1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
43 /* needed to disable PKCS11 autoload unless requested */
44 #if GNUTLS_VERSION_NUMBER >= 0x020c00
45 # include <gnutls/pkcs11.h>
46 # define SUPPORT_PARAM_TO_PK_BITS
48 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
52 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
53 # warning "GnuTLS library version too old; tls:cert event unsupported"
54 # define DISABLE_EVENT
56 #if GNUTLS_VERSION_NUMBER >= 0x030306
57 # define SUPPORT_CA_DIR
59 # undef SUPPORT_CA_DIR
61 #if GNUTLS_VERSION_NUMBER >= 0x030014
62 # define SUPPORT_SYSDEFAULT_CABUNDLE
64 #if GNUTLS_VERSION_NUMBER >= 0x030104
65 # define GNUTLS_CERT_VFY_STATUS_PRINT
67 #if GNUTLS_VERSION_NUMBER >= 0x030109
70 #if GNUTLS_VERSION_NUMBER >= 0x03010a
71 # define SUPPORT_GNUTLS_SESS_DESC
73 #if GNUTLS_VERSION_NUMBER >= 0x030300
74 # define GNUTLS_AUTO_GLOBAL_INIT
75 # define GNUTLS_AUTO_PKCS11_MANUAL
77 #if (GNUTLS_VERSION_NUMBER >= 0x030404) \
78 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
80 # define EXIM_HAVE_OCSP
83 #if GNUTLS_VERSION_NUMBER >= 0x030500
84 # define SUPPORT_GNUTLS_KEYLOG
86 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
87 # define SUPPORT_SRV_OCSP_STACK
89 #if GNUTLS_VERSION_NUMBER >= 0x030600
90 # define GNUTLS_AUTO_DHPARAMS
92 #if GNUTLS_VERSION_NUMBER >= 0x030603
93 # define EXIM_HAVE_TLS1_3
94 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
95 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
99 # if GNUTLS_VERSION_NUMBER >= 0x030000
100 # define DANESSL_USAGE_DANE_TA 2
101 # define DANESSL_USAGE_DANE_EE 3
103 # error GnuTLS version too early for DANE
105 # if GNUTLS_VERSION_NUMBER < 0x999999
106 # define GNUTLS_BROKEN_DANE_VALIDATION
110 #ifdef EXPERIMENTAL_TLS_RESUME
111 # if GNUTLS_VERSION_NUMBER < 0x030603
112 # error GNUTLS version too early for session-resumption
117 # include <gnutls/ocsp.h>
120 # include <gnutls/dane.h>
123 #include "tls-cipher-stdname.c"
130 # ifdef EXPERIMENTAL_TLS_RESUME
131 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
133 # ifdef EXIM_HAVE_TLS1_3
134 builtin_macro_create(US"_HAVE_TLS1_3");
136 # ifdef EXIM_HAVE_OCSP
137 builtin_macro_create(US"_HAVE_TLS_OCSP");
139 # ifdef SUPPORT_SRV_OCSP_STACK
140 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
149 gnutls_global_set_audit_log_function()
152 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
155 /* Local static variables for GnuTLS */
157 /* Values for verify_requirement */
159 enum peer_verify_requirement
160 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
162 /* This holds most state for server or client; with this, we can set up an
163 outbound TLS-enabled connection in an ACL callout, while not stomping all
164 over the TLS variables available for expansion.
166 Some of these correspond to variables in globals.c; those variables will
167 be set to point to content in one of these instances, as appropriate for
168 the stage of the process lifetime.
170 Not handled here: global tls_channelbinding_b64.
173 typedef struct exim_gnutls_state {
174 gnutls_session_t session;
175 gnutls_certificate_credentials_t x509_cred;
176 gnutls_priority_t priority_cache;
177 enum peer_verify_requirement verify_requirement;
180 BOOL peer_cert_verified;
181 BOOL peer_dane_verified;
182 BOOL trigger_sni_changes;
183 BOOL have_set_peerdn;
184 const struct host_item *host; /* NULL if server */
185 gnutls_x509_crt_t peercert;
188 uschar *received_sni;
190 const uschar *tls_certificate;
191 const uschar *tls_privatekey;
192 const uschar *tls_sni; /* client send only, not received */
193 const uschar *tls_verify_certificates;
194 const uschar *tls_crl;
195 const uschar *tls_require_ciphers;
197 uschar *exp_tls_certificate;
198 uschar *exp_tls_privatekey;
199 uschar *exp_tls_verify_certificates;
201 uschar *exp_tls_require_ciphers;
202 const uschar *exp_tls_verify_cert_hostnames;
203 #ifndef DISABLE_EVENT
204 uschar *event_action;
207 char * const * dane_data;
208 const int * dane_data_len;
211 tls_support *tlsp; /* set in tls_init() */
216 BOOL xfer_eof; /*XXX never gets set! */
218 } exim_gnutls_state_st;
220 static const exim_gnutls_state_st exim_gnutls_state_init = {
221 /* all elements not explicitly intialised here get 0/NULL/FALSE */
226 /* Not only do we have our own APIs which don't pass around state, assuming
227 it's held in globals, GnuTLS doesn't appear to let us register callback data
228 for callbacks, or as part of the session, so we have to keep a "this is the
229 context we're currently dealing with" pointer and rely upon being
230 single-threaded to keep from processing data on an inbound TLS connection while
231 talking to another TLS connection for an outbound check. This does mean that
232 there's no way for heart-beats to be responded to, for the duration of the
234 XXX But see gnutls_session_get_ptr()
237 static exim_gnutls_state_st state_server;
239 #ifndef GNUTLS_AUTO_DHPARAMS
240 /* dh_params are initialised once within the lifetime of a process using TLS;
241 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
242 don't want to repeat this. */
244 static gnutls_dh_params_t dh_server_params = NULL;
247 static int ssl_session_timeout = 7200; /* Two hours */
249 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
251 /* Guard library core initialisation */
253 static BOOL exim_gnutls_base_init_done = FALSE;
256 static BOOL gnutls_buggy_ocsp = FALSE;
257 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
260 #ifdef EXPERIMENTAL_TLS_RESUME
261 static gnutls_datum_t server_sessticket_key;
264 /* ------------------------------------------------------------------------ */
267 #define MAX_HOST_LEN 255
269 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
270 the library logging; a value less than 0 disables the calls to set up logging
271 callbacks. GNuTLS also looks for an environment variable - except not for
272 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
273 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
274 but the env var must be added to /etc/sudoers too. */
275 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
276 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
279 #ifndef EXIM_CLIENT_DH_MIN_BITS
280 # define EXIM_CLIENT_DH_MIN_BITS 1024
283 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
284 can ask for a bit-strength. Without that, we stick to the constant we had
286 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
287 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
290 #define expand_check_tlsvar(Varname, errstr) \
291 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
293 #if GNUTLS_VERSION_NUMBER >= 0x020c00
294 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
295 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
296 # define HAVE_GNUTLS_RND
297 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
298 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
299 * isn't available sometimes, so this needs to become a conditional
300 * compilation; the sanest way to deal with this being a problem on
301 * older OSes is to block it in the Local/Makefile with this compiler
303 # ifndef AVOID_GNUTLS_PKCS11
304 # define HAVE_GNUTLS_PKCS11
305 # endif /* AVOID_GNUTLS_PKCS11 */
311 /* ------------------------------------------------------------------------ */
312 /* Callback declarations */
314 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
315 static void exim_gnutls_logger_cb(int level, const char *message);
318 static int exim_sni_handling_cb(gnutls_session_t session);
320 #ifdef EXPERIMENTAL_TLS_RESUME
322 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
323 unsigned incoming, const gnutls_datum_t * msg);
327 /* Daemon one-time initialisation */
329 tls_daemon_init(void)
331 #ifdef EXPERIMENTAL_TLS_RESUME
332 /* We are dependent on the GnuTLS implementation of the Session Ticket
333 encryption; both the strength and the key rotation period. We hope that
334 the strength at least matches that of the ciphersuite (but GnuTLS does not
337 static BOOL once = FALSE;
340 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
341 if (f.running_in_test_harness) ssl_session_timeout = 6;
345 /* ------------------------------------------------------------------------ */
346 /* Static functions */
348 /*************************************************
350 *************************************************/
352 /* Called from lots of places when errors occur before actually starting to do
353 the TLS handshake, that is, while the session is still in clear. Always returns
354 DEFER for a server and FAIL for a client so that most calls can use "return
355 tls_error(...)" to do this processing and then give an appropriate return. A
356 single function is used for both server and client, because it is called from
357 some shared functions.
360 prefix text to include in the logged error
361 msg additional error string (may be NULL)
362 usually obtained from gnutls_strerror()
363 host NULL if setting up a server;
364 the connected host if setting up a client
365 errstr pointer to returned error string
367 Returns: OK/DEFER/FAIL
371 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
375 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
376 return host ? FAIL : DEFER;
381 tls_error_gnu(const uschar *prefix, int err, const host_item *host,
384 return tls_error(prefix, US gnutls_strerror(err), host, errstr);
388 tls_error_sys(const uschar *prefix, int err, const host_item *host,
391 return tls_error(prefix, US strerror(err), host, errstr);
395 /*************************************************
396 * Deal with logging errors during I/O *
397 *************************************************/
399 /* We have to get the identity of the peer from saved data.
402 state the current GnuTLS exim state container
403 rc the GnuTLS error code, or 0 if it's a local error
404 when text identifying read or write
405 text local error text when rc is 0
411 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
416 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
417 msg = string_sprintf("A TLS fatal alert has been received: %s",
418 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
420 msg = US gnutls_strerror(rc);
422 (void) tls_error(when, msg, state->host, &errstr);
425 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
426 state->host->name, state->host->address, errstr);
429 uschar * conn_info = smtp_get_connection_info();
430 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
431 /* I'd like to get separated H= here, but too hard for now */
432 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
439 /*************************************************
440 * Set various Exim expansion vars *
441 *************************************************/
443 #define exim_gnutls_cert_err(Label) \
446 if (rc != GNUTLS_E_SUCCESS) \
448 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
449 (Label), gnutls_strerror(rc)); \
455 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
459 rc = gnutls_x509_crt_init(crtp);
460 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
462 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
463 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
468 #undef exim_gnutls_cert_err
471 /* We set various Exim global variables from the state, once a session has
472 been established. With TLS callouts, may need to change this to stack
473 variables, or just re-call it with the server state after client callout
476 Make sure anything set here is unset in tls_getc().
480 tls_bits strength indicator
481 tls_certificate_verified bool indicator
482 tls_channelbinding_b64 for some SASL mechanisms
485 tls_peercert pointer to library internal
487 tls_sni a (UTF-8) string
488 tls_ourcert pointer to library internal
491 state the relevant exim_gnutls_state_st *
495 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
497 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
500 gnutls_datum_t channel;
502 tls_support * tlsp = state->tlsp;
504 tlsp->active.sock = state->fd_out;
505 tlsp->active.tls_ctx = state;
507 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
509 tlsp->certificate_verified = state->peer_cert_verified;
511 tlsp->dane_verified = state->peer_dane_verified;
514 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
515 only available for use for authenticators while this TLS session is running. */
517 tls_channelbinding_b64 = NULL;
518 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
521 if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
522 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
525 old_pool = store_pool;
526 store_pool = POOL_PERM;
527 tls_channelbinding_b64 = b64encode(CUS channel.data, (int)channel.size);
528 store_pool = old_pool;
529 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
533 /* peercert is set in peer_status() */
534 tlsp->peerdn = state->peerdn;
535 tlsp->sni = state->received_sni;
537 /* record our certificate */
539 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
540 gnutls_x509_crt_t crt;
542 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
549 #ifndef GNUTLS_AUTO_DHPARAMS
550 /*************************************************
551 * Setup up DH parameters *
552 *************************************************/
554 /* Generating the D-H parameters may take a long time. They only need to
555 be re-generated every so often, depending on security policy. What we do is to
556 keep these parameters in a file in the spool directory. If the file does not
557 exist, we generate them. This means that it is easy to cause a regeneration.
559 The new file is written as a temporary file and renamed, so that an incomplete
560 file is never present. If two processes both compute some new parameters, you
561 waste a bit of effort, but it doesn't seem worth messing around with locking to
564 Returns: OK/DEFER/FAIL
568 init_server_dh(uschar ** errstr)
571 unsigned int dh_bits;
572 gnutls_datum_t m = {.data = NULL, .size = 0};
573 uschar filename_buf[PATH_MAX];
574 uschar *filename = NULL;
576 uschar *exp_tls_dhparam;
577 BOOL use_file_in_spool = FALSE;
578 host_item *host = NULL; /* dummy for macros */
580 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
582 if ((rc = gnutls_dh_params_init(&dh_server_params)))
583 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
585 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
588 if (!exp_tls_dhparam)
590 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
591 m.data = US std_dh_prime_default();
592 m.size = Ustrlen(m.data);
594 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
595 use_file_in_spool = TRUE;
596 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
598 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
601 else if (exp_tls_dhparam[0] != '/')
603 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
604 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
605 m.size = Ustrlen(m.data);
608 filename = exp_tls_dhparam;
612 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
613 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
614 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
618 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
619 /* If you change this constant, also change dh_param_fn_ext so that we can use a
620 different filename and ensure we have sufficient bits. */
622 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
623 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
625 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
628 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
630 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
634 /* Some clients have hard-coded limits. */
635 if (dh_bits > tls_dh_max_bits)
638 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
640 dh_bits = tls_dh_max_bits;
643 if (use_file_in_spool)
645 if (!string_format(filename_buf, sizeof(filename_buf),
646 "%s/gnutls-params-%d", spool_directory, dh_bits))
647 return tls_error(US"overlong filename", NULL, NULL, errstr);
648 filename = filename_buf;
651 /* Open the cache file for reading and if successful, read it and set up the
654 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
660 if (fstat(fd, &statbuf) < 0) /* EIO */
664 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
666 if (!S_ISREG(statbuf.st_mode))
669 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
671 if (!(fp = fdopen(fd, "rb")))
675 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
676 saved_errno, NULL, errstr);
679 m.size = statbuf.st_size;
680 if (!(m.data = store_malloc(m.size)))
683 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
685 if (!(sz = fread(m.data, m.size, 1, fp)))
690 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
694 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
697 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
698 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
701 /* If the file does not exist, fall through to compute new data and cache it.
702 If there was any other opening error, it is serious. */
704 else if (errno == ENOENT)
708 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
711 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
714 /* If ret < 0, either the cache file does not exist, or the data it contains
715 is not useful. One particular case of this is when upgrading from an older
716 release of Exim in which the data was stored in a different format. We don't
717 try to be clever and support both formats; we just regenerate new data in this
723 unsigned int dh_bits_gen = dh_bits;
725 if ((PATH_MAX - Ustrlen(filename)) < 10)
726 return tls_error(US"Filename too long to generate replacement",
727 filename, NULL, errstr);
729 temp_fn = string_copy(US"%s.XXXXXXX");
730 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
731 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
732 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
734 /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But
735 there's no way to ask GnuTLS how many bits there really are. We can ask
736 how many bits were used in a TLS session, but that's it! The prime itself
737 is hidden behind too much abstraction. So we ask for less, and proceed on
738 a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */
740 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
742 dh_bits_gen = dh_bits - 10;
744 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
749 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
751 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
752 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
754 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
755 and I confirmed that a NULL call to get the size first is how the GnuTLS
756 sample apps handle this. */
760 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
761 GNUTLS_X509_FMT_PEM, m.data, &sz))
762 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
763 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
766 if (!(m.data = store_malloc(m.size)))
767 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
769 /* this will return a size 1 less than the allocation size above */
770 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
774 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
776 m.size = sz; /* shrink by 1, probably */
778 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
781 return tls_error_sys(US"TLS cache write D-H params failed",
782 errno, NULL, errstr);
785 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
786 return tls_error_sys(US"TLS cache write D-H params final newline failed",
787 errno, NULL, errstr);
789 if ((rc = close(fd)))
790 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
792 if (Urename(temp_fn, filename) < 0)
793 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
794 temp_fn, filename), errno, NULL, errstr);
796 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
799 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
807 /* Create and install a selfsigned certificate, for use in server mode */
810 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
812 gnutls_x509_crt_t cert = NULL;
814 gnutls_x509_privkey_t pkey = NULL;
815 const uschar * where;
818 where = US"initialising pkey";
819 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
821 where = US"initialising cert";
822 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
824 where = US"generating pkey";
825 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
826 #ifdef SUPPORT_PARAM_TO_PK_BITS
827 # ifndef GNUTLS_SEC_PARAM_MEDIUM
828 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
830 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
837 where = US"configuring cert";
839 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
840 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
841 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
842 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
843 || (rc = gnutls_x509_crt_set_key(cert, pkey))
845 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
846 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
847 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
848 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
849 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
850 GNUTLS_OID_X520_COMMON_NAME, 0,
851 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
855 where = US"signing cert";
856 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
858 where = US"installing selfsign cert";
860 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
866 if (cert) gnutls_x509_crt_deinit(cert);
867 if (pkey) gnutls_x509_privkey_deinit(pkey);
871 rc = tls_error_gnu(where, rc, NULL, errstr);
878 /* Add certificate and key, from files.
881 Zero or negative: good. Negate value for certificate index if < 0.
882 Greater than zero: FAIL or DEFER code.
886 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
887 uschar * certfile, uschar * keyfile, uschar ** errstr)
889 int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
890 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
892 return tls_error_gnu(
893 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
899 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
900 /* Load an OCSP proof from file for sending by the server. Called
901 on getting a status-request handshake message, for earlier versions
905 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
906 gnutls_datum_t * ocsp_response)
909 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
911 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
913 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
915 tls_in.ocsp = OCSP_NOT_RESP;
916 return GNUTLS_E_NO_CERTIFICATE_STATUS;
919 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
925 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
926 /* Make a note that we saw a status-request */
928 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
929 const unsigned char *data, unsigned size)
931 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
932 if (tls_id == 5) /* status_request */
934 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
935 tls_in.ocsp = OCSP_NOT_RESP;
940 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
942 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
943 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
945 /* Call fn for each extension seen. 3.6.3 onwards */
946 return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
947 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
951 /* Make a note that we saw a status-response */
953 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
954 const unsigned char *data, unsigned size)
956 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
957 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
958 if (FALSE && tls_id == 5) /* status_request */
960 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
961 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
962 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
967 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
969 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
970 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
972 /* Call fn for each extension seen. 3.6.3 onwards */
975 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
980 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
981 "Handshake Protocol: Certificate" record.
982 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
984 This is different to tls1.2 - where it is a separate record (wireshake term) / handshake message (gnutls term).
987 #if defined(EXPERIMENTAL_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
988 /* Callback for certificate-status, on server. We sent stapled OCSP. */
990 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
991 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
993 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
994 #ifdef SUPPORT_SRV_OCSP_STACK
995 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
996 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
998 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1003 /* Callback for handshake messages, on server */
1005 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1006 unsigned incoming, const gnutls_datum_t * msg)
1008 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
1011 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1012 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1013 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1014 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1015 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1017 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1018 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1019 # ifdef EXPERIMENTAL_TLS_RESUME
1020 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1021 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1030 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1032 tls_server_testharness_ocsp_fiddle(void)
1034 extern char ** environ;
1035 if (environ) for (uschar ** p = USS environ; *p; p++)
1036 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1038 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1039 exim_testharness_disable_ocsp_validity_check = TRUE;
1044 /*************************************************
1045 * Variables re-expanded post-SNI *
1046 *************************************************/
1048 /* Called from both server and client code, via tls_init(), and also from
1049 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1051 We can tell the two apart by state->received_sni being non-NULL in callback.
1053 The callback should not call us unless state->trigger_sni_changes is true,
1054 which we are responsible for setting on the first pass through.
1057 state exim_gnutls_state_st *
1058 errstr error string pointer
1060 Returns: OK/DEFER/FAIL
1064 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1066 struct stat statbuf;
1068 const host_item *host = state->host; /* macro should be reconsidered? */
1069 uschar *saved_tls_certificate = NULL;
1070 uschar *saved_tls_privatekey = NULL;
1071 uschar *saved_tls_verify_certificates = NULL;
1072 uschar *saved_tls_crl = NULL;
1075 /* We check for tls_sni *before* expansion. */
1076 if (!host) /* server */
1077 if (!state->received_sni)
1079 if ( state->tls_certificate
1080 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1081 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1082 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1085 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
1086 state->trigger_sni_changes = TRUE;
1091 /* useful for debugging */
1092 saved_tls_certificate = state->exp_tls_certificate;
1093 saved_tls_privatekey = state->exp_tls_privatekey;
1094 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1095 saved_tls_crl = state->exp_tls_crl;
1098 if ((rc = gnutls_certificate_allocate_credentials(&state->x509_cred)))
1099 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
1102 #ifdef SUPPORT_SRV_OCSP_STACK
1103 gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
1105 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1106 if (!host && tls_ocsp_file)
1108 if (f.running_in_test_harness)
1109 tls_server_testharness_ocsp_fiddle();
1111 if (exim_testharness_disable_ocsp_validity_check)
1112 gnutls_certificate_set_flags(state->x509_cred,
1113 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1118 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
1119 state members, assuming consistent naming; and expand_check() returns
1120 false if expansion failed, unless expansion was forced to fail. */
1122 /* check if we at least have a certificate, before doing expensive
1125 if (!expand_check_tlsvar(tls_certificate, errstr))
1128 /* certificate is mandatory in server, optional in client */
1130 if ( !state->exp_tls_certificate
1131 || !*state->exp_tls_certificate
1134 return tls_install_selfsign(state, errstr);
1136 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1138 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
1141 /* tls_privatekey is optional, defaulting to same file as certificate */
1143 if (!state->tls_privatekey || !*state->tls_privatekey)
1145 state->tls_privatekey = state->tls_certificate;
1146 state->exp_tls_privatekey = state->exp_tls_certificate;
1150 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1152 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1153 state->exp_tls_certificate, state->exp_tls_privatekey);
1155 if (state->received_sni)
1156 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1157 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1160 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1164 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
1167 if (!host) /* server */
1169 const uschar * clist = state->exp_tls_certificate;
1170 const uschar * klist = state->exp_tls_privatekey;
1171 const uschar * olist;
1172 int csep = 0, ksep = 0, osep = 0, cnt = 0;
1173 uschar * cfile, * kfile, * ofile;
1174 #ifndef DISABLE_OCSP
1175 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1176 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1179 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
1184 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1186 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1187 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
1188 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
1192 int gnutls_cert_index = -rc;
1193 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1194 gnutls_cert_index, cfile);
1196 #ifndef DISABLE_OCSP
1199 /* Set the OCSP stapling server info */
1200 if (gnutls_buggy_ocsp)
1203 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1205 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1207 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1208 gnutls_cert_index, ofile);
1209 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1210 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1212 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1215 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1217 ocsp_fmt = GNUTLS_X509_FMT_DER;
1221 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1222 state->x509_cred, CCS ofile, gnutls_cert_index,
1224 return tls_error_gnu(
1225 US"gnutls_certificate_set_ocsp_status_request_file2",
1228 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1230 /* Arrange callbacks for OCSP request observability */
1232 gnutls_handshake_set_hook_function(state->session,
1233 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1236 # if defined(SUPPORT_SRV_OCSP_STACK)
1237 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1238 state->x509_cred, gnutls_cert_index,
1239 server_ocsp_stapling_cb, ofile)))
1240 return tls_error_gnu(
1241 US"gnutls_certificate_set_ocsp_status_request_function2",
1249 debug_printf("oops; multiple OCSP files not supported\n");
1252 gnutls_certificate_set_ocsp_status_request_function(
1253 state->x509_cred, server_ocsp_stapling_cb, ofile);
1255 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1258 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1260 #endif /* DISABLE_OCSP */
1265 if (0 < (rc = tls_add_certfile(state, host,
1266 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1268 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1271 } /* tls_certificate */
1274 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1275 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1276 error message is provided. However, if we just refrain from setting anything up
1277 in that case, certificate verification fails, which seems to be the correct
1280 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1282 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
1284 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1285 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1286 state->exp_tls_verify_certificates = NULL;
1288 if (state->tls_crl && *state->tls_crl)
1289 if (!expand_check_tlsvar(tls_crl, errstr))
1292 if (!(state->exp_tls_verify_certificates &&
1293 *state->exp_tls_verify_certificates))
1296 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1297 /* With no tls_verify_certificates, we ignore tls_crl too */
1304 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1308 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1309 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1310 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1314 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1316 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1317 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1322 #ifndef SUPPORT_CA_DIR
1323 /* The test suite passes in /dev/null; we could check for that path explicitly,
1324 but who knows if someone has some weird FIFO which always dumps some certs, or
1325 other weirdness. The thing we really want to check is that it's not a
1326 directory, since while OpenSSL supports that, GnuTLS does not.
1327 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1328 if (S_ISDIR(statbuf.st_mode))
1331 debug_printf("verify certificates path is a dir: \"%s\"\n",
1332 state->exp_tls_verify_certificates);
1333 log_write(0, LOG_MAIN|LOG_PANIC,
1334 "tls_verify_certificates \"%s\" is a directory",
1335 state->exp_tls_verify_certificates);
1340 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1341 state->exp_tls_verify_certificates, statbuf.st_size);
1343 if (statbuf.st_size == 0)
1346 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1352 #ifdef SUPPORT_CA_DIR
1353 (statbuf.st_mode & S_IFMT) == S_IFDIR
1355 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1356 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1359 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1360 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1362 #ifdef SUPPORT_CA_DIR
1363 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1364 when using the directory-of-certs config model. */
1366 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1367 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1372 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1374 debug_printf("Added %d certificate authorities.\n", cert_count);
1376 if (state->tls_crl && *state->tls_crl &&
1377 state->exp_tls_crl && *state->exp_tls_crl)
1379 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1380 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1381 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM)) < 0)
1382 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1383 cert_count, host, errstr);
1385 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1394 /*************************************************
1395 * Set X.509 state variables *
1396 *************************************************/
1398 /* In GnuTLS, the registered cert/key are not replaced by a later
1399 set of a cert/key, so for SNI support we need a whole new x509_cred
1400 structure. Which means various other non-re-expanded pieces of state
1401 need to be re-set in the new struct, so the setting logic is pulled
1405 state exim_gnutls_state_st *
1406 errstr error string pointer
1408 Returns: OK/DEFER/FAIL
1412 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1415 const host_item *host = state->host; /* macro should be reconsidered? */
1417 #ifndef GNUTLS_AUTO_DHPARAMS
1418 /* Create D-H parameters, or read them from the cache file. This function does
1419 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1420 client-side params. */
1424 if (!dh_server_params)
1425 if ((rc = init_server_dh(errstr)) != OK) return rc;
1427 /* Unnecessary & discouraged with 3.6.0 or later */
1428 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1432 /* Link the credentials to the session. */
1434 if ((rc = gnutls_credentials_set(state->session,
1435 GNUTLS_CRD_CERTIFICATE, state->x509_cred)))
1436 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1441 /*************************************************
1442 * Initialize for GnuTLS *
1443 *************************************************/
1446 #ifndef DISABLE_OCSP
1449 tls_is_buggy_ocsp(void)
1452 uschar maj, mid, mic;
1454 s = CUS gnutls_check_version(NULL);
1458 while (*s && *s != '.') s++;
1459 mid = atoi(CCS ++s);
1466 while (*s && *s != '.') s++;
1467 mic = atoi(CCS ++s);
1468 return mic <= (mid == 3 ? 16 : 3);
1477 /* Called from both server and client code. In the case of a server, errors
1478 before actual TLS negotiation return DEFER.
1481 host connected host, if client; NULL if server
1482 certificate certificate file
1483 privatekey private key file
1484 sni TLS SNI to send, sometimes when client; else NULL
1487 require_ciphers tls_require_ciphers setting
1488 caller_state returned state-info structure
1489 errstr error string pointer
1491 Returns: OK/DEFER/FAIL
1496 const host_item *host,
1497 const uschar *certificate,
1498 const uschar *privatekey,
1502 const uschar *require_ciphers,
1503 exim_gnutls_state_st **caller_state,
1507 exim_gnutls_state_st * state;
1510 const char * errpos;
1513 if (!exim_gnutls_base_init_done)
1515 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1517 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
1518 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1519 which loads modules from a config file, which sounds good and may be wanted
1520 by some sysadmin, but also means in common configurations that GNOME keyring
1521 environment variables are used and so breaks for users calling mailq.
1522 To prevent this, we init PKCS11 first, which is the documented approach. */
1523 if (!gnutls_allow_auto_pkcs11)
1524 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
1525 return tls_error_gnu(US"gnutls_pkcs11_init", rc, host, errstr);
1528 #ifndef GNUTLS_AUTO_GLOBAL_INIT
1529 if ((rc = gnutls_global_init()))
1530 return tls_error_gnu(US"gnutls_global_init", rc, host, errstr);
1533 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1536 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1537 /* arbitrarily chosen level; bump up to 9 for more */
1538 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1542 #ifndef DISABLE_OCSP
1543 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1544 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1547 exim_gnutls_base_init_done = TRUE;
1552 /* For client-side sessions we allocate a context. This lets us run
1553 several in parallel. */
1554 int old_pool = store_pool;
1555 store_pool = POOL_PERM;
1556 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
1557 store_pool = old_pool;
1559 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1561 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1562 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1566 state = &state_server;
1567 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1569 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1570 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1573 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
1577 state->tls_certificate = certificate;
1578 state->tls_privatekey = privatekey;
1579 state->tls_require_ciphers = require_ciphers;
1580 state->tls_sni = sni;
1581 state->tls_verify_certificates = cas;
1582 state->tls_crl = crl;
1584 /* This handles the variables that might get re-expanded after TLS SNI;
1585 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1588 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1589 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1591 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1592 requires a new structure afterwards. */
1594 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
1596 /* set SNI in client, only */
1599 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
1601 if (state->tlsp->sni && *state->tlsp->sni)
1604 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1605 sz = Ustrlen(state->tlsp->sni);
1606 if ((rc = gnutls_server_name_set(state->session,
1607 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
1608 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
1611 else if (state->tls_sni)
1612 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1613 "have an SNI set for a server [%s]\n", state->tls_sni);
1615 /* This is the priority string support,
1616 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1617 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1618 This was backwards incompatible, but means Exim no longer needs to track
1619 all algorithms and provide string forms for them. */
1622 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1624 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
1626 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1628 p = state->exp_tls_require_ciphers;
1629 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
1634 p = exim_default_gnutls_priority;
1636 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1639 if ((rc = gnutls_priority_init(&state->priority_cache, CCS p, &errpos)))
1640 return tls_error_gnu(string_sprintf(
1641 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1642 p, errpos - CS p, errpos),
1645 if ((rc = gnutls_priority_set(state->session, state->priority_cache)))
1646 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
1648 /* This also sets the server ticket expiration time to the same, and
1649 the STEK rotation time to 3x. */
1651 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1653 /* Reduce security in favour of increased compatibility, if the admin
1654 decides to make that trade-off. */
1655 if (gnutls_compat_mode)
1657 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1658 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1659 gnutls_session_enable_compatibility_mode(state->session);
1661 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1665 *caller_state = state;
1671 /*************************************************
1672 * Extract peer information *
1673 *************************************************/
1675 static const uschar *
1676 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
1677 gnutls_mac_algorithm_t mac)
1680 gnutls_kx_algorithm_t kx_i;
1681 gnutls_cipher_algorithm_t cipher_i;
1682 gnutls_mac_algorithm_t mac_i;
1685 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
1687 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
1688 return cipher_stdname(cs_id[0], cs_id[1]);
1694 /* Called from both server and client code.
1695 Only this is allowed to set state->peerdn and state->have_set_peerdn
1696 and we use that to detect double-calls.
1698 NOTE: the state blocks last while the TLS connection is up, which is fine
1699 for logging in the server side, but for the client side, we log after teardown
1700 in src/deliver.c. While the session is up, we can twist about states and
1701 repoint tls_* globals, but those variables used for logging or other variable
1702 expansion that happens _after_ delivery need to have a longer life-time.
1704 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1705 doing this more than once per generation of a state context. We set them in
1706 the state context, and repoint tls_* to them. After the state goes away, the
1707 tls_* copies of the pointers remain valid and client delivery logging is happy.
1709 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1713 state exim_gnutls_state_st *
1714 errstr pointer to error string
1716 Returns: OK/DEFER/FAIL
1720 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
1722 gnutls_session_t session = state->session;
1723 const gnutls_datum_t * cert_list;
1725 unsigned int cert_list_size = 0;
1726 gnutls_protocol_t protocol;
1727 gnutls_cipher_algorithm_t cipher;
1728 gnutls_kx_algorithm_t kx;
1729 gnutls_mac_algorithm_t mac;
1730 gnutls_certificate_type_t ct;
1731 gnutls_x509_crt_t crt;
1735 if (state->have_set_peerdn)
1737 state->have_set_peerdn = TRUE;
1739 state->peerdn = NULL;
1742 cipher = gnutls_cipher_get(session);
1743 protocol = gnutls_protocol_get_version(session);
1744 mac = gnutls_mac_get(session);
1746 #ifdef GNUTLS_TLS1_3
1747 protocol >= GNUTLS_TLS1_3 ? 0 :
1749 gnutls_kx_get(session);
1751 old_pool = store_pool;
1753 tls_support * tlsp = state->tlsp;
1754 store_pool = POOL_PERM;
1756 #ifdef SUPPORT_GNUTLS_SESS_DESC
1759 uschar * s = US gnutls_session_get_desc(session), c;
1761 /* Nikos M suggests we use this by preference. It returns like:
1762 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
1764 For partial back-compat, put a colon after the TLS version, replace the
1765 )-( grouping with __, replace in-group - with _ and append the :keysize. */
1767 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
1769 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
1771 tlsp->ver = string_copyn(g->s, g->ptr);
1772 for (uschar * p = US tlsp->ver; *p; p++)
1773 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
1775 g = string_catn(g, US":", 1);
1776 if (*s) s++; /* now on _ between groups */
1779 for (*++s && ++s; (c = *s) && c != ')'; s++)
1780 g = string_catn(g, c == '-' ? US"_" : s, 1);
1781 /* now on ) closing group */
1782 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
1783 /* now on _ between groups */
1785 g = string_catn(g, US":", 1);
1786 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
1787 state->ciphersuite = string_from_gstring(g);
1790 state->ciphersuite = string_sprintf("%s:%s:%d",
1791 gnutls_protocol_get_name(protocol),
1792 gnutls_cipher_suite_get_name(kx, cipher, mac),
1793 (int) gnutls_cipher_get_key_size(cipher) * 8);
1795 /* I don't see a way that spaces could occur, in the current GnuTLS
1796 code base, but it was a concern in the old code and perhaps older GnuTLS
1797 releases did return "TLS 1.0"; play it safe, just in case. */
1799 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
1800 tlsp->ver = string_copyn(state->ciphersuite,
1801 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
1804 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
1806 tlsp->cipher = state->ciphersuite;
1807 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
1809 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
1811 store_pool = old_pool;
1814 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1816 if (!cert_list || cert_list_size == 0)
1818 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1819 cert_list, cert_list_size);
1820 if (state->verify_requirement >= VERIFY_REQUIRED)
1821 return tls_error(US"certificate verification failed",
1822 US"no certificate received from peer", state->host, errstr);
1826 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
1828 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
1830 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1831 if (state->verify_requirement >= VERIFY_REQUIRED)
1832 return tls_error(US"certificate verification not possible, unhandled type",
1833 ctn, state->host, errstr);
1837 #define exim_gnutls_peer_err(Label) \
1839 if (rc != GNUTLS_E_SUCCESS) \
1841 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1842 (Label), gnutls_strerror(rc)); \
1843 if (state->verify_requirement >= VERIFY_REQUIRED) \
1844 return tls_error_gnu((Label), rc, state->host, errstr); \
1849 rc = import_cert(&cert_list[0], &crt);
1850 exim_gnutls_peer_err(US"cert 0");
1852 state->tlsp->peercert = state->peercert = crt;
1855 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1856 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1858 exim_gnutls_peer_err(US"getting size for cert DN failed");
1859 return FAIL; /* should not happen */
1861 dn_buf = store_get_perm(sz, TRUE); /* tainted */
1862 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1863 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1865 state->peerdn = dn_buf;
1868 #undef exim_gnutls_peer_err
1874 /*************************************************
1875 * Verify peer certificate *
1876 *************************************************/
1878 /* Called from both server and client code.
1879 *Should* be using a callback registered with
1880 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1881 the peer information, but that's too new for some OSes.
1884 state exim_gnutls_state_st *
1885 errstr where to put an error message
1888 FALSE if the session should be rejected
1889 TRUE if the cert is okay or we just don't care
1893 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
1898 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
1900 rc = peer_status(state, errstr);
1902 if (state->verify_requirement == VERIFY_NONE)
1905 if (rc != OK || !state->peerdn)
1907 verify = GNUTLS_CERT_INVALID;
1908 *errstr = US"certificate not supplied";
1914 if (state->verify_requirement == VERIFY_DANE && state->host)
1916 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1917 including talking to a DNS resolver. But we want to do that bit ourselves
1918 as the testsuite intercepts and fakes its own DNS environment. */
1923 const gnutls_datum_t * certlist =
1924 gnutls_certificate_get_peers(state->session, &lsize);
1925 int usage = tls_out.tlsa_usage;
1927 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1928 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1929 dane-verification separately so that we know which selector verified;
1930 then we know whether to do name-verification (needed for TA but not EE). */
1932 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
1933 { /* a mixed-usage bundle */
1938 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1941 dd = store_get(nrec * sizeof(uschar *), FALSE);
1942 ddl = store_get(nrec * sizeof(int), FALSE);
1945 if ((rc = dane_state_init(&s, 0)))
1948 for (usage = DANESSL_USAGE_DANE_EE;
1949 usage >= DANESSL_USAGE_DANE_TA; usage--)
1950 { /* take records with this usage */
1951 for (j = i = 0; i < nrec; i++)
1952 if (state->dane_data[i][0] == usage)
1954 dd[j] = state->dane_data[i];
1955 ddl[j++] = state->dane_data_len[i];
1962 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1965 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1966 gnutls_certificate_type_get(state->session),
1968 usage == DANESSL_USAGE_DANE_EE
1969 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1973 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1975 else if (verify == 0) /* verification passed */
1983 if (rc) goto tlsa_prob;
1988 if ( (rc = dane_state_init(&s, 0))
1989 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1991 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1992 gnutls_certificate_type_get(state->session),
1994 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1995 usage == (1 << DANESSL_USAGE_DANE_EE)
1996 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2005 if (verify != 0) /* verification failed */
2008 (void) dane_verification_status_print(verify, &str, 0);
2009 *errstr = US str.data; /* don't bother to free */
2013 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2014 /* If a TA-mode TLSA record was used for verification we must additionally
2015 verify the cert name (but not the CA chain). For EE-mode, skip it. */
2017 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2020 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2023 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2024 /* Assume that the name on the A-record is the one that should be matching
2025 the cert. An alternate view is that the domain part of the email address
2026 is also permissible. */
2028 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2029 CS state->host->name))
2031 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2036 #endif /*SUPPORT_DANE*/
2038 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2041 /* Handle the result of verification. INVALID is set if any others are. */
2043 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2045 state->peer_cert_verified = FALSE;
2048 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2053 if (gnutls_certificate_verification_status_print(verify,
2054 gnutls_certificate_type_get(state->session), &txt, 0)
2055 == GNUTLS_E_SUCCESS)
2057 debug_printf("%s\n", txt.data);
2058 gnutls_free(txt.data);
2062 *errstr = verify & GNUTLS_CERT_REVOKED
2063 ? US"certificate revoked" : US"certificate invalid";
2067 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2068 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2070 if (state->verify_requirement >= VERIFY_REQUIRED)
2073 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2078 /* Client side, check the server's certificate name versus the name on the
2079 A-record for the connection we made. What to do for server side - what name
2080 to use for client? We document that there is no such checking for server
2083 if ( state->exp_tls_verify_cert_hostnames
2084 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2085 CS state->exp_tls_verify_cert_hostnames)
2089 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2090 if (state->verify_requirement >= VERIFY_REQUIRED)
2095 state->peer_cert_verified = TRUE;
2096 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2097 state->peerdn ? state->peerdn : US"<unset>");
2101 state->tlsp->peerdn = state->peerdn;
2106 *errstr = string_sprintf("TLSA record problem: %s",
2107 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2111 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2118 /* ------------------------------------------------------------------------ */
2121 /* Logging function which can be registered with
2122 * gnutls_global_set_log_function()
2123 * gnutls_global_set_log_level() 0..9
2125 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2127 exim_gnutls_logger_cb(int level, const char *message)
2129 size_t len = strlen(message);
2132 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2135 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2136 message[len-1] == '\n' ? "" : "\n");
2141 /* Called after client hello, should handle SNI work.
2142 This will always set tls_sni (state->received_sni) if available,
2143 and may trigger presenting different certificates,
2144 if state->trigger_sni_changes is TRUE.
2146 Should be registered with
2147 gnutls_handshake_set_post_client_hello_function()
2149 "This callback must return 0 on success or a gnutls error code to terminate the
2152 For inability to get SNI information, we return 0.
2153 We only return non-zero if re-setup failed.
2154 Only used for server-side TLS.
2158 exim_sni_handling_cb(gnutls_session_t session)
2160 char sni_name[MAX_HOST_LEN];
2161 size_t data_len = MAX_HOST_LEN;
2162 exim_gnutls_state_st *state = &state_server;
2163 unsigned int sni_type;
2165 uschar * dummy_errstr;
2167 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2168 if (rc != GNUTLS_E_SUCCESS)
2171 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2172 debug_printf("TLS: no SNI presented in handshake.\n");
2174 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2175 gnutls_strerror(rc), rc);
2179 if (sni_type != GNUTLS_NAME_DNS)
2181 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2185 /* We now have a UTF-8 string in sni_name */
2186 old_pool = store_pool;
2187 store_pool = POOL_PERM;
2188 state->received_sni = string_copy_taint(US sni_name, TRUE);
2189 store_pool = old_pool;
2191 /* We set this one now so that variable expansions below will work */
2192 state->tlsp->sni = state->received_sni;
2194 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2195 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2197 if (!state->trigger_sni_changes)
2200 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2202 /* If the setup of certs/etc failed before handshake, TLS would not have
2203 been offered. The best we can do now is abort. */
2204 return GNUTLS_E_APPLICATION_ERROR_MIN;
2207 rc = tls_set_remaining_x509(state, &dummy_errstr);
2208 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2215 #ifndef DISABLE_EVENT
2217 We use this callback to get observability and detail-level control
2218 for an exim TLS connection (either direction), raising a tls:cert event
2219 for each cert in the chain presented by the peer. Any event
2220 can deny verification.
2222 Return 0 for the handshake to continue or non-zero to terminate.
2226 verify_cb(gnutls_session_t session)
2228 const gnutls_datum_t * cert_list;
2229 unsigned int cert_list_size = 0;
2230 gnutls_x509_crt_t crt;
2233 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2235 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2236 while (cert_list_size--)
2238 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2240 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2241 cert_list_size, gnutls_strerror(rc));
2245 state->tlsp->peercert = crt;
2246 if ((yield = event_raise(state->event_action,
2247 US"tls:cert", string_sprintf("%d", cert_list_size))))
2249 log_write(0, LOG_MAIN,
2250 "SSL verify denied by event-action: depth=%d: %s",
2251 cert_list_size, yield);
2252 return 1; /* reject */
2254 state->tlsp->peercert = NULL;
2264 ddump(gnutls_datum_t * d)
2266 gstring * g = string_get((d->size+1) * 2);
2267 uschar * s = d->data;
2268 for (unsigned i = d->size; i > 0; i--, s++)
2270 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2271 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2277 post_handshake_debug(exim_gnutls_state_st * state)
2279 #ifdef SUPPORT_GNUTLS_SESS_DESC
2280 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2283 #ifdef SUPPORT_GNUTLS_KEYLOG
2284 # ifdef EXIM_HAVE_TLS1_3
2285 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2290 gnutls_datum_t c, s;
2292 /* For TLS1.2 we only want the client random and the master secret */
2293 gnutls_session_get_random(state->session, &c, &s);
2294 gnutls_session_get_master_secret(state->session, &s);
2297 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2300 debug_printf("To get keying info for TLS1.3 is hard:\n"
2301 " set environment variable SSLKEYLOGFILE to a filename writable by uid exim\n"
2302 " add SSLKEYLOGFILE to keep_environment in the exim config\n"
2303 " run exim as root\n"
2304 " if using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2305 " (works for TLS1.2 also, and saves cut-paste into file)"
2306 " Trying to use add_environment for this will not work\n");
2311 #ifdef EXPERIMENTAL_TLS_RESUME
2313 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2314 unsigned incoming, const gnutls_datum_t * msg)
2316 DEBUG(D_tls) debug_printf("newticket cb\n");
2317 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2322 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2324 /* Should the server offer session resumption? */
2325 tls_in.resumption = RESUME_SUPPORTED;
2326 if (verify_check_host(&tls_resumption_hosts) == OK)
2329 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2330 an offered resumption is unacceptable. We lose one resumption per ticket
2331 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2332 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2333 least they go out in a single packet. */
2335 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2336 &server_sessticket_key)))
2337 tls_in.resumption |= RESUME_SERVER_TICKET;
2340 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2342 /* Try to tell if we see a ticket request */
2343 gnutls_handshake_set_hook_function(state->session,
2344 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2349 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2351 if (gnutls_session_resumption_requested(state->session))
2353 /* This tells us the client sent a full ticket. We use a
2354 callback on session-ticket request, elsewhere, to tell
2355 if a client asked for a ticket. */
2357 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2358 DEBUG(D_tls) debug_printf("client requested resumption\n");
2360 if (gnutls_session_is_resumed(state->session))
2362 tls_in.resumption |= RESUME_USED;
2363 DEBUG(D_tls) debug_printf("Session resumed\n");
2367 /* ------------------------------------------------------------------------ */
2368 /* Exported functions */
2373 /*************************************************
2374 * Start a TLS session in a server *
2375 *************************************************/
2377 /* This is called when Exim is running as a server, after having received
2378 the STARTTLS command. It must respond to that command, and then negotiate
2382 require_ciphers list of allowed ciphers or NULL
2383 errstr pointer to error string
2385 Returns: OK on success
2386 DEFER for errors before the start of the negotiation
2387 FAIL for errors during the negotiation; the server can't
2392 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
2395 exim_gnutls_state_st * state = NULL;
2397 /* Check for previous activation */
2398 if (tls_in.active.sock >= 0)
2400 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2401 smtp_printf("554 Already in TLS\r\n", FALSE);
2405 /* Initialize the library. If it fails, it will already have logged the error
2406 and sent an SMTP response. */
2408 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2410 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
2411 NULL, tls_verify_certificates, tls_crl,
2412 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2414 #ifdef EXPERIMENTAL_TLS_RESUME
2415 tls_server_resume_prehandshake(state);
2418 /* If this is a host for which certificate verification is mandatory or
2419 optional, set up appropriately. */
2421 if (verify_check_host(&tls_verify_hosts) == OK)
2424 debug_printf("TLS: a client certificate will be required.\n");
2425 state->verify_requirement = VERIFY_REQUIRED;
2426 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2428 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2431 debug_printf("TLS: a client certificate will be requested but not required.\n");
2432 state->verify_requirement = VERIFY_OPTIONAL;
2433 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2438 debug_printf("TLS: a client certificate will not be requested.\n");
2439 state->verify_requirement = VERIFY_NONE;
2440 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2443 #ifndef DISABLE_EVENT
2446 state->event_action = event_action;
2447 gnutls_session_set_ptr(state->session, state);
2448 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2452 /* Register SNI handling; always, even if not in tls_certificate, so that the
2453 expansion variable $tls_sni is always available. */
2455 gnutls_handshake_set_post_client_hello_function(state->session,
2456 exim_sni_handling_cb);
2458 /* Set context and tell client to go ahead, except in the case of TLS startup
2459 on connection, where outputting anything now upsets the clients and tends to
2460 make them disconnect. We need to have an explicit fflush() here, to force out
2461 the response. Other smtp_printf() calls do not need it, because in non-TLS
2462 mode, the fflush() happens when smtp_getc() is called. */
2464 if (!state->tlsp->on_connect)
2466 smtp_printf("220 TLS go ahead\r\n", FALSE);
2470 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2471 that the GnuTLS library doesn't.
2472 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2473 to set (and clear down afterwards) up a pull-timeout callback function that does
2474 a select, so we're no better off unless avoiding signals becomes an issue. */
2476 gnutls_transport_set_ptr2(state->session,
2477 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2478 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
2479 state->fd_in = fileno(smtp_in);
2480 state->fd_out = fileno(smtp_out);
2482 sigalrm_seen = FALSE;
2483 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2485 rc = gnutls_handshake(state->session);
2486 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2489 if (rc != GNUTLS_E_SUCCESS)
2491 /* It seems that, except in the case of a timeout, we have to close the
2492 connection right here; otherwise if the other end is running OpenSSL it hangs
2493 until the server times out. */
2497 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
2498 gnutls_db_remove_session(state->session);
2502 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
2503 (void) gnutls_alert_send_appropriate(state->session, rc);
2504 gnutls_deinit(state->session);
2505 gnutls_certificate_free_credentials(state->x509_cred);
2507 shutdown(state->fd_out, SHUT_WR);
2508 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
2509 (void)fclose(smtp_out);
2510 (void)fclose(smtp_in);
2511 smtp_out = smtp_in = NULL;
2517 #ifdef EXPERIMENTAL_TLS_RESUME
2518 tls_server_resume_posthandshake(state);
2521 DEBUG(D_tls) post_handshake_debug(state);
2523 /* Verify after the fact */
2525 if (!verify_certificate(state, errstr))
2527 if (state->verify_requirement != VERIFY_OPTIONAL)
2529 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
2533 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
2537 /* Sets various Exim expansion variables; always safe within server */
2539 extract_exim_vars_from_tls_state(state);
2541 /* TLS has been set up. Adjust the input functions to read via TLS,
2542 and initialize appropriately. */
2544 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2546 receive_getc = tls_getc;
2547 receive_getbuf = tls_getbuf;
2548 receive_get_cache = tls_get_cache;
2549 receive_ungetc = tls_ungetc;
2550 receive_feof = tls_feof;
2551 receive_ferror = tls_ferror;
2552 receive_smtp_buffered = tls_smtp_buffered;
2561 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2562 smtp_transport_options_block * ob)
2564 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2566 state->exp_tls_verify_cert_hostnames =
2568 string_domain_utf8_to_alabel(host->name, NULL);
2573 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2574 state->exp_tls_verify_cert_hostnames);
2582 /* Given our list of RRs from the TLSA lookup, build a lookup block in
2583 GnuTLS-DANE's preferred format. Hang it on the state str for later
2584 use in DANE verification.
2586 We point at the dnsa data not copy it, so it must remain valid until
2587 after verification is done.*/
2590 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2594 const char ** dane_data;
2595 int * dane_data_len;
2598 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2599 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2600 ) if (rr->type == T_TLSA) i++;
2602 dane_data = store_get(i * sizeof(uschar *), FALSE);
2603 dane_data_len = store_get(i * sizeof(int), FALSE);
2606 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2607 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2608 ) if (rr->type == T_TLSA && rr->size > 3)
2610 const uschar * p = rr->data;
2611 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
2612 uint8_t usage = p[0], sel = p[1], type = p[2];
2615 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2617 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2618 || (sel != 0 && sel != 1)
2623 case 0: /* Full: cannot check at present */
2625 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2627 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2632 tls_out.tlsa_usage |= 1<<usage;
2633 dane_data[i] = CS p;
2634 dane_data_len[i++] = rr->size;
2637 if (!i) return FALSE;
2639 dane_data[i] = NULL;
2640 dane_data_len[i] = 0;
2642 state->dane_data = (char * const *)dane_data;
2643 state->dane_data_len = dane_data_len;
2650 #ifdef EXPERIMENTAL_TLS_RESUME
2651 /* On the client, get any stashed session for the given IP from hints db
2652 and apply it to the ssl-connection for attempted resumption. Although
2653 there is a gnutls_session_ticket_enable_client() interface it is
2654 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
2655 by deafult". There seems to be no way to disable them, so even hosts not
2656 enabled by the transport option will be sent a ticket request. We will
2657 however avoid storing and retrieving session information. */
2660 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
2661 host_item * host, smtp_transport_options_block * ob)
2663 tlsp->resumption = RESUME_SUPPORTED;
2664 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
2666 dbdata_tls_session * dt;
2668 open_db dbblock, * dbm_file;
2671 debug_printf("check for resumable session for %s\n", host->address);
2672 tlsp->host_resumable = TRUE;
2673 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2674 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
2676 /* Key for the db is the IP. We'd like to filter the retrieved session
2677 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
2679 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
2680 if (!(rc = gnutls_session_set_data(session,
2681 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
2683 DEBUG(D_tls) debug_printf("good session\n");
2684 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2686 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
2687 US gnutls_strerror(rc));
2688 dbfn_close(dbm_file);
2695 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
2697 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
2698 but this flag is not set until the second. TLS 1.3 it's the other way about.
2699 Keep both calls as the session data cannot be extracted before handshake
2702 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
2707 DEBUG(D_tls) debug_printf("server offered session ticket\n");
2708 tlsp->ticket_received = TRUE;
2709 tlsp->resumption |= RESUME_SERVER_TICKET;
2711 if (tlsp->host_resumable)
2712 if (!(rc = gnutls_session_get_data2(session, &tkt)))
2714 open_db dbblock, * dbm_file;
2715 int dlen = sizeof(dbdata_tls_session) + tkt.size;
2716 dbdata_tls_session * dt = store_get(dlen, TRUE);
2718 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
2719 memcpy(dt->session, tkt.data, tkt.size);
2720 gnutls_free(tkt.data);
2722 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
2724 /* key for the db is the IP */
2725 dbfn_delete(dbm_file, host->address);
2726 dbfn_write(dbm_file, host->address, dt, dlen);
2727 dbfn_close(dbm_file);
2730 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
2734 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
2739 /* With a TLS1.3 session, the ticket(s) are not seen until
2740 the first data read is attempted. And there's often two of them.
2741 Pick them up with this callback. We are also called for 1.2
2745 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2746 unsigned incoming, const gnutls_datum_t * msg)
2748 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
2749 tls_support * tlsp = state->tlsp;
2751 DEBUG(D_tls) debug_printf("newticket cb\n");
2753 if (!tlsp->ticket_received)
2754 tls_save_session(tlsp, sess, state->host);
2760 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
2761 tls_support * tlsp, host_item * host,
2762 smtp_transport_options_block * ob)
2764 gnutls_session_set_ptr(state->session, state);
2765 gnutls_handshake_set_hook_function(state->session,
2766 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
2768 tls_retrieve_session(tlsp, state->session, host, ob);
2772 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
2773 tls_support * tlsp, host_item * host)
2775 if (gnutls_session_is_resumed(state->session))
2777 DEBUG(D_tls) debug_printf("Session resumed\n");
2778 tlsp->resumption |= RESUME_USED;
2781 tls_save_session(tlsp, state->session, host);
2783 #endif /* EXPERIMENTAL_TLS_RESUME */
2786 /*************************************************
2787 * Start a TLS session in a client *
2788 *************************************************/
2790 /* Called from the smtp transport after STARTTLS has been accepted.
2793 cctx connection context
2794 conn_args connection details
2795 cookie datum for randomness (not used)
2796 tlsp record details of channel configuration here; must be non-NULL
2797 errstr error string pointer
2799 Returns: TRUE for success with TLS session context set in smtp context,
2804 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2805 void * cookie ARG_UNUSED,
2806 tls_support * tlsp, uschar ** errstr)
2808 host_item * host = conn_args->host; /* for msgs and option-tests */
2809 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
2810 smtp_transport_options_block * ob = tb
2811 ? (smtp_transport_options_block *)tb->options_block
2812 : &smtp_transport_option_defaults;
2814 exim_gnutls_state_st * state = NULL;
2815 uschar * cipher_list = NULL;
2817 #ifndef DISABLE_OCSP
2819 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
2820 BOOL request_ocsp = require_ocsp ? TRUE
2821 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2824 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
2827 /* If dane is flagged, have either request or require dane for this host, and
2828 a TLSA record found. Therefore, dane verify required. Which implies cert must
2829 be requested and supplied, dane verify must pass, and cert verify irrelevant
2830 (incl. hostnames), and (caller handled) require_tls */
2832 if (conn_args->dane && ob->dane_require_tls_ciphers)
2834 /* not using expand_check_tlsvar because not yet in state */
2835 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2836 &cipher_list, errstr))
2838 cipher_list = cipher_list && *cipher_list
2839 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
2844 cipher_list = ob->tls_require_ciphers;
2846 if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2847 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2848 cipher_list, &state, tlsp, errstr) != OK)
2852 int dh_min_bits = ob->tls_dh_min_bits;
2853 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2856 debug_printf("WARNING: tls_dh_min_bits far too low,"
2857 " clamping %d up to %d\n",
2858 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2859 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2862 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2863 " acceptable bits to %d\n",
2865 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2868 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
2869 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2870 the specified host patterns if one of them is defined */
2873 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
2876 debug_printf("TLS: server certificate DANE required.\n");
2877 state->verify_requirement = VERIFY_DANE;
2878 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2882 if ( ( state->exp_tls_verify_certificates
2883 && !ob->tls_verify_hosts
2884 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2886 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
2889 tls_client_setup_hostname_checks(host, state, ob);
2891 debug_printf("TLS: server certificate verification required.\n");
2892 state->verify_requirement = VERIFY_REQUIRED;
2893 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2895 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
2897 tls_client_setup_hostname_checks(host, state, ob);
2899 debug_printf("TLS: server certificate verification optional.\n");
2900 state->verify_requirement = VERIFY_OPTIONAL;
2901 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2906 debug_printf("TLS: server certificate verification not required.\n");
2907 state->verify_requirement = VERIFY_NONE;
2908 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2911 #ifndef DISABLE_OCSP
2912 /* supported since GnuTLS 3.1.3 */
2915 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2916 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2917 NULL, 0, NULL)) != OK)
2919 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
2922 tlsp->ocsp = OCSP_NOT_RESP;
2926 #ifdef EXPERIMENTAL_TLS_RESUME
2927 tls_client_resume_prehandshake(state, tlsp, host, ob);
2930 #ifndef DISABLE_EVENT
2931 if (tb && tb->event_action)
2933 state->event_action = tb->event_action;
2934 gnutls_session_set_ptr(state->session, state);
2935 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2939 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
2940 state->fd_in = cctx->sock;
2941 state->fd_out = cctx->sock;
2943 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2944 /* There doesn't seem to be a built-in timeout on connection. */
2946 sigalrm_seen = FALSE;
2947 ALARM(ob->command_timeout);
2949 rc = gnutls_handshake(state->session);
2950 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2953 if (rc != GNUTLS_E_SUCCESS)
2957 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
2958 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
2961 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
2965 DEBUG(D_tls) post_handshake_debug(state);
2969 if (!verify_certificate(state, errstr))
2971 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
2975 #ifndef DISABLE_OCSP
2980 gnutls_datum_t stapling;
2981 gnutls_ocsp_resp_t resp;
2982 gnutls_datum_t printed;
2986 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
2987 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
2989 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
2992 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
2993 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2994 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
2997 debug_printf("%.4096s", printed.data);
2998 gnutls_free(printed.data);
3001 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3003 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3006 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3008 tlsp->ocsp = OCSP_FAILED;
3009 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3015 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3016 tlsp->ocsp = OCSP_VFIED;
3021 #ifdef EXPERIMENTAL_TLS_RESUME
3022 tls_client_resume_posthandshake(state, tlsp, host);
3025 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3027 extract_exim_vars_from_tls_state(state);
3029 cctx->tls_ctx = state;
3036 /*************************************************
3037 * Close down a TLS session *
3038 *************************************************/
3040 /* This is also called from within a delivery subprocess forked from the
3041 daemon, to shut down the TLS library, without actually doing a shutdown (which
3042 would tamper with the TLS session in the parent process).
3045 ct_ctx client context pointer, or NULL for the one global server context
3046 shutdown 1 if TLS close-alert is to be sent,
3047 2 if also response to be waited for
3053 tls_close(void * ct_ctx, int shutdown)
3055 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3056 tls_support * tlsp = state->tlsp;
3058 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3062 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3063 shutdown > 1 ? " (with response-wait)" : "");
3066 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3070 if (!ct_ctx) /* server */
3072 receive_getc = smtp_getc;
3073 receive_getbuf = smtp_getbuf;
3074 receive_get_cache = smtp_get_cache;
3075 receive_ungetc = smtp_ungetc;
3076 receive_feof = smtp_feof;
3077 receive_ferror = smtp_ferror;
3078 receive_smtp_buffered = smtp_buffered;
3081 gnutls_deinit(state->session);
3082 gnutls_certificate_free_credentials(state->x509_cred);
3084 tlsp->active.sock = -1;
3085 tlsp->active.tls_ctx = NULL;
3086 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3087 tls_channelbinding_b64 = NULL;
3090 if (state->xfer_buffer) store_free(state->xfer_buffer);
3091 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
3098 tls_refill(unsigned lim)
3100 exim_gnutls_state_st * state = &state_server;
3103 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
3104 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3106 sigalrm_seen = FALSE;
3107 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3110 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3111 MIN(ssl_xfer_buffer_size, lim));
3112 while (inbytes == GNUTLS_E_AGAIN);
3114 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3116 if (had_command_timeout) /* set by signal handler */
3117 smtp_command_timeout_exit(); /* does not return */
3118 if (had_command_sigterm)
3119 smtp_command_sigterm_exit();
3120 if (had_data_timeout)
3121 smtp_data_timeout_exit();
3122 if (had_data_sigint)
3123 smtp_data_sigint_exit();
3125 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3126 TLS session has been closed down, not that the socket itself has been closed
3127 down. Revert to non-TLS handling. */
3131 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3132 state->xfer_error = TRUE;
3136 else if (inbytes == 0)
3138 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3139 tls_close(NULL, TLS_NO_SHUTDOWN);
3143 /* Handle genuine errors */
3145 else if (inbytes < 0)
3147 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3148 record_io_error(state, (int) inbytes, US"recv", NULL);
3149 state->xfer_error = TRUE;
3152 #ifndef DISABLE_DKIM
3153 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3155 state->xfer_buffer_hwm = (int) inbytes;
3156 state->xfer_buffer_lwm = 0;
3160 /*************************************************
3161 * TLS version of getc *
3162 *************************************************/
3164 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3165 it refills the buffer via the GnuTLS reading function.
3166 Only used by the server-side TLS.
3168 This feeds DKIM and should be used for all message-body reads.
3170 Arguments: lim Maximum amount to read/buffer
3171 Returns: the next character or EOF
3175 tls_getc(unsigned lim)
3177 exim_gnutls_state_st * state = &state_server;
3179 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3180 if (!tls_refill(lim))
3181 return state->xfer_error ? EOF : smtp_getc(lim);
3183 /* Something in the buffer; return next uschar */
3185 return state->xfer_buffer[state->xfer_buffer_lwm++];
3189 tls_getbuf(unsigned * len)
3191 exim_gnutls_state_st * state = &state_server;
3195 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3196 if (!tls_refill(*len))
3198 if (!state->xfer_error) return smtp_getbuf(len);
3203 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3205 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3206 state->xfer_buffer_lwm += size;
3215 #ifndef DISABLE_DKIM
3216 exim_gnutls_state_st * state = &state_server;
3217 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3219 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3225 tls_could_read(void)
3227 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3228 || gnutls_record_check_pending(state_server.session) > 0;
3234 /*************************************************
3235 * Read bytes from TLS channel *
3236 *************************************************/
3238 /* This does not feed DKIM, so if the caller uses this for reading message body,
3239 then the caller must feed DKIM.
3242 ct_ctx client context pointer, or NULL for the one global server context
3246 Returns: the number of bytes read
3247 -1 after a failed read, including EOF
3251 tls_read(void * ct_ctx, uschar *buff, size_t len)
3253 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3259 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3261 debug_printf("*** PROBABLY A BUG *** " \
3262 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3263 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3266 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
3267 state->session, buff, len);
3270 inbytes = gnutls_record_recv(state->session, buff, len);
3271 while (inbytes == GNUTLS_E_AGAIN);
3273 if (inbytes > 0) return inbytes;
3276 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3280 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3281 record_io_error(state, (int)inbytes, US"recv", NULL);
3290 /*************************************************
3291 * Write bytes down TLS channel *
3292 *************************************************/
3296 ct_ctx client context pointer, or NULL for the one global server context
3299 more more data expected soon
3301 Returns: the number of bytes after a successful write,
3302 -1 after a failed write
3306 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
3310 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3312 static BOOL corked = FALSE;
3314 if (more && !corked) gnutls_record_cork(state->session);
3317 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
3318 buff, left, more ? ", more" : "");
3322 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
3326 outbytes = gnutls_record_send(state->session, buff, left);
3327 while (outbytes == GNUTLS_E_AGAIN);
3329 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
3332 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
3333 record_io_error(state, outbytes, US"send", NULL);
3338 record_io_error(state, 0, US"send", US"TLS channel closed on write");
3349 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
3357 if (!more) (void) gnutls_record_uncork(state->session, 0);
3368 /*************************************************
3369 * Random number generation *
3370 *************************************************/
3372 /* Pseudo-random number generation. The result is not expected to be
3373 cryptographically strong but not so weak that someone will shoot themselves
3374 in the foot using it as a nonce in input in some email header scheme or
3375 whatever weirdness they'll twist this into. The result should handle fork()
3376 and avoid repeating sequences. OpenSSL handles that for us.
3380 Returns a random number in range [0, max-1]
3383 #ifdef HAVE_GNUTLS_RND
3385 vaguely_random_number(int max)
3389 uschar smallbuf[sizeof(r)];
3394 needed_len = sizeof(r);
3395 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
3396 asked for a number less than 10. */
3398 for (r = max, i = 0; r; ++i)
3404 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
3407 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
3408 return vaguely_random_number_fallback(max);
3411 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
3414 /* We don't particularly care about weighted results; if someone wants
3415 * smooth distribution and cares enough then they should submit a patch then. */
3418 #else /* HAVE_GNUTLS_RND */
3420 vaguely_random_number(int max)
3422 return vaguely_random_number_fallback(max);
3424 #endif /* HAVE_GNUTLS_RND */
3429 /*************************************************
3430 * Let tls_require_ciphers be checked at startup *
3431 *************************************************/
3433 /* The tls_require_ciphers option, if set, must be something which the
3436 Returns: NULL on success, or error message
3440 tls_validate_require_cipher(void)
3443 uschar *expciphers = NULL;
3444 gnutls_priority_t priority_cache;
3446 uschar * dummy_errstr;
3448 #ifdef GNUTLS_AUTO_GLOBAL_INIT
3449 # define validate_check_rc(Label) do { \
3450 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \
3451 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3452 # define return_deinit(Label) do { return (Label); } while (0)
3454 # define validate_check_rc(Label) do { \
3455 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
3456 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3457 # define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
3460 if (exim_gnutls_base_init_done)
3461 log_write(0, LOG_MAIN|LOG_PANIC,
3462 "already initialised GnuTLS, Exim developer bug");
3464 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
3465 if (!gnutls_allow_auto_pkcs11)
3467 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
3468 validate_check_rc(US"gnutls_pkcs11_init");
3471 #ifndef GNUTLS_AUTO_GLOBAL_INIT
3472 rc = gnutls_global_init();
3473 validate_check_rc(US"gnutls_global_init()");
3475 exim_gnutls_base_init_done = TRUE;
3477 if (!(tls_require_ciphers && *tls_require_ciphers))
3478 return_deinit(NULL);
3480 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
3482 return_deinit(US"failed to expand tls_require_ciphers");
3484 if (!(expciphers && *expciphers))
3485 return_deinit(NULL);
3488 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
3490 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
3491 validate_check_rc(string_sprintf(
3492 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
3493 expciphers, errpos - CS expciphers, errpos));
3495 #undef return_deinit
3496 #undef validate_check_rc
3497 #ifndef GNUTLS_AUTO_GLOBAL_INIT
3498 gnutls_global_deinit();
3507 /*************************************************
3508 * Report the library versions. *
3509 *************************************************/
3511 /* See a description in tls-openssl.c for an explanation of why this exists.
3513 Arguments: a FILE* to print the results to
3518 tls_version_report(FILE *f)
3520 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
3523 gnutls_check_version(NULL));
3526 #endif /*!MACRO_PREDEF*/
3529 /* End of tls-gnu.c */