1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Copyright (c) Phil Pennock 2012 */
11 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
12 one of the available supported implementations. This file is #included into
13 tls.c when USE_GNUTLS has been set.
15 The code herein is a revamp of GnuTLS integration using the current APIs; the
16 original tls-gnu.c was based on a patch which was contributed by Nikos
17 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
20 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
21 which is not widely deployed by OS vendors. Will note issues below, which may
22 assist in updating the code in the future. Another sources of hints is
23 mod_gnutls for Apache (SNI callback registration and handling).
25 Keeping client and server variables more split than before and is currently
26 the norm, in anticipation of TLS in ACL callouts.
28 I wanted to switch to gnutls_certificate_set_verify_function() so that
29 certificate rejection could happen during handshake where it belongs, rather
30 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
31 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
33 (I wasn't looking for libraries quite that old, when updating to get rid of
34 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
35 require current GnuTLS, then we'll drop support for the ancient libraries).
38 #include <gnutls/gnutls.h>
39 /* needed for cert checks in verification and DN extraction: */
40 #include <gnutls/x509.h>
41 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
42 #include <gnutls/crypto.h>
44 /* needed to disable PKCS11 autoload unless requested */
45 #if GNUTLS_VERSION_NUMBER >= 0x020c00
46 # include <gnutls/pkcs11.h>
47 # define SUPPORT_PARAM_TO_PK_BITS
49 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
50 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
53 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
54 # warning "GnuTLS library version too old; tls:cert event unsupported"
55 # define DISABLE_EVENT
57 #if GNUTLS_VERSION_NUMBER >= 0x030000
58 # define SUPPORT_SELFSIGN /* Uncertain what version is first usable but 2.12.23 is not */
60 #if GNUTLS_VERSION_NUMBER >= 0x030306
61 # define SUPPORT_CA_DIR
63 # undef SUPPORT_CA_DIR
65 #if GNUTLS_VERSION_NUMBER >= 0x030014
66 # define SUPPORT_SYSDEFAULT_CABUNDLE
68 #if GNUTLS_VERSION_NUMBER >= 0x030104
69 # define GNUTLS_CERT_VFY_STATUS_PRINT
71 #if GNUTLS_VERSION_NUMBER >= 0x030109
74 #if GNUTLS_VERSION_NUMBER >= 0x03010a
75 # define SUPPORT_GNUTLS_SESS_DESC
77 #if GNUTLS_VERSION_NUMBER >= 0x030300
78 # define GNUTLS_AUTO_GLOBAL_INIT
79 # define GNUTLS_AUTO_PKCS11_MANUAL
81 #if (GNUTLS_VERSION_NUMBER >= 0x030404) \
82 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
84 # define EXIM_HAVE_OCSP
87 #if GNUTLS_VERSION_NUMBER >= 0x030500
88 # define SUPPORT_GNUTLS_KEYLOG
90 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
91 # define SUPPORT_SRV_OCSP_STACK
93 #if GNUTLS_VERSION_NUMBER >= 0x030600
94 # define GNUTLS_AUTO_DHPARAMS
96 #if GNUTLS_VERSION_NUMBER >= 0x030603
97 # define EXIM_HAVE_TLS1_3
98 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
99 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
103 # if GNUTLS_VERSION_NUMBER >= 0x030000
104 # define DANESSL_USAGE_DANE_TA 2
105 # define DANESSL_USAGE_DANE_EE 3
107 # error GnuTLS version too early for DANE
109 # if GNUTLS_VERSION_NUMBER < 0x999999
110 # define GNUTLS_BROKEN_DANE_VALIDATION
114 #ifndef DISABLE_TLS_RESUME
115 # if GNUTLS_VERSION_NUMBER >= 0x030603
116 # define EXIM_HAVE_TLS_RESUME
118 # warning "GnuTLS library version too old; resumption unsupported"
123 # include <gnutls/ocsp.h>
126 # include <gnutls/dane.h>
129 #include "tls-cipher-stdname.c"
136 # ifndef DISABLE_TLS_RESUME
137 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
139 # ifdef EXIM_HAVE_TLS1_3
140 builtin_macro_create(US"_HAVE_TLS1_3");
142 # ifdef EXIM_HAVE_OCSP
143 builtin_macro_create(US"_HAVE_TLS_OCSP");
145 # ifdef SUPPORT_SRV_OCSP_STACK
146 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
148 #ifdef EXIM_HAVE_INOTIFY
149 builtin_macro_create(US"_HAVE_TLS_CA_CACHE");
158 gnutls_global_set_audit_log_function()
161 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
164 /* Local static variables for GnuTLS */
166 /* Values for verify_requirement */
168 enum peer_verify_requirement
169 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
171 /* This holds most state for server or client; with this, we can set up an
172 outbound TLS-enabled connection in an ACL callout, while not stomping all
173 over the TLS variables available for expansion.
175 Some of these correspond to variables in globals.c; those variables will
176 be set to point to content in one of these instances, as appropriate for
177 the stage of the process lifetime.
179 Not handled here: global tlsp->tls_channelbinding.
182 typedef struct exim_gnutls_state {
183 gnutls_session_t session;
185 exim_tlslib_state lib_state;
186 #define x509_cred libdata0
187 #define pri_cache libdata1
189 enum peer_verify_requirement verify_requirement;
193 BOOL peer_cert_verified:1;
194 BOOL peer_dane_verified:1;
195 BOOL trigger_sni_changes:1;
196 BOOL have_set_peerdn:1;
197 BOOL xfer_eof:1; /*XXX never gets set! */
203 const struct host_item *host; /* NULL if server */
204 gnutls_x509_crt_t peercert;
207 uschar *received_sni;
209 const uschar *tls_certificate;
210 const uschar *tls_privatekey;
211 const uschar *tls_sni; /* client send only, not received */
212 const uschar *tls_verify_certificates;
213 const uschar *tls_crl;
214 const uschar *tls_require_ciphers;
216 uschar *exp_tls_certificate;
217 uschar *exp_tls_privatekey;
218 uschar *exp_tls_verify_certificates;
220 uschar *exp_tls_require_ciphers;
221 const uschar *exp_tls_verify_cert_hostnames;
222 #ifndef DISABLE_EVENT
223 uschar *event_action;
226 char * const * dane_data;
227 const int * dane_data_len;
230 tls_support *tlsp; /* set in tls_init() */
235 } exim_gnutls_state_st;
237 static const exim_gnutls_state_st exim_gnutls_state_init = {
238 /* all elements not explicitly intialised here get 0/NULL/FALSE */
243 /* Not only do we have our own APIs which don't pass around state, assuming
244 it's held in globals, GnuTLS doesn't appear to let us register callback data
245 for callbacks, or as part of the session, so we have to keep a "this is the
246 context we're currently dealing with" pointer and rely upon being
247 single-threaded to keep from processing data on an inbound TLS connection while
248 talking to another TLS connection for an outbound check. This does mean that
249 there's no way for heart-beats to be responded to, for the duration of the
251 XXX But see gnutls_session_get_ptr()
254 static exim_gnutls_state_st state_server = {
255 /* all elements not explicitly intialised here get 0/NULL/FALSE */
260 #ifndef GNUTLS_AUTO_DHPARAMS
261 /* dh_params are initialised once within the lifetime of a process using TLS;
262 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
263 don't want to repeat this. */
265 static gnutls_dh_params_t dh_server_params = NULL;
268 static int ssl_session_timeout = 7200; /* Two hours */
270 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
272 /* Guard library core initialisation */
274 static BOOL exim_gnutls_base_init_done = FALSE;
277 static BOOL gnutls_buggy_ocsp = FALSE;
278 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
281 #ifdef EXIM_HAVE_TLS_RESUME
282 static gnutls_datum_t server_sessticket_key;
285 /* ------------------------------------------------------------------------ */
288 #define MAX_HOST_LEN 255
290 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
291 the library logging; a value less than 0 disables the calls to set up logging
292 callbacks. GNuTLS also looks for an environment variable - except not for
293 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
294 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
295 but the env var must be added to /etc/sudoers too. */
296 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
297 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
300 #ifndef EXIM_CLIENT_DH_MIN_BITS
301 # define EXIM_CLIENT_DH_MIN_BITS 1024
304 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
305 can ask for a bit-strength. Without that, we stick to the constant we had
307 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
308 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
311 #define Expand_check_tlsvar(Varname, errstr) \
312 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
314 #if GNUTLS_VERSION_NUMBER >= 0x020c00
315 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
316 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
317 # define HAVE_GNUTLS_RND
318 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
319 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
320 * isn't available sometimes, so this needs to become a conditional
321 * compilation; the sanest way to deal with this being a problem on
322 * older OSes is to block it in the Local/Makefile with this compiler
324 # ifndef AVOID_GNUTLS_PKCS11
325 # define HAVE_GNUTLS_PKCS11
326 # endif /* AVOID_GNUTLS_PKCS11 */
332 /* ------------------------------------------------------------------------ */
333 /* Callback declarations */
335 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
336 static void exim_gnutls_logger_cb(int level, const char *message);
339 static int exim_sni_handling_cb(gnutls_session_t session);
341 #ifdef EXIM_HAVE_TLS_RESUME
343 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
344 unsigned incoming, const gnutls_datum_t * msg);
348 /* ------------------------------------------------------------------------ */
354 tls_is_buggy_ocsp(void)
357 uschar maj, mid, mic;
359 s = CUS gnutls_check_version(NULL);
363 while (*s && *s != '.') s++;
371 while (*s && *s != '.') s++;
373 return mic <= (mid == 3 ? 16 : 3);
385 DEBUG(D_tls) debug_printf("GnuTLS global init required\n");
387 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
388 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
389 which loads modules from a config file, which sounds good and may be wanted
390 by some sysadmin, but also means in common configurations that GNOME keyring
391 environment variables are used and so breaks for users calling mailq.
392 To prevent this, we init PKCS11 first, which is the documented approach. */
394 if (!gnutls_allow_auto_pkcs11)
395 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
396 return tls_error_gnu(US"gnutls_pkcs11_init", rc, host, errstr);
399 #ifndef GNUTLS_AUTO_GLOBAL_INIT
400 if ((rc = gnutls_global_init()))
401 return tls_error_gnu(US"gnutls_global_init", rc, host, errstr);
404 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
407 gnutls_global_set_log_function(exim_gnutls_logger_cb);
408 /* arbitrarily chosen level; bump up to 9 for more */
409 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
414 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
415 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
418 exim_gnutls_base_init_done = TRUE;
423 /* Daemon-call before each connection. Nothing to do for GnuTLS. */
426 tls_per_lib_daemon_tick(void)
430 /* Daemon one-time initialisation */
433 tls_per_lib_daemon_init(void)
435 static BOOL once = FALSE;
437 if (!exim_gnutls_base_init_done)
444 #ifdef EXIM_HAVE_TLS_RESUME
445 /* We are dependent on the GnuTLS implementation of the Session Ticket
446 encryption; both the strength and the key rotation period. We hope that
447 the strength at least matches that of the ciphersuite (but GnuTLS does not
450 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
451 if (f.running_in_test_harness) ssl_session_timeout = 6;
454 tls_daemon_creds_reload();
458 /* ------------------------------------------------------------------------ */
459 /* Static functions */
461 /*************************************************
463 *************************************************/
465 /* Called from lots of places when errors occur before actually starting to do
466 the TLS handshake, that is, while the session is still in clear. Always returns
467 DEFER for a server and FAIL for a client so that most calls can use "return
468 tls_error(...)" to do this processing and then give an appropriate return. A
469 single function is used for both server and client, because it is called from
470 some shared functions.
473 prefix text to include in the logged error
474 msg additional error string (may be NULL)
475 usually obtained from gnutls_strerror()
476 host NULL if setting up a server;
477 the connected host if setting up a client
478 errstr pointer to returned error string
480 Returns: OK/DEFER/FAIL
484 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
488 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
489 return host ? FAIL : DEFER;
494 tls_error_gnu(const uschar *prefix, int err, const host_item *host,
497 return tls_error(prefix, US gnutls_strerror(err), host, errstr);
501 tls_error_sys(const uschar *prefix, int err, const host_item *host,
504 return tls_error(prefix, US strerror(err), host, errstr);
508 /*************************************************
509 * Deal with logging errors during I/O *
510 *************************************************/
512 /* We have to get the identity of the peer from saved data.
515 state the current GnuTLS exim state container
516 rc the GnuTLS error code, or 0 if it's a local error
517 when text identifying read or write
518 text local error text when rc is 0
524 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
529 msg = rc == GNUTLS_E_FATAL_ALERT_RECEIVED
530 ? string_sprintf("A TLS fatal alert has been received: %s",
531 US gnutls_alert_get_name(gnutls_alert_get(state->session)))
532 #ifdef GNUTLS_E_PREMATURE_TERMINATION
533 : rc == GNUTLS_E_PREMATURE_TERMINATION && errno
534 ? string_sprintf("%s: syscall: %s", US gnutls_strerror(rc), strerror(errno))
536 : US gnutls_strerror(rc);
538 (void) tls_error(when, msg, state->host, &errstr);
541 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
542 state->host->name, state->host->address, errstr);
545 uschar * conn_info = smtp_get_connection_info();
546 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
547 /* I'd like to get separated H= here, but too hard for now */
548 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
555 /*************************************************
556 * Set various Exim expansion vars *
557 *************************************************/
559 #define exim_gnutls_cert_err(Label) \
562 if (rc != GNUTLS_E_SUCCESS) \
564 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
565 (Label), gnutls_strerror(rc)); \
571 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
575 rc = gnutls_x509_crt_init(crtp);
576 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
578 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
579 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
584 #undef exim_gnutls_cert_err
587 /* We set various Exim global variables from the state, once a session has
588 been established. With TLS callouts, may need to change this to stack
589 variables, or just re-call it with the server state after client callout
592 Make sure anything set here is unset in tls_getc().
596 tls_bits strength indicator
597 tls_certificate_verified bool indicator
598 tls_channelbinding for some SASL mechanisms
601 tls_peercert pointer to library internal
603 tls_sni a (UTF-8) string
604 tls_ourcert pointer to library internal
607 state the relevant exim_gnutls_state_st *
611 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
613 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
616 gnutls_datum_t channel;
618 tls_support * tlsp = state->tlsp;
620 tlsp->active.sock = state->fd_out;
621 tlsp->active.tls_ctx = state;
623 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
625 tlsp->certificate_verified = state->peer_cert_verified;
627 tlsp->dane_verified = state->peer_dane_verified;
630 /* note that tls_channelbinding is not saved to the spool file, since it's
631 only available for use for authenticators while this TLS session is running. */
633 tlsp->channelbinding = NULL;
634 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
637 if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
638 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
641 /* Declare the taintedness of the binding info. On server, untainted; on
642 client, tainted - being the Finish msg from the server. */
644 old_pool = store_pool;
645 store_pool = POOL_PERM;
646 tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size,
648 store_pool = old_pool;
649 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n");
653 /* peercert is set in peer_status() */
654 tlsp->peerdn = state->peerdn;
656 /* do not corrupt sni sent by client; record sni rxd by server */
658 tlsp->sni = state->received_sni;
660 /* record our certificate */
662 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
663 gnutls_x509_crt_t crt;
665 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
672 #ifndef GNUTLS_AUTO_DHPARAMS
673 /*************************************************
674 * Setup up DH parameters *
675 *************************************************/
677 /* Generating the D-H parameters may take a long time. They only need to
678 be re-generated every so often, depending on security policy. What we do is to
679 keep these parameters in a file in the spool directory. If the file does not
680 exist, we generate them. This means that it is easy to cause a regeneration.
682 The new file is written as a temporary file and renamed, so that an incomplete
683 file is never present. If two processes both compute some new parameters, you
684 waste a bit of effort, but it doesn't seem worth messing around with locking to
687 Returns: OK/DEFER/FAIL
691 init_server_dh(uschar ** errstr)
694 unsigned int dh_bits;
695 gnutls_datum_t m = {.data = NULL, .size = 0};
696 uschar filename_buf[PATH_MAX];
697 uschar *filename = NULL;
699 uschar *exp_tls_dhparam;
700 BOOL use_file_in_spool = FALSE;
701 host_item *host = NULL; /* dummy for macros */
703 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params\n");
705 if ((rc = gnutls_dh_params_init(&dh_server_params)))
706 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
708 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
711 if (!exp_tls_dhparam)
713 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
714 m.data = US std_dh_prime_default();
715 m.size = Ustrlen(m.data);
717 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
718 use_file_in_spool = TRUE;
719 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
721 DEBUG(D_tls) debug_printf("Requested no DH parameters\n");
724 else if (exp_tls_dhparam[0] != '/')
726 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
727 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
728 m.size = Ustrlen(m.data);
731 filename = exp_tls_dhparam;
735 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
736 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
737 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
741 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
742 /* If you change this constant, also change dh_param_fn_ext so that we can use a
743 different filename and ensure we have sufficient bits. */
745 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
746 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
748 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits\n",
751 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
753 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits\n",
757 /* Some clients have hard-coded limits. */
758 if (dh_bits > tls_dh_max_bits)
761 debug_printf("tls_dh_max_bits clamping override, using %d bits instead\n",
763 dh_bits = tls_dh_max_bits;
766 if (use_file_in_spool)
768 if (!string_format(filename_buf, sizeof(filename_buf),
769 "%s/gnutls-params-%d", spool_directory, dh_bits))
770 return tls_error(US"overlong filename", NULL, NULL, errstr);
771 filename = filename_buf;
774 /* Open the cache file for reading and if successful, read it and set up the
777 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
783 if (fstat(fd, &statbuf) < 0) /* EIO */
787 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
789 if (!S_ISREG(statbuf.st_mode))
792 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
794 if (!(fp = fdopen(fd, "rb")))
798 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
799 saved_errno, NULL, errstr);
802 m.size = statbuf.st_size;
803 if (!(m.data = store_malloc(m.size)))
806 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
808 if (!(sz = fread(m.data, m.size, 1, fp)))
813 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
817 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
820 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
821 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
824 /* If the file does not exist, fall through to compute new data and cache it.
825 If there was any other opening error, it is serious. */
827 else if (errno == ENOENT)
831 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
834 return tls_error(string_open_failed("\"%s\" for reading", filename),
837 /* If ret < 0, either the cache file does not exist, or the data it contains
838 is not useful. One particular case of this is when upgrading from an older
839 release of Exim in which the data was stored in a different format. We don't
840 try to be clever and support both formats; we just regenerate new data in this
846 unsigned int dh_bits_gen = dh_bits;
848 if ((PATH_MAX - Ustrlen(filename)) < 10)
849 return tls_error(US"Filename too long to generate replacement",
850 filename, NULL, errstr);
852 temp_fn = string_copy(US"%s.XXXXXXX");
853 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
854 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
855 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
857 /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But
858 there's no way to ask GnuTLS how many bits there really are. We can ask
859 how many bits were used in a TLS session, but that's it! The prime itself
860 is hidden behind too much abstraction. So we ask for less, and proceed on
861 a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */
863 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
865 dh_bits_gen = dh_bits - 10;
867 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
872 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
874 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
875 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
877 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
878 and I confirmed that a NULL call to get the size first is how the GnuTLS
879 sample apps handle this. */
883 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
884 GNUTLS_X509_FMT_PEM, m.data, &sz))
885 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
886 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
889 if (!(m.data = store_malloc(m.size)))
890 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
892 /* this will return a size 1 less than the allocation size above */
893 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
897 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
899 m.size = sz; /* shrink by 1, probably */
901 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
904 return tls_error_sys(US"TLS cache write D-H params failed",
905 errno, NULL, errstr);
908 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
909 return tls_error_sys(US"TLS cache write D-H params final newline failed",
910 errno, NULL, errstr);
912 if ((rc = close(fd)))
913 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
915 if (Urename(temp_fn, filename) < 0)
916 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
917 temp_fn, filename), errno, NULL, errstr);
919 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
922 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
930 /* Create and install a selfsigned certificate, for use in server mode */
933 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
935 gnutls_x509_crt_t cert = NULL;
937 gnutls_x509_privkey_t pkey = NULL;
938 const uschar * where;
941 #ifndef SUPPORT_SELFSIGN
942 where = US"library too old";
943 rc = GNUTLS_E_NO_CERTIFICATE_FOUND;
947 where = US"initialising pkey";
948 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
950 where = US"initialising cert";
951 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
953 where = US"generating pkey"; /* Hangs on 2.12.23 */
954 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
955 #ifdef SUPPORT_PARAM_TO_PK_BITS
956 # ifndef GNUTLS_SEC_PARAM_MEDIUM
957 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
959 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
966 where = US"configuring cert";
968 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
969 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
970 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
971 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
972 || (rc = gnutls_x509_crt_set_key(cert, pkey))
974 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
975 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
976 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
977 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
978 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
979 GNUTLS_OID_X520_COMMON_NAME, 0,
980 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
984 where = US"signing cert";
985 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
987 where = US"installing selfsign cert";
989 if ((rc = gnutls_certificate_set_x509_key(state->lib_state.x509_cred,
996 if (cert) gnutls_x509_crt_deinit(cert);
997 if (pkey) gnutls_x509_privkey_deinit(pkey);
1001 rc = tls_error_gnu(where, rc, NULL, errstr);
1008 /* Add certificate and key, from files.
1011 Zero or negative: good. Negate value for certificate index if < 0.
1012 Greater than zero: FAIL or DEFER code.
1016 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
1017 const uschar * certfile, const uschar * keyfile, uschar ** errstr)
1019 int rc = gnutls_certificate_set_x509_key_file(state->lib_state.x509_cred,
1020 CCS certfile, CCS keyfile, GNUTLS_X509_FMT_PEM);
1022 return tls_error_gnu(
1023 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
1029 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1030 /* Load an OCSP proof from file for sending by the server. Called
1031 on getting a status-request handshake message, for earlier versions
1035 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1036 gnutls_datum_t * ocsp_response)
1039 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
1041 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1043 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1045 tls_in.ocsp = OCSP_NOT_RESP;
1046 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1049 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1055 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1056 /* Make a note that we saw a status-request */
1058 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
1059 const unsigned char *data, unsigned size)
1061 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1062 if (tls_id == 5) /* status_request */
1064 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
1065 tls_in.ocsp = OCSP_NOT_RESP;
1070 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
1072 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
1073 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1075 /* Call fn for each extension seen. 3.6.3 onwards */
1076 return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
1077 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
1081 # ifdef notdef_crashes
1082 /* Make a note that we saw a status-response */
1084 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
1085 const unsigned char *data, unsigned size)
1087 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
1088 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
1089 if (FALSE && tls_id == 5) /* status_request */
1091 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
1092 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1093 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1099 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
1101 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
1102 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1104 /* Call fn for each extension seen. 3.6.3 onwards */
1105 # ifdef notdef_crashes
1107 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
1110 #endif /*SUPPORT_GNUTLS_EXT_RAW_PARSE*/
1112 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
1113 "Handshake Protocol: Certificate" record.
1114 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
1116 This is different to tls1.2 - where it is a separate record (wireshark term) / handshake message (gnutls term).
1119 #if defined(EXIM_HAVE_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1120 /* Callback for certificate-status, on server. We sent stapled OCSP. */
1122 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
1123 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1125 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
1126 #ifdef SUPPORT_SRV_OCSP_STACK
1127 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1128 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1130 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1135 /* Callback for handshake messages, on server */
1137 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1138 unsigned incoming, const gnutls_datum_t * msg)
1140 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
1143 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1144 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1145 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1146 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1147 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1149 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1150 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1151 # ifdef EXIM_HAVE_TLS_RESUME
1152 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1153 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1162 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1164 tls_server_testharness_ocsp_fiddle(void)
1166 extern char ** environ;
1167 if (environ) for (uschar ** p = USS environ; *p; p++)
1168 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1170 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1171 exim_testharness_disable_ocsp_validity_check = TRUE;
1176 /**************************************************
1177 * One-time init credentials for server and client *
1178 **************************************************/
1181 creds_basic_init(gnutls_certificate_credentials_t x509_cred, BOOL server)
1183 #ifdef SUPPORT_SRV_OCSP_STACK
1184 gnutls_certificate_set_flags(x509_cred, GNUTLS_CERTIFICATE_API_V2);
1186 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1187 if (server && tls_ocsp_file)
1189 if (f.running_in_test_harness)
1190 tls_server_testharness_ocsp_fiddle();
1192 if (exim_testharness_disable_ocsp_validity_check)
1193 gnutls_certificate_set_flags(x509_cred,
1194 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1199 debug_printf("TLS: basic cred init, %s\n", server ? "server" : "client");
1203 creds_load_server_certs(exim_gnutls_state_st * state, const uschar * cert,
1204 const uschar * pkey, const uschar * ocsp, uschar ** errstr)
1206 const uschar * clist = cert;
1207 const uschar * klist = pkey;
1208 const uschar * olist;
1209 int csep = 0, ksep = 0, osep = 0, cnt = 0, rc;
1210 uschar * cfile, * kfile, * ofile;
1211 #ifndef DISABLE_OCSP
1212 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1213 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1216 if (!expand_check(ocsp, US"tls_ocsp_file", &ofile, errstr))
1221 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1223 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1224 return tls_error(US"cert/key setup: out of keys", NULL, NULL, errstr);
1225 else if ((rc = tls_add_certfile(state, NULL, cfile, kfile, errstr)) > 0)
1229 int gnutls_cert_index = -rc;
1230 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1231 gnutls_cert_index, cfile);
1233 #ifndef DISABLE_OCSP
1236 /* Set the OCSP stapling server info */
1237 if (gnutls_buggy_ocsp)
1240 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1242 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1244 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1245 gnutls_cert_index, ofile);
1246 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1247 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1249 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1252 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1254 ocsp_fmt = GNUTLS_X509_FMT_DER;
1258 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1259 state->lib_state.x509_cred, CCS ofile, gnutls_cert_index,
1261 return tls_error_gnu(
1262 US"gnutls_certificate_set_ocsp_status_request_file2",
1265 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1267 /* Arrange callbacks for OCSP request observability */
1270 gnutls_handshake_set_hook_function(state->session,
1271 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1273 state->lib_state.ocsp_hook = TRUE;
1277 # if defined(SUPPORT_SRV_OCSP_STACK)
1278 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1279 state->lib_state.x509_cred, gnutls_cert_index,
1280 server_ocsp_stapling_cb, ofile)))
1281 return tls_error_gnu(
1282 US"gnutls_certificate_set_ocsp_status_request_function2",
1290 debug_printf("oops; multiple OCSP files not supported\n");
1293 gnutls_certificate_set_ocsp_status_request_function(
1294 state->lib_state.x509_cred, server_ocsp_stapling_cb, ofile);
1296 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1299 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1301 #endif /* DISABLE_OCSP */
1307 creds_load_client_certs(exim_gnutls_state_st * state, const host_item * host,
1308 const uschar * cert, const uschar * pkey, uschar ** errstr)
1310 int rc = tls_add_certfile(state, host, cert, pkey, errstr);
1311 if (rc > 0) return rc;
1312 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1317 creds_load_cabundle(exim_gnutls_state_st * state, const uschar * bundle,
1318 const host_item * host, uschar ** errstr)
1321 struct stat statbuf;
1323 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1324 if (Ustrcmp(bundle, "system") == 0 || Ustrncmp(bundle, "system,", 7) == 0)
1325 cert_count = gnutls_certificate_set_x509_system_trust(state->lib_state.x509_cred);
1329 if (Ustat(bundle, &statbuf) < 0)
1331 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1332 "(tls_verify_certificates): %s", bundle, strerror(errno));
1336 #ifndef SUPPORT_CA_DIR
1337 /* The test suite passes in /dev/null; we could check for that path explicitly,
1338 but who knows if someone has some weird FIFO which always dumps some certs, or
1339 other weirdness. The thing we really want to check is that it's not a
1340 directory, since while OpenSSL supports that, GnuTLS does not.
1341 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1342 if (S_ISDIR(statbuf.st_mode))
1344 log_write(0, LOG_MAIN|LOG_PANIC,
1345 "tls_verify_certificates \"%s\" is a directory", bundle);
1350 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1351 bundle, statbuf.st_size);
1353 if (statbuf.st_size == 0)
1356 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1362 #ifdef SUPPORT_CA_DIR
1363 (statbuf.st_mode & S_IFMT) == S_IFDIR
1365 gnutls_certificate_set_x509_trust_dir(state->lib_state.x509_cred,
1366 CS bundle, GNUTLS_X509_FMT_PEM)
1369 gnutls_certificate_set_x509_trust_file(state->lib_state.x509_cred,
1370 CS bundle, GNUTLS_X509_FMT_PEM);
1372 #ifdef SUPPORT_CA_DIR
1373 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1374 when using the directory-of-certs config model. */
1376 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1378 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1380 state->lib_state.ca_rdn_emulate = TRUE;
1385 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1387 debug_printf("Added %d certificate authorities\n", cert_count);
1394 creds_load_crl(exim_gnutls_state_st * state, const uschar * crl, uschar ** errstr)
1397 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", crl);
1398 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->lib_state.x509_cred,
1399 CS crl, GNUTLS_X509_FMT_PEM)) < 0)
1400 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1401 cert_count, state->host, errstr);
1403 DEBUG(D_tls) debug_printf("Processed %d CRLs\n", cert_count);
1409 creds_load_pristring(exim_gnutls_state_st * state, const uschar * p,
1410 const char ** errpos)
1414 p = exim_default_gnutls_priority;
1416 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1418 return gnutls_priority_init( (gnutls_priority_t *) &state->lib_state.pri_cache,
1423 tls_server_creds_init(void)
1425 uschar * dummy_errstr;
1427 state_server.lib_state = null_tls_preload;
1428 if (gnutls_certificate_allocate_credentials(
1429 (gnutls_certificate_credentials_t *) &state_server.lib_state.x509_cred))
1431 state_server.lib_state.x509_cred = NULL;
1434 creds_basic_init(state_server.lib_state.x509_cred, TRUE);
1436 #ifdef EXIM_HAVE_INOTIFY
1437 /* If tls_certificate has any $ indicating expansions, it is not good.
1438 If tls_privatekey is set but has $, not good. Likewise for tls_ocsp_file.
1439 If all good (and tls_certificate set), load the cert(s). Do not try
1440 to handle selfsign generation for now (tls_certificate null/empty;
1441 XXX will want to do that later though) due to the lifetime/expiry issue. */
1443 if ( opt_set_and_noexpand(tls_certificate)
1444 # ifndef DISABLE_OCSP
1445 && opt_unset_or_noexpand(tls_ocsp_file)
1447 && opt_unset_or_noexpand(tls_privatekey))
1449 /* Set watches on the filenames. The implementation does de-duplication
1450 so we can just blindly do them all.
1453 if ( tls_set_watch(tls_certificate, TRUE)
1454 # ifndef DISABLE_OCSP
1455 && tls_set_watch(tls_ocsp_file, TRUE)
1457 && tls_set_watch(tls_privatekey, TRUE))
1459 DEBUG(D_tls) debug_printf("TLS: preloading server certs\n");
1460 if (creds_load_server_certs(&state_server, tls_certificate,
1461 tls_privatekey && *tls_privatekey ? tls_privatekey : tls_certificate,
1462 # ifdef DISABLE_OCSP
1467 &dummy_errstr) == 0)
1468 state_server.lib_state.conn_certs = TRUE;
1472 DEBUG(D_tls) debug_printf("TLS: not preloading server certs\n");
1474 /* If tls_verify_certificates is non-empty and has no $, load CAs */
1476 if (opt_set_and_noexpand(tls_verify_certificates))
1478 if (tls_set_watch(tls_verify_certificates, FALSE))
1480 DEBUG(D_tls) debug_printf("TLS: preloading CA bundle for server\n");
1481 if (creds_load_cabundle(&state_server, tls_verify_certificates,
1482 NULL, &dummy_errstr) != OK)
1484 state_server.lib_state.cabundle = TRUE;
1486 /* If CAs loaded and tls_crl is non-empty and has no $, load it */
1488 if (opt_set_and_noexpand(tls_crl))
1490 if (tls_set_watch(tls_crl, FALSE))
1492 DEBUG(D_tls) debug_printf("TLS: preloading CRL for server\n");
1493 if (creds_load_crl(&state_server, tls_crl, &dummy_errstr) != OK)
1495 state_server.lib_state.crl = TRUE;
1499 DEBUG(D_tls) debug_printf("TLS: not preloading CRL for server\n");
1503 DEBUG(D_tls) debug_printf("TLS: not preloading CA bundle for server\n");
1504 #endif /* EXIM_HAVE_INOTIFY */
1506 /* If tls_require_ciphers is non-empty and has no $, load the
1507 ciphers priority cache. If unset, load with the default.
1508 (server-only as the client one depends on non/DANE) */
1510 if (!tls_require_ciphers || opt_set_and_noexpand(tls_require_ciphers))
1512 const char * dummy_errpos;
1513 DEBUG(D_tls) debug_printf("TLS: preloading cipher list for server: %s\n",
1514 tls_require_ciphers);
1515 if ( creds_load_pristring(&state_server, tls_require_ciphers, &dummy_errpos)
1517 state_server.lib_state.pri_string = TRUE;
1520 DEBUG(D_tls) debug_printf("TLS: not preloading cipher list for server\n");
1524 /* Preload whatever creds are static, onto a transport. The client can then
1525 just copy the pointer as it starts up. */
1528 tls_client_creds_init(transport_instance * t, BOOL watch)
1530 smtp_transport_options_block * ob = t->options_block;
1531 exim_gnutls_state_st tpt_dummy_state;
1532 host_item * dummy_host = (host_item *)1;
1533 uschar * dummy_errstr;
1535 if (!exim_gnutls_base_init_done)
1538 ob->tls_preload = null_tls_preload;
1539 if (gnutls_certificate_allocate_credentials(
1540 (struct gnutls_certificate_credentials_st **)&ob->tls_preload.x509_cred))
1542 ob->tls_preload.x509_cred = NULL;
1545 creds_basic_init(ob->tls_preload.x509_cred, FALSE);
1547 tpt_dummy_state.session = NULL;
1548 tpt_dummy_state.lib_state = ob->tls_preload;
1550 #ifdef EXIM_HAVE_INOTIFY
1551 if ( opt_set_and_noexpand(ob->tls_certificate)
1552 && opt_unset_or_noexpand(ob->tls_privatekey))
1555 || ( tls_set_watch(ob->tls_certificate, FALSE)
1556 && tls_set_watch(ob->tls_privatekey, FALSE)
1559 const uschar * pkey = ob->tls_privatekey;
1562 debug_printf("TLS: preloading client certs for transport '%s'\n", t->name);
1564 /* The state->lib_state.x509_cred is used for the certs load, and is the sole
1565 structure element used. So we can set up a dummy. The hoat arg only
1566 selects a retcode in case of fail, so any value */
1568 if (creds_load_client_certs(&tpt_dummy_state, dummy_host,
1569 ob->tls_certificate, pkey ? pkey : ob->tls_certificate,
1570 &dummy_errstr) == OK)
1571 ob->tls_preload.conn_certs = TRUE;
1576 debug_printf("TLS: not preloading client certs, for transport '%s'\n", t->name);
1578 if (opt_set_and_noexpand(ob->tls_verify_certificates))
1580 if (!watch || tls_set_watch(ob->tls_verify_certificates, FALSE))
1583 debug_printf("TLS: preloading CA bundle for transport '%s'\n", t->name);
1584 if (creds_load_cabundle(&tpt_dummy_state, ob->tls_verify_certificates,
1585 dummy_host, &dummy_errstr) != OK)
1587 ob->tls_preload.cabundle = TRUE;
1589 if (opt_set_and_noexpand(ob->tls_crl))
1591 if (!watch || tls_set_watch(ob->tls_crl, FALSE))
1593 DEBUG(D_tls) debug_printf("TLS: preloading CRL for transport '%s'\n", t->name);
1594 if (creds_load_crl(&tpt_dummy_state, ob->tls_crl, &dummy_errstr) != OK)
1596 ob->tls_preload.crl = TRUE;
1600 DEBUG(D_tls) debug_printf("TLS: not preloading CRL, for transport '%s'\n", t->name);
1605 debug_printf("TLS: not preloading CA bundle, for transport '%s'\n", t->name);
1607 /* We do not preload tls_require_ciphers to to the transport as it implicitly
1608 depends on DANE or plain usage. */
1614 #ifdef EXIM_HAVE_INOTIFY
1615 /* Invalidate the creds cached, by dropping the current ones.
1616 Call when we notice one of the source files has changed. */
1619 tls_server_creds_invalidate(void)
1621 if (state_server.lib_state.pri_cache)
1622 gnutls_priority_deinit(state_server.lib_state.pri_cache);
1623 state_server.lib_state.pri_cache = NULL;
1625 if (state_server.lib_state.x509_cred)
1626 gnutls_certificate_free_credentials(state_server.lib_state.x509_cred);
1627 state_server.lib_state = null_tls_preload;
1632 tls_client_creds_invalidate(transport_instance * t)
1634 smtp_transport_options_block * ob = t->options_block;
1635 if (ob->tls_preload.x509_cred)
1636 gnutls_certificate_free_credentials(ob->tls_preload.x509_cred);
1637 ob->tls_preload = null_tls_preload;
1642 /*************************************************
1643 * Variables re-expanded post-SNI *
1644 *************************************************/
1646 /* Called from both server and client code, via tls_init(), and also from
1647 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1649 We can tell the two apart by state->received_sni being non-NULL in callback.
1651 The callback should not call us unless state->trigger_sni_changes is true,
1652 which we are responsible for setting on the first pass through.
1655 state exim_gnutls_state_st *
1656 errstr error string pointer
1658 Returns: OK/DEFER/FAIL
1662 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1665 const host_item *host = state->host; /* macro should be reconsidered? */
1666 const uschar *saved_tls_certificate = NULL;
1667 const uschar *saved_tls_privatekey = NULL;
1668 const uschar *saved_tls_verify_certificates = NULL;
1669 const uschar *saved_tls_crl = NULL;
1672 /* We check for tls_sni *before* expansion. */
1673 if (!host) /* server */
1674 if (!state->received_sni)
1676 if ( state->tls_certificate
1677 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1678 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1679 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1682 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI\n");
1683 state->trigger_sni_changes = TRUE;
1686 else /* SNI callback case */
1688 /* useful for debugging */
1689 saved_tls_certificate = state->exp_tls_certificate;
1690 saved_tls_privatekey = state->exp_tls_privatekey;
1691 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1692 saved_tls_crl = state->exp_tls_crl;
1695 if (!state->lib_state.x509_cred)
1697 if ((rc = gnutls_certificate_allocate_credentials(
1698 (gnutls_certificate_credentials_t *) &state->lib_state.x509_cred)))
1699 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
1701 creds_basic_init(state->lib_state.x509_cred, !host);
1705 /* remember: Expand_check_tlsvar() is expand_check() but fiddling with
1706 state members, assuming consistent naming; and expand_check() returns
1707 false if expansion failed, unless expansion was forced to fail. */
1709 /* check if we at least have a certificate, before doing expensive
1712 if (!state->lib_state.conn_certs)
1714 if (!Expand_check_tlsvar(tls_certificate, errstr))
1717 /* certificate is mandatory in server, optional in client */
1719 if ( !state->exp_tls_certificate
1720 || !*state->exp_tls_certificate
1723 return tls_install_selfsign(state, errstr);
1725 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1727 if (state->tls_privatekey && !Expand_check_tlsvar(tls_privatekey, errstr))
1730 /* tls_privatekey is optional, defaulting to same file as certificate */
1732 if (!state->tls_privatekey || !*state->tls_privatekey)
1734 state->tls_privatekey = state->tls_certificate;
1735 state->exp_tls_privatekey = state->exp_tls_certificate;
1738 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1741 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1742 state->exp_tls_certificate, state->exp_tls_privatekey);
1744 if (state->received_sni)
1745 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1746 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1749 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1750 load = FALSE; /* avoid re-loading the same certs */
1752 else /* unload the pre-SNI certs before loading new ones */
1754 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair\n");
1755 gnutls_certificate_free_keys(state->lib_state.x509_cred);
1760 ? creds_load_client_certs(state, host, state->exp_tls_certificate,
1761 state->exp_tls_privatekey, errstr)
1762 : creds_load_server_certs(state, state->exp_tls_certificate,
1763 state->exp_tls_privatekey,
1776 debug_printf("%s certs were preloaded\n", host ? "client" : "server");
1778 if (!state->tls_privatekey) state->tls_privatekey = state->tls_certificate;
1779 state->exp_tls_certificate = US state->tls_certificate;
1780 state->exp_tls_privatekey = US state->tls_privatekey;
1782 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1783 if (state->lib_state.ocsp_hook)
1784 gnutls_handshake_set_hook_function(state->session,
1785 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1790 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1791 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1792 error message is provided. However, if we just refrain from setting anything up
1793 in that case, certificate verification fails, which seems to be the correct
1796 if (!state->lib_state.cabundle)
1798 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1800 if (!Expand_check_tlsvar(tls_verify_certificates, errstr))
1802 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1803 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1804 state->exp_tls_verify_certificates = NULL;
1806 if (state->tls_crl && *state->tls_crl)
1807 if (!Expand_check_tlsvar(tls_crl, errstr))
1810 if (!(state->exp_tls_verify_certificates &&
1811 *state->exp_tls_verify_certificates))
1814 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1815 /* With no tls_verify_certificates, we ignore tls_crl too */
1822 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1825 rc = creds_load_cabundle(state, state->exp_tls_verify_certificates, host, errstr);
1826 if (rc != OK) return rc;
1831 debug_printf("%s CA bundle was preloaded\n", host ? "client" : "server");
1832 state->exp_tls_verify_certificates = US state->tls_verify_certificates;
1834 #ifdef SUPPORT_CA_DIR
1835 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1836 when using the directory-of-certs config model. */
1837 if (state->lib_state.ca_rdn_emulate)
1838 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1843 if (!state->lib_state.crl)
1845 if ( state->tls_crl && *state->tls_crl
1846 && state->exp_tls_crl && *state->exp_tls_crl)
1847 return creds_load_crl(state, state->exp_tls_crl, errstr);
1852 debug_printf("%s CRL was preloaded\n", host ? "client" : "server");
1853 state->exp_tls_crl = US state->tls_crl;
1862 /*************************************************
1863 * Set X.509 state variables *
1864 *************************************************/
1866 /* In GnuTLS, the registered cert/key are not replaced by a later
1867 set of a cert/key, so for SNI support we need a whole new x509_cred
1868 structure. Which means various other non-re-expanded pieces of state
1869 need to be re-set in the new struct, so the setting logic is pulled
1873 state exim_gnutls_state_st *
1874 errstr error string pointer
1876 Returns: OK/DEFER/FAIL
1880 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1883 const host_item *host = state->host; /* macro should be reconsidered? */
1885 #ifndef GNUTLS_AUTO_DHPARAMS
1886 /* Create D-H parameters, or read them from the cache file. This function does
1887 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1888 client-side params. */
1892 if (!dh_server_params)
1893 if ((rc = init_server_dh(errstr)) != OK) return rc;
1895 /* Unnecessary & discouraged with 3.6.0 or later */
1896 gnutls_certificate_set_dh_params(state->lib_state.x509_cred, dh_server_params);
1900 /* Link the credentials to the session. */
1902 if ((rc = gnutls_credentials_set(state->session,
1903 GNUTLS_CRD_CERTIFICATE, state->lib_state.x509_cred)))
1904 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1909 /*************************************************
1910 * Initialize for GnuTLS *
1911 *************************************************/
1914 /* Called from both server and client code. In the case of a server, errors
1915 before actual TLS negotiation return DEFER.
1918 host connected host, if client; NULL if server
1919 ob tranport options block, if client; NULL if server
1920 require_ciphers tls_require_ciphers setting
1921 caller_state returned state-info structure
1922 errstr error string pointer
1924 Returns: OK/DEFER/FAIL
1929 const host_item *host,
1930 smtp_transport_options_block * ob,
1931 const uschar * require_ciphers,
1932 exim_gnutls_state_st **caller_state,
1936 exim_gnutls_state_st * state;
1940 if (!exim_gnutls_base_init_done)
1945 /* For client-side sessions we allocate a context. This lets us run
1946 several in parallel. */
1948 int old_pool = store_pool;
1949 store_pool = POOL_PERM;
1950 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
1951 store_pool = old_pool;
1953 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1954 state->lib_state = ob->tls_preload;
1956 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1957 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1959 state->tls_certificate = ob->tls_certificate;
1960 state->tls_privatekey = ob->tls_privatekey;
1961 state->tls_sni = ob->tls_sni;
1962 state->tls_verify_certificates = ob->tls_verify_certificates;
1963 state->tls_crl = ob->tls_crl;
1967 /* Server operations always use the one state_server context. It is not
1968 shared because we have forked a fresh process for every receive. However it
1969 can get re-used for successive TLS sessions on a single TCP connection. */
1971 state = &state_server;
1973 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1974 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1976 state->tls_certificate = tls_certificate;
1977 state->tls_privatekey = tls_privatekey;
1978 state->tls_sni = NULL;
1979 state->tls_verify_certificates = tls_verify_certificates;
1980 state->tls_crl = tls_crl;
1983 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
1985 state->tls_require_ciphers = require_ciphers;
1988 /* This handles the variables that might get re-expanded after TLS SNI;
1989 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1992 debug_printf("Expanding various TLS configuration options for session credentials\n");
1993 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1995 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1996 requires a new structure afterwards. */
1998 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
2000 /* set SNI in client, only */
2003 if (!expand_check(state->tls_sni, US"tls_out_sni", &state->tlsp->sni, errstr))
2005 if (state->tlsp->sni && *state->tlsp->sni)
2008 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
2009 sz = Ustrlen(state->tlsp->sni);
2010 if ((rc = gnutls_server_name_set(state->session,
2011 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
2012 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
2015 else if (state->tls_sni)
2016 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
2017 "have an SNI set for a server [%s]\n", state->tls_sni);
2019 if (!state->lib_state.pri_string)
2021 const uschar * p = NULL;
2022 const char * errpos;
2024 /* This is the priority string support,
2025 http://www.gnutls.org/manual/html_node/Priority-Strings.html
2026 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
2027 This was backwards incompatible, but means Exim no longer needs to track
2028 all algorithms and provide string forms for them. */
2030 if (state->tls_require_ciphers && *state->tls_require_ciphers)
2032 if (!Expand_check_tlsvar(tls_require_ciphers, errstr))
2034 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
2036 p = state->exp_tls_require_ciphers;
2037 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
2041 if ((rc = creds_load_pristring(state, p, &errpos)))
2042 return tls_error_gnu(string_sprintf(
2043 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
2044 p, errpos - CS p, errpos),
2049 DEBUG(D_tls) debug_printf("cipher list preloaded\n");
2050 state->exp_tls_require_ciphers = US state->tls_require_ciphers;
2054 if ((rc = gnutls_priority_set(state->session, state->lib_state.pri_cache)))
2055 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
2057 /* This also sets the server ticket expiration time to the same, and
2058 the STEK rotation time to 3x. */
2060 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
2062 /* Reduce security in favour of increased compatibility, if the admin
2063 decides to make that trade-off. */
2064 if (gnutls_compat_mode)
2066 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
2067 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
2068 gnutls_session_enable_compatibility_mode(state->session);
2070 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
2074 *caller_state = state;
2080 /*************************************************
2081 * Extract peer information *
2082 *************************************************/
2084 static const uschar *
2085 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
2086 gnutls_mac_algorithm_t mac)
2089 gnutls_kx_algorithm_t kx_i;
2090 gnutls_cipher_algorithm_t cipher_i;
2091 gnutls_mac_algorithm_t mac_i;
2094 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
2096 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
2097 return cipher_stdname(cs_id[0], cs_id[1]);
2103 /* Called from both server and client code.
2104 Only this is allowed to set state->peerdn and state->have_set_peerdn
2105 and we use that to detect double-calls.
2107 NOTE: the state blocks last while the TLS connection is up, which is fine
2108 for logging in the server side, but for the client side, we log after teardown
2109 in src/deliver.c. While the session is up, we can twist about states and
2110 repoint tls_* globals, but those variables used for logging or other variable
2111 expansion that happens _after_ delivery need to have a longer life-time.
2113 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
2114 doing this more than once per generation of a state context. We set them in
2115 the state context, and repoint tls_* to them. After the state goes away, the
2116 tls_* copies of the pointers remain valid and client delivery logging is happy.
2118 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
2122 state exim_gnutls_state_st *
2123 errstr pointer to error string
2125 Returns: OK/DEFER/FAIL
2129 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
2131 gnutls_session_t session = state->session;
2132 const gnutls_datum_t * cert_list;
2134 unsigned int cert_list_size = 0;
2135 gnutls_protocol_t protocol;
2136 gnutls_cipher_algorithm_t cipher;
2137 gnutls_kx_algorithm_t kx;
2138 gnutls_mac_algorithm_t mac;
2139 gnutls_certificate_type_t ct;
2140 gnutls_x509_crt_t crt;
2144 if (state->have_set_peerdn)
2146 state->have_set_peerdn = TRUE;
2148 state->peerdn = NULL;
2151 cipher = gnutls_cipher_get(session);
2152 protocol = gnutls_protocol_get_version(session);
2153 mac = gnutls_mac_get(session);
2155 #ifdef GNUTLS_TLS1_3
2156 protocol >= GNUTLS_TLS1_3 ? 0 :
2158 gnutls_kx_get(session);
2160 old_pool = store_pool;
2162 tls_support * tlsp = state->tlsp;
2163 store_pool = POOL_PERM;
2165 #ifdef SUPPORT_GNUTLS_SESS_DESC
2168 uschar * s = US gnutls_session_get_desc(session), c;
2170 /* Nikos M suggests we use this by preference. It returns like:
2171 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
2173 For partial back-compat, put a colon after the TLS version, replace the
2174 )-( grouping with __, replace in-group - with _ and append the :keysize. */
2176 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
2178 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
2180 tlsp->ver = string_copyn(g->s, g->ptr);
2181 for (uschar * p = US tlsp->ver; *p; p++)
2182 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
2184 g = string_catn(g, US":", 1);
2185 if (*s) s++; /* now on _ between groups */
2188 for (*++s && ++s; (c = *s) && c != ')'; s++)
2189 g = string_catn(g, c == '-' ? US"_" : s, 1);
2190 /* now on ) closing group */
2191 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
2192 /* now on _ between groups */
2194 g = string_catn(g, US":", 1);
2195 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
2196 state->ciphersuite = string_from_gstring(g);
2199 state->ciphersuite = string_sprintf("%s:%s:%d",
2200 gnutls_protocol_get_name(protocol),
2201 gnutls_cipher_suite_get_name(kx, cipher, mac),
2202 (int) gnutls_cipher_get_key_size(cipher) * 8);
2204 /* I don't see a way that spaces could occur, in the current GnuTLS
2205 code base, but it was a concern in the old code and perhaps older GnuTLS
2206 releases did return "TLS 1.0"; play it safe, just in case. */
2208 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
2209 tlsp->ver = string_copyn(state->ciphersuite,
2210 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
2213 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
2215 tlsp->cipher = state->ciphersuite;
2216 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
2218 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
2220 store_pool = old_pool;
2223 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
2225 if (!cert_list || cert_list_size == 0)
2227 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
2228 cert_list, cert_list_size);
2229 if (state->verify_requirement >= VERIFY_REQUIRED)
2230 return tls_error(US"certificate verification failed",
2231 US"no certificate received from peer", state->host, errstr);
2235 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
2237 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
2239 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
2240 if (state->verify_requirement >= VERIFY_REQUIRED)
2241 return tls_error(US"certificate verification not possible, unhandled type",
2242 ctn, state->host, errstr);
2246 #define exim_gnutls_peer_err(Label) \
2248 if (rc != GNUTLS_E_SUCCESS) \
2250 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
2251 (Label), gnutls_strerror(rc)); \
2252 if (state->verify_requirement >= VERIFY_REQUIRED) \
2253 return tls_error_gnu((Label), rc, state->host, errstr); \
2258 rc = import_cert(&cert_list[0], &crt);
2259 exim_gnutls_peer_err(US"cert 0");
2261 state->tlsp->peercert = state->peercert = crt;
2264 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
2265 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
2267 exim_gnutls_peer_err(US"getting size for cert DN failed");
2268 return FAIL; /* should not happen */
2270 dn_buf = store_get_perm(sz, TRUE); /* tainted */
2271 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
2272 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
2274 state->peerdn = dn_buf;
2277 #undef exim_gnutls_peer_err
2283 /*************************************************
2284 * Verify peer certificate *
2285 *************************************************/
2287 /* Called from both server and client code.
2288 *Should* be using a callback registered with
2289 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
2290 the peer information, but that's too new for some OSes.
2293 state exim_gnutls_state_st *
2294 errstr where to put an error message
2297 FALSE if the session should be rejected
2298 TRUE if the cert is okay or we just don't care
2302 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
2307 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
2309 rc = peer_status(state, errstr);
2311 if (state->verify_requirement == VERIFY_NONE)
2314 if (rc != OK || !state->peerdn)
2316 verify = GNUTLS_CERT_INVALID;
2317 *errstr = US"certificate not supplied";
2323 if (state->verify_requirement == VERIFY_DANE && state->host)
2325 /* Using dane_verify_session_crt() would be easy, as it does it all for us
2326 including talking to a DNS resolver. But we want to do that bit ourselves
2327 as the testsuite intercepts and fakes its own DNS environment. */
2332 const gnutls_datum_t * certlist =
2333 gnutls_certificate_get_peers(state->session, &lsize);
2334 int usage = tls_out.tlsa_usage;
2336 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2337 /* Split the TLSA records into two sets, TA and EE selectors. Run the
2338 dane-verification separately so that we know which selector verified;
2339 then we know whether to do name-verification (needed for TA but not EE). */
2341 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
2342 { /* a mixed-usage bundle */
2347 for (nrec = 0; state->dane_data_len[nrec]; ) nrec++;
2350 dd = store_get(nrec * sizeof(uschar *), FALSE);
2351 ddl = store_get(nrec * sizeof(int), FALSE);
2354 if ((rc = dane_state_init(&s, 0)))
2357 for (usage = DANESSL_USAGE_DANE_EE;
2358 usage >= DANESSL_USAGE_DANE_TA; usage--)
2359 { /* take records with this usage */
2360 for (j = i = 0; i < nrec; i++)
2361 if (state->dane_data[i][0] == usage)
2363 dd[j] = state->dane_data[i];
2364 ddl[j++] = state->dane_data_len[i];
2371 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
2374 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
2375 gnutls_certificate_type_get(state->session),
2377 usage == DANESSL_USAGE_DANE_EE
2378 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2382 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
2384 else if (verify == 0) /* verification passed */
2392 if (rc) goto tlsa_prob;
2397 if ( (rc = dane_state_init(&s, 0))
2398 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
2400 || (rc = dane_verify_crt_raw(s, certlist, lsize,
2401 gnutls_certificate_type_get(state->session),
2403 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2404 usage == (1 << DANESSL_USAGE_DANE_EE)
2405 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2414 if (verify != 0) /* verification failed */
2417 (void) dane_verification_status_print(verify, &str, 0);
2418 *errstr = US str.data; /* don't bother to free */
2422 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2423 /* If a TA-mode TLSA record was used for verification we must additionally
2424 verify the cert name (but not the CA chain). For EE-mode, skip it. */
2426 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2429 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2432 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2433 /* Assume that the name on the A-record is the one that should be matching
2434 the cert. An alternate view is that the domain part of the email address
2435 is also permissible. */
2437 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2438 CS state->host->name))
2440 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2445 #endif /*SUPPORT_DANE*/
2447 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2450 /* Handle the result of verification. INVALID is set if any others are. */
2452 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2454 state->peer_cert_verified = FALSE;
2457 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2462 if (gnutls_certificate_verification_status_print(verify,
2463 gnutls_certificate_type_get(state->session), &txt, 0)
2464 == GNUTLS_E_SUCCESS)
2466 debug_printf("%s\n", txt.data);
2467 gnutls_free(txt.data);
2471 *errstr = verify & GNUTLS_CERT_REVOKED
2472 ? US"certificate revoked" : US"certificate invalid";
2476 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2477 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2479 if (state->verify_requirement >= VERIFY_REQUIRED)
2482 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2487 /* Client side, check the server's certificate name versus the name on the
2488 A-record for the connection we made. What to do for server side - what name
2489 to use for client? We document that there is no such checking for server
2492 if ( state->exp_tls_verify_cert_hostnames
2493 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2494 CS state->exp_tls_verify_cert_hostnames)
2498 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2499 if (state->verify_requirement >= VERIFY_REQUIRED)
2504 state->peer_cert_verified = TRUE;
2505 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2506 state->peerdn ? state->peerdn : US"<unset>");
2510 state->tlsp->peerdn = state->peerdn;
2515 *errstr = string_sprintf("TLSA record problem: %s",
2516 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2520 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2527 /* ------------------------------------------------------------------------ */
2530 /* Logging function which can be registered with
2531 * gnutls_global_set_log_function()
2532 * gnutls_global_set_log_level() 0..9
2534 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2536 exim_gnutls_logger_cb(int level, const char *message)
2538 size_t len = strlen(message);
2541 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2544 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2545 message[len-1] == '\n' ? "" : "\n");
2550 /* Called after client hello, should handle SNI work.
2551 This will always set tls_sni (state->received_sni) if available,
2552 and may trigger presenting different certificates,
2553 if state->trigger_sni_changes is TRUE.
2555 Should be registered with
2556 gnutls_handshake_set_post_client_hello_function()
2558 "This callback must return 0 on success or a gnutls error code to terminate the
2561 For inability to get SNI information, we return 0.
2562 We only return non-zero if re-setup failed.
2563 Only used for server-side TLS.
2567 exim_sni_handling_cb(gnutls_session_t session)
2569 char sni_name[MAX_HOST_LEN];
2570 size_t data_len = MAX_HOST_LEN;
2571 exim_gnutls_state_st *state = &state_server;
2572 unsigned int sni_type;
2574 uschar * dummy_errstr;
2576 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2577 if (rc != GNUTLS_E_SUCCESS)
2580 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2581 debug_printf("TLS: no SNI presented in handshake\n");
2583 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2584 gnutls_strerror(rc), rc);
2588 if (sni_type != GNUTLS_NAME_DNS)
2590 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2594 /* We now have a UTF-8 string in sni_name */
2595 old_pool = store_pool;
2596 store_pool = POOL_PERM;
2597 state->received_sni = string_copy_taint(US sni_name, TRUE);
2598 store_pool = old_pool;
2600 /* We set this one now so that variable expansions below will work */
2601 state->tlsp->sni = state->received_sni;
2603 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2604 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2606 if (!state->trigger_sni_changes)
2609 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2611 /* If the setup of certs/etc failed before handshake, TLS would not have
2612 been offered. The best we can do now is abort. */
2613 return GNUTLS_E_APPLICATION_ERROR_MIN;
2616 rc = tls_set_remaining_x509(state, &dummy_errstr);
2617 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2624 #ifndef DISABLE_EVENT
2626 We use this callback to get observability and detail-level control
2627 for an exim TLS connection (either direction), raising a tls:cert event
2628 for each cert in the chain presented by the peer. Any event
2629 can deny verification.
2631 Return 0 for the handshake to continue or non-zero to terminate.
2635 verify_cb(gnutls_session_t session)
2637 const gnutls_datum_t * cert_list;
2638 unsigned int cert_list_size = 0;
2639 gnutls_x509_crt_t crt;
2642 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2644 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2645 while (cert_list_size--)
2647 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2649 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2650 cert_list_size, gnutls_strerror(rc));
2654 state->tlsp->peercert = crt;
2655 if ((yield = event_raise(state->event_action,
2656 US"tls:cert", string_sprintf("%d", cert_list_size))))
2658 log_write(0, LOG_MAIN,
2659 "SSL verify denied by event-action: depth=%d: %s",
2660 cert_list_size, yield);
2661 return 1; /* reject */
2663 state->tlsp->peercert = NULL;
2673 ddump(gnutls_datum_t * d)
2675 gstring * g = string_get((d->size+1) * 2);
2676 uschar * s = d->data;
2677 for (unsigned i = d->size; i > 0; i--, s++)
2679 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2680 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2686 post_handshake_debug(exim_gnutls_state_st * state)
2688 #ifdef SUPPORT_GNUTLS_SESS_DESC
2689 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2692 #ifdef SUPPORT_GNUTLS_KEYLOG
2693 # ifdef EXIM_HAVE_TLS1_3
2694 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2699 gnutls_datum_t c, s;
2701 /* For TLS1.2 we only want the client random and the master secret */
2702 gnutls_session_get_random(state->session, &c, &s);
2703 gnutls_session_get_master_secret(state->session, &s);
2706 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2709 debug_printf("To get keying info for TLS1.3 is hard:\n"
2710 " Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,\n"
2711 " and make sure it is writable by the Exim runtime user.\n"
2712 " Add SSLKEYLOGFILE to keep_environment in the exim config.\n"
2713 " Start Exim as root.\n"
2714 " If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2715 " (works for TLS1.2 also, and saves cut-paste into file).\n"
2716 " Trying to use add_environment for this will not work\n");
2721 #ifdef EXIM_HAVE_TLS_RESUME
2723 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2724 unsigned incoming, const gnutls_datum_t * msg)
2726 DEBUG(D_tls) debug_printf("newticket cb\n");
2727 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2732 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2734 /* Should the server offer session resumption? */
2735 tls_in.resumption = RESUME_SUPPORTED;
2736 if (verify_check_host(&tls_resumption_hosts) == OK)
2739 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2740 an offered resumption is unacceptable. We lose one resumption per ticket
2741 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2742 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2743 least they go out in a single packet. */
2745 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2746 &server_sessticket_key)))
2747 tls_in.resumption |= RESUME_SERVER_TICKET;
2750 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2752 /* Try to tell if we see a ticket request */
2753 gnutls_handshake_set_hook_function(state->session,
2754 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2759 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2761 if (gnutls_session_resumption_requested(state->session))
2763 /* This tells us the client sent a full ticket. We use a
2764 callback on session-ticket request, elsewhere, to tell
2765 if a client asked for a ticket. */
2767 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2768 DEBUG(D_tls) debug_printf("client requested resumption\n");
2770 if (gnutls_session_is_resumed(state->session))
2772 tls_in.resumption |= RESUME_USED;
2773 DEBUG(D_tls) debug_printf("Session resumed\n");
2777 /* ------------------------------------------------------------------------ */
2778 /* Exported functions */
2783 /*************************************************
2784 * Start a TLS session in a server *
2785 *************************************************/
2787 /* This is called when Exim is running as a server, after having received
2788 the STARTTLS command. It must respond to that command, and then negotiate
2792 errstr pointer to error string
2794 Returns: OK on success
2795 DEFER for errors before the start of the negotiation
2796 FAIL for errors during the negotiation; the server can't
2801 tls_server_start(uschar ** errstr)
2804 exim_gnutls_state_st * state = NULL;
2806 /* Check for previous activation */
2807 if (tls_in.active.sock >= 0)
2809 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2810 smtp_printf("554 Already in TLS\r\n", FALSE);
2814 /* Initialize the library. If it fails, it will already have logged the error
2815 and sent an SMTP response. */
2817 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2820 #ifdef MEASURE_TIMING
2822 gettimeofday(&t0, NULL);
2825 if ((rc = tls_init(NULL, NULL,
2826 tls_require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2828 #ifdef MEASURE_TIMING
2829 report_time_since(&t0, US"server tls_init (delta)");
2833 #ifdef EXIM_HAVE_TLS_RESUME
2834 tls_server_resume_prehandshake(state);
2837 /* If this is a host for which certificate verification is mandatory or
2838 optional, set up appropriately. */
2840 if (verify_check_host(&tls_verify_hosts) == OK)
2843 debug_printf("TLS: a client certificate will be required\n");
2844 state->verify_requirement = VERIFY_REQUIRED;
2845 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2847 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2850 debug_printf("TLS: a client certificate will be requested but not required\n");
2851 state->verify_requirement = VERIFY_OPTIONAL;
2852 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2857 debug_printf("TLS: a client certificate will not be requested\n");
2858 state->verify_requirement = VERIFY_NONE;
2859 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2862 #ifndef DISABLE_EVENT
2865 state->event_action = event_action;
2866 gnutls_session_set_ptr(state->session, state);
2867 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
2871 /* Register SNI handling; always, even if not in tls_certificate, so that the
2872 expansion variable $tls_sni is always available. */
2874 gnutls_handshake_set_post_client_hello_function(state->session,
2875 exim_sni_handling_cb);
2877 /* Set context and tell client to go ahead, except in the case of TLS startup
2878 on connection, where outputting anything now upsets the clients and tends to
2879 make them disconnect. We need to have an explicit fflush() here, to force out
2880 the response. Other smtp_printf() calls do not need it, because in non-TLS
2881 mode, the fflush() happens when smtp_getc() is called. */
2883 if (!state->tlsp->on_connect)
2885 smtp_printf("220 TLS go ahead\r\n", FALSE);
2889 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2890 that the GnuTLS library doesn't.
2891 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2892 to set (and clear down afterwards) up a pull-timeout callback function that does
2893 a select, so we're no better off unless avoiding signals becomes an issue. */
2895 gnutls_transport_set_ptr2(state->session,
2896 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2897 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
2898 state->fd_in = fileno(smtp_in);
2899 state->fd_out = fileno(smtp_out);
2901 sigalrm_seen = FALSE;
2902 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2904 rc = gnutls_handshake(state->session);
2905 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2908 if (rc != GNUTLS_E_SUCCESS)
2910 /* It seems that, except in the case of a timeout, we have to close the
2911 connection right here; otherwise if the other end is running OpenSSL it hangs
2912 until the server times out. */
2916 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
2917 gnutls_db_remove_session(state->session);
2921 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
2922 (void) gnutls_alert_send_appropriate(state->session, rc);
2923 gnutls_deinit(state->session);
2924 gnutls_certificate_free_credentials(state->lib_state.x509_cred);
2925 state->lib_state = null_tls_preload;
2927 shutdown(state->fd_out, SHUT_WR);
2928 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
2929 (void)fclose(smtp_out);
2930 (void)fclose(smtp_in);
2931 smtp_out = smtp_in = NULL;
2937 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
2938 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
2939 tls_in.ext_master_secret = TRUE;
2942 #ifdef EXIM_HAVE_TLS_RESUME
2943 tls_server_resume_posthandshake(state);
2946 DEBUG(D_tls) post_handshake_debug(state);
2948 /* Verify after the fact */
2950 if (!verify_certificate(state, errstr))
2952 if (state->verify_requirement != VERIFY_OPTIONAL)
2954 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
2958 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
2962 /* Sets various Exim expansion variables; always safe within server */
2964 extract_exim_vars_from_tls_state(state);
2966 /* TLS has been set up. Adjust the input functions to read via TLS,
2967 and initialize appropriately. */
2969 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2971 receive_getc = tls_getc;
2972 receive_getbuf = tls_getbuf;
2973 receive_get_cache = tls_get_cache;
2974 receive_ungetc = tls_ungetc;
2975 receive_feof = tls_feof;
2976 receive_ferror = tls_ferror;
2977 receive_smtp_buffered = tls_smtp_buffered;
2986 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2987 smtp_transport_options_block * ob)
2989 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2991 state->exp_tls_verify_cert_hostnames =
2993 string_domain_utf8_to_alabel(host->certname, NULL);
2998 debug_printf("TLS: server cert verification includes hostname: \"%s\"\n",
2999 state->exp_tls_verify_cert_hostnames);
3007 /* Given our list of RRs from the TLSA lookup, build a lookup block in
3008 GnuTLS-DANE's preferred format. Hang it on the state str for later
3009 use in DANE verification.
3011 We point at the dnsa data not copy it, so it must remain valid until
3012 after verification is done.*/
3015 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
3019 const char ** dane_data;
3020 int * dane_data_len;
3023 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3024 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3025 ) if (rr->type == T_TLSA) i++;
3027 dane_data = store_get(i * sizeof(uschar *), FALSE);
3028 dane_data_len = store_get(i * sizeof(int), FALSE);
3031 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3032 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
3033 ) if (rr->type == T_TLSA && rr->size > 3)
3035 const uschar * p = rr->data;
3036 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
3037 uint8_t usage = p[0], sel = p[1], type = p[2];
3040 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
3042 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
3043 || (sel != 0 && sel != 1)
3048 case 0: /* Full: cannot check at present */
3050 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
3052 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
3057 tls_out.tlsa_usage |= 1<<usage;
3058 dane_data[i] = CS p;
3059 dane_data_len[i++] = rr->size;
3062 if (!i) return FALSE;
3064 dane_data[i] = NULL;
3065 dane_data_len[i] = 0;
3067 state->dane_data = (char * const *)dane_data;
3068 state->dane_data_len = dane_data_len;
3075 #ifdef EXIM_HAVE_TLS_RESUME
3076 /* On the client, get any stashed session for the given IP from hints db
3077 and apply it to the ssl-connection for attempted resumption. Although
3078 there is a gnutls_session_ticket_enable_client() interface it is
3079 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
3080 by deafult". There seems to be no way to disable them, so even hosts not
3081 enabled by the transport option will be sent a ticket request. We will
3082 however avoid storing and retrieving session information. */
3085 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
3086 host_item * host, smtp_transport_options_block * ob)
3088 tlsp->resumption = RESUME_SUPPORTED;
3089 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3091 dbdata_tls_session * dt;
3093 open_db dbblock, * dbm_file;
3096 debug_printf("check for resumable session for %s\n", host->address);
3097 tlsp->host_resumable = TRUE;
3098 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3099 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
3101 /* Key for the db is the IP. We'd like to filter the retrieved session
3102 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
3104 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
3105 if (!(rc = gnutls_session_set_data(session,
3106 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
3108 DEBUG(D_tls) debug_printf("good session\n");
3109 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3111 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
3112 US gnutls_strerror(rc));
3113 dbfn_close(dbm_file);
3120 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
3122 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
3123 but this flag is not set until the second. TLS 1.3 it's the other way about.
3124 Keep both calls as the session data cannot be extracted before handshake
3127 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
3132 DEBUG(D_tls) debug_printf("server offered session ticket\n");
3133 tlsp->ticket_received = TRUE;
3134 tlsp->resumption |= RESUME_SERVER_TICKET;
3136 if (tlsp->host_resumable)
3137 if (!(rc = gnutls_session_get_data2(session, &tkt)))
3139 open_db dbblock, * dbm_file;
3140 int dlen = sizeof(dbdata_tls_session) + tkt.size;
3141 dbdata_tls_session * dt = store_get(dlen, TRUE);
3143 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
3144 memcpy(dt->session, tkt.data, tkt.size);
3145 gnutls_free(tkt.data);
3147 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3149 /* key for the db is the IP */
3150 dbfn_delete(dbm_file, host->address);
3151 dbfn_write(dbm_file, host->address, dt, dlen);
3152 dbfn_close(dbm_file);
3155 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
3159 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
3164 /* With a TLS1.3 session, the ticket(s) are not seen until
3165 the first data read is attempted. And there's often two of them.
3166 Pick them up with this callback. We are also called for 1.2
3170 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
3171 unsigned incoming, const gnutls_datum_t * msg)
3173 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
3174 tls_support * tlsp = state->tlsp;
3176 DEBUG(D_tls) debug_printf("newticket cb\n");
3178 if (!tlsp->ticket_received)
3179 tls_save_session(tlsp, sess, state->host);
3185 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
3186 tls_support * tlsp, host_item * host,
3187 smtp_transport_options_block * ob)
3189 gnutls_session_set_ptr(state->session, state);
3190 gnutls_handshake_set_hook_function(state->session,
3191 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
3193 tls_retrieve_session(tlsp, state->session, host, ob);
3197 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
3198 tls_support * tlsp, host_item * host)
3200 if (gnutls_session_is_resumed(state->session))
3202 DEBUG(D_tls) debug_printf("Session resumed\n");
3203 tlsp->resumption |= RESUME_USED;
3206 tls_save_session(tlsp, state->session, host);
3208 #endif /* !DISABLE_TLS_RESUME */
3211 /*************************************************
3212 * Start a TLS session in a client *
3213 *************************************************/
3215 /* Called from the smtp transport after STARTTLS has been accepted.
3218 cctx connection context
3219 conn_args connection details
3220 cookie datum for randomness (not used)
3221 tlsp record details of channel configuration here; must be non-NULL
3222 errstr error string pointer
3224 Returns: TRUE for success with TLS session context set in smtp context,
3229 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3230 void * cookie ARG_UNUSED,
3231 tls_support * tlsp, uschar ** errstr)
3233 host_item * host = conn_args->host; /* for msgs and option-tests */
3234 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3235 smtp_transport_options_block * ob = tb
3236 ? (smtp_transport_options_block *)tb->options_block
3237 : &smtp_transport_option_defaults;
3239 exim_gnutls_state_st * state = NULL;
3240 uschar * cipher_list = NULL;
3242 #ifndef DISABLE_OCSP
3244 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3245 BOOL request_ocsp = require_ocsp ? TRUE
3246 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3249 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
3252 /* If dane is flagged, have either request or require dane for this host, and
3253 a TLSA record found. Therefore, dane verify required. Which implies cert must
3254 be requested and supplied, dane verify must pass, and cert verify irrelevant
3255 (incl. hostnames), and (caller handled) require_tls and sni=$domain */
3257 if (conn_args->dane && ob->dane_require_tls_ciphers)
3259 /* not using Expand_check_tlsvar because not yet in state */
3260 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3261 &cipher_list, errstr))
3263 cipher_list = cipher_list && *cipher_list
3264 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
3269 cipher_list = ob->tls_require_ciphers;
3272 #ifdef MEASURE_TIMING
3274 gettimeofday(&t0, NULL);
3277 if (tls_init(host, ob, cipher_list, &state, tlsp, errstr) != OK)
3280 #ifdef MEASURE_TIMING
3281 report_time_since(&t0, US"client tls_init (delta)");
3286 int dh_min_bits = ob->tls_dh_min_bits;
3287 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
3290 debug_printf("WARNING: tls_dh_min_bits far too low,"
3291 " clamping %d up to %d\n",
3292 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
3293 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
3296 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
3297 " acceptable bits to %d\n",
3299 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
3302 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
3303 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
3304 the specified host patterns if one of them is defined */
3307 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
3310 debug_printf("TLS: server certificate DANE required\n");
3311 state->verify_requirement = VERIFY_DANE;
3312 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3316 if ( ( state->exp_tls_verify_certificates
3317 && !ob->tls_verify_hosts
3318 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
3320 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
3323 tls_client_setup_hostname_checks(host, state, ob);
3325 debug_printf("TLS: server certificate verification required\n");
3326 state->verify_requirement = VERIFY_REQUIRED;
3327 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
3329 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
3331 tls_client_setup_hostname_checks(host, state, ob);
3333 debug_printf("TLS: server certificate verification optional\n");
3334 state->verify_requirement = VERIFY_OPTIONAL;
3335 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
3340 debug_printf("TLS: server certificate verification not required\n");
3341 state->verify_requirement = VERIFY_NONE;
3342 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
3345 #ifndef DISABLE_OCSP
3346 /* supported since GnuTLS 3.1.3 */
3349 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
3350 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
3351 NULL, 0, NULL)) != OK)
3353 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
3356 tlsp->ocsp = OCSP_NOT_RESP;
3360 #ifdef EXIM_HAVE_TLS_RESUME
3361 tls_client_resume_prehandshake(state, tlsp, host, ob);
3364 #ifndef DISABLE_EVENT
3365 if (tb && tb->event_action)
3367 state->event_action = tb->event_action;
3368 gnutls_session_set_ptr(state->session, state);
3369 gnutls_certificate_set_verify_function(state->lib_state.x509_cred, verify_cb);
3373 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
3374 state->fd_in = cctx->sock;
3375 state->fd_out = cctx->sock;
3377 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
3378 /* There doesn't seem to be a built-in timeout on connection. */
3380 sigalrm_seen = FALSE;
3381 ALARM(ob->command_timeout);
3383 rc = gnutls_handshake(state->session);
3384 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
3387 if (rc != GNUTLS_E_SUCCESS)
3391 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
3392 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
3395 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
3399 DEBUG(D_tls) post_handshake_debug(state);
3403 if (!verify_certificate(state, errstr))
3405 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
3409 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3410 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3411 tlsp->ext_master_secret = TRUE;
3414 #ifndef DISABLE_OCSP
3419 gnutls_datum_t stapling;
3420 gnutls_ocsp_resp_t resp;
3421 gnutls_datum_t printed;
3425 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
3426 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
3428 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
3431 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
3432 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
3433 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
3436 debug_printf("%.4096s", printed.data);
3437 gnutls_free(printed.data);
3440 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3442 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3445 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3447 tlsp->ocsp = OCSP_FAILED;
3448 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3454 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3455 tlsp->ocsp = OCSP_VFIED;
3460 #ifdef EXIM_HAVE_TLS_RESUME
3461 tls_client_resume_posthandshake(state, tlsp, host);
3464 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3466 extract_exim_vars_from_tls_state(state);
3468 cctx->tls_ctx = state;
3475 /*************************************************
3476 * Close down a TLS session *
3477 *************************************************/
3479 /* This is also called from within a delivery subprocess forked from the
3480 daemon, to shut down the TLS library, without actually doing a shutdown (which
3481 would tamper with the TLS session in the parent process).
3484 ct_ctx client context pointer, or NULL for the one global server context
3485 shutdown 1 if TLS close-alert is to be sent,
3486 2 if also response to be waited for
3492 tls_close(void * ct_ctx, int shutdown)
3494 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3495 tls_support * tlsp = state->tlsp;
3497 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3501 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3502 shutdown > 1 ? " (with response-wait)" : "");
3505 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3509 if (!ct_ctx) /* server */
3511 receive_getc = smtp_getc;
3512 receive_getbuf = smtp_getbuf;
3513 receive_get_cache = smtp_get_cache;
3514 receive_ungetc = smtp_ungetc;
3515 receive_feof = smtp_feof;
3516 receive_ferror = smtp_ferror;
3517 receive_smtp_buffered = smtp_buffered;
3520 gnutls_deinit(state->session);
3521 gnutls_certificate_free_credentials(state->lib_state.x509_cred);
3522 state->lib_state = null_tls_preload;
3524 tlsp->active.sock = -1;
3525 tlsp->active.tls_ctx = NULL;
3526 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3527 tlsp->channelbinding = NULL;
3530 if (state->xfer_buffer) store_free(state->xfer_buffer);
3537 tls_refill(unsigned lim)
3539 exim_gnutls_state_st * state = &state_server;
3542 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, buffersize=%u)\n",
3543 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3545 sigalrm_seen = FALSE;
3546 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3550 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3551 MIN(ssl_xfer_buffer_size, lim));
3552 while (inbytes == GNUTLS_E_AGAIN);
3554 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3556 if (had_command_timeout) /* set by signal handler */
3557 smtp_command_timeout_exit(); /* does not return */
3558 if (had_command_sigterm)
3559 smtp_command_sigterm_exit();
3560 if (had_data_timeout)
3561 smtp_data_timeout_exit();
3562 if (had_data_sigint)
3563 smtp_data_sigint_exit();
3565 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3566 TLS session has been closed down, not that the socket itself has been closed
3567 down. Revert to non-TLS handling. */
3571 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3572 state->xfer_error = TRUE;
3576 else if (inbytes == 0)
3578 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3579 tls_close(NULL, TLS_NO_SHUTDOWN);
3583 /* Handle genuine errors */
3585 else if (inbytes < 0)
3587 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3588 record_io_error(state, (int) inbytes, US"recv", NULL);
3589 state->xfer_error = TRUE;
3592 #ifndef DISABLE_DKIM
3593 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3595 state->xfer_buffer_hwm = (int) inbytes;
3596 state->xfer_buffer_lwm = 0;
3600 /*************************************************
3601 * TLS version of getc *
3602 *************************************************/
3604 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3605 it refills the buffer via the GnuTLS reading function.
3606 Only used by the server-side TLS.
3608 This feeds DKIM and should be used for all message-body reads.
3610 Arguments: lim Maximum amount to read/buffer
3611 Returns: the next character or EOF
3615 tls_getc(unsigned lim)
3617 exim_gnutls_state_st * state = &state_server;
3619 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3620 if (!tls_refill(lim))
3621 return state->xfer_error ? EOF : smtp_getc(lim);
3623 /* Something in the buffer; return next uschar */
3625 return state->xfer_buffer[state->xfer_buffer_lwm++];
3629 tls_getbuf(unsigned * len)
3631 exim_gnutls_state_st * state = &state_server;
3635 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3636 if (!tls_refill(*len))
3638 if (!state->xfer_error) return smtp_getbuf(len);
3643 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3645 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3646 state->xfer_buffer_lwm += size;
3655 #ifndef DISABLE_DKIM
3656 exim_gnutls_state_st * state = &state_server;
3657 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3659 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3665 tls_could_read(void)
3667 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3668 || gnutls_record_check_pending(state_server.session) > 0;
3674 /*************************************************
3675 * Read bytes from TLS channel *
3676 *************************************************/
3678 /* This does not feed DKIM, so if the caller uses this for reading message body,
3679 then the caller must feed DKIM.
3682 ct_ctx client context pointer, or NULL for the one global server context
3686 Returns: the number of bytes read
3687 -1 after a failed read, including EOF
3691 tls_read(void * ct_ctx, uschar *buff, size_t len)
3693 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3699 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3701 debug_printf("*** PROBABLY A BUG *** " \
3702 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3703 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3706 debug_printf("Calling gnutls_record_recv(session=%p, buffer=%p, len=" SIZE_T_FMT ")\n",
3707 state->session, buff, len);
3711 inbytes = gnutls_record_recv(state->session, buff, len);
3712 while (inbytes == GNUTLS_E_AGAIN);
3714 if (inbytes > 0) return inbytes;
3717 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3721 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3722 record_io_error(state, (int)inbytes, US"recv", NULL);
3731 /*************************************************
3732 * Write bytes down TLS channel *
3733 *************************************************/
3737 ct_ctx client context pointer, or NULL for the one global server context
3740 more more data expected soon
3742 Calling with len zero and more unset will flush buffered writes. The buff
3743 argument can be null for that case.
3745 Returns: the number of bytes after a successful write,
3746 -1 after a failed write
3750 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
3754 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3757 if (more && !state->corked)
3759 DEBUG(D_tls) debug_printf("gnutls_record_cork(session=%p)\n", state->session);
3760 gnutls_record_cork(state->session);
3761 state->corked = TRUE;
3765 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
3766 buff, left, more ? ", more" : "");
3770 DEBUG(D_tls) debug_printf("gnutls_record_send(session=%p, buffer=%p, left=" SIZE_T_FMT ")\n",
3771 state->session, buff, left);
3775 outbytes = gnutls_record_send(state->session, buff, left);
3776 while (outbytes == GNUTLS_E_AGAIN);
3778 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
3782 #ifdef GNUTLS_E_PREMATURE_TERMINATION
3783 if ( outbytes == GNUTLS_E_PREMATURE_TERMINATION && errno == ECONNRESET
3784 && !ct_ctx && f.smtp_in_quit
3786 { /* Outlook, dammit */
3787 if (LOGGING(protocol_detail))
3788 log_write(0, LOG_MAIN, "[%s] after QUIT, client reset TCP before"
3789 " SMTP response and TLS close\n", sender_host_address);
3791 DEBUG(D_tls) debug_printf("[%s] SSL_write: after QUIT,"
3792 " client reset TCP before TLS close\n", sender_host_address);
3797 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
3798 record_io_error(state, outbytes, US"send", NULL);
3804 record_io_error(state, 0, US"send", US"TLS channel closed on write");
3815 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
3821 if (!more && state->corked)
3823 DEBUG(D_tls) debug_printf("gnutls_record_uncork(session=%p)\n", state->session);
3825 /* We can't use GNUTLS_RECORD_WAIT here, as it retries on
3826 GNUTLS_E_AGAIN || GNUTLS_E_INTR, which would break our timeout set by alarm().
3827 The GNUTLS_E_AGAIN should not happen ever, as our sockets are blocking anyway.
3828 But who knows. (That all relies on the fact that GNUTLS_E_INTR and GNUTLS_E_AGAIN
3829 match the EINTR and EAGAIN errno values.) */
3830 outbytes = gnutls_record_uncork(state->session, 0);
3831 while (outbytes == GNUTLS_E_AGAIN);
3835 record_io_error(state, len, US"uncork", NULL);
3839 state->corked = FALSE;
3849 /*************************************************
3850 * Random number generation *
3851 *************************************************/
3853 /* Pseudo-random number generation. The result is not expected to be
3854 cryptographically strong but not so weak that someone will shoot themselves
3855 in the foot using it as a nonce in input in some email header scheme or
3856 whatever weirdness they'll twist this into. The result should handle fork()
3857 and avoid repeating sequences. OpenSSL handles that for us.
3861 Returns a random number in range [0, max-1]
3864 #ifdef HAVE_GNUTLS_RND
3866 vaguely_random_number(int max)
3870 uschar smallbuf[sizeof(r)];
3875 needed_len = sizeof(r);
3876 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
3877 asked for a number less than 10. */
3879 for (r = max, i = 0; r; ++i)
3885 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
3888 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback\n");
3889 return vaguely_random_number_fallback(max);
3892 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
3895 /* We don't particularly care about weighted results; if someone wants
3896 * smooth distribution and cares enough then they should submit a patch then. */
3899 #else /* HAVE_GNUTLS_RND */
3901 vaguely_random_number(int max)
3903 return vaguely_random_number_fallback(max);
3905 #endif /* HAVE_GNUTLS_RND */
3910 /*************************************************
3911 * Let tls_require_ciphers be checked at startup *
3912 *************************************************/
3914 /* The tls_require_ciphers option, if set, must be something which the
3917 Returns: NULL on success, or error message
3921 tls_validate_require_cipher(void)
3924 uschar *expciphers = NULL;
3925 gnutls_priority_t priority_cache;
3927 uschar * dummy_errstr;
3929 #ifdef GNUTLS_AUTO_GLOBAL_INIT
3930 # define validate_check_rc(Label) do { \
3931 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \
3932 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3933 # define return_deinit(Label) do { return (Label); } while (0)
3935 # define validate_check_rc(Label) do { \
3936 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
3937 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3938 # define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
3941 if (exim_gnutls_base_init_done)
3942 log_write(0, LOG_MAIN|LOG_PANIC,
3943 "already initialised GnuTLS, Exim developer bug");
3945 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
3946 if (!gnutls_allow_auto_pkcs11)
3948 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
3949 validate_check_rc(US"gnutls_pkcs11_init");
3952 #ifndef GNUTLS_AUTO_GLOBAL_INIT
3953 rc = gnutls_global_init();
3954 validate_check_rc(US"gnutls_global_init()");
3956 exim_gnutls_base_init_done = TRUE;
3958 if (!(tls_require_ciphers && *tls_require_ciphers))
3959 return_deinit(NULL);
3961 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
3963 return_deinit(US"failed to expand tls_require_ciphers");
3965 if (!(expciphers && *expciphers))
3966 return_deinit(NULL);
3969 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
3971 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
3972 validate_check_rc(string_sprintf(
3973 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
3974 expciphers, errpos - CS expciphers, errpos));
3976 #undef return_deinit
3977 #undef validate_check_rc
3978 #ifndef GNUTLS_AUTO_GLOBAL_INIT
3979 gnutls_global_deinit();
3988 /*************************************************
3989 * Report the library versions. *
3990 *************************************************/
3992 /* See a description in tls-openssl.c for an explanation of why this exists.
3994 Arguments: a FILE* to print the results to
3999 tls_version_report(FILE *f)
4001 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
4004 gnutls_check_version(NULL));
4007 #endif /*!MACRO_PREDEF*/
4010 /* End of tls-gnu.c */