1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2015 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42 /* needed to disable PKCS11 autoload unless requested */
43 #if GNUTLS_VERSION_NUMBER >= 0x020c00
44 # include <gnutls/pkcs11.h>
46 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
47 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
51 # warning "GnuTLS library version too old; tls:cert event unsupported"
52 # define DISABLE_EVENT
54 #if GNUTLS_VERSION_NUMBER >= 0x030306
55 # define SUPPORT_CA_DIR
57 # undef SUPPORT_CA_DIR
59 #if GNUTLS_VERSION_NUMBER >= 0x030014
60 # define SUPPORT_SYSDEFAULT_CABUNDLE
64 # include <gnutls/ocsp.h>
70 gnutls_global_set_audit_log_function()
73 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
76 /* Local static variables for GnuTLS */
78 /* Values for verify_requirement */
80 enum peer_verify_requirement
81 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
83 /* This holds most state for server or client; with this, we can set up an
84 outbound TLS-enabled connection in an ACL callout, while not stomping all
85 over the TLS variables available for expansion.
87 Some of these correspond to variables in globals.c; those variables will
88 be set to point to content in one of these instances, as appropriate for
89 the stage of the process lifetime.
91 Not handled here: global tls_channelbinding_b64.
94 typedef struct exim_gnutls_state {
95 gnutls_session_t session;
96 gnutls_certificate_credentials_t x509_cred;
97 gnutls_priority_t priority_cache;
98 enum peer_verify_requirement verify_requirement;
101 BOOL peer_cert_verified;
102 BOOL trigger_sni_changes;
103 BOOL have_set_peerdn;
104 const struct host_item *host;
105 gnutls_x509_crt_t peercert;
108 uschar *received_sni;
110 const uschar *tls_certificate;
111 const uschar *tls_privatekey;
112 const uschar *tls_sni; /* client send only, not received */
113 const uschar *tls_verify_certificates;
114 const uschar *tls_crl;
115 const uschar *tls_require_ciphers;
117 uschar *exp_tls_certificate;
118 uschar *exp_tls_privatekey;
119 uschar *exp_tls_verify_certificates;
121 uschar *exp_tls_require_ciphers;
122 uschar *exp_tls_ocsp_file;
123 const uschar *exp_tls_verify_cert_hostnames;
124 #ifndef DISABLE_EVENT
125 uschar *event_action;
128 tls_support *tlsp; /* set in tls_init() */
135 } exim_gnutls_state_st;
137 static const exim_gnutls_state_st exim_gnutls_state_init = {
138 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
139 NULL, NULL, NULL, NULL,
140 NULL, NULL, NULL, NULL, NULL, NULL,
141 NULL, NULL, NULL, NULL, NULL, NULL, NULL,
143 #ifndef DISABLE_EVENT
150 /* Not only do we have our own APIs which don't pass around state, assuming
151 it's held in globals, GnuTLS doesn't appear to let us register callback data
152 for callbacks, or as part of the session, so we have to keep a "this is the
153 context we're currently dealing with" pointer and rely upon being
154 single-threaded to keep from processing data on an inbound TLS connection while
155 talking to another TLS connection for an outbound check. This does mean that
156 there's no way for heart-beats to be responded to, for the duration of the
158 XXX But see gnutls_session_get_ptr()
161 static exim_gnutls_state_st state_server, state_client;
163 /* dh_params are initialised once within the lifetime of a process using TLS;
164 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
165 don't want to repeat this. */
167 static gnutls_dh_params_t dh_server_params = NULL;
169 /* No idea how this value was chosen; preserving it. Default is 3600. */
171 static const int ssl_session_timeout = 200;
173 static const char * const exim_default_gnutls_priority = "NORMAL";
175 /* Guard library core initialisation */
177 static BOOL exim_gnutls_base_init_done = FALSE;
180 static BOOL gnutls_buggy_ocsp = FALSE;
184 /* ------------------------------------------------------------------------ */
187 #define MAX_HOST_LEN 255
189 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
190 the library logging; a value less than 0 disables the calls to set up logging
192 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
193 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
196 #ifndef EXIM_CLIENT_DH_MIN_BITS
197 # define EXIM_CLIENT_DH_MIN_BITS 1024
200 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
201 can ask for a bit-strength. Without that, we stick to the constant we had
203 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
204 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
207 #define exim_gnutls_err_check(Label) do { \
208 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
210 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
212 #if GNUTLS_VERSION_NUMBER >= 0x020c00
213 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
214 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
215 # define HAVE_GNUTLS_RND
216 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
217 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
218 * isn't available sometimes, so this needs to become a conditional
219 * compilation; the sanest way to deal with this being a problem on
220 * older OSes is to block it in the Local/Makefile with this compiler
222 # ifndef AVOID_GNUTLS_PKCS11
223 # define HAVE_GNUTLS_PKCS11
224 # endif /* AVOID_GNUTLS_PKCS11 */
230 /* ------------------------------------------------------------------------ */
231 /* Callback declarations */
233 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
234 static void exim_gnutls_logger_cb(int level, const char *message);
237 static int exim_sni_handling_cb(gnutls_session_t session);
240 static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
241 gnutls_datum_t * ocsp_response);
246 /* ------------------------------------------------------------------------ */
247 /* Static functions */
249 /*************************************************
251 *************************************************/
253 /* Called from lots of places when errors occur before actually starting to do
254 the TLS handshake, that is, while the session is still in clear. Always returns
255 DEFER for a server and FAIL for a client so that most calls can use "return
256 tls_error(...)" to do this processing and then give an appropriate return. A
257 single function is used for both server and client, because it is called from
258 some shared functions.
261 prefix text to include in the logged error
262 msg additional error string (may be NULL)
263 usually obtained from gnutls_strerror()
264 host NULL if setting up a server;
265 the connected host if setting up a client
267 Returns: OK/DEFER/FAIL
271 tls_error(const uschar *prefix, const char *msg, const host_item *host)
275 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s)%s%s",
276 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
281 uschar *conn_info = smtp_get_connection_info();
282 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
284 /* I'd like to get separated H= here, but too hard for now */
285 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
286 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
294 /*************************************************
295 * Deal with logging errors during I/O *
296 *************************************************/
298 /* We have to get the identity of the peer from saved data.
301 state the current GnuTLS exim state container
302 rc the GnuTLS error code, or 0 if it's a local error
303 when text identifying read or write
304 text local error text when ec is 0
310 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
314 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
315 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
316 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
318 msg = gnutls_strerror(rc);
320 tls_error(when, msg, state->host);
326 /*************************************************
327 * Set various Exim expansion vars *
328 *************************************************/
330 #define exim_gnutls_cert_err(Label) \
333 if (rc != GNUTLS_E_SUCCESS) \
335 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
336 (Label), gnutls_strerror(rc)); \
342 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
346 rc = gnutls_x509_crt_init(crtp);
347 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
349 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
350 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
355 #undef exim_gnutls_cert_err
358 /* We set various Exim global variables from the state, once a session has
359 been established. With TLS callouts, may need to change this to stack
360 variables, or just re-call it with the server state after client callout
363 Make sure anything set here is unset in tls_getc().
367 tls_bits strength indicator
368 tls_certificate_verified bool indicator
369 tls_channelbinding_b64 for some SASL mechanisms
371 tls_peercert pointer to library internal
373 tls_sni a (UTF-8) string
374 tls_ourcert pointer to library internal
377 state the relevant exim_gnutls_state_st *
381 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
383 gnutls_cipher_algorithm_t cipher;
384 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
387 gnutls_datum_t channel;
389 tls_support * tlsp = state->tlsp;
391 tlsp->active = state->fd_out;
393 cipher = gnutls_cipher_get(state->session);
394 /* returns size in "bytes" */
395 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
397 tlsp->cipher = state->ciphersuite;
399 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
401 tlsp->certificate_verified = state->peer_cert_verified;
403 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
404 only available for use for authenticators while this TLS session is running. */
406 tls_channelbinding_b64 = NULL;
407 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
410 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
412 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
414 old_pool = store_pool;
415 store_pool = POOL_PERM;
416 tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
417 store_pool = old_pool;
418 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
422 /* peercert is set in peer_status() */
423 tlsp->peerdn = state->peerdn;
424 tlsp->sni = state->received_sni;
426 /* record our certificate */
428 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
429 gnutls_x509_crt_t crt;
431 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
438 /*************************************************
439 * Setup up DH parameters *
440 *************************************************/
442 /* Generating the D-H parameters may take a long time. They only need to
443 be re-generated every so often, depending on security policy. What we do is to
444 keep these parameters in a file in the spool directory. If the file does not
445 exist, we generate them. This means that it is easy to cause a regeneration.
447 The new file is written as a temporary file and renamed, so that an incomplete
448 file is never present. If two processes both compute some new parameters, you
449 waste a bit of effort, but it doesn't seem worth messing around with locking to
452 Returns: OK/DEFER/FAIL
459 unsigned int dh_bits;
461 uschar filename_buf[PATH_MAX];
462 uschar *filename = NULL;
464 uschar *exp_tls_dhparam;
465 BOOL use_file_in_spool = FALSE;
466 BOOL use_fixed_file = FALSE;
467 host_item *host = NULL; /* dummy for macros */
469 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
471 rc = gnutls_dh_params_init(&dh_server_params);
472 exim_gnutls_err_check(US"gnutls_dh_params_init");
477 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
480 if (!exp_tls_dhparam)
482 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
483 m.data = US std_dh_prime_default();
484 m.size = Ustrlen(m.data);
486 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
487 use_file_in_spool = TRUE;
488 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
490 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
493 else if (exp_tls_dhparam[0] != '/')
495 m.data = US std_dh_prime_named(exp_tls_dhparam);
497 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
498 m.size = Ustrlen(m.data);
502 use_fixed_file = TRUE;
503 filename = exp_tls_dhparam;
508 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
509 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
510 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
514 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
515 /* If you change this constant, also change dh_param_fn_ext so that we can use a
516 different filename and ensure we have sufficient bits. */
517 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
519 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
521 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
524 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
526 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
530 /* Some clients have hard-coded limits. */
531 if (dh_bits > tls_dh_max_bits)
534 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
536 dh_bits = tls_dh_max_bits;
539 if (use_file_in_spool)
541 if (!string_format(filename_buf, sizeof(filename_buf),
542 "%s/gnutls-params-%d", spool_directory, dh_bits))
543 return tls_error(US"overlong filename", NULL, NULL);
544 filename = filename_buf;
547 /* Open the cache file for reading and if successful, read it and set up the
550 fd = Uopen(filename, O_RDONLY, 0);
557 if (fstat(fd, &statbuf) < 0) /* EIO */
561 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
563 if (!S_ISREG(statbuf.st_mode))
566 return tls_error(US"TLS cache not a file", NULL, NULL);
568 fp = fdopen(fd, "rb");
573 return tls_error(US"fdopen(TLS cache stat fd) failed",
574 strerror(saved_errno), NULL);
577 m.size = statbuf.st_size;
578 m.data = malloc(m.size);
582 return tls_error(US"malloc failed", strerror(errno), NULL);
584 sz = fread(m.data, m.size, 1, fp);
590 return tls_error(US"fread failed", strerror(saved_errno), NULL);
594 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
596 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
597 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
600 /* If the file does not exist, fall through to compute new data and cache it.
601 If there was any other opening error, it is serious. */
603 else if (errno == ENOENT)
607 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
610 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
613 /* If ret < 0, either the cache file does not exist, or the data it contains
614 is not useful. One particular case of this is when upgrading from an older
615 release of Exim in which the data was stored in a different format. We don't
616 try to be clever and support both formats; we just regenerate new data in this
622 unsigned int dh_bits_gen = dh_bits;
624 if ((PATH_MAX - Ustrlen(filename)) < 10)
625 return tls_error(US"Filename too long to generate replacement",
628 temp_fn = string_copy(US "%s.XXXXXXX");
629 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
631 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
632 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
634 /* GnuTLS overshoots!
635 * If we ask for 2236, we might get 2237 or more.
636 * But there's no way to ask GnuTLS how many bits there really are.
637 * We can ask how many bits were used in a TLS session, but that's it!
638 * The prime itself is hidden behind too much abstraction.
639 * So we ask for less, and proceed on a wing and a prayer.
640 * First attempt, subtracted 3 for 2233 and got 2240.
642 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
644 dh_bits_gen = dh_bits - 10;
646 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
651 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
653 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
654 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
656 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
657 and I confirmed that a NULL call to get the size first is how the GnuTLS
658 sample apps handle this. */
662 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
664 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
665 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
667 m.data = malloc(m.size);
669 return tls_error(US"memory allocation failed", strerror(errno), NULL);
670 /* this will return a size 1 less than the allocation size above */
671 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
673 if (rc != GNUTLS_E_SUCCESS)
676 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
678 m.size = sz; /* shrink by 1, probably */
680 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
684 return tls_error(US"TLS cache write D-H params failed",
685 strerror(errno), NULL);
688 sz = write_to_fd_buf(fd, US"\n", 1);
690 return tls_error(US"TLS cache write D-H params final newline failed",
691 strerror(errno), NULL);
695 return tls_error(US"TLS cache write close() failed",
696 strerror(errno), NULL);
698 if (Urename(temp_fn, filename) < 0)
699 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
700 temp_fn, filename), strerror(errno), NULL);
702 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
705 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
712 /* Create and install a selfsigned certificate, for use in server mode */
715 tls_install_selfsign(exim_gnutls_state_st * state)
717 gnutls_x509_crt_t cert = NULL;
719 gnutls_x509_privkey_t pkey = NULL;
720 const uschar * where;
723 where = US"initialising pkey";
724 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
726 where = US"initialising cert";
727 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
729 where = US"generating pkey";
730 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
731 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_LOW),
732 0))) /* _to_pk_bits() Since: 2.12.0 */
735 where = US"configuring cert";
737 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
738 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
739 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
740 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
741 || (rc = gnutls_x509_crt_set_key(cert, pkey))
743 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
744 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
745 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
746 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
747 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
748 GNUTLS_OID_X520_COMMON_NAME, 0,
749 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
753 where = US"signing cert";
754 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
756 where = US"installing selfsign cert";
758 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
764 if (cert) gnutls_x509_crt_deinit(cert);
765 if (pkey) gnutls_x509_privkey_deinit(pkey);
769 rc = tls_error(where, gnutls_strerror(rc), NULL);
776 /*************************************************
777 * Variables re-expanded post-SNI *
778 *************************************************/
780 /* Called from both server and client code, via tls_init(), and also from
781 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
783 We can tell the two apart by state->received_sni being non-NULL in callback.
785 The callback should not call us unless state->trigger_sni_changes is true,
786 which we are responsible for setting on the first pass through.
789 state exim_gnutls_state_st *
791 Returns: OK/DEFER/FAIL
795 tls_expand_session_files(exim_gnutls_state_st *state)
799 const host_item *host = state->host; /* macro should be reconsidered? */
800 uschar *saved_tls_certificate = NULL;
801 uschar *saved_tls_privatekey = NULL;
802 uschar *saved_tls_verify_certificates = NULL;
803 uschar *saved_tls_crl = NULL;
806 /* We check for tls_sni *before* expansion. */
807 if (!host) /* server */
808 if (!state->received_sni)
810 if (state->tls_certificate &&
811 (Ustrstr(state->tls_certificate, US"tls_sni") ||
812 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
813 Ustrstr(state->tls_certificate, US"tls_out_sni")
816 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
817 state->trigger_sni_changes = TRUE;
822 /* useful for debugging */
823 saved_tls_certificate = state->exp_tls_certificate;
824 saved_tls_privatekey = state->exp_tls_privatekey;
825 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
826 saved_tls_crl = state->exp_tls_crl;
829 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
830 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
832 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
833 state members, assuming consistent naming; and expand_check() returns
834 false if expansion failed, unless expansion was forced to fail. */
836 /* check if we at least have a certificate, before doing expensive
839 if (!expand_check_tlsvar(tls_certificate))
842 /* certificate is mandatory in server, optional in client */
844 if ( !state->exp_tls_certificate
845 || !*state->exp_tls_certificate
848 return tls_install_selfsign(state);
850 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
852 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
855 /* tls_privatekey is optional, defaulting to same file as certificate */
857 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
859 state->tls_privatekey = state->tls_certificate;
860 state->exp_tls_privatekey = state->exp_tls_certificate;
864 if (state->exp_tls_certificate && *state->exp_tls_certificate)
866 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
867 state->exp_tls_certificate, state->exp_tls_privatekey);
869 if (state->received_sni)
870 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
871 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
874 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
878 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
881 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
882 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
883 GNUTLS_X509_FMT_PEM);
884 exim_gnutls_err_check(
885 string_sprintf("cert/key setup: cert=%s key=%s",
886 state->exp_tls_certificate, state->exp_tls_privatekey));
887 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
888 } /* tls_certificate */
891 /* Set the OCSP stapling server info */
894 if ( !host /* server */
898 if (gnutls_buggy_ocsp)
900 DEBUG(D_tls) debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
904 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file",
905 &state->exp_tls_ocsp_file))
908 /* Use the full callback method for stapling just to get observability.
909 More efficient would be to read the file once only, if it never changed
910 (due to SNI). Would need restart on file update, or watch datestamp. */
912 gnutls_certificate_set_ocsp_status_request_function(state->x509_cred,
913 server_ocsp_stapling_cb, state->exp_tls_ocsp_file);
915 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", state->exp_tls_ocsp_file);
921 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
922 provided. Experiment shows that, if the certificate file is empty, an unhelpful
923 error message is provided. However, if we just refrain from setting anything up
924 in that case, certificate verification fails, which seems to be the correct
927 if (state->tls_verify_certificates && *state->tls_verify_certificates)
929 if (!expand_check_tlsvar(tls_verify_certificates))
931 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
932 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
933 state->exp_tls_verify_certificates = NULL;
935 if (state->tls_crl && *state->tls_crl)
936 if (!expand_check_tlsvar(tls_crl))
939 if (!(state->exp_tls_verify_certificates &&
940 *state->exp_tls_verify_certificates))
943 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
944 /* With no tls_verify_certificates, we ignore tls_crl too */
951 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
955 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
956 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
957 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
961 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
963 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
964 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
969 #ifndef SUPPORT_CA_DIR
970 /* The test suite passes in /dev/null; we could check for that path explicitly,
971 but who knows if someone has some weird FIFO which always dumps some certs, or
972 other weirdness. The thing we really want to check is that it's not a
973 directory, since while OpenSSL supports that, GnuTLS does not.
974 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
975 if (S_ISDIR(statbuf.st_mode))
978 debug_printf("verify certificates path is a dir: \"%s\"\n",
979 state->exp_tls_verify_certificates);
980 log_write(0, LOG_MAIN|LOG_PANIC,
981 "tls_verify_certificates \"%s\" is a directory",
982 state->exp_tls_verify_certificates);
987 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
988 state->exp_tls_verify_certificates, statbuf.st_size);
990 if (statbuf.st_size == 0)
993 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
999 #ifdef SUPPORT_CA_DIR
1000 (statbuf.st_mode & S_IFMT) == S_IFDIR
1002 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1003 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1006 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1007 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1013 exim_gnutls_err_check(US"setting certificate trust");
1015 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
1017 if (state->tls_crl && *state->tls_crl &&
1018 state->exp_tls_crl && *state->exp_tls_crl)
1020 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1021 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1022 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1026 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
1028 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1037 /*************************************************
1038 * Set X.509 state variables *
1039 *************************************************/
1041 /* In GnuTLS, the registered cert/key are not replaced by a later
1042 set of a cert/key, so for SNI support we need a whole new x509_cred
1043 structure. Which means various other non-re-expanded pieces of state
1044 need to be re-set in the new struct, so the setting logic is pulled
1048 state exim_gnutls_state_st *
1050 Returns: OK/DEFER/FAIL
1054 tls_set_remaining_x509(exim_gnutls_state_st *state)
1057 const host_item *host = state->host; /* macro should be reconsidered? */
1059 /* Create D-H parameters, or read them from the cache file. This function does
1060 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1061 client-side params. */
1065 if (!dh_server_params)
1067 rc = init_server_dh();
1068 if (rc != OK) return rc;
1070 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1073 /* Link the credentials to the session. */
1075 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1076 exim_gnutls_err_check(US"gnutls_credentials_set");
1081 /*************************************************
1082 * Initialize for GnuTLS *
1083 *************************************************/
1086 #ifndef DISABLE_OCSP
1089 tls_is_buggy_ocsp(void)
1092 uschar maj, mid, mic;
1094 s = CUS gnutls_check_version(NULL);
1098 while (*s && *s != '.') s++;
1099 mid = atoi(CCS ++s);
1106 while (*s && *s != '.') s++;
1107 mic = atoi(CCS ++s);
1108 return mic <= (mid == 3 ? 16 : 3);
1117 /* Called from both server and client code. In the case of a server, errors
1118 before actual TLS negotiation return DEFER.
1121 host connected host, if client; NULL if server
1122 certificate certificate file
1123 privatekey private key file
1124 sni TLS SNI to send, sometimes when client; else NULL
1127 require_ciphers tls_require_ciphers setting
1128 caller_state returned state-info structure
1130 Returns: OK/DEFER/FAIL
1135 const host_item *host,
1136 const uschar *certificate,
1137 const uschar *privatekey,
1141 const uschar *require_ciphers,
1142 exim_gnutls_state_st **caller_state)
1144 exim_gnutls_state_st *state;
1149 BOOL want_default_priorities;
1151 if (!exim_gnutls_base_init_done)
1153 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1155 #ifdef HAVE_GNUTLS_PKCS11
1156 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1157 which loads modules from a config file, which sounds good and may be wanted
1158 by some sysadmin, but also means in common configurations that GNOME keyring
1159 environment variables are used and so breaks for users calling mailq.
1160 To prevent this, we init PKCS11 first, which is the documented approach. */
1161 if (!gnutls_allow_auto_pkcs11)
1163 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1164 exim_gnutls_err_check(US"gnutls_pkcs11_init");
1168 rc = gnutls_global_init();
1169 exim_gnutls_err_check(US"gnutls_global_init");
1171 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1174 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1175 /* arbitrarily chosen level; bump upto 9 for more */
1176 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1180 #ifndef DISABLE_OCSP
1181 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1182 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1185 exim_gnutls_base_init_done = TRUE;
1190 state = &state_client;
1191 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1192 state->tlsp = &tls_out;
1193 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1194 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1198 state = &state_server;
1199 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1200 state->tlsp = &tls_in;
1201 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1202 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1204 exim_gnutls_err_check(US"gnutls_init");
1208 state->tls_certificate = certificate;
1209 state->tls_privatekey = privatekey;
1210 state->tls_require_ciphers = require_ciphers;
1211 state->tls_sni = sni;
1212 state->tls_verify_certificates = cas;
1213 state->tls_crl = crl;
1215 /* This handles the variables that might get re-expanded after TLS SNI;
1216 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1219 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1220 rc = tls_expand_session_files(state);
1221 if (rc != OK) return rc;
1223 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1224 requires a new structure afterwards. */
1226 rc = tls_set_remaining_x509(state);
1227 if (rc != OK) return rc;
1229 /* set SNI in client, only */
1232 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni))
1234 if (state->tlsp->sni && *state->tlsp->sni)
1237 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1238 sz = Ustrlen(state->tlsp->sni);
1239 rc = gnutls_server_name_set(state->session,
1240 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
1241 exim_gnutls_err_check(US"gnutls_server_name_set");
1244 else if (state->tls_sni)
1245 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1246 "have an SNI set for a client [%s]\n", state->tls_sni);
1248 /* This is the priority string support,
1249 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1250 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1251 This was backwards incompatible, but means Exim no longer needs to track
1252 all algorithms and provide string forms for them. */
1254 want_default_priorities = TRUE;
1256 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1258 if (!expand_check_tlsvar(tls_require_ciphers))
1260 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1262 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1263 state->exp_tls_require_ciphers);
1265 rc = gnutls_priority_init(&state->priority_cache,
1266 CS state->exp_tls_require_ciphers, &errpos);
1267 want_default_priorities = FALSE;
1268 p = state->exp_tls_require_ciphers;
1271 if (want_default_priorities)
1274 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1275 exim_default_gnutls_priority);
1276 rc = gnutls_priority_init(&state->priority_cache,
1277 exim_default_gnutls_priority, &errpos);
1278 p = US exim_default_gnutls_priority;
1281 exim_gnutls_err_check(string_sprintf(
1282 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1283 p, errpos - CS p, errpos));
1285 rc = gnutls_priority_set(state->session, state->priority_cache);
1286 exim_gnutls_err_check(US"gnutls_priority_set");
1288 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1290 /* Reduce security in favour of increased compatibility, if the admin
1291 decides to make that trade-off. */
1292 if (gnutls_compat_mode)
1294 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1295 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1296 gnutls_session_enable_compatibility_mode(state->session);
1298 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1302 *caller_state = state;
1308 /*************************************************
1309 * Extract peer information *
1310 *************************************************/
1312 /* Called from both server and client code.
1313 Only this is allowed to set state->peerdn and state->have_set_peerdn
1314 and we use that to detect double-calls.
1316 NOTE: the state blocks last while the TLS connection is up, which is fine
1317 for logging in the server side, but for the client side, we log after teardown
1318 in src/deliver.c. While the session is up, we can twist about states and
1319 repoint tls_* globals, but those variables used for logging or other variable
1320 expansion that happens _after_ delivery need to have a longer life-time.
1322 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1323 doing this more than once per generation of a state context. We set them in
1324 the state context, and repoint tls_* to them. After the state goes away, the
1325 tls_* copies of the pointers remain valid and client delivery logging is happy.
1327 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1331 state exim_gnutls_state_st *
1333 Returns: OK/DEFER/FAIL
1337 peer_status(exim_gnutls_state_st *state)
1339 uschar cipherbuf[256];
1340 const gnutls_datum_t *cert_list;
1342 unsigned int cert_list_size = 0;
1343 gnutls_protocol_t protocol;
1344 gnutls_cipher_algorithm_t cipher;
1345 gnutls_kx_algorithm_t kx;
1346 gnutls_mac_algorithm_t mac;
1347 gnutls_certificate_type_t ct;
1348 gnutls_x509_crt_t crt;
1352 if (state->have_set_peerdn)
1354 state->have_set_peerdn = TRUE;
1356 state->peerdn = NULL;
1359 cipher = gnutls_cipher_get(state->session);
1360 protocol = gnutls_protocol_get_version(state->session);
1361 mac = gnutls_mac_get(state->session);
1362 kx = gnutls_kx_get(state->session);
1364 string_format(cipherbuf, sizeof(cipherbuf),
1366 gnutls_protocol_get_name(protocol),
1367 gnutls_cipher_suite_get_name(kx, cipher, mac),
1368 (int) gnutls_cipher_get_key_size(cipher) * 8);
1370 /* I don't see a way that spaces could occur, in the current GnuTLS
1371 code base, but it was a concern in the old code and perhaps older GnuTLS
1372 releases did return "TLS 1.0"; play it safe, just in case. */
1373 for (p = cipherbuf; *p != '\0'; ++p)
1376 old_pool = store_pool;
1377 store_pool = POOL_PERM;
1378 state->ciphersuite = string_copy(cipherbuf);
1379 store_pool = old_pool;
1380 state->tlsp->cipher = state->ciphersuite;
1383 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1385 if (cert_list == NULL || cert_list_size == 0)
1387 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1388 cert_list, cert_list_size);
1389 if (state->verify_requirement >= VERIFY_REQUIRED)
1390 return tls_error(US"certificate verification failed",
1391 "no certificate received from peer", state->host);
1395 ct = gnutls_certificate_type_get(state->session);
1396 if (ct != GNUTLS_CRT_X509)
1398 const char *ctn = gnutls_certificate_type_get_name(ct);
1400 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1401 if (state->verify_requirement >= VERIFY_REQUIRED)
1402 return tls_error(US"certificate verification not possible, unhandled type",
1407 #define exim_gnutls_peer_err(Label) \
1409 if (rc != GNUTLS_E_SUCCESS) \
1411 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1412 (Label), gnutls_strerror(rc)); \
1413 if (state->verify_requirement >= VERIFY_REQUIRED) \
1414 return tls_error((Label), gnutls_strerror(rc), state->host); \
1419 rc = import_cert(&cert_list[0], &crt);
1420 exim_gnutls_peer_err(US"cert 0");
1422 state->tlsp->peercert = state->peercert = crt;
1425 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1426 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1428 exim_gnutls_peer_err(US"getting size for cert DN failed");
1429 return FAIL; /* should not happen */
1431 dn_buf = store_get_perm(sz);
1432 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1433 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1435 state->peerdn = dn_buf;
1438 #undef exim_gnutls_peer_err
1444 /*************************************************
1445 * Verify peer certificate *
1446 *************************************************/
1448 /* Called from both server and client code.
1449 *Should* be using a callback registered with
1450 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1451 the peer information, but that's too new for some OSes.
1454 state exim_gnutls_state_st *
1455 error where to put an error message
1458 FALSE if the session should be rejected
1459 TRUE if the cert is okay or we just don't care
1463 verify_certificate(exim_gnutls_state_st *state, const char **error)
1466 unsigned int verify;
1470 if ((rc = peer_status(state)) != OK)
1472 verify = GNUTLS_CERT_INVALID;
1473 *error = "certificate not supplied";
1476 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1478 /* Handle the result of verification. INVALID seems to be set as well
1479 as REVOKED, but leave the test for both. */
1482 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1485 state->peer_cert_verified = FALSE;
1487 *error = verify & GNUTLS_CERT_REVOKED
1488 ? "certificate revoked" : "certificate invalid";
1491 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1492 *error, state->peerdn ? state->peerdn : US"<unset>");
1494 if (state->verify_requirement >= VERIFY_REQUIRED)
1496 gnutls_alert_send(state->session,
1497 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1501 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1506 if (state->exp_tls_verify_cert_hostnames)
1509 const uschar * list = state->exp_tls_verify_cert_hostnames;
1511 while (name = string_nextinlist(&list, &sep, NULL, 0))
1512 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1517 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1518 if (state->verify_requirement >= VERIFY_REQUIRED)
1520 gnutls_alert_send(state->session,
1521 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1527 state->peer_cert_verified = TRUE;
1528 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1529 state->peerdn ? state->peerdn : US"<unset>");
1532 state->tlsp->peerdn = state->peerdn;
1540 /* ------------------------------------------------------------------------ */
1543 /* Logging function which can be registered with
1544 * gnutls_global_set_log_function()
1545 * gnutls_global_set_log_level() 0..9
1547 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1549 exim_gnutls_logger_cb(int level, const char *message)
1551 size_t len = strlen(message);
1554 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1557 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1558 message[len-1] == '\n' ? "" : "\n");
1563 /* Called after client hello, should handle SNI work.
1564 This will always set tls_sni (state->received_sni) if available,
1565 and may trigger presenting different certificates,
1566 if state->trigger_sni_changes is TRUE.
1568 Should be registered with
1569 gnutls_handshake_set_post_client_hello_function()
1571 "This callback must return 0 on success or a gnutls error code to terminate the
1574 For inability to get SNI information, we return 0.
1575 We only return non-zero if re-setup failed.
1576 Only used for server-side TLS.
1580 exim_sni_handling_cb(gnutls_session_t session)
1582 char sni_name[MAX_HOST_LEN];
1583 size_t data_len = MAX_HOST_LEN;
1584 exim_gnutls_state_st *state = &state_server;
1585 unsigned int sni_type;
1588 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1589 if (rc != GNUTLS_E_SUCCESS)
1592 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1593 debug_printf("TLS: no SNI presented in handshake.\n");
1595 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1596 gnutls_strerror(rc), rc);
1601 if (sni_type != GNUTLS_NAME_DNS)
1603 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1607 /* We now have a UTF-8 string in sni_name */
1608 old_pool = store_pool;
1609 store_pool = POOL_PERM;
1610 state->received_sni = string_copyn(US sni_name, data_len);
1611 store_pool = old_pool;
1613 /* We set this one now so that variable expansions below will work */
1614 state->tlsp->sni = state->received_sni;
1616 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1617 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1619 if (!state->trigger_sni_changes)
1622 rc = tls_expand_session_files(state);
1625 /* If the setup of certs/etc failed before handshake, TLS would not have
1626 been offered. The best we can do now is abort. */
1627 return GNUTLS_E_APPLICATION_ERROR_MIN;
1630 rc = tls_set_remaining_x509(state);
1631 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1638 #ifndef DISABLE_OCSP
1641 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1642 gnutls_datum_t * ocsp_response)
1646 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1648 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1650 tls_in.ocsp = OCSP_NOT_RESP;
1651 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1654 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1661 #ifndef DISABLE_EVENT
1663 We use this callback to get observability and detail-level control
1664 for an exim TLS connection (either direction), raising a tls:cert event
1665 for each cert in the chain presented by the peer. Any event
1666 can deny verification.
1668 Return 0 for the handshake to continue or non-zero to terminate.
1672 verify_cb(gnutls_session_t session)
1674 const gnutls_datum_t * cert_list;
1675 unsigned int cert_list_size = 0;
1676 gnutls_x509_crt_t crt;
1679 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1681 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1683 while (cert_list_size--)
1685 rc = import_cert(&cert_list[cert_list_size], &crt);
1686 if (rc != GNUTLS_E_SUCCESS)
1688 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1689 cert_list_size, gnutls_strerror(rc));
1693 state->tlsp->peercert = crt;
1694 if ((yield = event_raise(state->event_action,
1695 US"tls:cert", string_sprintf("%d", cert_list_size))))
1697 log_write(0, LOG_MAIN,
1698 "SSL verify denied by event-action: depth=%d: %s",
1699 cert_list_size, yield);
1700 return 1; /* reject */
1702 state->tlsp->peercert = NULL;
1712 /* ------------------------------------------------------------------------ */
1713 /* Exported functions */
1718 /*************************************************
1719 * Start a TLS session in a server *
1720 *************************************************/
1722 /* This is called when Exim is running as a server, after having received
1723 the STARTTLS command. It must respond to that command, and then negotiate
1727 require_ciphers list of allowed ciphers or NULL
1729 Returns: OK on success
1730 DEFER for errors before the start of the negotiation
1731 FAIL for errors during the negotation; the server can't
1736 tls_server_start(const uschar *require_ciphers)
1740 exim_gnutls_state_st *state = NULL;
1742 /* Check for previous activation */
1743 if (tls_in.active >= 0)
1745 tls_error(US"STARTTLS received after TLS started", "", NULL);
1746 smtp_printf("554 Already in TLS\r\n");
1750 /* Initialize the library. If it fails, it will already have logged the error
1751 and sent an SMTP response. */
1753 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1755 rc = tls_init(NULL, tls_certificate, tls_privatekey,
1756 NULL, tls_verify_certificates, tls_crl,
1757 require_ciphers, &state);
1758 if (rc != OK) return rc;
1760 /* If this is a host for which certificate verification is mandatory or
1761 optional, set up appropriately. */
1763 if (verify_check_host(&tls_verify_hosts) == OK)
1766 debug_printf("TLS: a client certificate will be required.\n");
1767 state->verify_requirement = VERIFY_REQUIRED;
1768 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1770 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1773 debug_printf("TLS: a client certificate will be requested but not required.\n");
1774 state->verify_requirement = VERIFY_OPTIONAL;
1775 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1780 debug_printf("TLS: a client certificate will not be requested.\n");
1781 state->verify_requirement = VERIFY_NONE;
1782 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1785 #ifndef DISABLE_EVENT
1788 state->event_action = event_action;
1789 gnutls_session_set_ptr(state->session, state);
1790 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1794 /* Register SNI handling; always, even if not in tls_certificate, so that the
1795 expansion variable $tls_sni is always available. */
1797 gnutls_handshake_set_post_client_hello_function(state->session,
1798 exim_sni_handling_cb);
1800 /* Set context and tell client to go ahead, except in the case of TLS startup
1801 on connection, where outputting anything now upsets the clients and tends to
1802 make them disconnect. We need to have an explicit fflush() here, to force out
1803 the response. Other smtp_printf() calls do not need it, because in non-TLS
1804 mode, the fflush() happens when smtp_getc() is called. */
1806 if (!state->tlsp->on_connect)
1808 smtp_printf("220 TLS go ahead\r\n");
1812 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1813 that the GnuTLS library doesn't. */
1815 gnutls_transport_set_ptr2(state->session,
1816 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
1817 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
1818 state->fd_in = fileno(smtp_in);
1819 state->fd_out = fileno(smtp_out);
1821 sigalrm_seen = FALSE;
1822 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1825 rc = gnutls_handshake(state->session);
1826 } while ((rc == GNUTLS_E_AGAIN) ||
1827 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1830 if (rc != GNUTLS_E_SUCCESS)
1832 tls_error(US"gnutls_handshake",
1833 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
1834 /* It seems that, except in the case of a timeout, we have to close the
1835 connection right here; otherwise if the other end is running OpenSSL it hangs
1836 until the server times out. */
1840 (void)fclose(smtp_out);
1841 (void)fclose(smtp_in);
1847 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1849 /* Verify after the fact */
1851 if ( state->verify_requirement != VERIFY_NONE
1852 && !verify_certificate(state, &error))
1854 if (state->verify_requirement != VERIFY_OPTIONAL)
1856 tls_error(US"certificate verification failed", error, NULL);
1860 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1864 /* Figure out peer DN, and if authenticated, etc. */
1866 rc = peer_status(state);
1867 if (rc != OK) return rc;
1869 /* Sets various Exim expansion variables; always safe within server */
1871 extract_exim_vars_from_tls_state(state);
1873 /* TLS has been set up. Adjust the input functions to read via TLS,
1874 and initialize appropriately. */
1876 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1878 receive_getc = tls_getc;
1879 receive_ungetc = tls_ungetc;
1880 receive_feof = tls_feof;
1881 receive_ferror = tls_ferror;
1882 receive_smtp_buffered = tls_smtp_buffered;
1891 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
1892 smtp_transport_options_block * ob)
1894 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
1896 state->exp_tls_verify_cert_hostnames =
1898 string_domain_utf8_to_alabel(host->name, NULL);
1903 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
1904 state->exp_tls_verify_cert_hostnames);
1909 /*************************************************
1910 * Start a TLS session in a client *
1911 *************************************************/
1913 /* Called from the smtp transport after STARTTLS has been accepted.
1916 fd the fd of the connection
1917 host connected host (for messages)
1918 addr the first address (not used)
1919 tb transport (always smtp)
1921 Returns: OK/DEFER/FAIL (because using common functions),
1922 but for a client, DEFER and FAIL have the same meaning
1926 tls_client_start(int fd, host_item *host,
1927 address_item *addr ARG_UNUSED,
1928 transport_instance *tb
1929 #ifdef EXPERIMENTAL_DANE
1930 , dns_answer * unused_tlsa_dnsa
1934 smtp_transport_options_block *ob =
1935 (smtp_transport_options_block *)tb->options_block;
1938 exim_gnutls_state_st *state = NULL;
1939 #ifndef DISABLE_OCSP
1941 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
1942 BOOL request_ocsp = require_ocsp ? TRUE
1943 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
1946 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
1948 if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
1949 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
1950 ob->tls_require_ciphers, &state)) != OK)
1954 int dh_min_bits = ob->tls_dh_min_bits;
1955 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1958 debug_printf("WARNING: tls_dh_min_bits far too low,"
1959 " clamping %d up to %d\n",
1960 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1961 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1964 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
1965 " acceptable bits to %d\n",
1967 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1970 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
1971 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
1972 the specified host patterns if one of them is defined */
1974 if ( ( state->exp_tls_verify_certificates
1975 && !ob->tls_verify_hosts
1976 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
1978 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
1981 tls_client_setup_hostname_checks(host, state, ob);
1983 debug_printf("TLS: server certificate verification required.\n");
1984 state->verify_requirement = VERIFY_REQUIRED;
1985 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1987 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
1989 tls_client_setup_hostname_checks(host, state, ob);
1991 debug_printf("TLS: server certificate verification optional.\n");
1992 state->verify_requirement = VERIFY_OPTIONAL;
1993 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1998 debug_printf("TLS: server certificate verification not required.\n");
1999 state->verify_requirement = VERIFY_NONE;
2000 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2003 #ifndef DISABLE_OCSP
2004 /* supported since GnuTLS 3.1.3 */
2007 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2008 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2009 NULL, 0, NULL)) != OK)
2010 return tls_error(US"cert-status-req",
2011 gnutls_strerror(rc), state->host);
2012 tls_out.ocsp = OCSP_NOT_RESP;
2016 #ifndef DISABLE_EVENT
2017 if (tb->event_action)
2019 state->event_action = tb->event_action;
2020 gnutls_session_set_ptr(state->session, state);
2021 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2025 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
2029 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2030 /* There doesn't seem to be a built-in timeout on connection. */
2032 sigalrm_seen = FALSE;
2033 alarm(ob->command_timeout);
2036 rc = gnutls_handshake(state->session);
2037 } while ((rc == GNUTLS_E_AGAIN) ||
2038 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
2041 if (rc != GNUTLS_E_SUCCESS)
2042 return tls_error(US"gnutls_handshake",
2043 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
2045 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2049 if (state->verify_requirement != VERIFY_NONE &&
2050 !verify_certificate(state, &error))
2051 return tls_error(US"certificate verification failed", error, state->host);
2053 #ifndef DISABLE_OCSP
2058 gnutls_datum_t stapling;
2059 gnutls_ocsp_resp_t resp;
2060 gnutls_datum_t printed;
2061 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2062 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2063 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2064 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2067 debug_printf("%.4096s", printed.data);
2068 gnutls_free(printed.data);
2071 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host);
2074 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
2076 tls_out.ocsp = OCSP_FAILED;
2077 return tls_error(US"certificate status check failed", NULL, state->host);
2079 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
2080 tls_out.ocsp = OCSP_VFIED;
2084 /* Figure out peer DN, and if authenticated, etc. */
2086 if ((rc = peer_status(state)) != OK)
2089 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
2091 extract_exim_vars_from_tls_state(state);
2099 /*************************************************
2100 * Close down a TLS session *
2101 *************************************************/
2103 /* This is also called from within a delivery subprocess forked from the
2104 daemon, to shut down the TLS library, without actually doing a shutdown (which
2105 would tamper with the TLS session in the parent process).
2107 Arguments: TRUE if gnutls_bye is to be called
2112 tls_close(BOOL is_server, BOOL shutdown)
2114 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2116 if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
2120 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
2121 gnutls_bye(state->session, GNUTLS_SHUT_WR);
2124 gnutls_deinit(state->session);
2126 state->tlsp->active = -1;
2127 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2129 if ((state_server.session == NULL) && (state_client.session == NULL))
2131 gnutls_global_deinit();
2132 exim_gnutls_base_init_done = FALSE;
2140 /*************************************************
2141 * TLS version of getc *
2142 *************************************************/
2144 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2145 it refills the buffer via the GnuTLS reading function.
2146 Only used by the server-side TLS.
2148 This feeds DKIM and should be used for all message-body reads.
2151 Returns: the next character or EOF
2157 exim_gnutls_state_st *state = &state_server;
2158 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2162 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2163 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2165 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2166 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2167 ssl_xfer_buffer_size);
2170 /* A zero-byte return appears to mean that the TLS session has been
2171 closed down, not that the socket itself has been closed down. Revert to
2172 non-TLS handling. */
2176 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2178 receive_getc = smtp_getc;
2179 receive_ungetc = smtp_ungetc;
2180 receive_feof = smtp_feof;
2181 receive_ferror = smtp_ferror;
2182 receive_smtp_buffered = smtp_buffered;
2184 gnutls_deinit(state->session);
2185 state->session = NULL;
2186 state->tlsp->active = -1;
2187 state->tlsp->bits = 0;
2188 state->tlsp->certificate_verified = FALSE;
2189 tls_channelbinding_b64 = NULL;
2190 state->tlsp->cipher = NULL;
2191 state->tlsp->peercert = NULL;
2192 state->tlsp->peerdn = NULL;
2197 /* Handle genuine errors */
2199 else if (inbytes < 0)
2201 record_io_error(state, (int) inbytes, US"recv", NULL);
2202 state->xfer_error = 1;
2205 #ifndef DISABLE_DKIM
2206 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2208 state->xfer_buffer_hwm = (int) inbytes;
2209 state->xfer_buffer_lwm = 0;
2212 /* Something in the buffer; return next uschar */
2214 return state->xfer_buffer[state->xfer_buffer_lwm++];
2220 /*************************************************
2221 * Read bytes from TLS channel *
2222 *************************************************/
2224 /* This does not feed DKIM, so if the caller uses this for reading message body,
2225 then the caller must feed DKIM.
2231 Returns: the number of bytes read
2232 -1 after a failed read
2236 tls_read(BOOL is_server, uschar *buff, size_t len)
2238 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2244 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2246 debug_printf("*** PROBABLY A BUG *** " \
2247 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2248 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2251 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2252 state->session, buff, len);
2254 inbytes = gnutls_record_recv(state->session, buff, len);
2255 if (inbytes > 0) return inbytes;
2258 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2260 else record_io_error(state, (int)inbytes, US"recv", NULL);
2268 /*************************************************
2269 * Write bytes down TLS channel *
2270 *************************************************/
2274 is_server channel specifier
2278 Returns: the number of bytes after a successful write,
2279 -1 after a failed write
2283 tls_write(BOOL is_server, const uschar *buff, size_t len)
2287 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2289 DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
2292 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2294 outbytes = gnutls_record_send(state->session, buff, left);
2296 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
2299 record_io_error(state, outbytes, US"send", NULL);
2304 record_io_error(state, 0, US"send", US"TLS channel closed on write");
2315 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2326 /*************************************************
2327 * Random number generation *
2328 *************************************************/
2330 /* Pseudo-random number generation. The result is not expected to be
2331 cryptographically strong but not so weak that someone will shoot themselves
2332 in the foot using it as a nonce in input in some email header scheme or
2333 whatever weirdness they'll twist this into. The result should handle fork()
2334 and avoid repeating sequences. OpenSSL handles that for us.
2338 Returns a random number in range [0, max-1]
2341 #ifdef HAVE_GNUTLS_RND
2343 vaguely_random_number(int max)
2348 uschar smallbuf[sizeof(r)];
2353 needed_len = sizeof(r);
2354 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2355 * asked for a number less than 10. */
2356 for (r = max, i = 0; r; ++i)
2362 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2365 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2366 return vaguely_random_number_fallback(max);
2369 for (p = smallbuf; needed_len; --needed_len, ++p)
2375 /* We don't particularly care about weighted results; if someone wants
2376 * smooth distribution and cares enough then they should submit a patch then. */
2379 #else /* HAVE_GNUTLS_RND */
2381 vaguely_random_number(int max)
2383 return vaguely_random_number_fallback(max);
2385 #endif /* HAVE_GNUTLS_RND */
2390 /*************************************************
2391 * Let tls_require_ciphers be checked at startup *
2392 *************************************************/
2394 /* The tls_require_ciphers option, if set, must be something which the
2397 Returns: NULL on success, or error message
2401 tls_validate_require_cipher(void)
2404 uschar *expciphers = NULL;
2405 gnutls_priority_t priority_cache;
2408 #define validate_check_rc(Label) do { \
2409 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2410 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2411 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2413 if (exim_gnutls_base_init_done)
2414 log_write(0, LOG_MAIN|LOG_PANIC,
2415 "already initialised GnuTLS, Exim developer bug");
2417 #ifdef HAVE_GNUTLS_PKCS11
2418 if (!gnutls_allow_auto_pkcs11)
2420 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2421 validate_check_rc(US"gnutls_pkcs11_init");
2424 rc = gnutls_global_init();
2425 validate_check_rc(US"gnutls_global_init()");
2426 exim_gnutls_base_init_done = TRUE;
2428 if (!(tls_require_ciphers && *tls_require_ciphers))
2429 return_deinit(NULL);
2431 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2432 return_deinit(US"failed to expand tls_require_ciphers");
2434 if (!(expciphers && *expciphers))
2435 return_deinit(NULL);
2438 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2440 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2441 validate_check_rc(string_sprintf(
2442 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2443 expciphers, errpos - CS expciphers, errpos));
2445 #undef return_deinit
2446 #undef validate_check_rc
2447 gnutls_global_deinit();
2455 /*************************************************
2456 * Report the library versions. *
2457 *************************************************/
2459 /* See a description in tls-openssl.c for an explanation of why this exists.
2461 Arguments: a FILE* to print the results to
2466 tls_version_report(FILE *f)
2468 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2471 gnutls_check_version(NULL));
2476 /* End of tls-gnu.c */