1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2014 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42 /* needed to disable PKCS11 autoload unless requested */
43 #if GNUTLS_VERSION_NUMBER >= 0x020c00
44 # include <gnutls/pkcs11.h>
46 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
47 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50 #if GNUTLS_VERSION_NUMBER < 0x020a00 && defined(EXPERIMENTAL_EVENT)
51 # warning "GnuTLS library version too old; tls:cert event unsupported"
52 # undef EXPERIMENTAL_EVENT
54 #if GNUTLS_VERSION_NUMBER >= 0x030306
55 # define SUPPORT_CA_DIR
57 # undef SUPPORT_CA_DIR
61 # include <gnutls/ocsp.h>
67 gnutls_global_set_audit_log_function()
70 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
73 /* Local static variables for GnuTLS */
75 /* Values for verify_requirement */
77 enum peer_verify_requirement
78 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED
79 #ifdef EXPERIMENTAL_CERTNAMES
84 /* This holds most state for server or client; with this, we can set up an
85 outbound TLS-enabled connection in an ACL callout, while not stomping all
86 over the TLS variables available for expansion.
88 Some of these correspond to variables in globals.c; those variables will
89 be set to point to content in one of these instances, as appropriate for
90 the stage of the process lifetime.
92 Not handled here: global tls_channelbinding_b64.
95 typedef struct exim_gnutls_state {
96 gnutls_session_t session;
97 gnutls_certificate_credentials_t x509_cred;
98 gnutls_priority_t priority_cache;
99 enum peer_verify_requirement verify_requirement;
102 BOOL peer_cert_verified;
103 BOOL trigger_sni_changes;
104 BOOL have_set_peerdn;
105 const struct host_item *host;
106 gnutls_x509_crt_t peercert;
109 uschar *received_sni;
111 const uschar *tls_certificate;
112 const uschar *tls_privatekey;
113 const uschar *tls_sni; /* client send only, not received */
114 const uschar *tls_verify_certificates;
115 const uschar *tls_crl;
116 const uschar *tls_require_ciphers;
118 uschar *exp_tls_certificate;
119 uschar *exp_tls_privatekey;
120 uschar *exp_tls_verify_certificates;
122 uschar *exp_tls_require_ciphers;
123 uschar *exp_tls_ocsp_file;
124 #ifdef EXPERIMENTAL_CERTNAMES
125 uschar *exp_tls_verify_cert_hostnames;
127 #ifdef EXPERIMENTAL_EVENT
128 uschar *event_action;
131 tls_support *tlsp; /* set in tls_init() */
138 } exim_gnutls_state_st;
140 static const exim_gnutls_state_st exim_gnutls_state_init = {
141 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
142 NULL, NULL, NULL, NULL,
143 NULL, NULL, NULL, NULL, NULL, NULL,
144 NULL, NULL, NULL, NULL, NULL, NULL, NULL,
145 #ifdef EXPERIMENTAL_CERTNAMES
148 #ifdef EXPERIMENTAL_EVENT
155 /* Not only do we have our own APIs which don't pass around state, assuming
156 it's held in globals, GnuTLS doesn't appear to let us register callback data
157 for callbacks, or as part of the session, so we have to keep a "this is the
158 context we're currently dealing with" pointer and rely upon being
159 single-threaded to keep from processing data on an inbound TLS connection while
160 talking to another TLS connection for an outbound check. This does mean that
161 there's no way for heart-beats to be responded to, for the duration of the
163 XXX But see gnutls_session_get_ptr()
166 static exim_gnutls_state_st state_server, state_client;
168 /* dh_params are initialised once within the lifetime of a process using TLS;
169 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
170 don't want to repeat this. */
172 static gnutls_dh_params_t dh_server_params = NULL;
174 /* No idea how this value was chosen; preserving it. Default is 3600. */
176 static const int ssl_session_timeout = 200;
178 static const char * const exim_default_gnutls_priority = "NORMAL";
180 /* Guard library core initialisation */
182 static BOOL exim_gnutls_base_init_done = FALSE;
185 /* ------------------------------------------------------------------------ */
188 #define MAX_HOST_LEN 255
190 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
191 the library logging; a value less than 0 disables the calls to set up logging
193 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
194 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
197 #ifndef EXIM_CLIENT_DH_MIN_BITS
198 # define EXIM_CLIENT_DH_MIN_BITS 1024
201 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
202 can ask for a bit-strength. Without that, we stick to the constant we had
204 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
205 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
208 #define exim_gnutls_err_check(Label) do { \
209 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
211 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
213 #if GNUTLS_VERSION_NUMBER >= 0x020c00
214 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
215 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
216 # define HAVE_GNUTLS_RND
217 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
218 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
219 * isn't available sometimes, so this needs to become a conditional
220 * compilation; the sanest way to deal with this being a problem on
221 * older OSes is to block it in the Local/Makefile with this compiler
223 # ifndef AVOID_GNUTLS_PKCS11
224 # define HAVE_GNUTLS_PKCS11
225 # endif /* AVOID_GNUTLS_PKCS11 */
231 /* ------------------------------------------------------------------------ */
232 /* Callback declarations */
234 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
235 static void exim_gnutls_logger_cb(int level, const char *message);
238 static int exim_sni_handling_cb(gnutls_session_t session);
241 static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
242 gnutls_datum_t * ocsp_response);
247 /* ------------------------------------------------------------------------ */
248 /* Static functions */
250 /*************************************************
252 *************************************************/
254 /* Called from lots of places when errors occur before actually starting to do
255 the TLS handshake, that is, while the session is still in clear. Always returns
256 DEFER for a server and FAIL for a client so that most calls can use "return
257 tls_error(...)" to do this processing and then give an appropriate return. A
258 single function is used for both server and client, because it is called from
259 some shared functions.
262 prefix text to include in the logged error
263 msg additional error string (may be NULL)
264 usually obtained from gnutls_strerror()
265 host NULL if setting up a server;
266 the connected host if setting up a client
268 Returns: OK/DEFER/FAIL
272 tls_error(const uschar *prefix, const char *msg, const host_item *host)
276 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s)%s%s",
277 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
282 uschar *conn_info = smtp_get_connection_info();
283 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
285 /* I'd like to get separated H= here, but too hard for now */
286 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
287 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
295 /*************************************************
296 * Deal with logging errors during I/O *
297 *************************************************/
299 /* We have to get the identity of the peer from saved data.
302 state the current GnuTLS exim state container
303 rc the GnuTLS error code, or 0 if it's a local error
304 when text identifying read or write
305 text local error text when ec is 0
311 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
315 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
316 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
317 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
319 msg = gnutls_strerror(rc);
321 tls_error(when, msg, state->host);
327 /*************************************************
328 * Set various Exim expansion vars *
329 *************************************************/
331 #define exim_gnutls_cert_err(Label) \
334 if (rc != GNUTLS_E_SUCCESS) \
336 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
337 (Label), gnutls_strerror(rc)); \
343 import_cert(const gnutls_datum * cert, gnutls_x509_crt_t * crtp)
347 rc = gnutls_x509_crt_init(crtp);
348 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
350 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
351 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
356 #undef exim_gnutls_cert_err
359 /* We set various Exim global variables from the state, once a session has
360 been established. With TLS callouts, may need to change this to stack
361 variables, or just re-call it with the server state after client callout
364 Make sure anything set here is unset in tls_getc().
368 tls_bits strength indicator
369 tls_certificate_verified bool indicator
370 tls_channelbinding_b64 for some SASL mechanisms
372 tls_peercert pointer to library internal
374 tls_sni a (UTF-8) string
375 tls_ourcert pointer to library internal
378 state the relevant exim_gnutls_state_st *
382 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
384 gnutls_cipher_algorithm_t cipher;
385 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
388 gnutls_datum_t channel;
390 tls_support * tlsp = state->tlsp;
392 tlsp->active = state->fd_out;
394 cipher = gnutls_cipher_get(state->session);
395 /* returns size in "bytes" */
396 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
398 tlsp->cipher = state->ciphersuite;
400 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
402 tlsp->certificate_verified = state->peer_cert_verified;
404 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
405 only available for use for authenticators while this TLS session is running. */
407 tls_channelbinding_b64 = NULL;
408 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
411 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
413 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
415 old_pool = store_pool;
416 store_pool = POOL_PERM;
417 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
418 store_pool = old_pool;
419 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
423 /* peercert is set in peer_status() */
424 tlsp->peerdn = state->peerdn;
425 tlsp->sni = state->received_sni;
427 /* record our certificate */
429 const gnutls_datum * cert = gnutls_certificate_get_ours(state->session);
430 gnutls_x509_crt_t crt;
432 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
439 /*************************************************
440 * Setup up DH parameters *
441 *************************************************/
443 /* Generating the D-H parameters may take a long time. They only need to
444 be re-generated every so often, depending on security policy. What we do is to
445 keep these parameters in a file in the spool directory. If the file does not
446 exist, we generate them. This means that it is easy to cause a regeneration.
448 The new file is written as a temporary file and renamed, so that an incomplete
449 file is never present. If two processes both compute some new parameters, you
450 waste a bit of effort, but it doesn't seem worth messing around with locking to
453 Returns: OK/DEFER/FAIL
460 unsigned int dh_bits;
462 uschar filename_buf[PATH_MAX];
463 uschar *filename = NULL;
465 uschar *exp_tls_dhparam;
466 BOOL use_file_in_spool = FALSE;
467 BOOL use_fixed_file = FALSE;
468 host_item *host = NULL; /* dummy for macros */
470 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
472 rc = gnutls_dh_params_init(&dh_server_params);
473 exim_gnutls_err_check(US"gnutls_dh_params_init");
478 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
481 if (!exp_tls_dhparam)
483 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
484 m.data = US std_dh_prime_default();
485 m.size = Ustrlen(m.data);
487 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
488 use_file_in_spool = TRUE;
489 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
491 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
494 else if (exp_tls_dhparam[0] != '/')
496 m.data = US std_dh_prime_named(exp_tls_dhparam);
498 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
499 m.size = Ustrlen(m.data);
503 use_fixed_file = TRUE;
504 filename = exp_tls_dhparam;
509 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
510 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
511 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
515 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
516 /* If you change this constant, also change dh_param_fn_ext so that we can use a
517 different filename and ensure we have sufficient bits. */
518 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
520 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
522 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
525 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
527 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
531 /* Some clients have hard-coded limits. */
532 if (dh_bits > tls_dh_max_bits)
535 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
537 dh_bits = tls_dh_max_bits;
540 if (use_file_in_spool)
542 if (!string_format(filename_buf, sizeof(filename_buf),
543 "%s/gnutls-params-%d", spool_directory, dh_bits))
544 return tls_error(US"overlong filename", NULL, NULL);
545 filename = filename_buf;
548 /* Open the cache file for reading and if successful, read it and set up the
551 fd = Uopen(filename, O_RDONLY, 0);
558 if (fstat(fd, &statbuf) < 0) /* EIO */
562 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
564 if (!S_ISREG(statbuf.st_mode))
567 return tls_error(US"TLS cache not a file", NULL, NULL);
569 fp = fdopen(fd, "rb");
574 return tls_error(US"fdopen(TLS cache stat fd) failed",
575 strerror(saved_errno), NULL);
578 m.size = statbuf.st_size;
579 m.data = malloc(m.size);
583 return tls_error(US"malloc failed", strerror(errno), NULL);
585 sz = fread(m.data, m.size, 1, fp);
591 return tls_error(US"fread failed", strerror(saved_errno), NULL);
595 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
597 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
598 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
601 /* If the file does not exist, fall through to compute new data and cache it.
602 If there was any other opening error, it is serious. */
604 else if (errno == ENOENT)
608 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
611 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
614 /* If ret < 0, either the cache file does not exist, or the data it contains
615 is not useful. One particular case of this is when upgrading from an older
616 release of Exim in which the data was stored in a different format. We don't
617 try to be clever and support both formats; we just regenerate new data in this
623 unsigned int dh_bits_gen = dh_bits;
625 if ((PATH_MAX - Ustrlen(filename)) < 10)
626 return tls_error(US"Filename too long to generate replacement",
629 temp_fn = string_copy(US "%s.XXXXXXX");
630 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
632 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
633 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
635 /* GnuTLS overshoots!
636 * If we ask for 2236, we might get 2237 or more.
637 * But there's no way to ask GnuTLS how many bits there really are.
638 * We can ask how many bits were used in a TLS session, but that's it!
639 * The prime itself is hidden behind too much abstraction.
640 * So we ask for less, and proceed on a wing and a prayer.
641 * First attempt, subtracted 3 for 2233 and got 2240.
643 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
645 dh_bits_gen = dh_bits - 10;
647 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
652 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
654 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
655 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
657 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
658 and I confirmed that a NULL call to get the size first is how the GnuTLS
659 sample apps handle this. */
663 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
665 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
666 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
668 m.data = malloc(m.size);
670 return tls_error(US"memory allocation failed", strerror(errno), NULL);
671 /* this will return a size 1 less than the allocation size above */
672 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
674 if (rc != GNUTLS_E_SUCCESS)
677 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
679 m.size = sz; /* shrink by 1, probably */
681 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
685 return tls_error(US"TLS cache write D-H params failed",
686 strerror(errno), NULL);
689 sz = write_to_fd_buf(fd, US"\n", 1);
691 return tls_error(US"TLS cache write D-H params final newline failed",
692 strerror(errno), NULL);
696 return tls_error(US"TLS cache write close() failed",
697 strerror(errno), NULL);
699 if (Urename(temp_fn, filename) < 0)
700 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
701 temp_fn, filename), strerror(errno), NULL);
703 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
706 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
713 /*************************************************
714 * Variables re-expanded post-SNI *
715 *************************************************/
717 /* Called from both server and client code, via tls_init(), and also from
718 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
720 We can tell the two apart by state->received_sni being non-NULL in callback.
722 The callback should not call us unless state->trigger_sni_changes is true,
723 which we are responsible for setting on the first pass through.
726 state exim_gnutls_state_st *
728 Returns: OK/DEFER/FAIL
732 tls_expand_session_files(exim_gnutls_state_st *state)
736 const host_item *host = state->host; /* macro should be reconsidered? */
737 uschar *saved_tls_certificate = NULL;
738 uschar *saved_tls_privatekey = NULL;
739 uschar *saved_tls_verify_certificates = NULL;
740 uschar *saved_tls_crl = NULL;
743 /* We check for tls_sni *before* expansion. */
744 if (!host) /* server */
746 if (!state->received_sni)
748 if (state->tls_certificate &&
749 (Ustrstr(state->tls_certificate, US"tls_sni") ||
750 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
751 Ustrstr(state->tls_certificate, US"tls_out_sni")
754 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
755 state->trigger_sni_changes = TRUE;
760 /* useful for debugging */
761 saved_tls_certificate = state->exp_tls_certificate;
762 saved_tls_privatekey = state->exp_tls_privatekey;
763 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
764 saved_tls_crl = state->exp_tls_crl;
768 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
769 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
771 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
772 state members, assuming consistent naming; and expand_check() returns
773 false if expansion failed, unless expansion was forced to fail. */
775 /* check if we at least have a certificate, before doing expensive
778 if (!expand_check_tlsvar(tls_certificate))
781 /* certificate is mandatory in server, optional in client */
783 if ((state->exp_tls_certificate == NULL) ||
784 (*state->exp_tls_certificate == '\0'))
787 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
789 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
792 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
795 /* tls_privatekey is optional, defaulting to same file as certificate */
797 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
799 state->tls_privatekey = state->tls_certificate;
800 state->exp_tls_privatekey = state->exp_tls_certificate;
804 if (state->exp_tls_certificate && *state->exp_tls_certificate)
806 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
807 state->exp_tls_certificate, state->exp_tls_privatekey);
809 if (state->received_sni)
811 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
812 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
814 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
818 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
822 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
823 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
824 GNUTLS_X509_FMT_PEM);
825 exim_gnutls_err_check(
826 string_sprintf("cert/key setup: cert=%s key=%s",
827 state->exp_tls_certificate, state->exp_tls_privatekey));
828 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
829 } /* tls_certificate */
832 /* Set the OCSP stapling server info */
835 if ( !host /* server */
839 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file",
840 &state->exp_tls_ocsp_file))
843 /* Use the full callback method for stapling just to get observability.
844 More efficient would be to read the file once only, if it never changed
845 (due to SNI). Would need restart on file update, or watch datestamp. */
847 gnutls_certificate_set_ocsp_status_request_function(state->x509_cred,
848 server_ocsp_stapling_cb, state->exp_tls_ocsp_file);
850 DEBUG(D_tls) debug_printf("Set OCSP response file %s\n", &state->exp_tls_ocsp_file);
855 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
856 provided. Experiment shows that, if the certificate file is empty, an unhelpful
857 error message is provided. However, if we just refrain from setting anything up
858 in that case, certificate verification fails, which seems to be the correct
861 if (state->tls_verify_certificates && *state->tls_verify_certificates)
863 if (!expand_check_tlsvar(tls_verify_certificates))
865 if (state->tls_crl && *state->tls_crl)
866 if (!expand_check_tlsvar(tls_crl))
869 if (!(state->exp_tls_verify_certificates &&
870 *state->exp_tls_verify_certificates))
873 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
874 /* With no tls_verify_certificates, we ignore tls_crl too */
881 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
885 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
887 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
888 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
893 #ifndef SUPPORT_CA_DIR
894 /* The test suite passes in /dev/null; we could check for that path explicitly,
895 but who knows if someone has some weird FIFO which always dumps some certs, or
896 other weirdness. The thing we really want to check is that it's not a
897 directory, since while OpenSSL supports that, GnuTLS does not.
898 So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
899 if (S_ISDIR(statbuf.st_mode))
902 debug_printf("verify certificates path is a dir: \"%s\"\n",
903 state->exp_tls_verify_certificates);
904 log_write(0, LOG_MAIN|LOG_PANIC,
905 "tls_verify_certificates \"%s\" is a directory",
906 state->exp_tls_verify_certificates);
911 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
912 state->exp_tls_verify_certificates, statbuf.st_size);
914 if (statbuf.st_size == 0)
917 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
923 #ifdef SUPPORT_CA_DIR
924 (statbuf.st_mode & S_IFMT) == S_IFDIR
926 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
927 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
930 gnutls_certificate_set_x509_trust_file(state->x509_cred,
931 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
936 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
938 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
940 if (state->tls_crl && *state->tls_crl &&
941 state->exp_tls_crl && *state->exp_tls_crl)
943 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
944 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
945 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
949 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
951 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
960 /*************************************************
961 * Set X.509 state variables *
962 *************************************************/
964 /* In GnuTLS, the registered cert/key are not replaced by a later
965 set of a cert/key, so for SNI support we need a whole new x509_cred
966 structure. Which means various other non-re-expanded pieces of state
967 need to be re-set in the new struct, so the setting logic is pulled
971 state exim_gnutls_state_st *
973 Returns: OK/DEFER/FAIL
977 tls_set_remaining_x509(exim_gnutls_state_st *state)
980 const host_item *host = state->host; /* macro should be reconsidered? */
982 /* Create D-H parameters, or read them from the cache file. This function does
983 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
984 client-side params. */
988 if (!dh_server_params)
990 rc = init_server_dh();
991 if (rc != OK) return rc;
993 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
996 /* Link the credentials to the session. */
998 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
999 exim_gnutls_err_check(US"gnutls_credentials_set");
1004 /*************************************************
1005 * Initialize for GnuTLS *
1006 *************************************************/
1008 /* Called from both server and client code. In the case of a server, errors
1009 before actual TLS negotiation return DEFER.
1012 host connected host, if client; NULL if server
1013 certificate certificate file
1014 privatekey private key file
1015 sni TLS SNI to send, sometimes when client; else NULL
1018 require_ciphers tls_require_ciphers setting
1019 caller_state returned state-info structure
1021 Returns: OK/DEFER/FAIL
1026 const host_item *host,
1027 const uschar *certificate,
1028 const uschar *privatekey,
1032 const uschar *require_ciphers,
1033 exim_gnutls_state_st **caller_state)
1035 exim_gnutls_state_st *state;
1040 BOOL want_default_priorities;
1042 if (!exim_gnutls_base_init_done)
1044 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1046 #ifdef HAVE_GNUTLS_PKCS11
1047 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1048 which loads modules from a config file, which sounds good and may be wanted
1049 by some sysadmin, but also means in common configurations that GNOME keyring
1050 environment variables are used and so breaks for users calling mailq.
1051 To prevent this, we init PKCS11 first, which is the documented approach. */
1052 if (!gnutls_allow_auto_pkcs11)
1054 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1055 exim_gnutls_err_check(US"gnutls_pkcs11_init");
1059 rc = gnutls_global_init();
1060 exim_gnutls_err_check(US"gnutls_global_init");
1062 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1065 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1066 /* arbitrarily chosen level; bump upto 9 for more */
1067 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1071 exim_gnutls_base_init_done = TRUE;
1076 state = &state_client;
1077 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1078 state->tlsp = &tls_out;
1079 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1080 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1084 state = &state_server;
1085 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1086 state->tlsp = &tls_in;
1087 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1088 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1090 exim_gnutls_err_check(US"gnutls_init");
1094 state->tls_certificate = certificate;
1095 state->tls_privatekey = privatekey;
1096 state->tls_require_ciphers = require_ciphers;
1097 state->tls_sni = sni;
1098 state->tls_verify_certificates = cas;
1099 state->tls_crl = crl;
1101 /* This handles the variables that might get re-expanded after TLS SNI;
1102 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1105 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1106 rc = tls_expand_session_files(state);
1107 if (rc != OK) return rc;
1109 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1110 requires a new structure afterwards. */
1112 rc = tls_set_remaining_x509(state);
1113 if (rc != OK) return rc;
1115 /* set SNI in client, only */
1118 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni))
1120 if (state->tlsp->sni && *state->tlsp->sni)
1123 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1124 sz = Ustrlen(state->tlsp->sni);
1125 rc = gnutls_server_name_set(state->session,
1126 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
1127 exim_gnutls_err_check(US"gnutls_server_name_set");
1130 else if (state->tls_sni)
1131 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1132 "have an SNI set for a client [%s]\n", state->tls_sni);
1134 /* This is the priority string support,
1135 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1136 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1137 This was backwards incompatible, but means Exim no longer needs to track
1138 all algorithms and provide string forms for them. */
1140 want_default_priorities = TRUE;
1142 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1144 if (!expand_check_tlsvar(tls_require_ciphers))
1146 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1148 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1149 state->exp_tls_require_ciphers);
1151 rc = gnutls_priority_init(&state->priority_cache,
1152 CS state->exp_tls_require_ciphers, &errpos);
1153 want_default_priorities = FALSE;
1154 p = state->exp_tls_require_ciphers;
1157 if (want_default_priorities)
1160 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1161 exim_default_gnutls_priority);
1162 rc = gnutls_priority_init(&state->priority_cache,
1163 exim_default_gnutls_priority, &errpos);
1164 p = US exim_default_gnutls_priority;
1167 exim_gnutls_err_check(string_sprintf(
1168 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1169 p, errpos - CS p, errpos));
1171 rc = gnutls_priority_set(state->session, state->priority_cache);
1172 exim_gnutls_err_check(US"gnutls_priority_set");
1174 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1176 /* Reduce security in favour of increased compatibility, if the admin
1177 decides to make that trade-off. */
1178 if (gnutls_compat_mode)
1180 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1181 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1182 gnutls_session_enable_compatibility_mode(state->session);
1184 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1188 *caller_state = state;
1194 /*************************************************
1195 * Extract peer information *
1196 *************************************************/
1198 /* Called from both server and client code.
1199 Only this is allowed to set state->peerdn and state->have_set_peerdn
1200 and we use that to detect double-calls.
1202 NOTE: the state blocks last while the TLS connection is up, which is fine
1203 for logging in the server side, but for the client side, we log after teardown
1204 in src/deliver.c. While the session is up, we can twist about states and
1205 repoint tls_* globals, but those variables used for logging or other variable
1206 expansion that happens _after_ delivery need to have a longer life-time.
1208 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1209 doing this more than once per generation of a state context. We set them in
1210 the state context, and repoint tls_* to them. After the state goes away, the
1211 tls_* copies of the pointers remain valid and client delivery logging is happy.
1213 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1217 state exim_gnutls_state_st *
1219 Returns: OK/DEFER/FAIL
1223 peer_status(exim_gnutls_state_st *state)
1225 uschar cipherbuf[256];
1226 const gnutls_datum *cert_list;
1228 unsigned int cert_list_size = 0;
1229 gnutls_protocol_t protocol;
1230 gnutls_cipher_algorithm_t cipher;
1231 gnutls_kx_algorithm_t kx;
1232 gnutls_mac_algorithm_t mac;
1233 gnutls_certificate_type_t ct;
1234 gnutls_x509_crt_t crt;
1238 if (state->have_set_peerdn)
1240 state->have_set_peerdn = TRUE;
1242 state->peerdn = NULL;
1245 cipher = gnutls_cipher_get(state->session);
1246 protocol = gnutls_protocol_get_version(state->session);
1247 mac = gnutls_mac_get(state->session);
1248 kx = gnutls_kx_get(state->session);
1250 string_format(cipherbuf, sizeof(cipherbuf),
1252 gnutls_protocol_get_name(protocol),
1253 gnutls_cipher_suite_get_name(kx, cipher, mac),
1254 (int) gnutls_cipher_get_key_size(cipher) * 8);
1256 /* I don't see a way that spaces could occur, in the current GnuTLS
1257 code base, but it was a concern in the old code and perhaps older GnuTLS
1258 releases did return "TLS 1.0"; play it safe, just in case. */
1259 for (p = cipherbuf; *p != '\0'; ++p)
1262 old_pool = store_pool;
1263 store_pool = POOL_PERM;
1264 state->ciphersuite = string_copy(cipherbuf);
1265 store_pool = old_pool;
1266 state->tlsp->cipher = state->ciphersuite;
1269 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1271 if (cert_list == NULL || cert_list_size == 0)
1273 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1274 cert_list, cert_list_size);
1275 if (state->verify_requirement >= VERIFY_REQUIRED)
1276 return tls_error(US"certificate verification failed",
1277 "no certificate received from peer", state->host);
1281 ct = gnutls_certificate_type_get(state->session);
1282 if (ct != GNUTLS_CRT_X509)
1284 const char *ctn = gnutls_certificate_type_get_name(ct);
1286 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1287 if (state->verify_requirement >= VERIFY_REQUIRED)
1288 return tls_error(US"certificate verification not possible, unhandled type",
1293 #define exim_gnutls_peer_err(Label) \
1295 if (rc != GNUTLS_E_SUCCESS) \
1297 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1298 (Label), gnutls_strerror(rc)); \
1299 if (state->verify_requirement >= VERIFY_REQUIRED) \
1300 return tls_error((Label), gnutls_strerror(rc), state->host); \
1305 rc = import_cert(&cert_list[0], &crt);
1306 exim_gnutls_peer_err(US"cert 0");
1308 state->tlsp->peercert = state->peercert = crt;
1311 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1312 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1314 exim_gnutls_peer_err(US"getting size for cert DN failed");
1315 return FAIL; /* should not happen */
1317 dn_buf = store_get_perm(sz);
1318 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1319 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1321 state->peerdn = dn_buf;
1324 #undef exim_gnutls_peer_err
1330 /*************************************************
1331 * Verify peer certificate *
1332 *************************************************/
1334 /* Called from both server and client code.
1335 *Should* be using a callback registered with
1336 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1337 the peer information, but that's too new for some OSes.
1340 state exim_gnutls_state_st *
1341 error where to put an error message
1344 FALSE if the session should be rejected
1345 TRUE if the cert is okay or we just don't care
1349 verify_certificate(exim_gnutls_state_st *state, const char **error)
1352 unsigned int verify;
1356 if ((rc = peer_status(state)) != OK)
1358 verify = GNUTLS_CERT_INVALID;
1359 *error = "certificate not supplied";
1362 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1364 /* Handle the result of verification. INVALID seems to be set as well
1365 as REVOKED, but leave the test for both. */
1368 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1371 state->peer_cert_verified = FALSE;
1373 *error = verify & GNUTLS_CERT_REVOKED
1374 ? "certificate revoked" : "certificate invalid";
1377 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1378 *error, state->peerdn ? state->peerdn : US"<unset>");
1380 if (state->verify_requirement >= VERIFY_REQUIRED)
1382 gnutls_alert_send(state->session,
1383 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1387 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1392 #ifdef EXPERIMENTAL_CERTNAMES
1393 if (state->verify_requirement == VERIFY_WITHHOST)
1396 uschar * list = state->exp_tls_verify_cert_hostnames;
1398 while (name = string_nextinlist(&list, &sep, NULL, 0))
1399 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1404 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1405 gnutls_alert_send(state->session,
1406 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1411 state->peer_cert_verified = TRUE;
1412 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1413 state->peerdn ? state->peerdn : US"<unset>");
1416 state->tlsp->peerdn = state->peerdn;
1424 /* ------------------------------------------------------------------------ */
1427 /* Logging function which can be registered with
1428 * gnutls_global_set_log_function()
1429 * gnutls_global_set_log_level() 0..9
1431 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1433 exim_gnutls_logger_cb(int level, const char *message)
1435 size_t len = strlen(message);
1438 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1441 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1442 message[len-1] == '\n' ? "" : "\n");
1447 /* Called after client hello, should handle SNI work.
1448 This will always set tls_sni (state->received_sni) if available,
1449 and may trigger presenting different certificates,
1450 if state->trigger_sni_changes is TRUE.
1452 Should be registered with
1453 gnutls_handshake_set_post_client_hello_function()
1455 "This callback must return 0 on success or a gnutls error code to terminate the
1458 For inability to get SNI information, we return 0.
1459 We only return non-zero if re-setup failed.
1460 Only used for server-side TLS.
1464 exim_sni_handling_cb(gnutls_session_t session)
1466 char sni_name[MAX_HOST_LEN];
1467 size_t data_len = MAX_HOST_LEN;
1468 exim_gnutls_state_st *state = &state_server;
1469 unsigned int sni_type;
1472 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1473 if (rc != GNUTLS_E_SUCCESS)
1476 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1477 debug_printf("TLS: no SNI presented in handshake.\n");
1479 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1480 gnutls_strerror(rc), rc);
1485 if (sni_type != GNUTLS_NAME_DNS)
1487 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1491 /* We now have a UTF-8 string in sni_name */
1492 old_pool = store_pool;
1493 store_pool = POOL_PERM;
1494 state->received_sni = string_copyn(US sni_name, data_len);
1495 store_pool = old_pool;
1497 /* We set this one now so that variable expansions below will work */
1498 state->tlsp->sni = state->received_sni;
1500 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1501 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1503 if (!state->trigger_sni_changes)
1506 rc = tls_expand_session_files(state);
1509 /* If the setup of certs/etc failed before handshake, TLS would not have
1510 been offered. The best we can do now is abort. */
1511 return GNUTLS_E_APPLICATION_ERROR_MIN;
1514 rc = tls_set_remaining_x509(state);
1515 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1522 #ifndef DISABLE_OCSP
1525 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1526 gnutls_datum_t * ocsp_response)
1530 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1532 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1534 tls_in.ocsp = OCSP_NOT_RESP;
1535 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1538 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1545 #ifdef EXPERIMENTAL_EVENT
1547 We use this callback to get observability and detail-level control
1548 for an exim TLS connection (either direction), raising a tls:cert event
1549 for each cert in the chain presented by the peer. Any event
1550 can deny verification.
1552 Return 0 for the handshake to continue or non-zero to terminate.
1556 verify_cb(gnutls_session_t session)
1558 const gnutls_datum * cert_list;
1559 unsigned int cert_list_size = 0;
1560 gnutls_x509_crt_t crt;
1562 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1564 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1566 while (cert_list_size--)
1568 rc = import_cert(&cert_list[cert_list_size], &crt);
1569 if (rc != GNUTLS_E_SUCCESS)
1571 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1572 cert_list_size, gnutls_strerror(rc));
1576 state->tlsp->peercert = crt;
1577 if (event_raise(state->event_action,
1578 US"tls:cert", string_sprintf("%d", cert_list_size)) == DEFER)
1580 log_write(0, LOG_MAIN,
1581 "SSL verify denied by event-action: depth=%d", cert_list_size);
1582 return 1; /* reject */
1584 state->tlsp->peercert = NULL;
1594 /* ------------------------------------------------------------------------ */
1595 /* Exported functions */
1600 /*************************************************
1601 * Start a TLS session in a server *
1602 *************************************************/
1604 /* This is called when Exim is running as a server, after having received
1605 the STARTTLS command. It must respond to that command, and then negotiate
1609 require_ciphers list of allowed ciphers or NULL
1611 Returns: OK on success
1612 DEFER for errors before the start of the negotiation
1613 FAIL for errors during the negotation; the server can't
1618 tls_server_start(const uschar *require_ciphers)
1622 exim_gnutls_state_st *state = NULL;
1624 /* Check for previous activation */
1625 if (tls_in.active >= 0)
1627 tls_error(US"STARTTLS received after TLS started", "", NULL);
1628 smtp_printf("554 Already in TLS\r\n");
1632 /* Initialize the library. If it fails, it will already have logged the error
1633 and sent an SMTP response. */
1635 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1637 rc = tls_init(NULL, tls_certificate, tls_privatekey,
1638 NULL, tls_verify_certificates, tls_crl,
1639 require_ciphers, &state);
1640 if (rc != OK) return rc;
1642 /* If this is a host for which certificate verification is mandatory or
1643 optional, set up appropriately. */
1645 if (verify_check_host(&tls_verify_hosts) == OK)
1648 debug_printf("TLS: a client certificate will be required.\n");
1649 state->verify_requirement = VERIFY_REQUIRED;
1650 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1652 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1655 debug_printf("TLS: a client certificate will be requested but not required.\n");
1656 state->verify_requirement = VERIFY_OPTIONAL;
1657 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1662 debug_printf("TLS: a client certificate will not be requested.\n");
1663 state->verify_requirement = VERIFY_NONE;
1664 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1667 #ifdef EXPERIMENTAL_EVENT
1670 state->event_action = event_action;
1671 gnutls_session_set_ptr(state->session, state);
1672 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1676 /* Register SNI handling; always, even if not in tls_certificate, so that the
1677 expansion variable $tls_sni is always available. */
1679 gnutls_handshake_set_post_client_hello_function(state->session,
1680 exim_sni_handling_cb);
1682 /* Set context and tell client to go ahead, except in the case of TLS startup
1683 on connection, where outputting anything now upsets the clients and tends to
1684 make them disconnect. We need to have an explicit fflush() here, to force out
1685 the response. Other smtp_printf() calls do not need it, because in non-TLS
1686 mode, the fflush() happens when smtp_getc() is called. */
1688 if (!state->tlsp->on_connect)
1690 smtp_printf("220 TLS go ahead\r\n");
1694 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1695 that the GnuTLS library doesn't. */
1697 gnutls_transport_set_ptr2(state->session,
1698 (gnutls_transport_ptr)(long) fileno(smtp_in),
1699 (gnutls_transport_ptr)(long) fileno(smtp_out));
1700 state->fd_in = fileno(smtp_in);
1701 state->fd_out = fileno(smtp_out);
1703 sigalrm_seen = FALSE;
1704 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1707 rc = gnutls_handshake(state->session);
1708 } while ((rc == GNUTLS_E_AGAIN) ||
1709 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1712 if (rc != GNUTLS_E_SUCCESS)
1714 tls_error(US"gnutls_handshake",
1715 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
1716 /* It seems that, except in the case of a timeout, we have to close the
1717 connection right here; otherwise if the other end is running OpenSSL it hangs
1718 until the server times out. */
1722 (void)fclose(smtp_out);
1723 (void)fclose(smtp_in);
1729 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1731 /* Verify after the fact */
1733 if ( state->verify_requirement != VERIFY_NONE
1734 && !verify_certificate(state, &error))
1736 if (state->verify_requirement != VERIFY_OPTIONAL)
1738 tls_error(US"certificate verification failed", error, NULL);
1742 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1746 /* Figure out peer DN, and if authenticated, etc. */
1748 rc = peer_status(state);
1749 if (rc != OK) return rc;
1751 /* Sets various Exim expansion variables; always safe within server */
1753 extract_exim_vars_from_tls_state(state);
1755 /* TLS has been set up. Adjust the input functions to read via TLS,
1756 and initialize appropriately. */
1758 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1760 receive_getc = tls_getc;
1761 receive_ungetc = tls_ungetc;
1762 receive_feof = tls_feof;
1763 receive_ferror = tls_ferror;
1764 receive_smtp_buffered = tls_smtp_buffered;
1772 /*************************************************
1773 * Start a TLS session in a client *
1774 *************************************************/
1776 /* Called from the smtp transport after STARTTLS has been accepted.
1779 fd the fd of the connection
1780 host connected host (for messages)
1781 addr the first address (not used)
1782 tb transport (always smtp)
1784 Returns: OK/DEFER/FAIL (because using common functions),
1785 but for a client, DEFER and FAIL have the same meaning
1789 tls_client_start(int fd, host_item *host,
1790 address_item *addr ARG_UNUSED,
1791 transport_instance *tb
1792 #ifdef EXPERIMENTAL_DANE
1793 , dne_answer * unused_tlsa_dnsa
1797 smtp_transport_options_block *ob =
1798 (smtp_transport_options_block *)tb->options_block;
1801 exim_gnutls_state_st *state = NULL;
1802 #ifndef DISABLE_OCSP
1803 BOOL require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1804 NULL, host->name, host->address, NULL) == OK;
1805 BOOL request_ocsp = require_ocsp ? TRUE
1806 : verify_check_this_host(&ob->hosts_request_ocsp,
1807 NULL, host->name, host->address, NULL) == OK;
1810 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
1812 if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
1813 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
1814 ob->tls_require_ciphers, &state)) != OK)
1818 int dh_min_bits = ob->tls_dh_min_bits;
1819 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1822 debug_printf("WARNING: tls_dh_min_bits far too low,"
1823 " clamping %d up to %d\n",
1824 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1825 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1828 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
1829 " acceptable bits to %d\n",
1831 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1834 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
1835 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
1836 the specified host patterns if one of them is defined */
1838 if (( state->exp_tls_verify_certificates
1839 && !ob->tls_verify_hosts
1840 && !ob->tls_try_verify_hosts
1843 verify_check_host(&ob->tls_verify_hosts) == OK
1846 #ifdef EXPERIMENTAL_CERTNAMES
1847 if (ob->tls_verify_cert_hostnames)
1850 debug_printf("TLS: server cert incl. hostname verification required.\n");
1851 state->verify_requirement = VERIFY_WITHHOST;
1852 if (!expand_check(ob->tls_verify_cert_hostnames,
1853 US"tls_verify_cert_hostnames",
1854 &state->exp_tls_verify_cert_hostnames))
1856 if (state->exp_tls_verify_cert_hostnames)
1857 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1858 state->exp_tls_verify_cert_hostnames);
1864 debug_printf("TLS: server certificate verification required.\n");
1865 state->verify_requirement = VERIFY_REQUIRED;
1867 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1869 else if (verify_check_host(&ob->tls_try_verify_hosts) == OK)
1872 debug_printf("TLS: server certificate verification optional.\n");
1873 state->verify_requirement = VERIFY_OPTIONAL;
1874 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1879 debug_printf("TLS: server certificate verification not required.\n");
1880 state->verify_requirement = VERIFY_NONE;
1881 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1884 #ifndef DISABLE_OCSP
1885 /* supported since GnuTLS 3.1.3 */
1888 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
1889 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
1890 NULL, 0, NULL)) != OK)
1891 return tls_error(US"cert-status-req",
1892 gnutls_strerror(rc), state->host);
1893 tls_out.ocsp = OCSP_NOT_RESP;
1897 #ifdef EXPERIMENTAL_EVENT
1898 if (tb->event_action)
1900 state->event_action = tb->event_action;
1901 gnutls_session_set_ptr(state->session, state);
1902 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1906 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)(long) fd);
1910 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
1911 /* There doesn't seem to be a built-in timeout on connection. */
1913 sigalrm_seen = FALSE;
1914 alarm(ob->command_timeout);
1917 rc = gnutls_handshake(state->session);
1918 } while ((rc == GNUTLS_E_AGAIN) ||
1919 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1922 if (rc != GNUTLS_E_SUCCESS)
1923 return tls_error(US"gnutls_handshake",
1924 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1926 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1930 if (state->verify_requirement != VERIFY_NONE &&
1931 !verify_certificate(state, &error))
1932 return tls_error(US"certificate verification failed", error, state->host);
1934 #ifndef DISABLE_OCSP
1939 gnutls_datum_t stapling;
1940 gnutls_ocsp_resp_t resp;
1941 gnutls_datum_t printed;
1942 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
1943 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
1944 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
1945 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
1948 debug_printf("%.4096s", printed.data);
1949 gnutls_free(printed.data);
1952 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host);
1955 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
1957 tls_out.ocsp = OCSP_FAILED;
1958 return tls_error(US"certificate status check failed", NULL, state->host);
1960 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
1961 tls_out.ocsp = OCSP_VFIED;
1965 /* Figure out peer DN, and if authenticated, etc. */
1967 if ((rc = peer_status(state)) != OK)
1970 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
1972 extract_exim_vars_from_tls_state(state);
1980 /*************************************************
1981 * Close down a TLS session *
1982 *************************************************/
1984 /* This is also called from within a delivery subprocess forked from the
1985 daemon, to shut down the TLS library, without actually doing a shutdown (which
1986 would tamper with the TLS session in the parent process).
1988 Arguments: TRUE if gnutls_bye is to be called
1993 tls_close(BOOL is_server, BOOL shutdown)
1995 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
1997 if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
2001 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
2002 gnutls_bye(state->session, GNUTLS_SHUT_WR);
2005 gnutls_deinit(state->session);
2007 state->tlsp->active = -1;
2008 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2010 if ((state_server.session == NULL) && (state_client.session == NULL))
2012 gnutls_global_deinit();
2013 exim_gnutls_base_init_done = FALSE;
2021 /*************************************************
2022 * TLS version of getc *
2023 *************************************************/
2025 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2026 it refills the buffer via the GnuTLS reading function.
2027 Only used by the server-side TLS.
2029 This feeds DKIM and should be used for all message-body reads.
2032 Returns: the next character or EOF
2038 exim_gnutls_state_st *state = &state_server;
2039 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2043 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2044 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2046 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2047 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2048 ssl_xfer_buffer_size);
2051 /* A zero-byte return appears to mean that the TLS session has been
2052 closed down, not that the socket itself has been closed down. Revert to
2053 non-TLS handling. */
2057 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2059 receive_getc = smtp_getc;
2060 receive_ungetc = smtp_ungetc;
2061 receive_feof = smtp_feof;
2062 receive_ferror = smtp_ferror;
2063 receive_smtp_buffered = smtp_buffered;
2065 gnutls_deinit(state->session);
2066 state->session = NULL;
2067 state->tlsp->active = -1;
2068 state->tlsp->bits = 0;
2069 state->tlsp->certificate_verified = FALSE;
2070 tls_channelbinding_b64 = NULL;
2071 state->tlsp->cipher = NULL;
2072 state->tlsp->peercert = NULL;
2073 state->tlsp->peerdn = NULL;
2078 /* Handle genuine errors */
2080 else if (inbytes < 0)
2082 record_io_error(state, (int) inbytes, US"recv", NULL);
2083 state->xfer_error = 1;
2086 #ifndef DISABLE_DKIM
2087 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2089 state->xfer_buffer_hwm = (int) inbytes;
2090 state->xfer_buffer_lwm = 0;
2093 /* Something in the buffer; return next uschar */
2095 return state->xfer_buffer[state->xfer_buffer_lwm++];
2101 /*************************************************
2102 * Read bytes from TLS channel *
2103 *************************************************/
2105 /* This does not feed DKIM, so if the caller uses this for reading message body,
2106 then the caller must feed DKIM.
2112 Returns: the number of bytes read
2113 -1 after a failed read
2117 tls_read(BOOL is_server, uschar *buff, size_t len)
2119 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2125 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2127 debug_printf("*** PROBABLY A BUG *** " \
2128 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2129 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2132 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2133 state->session, buff, len);
2135 inbytes = gnutls_record_recv(state->session, buff, len);
2136 if (inbytes > 0) return inbytes;
2139 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2141 else record_io_error(state, (int)inbytes, US"recv", NULL);
2149 /*************************************************
2150 * Write bytes down TLS channel *
2151 *************************************************/
2155 is_server channel specifier
2159 Returns: the number of bytes after a successful write,
2160 -1 after a failed write
2164 tls_write(BOOL is_server, const uschar *buff, size_t len)
2168 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2170 DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
2173 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2175 outbytes = gnutls_record_send(state->session, buff, left);
2177 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
2180 record_io_error(state, outbytes, US"send", NULL);
2185 record_io_error(state, 0, US"send", US"TLS channel closed on write");
2196 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2207 /*************************************************
2208 * Random number generation *
2209 *************************************************/
2211 /* Pseudo-random number generation. The result is not expected to be
2212 cryptographically strong but not so weak that someone will shoot themselves
2213 in the foot using it as a nonce in input in some email header scheme or
2214 whatever weirdness they'll twist this into. The result should handle fork()
2215 and avoid repeating sequences. OpenSSL handles that for us.
2219 Returns a random number in range [0, max-1]
2222 #ifdef HAVE_GNUTLS_RND
2224 vaguely_random_number(int max)
2229 uschar smallbuf[sizeof(r)];
2234 needed_len = sizeof(r);
2235 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2236 * asked for a number less than 10. */
2237 for (r = max, i = 0; r; ++i)
2243 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2246 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2247 return vaguely_random_number_fallback(max);
2250 for (p = smallbuf; needed_len; --needed_len, ++p)
2256 /* We don't particularly care about weighted results; if someone wants
2257 * smooth distribution and cares enough then they should submit a patch then. */
2260 #else /* HAVE_GNUTLS_RND */
2262 vaguely_random_number(int max)
2264 return vaguely_random_number_fallback(max);
2266 #endif /* HAVE_GNUTLS_RND */
2271 /*************************************************
2272 * Let tls_require_ciphers be checked at startup *
2273 *************************************************/
2275 /* The tls_require_ciphers option, if set, must be something which the
2278 Returns: NULL on success, or error message
2282 tls_validate_require_cipher(void)
2285 uschar *expciphers = NULL;
2286 gnutls_priority_t priority_cache;
2289 #define validate_check_rc(Label) do { \
2290 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2291 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2292 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2294 if (exim_gnutls_base_init_done)
2295 log_write(0, LOG_MAIN|LOG_PANIC,
2296 "already initialised GnuTLS, Exim developer bug");
2298 #ifdef HAVE_GNUTLS_PKCS11
2299 if (!gnutls_allow_auto_pkcs11)
2301 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2302 validate_check_rc(US"gnutls_pkcs11_init");
2305 rc = gnutls_global_init();
2306 validate_check_rc(US"gnutls_global_init()");
2307 exim_gnutls_base_init_done = TRUE;
2309 if (!(tls_require_ciphers && *tls_require_ciphers))
2310 return_deinit(NULL);
2312 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2313 return_deinit(US"failed to expand tls_require_ciphers");
2315 if (!(expciphers && *expciphers))
2316 return_deinit(NULL);
2319 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2321 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2322 validate_check_rc(string_sprintf(
2323 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2324 expciphers, errpos - CS expciphers, errpos));
2326 #undef return_deinit
2327 #undef validate_check_rc
2328 gnutls_global_deinit();
2336 /*************************************************
2337 * Report the library versions. *
2338 *************************************************/
2340 /* See a description in tls-openssl.c for an explanation of why this exists.
2342 Arguments: a FILE* to print the results to
2347 tls_version_report(FILE *f)
2349 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2352 gnutls_check_version(NULL));
2357 /* End of tls-gnu.c */