Bug 1400: Fix GnuTLS PKCS11 issues

Can disable PKCS11 in Makefile with AVOID_GNUTLS_PKCS11 build flag.
Rename gnutls_enable_pkcs11 option to gnutls_allow_auto_pkcs11.
Update Changelog

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index d839df80b370f8bc7e003376f0efd11ec14a3da7..ec01e1669a4d92ef556a9b0ddb5cd2d02eab306b 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -13039,7 +13039,7 @@ listed in more than one group.
 .section "TLS" "SECID108"
 .table2
 .row &%gnutls_compat_mode%&          "use GnuTLS compatibility mode"
 .section "TLS" "SECID108"
 .table2
 .row &%gnutls_compat_mode%&          "use GnuTLS compatibility mode"

-.row &%gnutls_enable_pkcs11%&        "allow GnuTLS to autoload PKCS11 modules"
+.row &%gnutls_allow_auto_pkcs11%&    "allow GnuTLS to autoload PKCS11 modules"

 .row &%openssl_options%&             "adjust OpenSSL compatibility options"
 .row &%tls_advertise_hosts%&         "advertise TLS to these hosts"
 .row &%tls_certificate%&             "location of server certificate"
 .row &%openssl_options%&             "adjust OpenSSL compatibility options"
 .row &%tls_advertise_hosts%&         "advertise TLS to these hosts"
 .row &%tls_certificate%&             "location of server certificate"


@@ -14077,7 +14077,7 @@ implementations of TLS.
 
 
 .new
 
 
 .new

-option gnutls_enable_pkcs11 main boolean unset
+option gnutls_allow_auto_pkcs11 main boolean unset

 This option will let GnuTLS (2.12.0 or later) autoload PKCS11 modules with
 the p11-kit configuration files in &_/etc/pkcs11/modules/_&.
 
 This option will let GnuTLS (2.12.0 or later) autoload PKCS11 modules with
 the p11-kit configuration files in &_/etc/pkcs11/modules/_&.
 

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 1d848c9aae8f2541fb06c01a4549af2137e6c7c4..928f377b14fbceff8985c83e5626d84fbba1f4a9 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -60,7 +60,9 @@ NM/01 Bugzilla 1197 - Spec typo
 
 JH/03 Add expansion operators ${listnamed:name} and ${listcount:string}
 
 
 JH/03 Add expansion operators ${listnamed:name} and ${listcount:string}
 

-PP/09 Add gnutls_enable_pkcs11 option.
+PP/09 Add gnutls_allow_auto_pkcs11 option (was originally called
+      gnutls_enable_pkcs11, but renamed to more accurately indicate its
+      function.

 
 PP/10 Let Linux makefile inherit CFLAGS/CFLAGS_DYNAMIC.
       Pulled from Debian 30_dontoverridecflags.dpatch by Andreas Metzler.
 
 PP/10 Let Linux makefile inherit CFLAGS/CFLAGS_DYNAMIC.
       Pulled from Debian 30_dontoverridecflags.dpatch by Andreas Metzler.


@@ -259,6 +261,9 @@ TL/18 Had previously added a -CONTINUE option to runtest in the test suite.
 TL/19 Bugzilla 1402 - Test 533 fails if any part of the path to the test suite
       contains upper case chars. Make router use caseful_local_part.
 
 TL/19 Bugzilla 1402 - Test 533 fails if any part of the path to the test suite
       contains upper case chars. Make router use caseful_local_part.
 

+TL/20 Bugzilla 1400 - Add AVOID_GNUTLS_PKCS11 build option. Allows GnuTLS
+      support when GnuTLS has been built with p11-kit.
+

 
 Exim version 4.80.1
 -------------------
 
 Exim version 4.80.1
 -------------------

diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index 7f54b8f6c25c964fef230f93500b4718168673aa..d308f0485413a462739206da60f1d75889d30aa5 100644 (file)
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -88,7 +88,7 @@ Version 4.82
  8. New expansion operators ${listnamed:name} to get the content of a named list
     and ${listcount:string} to count the items in a list.
 
  8. New expansion operators ${listnamed:name} to get the content of a named list
     and ${listcount:string} to count the items in a list.
 

- 9. New global option "gnutls_enable_pkcs11", defaults false.  The GnuTLS
+ 9. New global option "gnutls_allow_auto_pkcs11", defaults false.  The GnuTLS

     rewrite in 4.80 combines with GnuTLS 2.12.0 or later, to autoload PKCS11
     modules.  For some situations this is desirable, but we expect admin in
     those situations to know they want the feature.  More commonly, it means
     rewrite in 4.80 combines with GnuTLS 2.12.0 or later, to autoload PKCS11
     modules.  For some situations this is desirable, but we expect admin in
     those situations to know they want the feature.  More commonly, it means


@@ -97,6 +97,13 @@ Version 4.82
     through, thus breakage.  So we explicitly inhibit the PKCS11 initialisation
     unless this new option is set.
 
     through, thus breakage.  So we explicitly inhibit the PKCS11 initialisation
     unless this new option is set.
 

+    Some older OS's with earlier versions of GnuTLS might not have pkcs11 ability,
+    so have also added a build option which can be used to build Exim with GnuTLS
+    but without trying to use any kind of PKCS11 support.  Uncomment this in the
+    Local/Makefile:
+
+    AVOID_GNUTLS_PKCS11=yes
+

 10. The "acl = name" condition on an ACL now supports optional arguments.
     New expansion item "${acl {name}{arg}...}" and expansion condition
     "acl {{name}{arg}...}" are added.  In all cases up to nine arguments
 10. The "acl = name" condition on an ACL now supports optional arguments.
     New expansion item "${acl {name}{arg}...}" and expansion condition
     "acl {{name}{arg}...}" are added.  In all cases up to nine arguments

diff --git a/doc/doc-txt/OptionLists.txt b/doc/doc-txt/OptionLists.txt
index 8787d488896b851e50a6fcdf7561a6366c291331..9c909f2f89d7dfccf9e55929e8cbb390e2d14de2 100644 (file)
--- a/doc/doc-txt/OptionLists.txt
+++ b/doc/doc-txt/OptionLists.txt
@@ -248,8 +248,8 @@ from                                 string*         unset         autoreply
 gecos_name                           string*         unset         main
 gecos_pattern                        string          unset         main
 gethostbyname                        boolean         false         smtp
 gecos_name                           string*         unset         main
 gecos_pattern                        string          unset         main
 gethostbyname                        boolean         false         smtp

+gnutls_allow_auto_pkcs11             boolean         false         main              4.82

 gnutls_compat_mode                   boolean         unset         main              4.70
 gnutls_compat_mode                   boolean         unset         main              4.70

-gnutls_enable_pkcs11                 boolean         false         main              4.82

 gnutls_require_kx                    string*         unset         main              4.67 deprecated, warns
                                      string*         unset         smtp              4.67 deprecated, warns
 gnutls_require_mac                   string*         unset         main              4.67 deprecated, warns
 gnutls_require_kx                    string*         unset         main              4.67 deprecated, warns
                                      string*         unset         smtp              4.67 deprecated, warns
 gnutls_require_mac                   string*         unset         main              4.67 deprecated, warns

diff --git a/src/README.UPDATING b/src/README.UPDATING
index 8b39848b445386dad84c155386e55ecac39d1b79..62652e7000a417a01b16225c28fbc377973e0e21 100644 (file)
--- a/src/README.UPDATING
+++ b/src/README.UPDATING
@@ -29,7 +29,7 @@ that might affect a running system.
 Exim version 4.82
 -----------------
 
 Exim version 4.82
 -----------------
 

- * New option gnutls_enable_pkcs11 defaults false; if you have GnuTLS 2.12.0
+ * New option gnutls_allow_auto_pkcs11 defaults false; if you have GnuTLS 2.12.0

    or later and do want PKCS11 modules to be autoloaded, then set this option.
 
  * A per-transport wait-<name> database is no longer updated if the transport
    or later and do want PKCS11 modules to be autoloaded, then set this option.
 
  * A per-transport wait-<name> database is no longer updated if the transport

diff --git a/src/scripts/Configure-Makefile b/src/scripts/Configure-Makefile
index 58b2b577067538d48606f6a4c6a8d04c023d4ac0..5e8a7268311b5b73b6db0202caedca959039b026 100755 (executable)
--- a/src/scripts/Configure-Makefile
+++ b/src/scripts/Configure-Makefile
@@ -118,7 +118,7 @@ done >> $mft || exit 1
 egrep "^[$st]*(AUTH|LOOKUP)_[A-Z0-9_]*[$st]*=[$st]*" $mft | \
   sed "s/[$st]*=/='/" | \
   sed "s/\$/'/" > $mftt
 egrep "^[$st]*(AUTH|LOOKUP)_[A-Z0-9_]*[$st]*=[$st]*" $mft | \
   sed "s/[$st]*=/='/" | \
   sed "s/\$/'/" > $mftt

-egrep "^[$st]*((USE_(OPENSSL|GNUTLS)_PC)|SUPPORT_TLS|USE_GNUTLS|PCRE_CONFIG)[$st]*=[$st]*" $mft | \
+egrep "^[$st]*((USE_(OPENSSL|GNUTLS)_PC)|SUPPORT_TLS|USE_GNUTLS|PCRE_CONFIG|AVOID_GNUTLS_PKCS11)[$st]*=[$st]*" $mft | \

   sed "s/[$st]*=/='/" | \
   sed "s/\$/'/" >> $mftt
 if test -s $mftt
   sed "s/[$st]*=/='/" | \
   sed "s/\$/'/" >> $mftt
 if test -s $mftt


@@ -187,6 +187,10 @@ then
         esac
         ;;
 
         esac
         ;;
 

+      AVOID_GNUTLS_PKCS11)
+        echo "$var=yes"
+        ;;
+

     esac
   done
   echo "# End of pkg-config fixups"
     esac
   done
   echo "# End of pkg-config fixups"

diff --git a/src/src/EDITME b/src/src/EDITME
index f44a1e3a5cf04eb8450141e7c188e80710ed8a0d..3f818f35581a6af7445f6e0560fe9478168e333e 100644 (file)
--- a/src/src/EDITME
+++ b/src/src/EDITME
@@ -728,6 +728,13 @@ HEADERS_CHARSET="ISO-8859-1"
 # USE_GNUTLS_PC=gnutls
 # TLS_LIBS=-lgnutls -ltasn1 -lgcrypt
 
 # USE_GNUTLS_PC=gnutls
 # TLS_LIBS=-lgnutls -ltasn1 -lgcrypt
 

+# The security fix we provide with the gnutls_allow_auto_pkcs11 option
+# (4.82 PP/09) introduces a compatibility regression.  The symbol is
+# not available if GnuTLS is build without p11-kit (--without-p11-kit
+# configure option).  In this case use AVOID_GNUTLS_PKCS11=yes when
+# building Exim.
+# AVOID_GNUTLS_PKCS11=yes
+

 # If you are running Exim as a server, note that just building it with TLS
 # support is not all you need to do. You also need to set up a suitable
 # certificate, and tell Exim about it by means of the tls_certificate
 # If you are running Exim as a server, note that just building it with TLS
 # support is not all you need to do. You also need to set up a suitable
 # certificate, and tell Exim about it by means of the tls_certificate

diff --git a/src/src/config.h.defaults b/src/src/config.h.defaults
index 19bc1b1801db174062727a969a04e561001b9000..8c1e799da313a7023abf721ef3656b107b61b29c 100644 (file)
--- a/src/src/config.h.defaults
+++ b/src/src/config.h.defaults
@@ -152,6 +152,7 @@ it's a default value. */
 #define USE_DB
 #define USE_GDBM
 #define USE_GNUTLS
 #define USE_DB
 #define USE_GDBM
 #define USE_GNUTLS

+#define AVOID_GNUTLS_PKCS11

 #define USE_READLINE
 #define USE_TCP_WRAPPERS
 #define USE_TDB
 #define USE_READLINE
 #define USE_TCP_WRAPPERS
 #define USE_TDB

diff --git a/src/src/globals.c b/src/src/globals.c
index 5f323490292b527a15df84f7c545bf9147d8d318..133a7bf740d9a13349af77d00240f383108e0c47 100644 (file)
--- a/src/src/globals.c
+++ b/src/src/globals.c
@@ -123,7 +123,7 @@ tls_support tls_out = {
 
 #ifdef SUPPORT_TLS
 BOOL    gnutls_compat_mode     = FALSE;
 
 #ifdef SUPPORT_TLS
 BOOL    gnutls_compat_mode     = FALSE;

-BOOL    gnutls_enable_pkcs11   = FALSE;
+BOOL    gnutls_allow_auto_pkcs11 = FALSE;

 uschar *gnutls_require_mac     = NULL;
 uschar *gnutls_require_kx      = NULL;
 uschar *gnutls_require_proto   = NULL;
 uschar *gnutls_require_mac     = NULL;
 uschar *gnutls_require_kx      = NULL;
 uschar *gnutls_require_proto   = NULL;

diff --git a/src/src/globals.h b/src/src/globals.h
index 4acc7f8c22322c7b2021fae22d04de07e6577a31..265f94e60617bd505925a17209a468883e21ba28 100644 (file)
--- a/src/src/globals.h
+++ b/src/src/globals.h
@@ -93,7 +93,7 @@ extern tls_support tls_out;
 
 #ifdef SUPPORT_TLS
 extern BOOL    gnutls_compat_mode;     /* Less security, more compatibility */
 
 #ifdef SUPPORT_TLS
 extern BOOL    gnutls_compat_mode;     /* Less security, more compatibility */

-extern BOOL    gnutls_enable_pkcs11;   /* Let GnuTLS autoload PKCS11 modules */
+extern BOOL    gnutls_allow_auto_pkcs11; /* Let GnuTLS autoload PKCS11 modules */

 extern uschar *gnutls_require_mac;     /* So some can be avoided */
 extern uschar *gnutls_require_kx;      /* So some can be avoided */
 extern uschar *gnutls_require_proto;   /* So some can be avoided */
 extern uschar *gnutls_require_mac;     /* So some can be avoided */
 extern uschar *gnutls_require_kx;      /* So some can be avoided */
 extern uschar *gnutls_require_proto;   /* So some can be avoided */

diff --git a/src/src/readconf.c b/src/src/readconf.c
index 6b0f3aaf755a6deb8040f835ca11f2514cee61b9..77c798412fd36ad145d000e2ef16bbd22ad7ce6c 100644 (file)
--- a/src/src/readconf.c
+++ b/src/src/readconf.c
@@ -243,8 +243,8 @@ static optionlist optionlist_config[] = {
   { "gecos_name",               opt_stringptr,   &gecos_name },
   { "gecos_pattern",            opt_stringptr,   &gecos_pattern },
 #ifdef SUPPORT_TLS
   { "gecos_name",               opt_stringptr,   &gecos_name },
   { "gecos_pattern",            opt_stringptr,   &gecos_pattern },
 #ifdef SUPPORT_TLS

+  { "gnutls_allow_auto_pkcs11", opt_bool,        &gnutls_allow_auto_pkcs11 },

   { "gnutls_compat_mode",       opt_bool,        &gnutls_compat_mode },
   { "gnutls_compat_mode",       opt_bool,        &gnutls_compat_mode },

-  { "gnutls_enable_pkcs11",     opt_bool,        &gnutls_enable_pkcs11 },

   /* These three gnutls_require_* options stopped working in Exim 4.80 */
   { "gnutls_require_kx",        opt_stringptr,   &gnutls_require_kx },
   { "gnutls_require_mac",       opt_stringptr,   &gnutls_require_mac },
   /* These three gnutls_require_* options stopped working in Exim 4.80 */
   { "gnutls_require_kx",        opt_stringptr,   &gnutls_require_kx },
   { "gnutls_require_mac",       opt_stringptr,   &gnutls_require_mac },

diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index c90ae1411caaa64234f826ace24af37f1e7b650f..5a37fae563348fb448bb517ec711a80073a7bca9 100644 (file)
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -176,7 +176,15 @@ before, for now. */
 #define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
 #define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
 #define HAVE_GNUTLS_RND
 #define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
 #define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
 #define HAVE_GNUTLS_RND

+/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
+ * (4.82 PP/09) introduces a compatibility regression. The symbol simply
+ * isn't available sometimes, so this needs to become a conditional
+ * compilation; the sanest way to deal with this being a problem on
+ * older OSes is to block it in the Local/Makefile with this compiler
+ * definition  */
+#ifndef AVOID_GNUTLS_PKCS11

 #define HAVE_GNUTLS_PKCS11
 #define HAVE_GNUTLS_PKCS11

+#endif /* AVOID_GNUTLS_PKCS11 */

 #endif
 
 
 #endif
 
 


@@ -922,7 +930,7 @@ if (!exim_gnutls_base_init_done)
   by some sysadmin, but also means in common configurations that GNOME keyring
   environment variables are used and so breaks for users calling mailq.
   To prevent this, we init PKCS11 first, which is the documented approach. */
   by some sysadmin, but also means in common configurations that GNOME keyring
   environment variables are used and so breaks for users calling mailq.
   To prevent this, we init PKCS11 first, which is the documented approach. */

-  if (!gnutls_enable_pkcs11)
+  if (!gnutls_allow_auto_pkcs11)

     {
     rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
     exim_gnutls_err_check(US"gnutls_pkcs11_init");
     {
     rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
     exim_gnutls_err_check(US"gnutls_pkcs11_init");


@@ -1967,7 +1975,7 @@ if (exim_gnutls_base_init_done)
       "already initialised GnuTLS, Exim developer bug");
 
 #ifdef HAVE_GNUTLS_PKCS11
       "already initialised GnuTLS, Exim developer bug");
 
 #ifdef HAVE_GNUTLS_PKCS11

-if (!gnutls_enable_pkcs11)
+if (!gnutls_allow_auto_pkcs11)

   {
   rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
   validate_check_rc(US"gnutls_pkcs11_init");
   {
   rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
   validate_check_rc(US"gnutls_pkcs11_init");