too new for some OSes.
2409 state exim_gnutls_state_st *
2410 errstr where to put an error message
2413 FALSE if the session should be rejected
2414 TRUE if the cert is okay or we just don't care
2418 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
2423 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
2425 rc = peer_status(state, errstr);
2427 if (state->verify_requirement == VERIFY_NONE)
2430 if (rc != OK || !state->peerdn)
2432 verify = GNUTLS_CERT_INVALID;
2433 *errstr = US"certificate not supplied";
2439 if (state->verify_requirement == VERIFY_DANE && state->host)
2441 /* Using dane_verify_session_crt() would be easy, as it does it all for us
2442 including talking to a DNS resolver. But we want to do that bit ourselves
2443 as the testsuite intercepts and fakes its own DNS environment. */
2448 const gnutls_datum_t * certlist =
2449 gnutls_certificate_get_peers(state->session, &lsize);
2450 int usage = tls_out.tlsa_usage;
2452 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2453 /* Split the TLSA records into two sets, TA and EE selectors. Run the
2454 dane-verification separately so that we know which selector verified;
2455 then we know whether to do name-verification (needed for TA but not EE). */
2457 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
2458 { /* a mixed-usage bundle */
2463 for (nrec = 0; state->dane_data_len[nrec]; ) nrec++;
2466 dd = store_get(nrec * sizeof(uschar *), GET_UNTAINTED);
2467 ddl = store_get(nrec * sizeof(int), GET_UNTAINTED);
2470 if ((rc = dane_state_init(&s, 0)))
2473 for (usage = DANESSL_USAGE_DANE_EE;
2474 usage >= DANESSL_USAGE_DANE_TA; usage--)
2475 { /* take records with this usage */
2476 for (j = i = 0; i < nrec; i++)
2477 if (state->dane_data[i][0] == usage)
2479 dd[j] = state->dane_data[i];
2480 ddl[j++] = state->dane_data_len[i];
2487 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
2490 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
2491 gnutls_certificate_type_get(state->session),
2493 usage == DANESSL_USAGE_DANE_EE
2494 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2498 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
2500 else if (verify == 0) /* verification passed */
2508 if (rc) goto tlsa_prob;
2513 if ( (rc = dane_state_init(&s, 0))
2514 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
2516 || (rc = dane_verify_crt_raw(s, certlist, lsize,
2517 gnutls_certificate_type_get(state->session),
2519 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2520 usage == (1 << DANESSL_USAGE_DANE_EE)
2521 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2530 if (verify != 0) /* verification failed */
2533 (void) dane_verification_status_print(verify, &str, 0);
2534 *errstr = US str.data; /* don't bother to free */
2538 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2539 /* If a TA-mode TLSA record was used for verification we must additionally
2540 verify the cert name (but not the CA chain). For EE-mode, skip it. */
2542 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2545 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2548 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2549 /* Assume that the name on the A-record is the one that should be matching
2550 the cert. An alternate view is that the domain part of the email address
2551 is also permissible. */
2553 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2554 CS state->host->name))
2556 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2561 #endif /*SUPPORT_DANE*/
2563 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2566 /* Handle the result of verification. INVALID is set if any others are. */
2568 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2570 state->peer_cert_verified = FALSE;
2573 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2578 if (gnutls_certificate_verification_status_print(verify,
2579 gnutls_certificate_type_get(state->session), &txt, 0)
2580 == GNUTLS_E_SUCCESS)
2582 debug_printf("%s\n", txt.data);
2583 gnutls_free(txt.data);
2587 *errstr = verify & GNUTLS_CERT_REVOKED
2588 ? US"certificate revoked" : US"certificate invalid";
2592 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2593 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2595 if (state->verify_requirement >= VERIFY_REQUIRED)
2598 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2603 /* Client side, check the server's certificate name versus the name on the
2604 A-record for the connection we made. What to do for server side - what name
2605 to use for client? We document that there is no such checking for server
2608 if ( state->exp_tls_verify_cert_hostnames
2609 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2610 CS state->exp_tls_verify_cert_hostnames)
2614 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2615 if (state->verify_requirement >= VERIFY_REQUIRED)
2620 state->peer_cert_verified = TRUE;
2621 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2622 state->peerdn ? state->peerdn : US"<unset>");
2626 state->tlsp->peerdn = state->peerdn;
2631 *errstr = string_sprintf("TLSA record problem: %s",
2632 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2636 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2643 /* ------------------------------------------------------------------------ */
2646 /* Logging function which can be registered with
2647 * gnutls_global_set_log_function()
2648 * gnutls_global_set_log_level() 0..9
2650 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2652 exim_gnutls_logger_cb(int level, const char *message)
2654 size_t len = strlen(message);
2657 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2660 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2661 message[len-1] == '\n' ? "" : "\n");
2666 /* Called after client hello, should handle SNI work.
2667 This will always set tls_sni (state->received_sni) if available,
2668 and may trigger presenting different certificates,
2669 if state->trigger_sni_changes is TRUE.
2671 Should be registered with
2672 gnutls_handshake_set_post_client_hello_function()
2674 "This callback must return 0 on success or a gnutls error code to terminate the
2677 For inability to get SNI information, we return 0.
2678 We only return non-zero if re-setup failed.
2679 Only used for server-side TLS.
2683 exim_sni_handling_cb(gnutls_session_t session)
2685 char sni_name[MAX_HOST_LEN];
2686 size_t data_len = MAX_HOST_LEN;
2687 exim_gnutls_state_st *state = &state_server;
2688 unsigned int sni_type;
2690 uschar * dummy_errstr;
2692 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2693 if (rc != GNUTLS_E_SUCCESS)
2696 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2697 debug_printf("TLS: no SNI presented in handshake\n");
2699 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2700 gnutls_strerror(rc), rc);
2704 if (sni_type != GNUTLS_NAME_DNS)
2706 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2710 /* We now have a UTF-8 string in sni_name */
2711 old_pool = store_pool;
2712 store_pool = POOL_PERM;
2713 state->received_sni = string_copy_taint(US sni_name, GET_TAINTED);
2714 store_pool = old_pool;
2716 /* We set this one now so that variable expansions below will work */
2717 state->tlsp->sni = state->received_sni;
2719 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2720 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2722 if (!state->trigger_sni_changes)
2725 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2727 /* If the setup of certs/etc failed before handshake, TLS would not have
2728 been offered. The best we can do now is abort. */
2729 DEBUG(D_tls) debug_printf("expansion for SNI-dependent session files failed\n");
2730 return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
2733 rc = tls_set_remaining_x509(state, &dummy_errstr);
2734 if (rc != OK) return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
2741 #ifndef DISABLE_EVENT
2743 We use this callback to get observability and detail-level control
2744 for an exim TLS connection (either direction), raising a tls:cert event
2745 for each cert in the chain presented by the peer. Any event
2746 can deny verification.
2748 Return 0 for the handshake to continue or non-zero to terminate.
2752 verify_cb(gnutls_session_t session)
2754 const gnutls_datum_t * cert_list;
2755 unsigned int cert_list_size = 0;
2756 gnutls_x509_crt_t crt;
2759 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2761 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2762 while (cert_list_size--)
2764 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2766 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2767 cert_list_size, gnutls_strerror(rc));
2771 state->tlsp->peercert = crt;
2772 if ((yield = event_raise(state->event_action,
2773 US"tls:cert", string_sprintf("%d", cert_list_size), &errno)))
2775 log_write(0, LOG_MAIN,
2776 "SSL verify denied by event-action: depth=%d: %s",
2777 cert_list_size, yield);
2778 return 1; /* reject */
2780 state->tlsp->peercert = NULL;
2790 ddump(gnutls_datum_t * d)
2792 gstring * g = string_get((d->size+1) * 2);
2793 uschar * s = d->data;
2794 for (unsigned i = d->size; i > 0; i--, s++)
2796 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2797 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2803 post_handshake_debug(exim_gnutls_state_st * state)
2805 #ifdef SUPPORT_GNUTLS_SESS_DESC
2806 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2809 #ifdef SUPPORT_GNUTLS_KEYLOG
2810 # ifdef EXIM_HAVE_TLS1_3
2811 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2816 gnutls_datum_t c, s;
2818 /* For TLS1.2 we only want the client random and the master secret */
2819 gnutls_session_get_random(state->session, &c, &s);
2820 gnutls_session_get_master_secret(state->session, &s);
2823 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2826 debug_printf("To get keying info for TLS1.3 is hard:\n"
2827 " Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,\n"
2828 " and make sure it is writable by the Exim runtime user.\n"
2829 " Add SSLKEYLOGFILE to keep_environment in the exim config.\n"
2830 " Start Exim as root.\n"
2831 " If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2832 " (works for TLS1.2 also, and saves cut-paste into file).\n"
2833 " Trying to use add_environment for this will not work\n");
2838 #ifdef EXIM_HAVE_TLS_RESUME
2840 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2841 unsigned incoming, const gnutls_datum_t * msg)
2843 DEBUG(D_tls) debug_printf("newticket cb\n");
2844 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2849 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2851 /* Should the server offer session resumption? */
2852 tls_in.resumption = RESUME_SUPPORTED;
2853 if (verify_check_host(&tls_resumption_hosts) == OK)
2856 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2857 an offered resumption is unacceptable. We lose one resumption per ticket
2858 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2859 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2860 least they go out in a single packet. */
2862 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2863 &server_sessticket_key)))
2864 tls_in.resumption |= RESUME_SERVER_TICKET;
2867 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2869 /* Try to tell if we see a ticket request */
2870 gnutls_handshake_set_hook_function(state->session,
2871 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2876 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2878 if (gnutls_session_resumption_requested(state->session))
2880 /* This tells us the client sent a full ticket. We use a
2881 callback on session-ticket request, elsewhere, to tell
2882 if a client asked for a ticket. */
2884 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2885 DEBUG(D_tls) debug_printf("client requested resumption\n");
2887 if (gnutls_session_is_resumed(state->session))
2889 tls_in.resumption |= RESUME_USED;
2890 DEBUG(D_tls) debug_printf("Session resumed\n");
2893 #endif /* EXIM_HAVE_TLS_RESUME */
2896 #ifdef EXIM_HAVE_ALPN
2897 /* Expand and convert an Exim list to a gnutls_datum list. False return for fail.
2898 NULL plist return for silent no-ALPN.
2902 tls_alpn_plist(uschar ** tls_alpn, const gnutls_datum_t ** plist, unsigned * plen,
2907 if (!expand_check(*tls_alpn, US"tls_alpn", &exp_alpn, errstr))
2912 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
2917 const uschar * list = exp_alpn;
2923 while (string_nextinlist(&list, &sep, NULL, 0)) cnt++;
2925 p = store_get(sizeof(gnutls_datum_t) * cnt, exp_alpn);
2927 for (int i = 0; s = string_nextinlist(&list, &sep, NULL, 0); i++)
2928 { p[i].data = s; p[i].size = Ustrlen(s); }
2929 *plist = (*plen = cnt) ? p : NULL;
2935 tls_server_set_acceptable_alpns(exim_gnutls_state_st * state, uschar ** errstr)
2937 uschar * local_alpn = string_copy(tls_alpn);
2939 const gnutls_datum_t * plist;
2942 if (tls_alpn_plist(&local_alpn, &plist, &plen, errstr) && plist)
2944 /* This seems to be only mandatory if the client sends an ALPN extension;
2945 not trying ALPN is ok. Need to decide how to support server-side must-alpn. */
2947 server_seen_alpn = 0;
2948 if (!(rc = gnutls_alpn_set_protocols(state->session, plist, plen,
2949 GNUTLS_ALPN_MANDATORY)))
2950 gnutls_handshake_set_hook_function(state->session,
2951 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2954 debug_printf("setting alpn protocols: %s\n", US gnutls_strerror(rc));
2957 #endif /* EXIM_HAVE_ALPN */
2959 /* ------------------------------------------------------------------------ */
2960 /* Exported functions */
2965 /*************************************************
2966 * Start a TLS session in a server *
2967 *************************************************/
2969 /* This is called when Exim is running as a server, after having received
2970 the STARTTLS command. It must respond to that command, and then negotiate
2974 errstr pointer to error string
2976 Returns: OK on success
2977 DEFER for errors before the start of the negotiation
2978 FAIL for errors during the negotiation; the server can't
2983 tls_server_start(uschar ** errstr)
2986 exim_gnutls_state_st * state = NULL;
2988 /* Check for previous activation */
2989 if (tls_in.active.sock >= 0)
2991 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2992 smtp_printf("554 Already in TLS\r\n", FALSE);
2996 /* Initialize the library. If it fails, it will already have logged the error
2997 and sent an SMTP response. */
2999 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
3002 #ifdef MEASURE_TIMING
3004 gettimeofday(&t0, NULL);
3007 if ((rc = tls_init(NULL, NULL,
3008 tls_require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
3010 #ifdef MEASURE_TIMING
3011 report_time_since(&t0, US"server tls_init (delta)");
3015 #ifdef EXIM_HAVE_ALPN
3016 tls_server_set_acceptable_alpns(state, errstr);
3019 #ifdef EXIM_HAVE_TLS_RESUME
3020 tls_server_resume_prehandshake(state);
3023 /* If this is a host for which certificate verification is mandatory or
3024 optional, set up appropriately. */
3026 if (verify_check_host(&tls_verify_hosts) == OK)
3029 debug_printf("TLS: a client certificate will be required\n");
3030 state->verify_requirement = VERIFY_REQUIRED;
3031 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3033 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3036 debug_printf("TLS: a client certificate will be requested but not required\n");
3037 state->verify_requirement = VERIFY_OPTIONAL;
3038 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
3043 debug_printf("TLS: a client certificate will not be requested\n");
3044 state->verify_requirement = VERIFY_NONE;
3045 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3048 #ifndef DISABLE_EVENT
3051 state->event_action = event_action;
3052 gnutls_session_set_ptr(state->session, state);
3053 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3057 /* Register SNI handling; always, even if not in tls_certificate, so that the
3058 expansion variable $tls_sni is always available. */
3060 gnutls_handshake_set_post_client_hello_function(state->session,
3061 exim_sni_handling_cb);
3063 /* Set context and tell client to go ahead, except in the case of TLS startup
3064 on connection, where outputting anything now upsets the clients and tends to
3065 make them disconnect. We need to have an explicit fflush() here, to force out
3066 the response. Other smtp_printf() calls do not need it, because in non-TLS
3067 mode, the fflush() happens when smtp_getc() is called. */
3069 if (!state->tlsp->on_connect)
3071 smtp_printf("220 TLS go ahead\r\n", FALSE);
3075 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3076 that the GnuTLS library doesn't.
3077 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
3078 to set (and clear down afterwards) up a pull-timeout callback function that does
3079 a select, so we're no better off unless avoiding signals becomes an issue. */
3081 gnutls_transport_set_ptr2(state->session,
3082 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
3083 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
3084 state->fd_in = fileno(smtp_in);
3085 state->fd_out = fileno(smtp_out);
3087 sigalrm_seen = FALSE;
3088 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3090 rc = gnutls_handshake(state->session);
3091 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3094 if (rc != GNUTLS_E_SUCCESS)
3096 DEBUG(D_tls) debug_printf(" error %d from gnutls_handshake: %s\n",
3097 rc, gnutls_strerror(rc));
3099 /* It seems that, except in the case of a timeout, we have to close the
3100 connection right here; otherwise if the other end is running OpenSSL it hangs
3101 until the server times out. */
3105 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
3106 #ifndef DISABLE_EVENT
3107 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3109 gnutls_db_remove_session(state->session);
3113 tls_error_gnu(state, US"gnutls_handshake", rc, errstr);
3114 #ifndef DISABLE_EVENT
3115 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3117 (void) gnutls_alert_send_appropriate(state->session, rc);
3118 gnutls_deinit(state->session);
3120 shutdown(state->fd_out, SHUT_WR);
3121 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
3122 (void)fclose(smtp_out);
3123 (void)fclose(smtp_in);
3124 smtp_out = smtp_in = NULL;
3130 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3131 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3132 tls_in.ext_master_secret = TRUE;
3135 #ifdef EXIM_HAVE_TLS_RESUME
3136 tls_server_resume_posthandshake(state);
3139 DEBUG(D_tls) post_handshake_debug(state);
3141 #ifdef EXIM_HAVE_ALPN
3142 if (server_seen_alpn > 0)
3145 { /* The client offered ALPN. See what was negotiated. */
3146 gnutls_datum_t p = {.size = 0};
3147 int rc = gnutls_alpn_get_selected_protocol(state->session, &p);
3149 debug_printf("ALPN negotiated: %.*s\n", (int)p.size, p.data);
3151 debug_printf("getting alpn protocol: %s\n", US gnutls_strerror(rc));
3155 else if (server_seen_alpn == 0)
3156 if (verify_check_host(&hosts_require_alpn) == OK)
3158 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_NO_APPLICATION_PROTOCOL);
3159 tls_error(US"handshake", US"ALPN required but not negotiated", NULL, errstr);
3163 DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n");
3165 DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n");
3168 /* Verify after the fact */
3170 if (!verify_certificate(state, errstr))
3172 if (state->verify_requirement != VERIFY_OPTIONAL)
3174 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
3178 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
3182 /* Sets various Exim expansion variables; always safe within server */
3184 extract_exim_vars_from_tls_state(state);
3186 /* TLS has been set up. Adjust the input functions to read via TLS,
3187 and initialize appropriately. */
3189 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3191 receive_getc = tls_getc;
3192 receive_getbuf = tls_getbuf;
3193 receive_get_cache = tls_get_cache;
3194 receive_hasc = tls_hasc;
3195 receive_ungetc = tls_ungetc;
3196 receive_feof = tls_feof;
3197 receive_ferror = tls_ferror;
3206 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
3207 smtp_transport_options_block * ob)
3209 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3211 state->exp_tls_verify_cert_hostnames =
3213 string_domain_utf8_to_alabel(host->certname, NULL);
3218 debug_printf("TLS: server cert verification includes hostname: \"%s\"\n",
3219 state->exp_tls_verify_cert_hostnames);
3227 /* Given our list of RRs from the TLSA lookup, build a lookup block in
3228 GnuTLS-DANE's preferred format. Hang it on the state str for later
3229 use in DANE verification.
3231 We point at the dnsa data not copy it, so it must remain valid until
3232 after verification is done.*/
3235 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
3239 const char ** dane_data;
3240 int * dane_data_len;
3243 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3244 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3245 ) if (rr->type == T_TLSA) i++;
3247 dane_data = store_get(i * sizeof(uschar *), GET_UNTAINTED);
3248 dane_data_len = store_get(i * sizeof(int), GET_UNTAINTED);
3251 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3252 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3253 ) if (rr->type == T_TLSA && rr->size > 3)
3255 const uschar * p = rr->data;
3256 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
3257 uint8_t usage = p[0], sel = p[1], type = p[2];
3260 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
3262 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
3263 || (sel != 0 && sel != 1)
3268 case 0: /* Full: cannot check at present */
3270 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
3272 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
3277 tls_out.tlsa_usage |= 1<<usage;
3278 dane_data[i] = CS p;
3279 dane_data_len[i++] = rr->size;
3282 if (!i) return FALSE;
3284 dane_data[i] = NULL;
3285 dane_data_len[i] = 0;
3287 state->dane_data = (char * const *)dane_data;
3288 state->dane_data_len = dane_data_len;
3295 #ifdef EXIM_HAVE_TLS_RESUME
3296 /* On the client, get any stashed session for the given IP from hints db
3297 and apply it to the ssl-connection for attempted resumption. Although
3298 there is a gnutls_session_ticket_enable_client() interface it is
3299 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
3300 by deafult". There seems to be no way to disable them, so even hosts not
3301 enabled by the transport option will be sent a ticket request. We will
3302 however avoid storing and retrieving session information. */
3305 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
3306 smtp_connect_args * conn_args, smtp_transport_options_block * ob)
3308 tlsp->resumption = RESUME_SUPPORTED;
3310 if (!conn_args->have_lbserver)
3311 { DEBUG(D_tls) debug_printf("resumption not supported on continued-connection\n"); }
3312 else if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, conn_args->host) == OK)
3314 dbdata_tls_session * dt;
3316 open_db dbblock, * dbm_file;
3318 tlsp->host_resumable = TRUE;
3319 tls_client_resmption_key(tlsp, conn_args, ob);
3321 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3322 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
3324 /* We'd like to filter the retrieved session for ticket advisory expiry,
3325 but 3.6.1 seems to give no access to that */
3327 if ((dt = dbfn_read_with_length(dbm_file, tlsp->resume_index, &len)))
3328 if (!(rc = gnutls_session_set_data(session,
3329 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
3331 DEBUG(D_tls) debug_printf("good session\n");
3332 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3334 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
3335 US gnutls_strerror(rc));
3336 dbfn_close(dbm_file);
3343 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
3345 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
3346 but this flag is not set until the second. TLS 1.3 it's the other way about.
3347 Keep both calls as the session data cannot be extracted before handshake
3350 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
3355 DEBUG(D_tls) debug_printf("server offered session ticket\n");
3356 tlsp->ticket_received = TRUE;
3357 tlsp->resumption |= RESUME_SERVER_TICKET;
3359 if (tlsp->host_resumable)
3360 if (!(rc = gnutls_session_get_data2(session, &tkt)))
3362 open_db dbblock, * dbm_file;
3363 int dlen = sizeof(dbdata_tls_session) + tkt.size;
3364 dbdata_tls_session * dt = store_get(dlen, GET_TAINTED);
3366 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
3367 memcpy(dt->session, tkt.data, tkt.size);
3368 gnutls_free(tkt.data);
3370 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3372 /* key for the db is the IP */
3373 dbfn_write(dbm_file, tlsp->resume_index, dt, dlen);
3374 dbfn_close(dbm_file);
3377 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
3381 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
3386 /* With a TLS1.3 session, the ticket(s) are not seen until
3387 the first data read is attempted. And there's often two of them.
3388 Pick them up with this callback. We are also called for 1.2
3392 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
3393 unsigned incoming, const gnutls_datum_t * msg)
3395 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
3396 tls_support * tlsp = state->tlsp;
3398 DEBUG(D_tls) debug_printf("newticket cb\n");
3400 if (!tlsp->ticket_received)
3401 tls_save_session(tlsp, sess, state->host);
3407 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
3408 tls_support * tlsp, smtp_connect_args * conn_args,
3409 smtp_transport_options_block * ob)
3411 gnutls_session_set_ptr(state->session, state);
3412 gnutls_handshake_set_hook_function(state->session,
3413 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
3415 tls_retrieve_session(tlsp, state->session, conn_args, ob);
3419 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
3420 tls_support * tlsp, host_item * host)
3422 if (gnutls_session_is_resumed(state->session))
3424 DEBUG(D_tls) debug_printf("Session resumed\n");
3425 tlsp->resumption |= RESUME_USED;
3428 tls_save_session(tlsp, state->session, host);
3430 #endif /* !DISABLE_TLS_RESUME */
3433 /*************************************************
3434 * Start a TLS session in a client *
3435 *************************************************/
3437 /* Called from the smtp transport after STARTTLS has been accepted.
3440 cctx connection context
3441 conn_args connection details
3442 cookie datum for randomness (not used)
3443 tlsp record details of channel configuration here; must be non-NULL
3444 errstr error string pointer
3446 Returns: TRUE for success with TLS session context set in smtp context,
3451 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3452 void * cookie ARG_UNUSED,
3453 tls_support * tlsp, uschar ** errstr)
3455 host_item * host = conn_args->host; /* for msgs and option-tests */
3456 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3457 smtp_transport_options_block * ob = tb
3458 ? (smtp_transport_options_block *)tb->options_block
3459 : &smtp_transport_option_defaults;
3461 exim_gnutls_state_st * state = NULL;
3462 uschar * cipher_list = NULL;
3464 #ifndef DISABLE_OCSP
3466 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3467 BOOL request_ocsp = require_ocsp ? TRUE
3468 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3471 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
3474 /* If dane is flagged, have either request or require dane for this host, and
3475 a TLSA record found. Therefore, dane verify required. Which implies cert must
3476 be requested and supplied, dane verify must pass, and cert verify irrelevant
3477 (incl. hostnames), and (caller handled) require_tls and sni=$domain */
3479 if (conn_args->dane && ob->dane_require_tls_ciphers)
3481 /* not using Expand_check_tlsvar because not yet in state */
3482 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3483 &cipher_list, errstr))
3485 cipher_list = cipher_list && *cipher_list
3486 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
3491 cipher_list = ob->tls_require_ciphers;
3494 #ifdef MEASURE_TIMING
3496 gettimeofday(&t0, NULL);
3499 if (tls_init(host, ob, cipher_list, &state, tlsp, errstr) != OK)
3502 #ifdef MEASURE_TIMING
3503 report_time_since(&t0, US"client tls_init (delta)");
3508 #ifdef EXIM_HAVE_ALPN
3510 const gnutls_datum_t * plist;
3513 if (!tls_alpn_plist(&ob->tls_alpn, &plist, &plen, errstr))
3516 if (gnutls_alpn_set_protocols(state->session, plist, plen, 0) != 0)
3518 tls_error(US"alpn init", NULL, state->host, errstr);
3522 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
3525 log_write(0, LOG_MAIN, "ALPN unusable with this GnuTLS library version; ignoring \"%s\"\n",
3530 int dh_min_bits = ob->tls_dh_min_bits;
3531 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
3534 debug_printf("WARNING: tls_dh_min_bits far too low,"
3535 " clamping %d up to %d\n",
3536 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
3537 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
3540 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
3541 " acceptable bits to %d\n",
3543 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
3546 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
3547 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
3548 the specified host patterns if one of them is defined */
3551 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
3554 debug_printf("TLS: server certificate DANE required\n");
3555 state->verify_requirement = VERIFY_DANE;
3556 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3560 if ( ( state->exp_tls_verify_certificates
3561 && !ob->tls_verify_hosts
3562 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
3564 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3567 tls_client_setup_hostname_checks(host, state, ob);
3569 debug_printf("TLS: server certificate verification required\n");
3570 state->verify_requirement = VERIFY_REQUIRED;
3571 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3573 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3575 tls_client_setup_hostname_checks(host, state, ob);
3577 debug_printf("TLS: server certificate verification optional\n");
3578 state->verify_requirement = VERIFY_OPTIONAL;
3579 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
3584 debug_printf("TLS: server certificate verification not required\n");
3585 state->verify_requirement = VERIFY_NONE;
3586 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3589 #ifndef DISABLE_OCSP
3590 /* supported since GnuTLS 3.1.3 */
3593 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
3594 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
3595 NULL, 0, NULL)) != OK)
3597 tls_error_gnu(state, US"cert-status-req", rc, errstr);
3600 tlsp->ocsp = OCSP_NOT_RESP;
3604 #ifdef EXIM_HAVE_TLS_RESUME
3605 tls_client_resume_prehandshake(state, tlsp, conn_args, ob);
3608 #ifndef DISABLE_EVENT
3609 if (tb && tb->event_action)
3611 state->event_action = tb->event_action;
3612 gnutls_session_set_ptr(state->session, state);
3613 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3617 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
3618 state->fd_in = cctx->sock;
3619 state->fd_out = cctx->sock;
3621 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
3622 /* There doesn't seem to be a built-in timeout on connection. */
3624 sigalrm_seen = FALSE;
3625 ALARM(ob->command_timeout);
3627 rc = gnutls_handshake(state->session);
3628 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3631 if (rc != GNUTLS_E_SUCCESS)
3635 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
3636 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
3639 tls_error_gnu(state, US"gnutls_handshake", rc, errstr);
3643 DEBUG(D_tls) post_handshake_debug(state);
3647 if (!verify_certificate(state, errstr))
3649 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
3653 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3654 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3655 tlsp->ext_master_secret = TRUE;
3658 #ifndef DISABLE_OCSP
3663 gnutls_datum_t stapling;
3664 gnutls_ocsp_resp_t resp;
3665 gnutls_datum_t printed;
3669 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
3670 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
3672 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
3675 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
3676 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
3677 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
3680 debug_printf("%.4096s", printed.data);
3681 gnutls_free(printed.data);
3684 (void) tls_error_gnu(state, US"ocsp decode", rc, errstr);
3686 (void) tls_error_gnu(state, US"ocsp decode", rc, errstr);
3689 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3691 tlsp->ocsp = OCSP_FAILED;
3692 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3698 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3699 tlsp->ocsp = OCSP_VFIED;
3704 #ifdef EXIM_HAVE_TLS_RESUME
3705 tls_client_resume_posthandshake(state, tlsp, host);
3708 #ifdef EXIM_HAVE_ALPN
3709 if (ob->tls_alpn) /* We requested. See what was negotiated. */
3711 gnutls_datum_t p = {.size = 0};
3713 if (gnutls_alpn_get_selected_protocol(state->session, &p) == 0)
3714 { DEBUG(D_tls) debug_printf("ALPN negotiated: '%.*s'\n", (int)p.size, p.data); }
3715 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
3717 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_NO_APPLICATION_PROTOCOL);
3718 tls_error(US"handshake", US"ALPN required but not negotiated", state->host, errstr);
3722 DEBUG(D_tls) debug_printf("No ALPN negotiated");
3726 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3728 extract_exim_vars_from_tls_state(state);
3730 cctx->tls_ctx = state;
3739 ct_ctx client TLS context pointer, or NULL for the one global server context
3743 tls_shutdown_wr(void * ct_ctx)
3745 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3746 tls_support * tlsp = state->tlsp;
3748 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3750 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3752 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
3753 gnutls_bye(state->session, GNUTLS_SHUT_WR);
3756 /*************************************************
3757 * Close down a TLS session *
3758 *************************************************/
3760 /* This is also called from within a delivery subprocess forked from the
3761 daemon, to shut down the TLS library, without actually doing a shutdown (which
3762 would tamper with the TLS session in the parent process).
3765 ct_ctx client context pointer, or NULL for the one global server context
3766 do_shutdown 0 no data-flush or TLS close-alert
3767 1 if TLS close-alert is to be sent,
3768 2 if also response to be waited for (2s timeout)
3774 tls_close(void * ct_ctx, int do_shutdown)
3776 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3777 tls_support * tlsp = state->tlsp;
3779 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3783 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3784 do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
3786 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3788 #ifdef EXIM_TCP_CORK
3789 if (do_shutdown == TLS_SHUTDOWN_WAIT)
3790 (void) setsockopt(tlsp->active.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
3793 /* The library seems to have no way to only wait for a peer's
3794 shutdown, so handle the same as TLS_SHUTDOWN_WAIT */
3797 gnutls_bye(state->session,
3798 do_shutdown > TLS_SHUTDOWN_NOWAIT ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3802 if (!ct_ctx) /* server */
3804 receive_getc = smtp_getc;
3805 receive_getbuf = smtp_getbuf;
3806 receive_get_cache = smtp_get_cache;
3807 receive_hasc = smtp_hasc;
3808 receive_ungetc = smtp_ungetc;
3809 receive_feof = smtp_feof;
3810 receive_ferror = smtp_ferror;
3813 gnutls_deinit(state->session);
3814 tlsp->active.sock = -1;
3815 tlsp->active.tls_ctx = NULL;
3816 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3817 tlsp->channelbinding = NULL;
3820 if (state->xfer_buffer) store_free(state->xfer_buffer);
3827 tls_refill(unsigned lim)
3829 exim_gnutls_state_st * state = &state_server;
3832 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, buffersize=%u)\n",
3833 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3835 sigalrm_seen = FALSE;
3836 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3840 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3841 MIN(ssl_xfer_buffer_size, lim));
3842 while (inbytes == GNUTLS_E_AGAIN);
3844 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3846 if (had_command_timeout) /* set by signal handler */
3847 smtp_command_timeout_exit(); /* does not return */
3848 if (had_command_sigterm)
3849 smtp_command_sigterm_exit();
3850 if (had_data_timeout)
3851 smtp_data_timeout_exit();
3852 if (had_data_sigint)
3853 smtp_data_sigint_exit();
3855 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3856 TLS session has been closed down, not that the socket itself has been closed
3857 down. Revert to non-TLS handling. */
3861 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3862 state->xfer_error = TRUE;
3866 else if (inbytes == 0)
3868 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3869 tls_close(NULL, TLS_NO_SHUTDOWN);
3873 /* Handle genuine errors */
3875 else if (inbytes < 0)
3877 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3878 record_io_error(state, (int) inbytes, US"recv", NULL);
3879 state->xfer_error = TRUE;
3882 #ifndef DISABLE_DKIM
3883 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3885 state->xfer_buffer_hwm = (int) inbytes;
3886 state->xfer_buffer_lwm = 0;
3890 /*************************************************
3891 * TLS version of getc *
3892 *************************************************/
3894 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3895 it refills the buffer via the GnuTLS reading function.
3896 Only used by the server-side TLS.
3898 This feeds DKIM and should be used for all message-body reads.
3900 Arguments: lim Maximum amount to read/buffer
3901 Returns: the next character or EOF
3905 tls_getc(unsigned lim)
3907 exim_gnutls_state_st * state = &state_server;
3909 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3910 if (!tls_refill(lim))
3911 return state->xfer_error ? EOF : smtp_getc(lim);
3913 /* Something in the buffer; return next uschar */
3915 return state->xfer_buffer[state->xfer_buffer_lwm++];
3921 exim_gnutls_state_st * state = &state_server;
3922 return state->xfer_buffer_lwm < state->xfer_buffer_hwm;
3926 tls_getbuf(unsigned * len)
3928 exim_gnutls_state_st * state = &state_server;
3932 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3933 if (!tls_refill(*len))
3935 if (!state->xfer_error) return smtp_getbuf(len);
3940 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3942 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3943 state->xfer_buffer_lwm += size;
3949 /* Get up to the given number of bytes from any cached data, and feed to dkim. */
3951 tls_get_cache(unsigned lim)
3953 #ifndef DISABLE_DKIM
3954 exim_gnutls_state_st * state = &state_server;
3955 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3959 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3965 tls_could_getc(void)
3967 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3968 || gnutls_record_check_pending(state_server.session) > 0;
3972 /*************************************************
3973 * Read bytes from TLS channel *
3974 *************************************************/
3976 /* This does not feed DKIM, so if the caller uses this for reading message body,
3977 then the caller must feed DKIM.
3980 ct_ctx client context pointer, or NULL for the one global server context
3984 Returns: the number of bytes read
3985 -1 after a failed read, including EOF
3989 tls_read(void * ct_ctx, uschar *buff, size_t len)
3991 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3997 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3999 debug_printf("*** PROBABLY A BUG *** " \
4000 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
4001 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
4004 debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, len=" SIZE_T_FMT ")\n",
4005 state->session, buff, len);
4009 inbytes = gnutls_record_recv(state->session, buff, len);
4010 while (inbytes == GNUTLS_E_AGAIN);
4012 if (inbytes > 0) return inbytes;
4015 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
4019 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
4020 record_io_error(state, (int)inbytes, US"recv", NULL);
4029 /*************************************************
4030 * Write bytes down TLS channel *
4031 *************************************************/
4035 ct_ctx client context pointer, or NULL for the one global server context
4038 more more data expected soon
4040 Calling with len zero and more unset will flush buffered writes. The buff
4041 argument can be null for that case.
4043 Returns: the number of bytes after a successful write,
4044 -1 after a failed write
4048 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4052 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
4055 if (more && !state->corked)
4057 DEBUG(D_tls) debug_printf("gnutls_record_cork(session=%p)\n", state->session);
4058 gnutls_record_cork(state->session);
4059 state->corked = TRUE;
4063 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
4064 buff, left, more ? ", more" : "");
4068 DEBUG(D_tls) debug_printf("gnutls_record_send(session=%p, buffer=%p, left=" SIZE_T_FMT ")\n",
4069 state->session, buff, left);
4073 outbytes = gnutls_record_send(state->session, buff, left);
4074 while (outbytes == GNUTLS_E_AGAIN);
4076 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
4080 #ifdef GNUTLS_E_PREMATURE_TERMINATION
4081 if ( outbytes == GNUTLS_E_PREMATURE_TERMINATION && errno == ECONNRESET
4082 && !ct_ctx && f.smtp_in_quit
4084 { /* Outlook, dammit */
4085 if (LOGGING(protocol_detail))
4086 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4087 " SMTP response and TLS close\n", sender_host_address);
4089 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4090 " client reset TCP before TLS close\n", sender_host_address);
4095 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
4096 record_io_error(state, outbytes, US"send", NULL);
4102 record_io_error(state, 0, US"send", US"TLS channel closed on write");
4113 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
4119 if (!more && state->corked)
4121 DEBUG(D_tls) debug_printf("gnutls_record_uncork(session=%p)\n", state->session);
4123 /* We can't use GNUTLS_RECORD_WAIT here, as it retries on
4124 GNUTLS_E_AGAIN || GNUTLS_E_INTR, which would break our timeout set by alarm().
4125 The GNUTLS_E_AGAIN should not happen ever, as our sockets are blocking anyway.
4126 But who knows. (That all relies on the fact that GNUTLS_E_INTR and GNUTLS_E_AGAIN
4127 match the EINTR and EAGAIN errno values.) */
4128 outbytes = gnutls_record_uncork(state->session, 0);
4129 while (outbytes == GNUTLS_E_AGAIN);
4133 record_io_error(state, len, US"uncork", NULL);
4137 state->corked = FALSE;
4147 /*************************************************
4148 * Random number generation *
4149 *************************************************/
4151 /* Pseudo-random number generation. The result is not expected to be
4152 cryptographically strong but not so weak that someone will shoot themselves
4153 in the foot using it as a nonce in input in some email header scheme or
4154 whatever weirdness they'll twist this into. The result should handle fork()
4155 and avoid repeating sequences. OpenSSL handles that for us.
4159 Returns a random number in range [0, max-1]
4162 #ifdef HAVE_GNUTLS_RND
4164 vaguely_random_number(int max)
4168 uschar smallbuf[sizeof(r)];
4173 needed_len = sizeof(r);
4174 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4175 asked for a number less than 10. */
4177 for (r = max, i = 0; r; ++i)
4183 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
4186 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback\n");
4187 return vaguely_random_number_fallback(max);
4190 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4193 /* We don't particularly care about weighted results; if someone wants
4194 * smooth distribution and cares enough then they should submit a patch then. */
4197 #else /* HAVE_GNUTLS_RND */
4199 vaguely_random_number(int max)
4201 return vaguely_random_number_fallback(max);
4203 #endif /* HAVE_GNUTLS_RND */
4208 /*************************************************
4209 * Let tls_require_ciphers be checked at startup *
4210 *************************************************/
4212 /* The tls_require_ciphers option, if set, must be something which the
4215 Returns: NULL on success, or error message
4219 tls_validate_require_cipher(void)
4222 uschar *expciphers = NULL;
4223 gnutls_priority_t priority_cache;
4225 uschar * dummy_errstr;
4227 #ifdef GNUTLS_AUTO_GLOBAL_INIT
4228 # define validate_check_rc(Label) do { \
4229 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \
4230 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4231 # define return_deinit(Label) do { return (Label); } while (0)
4233 # define validate_check_rc(Label) do { \
4234 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
4235 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4236 # define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
4239 if (exim_gnutls_base_init_done)
4240 log_write(0, LOG_MAIN|LOG_PANIC,
4241 "already initialised GnuTLS, Exim developer bug");
4243 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
4244 if (!gnutls_allow_auto_pkcs11)
4246 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
4247 validate_check_rc(US"gnutls_pkcs11_init");
4250 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4251 rc = gnutls_global_init();
4252 validate_check_rc(US"gnutls_global_init()");
4254 exim_gnutls_base_init_done = TRUE;
4256 if (!(tls_require_ciphers && *tls_require_ciphers))
4257 return_deinit(NULL);
4259 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4261 return_deinit(US"failed to expand tls_require_ciphers");
4263 if (!(expciphers && *expciphers))
4264 return_deinit(NULL);
4267 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4269 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
4270 validate_check_rc(string_sprintf(
4271 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
4272 expciphers, (long)(errpos - CS expciphers), errpos));
4274 #undef return_deinit
4275 #undef validate_check_rc
4276 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4277 gnutls_global_deinit();
4286 /*************************************************
4287 * Report the library versions. *
4288 *************************************************/
4290 /* See a description in tls-openssl.c for an explanation of why this exists.
4292 Arguments: string to append to
4297 tls_version_report(gstring * g)
4299 return string_fmt_append(g,
4300 "Library version: GnuTLS: Compile: %s\n"
4303 gnutls_check_version(NULL));
4306 #endif /*!MACRO_PREDEF*/
4309 /* End of tls-gnu.c */