1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2014 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42 /* needed to disable PKCS11 autoload unless requested */
43 #if GNUTLS_VERSION_NUMBER >= 0x020c00
44 # include <gnutls/pkcs11.h>
46 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
47 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50 #if GNUTLS_VERSION_NUMBER < 0x020a00 && defined(EXPERIMENTAL_TPDA)
51 # warning "GnuTLS library version too old; TPDA tls:cert event unsupported"
52 # undef EXPERIMENTAL_TPDA
54 #if GNUTLS_VERSION_NUMBER >= 0x030306
55 # define SUPPORT_CA_DIR
57 # undef SUPPORT_CA_DIR
61 # include <gnutls/ocsp.h>
67 gnutls_global_set_audit_log_function()
70 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
73 /* Local static variables for GnuTLS */
75 /* Values for verify_requirement */
77 enum peer_verify_requirement
78 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED
79 #ifdef EXPERIMENTAL_CERTNAMES
84 /* This holds most state for server or client; with this, we can set up an
85 outbound TLS-enabled connection in an ACL callout, while not stomping all
86 over the TLS variables available for expansion.
88 Some of these correspond to variables in globals.c; those variables will
89 be set to point to content in one of these instances, as appropriate for
90 the stage of the process lifetime.
92 Not handled here: global tls_channelbinding_b64.
95 typedef struct exim_gnutls_state {
96 gnutls_session_t session;
97 gnutls_certificate_credentials_t x509_cred;
98 gnutls_priority_t priority_cache;
99 enum peer_verify_requirement verify_requirement;
102 BOOL peer_cert_verified;
103 BOOL trigger_sni_changes;
104 BOOL have_set_peerdn;
105 const struct host_item *host;
106 gnutls_x509_crt_t peercert;
109 uschar *received_sni;
111 const uschar *tls_certificate;
112 const uschar *tls_privatekey;
113 const uschar *tls_sni; /* client send only, not received */
114 const uschar *tls_verify_certificates;
115 const uschar *tls_crl;
116 const uschar *tls_require_ciphers;
118 uschar *exp_tls_certificate;
119 uschar *exp_tls_privatekey;
120 uschar *exp_tls_verify_certificates;
122 uschar *exp_tls_require_ciphers;
123 uschar *exp_tls_ocsp_file;
124 #ifdef EXPERIMENTAL_CERTNAMES
125 uschar *exp_tls_verify_cert_hostnames;
127 #ifdef EXPERIMENTAL_TPDA
128 uschar *event_action;
131 tls_support *tlsp; /* set in tls_init() */
138 } exim_gnutls_state_st;
140 static const exim_gnutls_state_st exim_gnutls_state_init = {
141 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
142 NULL, NULL, NULL, NULL,
143 NULL, NULL, NULL, NULL, NULL, NULL,
144 NULL, NULL, NULL, NULL, NULL, NULL, NULL,
145 #ifdef EXPERIMENTAL_CERTNAMES
148 #ifdef EXPERIMENTAL_TPDA
155 /* Not only do we have our own APIs which don't pass around state, assuming
156 it's held in globals, GnuTLS doesn't appear to let us register callback data
157 for callbacks, or as part of the session, so we have to keep a "this is the
158 context we're currently dealing with" pointer and rely upon being
159 single-threaded to keep from processing data on an inbound TLS connection while
160 talking to another TLS connection for an outbound check. This does mean that
161 there's no way for heart-beats to be responded to, for the duration of the
163 XXX But see gnutls_session_get_ptr()
166 static exim_gnutls_state_st state_server, state_client;
168 /* dh_params are initialised once within the lifetime of a process using TLS;
169 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
170 don't want to repeat this. */
172 static gnutls_dh_params_t dh_server_params = NULL;
174 /* No idea how this value was chosen; preserving it. Default is 3600. */
176 static const int ssl_session_timeout = 200;
178 static const char * const exim_default_gnutls_priority = "NORMAL";
180 /* Guard library core initialisation */
182 static BOOL exim_gnutls_base_init_done = FALSE;
185 /* ------------------------------------------------------------------------ */
188 #define MAX_HOST_LEN 255
190 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
191 the library logging; a value less than 0 disables the calls to set up logging
193 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
194 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
197 #ifndef EXIM_CLIENT_DH_MIN_BITS
198 # define EXIM_CLIENT_DH_MIN_BITS 1024
201 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
202 can ask for a bit-strength. Without that, we stick to the constant we had
204 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
205 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
208 #define exim_gnutls_err_check(Label) do { \
209 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
211 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
213 #if GNUTLS_VERSION_NUMBER >= 0x020c00
214 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
215 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
216 # define HAVE_GNUTLS_RND
217 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
218 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
219 * isn't available sometimes, so this needs to become a conditional
220 * compilation; the sanest way to deal with this being a problem on
221 * older OSes is to block it in the Local/Makefile with this compiler
223 # ifndef AVOID_GNUTLS_PKCS11
224 # define HAVE_GNUTLS_PKCS11
225 # endif /* AVOID_GNUTLS_PKCS11 */
231 /* ------------------------------------------------------------------------ */
232 /* Callback declarations */
234 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
235 static void exim_gnutls_logger_cb(int level, const char *message);
238 static int exim_sni_handling_cb(gnutls_session_t session);
241 static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
242 gnutls_datum_t * ocsp_response);
247 /* ------------------------------------------------------------------------ */
248 /* Static functions */
250 /*************************************************
252 *************************************************/
254 /* Called from lots of places when errors occur before actually starting to do
255 the TLS handshake, that is, while the session is still in clear. Always returns
256 DEFER for a server and FAIL for a client so that most calls can use "return
257 tls_error(...)" to do this processing and then give an appropriate return. A
258 single function is used for both server and client, because it is called from
259 some shared functions.
262 prefix text to include in the logged error
263 msg additional error string (may be NULL)
264 usually obtained from gnutls_strerror()
265 host NULL if setting up a server;
266 the connected host if setting up a client
268 Returns: OK/DEFER/FAIL
272 tls_error(const uschar *prefix, const char *msg, const host_item *host)
276 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
277 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
282 uschar *conn_info = smtp_get_connection_info();
283 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
285 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
286 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
294 /*************************************************
295 * Deal with logging errors during I/O *
296 *************************************************/
298 /* We have to get the identity of the peer from saved data.
301 state the current GnuTLS exim state container
302 rc the GnuTLS error code, or 0 if it's a local error
303 when text identifying read or write
304 text local error text when ec is 0
310 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
314 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
315 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
316 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
318 msg = gnutls_strerror(rc);
320 tls_error(when, msg, state->host);
326 /*************************************************
327 * Set various Exim expansion vars *
328 *************************************************/
330 #define exim_gnutls_cert_err(Label) \
333 if (rc != GNUTLS_E_SUCCESS) \
335 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
336 (Label), gnutls_strerror(rc)); \
342 import_cert(const gnutls_datum * cert, gnutls_x509_crt_t * crtp)
346 rc = gnutls_x509_crt_init(crtp);
347 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
349 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
350 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
355 #undef exim_gnutls_cert_err
358 /* We set various Exim global variables from the state, once a session has
359 been established. With TLS callouts, may need to change this to stack
360 variables, or just re-call it with the server state after client callout
363 Make sure anything set here is unset in tls_getc().
367 tls_bits strength indicator
368 tls_certificate_verified bool indicator
369 tls_channelbinding_b64 for some SASL mechanisms
371 tls_peercert pointer to library internal
373 tls_sni a (UTF-8) string
374 tls_ourcert pointer to library internal
377 state the relevant exim_gnutls_state_st *
381 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
383 gnutls_cipher_algorithm_t cipher;
384 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
387 gnutls_datum_t channel;
389 tls_support * tlsp = state->tlsp;
391 tlsp->active = state->fd_out;
393 cipher = gnutls_cipher_get(state->session);
394 /* returns size in "bytes" */
395 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
397 tlsp->cipher = state->ciphersuite;
399 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
401 tlsp->certificate_verified = state->peer_cert_verified;
403 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
404 only available for use for authenticators while this TLS session is running. */
406 tls_channelbinding_b64 = NULL;
407 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
410 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
412 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
414 old_pool = store_pool;
415 store_pool = POOL_PERM;
416 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
417 store_pool = old_pool;
418 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
422 /* peercert is set in peer_status() */
423 tlsp->peerdn = state->peerdn;
424 tlsp->sni = state->received_sni;
426 /* record our certificate */
428 const gnutls_datum * cert = gnutls_certificate_get_ours(state->session);
429 gnutls_x509_crt_t crt;
431 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
438 /*************************************************
439 * Setup up DH parameters *
440 *************************************************/
442 /* Generating the D-H parameters may take a long time. They only need to
443 be re-generated every so often, depending on security policy. What we do is to
444 keep these parameters in a file in the spool directory. If the file does not
445 exist, we generate them. This means that it is easy to cause a regeneration.
447 The new file is written as a temporary file and renamed, so that an incomplete
448 file is never present. If two processes both compute some new parameters, you
449 waste a bit of effort, but it doesn't seem worth messing around with locking to
452 Returns: OK/DEFER/FAIL
459 unsigned int dh_bits;
461 uschar filename_buf[PATH_MAX];
462 uschar *filename = NULL;
464 uschar *exp_tls_dhparam;
465 BOOL use_file_in_spool = FALSE;
466 BOOL use_fixed_file = FALSE;
467 host_item *host = NULL; /* dummy for macros */
469 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
471 rc = gnutls_dh_params_init(&dh_server_params);
472 exim_gnutls_err_check(US"gnutls_dh_params_init");
477 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
480 if (!exp_tls_dhparam)
482 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
483 m.data = US std_dh_prime_default();
484 m.size = Ustrlen(m.data);
486 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
487 use_file_in_spool = TRUE;
488 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
490 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
493 else if (exp_tls_dhparam[0] != '/')
495 m.data = US std_dh_prime_named(exp_tls_dhparam);
497 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
498 m.size = Ustrlen(m.data);
502 use_fixed_file = TRUE;
503 filename = exp_tls_dhparam;
508 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
509 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
510 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
514 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
515 /* If you change this constant, also change dh_param_fn_ext so that we can use a
516 different filename and ensure we have sufficient bits. */
517 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
519 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
521 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
524 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
526 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
530 /* Some clients have hard-coded limits. */
531 if (dh_bits > tls_dh_max_bits)
534 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
536 dh_bits = tls_dh_max_bits;
539 if (use_file_in_spool)
541 if (!string_format(filename_buf, sizeof(filename_buf),
542 "%s/gnutls-params-%d", spool_directory, dh_bits))
543 return tls_error(US"overlong filename", NULL, NULL);
544 filename = filename_buf;
547 /* Open the cache file for reading and if successful, read it and set up the
550 fd = Uopen(filename, O_RDONLY, 0);
557 if (fstat(fd, &statbuf) < 0) /* EIO */
561 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
563 if (!S_ISREG(statbuf.st_mode))
566 return tls_error(US"TLS cache not a file", NULL, NULL);
568 fp = fdopen(fd, "rb");
573 return tls_error(US"fdopen(TLS cache stat fd) failed",
574 strerror(saved_errno), NULL);
577 m.size = statbuf.st_size;
578 m.data = malloc(m.size);
582 return tls_error(US"malloc failed", strerror(errno), NULL);
584 sz = fread(m.data, m.size, 1, fp);
590 return tls_error(US"fread failed", strerror(saved_errno), NULL);
594 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
596 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
597 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
600 /* If the file does not exist, fall through to compute new data and cache it.
601 If there was any other opening error, it is serious. */
603 else if (errno == ENOENT)
607 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
610 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
613 /* If ret < 0, either the cache file does not exist, or the data it contains
614 is not useful. One particular case of this is when upgrading from an older
615 release of Exim in which the data was stored in a different format. We don't
616 try to be clever and support both formats; we just regenerate new data in this
622 unsigned int dh_bits_gen = dh_bits;
624 if ((PATH_MAX - Ustrlen(filename)) < 10)
625 return tls_error(US"Filename too long to generate replacement",
628 temp_fn = string_copy(US "%s.XXXXXXX");
629 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
631 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
632 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
634 /* GnuTLS overshoots!
635 * If we ask for 2236, we might get 2237 or more.
636 * But there's no way to ask GnuTLS how many bits there really are.
637 * We can ask how many bits were used in a TLS session, but that's it!
638 * The prime itself is hidden behind too much abstraction.
639 * So we ask for less, and proceed on a wing and a prayer.
640 * First attempt, subtracted 3 for 2233 and got 2240.
642 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
644 dh_bits_gen = dh_bits - 10;
646 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
651 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
653 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
654 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
656 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
657 and I confirmed that a NULL call to get the size first is how the GnuTLS
658 sample apps handle this. */
662 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
664 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
665 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
667 m.data = malloc(m.size);
669 return tls_error(US"memory allocation failed", strerror(errno), NULL);
670 /* this will return a size 1 less than the allocation size above */
671 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
673 if (rc != GNUTLS_E_SUCCESS)
676 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
678 m.size = sz; /* shrink by 1, probably */
680 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
684 return tls_error(US"TLS cache write D-H params failed",
685 strerror(errno), NULL);
688 sz = write_to_fd_buf(fd, US"\n", 1);
690 return tls_error(US"TLS cache write D-H params final newline failed",
691 strerror(errno), NULL);
695 return tls_error(US"TLS cache write close() failed",
696 strerror(errno), NULL);
698 if (Urename(temp_fn, filename) < 0)
699 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
700 temp_fn, filename), strerror(errno), NULL);
702 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
705 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
712 /*************************************************
713 * Variables re-expanded post-SNI *
714 *************************************************/
716 /* Called from both server and client code, via tls_init(), and also from
717 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
719 We can tell the two apart by state->received_sni being non-NULL in callback.
721 The callback should not call us unless state->trigger_sni_changes is true,
722 which we are responsible for setting on the first pass through.
725 state exim_gnutls_state_st *
727 Returns: OK/DEFER/FAIL
731 tls_expand_session_files(exim_gnutls_state_st *state)
735 const host_item *host = state->host; /* macro should be reconsidered? */
736 uschar *saved_tls_certificate = NULL;
737 uschar *saved_tls_privatekey = NULL;
738 uschar *saved_tls_verify_certificates = NULL;
739 uschar *saved_tls_crl = NULL;
742 /* We check for tls_sni *before* expansion. */
743 if (!host) /* server */
745 if (!state->received_sni)
747 if (state->tls_certificate &&
748 (Ustrstr(state->tls_certificate, US"tls_sni") ||
749 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
750 Ustrstr(state->tls_certificate, US"tls_out_sni")
753 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
754 state->trigger_sni_changes = TRUE;
759 /* useful for debugging */
760 saved_tls_certificate = state->exp_tls_certificate;
761 saved_tls_privatekey = state->exp_tls_privatekey;
762 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
763 saved_tls_crl = state->exp_tls_crl;
767 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
768 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
770 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
771 state members, assuming consistent naming; and expand_check() returns
772 false if expansion failed, unless expansion was forced to fail. */
774 /* check if we at least have a certificate, before doing expensive
777 if (!expand_check_tlsvar(tls_certificate))
780 /* certificate is mandatory in server, optional in client */
782 if ((state->exp_tls_certificate == NULL) ||
783 (*state->exp_tls_certificate == '\0'))
786 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
788 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
791 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
794 /* tls_privatekey is optional, defaulting to same file as certificate */
796 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
798 state->tls_privatekey = state->tls_certificate;
799 state->exp_tls_privatekey = state->exp_tls_certificate;
803 if (state->exp_tls_certificate && *state->exp_tls_certificate)
805 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
806 state->exp_tls_certificate, state->exp_tls_privatekey);
808 if (state->received_sni)
810 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
811 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
813 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
817 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
821 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
822 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
823 GNUTLS_X509_FMT_PEM);
824 exim_gnutls_err_check(
825 string_sprintf("cert/key setup: cert=%s key=%s",
826 state->exp_tls_certificate, state->exp_tls_privatekey));
827 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
828 } /* tls_certificate */
831 /* Set the OCSP stapling server info */
834 if ( !host /* server */
838 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file",
839 &state->exp_tls_ocsp_file))
842 /* Use the full callback method for stapling just to get observability.
843 More efficient would be to read the file once only, if it never changed
844 (due to SNI). Would need restart on file update, or watch datestamp. */
846 gnutls_certificate_set_ocsp_status_request_function(state->x509_cred,
847 server_ocsp_stapling_cb, state->exp_tls_ocsp_file);
849 DEBUG(D_tls) debug_printf("Set OCSP response file %s\n", &state->exp_tls_ocsp_file);
854 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
855 provided. Experiment shows that, if the certificate file is empty, an unhelpful
856 error message is provided. However, if we just refrain from setting anything up
857 in that case, certificate verification fails, which seems to be the correct
860 if (state->tls_verify_certificates && *state->tls_verify_certificates)
862 if (!expand_check_tlsvar(tls_verify_certificates))
864 if (state->tls_crl && *state->tls_crl)
865 if (!expand_check_tlsvar(tls_crl))
868 if (!(state->exp_tls_verify_certificates &&
869 *state->exp_tls_verify_certificates))
872 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
873 /* With no tls_verify_certificates, we ignore tls_crl too */
880 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
884 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
886 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
887 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
892 #ifndef SUPPORT_CA_DIR
893 /* The test suite passes in /dev/null; we could check for that path explicitly,
894 but who knows if someone has some weird FIFO which always dumps some certs, or
895 other weirdness. The thing we really want to check is that it's not a
896 directory, since while OpenSSL supports that, GnuTLS does not.
897 So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
898 if (S_ISDIR(statbuf.st_mode))
901 debug_printf("verify certificates path is a dir: \"%s\"\n",
902 state->exp_tls_verify_certificates);
903 log_write(0, LOG_MAIN|LOG_PANIC,
904 "tls_verify_certificates \"%s\" is a directory",
905 state->exp_tls_verify_certificates);
910 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
911 state->exp_tls_verify_certificates, statbuf.st_size);
913 if (statbuf.st_size == 0)
916 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
922 #ifdef SUPPORT_CA_DIR
923 (statbuf.st_mode & S_IFMT) == S_IFDIR
925 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
926 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
929 gnutls_certificate_set_x509_trust_file(state->x509_cred,
930 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
935 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
937 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
939 if (state->tls_crl && *state->tls_crl &&
940 state->exp_tls_crl && *state->exp_tls_crl)
942 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
943 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
944 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
948 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
950 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
959 /*************************************************
960 * Set X.509 state variables *
961 *************************************************/
963 /* In GnuTLS, the registered cert/key are not replaced by a later
964 set of a cert/key, so for SNI support we need a whole new x509_cred
965 structure. Which means various other non-re-expanded pieces of state
966 need to be re-set in the new struct, so the setting logic is pulled
970 state exim_gnutls_state_st *
972 Returns: OK/DEFER/FAIL
976 tls_set_remaining_x509(exim_gnutls_state_st *state)
979 const host_item *host = state->host; /* macro should be reconsidered? */
981 /* Create D-H parameters, or read them from the cache file. This function does
982 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
983 client-side params. */
987 if (!dh_server_params)
989 rc = init_server_dh();
990 if (rc != OK) return rc;
992 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
995 /* Link the credentials to the session. */
997 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
998 exim_gnutls_err_check(US"gnutls_credentials_set");
1003 /*************************************************
1004 * Initialize for GnuTLS *
1005 *************************************************/
1007 /* Called from both server and client code. In the case of a server, errors
1008 before actual TLS negotiation return DEFER.
1011 host connected host, if client; NULL if server
1012 certificate certificate file
1013 privatekey private key file
1014 sni TLS SNI to send, sometimes when client; else NULL
1017 require_ciphers tls_require_ciphers setting
1018 caller_state returned state-info structure
1020 Returns: OK/DEFER/FAIL
1025 const host_item *host,
1026 const uschar *certificate,
1027 const uschar *privatekey,
1031 const uschar *require_ciphers,
1032 exim_gnutls_state_st **caller_state)
1034 exim_gnutls_state_st *state;
1039 BOOL want_default_priorities;
1041 if (!exim_gnutls_base_init_done)
1043 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1045 #ifdef HAVE_GNUTLS_PKCS11
1046 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1047 which loads modules from a config file, which sounds good and may be wanted
1048 by some sysadmin, but also means in common configurations that GNOME keyring
1049 environment variables are used and so breaks for users calling mailq.
1050 To prevent this, we init PKCS11 first, which is the documented approach. */
1051 if (!gnutls_allow_auto_pkcs11)
1053 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1054 exim_gnutls_err_check(US"gnutls_pkcs11_init");
1058 rc = gnutls_global_init();
1059 exim_gnutls_err_check(US"gnutls_global_init");
1061 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1064 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1065 /* arbitrarily chosen level; bump upto 9 for more */
1066 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1070 exim_gnutls_base_init_done = TRUE;
1075 state = &state_client;
1076 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1077 state->tlsp = &tls_out;
1078 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1079 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1083 state = &state_server;
1084 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1085 state->tlsp = &tls_in;
1086 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1087 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1089 exim_gnutls_err_check(US"gnutls_init");
1093 state->tls_certificate = certificate;
1094 state->tls_privatekey = privatekey;
1095 state->tls_require_ciphers = require_ciphers;
1096 state->tls_sni = sni;
1097 state->tls_verify_certificates = cas;
1098 state->tls_crl = crl;
1100 /* This handles the variables that might get re-expanded after TLS SNI;
1101 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1104 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1105 rc = tls_expand_session_files(state);
1106 if (rc != OK) return rc;
1108 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1109 requires a new structure afterwards. */
1111 rc = tls_set_remaining_x509(state);
1112 if (rc != OK) return rc;
1114 /* set SNI in client, only */
1117 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni))
1119 if (state->tlsp->sni && *state->tlsp->sni)
1122 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1123 sz = Ustrlen(state->tlsp->sni);
1124 rc = gnutls_server_name_set(state->session,
1125 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
1126 exim_gnutls_err_check(US"gnutls_server_name_set");
1129 else if (state->tls_sni)
1130 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1131 "have an SNI set for a client [%s]\n", state->tls_sni);
1133 /* This is the priority string support,
1134 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1135 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1136 This was backwards incompatible, but means Exim no longer needs to track
1137 all algorithms and provide string forms for them. */
1139 want_default_priorities = TRUE;
1141 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1143 if (!expand_check_tlsvar(tls_require_ciphers))
1145 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1147 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1148 state->exp_tls_require_ciphers);
1150 rc = gnutls_priority_init(&state->priority_cache,
1151 CS state->exp_tls_require_ciphers, &errpos);
1152 want_default_priorities = FALSE;
1153 p = state->exp_tls_require_ciphers;
1156 if (want_default_priorities)
1159 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1160 exim_default_gnutls_priority);
1161 rc = gnutls_priority_init(&state->priority_cache,
1162 exim_default_gnutls_priority, &errpos);
1163 p = US exim_default_gnutls_priority;
1166 exim_gnutls_err_check(string_sprintf(
1167 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1168 p, errpos - CS p, errpos));
1170 rc = gnutls_priority_set(state->session, state->priority_cache);
1171 exim_gnutls_err_check(US"gnutls_priority_set");
1173 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1175 /* Reduce security in favour of increased compatibility, if the admin
1176 decides to make that trade-off. */
1177 if (gnutls_compat_mode)
1179 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1180 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1181 gnutls_session_enable_compatibility_mode(state->session);
1183 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1187 *caller_state = state;
1193 /*************************************************
1194 * Extract peer information *
1195 *************************************************/
1197 /* Called from both server and client code.
1198 Only this is allowed to set state->peerdn and state->have_set_peerdn
1199 and we use that to detect double-calls.
1201 NOTE: the state blocks last while the TLS connection is up, which is fine
1202 for logging in the server side, but for the client side, we log after teardown
1203 in src/deliver.c. While the session is up, we can twist about states and
1204 repoint tls_* globals, but those variables used for logging or other variable
1205 expansion that happens _after_ delivery need to have a longer life-time.
1207 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1208 doing this more than once per generation of a state context. We set them in
1209 the state context, and repoint tls_* to them. After the state goes away, the
1210 tls_* copies of the pointers remain valid and client delivery logging is happy.
1212 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1216 state exim_gnutls_state_st *
1218 Returns: OK/DEFER/FAIL
1222 peer_status(exim_gnutls_state_st *state)
1224 uschar cipherbuf[256];
1225 const gnutls_datum *cert_list;
1227 unsigned int cert_list_size = 0;
1228 gnutls_protocol_t protocol;
1229 gnutls_cipher_algorithm_t cipher;
1230 gnutls_kx_algorithm_t kx;
1231 gnutls_mac_algorithm_t mac;
1232 gnutls_certificate_type_t ct;
1233 gnutls_x509_crt_t crt;
1237 if (state->have_set_peerdn)
1239 state->have_set_peerdn = TRUE;
1241 state->peerdn = NULL;
1244 cipher = gnutls_cipher_get(state->session);
1245 protocol = gnutls_protocol_get_version(state->session);
1246 mac = gnutls_mac_get(state->session);
1247 kx = gnutls_kx_get(state->session);
1249 string_format(cipherbuf, sizeof(cipherbuf),
1251 gnutls_protocol_get_name(protocol),
1252 gnutls_cipher_suite_get_name(kx, cipher, mac),
1253 (int) gnutls_cipher_get_key_size(cipher) * 8);
1255 /* I don't see a way that spaces could occur, in the current GnuTLS
1256 code base, but it was a concern in the old code and perhaps older GnuTLS
1257 releases did return "TLS 1.0"; play it safe, just in case. */
1258 for (p = cipherbuf; *p != '\0'; ++p)
1261 old_pool = store_pool;
1262 store_pool = POOL_PERM;
1263 state->ciphersuite = string_copy(cipherbuf);
1264 store_pool = old_pool;
1265 state->tlsp->cipher = state->ciphersuite;
1268 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1270 if (cert_list == NULL || cert_list_size == 0)
1272 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1273 cert_list, cert_list_size);
1274 if (state->verify_requirement >= VERIFY_REQUIRED)
1275 return tls_error(US"certificate verification failed",
1276 "no certificate received from peer", state->host);
1280 ct = gnutls_certificate_type_get(state->session);
1281 if (ct != GNUTLS_CRT_X509)
1283 const char *ctn = gnutls_certificate_type_get_name(ct);
1285 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1286 if (state->verify_requirement >= VERIFY_REQUIRED)
1287 return tls_error(US"certificate verification not possible, unhandled type",
1292 #define exim_gnutls_peer_err(Label) \
1294 if (rc != GNUTLS_E_SUCCESS) \
1296 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1297 (Label), gnutls_strerror(rc)); \
1298 if (state->verify_requirement >= VERIFY_REQUIRED) \
1299 return tls_error((Label), gnutls_strerror(rc), state->host); \
1304 rc = import_cert(&cert_list[0], &crt);
1305 exim_gnutls_peer_err(US"cert 0");
1307 state->tlsp->peercert = state->peercert = crt;
1310 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1311 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1313 exim_gnutls_peer_err(US"getting size for cert DN failed");
1314 return FAIL; /* should not happen */
1316 dn_buf = store_get_perm(sz);
1317 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1318 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1320 state->peerdn = dn_buf;
1323 #undef exim_gnutls_peer_err
1329 /*************************************************
1330 * Verify peer certificate *
1331 *************************************************/
1333 /* Called from both server and client code.
1334 *Should* be using a callback registered with
1335 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1336 the peer information, but that's too new for some OSes.
1339 state exim_gnutls_state_st *
1340 error where to put an error message
1343 FALSE if the session should be rejected
1344 TRUE if the cert is okay or we just don't care
1348 verify_certificate(exim_gnutls_state_st *state, const char **error)
1351 unsigned int verify;
1355 if ((rc = peer_status(state)) != OK)
1357 verify = GNUTLS_CERT_INVALID;
1358 *error = "certificate not supplied";
1361 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1363 /* Handle the result of verification. INVALID seems to be set as well
1364 as REVOKED, but leave the test for both. */
1367 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1370 state->peer_cert_verified = FALSE;
1372 *error = verify & GNUTLS_CERT_REVOKED
1373 ? "certificate revoked" : "certificate invalid";
1376 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1377 *error, state->peerdn ? state->peerdn : US"<unset>");
1379 if (state->verify_requirement >= VERIFY_REQUIRED)
1381 gnutls_alert_send(state->session,
1382 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1386 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1391 #ifdef EXPERIMENTAL_CERTNAMES
1392 if (state->verify_requirement == VERIFY_WITHHOST)
1395 uschar * list = state->exp_tls_verify_cert_hostnames;
1397 while (name = string_nextinlist(&list, &sep, NULL, 0))
1398 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1403 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1404 gnutls_alert_send(state->session,
1405 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1410 state->peer_cert_verified = TRUE;
1411 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1412 state->peerdn ? state->peerdn : US"<unset>");
1415 state->tlsp->peerdn = state->peerdn;
1423 /* ------------------------------------------------------------------------ */
1426 /* Logging function which can be registered with
1427 * gnutls_global_set_log_function()
1428 * gnutls_global_set_log_level() 0..9
1430 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1432 exim_gnutls_logger_cb(int level, const char *message)
1434 size_t len = strlen(message);
1437 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1440 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1441 message[len-1] == '\n' ? "" : "\n");
1446 /* Called after client hello, should handle SNI work.
1447 This will always set tls_sni (state->received_sni) if available,
1448 and may trigger presenting different certificates,
1449 if state->trigger_sni_changes is TRUE.
1451 Should be registered with
1452 gnutls_handshake_set_post_client_hello_function()
1454 "This callback must return 0 on success or a gnutls error code to terminate the
1457 For inability to get SNI information, we return 0.
1458 We only return non-zero if re-setup failed.
1459 Only used for server-side TLS.
1463 exim_sni_handling_cb(gnutls_session_t session)
1465 char sni_name[MAX_HOST_LEN];
1466 size_t data_len = MAX_HOST_LEN;
1467 exim_gnutls_state_st *state = &state_server;
1468 unsigned int sni_type;
1471 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1472 if (rc != GNUTLS_E_SUCCESS)
1475 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1476 debug_printf("TLS: no SNI presented in handshake.\n");
1478 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1479 gnutls_strerror(rc), rc);
1484 if (sni_type != GNUTLS_NAME_DNS)
1486 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1490 /* We now have a UTF-8 string in sni_name */
1491 old_pool = store_pool;
1492 store_pool = POOL_PERM;
1493 state->received_sni = string_copyn(US sni_name, data_len);
1494 store_pool = old_pool;
1496 /* We set this one now so that variable expansions below will work */
1497 state->tlsp->sni = state->received_sni;
1499 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1500 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1502 if (!state->trigger_sni_changes)
1505 rc = tls_expand_session_files(state);
1508 /* If the setup of certs/etc failed before handshake, TLS would not have
1509 been offered. The best we can do now is abort. */
1510 return GNUTLS_E_APPLICATION_ERROR_MIN;
1513 rc = tls_set_remaining_x509(state);
1514 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1521 #ifndef DISABLE_OCSP
1524 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1525 gnutls_datum_t * ocsp_response)
1529 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1531 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1533 tls_in.ocsp = OCSP_NOT_RESP;
1534 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1537 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1544 #ifdef EXPERIMENTAL_TPDA
1546 We use this callback to get observability and detail-level control
1547 for an exim client TLS connection, raising a TPDA tls:cert event
1548 for each cert in the chain presented by the server. Any event
1549 can deny verification.
1551 Return 0 for the handshake to continue or non-zero to terminate.
1555 client_verify_cb(gnutls_session_t session)
1557 const gnutls_datum * cert_list;
1558 unsigned int cert_list_size = 0;
1559 gnutls_x509_crt_t crt;
1561 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1563 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1565 while (cert_list_size--)
1567 rc = import_cert(&cert_list[cert_list_size], &crt);
1568 if (rc != GNUTLS_E_SUCCESS)
1570 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1571 cert_list_size, gnutls_strerror(rc));
1575 state->tlsp->peercert = crt;
1576 if (tpda_raise_event(state->event_action,
1577 US"tls:cert", string_sprintf("%d", cert_list_size)) == DEFER)
1579 log_write(0, LOG_MAIN,
1580 "SSL verify denied by event-action: depth=%d", cert_list_size);
1581 return 1; /* reject */
1583 state->tlsp->peercert = NULL;
1593 /* ------------------------------------------------------------------------ */
1594 /* Exported functions */
1599 /*************************************************
1600 * Start a TLS session in a server *
1601 *************************************************/
1603 /* This is called when Exim is running as a server, after having received
1604 the STARTTLS command. It must respond to that command, and then negotiate
1608 require_ciphers list of allowed ciphers or NULL
1610 Returns: OK on success
1611 DEFER for errors before the start of the negotiation
1612 FAIL for errors during the negotation; the server can't
1617 tls_server_start(const uschar *require_ciphers)
1621 exim_gnutls_state_st *state = NULL;
1623 /* Check for previous activation */
1624 if (tls_in.active >= 0)
1626 tls_error(US"STARTTLS received after TLS started", "", NULL);
1627 smtp_printf("554 Already in TLS\r\n");
1631 /* Initialize the library. If it fails, it will already have logged the error
1632 and sent an SMTP response. */
1634 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1636 rc = tls_init(NULL, tls_certificate, tls_privatekey,
1637 NULL, tls_verify_certificates, tls_crl,
1638 require_ciphers, &state);
1639 if (rc != OK) return rc;
1641 /* If this is a host for which certificate verification is mandatory or
1642 optional, set up appropriately. */
1644 if (verify_check_host(&tls_verify_hosts) == OK)
1647 debug_printf("TLS: a client certificate will be required.\n");
1648 state->verify_requirement = VERIFY_REQUIRED;
1649 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1651 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1654 debug_printf("TLS: a client certificate will be requested but not required.\n");
1655 state->verify_requirement = VERIFY_OPTIONAL;
1656 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1661 debug_printf("TLS: a client certificate will not be requested.\n");
1662 state->verify_requirement = VERIFY_NONE;
1663 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1666 /* Register SNI handling; always, even if not in tls_certificate, so that the
1667 expansion variable $tls_sni is always available. */
1669 gnutls_handshake_set_post_client_hello_function(state->session,
1670 exim_sni_handling_cb);
1672 /* Set context and tell client to go ahead, except in the case of TLS startup
1673 on connection, where outputting anything now upsets the clients and tends to
1674 make them disconnect. We need to have an explicit fflush() here, to force out
1675 the response. Other smtp_printf() calls do not need it, because in non-TLS
1676 mode, the fflush() happens when smtp_getc() is called. */
1678 if (!state->tlsp->on_connect)
1680 smtp_printf("220 TLS go ahead\r\n");
1684 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1685 that the GnuTLS library doesn't. */
1687 gnutls_transport_set_ptr2(state->session,
1688 (gnutls_transport_ptr)(long) fileno(smtp_in),
1689 (gnutls_transport_ptr)(long) fileno(smtp_out));
1690 state->fd_in = fileno(smtp_in);
1691 state->fd_out = fileno(smtp_out);
1693 sigalrm_seen = FALSE;
1694 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1697 rc = gnutls_handshake(state->session);
1698 } while ((rc == GNUTLS_E_AGAIN) ||
1699 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1702 if (rc != GNUTLS_E_SUCCESS)
1704 tls_error(US"gnutls_handshake",
1705 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
1706 /* It seems that, except in the case of a timeout, we have to close the
1707 connection right here; otherwise if the other end is running OpenSSL it hangs
1708 until the server times out. */
1712 (void)fclose(smtp_out);
1713 (void)fclose(smtp_in);
1719 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1721 /* Verify after the fact */
1723 if ( state->verify_requirement != VERIFY_NONE
1724 && !verify_certificate(state, &error))
1726 if (state->verify_requirement != VERIFY_OPTIONAL)
1728 tls_error(US"certificate verification failed", error, NULL);
1732 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1736 /* Figure out peer DN, and if authenticated, etc. */
1738 rc = peer_status(state);
1739 if (rc != OK) return rc;
1741 /* Sets various Exim expansion variables; always safe within server */
1743 extract_exim_vars_from_tls_state(state);
1745 /* TLS has been set up. Adjust the input functions to read via TLS,
1746 and initialize appropriately. */
1748 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1750 receive_getc = tls_getc;
1751 receive_ungetc = tls_ungetc;
1752 receive_feof = tls_feof;
1753 receive_ferror = tls_ferror;
1754 receive_smtp_buffered = tls_smtp_buffered;
1762 /*************************************************
1763 * Start a TLS session in a client *
1764 *************************************************/
1766 /* Called from the smtp transport after STARTTLS has been accepted.
1769 fd the fd of the connection
1770 host connected host (for messages)
1771 addr the first address (not used)
1772 tb transport (always smtp)
1774 Returns: OK/DEFER/FAIL (because using common functions),
1775 but for a client, DEFER and FAIL have the same meaning
1779 tls_client_start(int fd, host_item *host,
1780 address_item *addr ARG_UNUSED,
1781 transport_instance *tb
1782 #ifdef EXPERIMENTAL_DANE
1783 , dne_answer * unused_tlsa_dnsa
1787 smtp_transport_options_block *ob =
1788 (smtp_transport_options_block *)tb->options_block;
1791 exim_gnutls_state_st *state = NULL;
1792 #ifndef DISABLE_OCSP
1793 BOOL require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1794 NULL, host->name, host->address, NULL) == OK;
1795 BOOL request_ocsp = require_ocsp ? TRUE
1796 : verify_check_this_host(&ob->hosts_request_ocsp,
1797 NULL, host->name, host->address, NULL) == OK;
1800 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
1802 if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
1803 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
1804 ob->tls_require_ciphers, &state)) != OK)
1808 int dh_min_bits = ob->tls_dh_min_bits;
1809 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1812 debug_printf("WARNING: tls_dh_min_bits far too low,"
1813 " clamping %d up to %d\n",
1814 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1815 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1818 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
1819 " acceptable bits to %d\n",
1821 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1824 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
1825 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
1826 the specified host patterns if one of them is defined */
1828 if (( state->exp_tls_verify_certificates
1829 && !ob->tls_verify_hosts
1830 && !ob->tls_try_verify_hosts
1833 verify_check_host(&ob->tls_verify_hosts) == OK
1836 #ifdef EXPERIMENTAL_CERTNAMES
1837 if (ob->tls_verify_cert_hostnames)
1840 debug_printf("TLS: server cert incl. hostname verification required.\n");
1841 state->verify_requirement = VERIFY_WITHHOST;
1842 if (!expand_check(ob->tls_verify_cert_hostnames,
1843 US"tls_verify_cert_hostnames",
1844 &state->exp_tls_verify_cert_hostnames))
1846 if (state->exp_tls_verify_cert_hostnames)
1847 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1848 state->exp_tls_verify_cert_hostnames);
1854 debug_printf("TLS: server certificate verification required.\n");
1855 state->verify_requirement = VERIFY_REQUIRED;
1857 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1859 else if (verify_check_host(&ob->tls_try_verify_hosts) == OK)
1862 debug_printf("TLS: server certificate verification optional.\n");
1863 state->verify_requirement = VERIFY_OPTIONAL;
1864 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1869 debug_printf("TLS: server certificate verification not required.\n");
1870 state->verify_requirement = VERIFY_NONE;
1871 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1874 #ifndef DISABLE_OCSP
1875 /* supported since GnuTLS 3.1.3 */
1878 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
1879 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
1880 NULL, 0, NULL)) != OK)
1881 return tls_error(US"cert-status-req",
1882 gnutls_strerror(rc), state->host);
1883 tls_out.ocsp = OCSP_NOT_RESP;
1887 #ifdef EXPERIMENTAL_TPDA
1888 if (tb->tpda_event_action)
1890 state->event_action = tb->tpda_event_action;
1891 gnutls_session_set_ptr(state->session, state);
1892 gnutls_certificate_set_verify_function(state->x509_cred, client_verify_cb);
1896 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)(long) fd);
1900 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
1901 /* There doesn't seem to be a built-in timeout on connection. */
1903 sigalrm_seen = FALSE;
1904 alarm(ob->command_timeout);
1907 rc = gnutls_handshake(state->session);
1908 } while ((rc == GNUTLS_E_AGAIN) ||
1909 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1912 if (rc != GNUTLS_E_SUCCESS)
1913 return tls_error(US"gnutls_handshake",
1914 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1916 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1920 if (state->verify_requirement != VERIFY_NONE &&
1921 !verify_certificate(state, &error))
1922 return tls_error(US"certificate verification failed", error, state->host);
1924 #ifndef DISABLE_OCSP
1929 gnutls_datum_t stapling;
1930 gnutls_ocsp_resp_t resp;
1931 gnutls_datum_t printed;
1932 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
1933 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
1934 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
1935 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
1938 debug_printf("%.4096s", printed.data);
1939 gnutls_free(printed.data);
1942 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host);
1945 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
1947 tls_out.ocsp = OCSP_FAILED;
1948 return tls_error(US"certificate status check failed", NULL, state->host);
1950 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
1951 tls_out.ocsp = OCSP_VFIED;
1955 /* Figure out peer DN, and if authenticated, etc. */
1957 if ((rc = peer_status(state)) != OK)
1960 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
1962 extract_exim_vars_from_tls_state(state);
1970 /*************************************************
1971 * Close down a TLS session *
1972 *************************************************/
1974 /* This is also called from within a delivery subprocess forked from the
1975 daemon, to shut down the TLS library, without actually doing a shutdown (which
1976 would tamper with the TLS session in the parent process).
1978 Arguments: TRUE if gnutls_bye is to be called
1983 tls_close(BOOL is_server, BOOL shutdown)
1985 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
1987 if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
1991 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1992 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1995 gnutls_deinit(state->session);
1997 state->tlsp->active = -1;
1998 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2000 if ((state_server.session == NULL) && (state_client.session == NULL))
2002 gnutls_global_deinit();
2003 exim_gnutls_base_init_done = FALSE;
2011 /*************************************************
2012 * TLS version of getc *
2013 *************************************************/
2015 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2016 it refills the buffer via the GnuTLS reading function.
2017 Only used by the server-side TLS.
2019 This feeds DKIM and should be used for all message-body reads.
2022 Returns: the next character or EOF
2028 exim_gnutls_state_st *state = &state_server;
2029 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2033 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2034 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2036 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2037 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2038 ssl_xfer_buffer_size);
2041 /* A zero-byte return appears to mean that the TLS session has been
2042 closed down, not that the socket itself has been closed down. Revert to
2043 non-TLS handling. */
2047 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2049 receive_getc = smtp_getc;
2050 receive_ungetc = smtp_ungetc;
2051 receive_feof = smtp_feof;
2052 receive_ferror = smtp_ferror;
2053 receive_smtp_buffered = smtp_buffered;
2055 gnutls_deinit(state->session);
2056 state->session = NULL;
2057 state->tlsp->active = -1;
2058 state->tlsp->bits = 0;
2059 state->tlsp->certificate_verified = FALSE;
2060 tls_channelbinding_b64 = NULL;
2061 state->tlsp->cipher = NULL;
2062 state->tlsp->peercert = NULL;
2063 state->tlsp->peerdn = NULL;
2068 /* Handle genuine errors */
2070 else if (inbytes < 0)
2072 record_io_error(state, (int) inbytes, US"recv", NULL);
2073 state->xfer_error = 1;
2076 #ifndef DISABLE_DKIM
2077 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2079 state->xfer_buffer_hwm = (int) inbytes;
2080 state->xfer_buffer_lwm = 0;
2083 /* Something in the buffer; return next uschar */
2085 return state->xfer_buffer[state->xfer_buffer_lwm++];
2091 /*************************************************
2092 * Read bytes from TLS channel *
2093 *************************************************/
2095 /* This does not feed DKIM, so if the caller uses this for reading message body,
2096 then the caller must feed DKIM.
2102 Returns: the number of bytes read
2103 -1 after a failed read
2107 tls_read(BOOL is_server, uschar *buff, size_t len)
2109 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2115 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2117 debug_printf("*** PROBABLY A BUG *** " \
2118 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2119 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2122 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2123 state->session, buff, len);
2125 inbytes = gnutls_record_recv(state->session, buff, len);
2126 if (inbytes > 0) return inbytes;
2129 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2131 else record_io_error(state, (int)inbytes, US"recv", NULL);
2139 /*************************************************
2140 * Write bytes down TLS channel *
2141 *************************************************/
2145 is_server channel specifier
2149 Returns: the number of bytes after a successful write,
2150 -1 after a failed write
2154 tls_write(BOOL is_server, const uschar *buff, size_t len)
2158 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2160 DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
2163 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2165 outbytes = gnutls_record_send(state->session, buff, left);
2167 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
2170 record_io_error(state, outbytes, US"send", NULL);
2175 record_io_error(state, 0, US"send", US"TLS channel closed on write");
2186 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2197 /*************************************************
2198 * Random number generation *
2199 *************************************************/
2201 /* Pseudo-random number generation. The result is not expected to be
2202 cryptographically strong but not so weak that someone will shoot themselves
2203 in the foot using it as a nonce in input in some email header scheme or
2204 whatever weirdness they'll twist this into. The result should handle fork()
2205 and avoid repeating sequences. OpenSSL handles that for us.
2209 Returns a random number in range [0, max-1]
2212 #ifdef HAVE_GNUTLS_RND
2214 vaguely_random_number(int max)
2219 uschar smallbuf[sizeof(r)];
2224 needed_len = sizeof(r);
2225 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2226 * asked for a number less than 10. */
2227 for (r = max, i = 0; r; ++i)
2233 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2236 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2237 return vaguely_random_number_fallback(max);
2240 for (p = smallbuf; needed_len; --needed_len, ++p)
2246 /* We don't particularly care about weighted results; if someone wants
2247 * smooth distribution and cares enough then they should submit a patch then. */
2250 #else /* HAVE_GNUTLS_RND */
2252 vaguely_random_number(int max)
2254 return vaguely_random_number_fallback(max);
2256 #endif /* HAVE_GNUTLS_RND */
2261 /*************************************************
2262 * Let tls_require_ciphers be checked at startup *
2263 *************************************************/
2265 /* The tls_require_ciphers option, if set, must be something which the
2268 Returns: NULL on success, or error message
2272 tls_validate_require_cipher(void)
2275 uschar *expciphers = NULL;
2276 gnutls_priority_t priority_cache;
2279 #define validate_check_rc(Label) do { \
2280 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2281 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2282 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2284 if (exim_gnutls_base_init_done)
2285 log_write(0, LOG_MAIN|LOG_PANIC,
2286 "already initialised GnuTLS, Exim developer bug");
2288 #ifdef HAVE_GNUTLS_PKCS11
2289 if (!gnutls_allow_auto_pkcs11)
2291 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2292 validate_check_rc(US"gnutls_pkcs11_init");
2295 rc = gnutls_global_init();
2296 validate_check_rc(US"gnutls_global_init()");
2297 exim_gnutls_base_init_done = TRUE;
2299 if (!(tls_require_ciphers && *tls_require_ciphers))
2300 return_deinit(NULL);
2302 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2303 return_deinit(US"failed to expand tls_require_ciphers");
2305 if (!(expciphers && *expciphers))
2306 return_deinit(NULL);
2309 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2311 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2312 validate_check_rc(string_sprintf(
2313 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2314 expciphers, errpos - CS expciphers, errpos));
2316 #undef return_deinit
2317 #undef validate_check_rc
2318 gnutls_global_deinit();
2326 /*************************************************
2327 * Report the library versions. *
2328 *************************************************/
2330 /* See a description in tls-openssl.c for an explanation of why this exists.
2332 Arguments: a FILE* to print the results to
2337 tls_version_report(FILE *f)
2339 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2342 gnutls_check_version(NULL));
2347 /* End of tls-gnu.c */