1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2018 */
7 /* Copyright (c) Phil Pennock 2012 */
8 /* See the file NOTICE for conditions of use and distribution. */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
43 /* needed to disable PKCS11 autoload unless requested */
44 #if GNUTLS_VERSION_NUMBER >= 0x020c00
45 # include <gnutls/pkcs11.h>
46 # define SUPPORT_PARAM_TO_PK_BITS
48 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
52 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
53 # warning "GnuTLS library version too old; tls:cert event unsupported"
54 # define DISABLE_EVENT
56 #if GNUTLS_VERSION_NUMBER >= 0x030000
57 # define SUPPORT_SELFSIGN /* Uncertain what version is first usable but 2.12.23 is not */
59 #if GNUTLS_VERSION_NUMBER >= 0x030306
60 # define SUPPORT_CA_DIR
62 # undef SUPPORT_CA_DIR
64 #if GNUTLS_VERSION_NUMBER >= 0x030014
65 # define SUPPORT_SYSDEFAULT_CABUNDLE
67 #if GNUTLS_VERSION_NUMBER >= 0x030104
68 # define GNUTLS_CERT_VFY_STATUS_PRINT
70 #if GNUTLS_VERSION_NUMBER >= 0x030109
73 #if GNUTLS_VERSION_NUMBER >= 0x03010a
74 # define SUPPORT_GNUTLS_SESS_DESC
76 #if GNUTLS_VERSION_NUMBER >= 0x030300
77 # define GNUTLS_AUTO_GLOBAL_INIT
78 # define GNUTLS_AUTO_PKCS11_MANUAL
80 #if (GNUTLS_VERSION_NUMBER >= 0x030404) \
81 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
83 # define EXIM_HAVE_OCSP
86 #if GNUTLS_VERSION_NUMBER >= 0x030500
87 # define SUPPORT_GNUTLS_KEYLOG
89 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
90 # define SUPPORT_SRV_OCSP_STACK
92 #if GNUTLS_VERSION_NUMBER >= 0x030603
93 # define EXIM_HAVE_TLS1_3
94 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
95 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
99 # if GNUTLS_VERSION_NUMBER >= 0x030000
100 # define DANESSL_USAGE_DANE_TA 2
101 # define DANESSL_USAGE_DANE_EE 3
103 # error GnuTLS version too early for DANE
105 # if GNUTLS_VERSION_NUMBER < 0x999999
106 # define GNUTLS_BROKEN_DANE_VALIDATION
110 #ifndef DISABLE_TLS_RESUME
111 # if GNUTLS_VERSION_NUMBER >= 0x030603
112 # define EXIM_HAVE_TLS_RESUME
114 # warning "GnuTLS library version too old; resumption unsupported"
118 #if GNUTLS_VERSION_NUMBER >= 0x030200
119 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
120 # define EXIM_HAVE_ALPN
125 # include <gnutls/ocsp.h>
128 # include <gnutls/dane.h>
131 #include "tls-cipher-stdname.c"
138 # ifndef DISABLE_TLS_RESUME
139 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
141 # ifdef EXIM_HAVE_TLS1_3
142 builtin_macro_create(US"_HAVE_TLS1_3");
144 # ifdef EXIM_HAVE_OCSP
145 builtin_macro_create(US"_HAVE_TLS_OCSP");
147 # ifdef SUPPORT_SRV_OCSP_STACK
148 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
150 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
151 builtin_macro_create(US"_HAVE_TLS_CA_CACHE");
153 # ifdef EXIM_HAVE_ALPN
154 builtin_macro_create(US"_HAVE_TLS_ALPN");
163 gnutls_global_set_audit_log_function()
166 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
169 /* Local static variables for GnuTLS */
171 /* Values for verify_requirement */
173 enum peer_verify_requirement
174 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
176 /* This holds most state for server or client; with this, we can set up an
177 outbound TLS-enabled connection in an ACL callout, while not stomping all
178 over the TLS variables available for expansion.
180 Some of these correspond to variables in globals.c; those variables will
181 be set to point to content in one of these instances, as appropriate for
182 the stage of the process lifetime.
184 Not handled here: global tlsp->tls_channelbinding.
187 typedef struct exim_gnutls_state {
188 gnutls_session_t session;
190 exim_tlslib_state lib_state;
191 #define x509_cred libdata0
192 #define pri_cache libdata1
194 enum peer_verify_requirement verify_requirement;
198 BOOL peer_cert_verified:1;
199 BOOL peer_dane_verified:1;
200 BOOL trigger_sni_changes:1;
201 BOOL have_set_peerdn:1;
202 BOOL xfer_eof:1; /*XXX never gets set! */
208 const struct host_item *host; /* NULL if server */
209 gnutls_x509_crt_t peercert;
212 uschar *received_sni;
214 const uschar *tls_certificate;
215 const uschar *tls_privatekey;
216 const uschar *tls_sni; /* client send only, not received */
217 const uschar *tls_verify_certificates;
218 const uschar *tls_crl;
219 const uschar *tls_require_ciphers;
221 uschar *exp_tls_certificate;
222 uschar *exp_tls_privatekey;
223 uschar *exp_tls_verify_certificates;
225 uschar *exp_tls_require_ciphers;
226 const uschar *exp_tls_verify_cert_hostnames;
227 #ifndef DISABLE_EVENT
228 uschar *event_action;
231 char * const * dane_data;
232 const int * dane_data_len;
235 tls_support *tlsp; /* set in tls_init() */
240 } exim_gnutls_state_st;
242 static const exim_gnutls_state_st exim_gnutls_state_init = {
243 /* all elements not explicitly intialised here get 0/NULL/FALSE */
248 /* Not only do we have our own APIs which don't pass around state, assuming
249 it's held in globals, GnuTLS doesn't appear to let us register callback data
250 for callbacks, or as part of the session, so we have to keep a "this is the
251 context we're currently dealing with" pointer and rely upon being
252 single-threaded to keep from processing data on an inbound TLS connection while
253 talking to another TLS connection for an outbound check. This does mean that
254 there's no way for heart-beats to be responded to, for the duration of the
256 XXX But see gnutls_session_get_ptr()
259 static exim_gnutls_state_st state_server = {
260 /* all elements not explicitly intialised here get 0/NULL/FALSE */
265 /* dh_params are initialised once within the lifetime of a process using TLS;
266 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
267 don't want to repeat this. */
269 static gnutls_dh_params_t dh_server_params = NULL;
271 static int ssl_session_timeout = 7200; /* Two hours */
273 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
275 /* Guard library core initialisation */
277 static BOOL exim_gnutls_base_init_done = FALSE;
280 static BOOL gnutls_buggy_ocsp = FALSE;
281 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
284 #ifdef EXIM_HAVE_ALPN
285 static int server_seen_alpn = -1; /* count of names */
287 #ifdef EXIM_HAVE_TLS_RESUME
288 static gnutls_datum_t server_sessticket_key;
292 /* ------------------------------------------------------------------------ */
295 #define MAX_HOST_LEN 255
297 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
298 the library logging; a value less than 0 disables the calls to set up logging
299 callbacks. GNuTLS also looks for an environment variable - except not for
300 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
301 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
302 but the env var must be added to /etc/sudoers too. */
303 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
304 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
307 #ifndef EXIM_CLIENT_DH_MIN_BITS
308 # define EXIM_CLIENT_DH_MIN_BITS 1024
311 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
312 can ask for a bit-strength. Without that, we stick to the constant we had
314 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
315 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
318 #define Expand_check_tlsvar(Varname, errstr) \
319 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
321 #if GNUTLS_VERSION_NUMBER >= 0x020c00
322 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
323 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
324 # define HAVE_GNUTLS_RND
325 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
326 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
327 * isn't available sometimes, so this needs to become a conditional
328 * compilation; the sanest way to deal with this being a problem on
329 * older OSes is to block it in the Local/Makefile with this compiler
331 # ifndef AVOID_GNUTLS_PKCS11
332 # define HAVE_GNUTLS_PKCS11
333 # endif /* AVOID_GNUTLS_PKCS11 */
336 #if GNUTLS_VERSION_NUMBER >= 0x030404
337 # define HAVE_GNUTLS_PRF_RFC5705
342 /* ------------------------------------------------------------------------ */
343 /* Callback declarations */
345 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
346 static void exim_gnutls_logger_cb(int level, const char *message);
349 static int exim_sni_handling_cb(gnutls_session_t session);
351 #ifdef EXIM_HAVE_TLS_RESUME
353 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
354 unsigned incoming, const gnutls_datum_t * msg);
358 /*************************************************
360 *************************************************/
362 /* Called from lots of places when errors occur before actually starting to do
363 the TLS handshake, that is, while the session is still in clear. Always returns
364 DEFER for a server and FAIL for a client so that most calls can use "return
365 tls_error(...)" to do this processing and then give an appropriate return. A
366 single function is used for both server and client, because it is called from
367 some shared functions.
370 prefix text to include in the logged error
371 msg additional error string (may be NULL)
372 usually obtained from gnutls_strerror()
373 host NULL if setting up a server;
374 the connected host if setting up a client
375 errstr pointer to returned error string
377 Returns: OK/DEFER/FAIL
381 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
385 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
386 return host ? FAIL : DEFER;
391 tls_error_gnu(exim_gnutls_state_st * state, const uschar *prefix, int err,
394 return tls_error(prefix,
395 state && err == GNUTLS_E_FATAL_ALERT_RECEIVED
396 ? US gnutls_alert_get_name(gnutls_alert_get(state->session))
397 : US gnutls_strerror(err),
398 state ? state->host : NULL,
403 tls_error_sys(const uschar *prefix, int err, const host_item *host,
406 return tls_error(prefix, US strerror(err), host, errstr);
410 /* ------------------------------------------------------------------------ */
416 tls_is_buggy_ocsp(void)
419 uschar maj, mid, mic;
421 s = CUS gnutls_check_version(NULL);
425 while (*s && *s != '.') s++;
433 while (*s && *s != '.') s++;
435 return mic <= (mid == 3 ? 16 : 3);
445 tls_g_init(uschar ** errstr)
448 DEBUG(D_tls) debug_printf("GnuTLS global init required\n");
450 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
451 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
452 which loads modules from a config file, which sounds good and may be wanted
453 by some sysadmin, but also means in common configurations that GNOME keyring
454 environment variables are used and so breaks for users calling mailq.
455 To prevent this, we init PKCS11 first, which is the documented approach. */
457 if (!gnutls_allow_auto_pkcs11)
458 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
459 return tls_error_gnu(NULL, US"gnutls_pkcs11_init", rc, errstr);
462 #ifndef GNUTLS_AUTO_GLOBAL_INIT
463 if ((rc = gnutls_global_init()))
464 return tls_error_gnu(NULL, US"gnutls_global_init", rc, errstr);
467 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
470 gnutls_global_set_log_function(exim_gnutls_logger_cb);
471 /* arbitrarily chosen level; bump up to 9 for more */
472 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
477 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
478 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
481 exim_gnutls_base_init_done = TRUE;
487 /* Daemon-call before each connection. Nothing to do for GnuTLS. */
490 tls_per_lib_daemon_tick(void)
494 /* Daemon one-time initialisation */
497 tls_per_lib_daemon_init(void)
499 uschar * dummy_errstr;
500 static BOOL once = FALSE;
502 if (!exim_gnutls_base_init_done)
503 tls_g_init(&dummy_errstr);
509 #ifdef EXIM_HAVE_TLS_RESUME
510 /* We are dependent on the GnuTLS implementation of the Session Ticket
511 encryption; both the strength and the key rotation period. We hope that
512 the strength at least matches that of the ciphersuite (but GnuTLS does not
515 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
516 if (f.running_in_test_harness) ssl_session_timeout = 6;
519 tls_daemon_creds_reload();
523 /* ------------------------------------------------------------------------ */
525 /*************************************************
526 * Deal with logging errors during I/O *
527 *************************************************/
529 /* We have to get the identity of the peer from saved data.
532 state the current GnuTLS exim state container
533 rc the GnuTLS error code, or 0 if it's a local error
534 when text identifying read or write
535 text local error text when rc is 0
541 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
546 msg = rc == GNUTLS_E_FATAL_ALERT_RECEIVED
547 ? string_sprintf("A TLS fatal alert has been received: %s",
548 US gnutls_alert_get_name(gnutls_alert_get(state->session)))
549 #ifdef GNUTLS_E_PREMATURE_TERMINATION
550 : rc == GNUTLS_E_PREMATURE_TERMINATION && errno
551 ? string_sprintf("%s: syscall: %s", US gnutls_strerror(rc), strerror(errno))
553 : US gnutls_strerror(rc);
555 (void) tls_error(when, msg, state->host, &errstr);
558 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
559 state->host->name, state->host->address, errstr);
562 uschar * conn_info = smtp_get_connection_info();
563 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
564 /* I'd like to get separated H= here, but too hard for now */
565 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
572 /*************************************************
573 * Set various Exim expansion vars *
574 *************************************************/
576 #define exim_gnutls_cert_err(Label) \
579 if (rc != GNUTLS_E_SUCCESS) \
581 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
582 (Label), gnutls_strerror(rc)); \
588 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
592 rc = gnutls_x509_crt_init(crtp);
593 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
595 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
596 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
601 #undef exim_gnutls_cert_err
604 /* We set various Exim global variables from the state, once a session has
605 been established. With TLS callouts, may need to change this to stack
606 variables, or just re-call it with the server state after client callout
609 Make sure anything set here is unset in tls_getc().
613 tls_bits strength indicator
614 tls_certificate_verified bool indicator
615 tls_channelbinding for some SASL mechanisms
618 tls_peercert pointer to library internal
620 tls_sni a (UTF-8) string
621 tls_ourcert pointer to library internal
624 state the relevant exim_gnutls_state_st *
628 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
630 tls_support * tlsp = state->tlsp;
632 tlsp->active.sock = state->fd_out;
633 tlsp->active.tls_ctx = state;
635 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
637 tlsp->certificate_verified = state->peer_cert_verified;
639 tlsp->dane_verified = state->peer_dane_verified;
642 /* note that tls_channelbinding is not saved to the spool file, since it's
643 only available for use for authenticators while this TLS session is running. */
645 tlsp->channelbinding = NULL;
646 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
648 gnutls_datum_t channel = {.data = NULL, .size = 0};
652 # ifdef HAVE_GNUTLS_PRF_RFC5705
653 /* Older libraries may not have GNUTLS_TLS1_3 defined! */
654 if (gnutls_protocol_get_version(state->session) > GNUTLS_TLS1_2)
656 buf = store_get(32, state->host ? GET_TAINTED : GET_UNTAINTED);
657 rc = gnutls_prf_rfc5705(state->session,
658 (size_t)24, "EXPORTER-Channel-Binding", (size_t)0, "",
665 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
668 { DEBUG(D_tls) debug_printf("extracting channel binding: %s\n", gnutls_strerror(rc)); }
671 int old_pool = store_pool;
672 /* Declare the taintedness of the binding info. On server, untainted; on
673 client, tainted - being the Finish msg from the server. */
675 store_pool = POOL_PERM;
676 tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size,
677 state->host ? GET_TAINTED : GET_UNTAINTED);
678 store_pool = old_pool;
679 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n");
684 /* peercert is set in peer_status() */
685 tlsp->peerdn = state->peerdn;
687 /* do not corrupt sni sent by client; record sni rxd by server */
689 tlsp->sni = state->received_sni;
691 /* record our certificate */
693 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
694 gnutls_x509_crt_t crt;
696 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
703 /*************************************************
704 * Setup up DH parameters *
705 *************************************************/
707 /* Generating the D-H parameters may take a long time. They only need to
708 be re-generated every so often, depending on security policy. What we do is to
709 keep these parameters in a file in the spool directory. If the file does not
710 exist, we generate them. This means that it is easy to cause a regeneration.
712 The new file is written as a temporary file and renamed, so that an incomplete
713 file is never present. If two processes both compute some new parameters, you
714 waste a bit of effort, but it doesn't seem worth messing around with locking to
717 Returns: OK/DEFER/FAIL
721 init_server_dh(uschar ** errstr)
724 unsigned int dh_bits;
726 uschar filename_buf[PATH_MAX];
727 uschar *filename = NULL;
729 uschar *exp_tls_dhparam;
730 BOOL use_file_in_spool = FALSE;
731 host_item *host = NULL; /* dummy for macros */
733 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params\n");
735 if ((rc = gnutls_dh_params_init(&dh_server_params)))
736 return tls_error_gnu(NULL, US"gnutls_dh_params_init", rc, errstr);
741 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
744 if (!exp_tls_dhparam)
746 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
747 m.data = US std_dh_prime_default();
748 m.size = Ustrlen(m.data);
750 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
751 use_file_in_spool = TRUE;
752 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
754 DEBUG(D_tls) debug_printf("Requested no DH parameters\n");
757 else if (exp_tls_dhparam[0] != '/')
759 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
760 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
761 m.size = Ustrlen(m.data);
764 filename = exp_tls_dhparam;
768 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
769 return tls_error_gnu(NULL, US"gnutls_dh_params_import_pkcs3", rc, errstr);
770 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
774 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
775 /* If you change this constant, also change dh_param_fn_ext so that we can use a
776 different filename and ensure we have sufficient bits. */
778 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
779 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
781 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits\n",
784 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
786 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits\n",
790 /* Some clients have hard-coded limits. */
791 if (dh_bits > tls_dh_max_bits)
794 debug_printf("tls_dh_max_bits clamping override, using %d bits instead\n",
796 dh_bits = tls_dh_max_bits;
799 if (use_file_in_spool)
801 if (!string_format(filename_buf, sizeof(filename_buf),
802 "%s/gnutls-params-%d", spool_directory, dh_bits))
803 return tls_error(US"overlong filename", NULL, NULL, errstr);
804 filename = filename_buf;
807 /* Open the cache file for reading and if successful, read it and set up the
810 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
816 if (fstat(fd, &statbuf) < 0) /* EIO */
820 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
822 if (!S_ISREG(statbuf.st_mode))
825 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
827 if (!(fp = fdopen(fd, "rb")))
831 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
832 saved_errno, NULL, errstr);
835 m.size = statbuf.st_size;
836 if (!(m.data = store_malloc(m.size)))
839 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
841 if (!(sz = fread(m.data, m.size, 1, fp)))
846 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
850 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
853 return tls_error_gnu(NULL, US"gnutls_dh_params_import_pkcs3", rc, errstr);
854 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
857 /* If the file does not exist, fall through to compute new data and cache it.
858 If there was any other opening error, it is serious. */
860 else if (errno == ENOENT)
864 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
867 return tls_error(string_open_failed("\"%s\" for reading", filename),
870 /* If ret < 0, either the cache file does not exist, or the data it contains
871 is not useful. One particular case of this is when upgrading from an older
872 release of Exim in which the data was stored in a different format. We don't
873 try to be clever and support both formats; we just regenerate new data in this
879 unsigned int dh_bits_gen = dh_bits;
881 if ((PATH_MAX - Ustrlen(filename)) < 10)
882 return tls_error(US"Filename too long to generate replacement",
883 filename, NULL, errstr);
885 temp_fn = string_copy(US"exim-dh.XXXXXXX");
886 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
887 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
888 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
890 /* GnuTLS overshoots!
891 * If we ask for 2236, we might get 2237 or more.
892 * But there's no way to ask GnuTLS how many bits there really are.
893 * We can ask how many bits were used in a TLS session, but that's it!
894 * The prime itself is hidden behind too much abstraction.
895 * So we ask for less, and proceed on a wing and a prayer.
896 * First attempt, subtracted 3 for 2233 and got 2240.
898 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
900 dh_bits_gen = dh_bits - 10;
902 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
907 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
909 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
910 return tls_error_gnu(NULL, US"gnutls_dh_params_generate2", rc, errstr);
912 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
913 and I confirmed that a NULL call to get the size first is how the GnuTLS
914 sample apps handle this. */
918 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
919 GNUTLS_X509_FMT_PEM, m.data, &sz))
920 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
921 return tls_error_gnu(NULL, US"gnutls_dh_params_export_pkcs3(NULL) sizing",
924 if (!(m.data = store_malloc(m.size)))
925 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
927 /* this will return a size 1 less than the allocation size above */
928 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
932 return tls_error_gnu(NULL, US"gnutls_dh_params_export_pkcs3() real", rc, errstr);
934 m.size = sz; /* shrink by 1, probably */
936 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
939 return tls_error_sys(US"TLS cache write D-H params failed",
940 errno, NULL, errstr);
943 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
944 return tls_error_sys(US"TLS cache write D-H params final newline failed",
945 errno, NULL, errstr);
947 if ((rc = close(fd)))
948 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
950 if (Urename(temp_fn, filename) < 0)
951 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
952 temp_fn, filename), errno, NULL, errstr);
954 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
957 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
964 /* Create and install a selfsigned certificate, for use in server mode. */
967 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
969 gnutls_x509_crt_t cert = NULL;
971 gnutls_x509_privkey_t pkey = NULL;
972 const uschar * where;
975 #ifndef SUPPORT_SELFSIGN
976 where = US"library too old";
977 rc = GNUTLS_E_NO_CERTIFICATE_FOUND;
981 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
982 where = US"initialising pkey";
983 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
985 where = US"initialising cert";
986 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
988 where = US"generating pkey"; /* Hangs on 2.12.23 */
989 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
990 #ifdef SUPPORT_PARAM_TO_PK_BITS
991 # ifndef GNUTLS_SEC_PARAM_MEDIUM
992 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
994 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
1001 where = US"configuring cert";
1003 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
1004 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
1005 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
1006 || (rc = gnutls_x509_crt_set_expiration_time(cert, (long)2 * 60 * 60)) /* 2 hour */
1007 || (rc = gnutls_x509_crt_set_key(cert, pkey))
1009 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
1010 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
1011 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
1012 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
1013 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
1014 GNUTLS_OID_X520_COMMON_NAME, 0,
1015 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
1019 where = US"signing cert";
1020 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
1022 where = US"installing selfsign cert";
1024 if ((rc = gnutls_certificate_set_x509_key(state->lib_state.x509_cred,
1031 if (cert) gnutls_x509_crt_deinit(cert);
1032 if (pkey) gnutls_x509_privkey_deinit(pkey);
1036 rc = tls_error_gnu(state, where, rc, errstr);
1043 /* Add certificate and key, from files.
1046 Zero or negative: good. Negate value for certificate index if < 0.
1047 Greater than zero: FAIL or DEFER code.
1051 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
1052 const uschar * certfile, const uschar * keyfile, uschar ** errstr)
1054 int rc = gnutls_certificate_set_x509_key_file(state->lib_state.x509_cred,
1055 CCS certfile, CCS keyfile, GNUTLS_X509_FMT_PEM);
1057 return tls_error_gnu(state,
1058 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
1064 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1065 /* Load an OCSP proof from file for sending by the server. Called
1066 on getting a status-request handshake message, for earlier versions
1070 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1071 gnutls_datum_t * ocsp_response)
1074 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
1076 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1078 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1080 tls_in.ocsp = OCSP_NOT_RESP;
1081 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1084 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1090 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1091 /* Make a note that we saw a status-request */
1093 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
1094 const uschar * data, unsigned size)
1096 /* The values for tls_id are documented here:
1097 https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1100 case 5: /* Status Request */
1101 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
1102 tls_in.ocsp = OCSP_NOT_RESP;
1104 #ifdef EXIM_HAVE_ALPN
1105 case 16: /* Application Layer Protocol Notification */
1106 /* The format of "data" here doesn't seem to be documented, but appears
1107 to be a 2-byte field with a (redundant, given the "size" arg) total length
1108 then a sequence of one-byte size then string (not nul-term) names. The
1109 latter is as described in OpenSSL documentation. */
1111 DEBUG(D_tls) debug_printf("Seen ALPN extension from client (s=%u):", size);
1112 for (const uschar * s = data+2; s-data < size-1; s += *s + 1)
1115 DEBUG(D_tls) debug_printf(" '%.*s'", (int)*s, s+1);
1117 DEBUG(D_tls) debug_printf("\n");
1118 if (server_seen_alpn > 1)
1120 DEBUG(D_tls) debug_printf("TLS: too many ALPNs presented in handshake\n");
1121 return GNUTLS_E_NO_APPLICATION_PROTOCOL;
1129 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
1131 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
1132 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1134 /* Call fn for each extension seen. 3.6.3 onwards */
1135 return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
1136 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
1140 # ifdef notdef_crashes
1141 /* Make a note that we saw a status-response */
1143 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
1144 const unsigned char *data, unsigned size)
1146 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
1147 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1148 if (FALSE && tls_id == 5) /* status_request */
1150 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
1151 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1152 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1158 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
1160 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
1161 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1163 /* Call fn for each extension seen. 3.6.3 onwards */
1164 # ifdef notdef_crashes
1166 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
1169 #endif /*SUPPORT_GNUTLS_EXT_RAW_PARSE*/
1171 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
1172 "Handshake Protocol: Certificate" record.
1173 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
1175 This is different to tls1.2 - where it is a separate record (wireshark term) / handshake message (gnutls term).
1178 #if defined(EXIM_HAVE_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1179 /* Callback for certificate-status, on server. We sent stapled OCSP. */
1181 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
1182 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1184 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
1185 # ifdef SUPPORT_SRV_OCSP_STACK
1186 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1187 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1189 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1194 /* Callback for handshake messages, on server */
1196 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1197 unsigned incoming, const gnutls_datum_t * msg)
1199 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
1202 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1203 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1204 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1205 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1206 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1208 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1209 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1210 # ifdef EXIM_HAVE_TLS_RESUME
1211 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1212 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1221 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1223 tls_server_testharness_ocsp_fiddle(void)
1225 extern char ** environ;
1226 if (environ) for (uschar ** p = USS environ; *p; p++)
1227 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1229 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1230 exim_testharness_disable_ocsp_validity_check = TRUE;
1235 /**************************************************
1236 * One-time init credentials for server and client *
1237 **************************************************/
1240 creds_basic_init(gnutls_certificate_credentials_t x509_cred, BOOL server)
1242 #ifdef SUPPORT_SRV_OCSP_STACK
1243 gnutls_certificate_set_flags(x509_cred, GNUTLS_CERTIFICATE_API_V2);
1245 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1246 if (server && tls_ocsp_file)
1248 if (f.running_in_test_harness)
1249 tls_server_testharness_ocsp_fiddle();
1251 if (exim_testharness_disable_ocsp_validity_check)
1252 gnutls_certificate_set_flags(x509_cred,
1253 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1258 debug_printf("TLS: basic cred init, %s\n", server ? "server" : "client");
1262 creds_load_server_certs(exim_gnutls_state_st * state, const uschar * cert,
1263 const uschar * pkey, const uschar * ocsp, uschar ** errstr)
1265 const uschar * clist = cert;
1266 const uschar * klist = pkey;
1267 const uschar * olist;
1268 int csep = 0, ksep = 0, osep = 0, cnt = 0, rc;
1269 uschar * cfile, * kfile, * ofile;
1270 #ifndef DISABLE_OCSP
1271 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1272 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1275 if (!expand_check(ocsp, US"tls_ocsp_file", &ofile, errstr))
1280 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1282 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1283 return tls_error(US"cert/key setup: out of keys", NULL, NULL, errstr);
1284 else if ((rc = tls_add_certfile(state, NULL, cfile, kfile, errstr)) > 0)
1288 int gnutls_cert_index = -rc;
1289 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1290 gnutls_cert_index, cfile);
1292 #ifndef DISABLE_OCSP
1295 /* Set the OCSP stapling server info */
1296 if (gnutls_buggy_ocsp)
1299 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1301 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1303 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1304 gnutls_cert_index, ofile);
1305 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1306 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1308 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1311 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1313 ocsp_fmt = GNUTLS_X509_FMT_DER;
1317 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1318 state->lib_state.x509_cred, CCS ofile, gnutls_cert_index,
1320 return tls_error_gnu(state,
1321 US"gnutls_certificate_set_ocsp_status_request_file2",
1324 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1326 /* Arrange callbacks for OCSP request observability */
1329 gnutls_handshake_set_hook_function(state->session,
1330 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1332 state->lib_state.ocsp_hook = TRUE;
1336 # if defined(SUPPORT_SRV_OCSP_STACK)
1337 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1338 state->lib_state.x509_cred, gnutls_cert_index,
1339 server_ocsp_stapling_cb, ofile)))
1340 return tls_error_gnu(state,
1341 US"gnutls_certificate_set_ocsp_status_request_function2",
1349 debug_printf("oops; multiple OCSP files not supported\n");
1352 gnutls_certificate_set_ocsp_status_request_function(
1353 state->lib_state.x509_cred, server_ocsp_stapling_cb, ofile);
1355 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1358 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1360 #endif /* DISABLE_OCSP */
1366 creds_load_client_certs(exim_gnutls_state_st * state, const host_item * host,
1367 const uschar * cert, const uschar * pkey, uschar ** errstr)
1369 int rc = tls_add_certfile(state, host, cert, pkey, errstr);
1370 if (rc > 0) return rc;
1371 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1376 creds_load_cabundle(exim_gnutls_state_st * state, const uschar * bundle,
1377 const host_item * host, uschar ** errstr)
1380 struct stat statbuf;
1382 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1383 if (Ustrcmp(bundle, "system") == 0 || Ustrncmp(bundle, "system,", 7) == 0)
1384 cert_count = gnutls_certificate_set_x509_system_trust(state->lib_state.x509_cred);
1388 if (Ustat(bundle, &statbuf) < 0)
1390 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1391 "(tls_verify_certificates): %s", bundle, strerror(errno));
1395 #ifndef SUPPORT_CA_DIR
1396 /* The test suite passes in /dev/null; we could check for that path explicitly,
1397 but who knows if someone has some weird FIFO which always dumps some certs, or
1398 other weirdness. The thing we really want to check is that it's not a
1399 directory, since while OpenSSL supports that, GnuTLS does not.
1400 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1401 if (S_ISDIR(statbuf.st_mode))
1403 log_write(0, LOG_MAIN|LOG_PANIC,
1404 "tls_verify_certificates \"%s\" is a directory", bundle);
1409 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1410 bundle, statbuf.st_size);
1412 if (statbuf.st_size == 0)
1415 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1421 #ifdef SUPPORT_CA_DIR
1422 (statbuf.st_mode & S_IFMT) == S_IFDIR
1424 gnutls_certificate_set_x509_trust_dir(state->lib_state.x509_cred,
1425 CS bundle, GNUTLS_X509_FMT_PEM)
1428 gnutls_certificate_set_x509_trust_file(state->lib_state.x509_cred,
1429 CS bundle, GNUTLS_X509_FMT_PEM);
1431 #ifdef SUPPORT_CA_DIR
1432 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1433 when using the directory-of-certs config model. */
1435 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1437 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1439 state->lib_state.ca_rdn_emulate = TRUE;
1444 return tls_error_gnu(state, US"setting certificate trust", cert_count, errstr);
1446 debug_printf("Added %d certificate authorities\n", cert_count);
1453 creds_load_crl(exim_gnutls_state_st * state, const uschar * crl, uschar ** errstr)
1456 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", crl);
1457 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->lib_state.x509_cred,
1458 CS crl, GNUTLS_X509_FMT_PEM)) < 0)
1459 return tls_error_gnu(state, US"gnutls_certificate_set_x509_crl_file",
1460 cert_count, errstr);
1462 DEBUG(D_tls) debug_printf("Processed %d CRLs\n", cert_count);
1468 creds_load_pristring(exim_gnutls_state_st * state, const uschar * p,
1469 const char ** errpos)
1473 p = exim_default_gnutls_priority;
1475 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1477 return gnutls_priority_init( (gnutls_priority_t *) &state->lib_state.pri_cache,
1482 tls_server_creds_init(void)
1484 uschar * dummy_errstr;
1485 unsigned lifetime = 0;
1487 state_server.lib_state = null_tls_preload;
1488 if (gnutls_certificate_allocate_credentials(
1489 (gnutls_certificate_credentials_t *) &state_server.lib_state.x509_cred))
1491 state_server.lib_state.x509_cred = NULL;
1494 creds_basic_init(state_server.lib_state.x509_cred, TRUE);
1496 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1497 /* If tls_certificate has any $ indicating expansions, it is not good.
1498 If tls_privatekey is set but has $, not good. Likewise for tls_ocsp_file.
1499 If all good (and tls_certificate set), load the cert(s). */
1501 if ( opt_set_and_noexpand(tls_certificate)
1502 # ifndef DISABLE_OCSP
1503 && opt_unset_or_noexpand(tls_ocsp_file)
1505 && opt_unset_or_noexpand(tls_privatekey))
1507 /* Set watches on the filenames. The implementation does de-duplication
1508 so we can just blindly do them all.
1511 if ( tls_set_watch(tls_certificate, TRUE)
1512 # ifndef DISABLE_OCSP
1513 && tls_set_watch(tls_ocsp_file, TRUE)
1515 && tls_set_watch(tls_privatekey, TRUE))
1517 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1518 if (creds_load_server_certs(&state_server, tls_certificate,
1519 tls_privatekey && *tls_privatekey ? tls_privatekey : tls_certificate,
1520 # ifdef DISABLE_OCSP
1525 &dummy_errstr) == 0)
1526 state_server.lib_state.conn_certs = TRUE;
1529 else if ( !tls_certificate && !tls_privatekey
1530 # ifndef DISABLE_OCSP
1534 { /* Generate & preload a selfsigned cert. No files to watch. */
1535 if ((tls_install_selfsign(&state_server, &dummy_errstr)) == OK)
1537 state_server.lib_state.conn_certs = TRUE;
1538 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1542 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1544 /* If tls_verify_certificates is non-empty and has no $, load CAs.
1545 If none was configured and we can't handle "system", treat as empty. */
1547 if ( opt_set_and_noexpand(tls_verify_certificates)
1548 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1549 && Ustrcmp(tls_verify_certificates, "system") != 0
1553 if (tls_set_watch(tls_verify_certificates, FALSE))
1555 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1556 if (creds_load_cabundle(&state_server, tls_verify_certificates,
1557 NULL, &dummy_errstr) != OK)
1559 state_server.lib_state.cabundle = TRUE;
1561 /* If CAs loaded and tls_crl is non-empty and has no $, load it */
1563 if (opt_set_and_noexpand(tls_crl))
1565 if (tls_set_watch(tls_crl, FALSE))
1567 DEBUG(D_tls) debug_printf("TLS: preloading CRL for server\n");
1568 if (creds_load_crl(&state_server, tls_crl, &dummy_errstr) != OK)
1570 state_server.lib_state.crl = TRUE;
1574 DEBUG(D_tls) debug_printf("TLS: not preloading CRL for server\n");
1578 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1579 #endif /* EXIM_HAVE_INOTIFY */
1581 /* If tls_require_ciphers is non-empty and has no $, load the
1582 ciphers priority cache. If unset, load with the default.
1583 (server-only as the client one depends on non/DANE) */
1585 if (!tls_require_ciphers || opt_set_and_noexpand(tls_require_ciphers))
1587 const char * dummy_errpos;
1588 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server: %s\n",
1589 tls_require_ciphers);
1590 if ( creds_load_pristring(&state_server, tls_require_ciphers, &dummy_errpos)
1592 state_server.lib_state.pri_string = TRUE;
1595 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1600 /* Preload whatever creds are static, onto a transport. The client can then
1601 just copy the pointer as it starts up. */
1604 tls_client_creds_init(transport_instance * t, BOOL watch)
1606 smtp_transport_options_block * ob = t->options_block;
1607 exim_gnutls_state_st tpt_dummy_state;
1608 host_item * dummy_host = (host_item *)1;
1609 uschar * dummy_errstr;
1611 if ( !exim_gnutls_base_init_done
1612 && tls_g_init(&dummy_errstr) != OK)
1615 ob->tls_preload = null_tls_preload;
1616 if (gnutls_certificate_allocate_credentials(
1617 (struct gnutls_certificate_credentials_st **)&ob->tls_preload.x509_cred))
1619 ob->tls_preload.x509_cred = NULL;
1622 creds_basic_init(ob->tls_preload.x509_cred, FALSE);
1624 tpt_dummy_state.session = NULL;
1625 tpt_dummy_state.lib_state = ob->tls_preload;
1627 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1628 if ( opt_set_and_noexpand(ob->tls_certificate)
1629 && opt_unset_or_noexpand(ob->tls_privatekey))
1632 || ( tls_set_watch(ob->tls_certificate, FALSE)
1633 && tls_set_watch(ob->tls_privatekey, FALSE)
1636 const uschar * pkey = ob->tls_privatekey;
1639 debug_printf("TLS: preloading client certs for transport '%s'\n", t->name);
1641 /* The state->lib_state.x509_cred is used for the certs load, and is the sole
1642 structure element used. So we can set up a dummy. The hoat arg only
1643 selects a retcode in case of fail, so any value */
1645 if (creds_load_client_certs(&tpt_dummy_state, dummy_host,
1646 ob->tls_certificate, pkey ? pkey : ob->tls_certificate,
1647 &dummy_errstr) == OK)
1648 ob->tls_preload.conn_certs = TRUE;
1653 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1655 /* If tls_verify_certificates is non-empty and has no $, load CAs.
1656 If none was configured and we can't handle "system", treat as empty. */
1658 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1659 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1660 && Ustrcmp(ob->tls_verify_certificates, "system") != 0
1664 if (!watch || tls_set_watch(ob->tls_verify_certificates, FALSE))
1667 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1668 if (creds_load_cabundle(&tpt_dummy_state, ob->tls_verify_certificates,
1669 dummy_host, &dummy_errstr) != OK)
1671 ob->tls_preload.cabundle = TRUE;
1673 if (opt_set_and_noexpand(ob->tls_crl))
1675 if (!watch || tls_set_watch(ob->tls_crl, FALSE))
1677 DEBUG(D_tls) debug_printf("TLS: preloading CRL for transport '%s'\n", t->name);
1678 if (creds_load_crl(&tpt_dummy_state, ob->tls_crl, &dummy_errstr) != OK)
1680 ob->tls_preload.crl = TRUE;
1684 DEBUG(D_tls) debug_printf("TLS: not preloading CRL, for transport '%s'\n", t->name);
1689 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1691 /* We do not preload tls_require_ciphers to to the transport as it implicitly
1692 depends on DANE or plain usage. */
1698 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1699 /* Invalidate the creds cached, by dropping the current ones.
1700 Call when we notice one of the source files has changed. */
1703 tls_server_creds_invalidate(void)
1705 if (state_server.lib_state.pri_cache)
1706 gnutls_priority_deinit(state_server.lib_state.pri_cache);
1707 state_server.lib_state.pri_cache = NULL;
1709 if (state_server.lib_state.x509_cred)
1710 gnutls_certificate_free_credentials(state_server.lib_state.x509_cred);
1711 state_server.lib_state = null_tls_preload;
1716 tls_client_creds_invalidate(transport_instance * t)
1718 smtp_transport_options_block * ob = t->options_block;
1719 if (ob->tls_preload.x509_cred)
1720 gnutls_certificate_free_credentials(ob->tls_preload.x509_cred);
1721 ob->tls_preload = null_tls_preload;
1726 /*************************************************
1727 * Variables re-expanded post-SNI *
1728 *************************************************/
1730 /* Called from both server and client code, via tls_init(), and also from
1731 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1733 We can tell the two apart by state->received_sni being non-NULL in callback.
1735 The callback should not call us unless state->trigger_sni_changes is true,
1736 which we are responsible for setting on the first pass through.
1739 state exim_gnutls_state_st *
1740 errstr error string pointer
1742 Returns: OK/DEFER/FAIL
1746 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1749 const host_item *host = state->host; /* macro should be reconsidered? */
1750 const uschar *saved_tls_certificate = NULL;
1751 const uschar *saved_tls_privatekey = NULL;
1752 const uschar *saved_tls_verify_certificates = NULL;
1753 const uschar *saved_tls_crl = NULL;
1756 /* We check for tls_sni *before* expansion. */
1757 if (!host) /* server */
1758 if (!state->received_sni)
1760 if ( state->tls_certificate
1761 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1762 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1763 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1766 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI\n");
1767 state->trigger_sni_changes = TRUE;
1770 else /* SNI callback case */
1772 /* useful for debugging */
1773 saved_tls_certificate = state->exp_tls_certificate;
1774 saved_tls_privatekey = state->exp_tls_privatekey;
1775 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1776 saved_tls_crl = state->exp_tls_crl;
1779 if (!state->lib_state.x509_cred)
1781 if ((rc = gnutls_certificate_allocate_credentials(
1782 (gnutls_certificate_credentials_t *) &state->lib_state.x509_cred)))
1783 return tls_error_gnu(state, US"gnutls_certificate_allocate_credentials",
1785 creds_basic_init(state->lib_state.x509_cred, !host);
1789 /* remember: Expand_check_tlsvar() is expand_check() but fiddling with
1790 state members, assuming consistent naming; and expand_check() returns
1791 false if expansion failed, unless expansion was forced to fail. */
1793 /* check if we at least have a certificate, before doing expensive
1796 if (!state->lib_state.conn_certs)
1798 if (!Expand_check_tlsvar(tls_certificate, errstr))
1801 /* certificate is mandatory in server, optional in client */
1803 if ( !state->exp_tls_certificate
1804 || !*state->exp_tls_certificate
1807 return tls_install_selfsign(state, errstr);
1809 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1811 if (state->tls_privatekey && !Expand_check_tlsvar(tls_privatekey, errstr))
1814 /* tls_privatekey is optional, defaulting to same file as certificate */
1816 if (!state->tls_privatekey || !*state->tls_privatekey)
1818 state->tls_privatekey = state->tls_certificate;
1819 state->exp_tls_privatekey = state->exp_tls_certificate;
1822 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1825 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1826 state->exp_tls_certificate, state->exp_tls_privatekey);
1828 if (state->received_sni)
1829 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1830 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1833 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1834 load = FALSE; /* avoid re-loading the same certs */
1836 else /* unload the pre-SNI certs before loading new ones */
1838 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair\n");
1839 gnutls_certificate_free_keys(state->lib_state.x509_cred);
1844 ? creds_load_client_certs(state, host, state->exp_tls_certificate,
1845 state->exp_tls_privatekey, errstr)
1846 : creds_load_server_certs(state, state->exp_tls_certificate,
1847 state->exp_tls_privatekey,
1860 debug_printf("%s certs were preloaded\n", host ? "client" : "server");
1862 if (!state->tls_privatekey) state->tls_privatekey = state->tls_certificate;
1863 state->exp_tls_certificate = US state->tls_certificate;
1864 state->exp_tls_privatekey = US state->tls_privatekey;
1866 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1867 if (state->lib_state.ocsp_hook)
1868 gnutls_handshake_set_hook_function(state->session,
1869 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1874 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1875 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1876 error message is provided. However, if we just refrain from setting anything up
1877 in that case, certificate verification fails, which seems to be the correct
1879 If none was configured and we can't handle "system", treat as empty. */
1881 if (!state->lib_state.cabundle)
1883 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1885 if (!Expand_check_tlsvar(tls_verify_certificates, errstr))
1887 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1888 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1889 state->exp_tls_verify_certificates = NULL;
1891 if (state->tls_crl && *state->tls_crl)
1892 if (!Expand_check_tlsvar(tls_crl, errstr))
1895 if (!(state->exp_tls_verify_certificates &&
1896 *state->exp_tls_verify_certificates))
1899 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1900 /* With no tls_verify_certificates, we ignore tls_crl too */
1907 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1910 rc = creds_load_cabundle(state, state->exp_tls_verify_certificates, host, errstr);
1911 if (rc != OK) return rc;
1916 debug_printf("%s CA bundle was preloaded\n", host ? "client" : "server");
1917 state->exp_tls_verify_certificates = US state->tls_verify_certificates;
1919 #ifdef SUPPORT_CA_DIR
1920 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1921 when using the directory-of-certs config model. */
1922 if (state->lib_state.ca_rdn_emulate)
1923 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1928 if (!state->lib_state.crl)
1930 if ( state->tls_crl && *state->tls_crl
1931 && state->exp_tls_crl && *state->exp_tls_crl)
1932 return creds_load_crl(state, state->exp_tls_crl, errstr);
1937 debug_printf("%s CRL was preloaded\n", host ? "client" : "server");
1938 state->exp_tls_crl = US state->tls_crl;
1947 /*************************************************
1948 * Set X.509 state variables *
1949 *************************************************/
1951 /* In GnuTLS, the registered cert/key are not replaced by a later
1952 set of a cert/key, so for SNI support we need a whole new x509_cred
1953 structure. Which means various other non-re-expanded pieces of state
1954 need to be re-set in the new struct, so the setting logic is pulled
1958 state exim_gnutls_state_st *
1959 errstr error string pointer
1961 Returns: OK/DEFER/FAIL
1965 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1968 const host_item *host = state->host; /* macro should be reconsidered? */
1970 /* Create D-H parameters, or read them from the cache file. This function does
1971 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1972 client-side params. */
1976 if (!dh_server_params)
1977 if ((rc = init_server_dh(errstr)) != OK) return rc;
1979 /* Unnecessary & discouraged with 3.6.0 or later, according to docs. But without it,
1980 no DHE- ciphers are advertised. */
1981 gnutls_certificate_set_dh_params(state->lib_state.x509_cred, dh_server_params);
1984 /* Link the credentials to the session. */
1986 if ((rc = gnutls_credentials_set(state->session,
1987 GNUTLS_CRD_CERTIFICATE, state->lib_state.x509_cred)))
1988 return tls_error_gnu(state, US"gnutls_credentials_set", rc, errstr);
1993 /*************************************************
1994 * Initialize for GnuTLS *
1995 *************************************************/
1998 /* Called from both server and client code. In the case of a server, errors
1999 before actual TLS negotiation return DEFER.
2002 host connected host, if client; NULL if server
2003 ob tranport options block, if client; NULL if server
2004 require_ciphers tls_require_ciphers setting
2005 caller_state returned state-info structure
2006 errstr error string pointer
2008 Returns: OK/DEFER/FAIL
2013 const host_item *host,
2014 smtp_transport_options_block * ob,
2015 const uschar * require_ciphers,
2016 exim_gnutls_state_st **caller_state,
2020 exim_gnutls_state_st * state;
2024 if ( !exim_gnutls_base_init_done
2025 && (rc = tls_g_init(errstr)) != OK)
2030 /* For client-side sessions we allocate a context. This lets us run
2031 several in parallel. */
2033 int old_pool = store_pool;
2034 store_pool = POOL_PERM;
2035 state = store_get(sizeof(exim_gnutls_state_st), GET_UNTAINTED);
2036 store_pool = old_pool;
2038 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2039 state->lib_state = ob->tls_preload;
2041 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
2042 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
2044 state->tls_certificate = ob->tls_certificate;
2045 state->tls_privatekey = ob->tls_privatekey;
2046 state->tls_sni = ob->tls_sni;
2047 state->tls_verify_certificates = ob->tls_verify_certificates;
2048 state->tls_crl = ob->tls_crl;
2052 /* Server operations always use the one state_server context. It is not
2053 shared because we have forked a fresh process for every receive. However it
2054 can get re-used for successive TLS sessions on a single TCP connection. */
2056 state = &state_server;
2058 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
2059 rc = gnutls_init(&state->session, GNUTLS_SERVER);
2061 state->tls_certificate = tls_certificate;
2062 state->tls_privatekey = tls_privatekey;
2063 state->tls_sni = NULL;
2064 state->tls_verify_certificates = tls_verify_certificates;
2065 state->tls_crl = tls_crl;
2068 return tls_error_gnu(state, US"gnutls_init", rc, errstr);
2070 state->tls_require_ciphers = require_ciphers;
2073 /* This handles the variables that might get re-expanded after TLS SNI;
2074 tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
2077 debug_printf("Expanding various TLS configuration options for session credentials\n");
2078 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
2080 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
2081 requires a new structure afterwards. */
2083 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
2085 /* set SNI in client, only */
2088 if (!expand_check(state->tls_sni, US"tls_out_sni", &state->tlsp->sni, errstr))
2090 if (state->tlsp->sni && *state->tlsp->sni)
2093 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
2094 sz = Ustrlen(state->tlsp->sni);
2095 if ((rc = gnutls_server_name_set(state->session,
2096 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
2097 return tls_error_gnu(state, US"gnutls_server_name_set", rc, errstr);
2100 else if (state->tls_sni)
2101 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
2102 "have an SNI set for a server [%s]\n", state->tls_sni);
2104 if (!state->lib_state.pri_string)
2106 const uschar * p = NULL;
2107 const char * errpos;
2109 /* This is the priority string support,
2110 http://www.gnutls.org/manual/html_node/Priority-Strings.html
2111 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
2112 This was backwards incompatible, but means Exim no longer needs to track
2113 all algorithms and provide string forms for them. */
2115 if (state->tls_require_ciphers && *state->tls_require_ciphers)
2117 if (!Expand_check_tlsvar(tls_require_ciphers, errstr))
2119 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
2121 p = state->exp_tls_require_ciphers;
2122 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
2126 if ((rc = creds_load_pristring(state, p, &errpos)))
2127 return tls_error_gnu(state, string_sprintf(
2128 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
2129 p, (long)(errpos - CS p), errpos),
2134 DEBUG(D_tls) debug_printf("cipher list preloaded\n");
2135 state->exp_tls_require_ciphers = US state->tls_require_ciphers;
2139 if ((rc = gnutls_priority_set(state->session, state->lib_state.pri_cache)))
2140 return tls_error_gnu(state, US"gnutls_priority_set", rc, errstr);
2142 /* This also sets the server ticket expiration time to the same, and
2143 the STEK rotation time to 3x. */
2145 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
2147 /* Reduce security in favour of increased compatibility, if the admin
2148 decides to make that trade-off. */
2149 if (gnutls_compat_mode)
2151 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
2152 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
2153 gnutls_session_enable_compatibility_mode(state->session);
2155 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
2159 *caller_state = state;
2165 /*************************************************
2166 * Extract peer information *
2167 *************************************************/
2169 static const uschar *
2170 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
2171 gnutls_mac_algorithm_t mac)
2174 gnutls_kx_algorithm_t kx_i;
2175 gnutls_cipher_algorithm_t cipher_i;
2176 gnutls_mac_algorithm_t mac_i;
2179 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
2181 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
2182 return cipher_stdname(cs_id[0], cs_id[1]);
2188 /* Called from both server and client code.
2189 Only this is allowed to set state->peerdn and state->have_set_peerdn
2190 and we use that to detect double-calls.
2192 NOTE: the state blocks last while the TLS connection is up, which is fine
2193 for logging in the server side, but for the client side, we log after teardown
2194 in src/deliver.c. While the session is up, we can twist about states and
2195 repoint tls_* globals, but those variables used for logging or other variable
2196 expansion that happens _after_ delivery need to have a longer life-time.
2198 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
2199 doing this more than once per generation of a state context. We set them in
2200 the state context, and repoint tls_* to them. After the state goes away, the
2201 tls_* copies of the pointers remain valid and client delivery logging is happy.
2203 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
2207 state exim_gnutls_state_st *
2208 errstr pointer to error string
2210 Returns: OK/DEFER/FAIL
2214 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
2216 gnutls_session_t session = state->session;
2217 const gnutls_datum_t * cert_list;
2219 unsigned int cert_list_size = 0;
2220 gnutls_protocol_t protocol;
2221 gnutls_cipher_algorithm_t cipher;
2222 gnutls_kx_algorithm_t kx;
2223 gnutls_mac_algorithm_t mac;
2224 gnutls_certificate_type_t ct;
2225 gnutls_x509_crt_t crt;
2229 if (state->have_set_peerdn)
2231 state->have_set_peerdn = TRUE;
2233 state->peerdn = NULL;
2236 cipher = gnutls_cipher_get(session);
2237 protocol = gnutls_protocol_get_version(session);
2238 mac = gnutls_mac_get(session);
2240 #ifdef GNUTLS_TLS1_3
2241 protocol >= GNUTLS_TLS1_3 ? 0 :
2243 gnutls_kx_get(session);
2245 old_pool = store_pool;
2247 tls_support * tlsp = state->tlsp;
2248 store_pool = POOL_PERM;
2250 #ifdef SUPPORT_GNUTLS_SESS_DESC
2253 uschar * s = US gnutls_session_get_desc(session), c;
2255 /* Nikos M suggests we use this by preference. It returns like:
2256 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
2258 For partial back-compat, put a colon after the TLS version, replace the
2259 )-( grouping with __, replace in-group - with _ and append the :keysize. */
2261 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
2263 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
2265 tlsp->ver = string_copyn(g->s, g->ptr);
2266 for (uschar * p = US tlsp->ver; *p; p++)
2267 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
2269 g = string_catn(g, US":", 1);
2270 if (*s) s++; /* now on _ between groups */
2273 for (*++s && ++s; (c = *s) && c != ')'; s++)
2274 g = string_catn(g, c == '-' ? US"_" : s, 1);
2275 /* now on ) closing group */
2276 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
2277 /* now on _ between groups */
2279 g = string_catn(g, US":", 1);
2280 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
2281 state->ciphersuite = string_from_gstring(g);
2284 state->ciphersuite = string_sprintf("%s:%s:%d",
2285 gnutls_protocol_get_name(protocol),
2286 gnutls_cipher_suite_get_name(kx, cipher, mac),
2287 (int) gnutls_cipher_get_key_size(cipher) * 8);
2289 /* I don't see a way that spaces could occur, in the current GnuTLS
2290 code base, but it was a concern in the old code and perhaps older GnuTLS
2291 releases did return "TLS 1.0"; play it safe, just in case. */
2293 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
2294 tlsp->ver = string_copyn(state->ciphersuite,
2295 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
2298 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
2300 tlsp->cipher = state->ciphersuite;
2301 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
2303 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
2305 store_pool = old_pool;
2308 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
2310 if (!cert_list || cert_list_size == 0)
2312 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
2313 cert_list, cert_list_size);
2314 if (state->verify_requirement >= VERIFY_REQUIRED)
2315 return tls_error(US"certificate verification failed",
2316 US"no certificate received from peer", state->host, errstr);
2320 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
2322 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
2324 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
2325 if (state->verify_requirement >= VERIFY_REQUIRED)
2326 return tls_error(US"certificate verification not possible, unhandled type",
2327 ctn, state->host, errstr);
2331 #define exim_gnutls_peer_err(Label) \
2333 if (rc != GNUTLS_E_SUCCESS) \
2335 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
2336 (Label), gnutls_strerror(rc)); \
2337 if (state->verify_requirement >= VERIFY_REQUIRED) \
2338 return tls_error_gnu(state, (Label), rc, errstr); \
2343 rc = import_cert(&cert_list[0], &crt);
2344 exim_gnutls_peer_err(US"cert 0");
2346 state->tlsp->peercert = state->peercert = crt;
2349 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
2350 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
2352 exim_gnutls_peer_err(US"getting size for cert DN failed");
2353 return FAIL; /* should not happen */
2355 dn_buf = store_get_perm(sz, GET_TAINTED);
2356 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
2357 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
2359 state->peerdn = dn_buf;
2362 #undef exim_gnutls_peer_err
2368 /*************************************************
2369 * Verify peer certificate *
2370 *************************************************/
2372 /* Called from both server and client code.
2373 *Should* be using a callback registered with
2374 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
2375 the peer information, but that's too new for some OSes.
2378 state exim_gnutls_state_st *
2379 errstr where to put an error message
2382 FALSE if the session should be rejected
2383 TRUE if the cert is okay or we just don't care
2387 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
2392 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
2394 rc = peer_status(state, errstr);
2396 if (state->verify_requirement == VERIFY_NONE)
2399 if (rc != OK || !state->peerdn)
2401 verify = GNUTLS_CERT_INVALID;
2402 *errstr = US"certificate not supplied";
2408 if (state->verify_requirement == VERIFY_DANE && state->host)
2410 /* Using dane_verify_session_crt() would be easy, as it does it all for us
2411 including talking to a DNS resolver. But we want to do that bit ourselves
2412 as the testsuite intercepts and fakes its own DNS environment. */
2417 const gnutls_datum_t * certlist =
2418 gnutls_certificate_get_peers(state->session, &lsize);
2419 int usage = tls_out.tlsa_usage;
2421 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2422 /* Split the TLSA records into two sets, TA and EE selectors. Run the
2423 dane-verification separately so that we know which selector verified;
2424 then we know whether to do name-verification (needed for TA but not EE). */
2426 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
2427 { /* a mixed-usage bundle */
2432 for (nrec = 0; state->dane_data_len[nrec]; ) nrec++;
2435 dd = store_get(nrec * sizeof(uschar *), GET_UNTAINTED);
2436 ddl = store_get(nrec * sizeof(int), GET_UNTAINTED);
2439 if ((rc = dane_state_init(&s, 0)))
2442 for (usage = DANESSL_USAGE_DANE_EE;
2443 usage >= DANESSL_USAGE_DANE_TA; usage--)
2444 { /* take records with this usage */
2445 for (j = i = 0; i < nrec; i++)
2446 if (state->dane_data[i][0] == usage)
2448 dd[j] = state->dane_data[i];
2449 ddl[j++] = state->dane_data_len[i];
2456 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
2459 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
2460 gnutls_certificate_type_get(state->session),
2462 usage == DANESSL_USAGE_DANE_EE
2463 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2467 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
2469 else if (verify == 0) /* verification passed */
2477 if (rc) goto tlsa_prob;
2482 if ( (rc = dane_state_init(&s, 0))
2483 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
2485 || (rc = dane_verify_crt_raw(s, certlist, lsize,
2486 gnutls_certificate_type_get(state->session),
2488 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2489 usage == (1 << DANESSL_USAGE_DANE_EE)
2490 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2499 if (verify != 0) /* verification failed */
2502 (void) dane_verification_status_print(verify, &str, 0);
2503 *errstr = US str.data; /* don't bother to free */
2507 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2508 /* If a TA-mode TLSA record was used for verification we must additionally
2509 verify the cert name (but not the CA chain). For EE-mode, skip it. */
2511 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2514 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2517 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2518 /* Assume that the name on the A-record is the one that should be matching
2519 the cert. An alternate view is that the domain part of the email address
2520 is also permissible. */
2522 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2523 CS state->host->name))
2525 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2530 #endif /*SUPPORT_DANE*/
2532 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2535 /* Handle the result of verification. INVALID is set if any others are. */
2537 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2539 state->peer_cert_verified = FALSE;
2542 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2547 if (gnutls_certificate_verification_status_print(verify,
2548 gnutls_certificate_type_get(state->session), &txt, 0)
2549 == GNUTLS_E_SUCCESS)
2551 debug_printf("%s\n", txt.data);
2552 gnutls_free(txt.data);
2556 *errstr = verify & GNUTLS_CERT_REVOKED
2557 ? US"certificate revoked" : US"certificate invalid";
2561 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2562 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2564 if (state->verify_requirement >= VERIFY_REQUIRED)
2567 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2572 /* Client side, check the server's certificate name versus the name on the
2573 A-record for the connection we made. What to do for server side - what name
2574 to use for client? We document that there is no such checking for server
2577 if ( state->exp_tls_verify_cert_hostnames
2578 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2579 CS state->exp_tls_verify_cert_hostnames)
2583 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2584 if (state->verify_requirement >= VERIFY_REQUIRED)
2589 state->peer_cert_verified = TRUE;
2590 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2591 state->peerdn ? state->peerdn : US"<unset>");
2595 state->tlsp->peerdn = state->peerdn;
2600 *errstr = string_sprintf("TLSA record problem: %s",
2601 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2605 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2612 /* ------------------------------------------------------------------------ */
2615 /* Logging function which can be registered with
2616 * gnutls_global_set_log_function()
2617 * gnutls_global_set_log_level() 0..9
2619 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2621 exim_gnutls_logger_cb(int level, const char *message)
2623 size_t len = strlen(message);
2626 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2629 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2630 message[len-1] == '\n' ? "" : "\n");
2635 /* Called after client hello, should handle SNI work.
2636 This will always set tls_sni (state->received_sni) if available,
2637 and may trigger presenting different certificates,
2638 if state->trigger_sni_changes is TRUE.
2640 Should be registered with
2641 gnutls_handshake_set_post_client_hello_function()
2643 "This callback must return 0 on success or a gnutls error code to terminate the
2646 For inability to get SNI information, we return 0.
2647 We only return non-zero if re-setup failed.
2648 Only used for server-side TLS.
2652 exim_sni_handling_cb(gnutls_session_t session)
2654 char sni_name[MAX_HOST_LEN];
2655 size_t data_len = MAX_HOST_LEN;
2656 exim_gnutls_state_st *state = &state_server;
2657 unsigned int sni_type;
2659 uschar * dummy_errstr;
2661 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2662 if (rc != GNUTLS_E_SUCCESS)
2665 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2666 debug_printf("TLS: no SNI presented in handshake\n");
2668 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2669 gnutls_strerror(rc), rc);
2673 if (sni_type != GNUTLS_NAME_DNS)
2675 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2679 /* We now have a UTF-8 string in sni_name */
2680 old_pool = store_pool;
2681 store_pool = POOL_PERM;
2682 state->received_sni = string_copy_taint(US sni_name, GET_TAINTED);
2683 store_pool = old_pool;
2685 /* We set this one now so that variable expansions below will work */
2686 state->tlsp->sni = state->received_sni;
2688 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2689 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2691 if (!state->trigger_sni_changes)
2694 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2696 /* If the setup of certs/etc failed before handshake, TLS would not have
2697 been offered. The best we can do now is abort. */
2698 return GNUTLS_E_APPLICATION_ERROR_MIN;
2701 rc = tls_set_remaining_x509(state, &dummy_errstr);
2702 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2709 #ifndef DISABLE_EVENT
2711 We use this callback to get observability and detail-level control
2712 for an exim TLS connection (either direction), raising a tls:cert event
2713 for each cert in the chain presented by the peer. Any event
2714 can deny verification.
2716 Return 0 for the handshake to continue or non-zero to terminate.
2720 verify_cb(gnutls_session_t session)
2722 const gnutls_datum_t * cert_list;
2723 unsigned int cert_list_size = 0;
2724 gnutls_x509_crt_t crt;
2727 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2729 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2730 while (cert_list_size--)
2732 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2734 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2735 cert_list_size, gnutls_strerror(rc));
2739 state->tlsp->peercert = crt;
2740 if ((yield = event_raise(state->event_action,
2741 US"tls:cert", string_sprintf("%d", cert_list_size), &errno)))
2743 log_write(0, LOG_MAIN,
2744 "SSL verify denied by event-action: depth=%d: %s",
2745 cert_list_size, yield);
2746 return 1; /* reject */
2748 state->tlsp->peercert = NULL;
2758 ddump(gnutls_datum_t * d)
2760 gstring * g = string_get((d->size+1) * 2);
2761 uschar * s = d->data;
2762 for (unsigned i = d->size; i > 0; i--, s++)
2764 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2765 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2771 post_handshake_debug(exim_gnutls_state_st * state)
2773 #ifdef SUPPORT_GNUTLS_SESS_DESC
2774 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2777 #ifdef SUPPORT_GNUTLS_KEYLOG
2778 # ifdef EXIM_HAVE_TLS1_3
2779 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2784 gnutls_datum_t c, s;
2786 /* For TLS1.2 we only want the client random and the master secret */
2787 gnutls_session_get_random(state->session, &c, &s);
2788 gnutls_session_get_master_secret(state->session, &s);
2791 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2794 debug_printf("To get keying info for TLS1.3 is hard:\n"
2795 " Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,\n"
2796 " and make sure it is writable by the Exim runtime user.\n"
2797 " Add SSLKEYLOGFILE to keep_environment in the exim config.\n"
2798 " Start Exim as root.\n"
2799 " If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2800 " (works for TLS1.2 also, and saves cut-paste into file).\n"
2801 " Trying to use add_environment for this will not work\n");
2806 #ifdef EXIM_HAVE_TLS_RESUME
2808 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2809 unsigned incoming, const gnutls_datum_t * msg)
2811 DEBUG(D_tls) debug_printf("newticket cb\n");
2812 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2817 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2819 /* Should the server offer session resumption? */
2820 tls_in.resumption = RESUME_SUPPORTED;
2821 if (verify_check_host(&tls_resumption_hosts) == OK)
2824 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2825 an offered resumption is unacceptable. We lose one resumption per ticket
2826 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2827 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2828 least they go out in a single packet. */
2830 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2831 &server_sessticket_key)))
2832 tls_in.resumption |= RESUME_SERVER_TICKET;
2835 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2837 /* Try to tell if we see a ticket request */
2838 gnutls_handshake_set_hook_function(state->session,
2839 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2844 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2846 if (gnutls_session_resumption_requested(state->session))
2848 /* This tells us the client sent a full ticket. We use a
2849 callback on session-ticket request, elsewhere, to tell
2850 if a client asked for a ticket. */
2852 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2853 DEBUG(D_tls) debug_printf("client requested resumption\n");
2855 if (gnutls_session_is_resumed(state->session))
2857 tls_in.resumption |= RESUME_USED;
2858 DEBUG(D_tls) debug_printf("Session resumed\n");
2861 #endif /* EXIM_HAVE_TLS_RESUME */
2864 #ifdef EXIM_HAVE_ALPN
2865 /* Expand and convert an Exim list to a gnutls_datum list. False return for fail.
2866 NULL plist return for silent no-ALPN.
2870 tls_alpn_plist(uschar ** tls_alpn, const gnutls_datum_t ** plist, unsigned * plen,
2875 if (!expand_check(*tls_alpn, US"tls_alpn", &exp_alpn, errstr))
2880 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
2885 const uschar * list = exp_alpn;
2891 while (string_nextinlist(&list, &sep, NULL, 0)) cnt++;
2893 p = store_get(sizeof(gnutls_datum_t) * cnt, exp_alpn);
2895 for (int i = 0; s = string_nextinlist(&list, &sep, NULL, 0); i++)
2896 { p[i].data = s; p[i].size = Ustrlen(s); }
2897 *plist = (*plen = cnt) ? p : NULL;
2903 tls_server_set_acceptable_alpns(exim_gnutls_state_st * state, uschar ** errstr)
2905 uschar * local_alpn = string_copy(tls_alpn);
2907 const gnutls_datum_t * plist;
2910 if (tls_alpn_plist(&local_alpn, &plist, &plen, errstr) && plist)
2912 /* This seems to be only mandatory if the client sends an ALPN extension;
2913 not trying ALPN is ok. Need to decide how to support server-side must-alpn. */
2915 server_seen_alpn = 0;
2916 if (!(rc = gnutls_alpn_set_protocols(state->session, plist, plen,
2917 GNUTLS_ALPN_MANDATORY)))
2918 gnutls_handshake_set_hook_function(state->session,
2919 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2922 debug_printf("setting alpn protocols: %s\n", US gnutls_strerror(rc));
2925 #endif /* EXIM_HAVE_ALPN */
2927 /* ------------------------------------------------------------------------ */
2928 /* Exported functions */
2933 /*************************************************
2934 * Start a TLS session in a server *
2935 *************************************************/
2937 /* This is called when Exim is running as a server, after having received
2938 the STARTTLS command. It must respond to that command, and then negotiate
2942 errstr pointer to error string
2944 Returns: OK on success
2945 DEFER for errors before the start of the negotiation
2946 FAIL for errors during the negotiation; the server can't
2951 tls_server_start(uschar ** errstr)
2954 exim_gnutls_state_st * state = NULL;
2956 /* Check for previous activation */
2957 if (tls_in.active.sock >= 0)
2959 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2960 smtp_printf("554 Already in TLS\r\n", FALSE);
2964 /* Initialize the library. If it fails, it will already have logged the error
2965 and sent an SMTP response. */
2967 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2970 #ifdef MEASURE_TIMING
2972 gettimeofday(&t0, NULL);
2975 if ((rc = tls_init(NULL, NULL,
2976 tls_require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2978 #ifdef MEASURE_TIMING
2979 report_time_since(&t0, US"server tls_init (delta)");
2983 #ifdef EXIM_HAVE_ALPN
2984 tls_server_set_acceptable_alpns(state, errstr);
2987 #ifdef EXIM_HAVE_TLS_RESUME
2988 tls_server_resume_prehandshake(state);
2991 /* If this is a host for which certificate verification is mandatory or
2992 optional, set up appropriately. */
2994 if (verify_check_host(&tls_verify_hosts) == OK)
2997 debug_printf("TLS: a client certificate will be required\n");
2998 state->verify_requirement = VERIFY_REQUIRED;
2999 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3001 else if (verify_check_host(&tls_try_verify_hosts) == OK)
3004 debug_printf("TLS: a client certificate will be requested but not required\n");
3005 state->verify_requirement = VERIFY_OPTIONAL;
3006 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
3011 debug_printf("TLS: a client certificate will not be requested\n");
3012 state->verify_requirement = VERIFY_NONE;
3013 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3016 #ifndef DISABLE_EVENT
3019 state->event_action = event_action;
3020 gnutls_session_set_ptr(state->session, state);
3021 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3025 /* Register SNI handling; always, even if not in tls_certificate, so that the
3026 expansion variable $tls_sni is always available. */
3028 gnutls_handshake_set_post_client_hello_function(state->session,
3029 exim_sni_handling_cb);
3031 /* Set context and tell client to go ahead, except in the case of TLS startup
3032 on connection, where outputting anything now upsets the clients and tends to
3033 make them disconnect. We need to have an explicit fflush() here, to force out
3034 the response. Other smtp_printf() calls do not need it, because in non-TLS
3035 mode, the fflush() happens when smtp_getc() is called. */
3037 if (!state->tlsp->on_connect)
3039 smtp_printf("220 TLS go ahead\r\n", FALSE);
3043 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3044 that the GnuTLS library doesn't.
3045 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
3046 to set (and clear down afterwards) up a pull-timeout callback function that does
3047 a select, so we're no better off unless avoiding signals becomes an issue. */
3049 gnutls_transport_set_ptr2(state->session,
3050 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
3051 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
3052 state->fd_in = fileno(smtp_in);
3053 state->fd_out = fileno(smtp_out);
3055 sigalrm_seen = FALSE;
3056 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3058 rc = gnutls_handshake(state->session);
3059 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3062 if (rc != GNUTLS_E_SUCCESS)
3064 DEBUG(D_tls) debug_printf(" error %d from gnutls_handshake: %s\n",
3065 rc, gnutls_strerror(rc));
3067 /* It seems that, except in the case of a timeout, we have to close the
3068 connection right here; otherwise if the other end is running OpenSSL it hangs
3069 until the server times out. */
3073 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
3074 #ifndef DISABLE_EVENT
3075 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3077 gnutls_db_remove_session(state->session);
3081 tls_error_gnu(state, US"gnutls_handshake", rc, errstr);
3082 #ifndef DISABLE_EVENT
3083 (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
3085 (void) gnutls_alert_send_appropriate(state->session, rc);
3086 gnutls_deinit(state->session);
3087 gnutls_certificate_free_credentials(state->lib_state.x509_cred);
3088 state->lib_state = null_tls_preload;
3090 shutdown(state->fd_out, SHUT_WR);
3091 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
3092 (void)fclose(smtp_out);
3093 (void)fclose(smtp_in);
3094 smtp_out = smtp_in = NULL;
3100 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3101 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3102 tls_in.ext_master_secret = TRUE;
3105 #ifdef EXIM_HAVE_TLS_RESUME
3106 tls_server_resume_posthandshake(state);
3109 DEBUG(D_tls) post_handshake_debug(state);
3111 #ifdef EXIM_HAVE_ALPN
3112 if (server_seen_alpn > 0)
3115 { /* The client offered ALPN. See what was negotiated. */
3116 gnutls_datum_t p = {.size = 0};
3117 int rc = gnutls_alpn_get_selected_protocol(state->session, &p);
3119 debug_printf("ALPN negotiated: %.*s\n", (int)p.size, p.data);
3121 debug_printf("getting alpn protocol: %s\n", US gnutls_strerror(rc));
3125 else if (server_seen_alpn == 0)
3126 if (verify_check_host(&hosts_require_alpn) == OK)
3128 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_NO_APPLICATION_PROTOCOL);
3129 tls_error(US"handshake", US"ALPN required but not negotiated", NULL, errstr);
3133 DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n");
3135 DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n");
3138 /* Verify after the fact */
3140 if (!verify_certificate(state, errstr))
3142 if (state->verify_requirement != VERIFY_OPTIONAL)
3144 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
3148 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
3152 /* Sets various Exim expansion variables; always safe within server */
3154 extract_exim_vars_from_tls_state(state);
3156 /* TLS has been set up. Adjust the input functions to read via TLS,
3157 and initialize appropriately. */
3159 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3161 receive_getc = tls_getc;
3162 receive_getbuf = tls_getbuf;
3163 receive_get_cache = tls_get_cache;
3164 receive_hasc = tls_hasc;
3165 receive_ungetc = tls_ungetc;
3166 receive_feof = tls_feof;
3167 receive_ferror = tls_ferror;
3176 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
3177 smtp_transport_options_block * ob)
3179 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3181 state->exp_tls_verify_cert_hostnames =
3183 string_domain_utf8_to_alabel(host->certname, NULL);
3188 debug_printf("TLS: server cert verification includes hostname: \"%s\"\n",
3189 state->exp_tls_verify_cert_hostnames);
3197 /* Given our list of RRs from the TLSA lookup, build a lookup block in
3198 GnuTLS-DANE's preferred format. Hang it on the state str for later
3199 use in DANE verification.
3201 We point at the dnsa data not copy it, so it must remain valid until
3202 after verification is done.*/
3205 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
3209 const char ** dane_data;
3210 int * dane_data_len;
3213 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3214 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3215 ) if (rr->type == T_TLSA) i++;
3217 dane_data = store_get(i * sizeof(uschar *), GET_UNTAINTED);
3218 dane_data_len = store_get(i * sizeof(int), GET_UNTAINTED);
3221 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3222 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3223 ) if (rr->type == T_TLSA && rr->size > 3)
3225 const uschar * p = rr->data;
3226 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
3227 uint8_t usage = p[0], sel = p[1], type = p[2];
3230 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
3232 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
3233 || (sel != 0 && sel != 1)
3238 case 0: /* Full: cannot check at present */
3240 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
3242 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
3247 tls_out.tlsa_usage |= 1<<usage;
3248 dane_data[i] = CS p;
3249 dane_data_len[i++] = rr->size;
3252 if (!i) return FALSE;
3254 dane_data[i] = NULL;
3255 dane_data_len[i] = 0;
3257 state->dane_data = (char * const *)dane_data;
3258 state->dane_data_len = dane_data_len;
3265 #ifdef EXIM_HAVE_TLS_RESUME
3266 /* On the client, get any stashed session for the given IP from hints db
3267 and apply it to the ssl-connection for attempted resumption. Although
3268 there is a gnutls_session_ticket_enable_client() interface it is
3269 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
3270 by deafult". There seems to be no way to disable them, so even hosts not
3271 enabled by the transport option will be sent a ticket request. We will
3272 however avoid storing and retrieving session information. */
3275 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
3276 smtp_connect_args * conn_args, smtp_transport_options_block * ob)
3278 tlsp->resumption = RESUME_SUPPORTED;
3279 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, conn_args->host) == OK)
3281 dbdata_tls_session * dt;
3283 open_db dbblock, * dbm_file;
3285 tlsp->host_resumable = TRUE;
3286 tls_client_resmption_key(tlsp, conn_args, ob);
3288 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3289 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
3291 /* We'd like to filter the retrieved session for ticket advisory expiry,
3292 but 3.6.1 seems to give no access to that */
3294 if ((dt = dbfn_read_with_length(dbm_file, tlsp->resume_index, &len)))
3295 if (!(rc = gnutls_session_set_data(session,
3296 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
3298 DEBUG(D_tls) debug_printf("good session\n");
3299 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3301 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
3302 US gnutls_strerror(rc));
3303 dbfn_close(dbm_file);
3310 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
3312 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
3313 but this flag is not set until the second. TLS 1.3 it's the other way about.
3314 Keep both calls as the session data cannot be extracted before handshake
3317 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
3322 DEBUG(D_tls) debug_printf("server offered session ticket\n");
3323 tlsp->ticket_received = TRUE;
3324 tlsp->resumption |= RESUME_SERVER_TICKET;
3326 if (tlsp->host_resumable)
3327 if (!(rc = gnutls_session_get_data2(session, &tkt)))
3329 open_db dbblock, * dbm_file;
3330 int dlen = sizeof(dbdata_tls_session) + tkt.size;
3331 dbdata_tls_session * dt = store_get(dlen, GET_TAINTED);
3333 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
3334 memcpy(dt->session, tkt.data, tkt.size);
3335 gnutls_free(tkt.data);
3337 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3339 /* key for the db is the IP */
3340 dbfn_write(dbm_file, tlsp->resume_index, dt, dlen);
3341 dbfn_close(dbm_file);
3344 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
3348 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
3353 /* With a TLS1.3 session, the ticket(s) are not seen until
3354 the first data read is attempted. And there's often two of them.
3355 Pick them up with this callback. We are also called for 1.2
3359 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
3360 unsigned incoming, const gnutls_datum_t * msg)
3362 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
3363 tls_support * tlsp = state->tlsp;
3365 DEBUG(D_tls) debug_printf("newticket cb\n");
3367 if (!tlsp->ticket_received)
3368 tls_save_session(tlsp, sess, state->host);
3374 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
3375 tls_support * tlsp, smtp_connect_args * conn_args,
3376 smtp_transport_options_block * ob)
3378 gnutls_session_set_ptr(state->session, state);
3379 gnutls_handshake_set_hook_function(state->session,
3380 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
3382 tls_retrieve_session(tlsp, state->session, conn_args, ob);
3386 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
3387 tls_support * tlsp, host_item * host)
3389 if (gnutls_session_is_resumed(state->session))
3391 DEBUG(D_tls) debug_printf("Session resumed\n");
3392 tlsp->resumption |= RESUME_USED;
3395 tls_save_session(tlsp, state->session, host);
3397 #endif /* !DISABLE_TLS_RESUME */
3400 /*************************************************
3401 * Start a TLS session in a client *
3402 *************************************************/
3404 /* Called from the smtp transport after STARTTLS has been accepted.
3407 cctx connection context
3408 conn_args connection details
3409 cookie datum for randomness (not used)
3410 tlsp record details of channel configuration here; must be non-NULL
3411 errstr error string pointer
3413 Returns: TRUE for success with TLS session context set in smtp context,
3418 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3419 void * cookie ARG_UNUSED,
3420 tls_support * tlsp, uschar ** errstr)
3422 host_item * host = conn_args->host; /* for msgs and option-tests */
3423 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3424 smtp_transport_options_block * ob = tb
3425 ? (smtp_transport_options_block *)tb->options_block
3426 : &smtp_transport_option_defaults;
3428 exim_gnutls_state_st * state = NULL;
3429 uschar * cipher_list = NULL;
3431 #ifndef DISABLE_OCSP
3433 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3434 BOOL request_ocsp = require_ocsp ? TRUE
3435 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3438 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
3441 /* If dane is flagged, have either request or require dane for this host, and
3442 a TLSA record found. Therefore, dane verify required. Which implies cert must
3443 be requested and supplied, dane verify must pass, and cert verify irrelevant
3444 (incl. hostnames), and (caller handled) require_tls and sni=$domain */
3446 if (conn_args->dane && ob->dane_require_tls_ciphers)
3448 /* not using Expand_check_tlsvar because not yet in state */
3449 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3450 &cipher_list, errstr))
3452 cipher_list = cipher_list && *cipher_list
3453 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
3458 cipher_list = ob->tls_require_ciphers;
3461 #ifdef MEASURE_TIMING
3463 gettimeofday(&t0, NULL);
3466 if (tls_init(host, ob, cipher_list, &state, tlsp, errstr) != OK)
3469 #ifdef MEASURE_TIMING
3470 report_time_since(&t0, US"client tls_init (delta)");
3475 #ifdef EXIM_HAVE_ALPN
3477 const gnutls_datum_t * plist;
3480 if (!tls_alpn_plist(&ob->tls_alpn, &plist, &plen, errstr))
3483 if (gnutls_alpn_set_protocols(state->session, plist, plen, 0) != 0)
3485 tls_error(US"alpn init", NULL, state->host, errstr);
3489 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
3492 log_write(0, LOG_MAIN, "ALPN unusable with this GnuTLS library version; ignoring \"%s\"\n",
3497 int dh_min_bits = ob->tls_dh_min_bits;
3498 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
3501 debug_printf("WARNING: tls_dh_min_bits far too low,"
3502 " clamping %d up to %d\n",
3503 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
3504 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
3507 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
3508 " acceptable bits to %d\n",
3510 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
3513 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
3514 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
3515 the specified host patterns if one of them is defined */
3518 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
3521 debug_printf("TLS: server certificate DANE required\n");
3522 state->verify_requirement = VERIFY_DANE;
3523 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3527 if ( ( state->exp_tls_verify_certificates
3528 && !ob->tls_verify_hosts
3529 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
3531 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3534 tls_client_setup_hostname_checks(host, state, ob);
3536 debug_printf("TLS: server certificate verification required\n");
3537 state->verify_requirement = VERIFY_REQUIRED;
3538 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3540 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3542 tls_client_setup_hostname_checks(host, state, ob);
3544 debug_printf("TLS: server certificate verification optional\n");
3545 state->verify_requirement = VERIFY_OPTIONAL;
3546 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
3551 debug_printf("TLS: server certificate verification not required\n");
3552 state->verify_requirement = VERIFY_NONE;
3553 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3556 #ifndef DISABLE_OCSP
3557 /* supported since GnuTLS 3.1.3 */
3560 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
3561 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
3562 NULL, 0, NULL)) != OK)
3564 tls_error_gnu(state, US"cert-status-req", rc, errstr);
3567 tlsp->ocsp = OCSP_NOT_RESP;
3571 #ifdef EXIM_HAVE_TLS_RESUME
3572 tls_client_resume_prehandshake(state, tlsp, conn_args, ob);
3575 #ifndef DISABLE_EVENT
3576 if (tb && tb->event_action)
3578 state->event_action = tb->event_action;
3579 gnutls_session_set_ptr(state->session, state);
3580 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3584 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
3585 state->fd_in = cctx->sock;
3586 state->fd_out = cctx->sock;
3588 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
3589 /* There doesn't seem to be a built-in timeout on connection. */
3591 sigalrm_seen = FALSE;
3592 ALARM(ob->command_timeout);
3594 rc = gnutls_handshake(state->session);
3595 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3598 if (rc != GNUTLS_E_SUCCESS)
3602 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
3603 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
3606 tls_error_gnu(state, US"gnutls_handshake", rc, errstr);
3610 DEBUG(D_tls) post_handshake_debug(state);
3614 if (!verify_certificate(state, errstr))
3616 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
3620 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3621 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3622 tlsp->ext_master_secret = TRUE;
3625 #ifndef DISABLE_OCSP
3630 gnutls_datum_t stapling;
3631 gnutls_ocsp_resp_t resp;
3632 gnutls_datum_t printed;
3636 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
3637 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
3639 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
3642 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
3643 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
3644 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
3647 debug_printf("%.4096s", printed.data);
3648 gnutls_free(printed.data);
3651 (void) tls_error_gnu(state, US"ocsp decode", rc, errstr);
3653 (void) tls_error_gnu(state, US"ocsp decode", rc, errstr);
3656 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3658 tlsp->ocsp = OCSP_FAILED;
3659 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3665 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3666 tlsp->ocsp = OCSP_VFIED;
3671 #ifdef EXIM_HAVE_TLS_RESUME
3672 tls_client_resume_posthandshake(state, tlsp, host);
3675 #ifdef EXIM_HAVE_ALPN
3676 if (ob->tls_alpn) /* We requested. See what was negotiated. */
3678 gnutls_datum_t p = {.size = 0};
3680 if (gnutls_alpn_get_selected_protocol(state->session, &p) == 0)
3681 { DEBUG(D_tls) debug_printf("ALPN negotiated: '%.*s'\n", (int)p.size, p.data); }
3682 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
3684 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_NO_APPLICATION_PROTOCOL);
3685 tls_error(US"handshake", US"ALPN required but not negotiated", state->host, errstr);
3689 DEBUG(D_tls) debug_printf("No ALPN negotiated");
3693 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3695 extract_exim_vars_from_tls_state(state);
3697 cctx->tls_ctx = state;
3706 ct_ctx client TLS context pointer, or NULL for the one global server context
3710 tls_shutdown_wr(void * ct_ctx)
3712 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3713 tls_support * tlsp = state->tlsp;
3715 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3717 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3719 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
3720 gnutls_bye(state->session, GNUTLS_SHUT_WR);
3723 /*************************************************
3724 * Close down a TLS session *
3725 *************************************************/
3727 /* This is also called from within a delivery subprocess forked from the
3728 daemon, to shut down the TLS library, without actually doing a shutdown (which
3729 would tamper with the TLS session in the parent process).
3732 ct_ctx client context pointer, or NULL for the one global server context
3733 do_shutdown 0 no data-flush or TLS close-alert
3734 1 if TLS close-alert is to be sent,
3735 2 if also response to be waited for (2s timeout)
3741 tls_close(void * ct_ctx, int do_shutdown)
3743 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3744 tls_support * tlsp = state->tlsp;
3746 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3750 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3751 do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
3753 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3755 #ifdef EXIM_TCP_CORK
3756 if (do_shutdown == TLS_SHUTDOWN_WAIT)
3757 (void) setsockopt(tlsp->active.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
3760 /* The library seems to have no way to only wait for a peer's
3761 shutdown, so handle the same as TLS_SHUTDOWN_WAIT */
3764 gnutls_bye(state->session,
3765 do_shutdown > TLS_SHUTDOWN_NOWAIT ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3769 if (!ct_ctx) /* server */
3771 receive_getc = smtp_getc;
3772 receive_getbuf = smtp_getbuf;
3773 receive_get_cache = smtp_get_cache;
3774 receive_hasc = smtp_hasc;
3775 receive_ungetc = smtp_ungetc;
3776 receive_feof = smtp_feof;
3777 receive_ferror = smtp_ferror;
3780 gnutls_deinit(state->session);
3781 gnutls_certificate_free_credentials(state->lib_state.x509_cred);
3782 state->lib_state = null_tls_preload;
3784 tlsp->active.sock = -1;
3785 tlsp->active.tls_ctx = NULL;
3786 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3787 tlsp->channelbinding = NULL;
3790 if (state->xfer_buffer) store_free(state->xfer_buffer);
3797 tls_refill(unsigned lim)
3799 exim_gnutls_state_st * state = &state_server;
3802 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, buffersize=%u)\n",
3803 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3805 sigalrm_seen = FALSE;
3806 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3810 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3811 MIN(ssl_xfer_buffer_size, lim));
3812 while (inbytes == GNUTLS_E_AGAIN);
3814 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3816 if (had_command_timeout) /* set by signal handler */
3817 smtp_command_timeout_exit(); /* does not return */
3818 if (had_command_sigterm)
3819 smtp_command_sigterm_exit();
3820 if (had_data_timeout)
3821 smtp_data_timeout_exit();
3822 if (had_data_sigint)
3823 smtp_data_sigint_exit();
3825 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3826 TLS session has been closed down, not that the socket itself has been closed
3827 down. Revert to non-TLS handling. */
3831 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3832 state->xfer_error = TRUE;
3836 else if (inbytes == 0)
3838 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3839 tls_close(NULL, TLS_NO_SHUTDOWN);
3843 /* Handle genuine errors */
3845 else if (inbytes < 0)
3847 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3848 record_io_error(state, (int) inbytes, US"recv", NULL);
3849 state->xfer_error = TRUE;
3852 #ifndef DISABLE_DKIM
3853 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3855 state->xfer_buffer_hwm = (int) inbytes;
3856 state->xfer_buffer_lwm = 0;
3860 /*************************************************
3861 * TLS version of getc *
3862 *************************************************/
3864 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3865 it refills the buffer via the GnuTLS reading function.
3866 Only used by the server-side TLS.
3868 This feeds DKIM and should be used for all message-body reads.
3870 Arguments: lim Maximum amount to read/buffer
3871 Returns: the next character or EOF
3875 tls_getc(unsigned lim)
3877 exim_gnutls_state_st * state = &state_server;
3879 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3880 if (!tls_refill(lim))
3881 return state->xfer_error ? EOF : smtp_getc(lim);
3883 /* Something in the buffer; return next uschar */
3885 return state->xfer_buffer[state->xfer_buffer_lwm++];
3891 exim_gnutls_state_st * state = &state_server;
3892 return state->xfer_buffer_lwm < state->xfer_buffer_hwm;
3896 tls_getbuf(unsigned * len)
3898 exim_gnutls_state_st * state = &state_server;
3902 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3903 if (!tls_refill(*len))
3905 if (!state->xfer_error) return smtp_getbuf(len);
3910 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3912 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3913 state->xfer_buffer_lwm += size;
3919 /* Get up to the given number of bytes from any cached data, and feed to dkim. */
3921 tls_get_cache(unsigned lim)
3923 #ifndef DISABLE_DKIM
3924 exim_gnutls_state_st * state = &state_server;
3925 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3929 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3935 tls_could_getc(void)
3937 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3938 || gnutls_record_check_pending(state_server.session) > 0;
3942 /*************************************************
3943 * Read bytes from TLS channel *
3944 *************************************************/
3946 /* This does not feed DKIM, so if the caller uses this for reading message body,
3947 then the caller must feed DKIM.
3950 ct_ctx client context pointer, or NULL for the one global server context
3954 Returns: the number of bytes read
3955 -1 after a failed read, including EOF
3959 tls_read(void * ct_ctx, uschar *buff, size_t len)
3961 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3967 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3969 debug_printf("*** PROBABLY A BUG *** " \
3970 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3971 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3974 debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, len=" SIZE_T_FMT ")\n",
3975 state->session, buff, len);
3979 inbytes = gnutls_record_recv(state->session, buff, len);
3980 while (inbytes == GNUTLS_E_AGAIN);
3982 if (inbytes > 0) return inbytes;
3985 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3989 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3990 record_io_error(state, (int)inbytes, US"recv", NULL);
3999 /*************************************************
4000 * Write bytes down TLS channel *
4001 *************************************************/
4005 ct_ctx client context pointer, or NULL for the one global server context
4008 more more data expected soon
4010 Calling with len zero and more unset will flush buffered writes. The buff
4011 argument can be null for that case.
4013 Returns: the number of bytes after a successful write,
4014 -1 after a failed write
4018 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
4022 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
4025 if (more && !state->corked)
4027 DEBUG(D_tls) debug_printf("gnutls_record_cork(session=%p)\n", state->session);
4028 gnutls_record_cork(state->session);
4029 state->corked = TRUE;
4033 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
4034 buff, left, more ? ", more" : "");
4038 DEBUG(D_tls) debug_printf("gnutls_record_send(session=%p, buffer=%p, left=" SIZE_T_FMT ")\n",
4039 state->session, buff, left);
4043 outbytes = gnutls_record_send(state->session, buff, left);
4044 while (outbytes == GNUTLS_E_AGAIN);
4046 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
4050 #ifdef GNUTLS_E_PREMATURE_TERMINATION
4051 if ( outbytes == GNUTLS_E_PREMATURE_TERMINATION && errno == ECONNRESET
4052 && !ct_ctx && f.smtp_in_quit
4054 { /* Outlook, dammit */
4055 if (LOGGING(protocol_detail))
4056 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4057 " SMTP response and TLS close\n", sender_host_address);
4059 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4060 " client reset TCP before TLS close\n", sender_host_address);
4065 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
4066 record_io_error(state, outbytes, US"send", NULL);
4072 record_io_error(state, 0, US"send", US"TLS channel closed on write");
4083 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
4089 if (!more && state->corked)
4091 DEBUG(D_tls) debug_printf("gnutls_record_uncork(session=%p)\n", state->session);
4093 /* We can't use GNUTLS_RECORD_WAIT here, as it retries on
4094 GNUTLS_E_AGAIN || GNUTLS_E_INTR, which would break our timeout set by alarm().
4095 The GNUTLS_E_AGAIN should not happen ever, as our sockets are blocking anyway.
4096 But who knows. (That all relies on the fact that GNUTLS_E_INTR and GNUTLS_E_AGAIN
4097 match the EINTR and EAGAIN errno values.) */
4098 outbytes = gnutls_record_uncork(state->session, 0);
4099 while (outbytes == GNUTLS_E_AGAIN);
4103 record_io_error(state, len, US"uncork", NULL);
4107 state->corked = FALSE;
4117 /*************************************************
4118 * Random number generation *
4119 *************************************************/
4121 /* Pseudo-random number generation. The result is not expected to be
4122 cryptographically strong but not so weak that someone will shoot themselves
4123 in the foot using it as a nonce in input in some email header scheme or
4124 whatever weirdness they'll twist this into. The result should handle fork()
4125 and avoid repeating sequences. OpenSSL handles that for us.
4129 Returns a random number in range [0, max-1]
4132 #ifdef HAVE_GNUTLS_RND
4134 vaguely_random_number(int max)
4138 uschar smallbuf[sizeof(r)];
4143 needed_len = sizeof(r);
4144 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4145 asked for a number less than 10. */
4147 for (r = max, i = 0; r; ++i)
4153 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
4156 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback\n");
4157 return vaguely_random_number_fallback(max);
4160 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4163 /* We don't particularly care about weighted results; if someone wants
4164 * smooth distribution and cares enough then they should submit a patch then. */
4167 #else /* HAVE_GNUTLS_RND */
4169 vaguely_random_number(int max)
4171 return vaguely_random_number_fallback(max);
4173 #endif /* HAVE_GNUTLS_RND */
4178 /*************************************************
4179 * Let tls_require_ciphers be checked at startup *
4180 *************************************************/
4182 /* The tls_require_ciphers option, if set, must be something which the
4185 Returns: NULL on success, or error message
4189 tls_validate_require_cipher(void)
4192 uschar *expciphers = NULL;
4193 gnutls_priority_t priority_cache;
4195 uschar * dummy_errstr;
4197 #ifdef GNUTLS_AUTO_GLOBAL_INIT
4198 # define validate_check_rc(Label) do { \
4199 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \
4200 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4201 # define return_deinit(Label) do { return (Label); } while (0)
4203 # define validate_check_rc(Label) do { \
4204 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
4205 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4206 # define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
4209 if (exim_gnutls_base_init_done)
4210 log_write(0, LOG_MAIN|LOG_PANIC,
4211 "already initialised GnuTLS, Exim developer bug");
4213 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
4214 if (!gnutls_allow_auto_pkcs11)
4216 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
4217 validate_check_rc(US"gnutls_pkcs11_init");
4220 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4221 rc = gnutls_global_init();
4222 validate_check_rc(US"gnutls_global_init()");
4224 exim_gnutls_base_init_done = TRUE;
4226 if (!(tls_require_ciphers && *tls_require_ciphers))
4227 return_deinit(NULL);
4229 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4231 return_deinit(US"failed to expand tls_require_ciphers");
4233 if (!(expciphers && *expciphers))
4234 return_deinit(NULL);
4237 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4239 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
4240 validate_check_rc(string_sprintf(
4241 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
4242 expciphers, (long)(errpos - CS expciphers), errpos));
4244 #undef return_deinit
4245 #undef validate_check_rc
4246 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4247 gnutls_global_deinit();
4256 /*************************************************
4257 * Report the library versions. *
4258 *************************************************/
4260 /* See a description in tls-openssl.c for an explanation of why this exists.
4262 Arguments: string to append to
4267 tls_version_report(gstring * g)
4269 return string_fmt_append(g,
4270 "Library version: GnuTLS: Compile: %s\n"
4273 gnutls_check_version(NULL));
4276 #endif /*!MACRO_PREDEF*/
4279 /* End of tls-gnu.c */