1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) Phil Pennock 2012 */
7 /* Copyright (c) The Exim Maintainers 2020 - 2021 */
8 /* See the file NOTICE for conditions of use and distribution. */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
43 /* needed to disable PKCS11 autoload unless requested */
44 #if GNUTLS_VERSION_NUMBER >= 0x020c00
45 # include <gnutls/pkcs11.h>
46 # define SUPPORT_PARAM_TO_PK_BITS
48 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
52 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
53 # warning "GnuTLS library version too old; tls:cert event unsupported"
54 # define DISABLE_EVENT
56 #if GNUTLS_VERSION_NUMBER >= 0x030000
57 # define SUPPORT_SELFSIGN /* Uncertain what version is first usable but 2.12.23 is not */
59 #if GNUTLS_VERSION_NUMBER >= 0x030306
60 # define SUPPORT_CA_DIR
62 # undef SUPPORT_CA_DIR
64 #if GNUTLS_VERSION_NUMBER >= 0x030014
65 # define SUPPORT_SYSDEFAULT_CABUNDLE
67 #if GNUTLS_VERSION_NUMBER >= 0x030104
68 # define GNUTLS_CERT_VFY_STATUS_PRINT
70 #if GNUTLS_VERSION_NUMBER >= 0x030109
73 #if GNUTLS_VERSION_NUMBER >= 0x03010a
74 # define SUPPORT_GNUTLS_SESS_DESC
76 #if GNUTLS_VERSION_NUMBER >= 0x030300
77 # define GNUTLS_AUTO_GLOBAL_INIT
78 # define GNUTLS_AUTO_PKCS11_MANUAL
80 #if (GNUTLS_VERSION_NUMBER >= 0x030404) \
81 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
83 # define EXIM_HAVE_OCSP
86 #if GNUTLS_VERSION_NUMBER >= 0x030500
87 # define SUPPORT_GNUTLS_KEYLOG
89 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
90 # define SUPPORT_SRV_OCSP_STACK
92 #if GNUTLS_VERSION_NUMBER >= 0x030600
93 # define GNUTLS_AUTO_DHPARAMS
95 #if GNUTLS_VERSION_NUMBER >= 0x030603
96 # define EXIM_HAVE_TLS1_3
97 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
98 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
102 # if GNUTLS_VERSION_NUMBER >= 0x030000
103 # define DANESSL_USAGE_DANE_TA 2
104 # define DANESSL_USAGE_DANE_EE 3
106 # error GnuTLS version too early for DANE
108 # if GNUTLS_VERSION_NUMBER < 0x999999
109 # define GNUTLS_BROKEN_DANE_VALIDATION
113 #ifndef DISABLE_TLS_RESUME
114 # if GNUTLS_VERSION_NUMBER >= 0x030603
115 # define EXIM_HAVE_TLS_RESUME
117 # warning "GnuTLS library version too old; resumption unsupported"
121 #if GNUTLS_VERSION_NUMBER >= 0x030200
122 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
123 # define EXIM_HAVE_ALPN
128 # include <gnutls/ocsp.h>
131 # include <gnutls/dane.h>
134 #include "tls-cipher-stdname.c"
141 # ifndef DISABLE_TLS_RESUME
142 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
144 # ifdef EXIM_HAVE_TLS1_3
145 builtin_macro_create(US"_HAVE_TLS1_3");
147 # ifdef EXIM_HAVE_OCSP
148 builtin_macro_create(US"_HAVE_TLS_OCSP");
150 # ifdef SUPPORT_SRV_OCSP_STACK
151 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
153 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
154 builtin_macro_create(US"_HAVE_TLS_CA_CACHE");
156 # ifdef EXIM_HAVE_ALPN
157 builtin_macro_create(US"_HAVE_TLS_ALPN");
166 gnutls_global_set_audit_log_function()
169 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
172 /* Local static variables for GnuTLS */
174 /* Values for verify_requirement */
176 enum peer_verify_requirement
177 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
179 /* This holds most state for server or client; with this, we can set up an
180 outbound TLS-enabled connection in an ACL callout, while not stomping all
181 over the TLS variables available for expansion.
183 Some of these correspond to variables in globals.c; those variables will
184 be set to point to content in one of these instances, as appropriate for
185 the stage of the process lifetime.
187 Not handled here: global tlsp->tls_channelbinding.
190 typedef struct exim_gnutls_state {
191 gnutls_session_t session;
193 exim_tlslib_state lib_state;
194 #define x509_cred libdata0
195 #define pri_cache libdata1
197 enum peer_verify_requirement verify_requirement;
201 BOOL peer_cert_verified:1;
202 BOOL peer_dane_verified:1;
203 BOOL trigger_sni_changes:1;
204 BOOL have_set_peerdn:1;
205 BOOL xfer_eof:1; /*XXX never gets set! */
211 const struct host_item *host; /* NULL if server */
212 gnutls_x509_crt_t peercert;
215 uschar *received_sni;
217 const uschar *tls_certificate;
218 const uschar *tls_privatekey;
219 const uschar *tls_sni; /* client send only, not received */
220 const uschar *tls_verify_certificates;
221 const uschar *tls_crl;
222 const uschar *tls_require_ciphers;
224 uschar *exp_tls_certificate;
225 uschar *exp_tls_privatekey;
226 uschar *exp_tls_verify_certificates;
228 uschar *exp_tls_require_ciphers;
229 const uschar *exp_tls_verify_cert_hostnames;
230 #ifndef DISABLE_EVENT
231 uschar *event_action;
234 char * const * dane_data;
235 const int * dane_data_len;
238 tls_support *tlsp; /* set in tls_init() */
243 } exim_gnutls_state_st;
245 static const exim_gnutls_state_st exim_gnutls_state_init = {
246 /* all elements not explicitly intialised here get 0/NULL/FALSE */
251 /* Not only do we have our own APIs which don't pass around state, assuming
252 it's held in globals, GnuTLS doesn't appear to let us register callback data
253 for callbacks, or as part of the session, so we have to keep a "this is the
254 context we're currently dealing with" pointer and rely upon being
255 single-threaded to keep from processing data on an inbound TLS connection while
256 talking to another TLS connection for an outbound check. This does mean that
257 there's no way for heart-beats to be responded to, for the duration of the
259 XXX But see gnutls_session_get_ptr()
262 static exim_gnutls_state_st state_server = {
263 /* all elements not explicitly intialised here get 0/NULL/FALSE */
268 #ifndef GNUTLS_AUTO_DHPARAMS
269 /* dh_params are initialised once within the lifetime of a process using TLS;
270 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
271 don't want to repeat this. */
273 static gnutls_dh_params_t dh_server_params = NULL;
276 static int ssl_session_timeout = 7200; /* Two hours */
278 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
280 /* Guard library core initialisation */
282 static BOOL exim_gnutls_base_init_done = FALSE;
285 static BOOL gnutls_buggy_ocsp = FALSE;
286 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
289 #ifdef EXIM_HAVE_ALPN
290 static int server_seen_alpn = -1; /* count of names */
292 #ifdef EXIM_HAVE_TLS_RESUME
293 static gnutls_datum_t server_sessticket_key;
297 /* ------------------------------------------------------------------------ */
300 #define MAX_HOST_LEN 255
302 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
303 the library logging; a value less than 0 disables the calls to set up logging
304 callbacks. GNuTLS also looks for an environment variable - except not for
305 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
306 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
307 but the env var must be added to /etc/sudoers too. */
308 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
309 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
312 #ifndef EXIM_CLIENT_DH_MIN_BITS
313 # define EXIM_CLIENT_DH_MIN_BITS 1024
316 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
317 can ask for a bit-strength. Without that, we stick to the constant we had
319 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
320 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
323 #define Expand_check_tlsvar(Varname, errstr) \
324 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
326 #if GNUTLS_VERSION_NUMBER >= 0x020c00
327 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
328 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
329 # define HAVE_GNUTLS_RND
330 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
331 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
332 * isn't available sometimes, so this needs to become a conditional
333 * compilation; the sanest way to deal with this being a problem on
334 * older OSes is to block it in the Local/Makefile with this compiler
336 # ifndef AVOID_GNUTLS_PKCS11
337 # define HAVE_GNUTLS_PKCS11
338 # endif /* AVOID_GNUTLS_PKCS11 */
344 /* ------------------------------------------------------------------------ */
345 /* Callback declarations */
347 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
348 static void exim_gnutls_logger_cb(int level, const char *message);
351 static int exim_sni_handling_cb(gnutls_session_t session);
353 #ifdef EXIM_HAVE_TLS_RESUME
355 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
356 unsigned incoming, const gnutls_datum_t * msg);
360 /*************************************************
362 *************************************************/
364 /* Called from lots of places when errors occur before actually starting to do
365 the TLS handshake, that is, while the session is still in clear. Always returns
366 DEFER for a server and FAIL for a client so that most calls can use "return
367 tls_error(...)" to do this processing and then give an appropriate return. A
368 single function is used for both server and client, because it is called from
369 some shared functions.
372 prefix text to include in the logged error
373 msg additional error string (may be NULL)
374 usually obtained from gnutls_strerror()
375 host NULL if setting up a server;
376 the connected host if setting up a client
377 errstr pointer to returned error string
379 Returns: OK/DEFER/FAIL
383 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
387 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
388 return host ? FAIL : DEFER;
393 tls_error_gnu(exim_gnutls_state_st * state, const uschar *prefix, int err,
396 return tls_error(prefix,
397 state && err == GNUTLS_E_FATAL_ALERT_RECEIVED
398 ? US gnutls_alert_get_name(gnutls_alert_get(state->session))
399 : US gnutls_strerror(err),
400 state ? state->host : NULL,
405 tls_error_sys(const uschar *prefix, int err, const host_item *host,
408 return tls_error(prefix, US strerror(err), host, errstr);
412 /* ------------------------------------------------------------------------ */
418 tls_is_buggy_ocsp(void)
421 uschar maj, mid, mic;
423 s = CUS gnutls_check_version(NULL);
427 while (*s && *s != '.') s++;
435 while (*s && *s != '.') s++;
437 return mic <= (mid == 3 ? 16 : 3);
447 tls_g_init(uschar ** errstr)
450 DEBUG(D_tls) debug_printf("GnuTLS global init required\n");
452 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
453 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
454 which loads modules from a config file, which sounds good and may be wanted
455 by some sysadmin, but also means in common configurations that GNOME keyring
456 environment variables are used and so breaks for users calling mailq.
457 To prevent this, we init PKCS11 first, which is the documented approach. */
459 if (!gnutls_allow_auto_pkcs11)
460 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
461 return tls_error_gnu(NULL, US"gnutls_pkcs11_init", rc, errstr);
464 #ifndef GNUTLS_AUTO_GLOBAL_INIT
465 if ((rc = gnutls_global_init()))
466 return tls_error_gnu(NULL, US"gnutls_global_init", rc, errstr);
469 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
472 gnutls_global_set_log_function(exim_gnutls_logger_cb);
473 /* arbitrarily chosen level; bump up to 9 for more */
474 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
479 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
480 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
483 exim_gnutls_base_init_done = TRUE;
489 /* Daemon-call before each connection. Nothing to do for GnuTLS. */
492 tls_per_lib_daemon_tick(void)
496 /* Daemon one-time initialisation */
499 tls_per_lib_daemon_init(void)
501 uschar * dummy_errstr;
502 static BOOL once = FALSE;
504 if (!exim_gnutls_base_init_done)
505 tls_g_init(&dummy_errstr);
511 #ifdef EXIM_HAVE_TLS_RESUME
512 /* We are dependent on the GnuTLS implementation of the Session Ticket
513 encryption; both the strength and the key rotation period. We hope that
514 the strength at least matches that of the ciphersuite (but GnuTLS does not
517 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
518 if (f.running_in_test_harness) ssl_session_timeout = 6;
521 tls_daemon_creds_reload();
525 /* ------------------------------------------------------------------------ */
527 /*************************************************
528 * Deal with logging errors during I/O *
529 *************************************************/
531 /* We have to get the identity of the peer from saved data.
534 state the current GnuTLS exim state container
535 rc the GnuTLS error code, or 0 if it's a local error
536 when text identifying read or write
537 text local error text when rc is 0
543 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
548 msg = rc == GNUTLS_E_FATAL_ALERT_RECEIVED
549 ? string_sprintf("A TLS fatal alert has been received: %s",
550 US gnutls_alert_get_name(gnutls_alert_get(state->session)))
551 #ifdef GNUTLS_E_PREMATURE_TERMINATION
552 : rc == GNUTLS_E_PREMATURE_TERMINATION && errno
553 ? string_sprintf("%s: syscall: %s", US gnutls_strerror(rc), strerror(errno))
555 : US gnutls_strerror(rc);
557 (void) tls_error(when, msg, state->host, &errstr);
560 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
561 state->host->name, state->host->address, errstr);
564 uschar * conn_info = smtp_get_connection_info();
565 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
566 /* I'd like to get separated H= here, but too hard for now */
567 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
574 /*************************************************
575 * Set various Exim expansion vars *
576 *************************************************/
578 #define exim_gnutls_cert_err(Label) \
581 if (rc != GNUTLS_E_SUCCESS) \
583 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
584 (Label), gnutls_strerror(rc)); \
590 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
594 rc = gnutls_x509_crt_init(crtp);
595 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
597 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
598 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
603 #undef exim_gnutls_cert_err
606 /* We set various Exim global variables from the state, once a session has
607 been established. With TLS callouts, may need to change this to stack
608 variables, or just re-call it with the server state after client callout
611 Make sure anything set here is unset in tls_getc().
615 tls_bits strength indicator
616 tls_certificate_verified bool indicator
617 tls_channelbinding for some SASL mechanisms
620 tls_peercert pointer to library internal
622 tls_sni a (UTF-8) string
623 tls_ourcert pointer to library internal
626 state the relevant exim_gnutls_state_st *
630 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
632 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
635 gnutls_datum_t channel;
637 tls_support * tlsp = state->tlsp;
639 tlsp->active.sock = state->fd_out;
640 tlsp->active.tls_ctx = state;
642 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
644 tlsp->certificate_verified = state->peer_cert_verified;
646 tlsp->dane_verified = state->peer_dane_verified;
649 /* note that tls_channelbinding is not saved to the spool file, since it's
650 only available for use for authenticators while this TLS session is running. */
652 tlsp->channelbinding = NULL;
653 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
656 if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
657 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
660 /* Declare the taintedness of the binding info. On server, untainted; on
661 client, tainted - being the Finish msg from the server. */
663 old_pool = store_pool;
664 store_pool = POOL_PERM;
665 tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size,
667 store_pool = old_pool;
668 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n");
672 /* peercert is set in peer_status() */
673 tlsp->peerdn = state->peerdn;
675 /* do not corrupt sni sent by client; record sni rxd by server */
677 tlsp->sni = state->received_sni;
679 /* record our certificate */
681 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
682 gnutls_x509_crt_t crt;
684 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
691 #ifndef GNUTLS_AUTO_DHPARAMS
692 /*************************************************
693 * Setup up DH parameters *
694 *************************************************/
696 /* Generating the D-H parameters may take a long time. They only need to
697 be re-generated every so often, depending on security policy. What we do is to
698 keep these parameters in a file in the spool directory. If the file does not
699 exist, we generate them. This means that it is easy to cause a regeneration.
701 The new file is written as a temporary file and renamed, so that an incomplete
702 file is never present. If two processes both compute some new parameters, you
703 waste a bit of effort, but it doesn't seem worth messing around with locking to
706 Returns: OK/DEFER/FAIL
710 init_server_dh(uschar ** errstr)
713 unsigned int dh_bits;
714 gnutls_datum_t m = {.data = NULL, .size = 0};
715 uschar filename_buf[PATH_MAX];
716 uschar *filename = NULL;
718 uschar *exp_tls_dhparam;
719 BOOL use_file_in_spool = FALSE;
720 host_item *host = NULL; /* dummy for macros */
722 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params\n");
724 if ((rc = gnutls_dh_params_init(&dh_server_params)))
725 return tls_error_gnu(NULL, US"gnutls_dh_params_init", rc, errstr);
727 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
730 if (!exp_tls_dhparam)
732 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
733 m.data = US std_dh_prime_default();
734 m.size = Ustrlen(m.data);
736 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
737 use_file_in_spool = TRUE;
738 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
740 DEBUG(D_tls) debug_printf("Requested no DH parameters\n");
743 else if (exp_tls_dhparam[0] != '/')
745 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
746 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
747 m.size = Ustrlen(m.data);
750 filename = exp_tls_dhparam;
754 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
755 return tls_error_gnu(NULL, US"gnutls_dh_params_import_pkcs3", rc, errstr);
756 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
760 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
761 /* If you change this constant, also change dh_param_fn_ext so that we can use a
762 different filename and ensure we have sufficient bits. */
764 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
765 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
767 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits\n",
770 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
772 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits\n",
776 /* Some clients have hard-coded limits. */
777 if (dh_bits > tls_dh_max_bits)
780 debug_printf("tls_dh_max_bits clamping override, using %d bits instead\n",
782 dh_bits = tls_dh_max_bits;
785 if (use_file_in_spool)
787 if (!string_format(filename_buf, sizeof(filename_buf),
788 "%s/gnutls-params-%d", spool_directory, dh_bits))
789 return tls_error(US"overlong filename", NULL, NULL, errstr);
790 filename = filename_buf;
793 /* Open the cache file for reading and if successful, read it and set up the
796 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
802 if (fstat(fd, &statbuf) < 0) /* EIO */
806 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
808 if (!S_ISREG(statbuf.st_mode))
811 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
813 if (!(fp = fdopen(fd, "rb")))
817 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
818 saved_errno, NULL, errstr);
821 m.size = statbuf.st_size;
822 if (!(m.data = store_malloc(m.size)))
825 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
827 if (!(sz = fread(m.data, m.size, 1, fp)))
832 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
836 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
839 return tls_error_gnu(NULL, US"gnutls_dh_params_import_pkcs3", rc, errstr);
840 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
843 /* If the file does not exist, fall through to compute new data and cache it.
844 If there was any other opening error, it is serious. */
846 else if (errno == ENOENT)
850 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
853 return tls_error(string_open_failed("\"%s\" for reading", filename),
856 /* If ret < 0, either the cache file does not exist, or the data it contains
857 is not useful. One particular case of this is when upgrading from an older
858 release of Exim in which the data was stored in a different format. We don't
859 try to be clever and support both formats; we just regenerate new data in this
865 unsigned int dh_bits_gen = dh_bits;
867 if ((PATH_MAX - Ustrlen(filename)) < 10)
868 return tls_error(US"Filename too long to generate replacement",
869 filename, NULL, errstr);
871 temp_fn = string_copy(US"exim-dh.XXXXXXX");
872 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
873 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
874 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
876 /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But
877 there's no way to ask GnuTLS how many bits there really are. We can ask
878 how many bits were used in a TLS session, but that's it! The prime itself
879 is hidden behind too much abstraction. So we ask for less, and proceed on
880 a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */
882 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
884 dh_bits_gen = dh_bits - 10;
886 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
891 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
893 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
894 return tls_error_gnu(NULL, US"gnutls_dh_params_generate2", rc, errstr);
896 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
897 and I confirmed that a NULL call to get the size first is how the GnuTLS
898 sample apps handle this. */
902 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
903 GNUTLS_X509_FMT_PEM, m.data, &sz))
904 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
905 return tls_error_gnu(NULL, US"gnutls_dh_params_export_pkcs3(NULL) sizing",
908 if (!(m.data = store_malloc(m.size)))
909 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
911 /* this will return a size 1 less than the allocation size above */
912 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
916 return tls_error_gnu(NULL, US"gnutls_dh_params_export_pkcs3() real", rc, errstr);
918 m.size = sz; /* shrink by 1, probably */
920 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
923 return tls_error_sys(US"TLS cache write D-H params failed",
924 errno, NULL, errstr);
927 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
928 return tls_error_sys(US"TLS cache write D-H params final newline failed",
929 errno, NULL, errstr);
931 if ((rc = close(fd)))
932 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
934 if (Urename(temp_fn, filename) < 0)
935 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
936 temp_fn, filename), errno, NULL, errstr);
938 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
941 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
949 /* Create and install a selfsigned certificate, for use in server mode. */
952 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
954 gnutls_x509_crt_t cert = NULL;
956 gnutls_x509_privkey_t pkey = NULL;
957 const uschar * where;
960 #ifndef SUPPORT_SELFSIGN
961 where = US"library too old";
962 rc = GNUTLS_E_NO_CERTIFICATE_FOUND;
966 DEBUG(D_tls) debug_printf("TLS: generating selfsigned server cert\n");
967 where = US"initialising pkey";
968 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
970 where = US"initialising cert";
971 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
973 where = US"generating pkey"; /* Hangs on 2.12.23 */
974 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
975 #ifdef SUPPORT_PARAM_TO_PK_BITS
976 # ifndef GNUTLS_SEC_PARAM_MEDIUM
977 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
979 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
986 where = US"configuring cert";
988 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
989 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
990 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
991 || (rc = gnutls_x509_crt_set_expiration_time(cert, (long)2 * 60 * 60)) /* 2 hour */
992 || (rc = gnutls_x509_crt_set_key(cert, pkey))
994 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
995 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
996 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
997 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
998 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
999 GNUTLS_OID_X520_COMMON_NAME, 0,
1000 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
1004 where = US"signing cert";
1005 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
1007 where = US"installing selfsign cert";
1009 if ((rc = gnutls_certificate_set_x509_key(state->lib_state.x509_cred,
1016 if (cert) gnutls_x509_crt_deinit(cert);
1017 if (pkey) gnutls_x509_privkey_deinit(pkey);
1021 rc = tls_error_gnu(state, where, rc, errstr);
1028 /* Add certificate and key, from files.
1031 Zero or negative: good. Negate value for certificate index if < 0.
1032 Greater than zero: FAIL or DEFER code.
1036 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
1037 const uschar * certfile, const uschar * keyfile, uschar ** errstr)
1039 int rc = gnutls_certificate_set_x509_key_file(state->lib_state.x509_cred,
1040 CCS certfile, CCS keyfile, GNUTLS_X509_FMT_PEM);
1042 return tls_error_gnu(state,
1043 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
1049 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1050 /* Load an OCSP proof from file for sending by the server. Called
1051 on getting a status-request handshake message, for earlier versions
1055 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1056 gnutls_datum_t * ocsp_response)
1059 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
1061 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1063 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1065 tls_in.ocsp = OCSP_NOT_RESP;
1066 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1069 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1075 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1076 /* Make a note that we saw a status-request */
1078 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
1079 const uschar * data, unsigned size)
1081 /* The values for tls_id are documented here:
1082 https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1085 case 5: /* Status Request */
1086 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
1087 tls_in.ocsp = OCSP_NOT_RESP;
1089 #ifdef EXIM_HAVE_ALPN
1090 case 16: /* Application Layer Protocol Notification */
1091 /* The format of "data" here doesn't seem to be documented, but appears
1092 to be a 2-byte field with a (redundant, given the "size" arg) total length
1093 then a sequence of one-byte size then string (not nul-term) names. The
1094 latter is as described in OpenSSL documentation. */
1096 DEBUG(D_tls) debug_printf("Seen ALPN extension from client (s=%u):", size);
1097 for (const uschar * s = data+2; s-data < size-1; s += *s + 1)
1100 DEBUG(D_tls) debug_printf(" '%.*s'", (int)*s, s+1);
1102 DEBUG(D_tls) debug_printf("\n");
1103 if (server_seen_alpn > 1)
1105 DEBUG(D_tls) debug_printf("TLS: too many ALPNs presented in handshake\n");
1106 return GNUTLS_E_NO_APPLICATION_PROTOCOL;
1114 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
1116 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
1117 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1119 /* Call fn for each extension seen. 3.6.3 onwards */
1120 return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
1121 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
1125 # ifdef notdef_crashes
1126 /* Make a note that we saw a status-response */
1128 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
1129 const unsigned char *data, unsigned size)
1131 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
1132 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1133 if (FALSE && tls_id == 5) /* status_request */
1135 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
1136 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1137 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1143 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
1145 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
1146 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1148 /* Call fn for each extension seen. 3.6.3 onwards */
1149 # ifdef notdef_crashes
1151 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
1154 #endif /*SUPPORT_GNUTLS_EXT_RAW_PARSE*/
1156 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
1157 "Handshake Protocol: Certificate" record.
1158 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
1160 This is different to tls1.2 - where it is a separate record (wireshark term) / handshake message (gnutls term).
1163 #if defined(EXIM_HAVE_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1164 /* Callback for certificate-status, on server. We sent stapled OCSP. */
1166 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
1167 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1169 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
1170 # ifdef SUPPORT_SRV_OCSP_STACK
1171 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1172 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1174 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1179 /* Callback for handshake messages, on server */
1181 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1182 unsigned incoming, const gnutls_datum_t * msg)
1184 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
1187 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1188 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1189 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1190 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1191 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1193 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1194 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1195 # ifdef EXIM_HAVE_TLS_RESUME
1196 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1197 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1206 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1208 tls_server_testharness_ocsp_fiddle(void)
1210 extern char ** environ;
1211 if (environ) for (uschar ** p = USS environ; *p; p++)
1212 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1214 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1215 exim_testharness_disable_ocsp_validity_check = TRUE;
1220 /**************************************************
1221 * One-time init credentials for server and client *
1222 **************************************************/
1225 creds_basic_init(gnutls_certificate_credentials_t x509_cred, BOOL server)
1227 #ifdef SUPPORT_SRV_OCSP_STACK
1228 gnutls_certificate_set_flags(x509_cred, GNUTLS_CERTIFICATE_API_V2);
1230 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1231 if (server && tls_ocsp_file)
1233 if (f.running_in_test_harness)
1234 tls_server_testharness_ocsp_fiddle();
1236 if (exim_testharness_disable_ocsp_validity_check)
1237 gnutls_certificate_set_flags(x509_cred,
1238 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1243 debug_printf("TLS: basic cred init, %s\n", server ? "server" : "client");
1247 creds_load_server_certs(exim_gnutls_state_st * state, const uschar * cert,
1248 const uschar * pkey, const uschar * ocsp, uschar ** errstr)
1250 const uschar * clist = cert;
1251 const uschar * klist = pkey;
1252 const uschar * olist;
1253 int csep = 0, ksep = 0, osep = 0, cnt = 0, rc;
1254 uschar * cfile, * kfile, * ofile;
1255 #ifndef DISABLE_OCSP
1256 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1257 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1260 if (!expand_check(ocsp, US"tls_ocsp_file", &ofile, errstr))
1265 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1267 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1268 return tls_error(US"cert/key setup: out of keys", NULL, NULL, errstr);
1269 else if ((rc = tls_add_certfile(state, NULL, cfile, kfile, errstr)) > 0)
1273 int gnutls_cert_index = -rc;
1274 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1275 gnutls_cert_index, cfile);
1277 #ifndef DISABLE_OCSP
1280 /* Set the OCSP stapling server info */
1281 if (gnutls_buggy_ocsp)
1284 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1286 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1288 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1289 gnutls_cert_index, ofile);
1290 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1291 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1293 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1296 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1298 ocsp_fmt = GNUTLS_X509_FMT_DER;
1302 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1303 state->lib_state.x509_cred, CCS ofile, gnutls_cert_index,
1305 return tls_error_gnu(state,
1306 US"gnutls_certificate_set_ocsp_status_request_file2",
1309 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1311 /* Arrange callbacks for OCSP request observability */
1314 gnutls_handshake_set_hook_function(state->session,
1315 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1317 state->lib_state.ocsp_hook = TRUE;
1321 # if defined(SUPPORT_SRV_OCSP_STACK)
1322 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1323 state->lib_state.x509_cred, gnutls_cert_index,
1324 server_ocsp_stapling_cb, ofile)))
1325 return tls_error_gnu(state,
1326 US"gnutls_certificate_set_ocsp_status_request_function2",
1334 debug_printf("oops; multiple OCSP files not supported\n");
1337 gnutls_certificate_set_ocsp_status_request_function(
1338 state->lib_state.x509_cred, server_ocsp_stapling_cb, ofile);
1340 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1343 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1345 #endif /* DISABLE_OCSP */
1351 creds_load_client_certs(exim_gnutls_state_st * state, const host_item * host,
1352 const uschar * cert, const uschar * pkey, uschar ** errstr)
1354 int rc = tls_add_certfile(state, host, cert, pkey, errstr);
1355 if (rc > 0) return rc;
1356 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1361 creds_load_cabundle(exim_gnutls_state_st * state, const uschar * bundle,
1362 const host_item * host, uschar ** errstr)
1365 struct stat statbuf;
1367 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1368 if (Ustrcmp(bundle, "system") == 0 || Ustrncmp(bundle, "system,", 7) == 0)
1369 cert_count = gnutls_certificate_set_x509_system_trust(state->lib_state.x509_cred);
1373 if (Ustat(bundle, &statbuf) < 0)
1375 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1376 "(tls_verify_certificates): %s", bundle, strerror(errno));
1380 #ifndef SUPPORT_CA_DIR
1381 /* The test suite passes in /dev/null; we could check for that path explicitly,
1382 but who knows if someone has some weird FIFO which always dumps some certs, or
1383 other weirdness. The thing we really want to check is that it's not a
1384 directory, since while OpenSSL supports that, GnuTLS does not.
1385 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1386 if (S_ISDIR(statbuf.st_mode))
1388 log_write(0, LOG_MAIN|LOG_PANIC,
1389 "tls_verify_certificates \"%s\" is a directory", bundle);
1394 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1395 bundle, statbuf.st_size);
1397 if (statbuf.st_size == 0)
1400 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1406 #ifdef SUPPORT_CA_DIR
1407 (statbuf.st_mode & S_IFMT) == S_IFDIR
1409 gnutls_certificate_set_x509_trust_dir(state->lib_state.x509_cred,
1410 CS bundle, GNUTLS_X509_FMT_PEM)
1413 gnutls_certificate_set_x509_trust_file(state->lib_state.x509_cred,
1414 CS bundle, GNUTLS_X509_FMT_PEM);
1416 #ifdef SUPPORT_CA_DIR
1417 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1418 when using the directory-of-certs config model. */
1420 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1422 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1424 state->lib_state.ca_rdn_emulate = TRUE;
1429 return tls_error_gnu(state, US"setting certificate trust", cert_count, errstr);
1431 debug_printf("Added %d certificate authorities\n", cert_count);
1438 creds_load_crl(exim_gnutls_state_st * state, const uschar * crl, uschar ** errstr)
1441 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", crl);
1442 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->lib_state.x509_cred,
1443 CS crl, GNUTLS_X509_FMT_PEM)) < 0)
1444 return tls_error_gnu(state, US"gnutls_certificate_set_x509_crl_file",
1445 cert_count, errstr);
1447 DEBUG(D_tls) debug_printf("Processed %d CRLs\n", cert_count);
1453 creds_load_pristring(exim_gnutls_state_st * state, const uschar * p,
1454 const char ** errpos)
1458 p = exim_default_gnutls_priority;
1460 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1462 return gnutls_priority_init( (gnutls_priority_t *) &state->lib_state.pri_cache,
1467 tls_server_creds_init(void)
1469 uschar * dummy_errstr;
1470 unsigned lifetime = 0;
1472 state_server.lib_state = null_tls_preload;
1473 if (gnutls_certificate_allocate_credentials(
1474 (gnutls_certificate_credentials_t *) &state_server.lib_state.x509_cred))
1476 state_server.lib_state.x509_cred = NULL;
1479 creds_basic_init(state_server.lib_state.x509_cred, TRUE);
1481 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1482 /* If tls_certificate has any $ indicating expansions, it is not good.
1483 If tls_privatekey is set but has $, not good. Likewise for tls_ocsp_file.
1484 If all good (and tls_certificate set), load the cert(s). */
1486 if ( opt_set_and_noexpand(tls_certificate)
1487 # ifndef DISABLE_OCSP
1488 && opt_unset_or_noexpand(tls_ocsp_file)
1490 && opt_unset_or_noexpand(tls_privatekey))
1492 /* Set watches on the filenames. The implementation does de-duplication
1493 so we can just blindly do them all.
1496 if ( tls_set_watch(tls_certificate, TRUE)
1497 # ifndef DISABLE_OCSP
1498 && tls_set_watch(tls_ocsp_file, TRUE)
1500 && tls_set_watch(tls_privatekey, TRUE))
1502 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1503 if (creds_load_server_certs(&state_server, tls_certificate,
1504 tls_privatekey && *tls_privatekey ? tls_privatekey : tls_certificate,
1505 # ifdef DISABLE_OCSP
1510 &dummy_errstr) == 0)
1511 state_server.lib_state.conn_certs = TRUE;
1514 else if ( !tls_certificate && !tls_privatekey
1515 # ifndef DISABLE_OCSP
1519 { /* Generate & preload a selfsigned cert. No files to watch. */
1520 if ((tls_install_selfsign(&state_server, &dummy_errstr)) == OK)
1522 state_server.lib_state.conn_certs = TRUE;
1523 lifetime = f.running_in_test_harness ? 2 : 60 * 60; /* 1 hour */
1527 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1529 /* If tls_verify_certificates is non-empty and has no $, load CAs.
1530 If none was configured and we can't handle "system", treat as empty. */
1532 if ( opt_set_and_noexpand(tls_verify_certificates)
1533 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1534 && Ustrcmp(tls_verify_certificates, "system") != 0
1538 if (tls_set_watch(tls_verify_certificates, FALSE))
1540 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1541 if (creds_load_cabundle(&state_server, tls_verify_certificates,
1542 NULL, &dummy_errstr) != OK)
1544 state_server.lib_state.cabundle = TRUE;
1546 /* If CAs loaded and tls_crl is non-empty and has no $, load it */
1548 if (opt_set_and_noexpand(tls_crl))
1550 if (tls_set_watch(tls_crl, FALSE))
1552 DEBUG(D_tls) debug_printf("TLS: preloading CRL for server\n");
1553 if (creds_load_crl(&state_server, tls_crl, &dummy_errstr) != OK)
1555 state_server.lib_state.crl = TRUE;
1559 DEBUG(D_tls) debug_printf("TLS: not preloading CRL for server\n");
1563 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1564 #endif /* EXIM_HAVE_INOTIFY */
1566 /* If tls_require_ciphers is non-empty and has no $, load the
1567 ciphers priority cache. If unset, load with the default.
1568 (server-only as the client one depends on non/DANE) */
1570 if (!tls_require_ciphers || opt_set_and_noexpand(tls_require_ciphers))
1572 const char * dummy_errpos;
1573 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server: %s\n",
1574 tls_require_ciphers);
1575 if ( creds_load_pristring(&state_server, tls_require_ciphers, &dummy_errpos)
1577 state_server.lib_state.pri_string = TRUE;
1580 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1585 /* Preload whatever creds are static, onto a transport. The client can then
1586 just copy the pointer as it starts up. */
1589 tls_client_creds_init(transport_instance * t, BOOL watch)
1591 smtp_transport_options_block * ob = t->options_block;
1592 exim_gnutls_state_st tpt_dummy_state;
1593 host_item * dummy_host = (host_item *)1;
1594 uschar * dummy_errstr;
1596 if ( !exim_gnutls_base_init_done
1597 && tls_g_init(&dummy_errstr) != OK)
1600 ob->tls_preload = null_tls_preload;
1601 if (gnutls_certificate_allocate_credentials(
1602 (struct gnutls_certificate_credentials_st **)&ob->tls_preload.x509_cred))
1604 ob->tls_preload.x509_cred = NULL;
1607 creds_basic_init(ob->tls_preload.x509_cred, FALSE);
1609 tpt_dummy_state.session = NULL;
1610 tpt_dummy_state.lib_state = ob->tls_preload;
1612 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1613 if ( opt_set_and_noexpand(ob->tls_certificate)
1614 && opt_unset_or_noexpand(ob->tls_privatekey))
1617 || ( tls_set_watch(ob->tls_certificate, FALSE)
1618 && tls_set_watch(ob->tls_privatekey, FALSE)
1621 const uschar * pkey = ob->tls_privatekey;
1624 debug_printf("TLS: preloading client certs for transport '%s'\n", t->name);
1626 /* The state->lib_state.x509_cred is used for the certs load, and is the sole
1627 structure element used. So we can set up a dummy. The hoat arg only
1628 selects a retcode in case of fail, so any value */
1630 if (creds_load_client_certs(&tpt_dummy_state, dummy_host,
1631 ob->tls_certificate, pkey ? pkey : ob->tls_certificate,
1632 &dummy_errstr) == OK)
1633 ob->tls_preload.conn_certs = TRUE;
1638 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1640 /* If tls_verify_certificates is non-empty and has no $, load CAs.
1641 If none was configured and we can't handle "system", treat as empty. */
1643 if ( opt_set_and_noexpand(ob->tls_verify_certificates)
1644 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1645 && Ustrcmp(ob->tls_verify_certificates, "system") != 0
1649 if (!watch || tls_set_watch(ob->tls_verify_certificates, FALSE))
1652 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1653 if (creds_load_cabundle(&tpt_dummy_state, ob->tls_verify_certificates,
1654 dummy_host, &dummy_errstr) != OK)
1656 ob->tls_preload.cabundle = TRUE;
1658 if (opt_set_and_noexpand(ob->tls_crl))
1660 if (!watch || tls_set_watch(ob->tls_crl, FALSE))
1662 DEBUG(D_tls) debug_printf("TLS: preloading CRL for transport '%s'\n", t->name);
1663 if (creds_load_crl(&tpt_dummy_state, ob->tls_crl, &dummy_errstr) != OK)
1665 ob->tls_preload.crl = TRUE;
1669 DEBUG(D_tls) debug_printf("TLS: not preloading CRL, for transport '%s'\n", t->name);
1674 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1676 /* We do not preload tls_require_ciphers to to the transport as it implicitly
1677 depends on DANE or plain usage. */
1683 #if defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT)
1684 /* Invalidate the creds cached, by dropping the current ones.
1685 Call when we notice one of the source files has changed. */
1688 tls_server_creds_invalidate(void)
1690 if (state_server.lib_state.pri_cache)
1691 gnutls_priority_deinit(state_server.lib_state.pri_cache);
1692 state_server.lib_state.pri_cache = NULL;
1694 if (state_server.lib_state.x509_cred)
1695 gnutls_certificate_free_credentials(state_server.lib_state.x509_cred);
1696 state_server.lib_state = null_tls_preload;
1701 tls_client_creds_invalidate(transport_instance * t)
1703 smtp_transport_options_block * ob = t->options_block;
1704 if (ob->tls_preload.x509_cred)
1705 gnutls_certificate_free_credentials(ob->tls_preload.x509_cred);
1706 ob->tls_preload = null_tls_preload;
1711 /*************************************************
1712 * Variables re-expanded post-SNI *
1713 *************************************************/
1715 /* Called from both server and client code, via tls_init(), and also from
1716 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1718 We can tell the two apart by state->received_sni being non-NULL in callback.
1720 The callback should not call us unless state->trigger_sni_changes is true,
1721 which we are responsible for setting on the first pass through.
1724 state exim_gnutls_state_st *
1725 errstr error string pointer
1727 Returns: OK/DEFER/FAIL
1731 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1734 const host_item *host = state->host; /* macro should be reconsidered? */
1735 const uschar *saved_tls_certificate = NULL;
1736 const uschar *saved_tls_privatekey = NULL;
1737 const uschar *saved_tls_verify_certificates = NULL;
1738 const uschar *saved_tls_crl = NULL;
1741 /* We check for tls_sni *before* expansion. */
1742 if (!host) /* server */
1743 if (!state->received_sni)
1745 if ( state->tls_certificate
1746 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1747 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1748 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1751 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI\n");
1752 state->trigger_sni_changes = TRUE;
1755 else /* SNI callback case */
1757 /* useful for debugging */
1758 saved_tls_certificate = state->exp_tls_certificate;
1759 saved_tls_privatekey = state->exp_tls_privatekey;
1760 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1761 saved_tls_crl = state->exp_tls_crl;
1764 if (!state->lib_state.x509_cred)
1766 if ((rc = gnutls_certificate_allocate_credentials(
1767 (gnutls_certificate_credentials_t *) &state->lib_state.x509_cred)))
1768 return tls_error_gnu(state, US"gnutls_certificate_allocate_credentials",
1770 creds_basic_init(state->lib_state.x509_cred, !host);
1774 /* remember: Expand_check_tlsvar() is expand_check() but fiddling with
1775 state members, assuming consistent naming; and expand_check() returns
1776 false if expansion failed, unless expansion was forced to fail. */
1778 /* check if we at least have a certificate, before doing expensive
1781 if (!state->lib_state.conn_certs)
1783 if (!Expand_check_tlsvar(tls_certificate, errstr))
1786 /* certificate is mandatory in server, optional in client */
1788 if ( !state->exp_tls_certificate
1789 || !*state->exp_tls_certificate
1792 return tls_install_selfsign(state, errstr);
1794 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1796 if (state->tls_privatekey && !Expand_check_tlsvar(tls_privatekey, errstr))
1799 /* tls_privatekey is optional, defaulting to same file as certificate */
1801 if (!state->tls_privatekey || !*state->tls_privatekey)
1803 state->tls_privatekey = state->tls_certificate;
1804 state->exp_tls_privatekey = state->exp_tls_certificate;
1807 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1810 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1811 state->exp_tls_certificate, state->exp_tls_privatekey);
1813 if (state->received_sni)
1814 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1815 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1818 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1819 load = FALSE; /* avoid re-loading the same certs */
1821 else /* unload the pre-SNI certs before loading new ones */
1823 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair\n");
1824 gnutls_certificate_free_keys(state->lib_state.x509_cred);
1829 ? creds_load_client_certs(state, host, state->exp_tls_certificate,
1830 state->exp_tls_privatekey, errstr)
1831 : creds_load_server_certs(state, state->exp_tls_certificate,
1832 state->exp_tls_privatekey,
1845 debug_printf("%s certs were preloaded\n", host ? "client" : "server");
1847 if (!state->tls_privatekey) state->tls_privatekey = state->tls_certificate;
1848 state->exp_tls_certificate = US state->tls_certificate;
1849 state->exp_tls_privatekey = US state->tls_privatekey;
1851 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1852 if (state->lib_state.ocsp_hook)
1853 gnutls_handshake_set_hook_function(state->session,
1854 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1859 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1860 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1861 error message is provided. However, if we just refrain from setting anything up
1862 in that case, certificate verification fails, which seems to be the correct
1864 If none was configured and we can't handle "system", treat as empty. */
1866 if (!state->lib_state.cabundle)
1868 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1870 if (!Expand_check_tlsvar(tls_verify_certificates, errstr))
1872 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1873 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1874 state->exp_tls_verify_certificates = NULL;
1876 if (state->tls_crl && *state->tls_crl)
1877 if (!Expand_check_tlsvar(tls_crl, errstr))
1880 if (!(state->exp_tls_verify_certificates &&
1881 *state->exp_tls_verify_certificates))
1884 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1885 /* With no tls_verify_certificates, we ignore tls_crl too */
1892 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1895 rc = creds_load_cabundle(state, state->exp_tls_verify_certificates, host, errstr);
1896 if (rc != OK) return rc;
1901 debug_printf("%s CA bundle was preloaded\n", host ? "client" : "server");
1902 state->exp_tls_verify_certificates = US state->tls_verify_certificates;
1904 #ifdef SUPPORT_CA_DIR
1905 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1906 when using the directory-of-certs config model. */
1907 if (state->lib_state.ca_rdn_emulate)
1908 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1913 if (!state->lib_state.crl)
1915 if ( state->tls_crl && *state->tls_crl
1916 && state->exp_tls_crl && *state->exp_tls_crl)
1917 return creds_load_crl(state, state->exp_tls_crl, errstr);
1922 debug_printf("%s CRL was preloaded\n", host ? "client" : "server");
1923 state->exp_tls_crl = US state->tls_crl;
1932 /*************************************************
1933 * Set X.509 state variables *
1934 *************************************************/
1936 /* In GnuTLS, the registered cert/key are not replaced by a later
1937 set of a cert/key, so for SNI support we need a whole new x509_cred
1938 structure. Which means various other non-re-expanded pieces of state
1939 need to be re-set in the new struct, so the setting logic is pulled
1943 state exim_gnutls_state_st *
1944 errstr error string pointer
1946 Returns: OK/DEFER/FAIL
1950 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1953 const host_item *host = state->host; /* macro should be reconsidered? */
1955 #ifndef GNUTLS_AUTO_DHPARAMS
1956 /* Create D-H parameters, or read them from the cache file. This function does
1957 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1958 client-side params. */
1962 if (!dh_server_params)
1963 if ((rc = init_server_dh(errstr)) != OK) return rc;
1965 /* Unnecessary & discouraged with 3.6.0 or later */
1966 gnutls_certificate_set_dh_params(state->lib_state.x509_cred, dh_server_params);
1969 DEBUG(D_tls) if (tls_dhparam)
1970 debug_printf("Ignoring tls_dhparam (recent version GnuTLS)\n");
1973 /* Link the credentials to the session. */
1975 if ((rc = gnutls_credentials_set(state->session,
1976 GNUTLS_CRD_CERTIFICATE, state->lib_state.x509_cred)))
1977 return tls_error_gnu(state, US"gnutls_credentials_set", rc, errstr);
1982 /*************************************************
1983 * Initialize for GnuTLS *
1984 *************************************************/
1987 /* Called from both server and client code. In the case of a server, errors
1988 before actual TLS negotiation return DEFER.
1991 host connected host, if client; NULL if server
1992 ob tranport options block, if client; NULL if server
1993 require_ciphers tls_require_ciphers setting
1994 caller_state returned state-info structure
1995 errstr error string pointer
1997 Returns: OK/DEFER/FAIL
2002 const host_item *host,
2003 smtp_transport_options_block * ob,
2004 const uschar * require_ciphers,
2005 exim_gnutls_state_st **caller_state,
2009 exim_gnutls_state_st * state;
2013 if ( !exim_gnutls_base_init_done
2014 && (rc = tls_g_init(errstr)) != OK)
2019 /* For client-side sessions we allocate a context. This lets us run
2020 several in parallel. */
2022 int old_pool = store_pool;
2023 store_pool = POOL_PERM;
2024 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
2025 store_pool = old_pool;
2027 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2028 state->lib_state = ob->tls_preload;
2030 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
2031 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
2033 state->tls_certificate = ob->tls_certificate;
2034 state->tls_privatekey = ob->tls_privatekey;
2035 state->tls_sni = ob->tls_sni;
2036 state->tls_verify_certificates = ob->tls_verify_certificates;
2037 state->tls_crl = ob->tls_crl;
2041 /* Server operations always use the one state_server context. It is not
2042 shared because we have forked a fresh process for every receive. However it
2043 can get re-used for successive TLS sessions on a single TCP connection. */
2045 state = &state_server;
2047 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
2048 rc = gnutls_init(&state->session, GNUTLS_SERVER);
2050 state->tls_certificate = tls_certificate;
2051 state->tls_privatekey = tls_privatekey;
2052 state->tls_sni = NULL;
2053 state->tls_verify_certificates = tls_verify_certificates;
2054 state->tls_crl = tls_crl;
2057 return tls_error_gnu(state, US"gnutls_init", rc, errstr);
2059 state->tls_require_ciphers = require_ciphers;
2062 /* This handles the variables that might get re-expanded after TLS SNI;
2063 tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
2066 debug_printf("Expanding various TLS configuration options for session credentials\n");
2067 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
2069 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
2070 requires a new structure afterwards. */
2072 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
2074 /* set SNI in client, only */
2077 if (!expand_check(state->tls_sni, US"tls_out_sni", &state->tlsp->sni, errstr))
2079 if (state->tlsp->sni && *state->tlsp->sni)
2082 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
2083 sz = Ustrlen(state->tlsp->sni);
2084 if ((rc = gnutls_server_name_set(state->session,
2085 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
2086 return tls_error_gnu(state, US"gnutls_server_name_set", rc, errstr);
2089 else if (state->tls_sni)
2090 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
2091 "have an SNI set for a server [%s]\n", state->tls_sni);
2093 if (!state->lib_state.pri_string)
2095 const uschar * p = NULL;
2096 const char * errpos;
2098 /* This is the priority string support,
2099 http://www.gnutls.org/manual/html_node/Priority-Strings.html
2100 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
2101 This was backwards incompatible, but means Exim no longer needs to track
2102 all algorithms and provide string forms for them. */
2104 if (state->tls_require_ciphers && *state->tls_require_ciphers)
2106 if (!Expand_check_tlsvar(tls_require_ciphers, errstr))
2108 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
2110 p = state->exp_tls_require_ciphers;
2111 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
2115 if ((rc = creds_load_pristring(state, p, &errpos)))
2116 return tls_error_gnu(state, string_sprintf(
2117 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
2118 p, (long)(errpos - CS p), errpos),
2123 DEBUG(D_tls) debug_printf("cipher list preloaded\n");
2124 state->exp_tls_require_ciphers = US state->tls_require_ciphers;
2128 if ((rc = gnutls_priority_set(state->session, state->lib_state.pri_cache)))
2129 return tls_error_gnu(state, US"gnutls_priority_set", rc, errstr);
2131 /* This also sets the server ticket expiration time to the same, and
2132 the STEK rotation time to 3x. */
2134 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
2136 /* Reduce security in favour of increased compatibility, if the admin
2137 decides to make that trade-off. */
2138 if (gnutls_compat_mode)
2140 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
2141 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
2142 gnutls_session_enable_compatibility_mode(state->session);
2144 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
2148 *caller_state = state;
2154 /*************************************************
2155 * Extract peer information *
2156 *************************************************/
2158 static const uschar *
2159 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
2160 gnutls_mac_algorithm_t mac)
2163 gnutls_kx_algorithm_t kx_i;
2164 gnutls_cipher_algorithm_t cipher_i;
2165 gnutls_mac_algorithm_t mac_i;
2168 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
2170 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
2171 return cipher_stdname(cs_id[0], cs_id[1]);
2177 /* Called from both server and client code.
2178 Only this is allowed to set state->peerdn and state->have_set_peerdn
2179 and we use that to detect double-calls.
2181 NOTE: the state blocks last while the TLS connection is up, which is fine
2182 for logging in the server side, but for the client side, we log after teardown
2183 in src/deliver.c. While the session is up, we can twist about states and
2184 repoint tls_* globals, but those variables used for logging or other variable
2185 expansion that happens _after_ delivery need to have a longer life-time.
2187 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
2188 doing this more than once per generation of a state context. We set them in
2189 the state context, and repoint tls_* to them. After the state goes away, the
2190 tls_* copies of the pointers remain valid and client delivery logging is happy.
2192 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
2196 state exim_gnutls_state_st *
2197 errstr pointer to error string
2199 Returns: OK/DEFER/FAIL
2203 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
2205 gnutls_session_t session = state->session;
2206 const gnutls_datum_t * cert_list;
2208 unsigned int cert_list_size = 0;
2209 gnutls_protocol_t protocol;
2210 gnutls_cipher_algorithm_t cipher;
2211 gnutls_kx_algorithm_t kx;
2212 gnutls_mac_algorithm_t mac;
2213 gnutls_certificate_type_t ct;
2214 gnutls_x509_crt_t crt;
2218 if (state->have_set_peerdn)
2220 state->have_set_peerdn = TRUE;
2222 state->peerdn = NULL;
2225 cipher = gnutls_cipher_get(session);
2226 protocol = gnutls_protocol_get_version(session);
2227 mac = gnutls_mac_get(session);
2229 #ifdef GNUTLS_TLS1_3
2230 protocol >= GNUTLS_TLS1_3 ? 0 :
2232 gnutls_kx_get(session);
2234 old_pool = store_pool;
2236 tls_support * tlsp = state->tlsp;
2237 store_pool = POOL_PERM;
2239 #ifdef SUPPORT_GNUTLS_SESS_DESC
2242 uschar * s = US gnutls_session_get_desc(session), c;
2244 /* Nikos M suggests we use this by preference. It returns like:
2245 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
2247 For partial back-compat, put a colon after the TLS version, replace the
2248 )-( grouping with __, replace in-group - with _ and append the :keysize. */
2250 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
2252 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
2254 tlsp->ver = string_copyn(g->s, g->ptr);
2255 for (uschar * p = US tlsp->ver; *p; p++)
2256 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
2258 g = string_catn(g, US":", 1);
2259 if (*s) s++; /* now on _ between groups */
2262 for (*++s && ++s; (c = *s) && c != ')'; s++)
2263 g = string_catn(g, c == '-' ? US"_" : s, 1);
2264 /* now on ) closing group */
2265 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
2266 /* now on _ between groups */
2268 g = string_catn(g, US":", 1);
2269 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
2270 state->ciphersuite = string_from_gstring(g);
2273 state->ciphersuite = string_sprintf("%s:%s:%d",
2274 gnutls_protocol_get_name(protocol),
2275 gnutls_cipher_suite_get_name(kx, cipher, mac),
2276 (int) gnutls_cipher_get_key_size(cipher) * 8);
2278 /* I don't see a way that spaces could occur, in the current GnuTLS
2279 code base, but it was a concern in the old code and perhaps older GnuTLS
2280 releases did return "TLS 1.0"; play it safe, just in case. */
2282 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
2283 tlsp->ver = string_copyn(state->ciphersuite,
2284 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
2287 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
2289 tlsp->cipher = state->ciphersuite;
2290 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
2292 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
2294 store_pool = old_pool;
2297 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
2299 if (!cert_list || cert_list_size == 0)
2301 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
2302 cert_list, cert_list_size);
2303 if (state->verify_requirement >= VERIFY_REQUIRED)
2304 return tls_error(US"certificate verification failed",
2305 US"no certificate received from peer", state->host, errstr);
2309 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
2311 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
2313 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
2314 if (state->verify_requirement >= VERIFY_REQUIRED)
2315 return tls_error(US"certificate verification not possible, unhandled type",
2316 ctn, state->host, errstr);
2320 #define exim_gnutls_peer_err(Label) \
2322 if (rc != GNUTLS_E_SUCCESS) \
2324 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
2325 (Label), gnutls_strerror(rc)); \
2326 if (state->verify_requirement >= VERIFY_REQUIRED) \
2327 return tls_error_gnu(state, (Label), rc, errstr); \
2332 rc = import_cert(&cert_list[0], &crt);
2333 exim_gnutls_peer_err(US"cert 0");
2335 state->tlsp->peercert = state->peercert = crt;
2338 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
2339 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
2341 exim_gnutls_peer_err(US"getting size for cert DN failed");
2342 return FAIL; /* should not happen */
2344 dn_buf = store_get_perm(sz, TRUE); /* tainted */
2345 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
2346 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
2348 state->peerdn = dn_buf;
2351 #undef exim_gnutls_peer_err
2357 /*************************************************
2358 * Verify peer certificate *
2359 *************************************************/
2361 /* Called from both server and client code.
2362 *Should* be using a callback registered with
2363 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
2364 the peer information, but that's too new for some OSes.
2367 state exim_gnutls_state_st *
2368 errstr where to put an error message
2371 FALSE if the session should be rejected
2372 TRUE if the cert is okay or we just don't care
2376 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
2381 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
2383 rc = peer_status(state, errstr);
2385 if (state->verify_requirement == VERIFY_NONE)
2388 if (rc != OK || !state->peerdn)
2390 verify = GNUTLS_CERT_INVALID;
2391 *errstr = US"certificate not supplied";
2397 if (state->verify_requirement == VERIFY_DANE && state->host)
2399 /* Using dane_verify_session_crt() would be easy, as it does it all for us
2400 including talking to a DNS resolver. But we want to do that bit ourselves
2401 as the testsuite intercepts and fakes its own DNS environment. */
2406 const gnutls_datum_t * certlist =
2407 gnutls_certificate_get_peers(state->session, &lsize);
2408 int usage = tls_out.tlsa_usage;
2410 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2411 /* Split the TLSA records into two sets, TA and EE selectors. Run the
2412 dane-verification separately so that we know which selector verified;
2413 then we know whether to do name-verification (needed for TA but not EE). */
2415 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
2416 { /* a mixed-usage bundle */
2421 for (nrec = 0; state->dane_data_len[nrec]; ) nrec++;
2424 dd = store_get(nrec * sizeof(uschar *), FALSE);
2425 ddl = store_get(nrec * sizeof(int), FALSE);
2428 if ((rc = dane_state_init(&s, 0)))
2431 for (usage = DANESSL_USAGE_DANE_EE;
2432 usage >= DANESSL_USAGE_DANE_TA; usage--)
2433 { /* take records with this usage */
2434 for (j = i = 0; i < nrec; i++)
2435 if (state->dane_data[i][0] == usage)
2437 dd[j] = state->dane_data[i];
2438 ddl[j++] = state->dane_data_len[i];
2445 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
2448 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
2449 gnutls_certificate_type_get(state->session),
2451 usage == DANESSL_USAGE_DANE_EE
2452 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2456 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
2458 else if (verify == 0) /* verification passed */
2466 if (rc) goto tlsa_prob;
2471 if ( (rc = dane_state_init(&s, 0))
2472 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
2474 || (rc = dane_verify_crt_raw(s, certlist, lsize,
2475 gnutls_certificate_type_get(state->session),
2477 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2478 usage == (1 << DANESSL_USAGE_DANE_EE)
2479 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2488 if (verify != 0) /* verification failed */
2491 (void) dane_verification_status_print(verify, &str, 0);
2492 *errstr = US str.data; /* don't bother to free */
2496 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2497 /* If a TA-mode TLSA record was used for verification we must additionally
2498 verify the cert name (but not the CA chain). For EE-mode, skip it. */
2500 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2503 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2506 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2507 /* Assume that the name on the A-record is the one that should be matching
2508 the cert. An alternate view is that the domain part of the email address
2509 is also permissible. */
2511 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2512 CS state->host->name))
2514 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2519 #endif /*SUPPORT_DANE*/
2521 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2524 /* Handle the result of verification. INVALID is set if any others are. */
2526 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2528 state->peer_cert_verified = FALSE;
2531 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2536 if (gnutls_certificate_verification_status_print(verify,
2537 gnutls_certificate_type_get(state->session), &txt, 0)
2538 == GNUTLS_E_SUCCESS)
2540 debug_printf("%s\n", txt.data);
2541 gnutls_free(txt.data);
2545 *errstr = verify & GNUTLS_CERT_REVOKED
2546 ? US"certificate revoked" : US"certificate invalid";
2550 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2551 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2553 if (state->verify_requirement >= VERIFY_REQUIRED)
2556 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2561 /* Client side, check the server's certificate name versus the name on the
2562 A-record for the connection we made. What to do for server side - what name
2563 to use for client? We document that there is no such checking for server
2566 if ( state->exp_tls_verify_cert_hostnames
2567 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2568 CS state->exp_tls_verify_cert_hostnames)
2572 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2573 if (state->verify_requirement >= VERIFY_REQUIRED)
2578 state->peer_cert_verified = TRUE;
2579 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2580 state->peerdn ? state->peerdn : US"<unset>");
2584 state->tlsp->peerdn = state->peerdn;
2589 *errstr = string_sprintf("TLSA record problem: %s",
2590 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2594 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2601 /* ------------------------------------------------------------------------ */
2604 /* Logging function which can be registered with
2605 * gnutls_global_set_log_function()
2606 * gnutls_global_set_log_level() 0..9
2608 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2610 exim_gnutls_logger_cb(int level, const char *message)
2612 size_t len = strlen(message);
2615 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2618 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2619 message[len-1] == '\n' ? "" : "\n");
2624 /* Called after client hello, should handle SNI work.
2625 This will always set tls_sni (state->received_sni) if available,
2626 and may trigger presenting different certificates,
2627 if state->trigger_sni_changes is TRUE.
2629 Should be registered with
2630 gnutls_handshake_set_post_client_hello_function()
2632 "This callback must return 0 on success or a gnutls error code to terminate the
2635 For inability to get SNI information, we return 0.
2636 We only return non-zero if re-setup failed.
2637 Only used for server-side TLS.
2641 exim_sni_handling_cb(gnutls_session_t session)
2643 char sni_name[MAX_HOST_LEN];
2644 size_t data_len = MAX_HOST_LEN;
2645 exim_gnutls_state_st *state = &state_server;
2646 unsigned int sni_type;
2648 uschar * dummy_errstr;
2650 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2651 if (rc != GNUTLS_E_SUCCESS)
2654 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2655 debug_printf("TLS: no SNI presented in handshake\n");
2657 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2658 gnutls_strerror(rc), rc);
2662 if (sni_type != GNUTLS_NAME_DNS)
2664 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2668 /* We now have a UTF-8 string in sni_name */
2669 old_pool = store_pool;
2670 store_pool = POOL_PERM;
2671 state->received_sni = string_copy_taint(US sni_name, TRUE);
2672 store_pool = old_pool;
2674 /* We set this one now so that variable expansions below will work */
2675 state->tlsp->sni = state->received_sni;
2677 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2678 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2680 if (!state->trigger_sni_changes)
2683 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2685 /* If the setup of certs/etc failed before handshake, TLS would not have
2686 been offered. The best we can do now is abort. */
2687 return GNUTLS_E_APPLICATION_ERROR_MIN;
2690 rc = tls_set_remaining_x509(state, &dummy_errstr);
2691 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2698 #ifndef DISABLE_EVENT
2700 We use this callback to get observability and detail-level control
2701 for an exim TLS connection (either direction), raising a tls:cert event
2702 for each cert in the chain presented by the peer. Any event
2703 can deny verification.
2705 Return 0 for the handshake to continue or non-zero to terminate.
2709 verify_cb(gnutls_session_t session)
2711 const gnutls_datum_t * cert_list;
2712 unsigned int cert_list_size = 0;
2713 gnutls_x509_crt_t crt;
2716 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2718 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2719 while (cert_list_size--)
2721 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2723 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2724 cert_list_size, gnutls_strerror(rc));
2728 state->tlsp->peercert = crt;
2729 if ((yield = event_raise(state->event_action,
2730 US"tls:cert", string_sprintf("%d", cert_list_size))))
2732 log_write(0, LOG_MAIN,
2733 "SSL verify denied by event-action: depth=%d: %s",
2734 cert_list_size, yield);
2735 return 1; /* reject */
2737 state->tlsp->peercert = NULL;
2747 ddump(gnutls_datum_t * d)
2749 gstring * g = string_get((d->size+1) * 2);
2750 uschar * s = d->data;
2751 for (unsigned i = d->size; i > 0; i--, s++)
2753 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2754 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2760 post_handshake_debug(exim_gnutls_state_st * state)
2762 #ifdef SUPPORT_GNUTLS_SESS_DESC
2763 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2766 #ifdef SUPPORT_GNUTLS_KEYLOG
2767 # ifdef EXIM_HAVE_TLS1_3
2768 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2773 gnutls_datum_t c, s;
2775 /* For TLS1.2 we only want the client random and the master secret */
2776 gnutls_session_get_random(state->session, &c, &s);
2777 gnutls_session_get_master_secret(state->session, &s);
2780 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2783 debug_printf("To get keying info for TLS1.3 is hard:\n"
2784 " Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,\n"
2785 " and make sure it is writable by the Exim runtime user.\n"
2786 " Add SSLKEYLOGFILE to keep_environment in the exim config.\n"
2787 " Start Exim as root.\n"
2788 " If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2789 " (works for TLS1.2 also, and saves cut-paste into file).\n"
2790 " Trying to use add_environment for this will not work\n");
2795 #ifdef EXIM_HAVE_TLS_RESUME
2797 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2798 unsigned incoming, const gnutls_datum_t * msg)
2800 DEBUG(D_tls) debug_printf("newticket cb\n");
2801 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2806 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2808 /* Should the server offer session resumption? */
2809 tls_in.resumption = RESUME_SUPPORTED;
2810 if (verify_check_host(&tls_resumption_hosts) == OK)
2813 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2814 an offered resumption is unacceptable. We lose one resumption per ticket
2815 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2816 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2817 least they go out in a single packet. */
2819 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2820 &server_sessticket_key)))
2821 tls_in.resumption |= RESUME_SERVER_TICKET;
2824 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2826 /* Try to tell if we see a ticket request */
2827 gnutls_handshake_set_hook_function(state->session,
2828 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2833 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2835 if (gnutls_session_resumption_requested(state->session))
2837 /* This tells us the client sent a full ticket. We use a
2838 callback on session-ticket request, elsewhere, to tell
2839 if a client asked for a ticket. */
2841 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2842 DEBUG(D_tls) debug_printf("client requested resumption\n");
2844 if (gnutls_session_is_resumed(state->session))
2846 tls_in.resumption |= RESUME_USED;
2847 DEBUG(D_tls) debug_printf("Session resumed\n");
2850 #endif /* EXIM_HAVE_TLS_RESUME */
2853 #ifdef EXIM_HAVE_ALPN
2854 /* Expand and convert an Exim list to a gnutls_datum list. False return for fail.
2855 NULL plist return for silent no-ALPN.
2859 tls_alpn_plist(const uschar * tls_alpn, const gnutls_datum_t ** plist, unsigned * plen,
2864 if (!expand_check(tls_alpn, US"tls_alpn", &exp_alpn, errstr))
2869 DEBUG(D_tls) debug_printf("Setting TLS ALPN forced to fail, not sending\n");
2874 const uschar * list = exp_alpn;
2880 while (string_nextinlist(&list, &sep, NULL, 0)) cnt++;
2882 p = store_get(sizeof(gnutls_datum_t) * cnt, is_tainted(exp_alpn));
2884 for (int i = 0; s = string_nextinlist(&list, &sep, NULL, 0); i++)
2885 { p[i].data = s; p[i].size = Ustrlen(s); }
2886 *plist = (*plen = cnt) ? p : NULL;
2892 tls_server_set_acceptable_alpns(exim_gnutls_state_st * state, uschar ** errstr)
2895 const gnutls_datum_t * plist;
2898 if (tls_alpn_plist(tls_alpn, &plist, &plen, errstr) && plist)
2900 /* This seems to be only mandatory if the client sends an ALPN extension;
2901 not trying ALPN is ok. Need to decide how to support server-side must-alpn. */
2903 server_seen_alpn = 0;
2904 if (!(rc = gnutls_alpn_set_protocols(state->session, plist, plen,
2905 GNUTLS_ALPN_MANDATORY)))
2906 gnutls_handshake_set_hook_function(state->session,
2907 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2910 debug_printf("setting alpn protocols: %s\n", US gnutls_strerror(rc));
2913 #endif /* EXIM_HAVE_ALPN */
2915 /* ------------------------------------------------------------------------ */
2916 /* Exported functions */
2921 /*************************************************
2922 * Start a TLS session in a server *
2923 *************************************************/
2925 /* This is called when Exim is running as a server, after having received
2926 the STARTTLS command. It must respond to that command, and then negotiate
2930 errstr pointer to error string
2932 Returns: OK on success
2933 DEFER for errors before the start of the negotiation
2934 FAIL for errors during the negotiation; the server can't
2939 tls_server_start(uschar ** errstr)
2942 exim_gnutls_state_st * state = NULL;
2944 /* Check for previous activation */
2945 if (tls_in.active.sock >= 0)
2947 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2948 smtp_printf("554 Already in TLS\r\n", FALSE);
2952 /* Initialize the library. If it fails, it will already have logged the error
2953 and sent an SMTP response. */
2955 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2958 #ifdef MEASURE_TIMING
2960 gettimeofday(&t0, NULL);
2963 if ((rc = tls_init(NULL, NULL,
2964 tls_require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2966 #ifdef MEASURE_TIMING
2967 report_time_since(&t0, US"server tls_init (delta)");
2971 #ifdef EXIM_HAVE_ALPN
2972 tls_server_set_acceptable_alpns(state, errstr);
2975 #ifdef EXIM_HAVE_TLS_RESUME
2976 tls_server_resume_prehandshake(state);
2979 /* If this is a host for which certificate verification is mandatory or
2980 optional, set up appropriately. */
2982 if (verify_check_host(&tls_verify_hosts) == OK)
2985 debug_printf("TLS: a client certificate will be required\n");
2986 state->verify_requirement = VERIFY_REQUIRED;
2987 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2989 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2992 debug_printf("TLS: a client certificate will be requested but not required\n");
2993 state->verify_requirement = VERIFY_OPTIONAL;
2994 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2999 debug_printf("TLS: a client certificate will not be requested\n");
3000 state->verify_requirement = VERIFY_NONE;
3001 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3004 #ifndef DISABLE_EVENT
3007 state->event_action = event_action;
3008 gnutls_session_set_ptr(state->session, state);
3009 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3013 /* Register SNI handling; always, even if not in tls_certificate, so that the
3014 expansion variable $tls_sni is always available. */
3016 gnutls_handshake_set_post_client_hello_function(state->session,
3017 exim_sni_handling_cb);
3019 /* Set context and tell client to go ahead, except in the case of TLS startup
3020 on connection, where outputting anything now upsets the clients and tends to
3021 make them disconnect. We need to have an explicit fflush() here, to force out
3022 the response. Other smtp_printf() calls do not need it, because in non-TLS
3023 mode, the fflush() happens when smtp_getc() is called. */
3025 if (!state->tlsp->on_connect)
3027 smtp_printf("220 TLS go ahead\r\n", FALSE);
3031 /* Now negotiate the TLS session. We put our own timer on it, since it seems
3032 that the GnuTLS library doesn't.
3033 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
3034 to set (and clear down afterwards) up a pull-timeout callback function that does
3035 a select, so we're no better off unless avoiding signals becomes an issue. */
3037 gnutls_transport_set_ptr2(state->session,
3038 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
3039 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
3040 state->fd_in = fileno(smtp_in);
3041 state->fd_out = fileno(smtp_out);
3043 sigalrm_seen = FALSE;
3044 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3046 rc = gnutls_handshake(state->session);
3047 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3050 if (rc != GNUTLS_E_SUCCESS)
3052 /* It seems that, except in the case of a timeout, we have to close the
3053 connection right here; otherwise if the other end is running OpenSSL it hangs
3054 until the server times out. */
3058 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
3059 gnutls_db_remove_session(state->session);
3063 tls_error_gnu(state, US"gnutls_handshake", rc, errstr);
3064 (void) gnutls_alert_send_appropriate(state->session, rc);
3065 gnutls_deinit(state->session);
3066 gnutls_certificate_free_credentials(state->lib_state.x509_cred);
3067 state->lib_state = null_tls_preload;
3069 shutdown(state->fd_out, SHUT_WR);
3070 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
3071 (void)fclose(smtp_out);
3072 (void)fclose(smtp_in);
3073 smtp_out = smtp_in = NULL;
3079 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3080 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3081 tls_in.ext_master_secret = TRUE;
3084 #ifdef EXIM_HAVE_TLS_RESUME
3085 tls_server_resume_posthandshake(state);
3088 DEBUG(D_tls) post_handshake_debug(state);
3090 #ifdef EXIM_HAVE_ALPN
3091 if (server_seen_alpn > 0)
3094 { /* The client offered ALPN. See what was negotiated. */
3095 gnutls_datum_t p = {.size = 0};
3096 int rc = gnutls_alpn_get_selected_protocol(state->session, &p);
3098 debug_printf("ALPN negotiated: %.*s\n", (int)p.size, p.data);
3100 debug_printf("getting alpn protocol: %s\n", US gnutls_strerror(rc));
3104 else if (server_seen_alpn == 0)
3105 if (verify_check_host(&hosts_require_alpn) == OK)
3107 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_NO_APPLICATION_PROTOCOL);
3108 tls_error(US"handshake", US"ALPN required but not negotiated", NULL, errstr);
3112 DEBUG(D_tls) debug_printf("TLS: no ALPN presented in handshake\n");
3114 DEBUG(D_tls) debug_printf("TLS: was not watching for ALPN\n");
3117 /* Verify after the fact */
3119 if (!verify_certificate(state, errstr))
3121 if (state->verify_requirement != VERIFY_OPTIONAL)
3123 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
3127 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
3131 /* Sets various Exim expansion variables; always safe within server */
3133 extract_exim_vars_from_tls_state(state);
3135 /* TLS has been set up. Adjust the input functions to read via TLS,
3136 and initialize appropriately. */
3138 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
3140 receive_getc = tls_getc;
3141 receive_getbuf = tls_getbuf;
3142 receive_get_cache = tls_get_cache;
3143 receive_hasc = tls_hasc;
3144 receive_ungetc = tls_ungetc;
3145 receive_feof = tls_feof;
3146 receive_ferror = tls_ferror;
3147 receive_smtp_buffered = tls_smtp_buffered;
3156 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
3157 smtp_transport_options_block * ob)
3159 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
3161 state->exp_tls_verify_cert_hostnames =
3163 string_domain_utf8_to_alabel(host->certname, NULL);
3168 debug_printf("TLS: server cert verification includes hostname: \"%s\"\n",
3169 state->exp_tls_verify_cert_hostnames);
3177 /* Given our list of RRs from the TLSA lookup, build a lookup block in
3178 GnuTLS-DANE's preferred format. Hang it on the state str for later
3179 use in DANE verification.
3181 We point at the dnsa data not copy it, so it must remain valid until
3182 after verification is done.*/
3185 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
3189 const char ** dane_data;
3190 int * dane_data_len;
3193 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3194 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3195 ) if (rr->type == T_TLSA) i++;
3197 dane_data = store_get(i * sizeof(uschar *), FALSE);
3198 dane_data_len = store_get(i * sizeof(int), FALSE);
3201 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3202 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3203 ) if (rr->type == T_TLSA && rr->size > 3)
3205 const uschar * p = rr->data;
3206 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
3207 uint8_t usage = p[0], sel = p[1], type = p[2];
3210 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
3212 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
3213 || (sel != 0 && sel != 1)
3218 case 0: /* Full: cannot check at present */
3220 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
3222 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
3227 tls_out.tlsa_usage |= 1<<usage;
3228 dane_data[i] = CS p;
3229 dane_data_len[i++] = rr->size;
3232 if (!i) return FALSE;
3234 dane_data[i] = NULL;
3235 dane_data_len[i] = 0;
3237 state->dane_data = (char * const *)dane_data;
3238 state->dane_data_len = dane_data_len;
3245 #ifdef EXIM_HAVE_TLS_RESUME
3246 /* On the client, get any stashed session for the given IP from hints db
3247 and apply it to the ssl-connection for attempted resumption. Although
3248 there is a gnutls_session_ticket_enable_client() interface it is
3249 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
3250 by deafult". There seems to be no way to disable them, so even hosts not
3251 enabled by the transport option will be sent a ticket request. We will
3252 however avoid storing and retrieving session information. */
3255 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
3256 host_item * host, smtp_transport_options_block * ob)
3258 tlsp->resumption = RESUME_SUPPORTED;
3259 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3261 dbdata_tls_session * dt;
3263 open_db dbblock, * dbm_file;
3266 debug_printf("check for resumable session for %s\n", host->address);
3267 tlsp->host_resumable = TRUE;
3268 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3269 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
3271 /* Key for the db is the IP. We'd like to filter the retrieved session
3272 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
3274 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
3275 if (!(rc = gnutls_session_set_data(session,
3276 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
3278 DEBUG(D_tls) debug_printf("good session\n");
3279 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3281 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
3282 US gnutls_strerror(rc));
3283 dbfn_close(dbm_file);
3290 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
3292 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
3293 but this flag is not set until the second. TLS 1.3 it's the other way about.
3294 Keep both calls as the session data cannot be extracted before handshake
3297 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
3302 DEBUG(D_tls) debug_printf("server offered session ticket\n");
3303 tlsp->ticket_received = TRUE;
3304 tlsp->resumption |= RESUME_SERVER_TICKET;
3306 if (tlsp->host_resumable)
3307 if (!(rc = gnutls_session_get_data2(session, &tkt)))
3309 open_db dbblock, * dbm_file;
3310 int dlen = sizeof(dbdata_tls_session) + tkt.size;
3311 dbdata_tls_session * dt = store_get(dlen, TRUE);
3313 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
3314 memcpy(dt->session, tkt.data, tkt.size);
3315 gnutls_free(tkt.data);
3317 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3319 /* key for the db is the IP */
3320 dbfn_delete(dbm_file, host->address);
3321 dbfn_write(dbm_file, host->address, dt, dlen);
3322 dbfn_close(dbm_file);
3325 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
3329 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
3334 /* With a TLS1.3 session, the ticket(s) are not seen until
3335 the first data read is attempted. And there's often two of them.
3336 Pick them up with this callback. We are also called for 1.2
3340 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
3341 unsigned incoming, const gnutls_datum_t * msg)
3343 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
3344 tls_support * tlsp = state->tlsp;
3346 DEBUG(D_tls) debug_printf("newticket cb\n");
3348 if (!tlsp->ticket_received)
3349 tls_save_session(tlsp, sess, state->host);
3355 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
3356 tls_support * tlsp, host_item * host,
3357 smtp_transport_options_block * ob)
3359 gnutls_session_set_ptr(state->session, state);
3360 gnutls_handshake_set_hook_function(state->session,
3361 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
3363 tls_retrieve_session(tlsp, state->session, host, ob);
3367 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
3368 tls_support * tlsp, host_item * host)
3370 if (gnutls_session_is_resumed(state->session))
3372 DEBUG(D_tls) debug_printf("Session resumed\n");
3373 tlsp->resumption |= RESUME_USED;
3376 tls_save_session(tlsp, state->session, host);
3378 #endif /* !DISABLE_TLS_RESUME */
3381 /*************************************************
3382 * Start a TLS session in a client *
3383 *************************************************/
3385 /* Called from the smtp transport after STARTTLS has been accepted.
3388 cctx connection context
3389 conn_args connection details
3390 cookie datum for randomness (not used)
3391 tlsp record details of channel configuration here; must be non-NULL
3392 errstr error string pointer
3394 Returns: TRUE for success with TLS session context set in smtp context,
3399 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3400 void * cookie ARG_UNUSED,
3401 tls_support * tlsp, uschar ** errstr)
3403 host_item * host = conn_args->host; /* for msgs and option-tests */
3404 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3405 smtp_transport_options_block * ob = tb
3406 ? (smtp_transport_options_block *)tb->options_block
3407 : &smtp_transport_option_defaults;
3409 exim_gnutls_state_st * state = NULL;
3410 uschar * cipher_list = NULL;
3412 #ifndef DISABLE_OCSP
3414 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3415 BOOL request_ocsp = require_ocsp ? TRUE
3416 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3419 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
3422 /* If dane is flagged, have either request or require dane for this host, and
3423 a TLSA record found. Therefore, dane verify required. Which implies cert must
3424 be requested and supplied, dane verify must pass, and cert verify irrelevant
3425 (incl. hostnames), and (caller handled) require_tls and sni=$domain */
3427 if (conn_args->dane && ob->dane_require_tls_ciphers)
3429 /* not using Expand_check_tlsvar because not yet in state */
3430 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3431 &cipher_list, errstr))
3433 cipher_list = cipher_list && *cipher_list
3434 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
3439 cipher_list = ob->tls_require_ciphers;
3442 #ifdef MEASURE_TIMING
3444 gettimeofday(&t0, NULL);
3447 if (tls_init(host, ob, cipher_list, &state, tlsp, errstr) != OK)
3450 #ifdef MEASURE_TIMING
3451 report_time_since(&t0, US"client tls_init (delta)");
3456 #ifdef EXIM_HAVE_ALPN
3458 const gnutls_datum_t * plist;
3461 if (!tls_alpn_plist(ob->tls_alpn, &plist, &plen, errstr))
3464 if (gnutls_alpn_set_protocols(state->session, plist, plen, 0) != 0)
3466 tls_error(US"alpn init", NULL, state->host, errstr);
3470 DEBUG(D_tls) debug_printf("Setting TLS ALPN '%s'\n", ob->tls_alpn);
3473 log_write(0, LOG_MAIN, "ALPN unusable with this GnuTLS library version; ignoring \"%s\"\n",
3478 int dh_min_bits = ob->tls_dh_min_bits;
3479 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
3482 debug_printf("WARNING: tls_dh_min_bits far too low,"
3483 " clamping %d up to %d\n",
3484 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
3485 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
3488 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
3489 " acceptable bits to %d\n",
3491 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
3494 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
3495 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
3496 the specified host patterns if one of them is defined */
3499 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
3502 debug_printf("TLS: server certificate DANE required\n");
3503 state->verify_requirement = VERIFY_DANE;
3504 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3508 if ( ( state->exp_tls_verify_certificates
3509 && !ob->tls_verify_hosts
3510 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
3512 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3515 tls_client_setup_hostname_checks(host, state, ob);
3517 debug_printf("TLS: server certificate verification required\n");
3518 state->verify_requirement = VERIFY_REQUIRED;
3519 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3521 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3523 tls_client_setup_hostname_checks(host, state, ob);
3525 debug_printf("TLS: server certificate verification optional\n");
3526 state->verify_requirement = VERIFY_OPTIONAL;
3527 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
3532 debug_printf("TLS: server certificate verification not required\n");
3533 state->verify_requirement = VERIFY_NONE;
3534 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3537 #ifndef DISABLE_OCSP
3538 /* supported since GnuTLS 3.1.3 */
3541 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
3542 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
3543 NULL, 0, NULL)) != OK)
3545 tls_error_gnu(state, US"cert-status-req", rc, errstr);
3548 tlsp->ocsp = OCSP_NOT_RESP;
3552 #ifdef EXIM_HAVE_TLS_RESUME
3553 tls_client_resume_prehandshake(state, tlsp, host, ob);
3556 #ifndef DISABLE_EVENT
3557 if (tb && tb->event_action)
3559 state->event_action = tb->event_action;
3560 gnutls_session_set_ptr(state->session, state);
3561 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3565 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
3566 state->fd_in = cctx->sock;
3567 state->fd_out = cctx->sock;
3569 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
3570 /* There doesn't seem to be a built-in timeout on connection. */
3572 sigalrm_seen = FALSE;
3573 ALARM(ob->command_timeout);
3575 rc = gnutls_handshake(state->session);
3576 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3579 if (rc != GNUTLS_E_SUCCESS)
3583 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
3584 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
3587 tls_error_gnu(state, US"gnutls_handshake", rc, errstr);
3591 DEBUG(D_tls) post_handshake_debug(state);
3595 if (!verify_certificate(state, errstr))
3597 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
3601 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3602 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3603 tlsp->ext_master_secret = TRUE;
3606 #ifndef DISABLE_OCSP
3611 gnutls_datum_t stapling;
3612 gnutls_ocsp_resp_t resp;
3613 gnutls_datum_t printed;
3617 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
3618 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
3620 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
3623 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
3624 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
3625 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
3628 debug_printf("%.4096s", printed.data);
3629 gnutls_free(printed.data);
3632 (void) tls_error_gnu(state, US"ocsp decode", rc, errstr);
3634 (void) tls_error_gnu(state, US"ocsp decode", rc, errstr);
3637 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3639 tlsp->ocsp = OCSP_FAILED;
3640 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3646 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3647 tlsp->ocsp = OCSP_VFIED;
3652 #ifdef EXIM_HAVE_TLS_RESUME
3653 tls_client_resume_posthandshake(state, tlsp, host);
3656 #ifdef EXIM_HAVE_ALPN
3657 if (ob->tls_alpn) /* We requested. See what was negotiated. */
3659 gnutls_datum_t p = {.size = 0};
3661 if (gnutls_alpn_get_selected_protocol(state->session, &p) == 0)
3662 { DEBUG(D_tls) debug_printf("ALPN negotiated: '%.*s'\n", (int)p.size, p.data); }
3663 else if (verify_check_given_host(CUSS &ob->hosts_require_alpn, host) == OK)
3665 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_NO_APPLICATION_PROTOCOL);
3666 tls_error(US"handshake", US"ALPN required but not negotiated", state->host, errstr);
3670 DEBUG(D_tls) debug_printf("No ALPN negotiated");
3674 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3676 extract_exim_vars_from_tls_state(state);
3678 cctx->tls_ctx = state;
3687 ct_ctx client TLS context pointer, or NULL for the one global server context
3691 tls_shutdown_wr(void * ct_ctx)
3693 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3694 tls_support * tlsp = state->tlsp;
3696 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3698 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3700 HDEBUG(D_transport|D_tls|D_acl|D_v) debug_printf_indent(" SMTP(TLS shutdown)>>\n");
3701 gnutls_bye(state->session, GNUTLS_SHUT_WR);
3704 /*************************************************
3705 * Close down a TLS session *
3706 *************************************************/
3708 /* This is also called from within a delivery subprocess forked from the
3709 daemon, to shut down the TLS library, without actually doing a shutdown (which
3710 would tamper with the TLS session in the parent process).
3713 ct_ctx client context pointer, or NULL for the one global server context
3714 do_shutdown 0 no data-flush or TLS close-alert
3715 1 if TLS close-alert is to be sent,
3716 2 if also response to be waited for (2s timeout)
3722 tls_close(void * ct_ctx, int do_shutdown)
3724 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3725 tls_support * tlsp = state->tlsp;
3727 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3731 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3732 do_shutdown > 1 ? " (with response-wait)" : "");
3734 tls_write(ct_ctx, NULL, 0, FALSE); /* flush write buffer */
3737 gnutls_bye(state->session, do_shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3741 if (!ct_ctx) /* server */
3743 receive_getc = smtp_getc;
3744 receive_getbuf = smtp_getbuf;
3745 receive_get_cache = smtp_get_cache;
3746 receive_hasc = smtp_hasc;
3747 receive_ungetc = smtp_ungetc;
3748 receive_feof = smtp_feof;
3749 receive_ferror = smtp_ferror;
3750 receive_smtp_buffered = smtp_buffered;
3753 gnutls_deinit(state->session);
3754 gnutls_certificate_free_credentials(state->lib_state.x509_cred);
3755 state->lib_state = null_tls_preload;
3757 tlsp->active.sock = -1;
3758 tlsp->active.tls_ctx = NULL;
3759 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3760 tlsp->channelbinding = NULL;
3763 if (state->xfer_buffer) store_free(state->xfer_buffer);
3770 tls_refill(unsigned lim)
3772 exim_gnutls_state_st * state = &state_server;
3775 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, buffersize=%u)\n",
3776 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3778 sigalrm_seen = FALSE;
3779 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3783 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3784 MIN(ssl_xfer_buffer_size, lim));
3785 while (inbytes == GNUTLS_E_AGAIN);
3787 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3789 if (had_command_timeout) /* set by signal handler */
3790 smtp_command_timeout_exit(); /* does not return */
3791 if (had_command_sigterm)
3792 smtp_command_sigterm_exit();
3793 if (had_data_timeout)
3794 smtp_data_timeout_exit();
3795 if (had_data_sigint)
3796 smtp_data_sigint_exit();
3798 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3799 TLS session has been closed down, not that the socket itself has been closed
3800 down. Revert to non-TLS handling. */
3804 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3805 state->xfer_error = TRUE;
3809 else if (inbytes == 0)
3811 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3812 tls_close(NULL, TLS_NO_SHUTDOWN);
3816 /* Handle genuine errors */
3818 else if (inbytes < 0)
3820 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3821 record_io_error(state, (int) inbytes, US"recv", NULL);
3822 state->xfer_error = TRUE;
3825 #ifndef DISABLE_DKIM
3826 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3828 state->xfer_buffer_hwm = (int) inbytes;
3829 state->xfer_buffer_lwm = 0;
3833 /*************************************************
3834 * TLS version of getc *
3835 *************************************************/
3837 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3838 it refills the buffer via the GnuTLS reading function.
3839 Only used by the server-side TLS.
3841 This feeds DKIM and should be used for all message-body reads.
3843 Arguments: lim Maximum amount to read/buffer
3844 Returns: the next character or EOF
3848 tls_getc(unsigned lim)
3850 exim_gnutls_state_st * state = &state_server;
3852 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3853 if (!tls_refill(lim))
3854 return state->xfer_error ? EOF : smtp_getc(lim);
3856 /* Something in the buffer; return next uschar */
3858 return state->xfer_buffer[state->xfer_buffer_lwm++];
3864 exim_gnutls_state_st * state = &state_server;
3865 return state->xfer_buffer_lwm < state->xfer_buffer_hwm;
3869 tls_getbuf(unsigned * len)
3871 exim_gnutls_state_st * state = &state_server;
3875 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3876 if (!tls_refill(*len))
3878 if (!state->xfer_error) return smtp_getbuf(len);
3883 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3885 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3886 state->xfer_buffer_lwm += size;
3892 /* Get up to the given number of bytes from any cached data, and feed to dkim. */
3894 tls_get_cache(unsigned lim)
3896 #ifndef DISABLE_DKIM
3897 exim_gnutls_state_st * state = &state_server;
3898 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3902 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3908 tls_could_read(void)
3910 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3911 || gnutls_record_check_pending(state_server.session) > 0;
3915 /*************************************************
3916 * Read bytes from TLS channel *
3917 *************************************************/
3919 /* This does not feed DKIM, so if the caller uses this for reading message body,
3920 then the caller must feed DKIM.
3923 ct_ctx client context pointer, or NULL for the one global server context
3927 Returns: the number of bytes read
3928 -1 after a failed read, including EOF
3932 tls_read(void * ct_ctx, uschar *buff, size_t len)
3934 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3940 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3942 debug_printf("*** PROBABLY A BUG *** " \
3943 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3944 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3947 debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, len=" SIZE_T_FMT ")\n",
3948 state->session, buff, len);
3952 inbytes = gnutls_record_recv(state->session, buff, len);
3953 while (inbytes == GNUTLS_E_AGAIN);
3955 if (inbytes > 0) return inbytes;
3958 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3962 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3963 record_io_error(state, (int)inbytes, US"recv", NULL);
3972 /*************************************************
3973 * Write bytes down TLS channel *
3974 *************************************************/
3978 ct_ctx client context pointer, or NULL for the one global server context
3981 more more data expected soon
3983 Calling with len zero and more unset will flush buffered writes. The buff
3984 argument can be null for that case.
3986 Returns: the number of bytes after a successful write,
3987 -1 after a failed write
3991 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
3995 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3998 if (more && !state->corked)
4000 DEBUG(D_tls) debug_printf("gnutls_record_cork(session=%p)\n", state->session);
4001 gnutls_record_cork(state->session);
4002 state->corked = TRUE;
4006 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
4007 buff, left, more ? ", more" : "");
4011 DEBUG(D_tls) debug_printf("gnutls_record_send(session=%p, buffer=%p, left=" SIZE_T_FMT ")\n",
4012 state->session, buff, left);
4016 outbytes = gnutls_record_send(state->session, buff, left);
4017 while (outbytes == GNUTLS_E_AGAIN);
4019 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
4023 #ifdef GNUTLS_E_PREMATURE_TERMINATION
4024 if ( outbytes == GNUTLS_E_PREMATURE_TERMINATION && errno == ECONNRESET
4025 && !ct_ctx && f.smtp_in_quit
4027 { /* Outlook, dammit */
4028 if (LOGGING(protocol_detail))
4029 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
4030 " SMTP response and TLS close\n", sender_host_address);
4032 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
4033 " client reset TCP before TLS close\n", sender_host_address);
4038 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
4039 record_io_error(state, outbytes, US"send", NULL);
4045 record_io_error(state, 0, US"send", US"TLS channel closed on write");
4056 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
4062 if (!more && state->corked)
4064 DEBUG(D_tls) debug_printf("gnutls_record_uncork(session=%p)\n", state->session);
4066 /* We can't use GNUTLS_RECORD_WAIT here, as it retries on
4067 GNUTLS_E_AGAIN || GNUTLS_E_INTR, which would break our timeout set by alarm().
4068 The GNUTLS_E_AGAIN should not happen ever, as our sockets are blocking anyway.
4069 But who knows. (That all relies on the fact that GNUTLS_E_INTR and GNUTLS_E_AGAIN
4070 match the EINTR and EAGAIN errno values.) */
4071 outbytes = gnutls_record_uncork(state->session, 0);
4072 while (outbytes == GNUTLS_E_AGAIN);
4076 record_io_error(state, len, US"uncork", NULL);
4080 state->corked = FALSE;
4090 /*************************************************
4091 * Random number generation *
4092 *************************************************/
4094 /* Pseudo-random number generation. The result is not expected to be
4095 cryptographically strong but not so weak that someone will shoot themselves
4096 in the foot using it as a nonce in input in some email header scheme or
4097 whatever weirdness they'll twist this into. The result should handle fork()
4098 and avoid repeating sequences. OpenSSL handles that for us.
4102 Returns a random number in range [0, max-1]
4105 #ifdef HAVE_GNUTLS_RND
4107 vaguely_random_number(int max)
4111 uschar smallbuf[sizeof(r)];
4116 needed_len = sizeof(r);
4117 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
4118 asked for a number less than 10. */
4120 for (r = max, i = 0; r; ++i)
4126 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
4129 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback\n");
4130 return vaguely_random_number_fallback(max);
4133 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
4136 /* We don't particularly care about weighted results; if someone wants
4137 * smooth distribution and cares enough then they should submit a patch then. */
4140 #else /* HAVE_GNUTLS_RND */
4142 vaguely_random_number(int max)
4144 return vaguely_random_number_fallback(max);
4146 #endif /* HAVE_GNUTLS_RND */
4151 /*************************************************
4152 * Let tls_require_ciphers be checked at startup *
4153 *************************************************/
4155 /* The tls_require_ciphers option, if set, must be something which the
4158 Returns: NULL on success, or error message
4162 tls_validate_require_cipher(void)
4165 uschar *expciphers = NULL;
4166 gnutls_priority_t priority_cache;
4168 uschar * dummy_errstr;
4170 #ifdef GNUTLS_AUTO_GLOBAL_INIT
4171 # define validate_check_rc(Label) do { \
4172 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \
4173 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4174 # define return_deinit(Label) do { return (Label); } while (0)
4176 # define validate_check_rc(Label) do { \
4177 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
4178 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
4179 # define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
4182 if (exim_gnutls_base_init_done)
4183 log_write(0, LOG_MAIN|LOG_PANIC,
4184 "already initialised GnuTLS, Exim developer bug");
4186 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
4187 if (!gnutls_allow_auto_pkcs11)
4189 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
4190 validate_check_rc(US"gnutls_pkcs11_init");
4193 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4194 rc = gnutls_global_init();
4195 validate_check_rc(US"gnutls_global_init()");
4197 exim_gnutls_base_init_done = TRUE;
4199 if (!(tls_require_ciphers && *tls_require_ciphers))
4200 return_deinit(NULL);
4202 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
4204 return_deinit(US"failed to expand tls_require_ciphers");
4206 if (!(expciphers && *expciphers))
4207 return_deinit(NULL);
4210 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
4212 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
4213 validate_check_rc(string_sprintf(
4214 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
4215 expciphers, (long)(errpos - CS expciphers), errpos));
4217 #undef return_deinit
4218 #undef validate_check_rc
4219 #ifndef GNUTLS_AUTO_GLOBAL_INIT
4220 gnutls_global_deinit();
4229 /*************************************************
4230 * Report the library versions. *
4231 *************************************************/
4233 /* See a description in tls-openssl.c for an explanation of why this exists.
4235 Arguments: a FILE* to print the results to
4240 tls_version_report(FILE *f)
4242 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
4245 gnutls_check_version(NULL));
4248 #endif /*!MACRO_PREDEF*/
4251 /* End of tls-gnu.c */