1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2014 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42 /* needed to disable PKCS11 autoload unless requested */
43 #if GNUTLS_VERSION_NUMBER >= 0x020c00
44 # include <gnutls/pkcs11.h>
46 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
47 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50 #if GNUTLS_VERSION_NUMBER < 0x020a00 && defined(EXPERIMENTAL_EVENT)
51 # warning "GnuTLS library version too old; tls:cert event unsupported"
52 # undef EXPERIMENTAL_EVENT
54 #if GNUTLS_VERSION_NUMBER >= 0x030306
55 # define SUPPORT_CA_DIR
57 # undef SUPPORT_CA_DIR
59 #if GNUTLS_VERSION_NUMBER >= 0x030314
60 # define SUPPORT_SYSDEFAULT_CABUNDLE
64 # include <gnutls/ocsp.h>
70 gnutls_global_set_audit_log_function()
73 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
76 /* Local static variables for GnuTLS */
78 /* Values for verify_requirement */
80 enum peer_verify_requirement
81 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
83 /* This holds most state for server or client; with this, we can set up an
84 outbound TLS-enabled connection in an ACL callout, while not stomping all
85 over the TLS variables available for expansion.
87 Some of these correspond to variables in globals.c; those variables will
88 be set to point to content in one of these instances, as appropriate for
89 the stage of the process lifetime.
91 Not handled here: global tls_channelbinding_b64.
94 typedef struct exim_gnutls_state {
95 gnutls_session_t session;
96 gnutls_certificate_credentials_t x509_cred;
97 gnutls_priority_t priority_cache;
98 enum peer_verify_requirement verify_requirement;
101 BOOL peer_cert_verified;
102 BOOL trigger_sni_changes;
103 BOOL have_set_peerdn;
104 const struct host_item *host;
105 gnutls_x509_crt_t peercert;
108 uschar *received_sni;
110 const uschar *tls_certificate;
111 const uschar *tls_privatekey;
112 const uschar *tls_sni; /* client send only, not received */
113 const uschar *tls_verify_certificates;
114 const uschar *tls_crl;
115 const uschar *tls_require_ciphers;
117 uschar *exp_tls_certificate;
118 uschar *exp_tls_privatekey;
119 uschar *exp_tls_verify_certificates;
121 uschar *exp_tls_require_ciphers;
122 uschar *exp_tls_ocsp_file;
123 uschar *exp_tls_verify_cert_hostnames;
124 #ifdef EXPERIMENTAL_EVENT
125 uschar *event_action;
128 tls_support *tlsp; /* set in tls_init() */
135 } exim_gnutls_state_st;
137 static const exim_gnutls_state_st exim_gnutls_state_init = {
138 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
139 NULL, NULL, NULL, NULL,
140 NULL, NULL, NULL, NULL, NULL, NULL,
141 NULL, NULL, NULL, NULL, NULL, NULL, NULL,
143 #ifdef EXPERIMENTAL_EVENT
150 /* Not only do we have our own APIs which don't pass around state, assuming
151 it's held in globals, GnuTLS doesn't appear to let us register callback data
152 for callbacks, or as part of the session, so we have to keep a "this is the
153 context we're currently dealing with" pointer and rely upon being
154 single-threaded to keep from processing data on an inbound TLS connection while
155 talking to another TLS connection for an outbound check. This does mean that
156 there's no way for heart-beats to be responded to, for the duration of the
158 XXX But see gnutls_session_get_ptr()
161 static exim_gnutls_state_st state_server, state_client;
163 /* dh_params are initialised once within the lifetime of a process using TLS;
164 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
165 don't want to repeat this. */
167 static gnutls_dh_params_t dh_server_params = NULL;
169 /* No idea how this value was chosen; preserving it. Default is 3600. */
171 static const int ssl_session_timeout = 200;
173 static const char * const exim_default_gnutls_priority = "NORMAL";
175 /* Guard library core initialisation */
177 static BOOL exim_gnutls_base_init_done = FALSE;
180 /* ------------------------------------------------------------------------ */
183 #define MAX_HOST_LEN 255
185 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
186 the library logging; a value less than 0 disables the calls to set up logging
188 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
189 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
192 #ifndef EXIM_CLIENT_DH_MIN_BITS
193 # define EXIM_CLIENT_DH_MIN_BITS 1024
196 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
197 can ask for a bit-strength. Without that, we stick to the constant we had
199 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
200 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
203 #define exim_gnutls_err_check(Label) do { \
204 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
206 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
208 #if GNUTLS_VERSION_NUMBER >= 0x020c00
209 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
210 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
211 # define HAVE_GNUTLS_RND
212 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
213 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
214 * isn't available sometimes, so this needs to become a conditional
215 * compilation; the sanest way to deal with this being a problem on
216 * older OSes is to block it in the Local/Makefile with this compiler
218 # ifndef AVOID_GNUTLS_PKCS11
219 # define HAVE_GNUTLS_PKCS11
220 # endif /* AVOID_GNUTLS_PKCS11 */
226 /* ------------------------------------------------------------------------ */
227 /* Callback declarations */
229 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
230 static void exim_gnutls_logger_cb(int level, const char *message);
233 static int exim_sni_handling_cb(gnutls_session_t session);
236 static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
237 gnutls_datum_t * ocsp_response);
242 /* ------------------------------------------------------------------------ */
243 /* Static functions */
245 /*************************************************
247 *************************************************/
249 /* Called from lots of places when errors occur before actually starting to do
250 the TLS handshake, that is, while the session is still in clear. Always returns
251 DEFER for a server and FAIL for a client so that most calls can use "return
252 tls_error(...)" to do this processing and then give an appropriate return. A
253 single function is used for both server and client, because it is called from
254 some shared functions.
257 prefix text to include in the logged error
258 msg additional error string (may be NULL)
259 usually obtained from gnutls_strerror()
260 host NULL if setting up a server;
261 the connected host if setting up a client
263 Returns: OK/DEFER/FAIL
267 tls_error(const uschar *prefix, const char *msg, const host_item *host)
271 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s)%s%s",
272 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
277 uschar *conn_info = smtp_get_connection_info();
278 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
280 /* I'd like to get separated H= here, but too hard for now */
281 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
282 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
290 /*************************************************
291 * Deal with logging errors during I/O *
292 *************************************************/
294 /* We have to get the identity of the peer from saved data.
297 state the current GnuTLS exim state container
298 rc the GnuTLS error code, or 0 if it's a local error
299 when text identifying read or write
300 text local error text when ec is 0
306 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
310 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
311 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
312 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
314 msg = gnutls_strerror(rc);
316 tls_error(when, msg, state->host);
322 /*************************************************
323 * Set various Exim expansion vars *
324 *************************************************/
326 #define exim_gnutls_cert_err(Label) \
329 if (rc != GNUTLS_E_SUCCESS) \
331 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
332 (Label), gnutls_strerror(rc)); \
338 import_cert(const gnutls_datum * cert, gnutls_x509_crt_t * crtp)
342 rc = gnutls_x509_crt_init(crtp);
343 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
345 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
346 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
351 #undef exim_gnutls_cert_err
354 /* We set various Exim global variables from the state, once a session has
355 been established. With TLS callouts, may need to change this to stack
356 variables, or just re-call it with the server state after client callout
359 Make sure anything set here is unset in tls_getc().
363 tls_bits strength indicator
364 tls_certificate_verified bool indicator
365 tls_channelbinding_b64 for some SASL mechanisms
367 tls_peercert pointer to library internal
369 tls_sni a (UTF-8) string
370 tls_ourcert pointer to library internal
373 state the relevant exim_gnutls_state_st *
377 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
379 gnutls_cipher_algorithm_t cipher;
380 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
383 gnutls_datum_t channel;
385 tls_support * tlsp = state->tlsp;
387 tlsp->active = state->fd_out;
389 cipher = gnutls_cipher_get(state->session);
390 /* returns size in "bytes" */
391 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
393 tlsp->cipher = state->ciphersuite;
395 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
397 tlsp->certificate_verified = state->peer_cert_verified;
399 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
400 only available for use for authenticators while this TLS session is running. */
402 tls_channelbinding_b64 = NULL;
403 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
406 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
408 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
410 old_pool = store_pool;
411 store_pool = POOL_PERM;
412 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
413 store_pool = old_pool;
414 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
418 /* peercert is set in peer_status() */
419 tlsp->peerdn = state->peerdn;
420 tlsp->sni = state->received_sni;
422 /* record our certificate */
424 const gnutls_datum * cert = gnutls_certificate_get_ours(state->session);
425 gnutls_x509_crt_t crt;
427 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
434 /*************************************************
435 * Setup up DH parameters *
436 *************************************************/
438 /* Generating the D-H parameters may take a long time. They only need to
439 be re-generated every so often, depending on security policy. What we do is to
440 keep these parameters in a file in the spool directory. If the file does not
441 exist, we generate them. This means that it is easy to cause a regeneration.
443 The new file is written as a temporary file and renamed, so that an incomplete
444 file is never present. If two processes both compute some new parameters, you
445 waste a bit of effort, but it doesn't seem worth messing around with locking to
448 Returns: OK/DEFER/FAIL
455 unsigned int dh_bits;
457 uschar filename_buf[PATH_MAX];
458 uschar *filename = NULL;
460 uschar *exp_tls_dhparam;
461 BOOL use_file_in_spool = FALSE;
462 BOOL use_fixed_file = FALSE;
463 host_item *host = NULL; /* dummy for macros */
465 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
467 rc = gnutls_dh_params_init(&dh_server_params);
468 exim_gnutls_err_check(US"gnutls_dh_params_init");
473 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
476 if (!exp_tls_dhparam)
478 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
479 m.data = US std_dh_prime_default();
480 m.size = Ustrlen(m.data);
482 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
483 use_file_in_spool = TRUE;
484 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
486 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
489 else if (exp_tls_dhparam[0] != '/')
491 m.data = US std_dh_prime_named(exp_tls_dhparam);
493 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
494 m.size = Ustrlen(m.data);
498 use_fixed_file = TRUE;
499 filename = exp_tls_dhparam;
504 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
505 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
506 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
510 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
511 /* If you change this constant, also change dh_param_fn_ext so that we can use a
512 different filename and ensure we have sufficient bits. */
513 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
515 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
517 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
520 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
522 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
526 /* Some clients have hard-coded limits. */
527 if (dh_bits > tls_dh_max_bits)
530 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
532 dh_bits = tls_dh_max_bits;
535 if (use_file_in_spool)
537 if (!string_format(filename_buf, sizeof(filename_buf),
538 "%s/gnutls-params-%d", spool_directory, dh_bits))
539 return tls_error(US"overlong filename", NULL, NULL);
540 filename = filename_buf;
543 /* Open the cache file for reading and if successful, read it and set up the
546 fd = Uopen(filename, O_RDONLY, 0);
553 if (fstat(fd, &statbuf) < 0) /* EIO */
557 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
559 if (!S_ISREG(statbuf.st_mode))
562 return tls_error(US"TLS cache not a file", NULL, NULL);
564 fp = fdopen(fd, "rb");
569 return tls_error(US"fdopen(TLS cache stat fd) failed",
570 strerror(saved_errno), NULL);
573 m.size = statbuf.st_size;
574 m.data = malloc(m.size);
578 return tls_error(US"malloc failed", strerror(errno), NULL);
580 sz = fread(m.data, m.size, 1, fp);
586 return tls_error(US"fread failed", strerror(saved_errno), NULL);
590 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
592 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
593 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
596 /* If the file does not exist, fall through to compute new data and cache it.
597 If there was any other opening error, it is serious. */
599 else if (errno == ENOENT)
603 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
606 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
609 /* If ret < 0, either the cache file does not exist, or the data it contains
610 is not useful. One particular case of this is when upgrading from an older
611 release of Exim in which the data was stored in a different format. We don't
612 try to be clever and support both formats; we just regenerate new data in this
618 unsigned int dh_bits_gen = dh_bits;
620 if ((PATH_MAX - Ustrlen(filename)) < 10)
621 return tls_error(US"Filename too long to generate replacement",
624 temp_fn = string_copy(US "%s.XXXXXXX");
625 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
627 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
628 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
630 /* GnuTLS overshoots!
631 * If we ask for 2236, we might get 2237 or more.
632 * But there's no way to ask GnuTLS how many bits there really are.
633 * We can ask how many bits were used in a TLS session, but that's it!
634 * The prime itself is hidden behind too much abstraction.
635 * So we ask for less, and proceed on a wing and a prayer.
636 * First attempt, subtracted 3 for 2233 and got 2240.
638 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
640 dh_bits_gen = dh_bits - 10;
642 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
647 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
649 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
650 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
652 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
653 and I confirmed that a NULL call to get the size first is how the GnuTLS
654 sample apps handle this. */
658 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
660 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
661 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
663 m.data = malloc(m.size);
665 return tls_error(US"memory allocation failed", strerror(errno), NULL);
666 /* this will return a size 1 less than the allocation size above */
667 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
669 if (rc != GNUTLS_E_SUCCESS)
672 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
674 m.size = sz; /* shrink by 1, probably */
676 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
680 return tls_error(US"TLS cache write D-H params failed",
681 strerror(errno), NULL);
684 sz = write_to_fd_buf(fd, US"\n", 1);
686 return tls_error(US"TLS cache write D-H params final newline failed",
687 strerror(errno), NULL);
691 return tls_error(US"TLS cache write close() failed",
692 strerror(errno), NULL);
694 if (Urename(temp_fn, filename) < 0)
695 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
696 temp_fn, filename), strerror(errno), NULL);
698 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
701 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
708 /*************************************************
709 * Variables re-expanded post-SNI *
710 *************************************************/
712 /* Called from both server and client code, via tls_init(), and also from
713 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
715 We can tell the two apart by state->received_sni being non-NULL in callback.
717 The callback should not call us unless state->trigger_sni_changes is true,
718 which we are responsible for setting on the first pass through.
721 state exim_gnutls_state_st *
723 Returns: OK/DEFER/FAIL
727 tls_expand_session_files(exim_gnutls_state_st *state)
731 const host_item *host = state->host; /* macro should be reconsidered? */
732 uschar *saved_tls_certificate = NULL;
733 uschar *saved_tls_privatekey = NULL;
734 uschar *saved_tls_verify_certificates = NULL;
735 uschar *saved_tls_crl = NULL;
738 /* We check for tls_sni *before* expansion. */
739 if (!host) /* server */
741 if (!state->received_sni)
743 if (state->tls_certificate &&
744 (Ustrstr(state->tls_certificate, US"tls_sni") ||
745 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
746 Ustrstr(state->tls_certificate, US"tls_out_sni")
749 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
750 state->trigger_sni_changes = TRUE;
755 /* useful for debugging */
756 saved_tls_certificate = state->exp_tls_certificate;
757 saved_tls_privatekey = state->exp_tls_privatekey;
758 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
759 saved_tls_crl = state->exp_tls_crl;
763 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
764 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
766 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
767 state members, assuming consistent naming; and expand_check() returns
768 false if expansion failed, unless expansion was forced to fail. */
770 /* check if we at least have a certificate, before doing expensive
773 if (!expand_check_tlsvar(tls_certificate))
776 /* certificate is mandatory in server, optional in client */
778 if ((state->exp_tls_certificate == NULL) ||
779 (*state->exp_tls_certificate == '\0'))
782 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
784 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
787 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
790 /* tls_privatekey is optional, defaulting to same file as certificate */
792 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
794 state->tls_privatekey = state->tls_certificate;
795 state->exp_tls_privatekey = state->exp_tls_certificate;
799 if (state->exp_tls_certificate && *state->exp_tls_certificate)
801 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
802 state->exp_tls_certificate, state->exp_tls_privatekey);
804 if (state->received_sni)
806 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
807 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
809 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
813 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
817 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
818 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
819 GNUTLS_X509_FMT_PEM);
820 exim_gnutls_err_check(
821 string_sprintf("cert/key setup: cert=%s key=%s",
822 state->exp_tls_certificate, state->exp_tls_privatekey));
823 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
824 } /* tls_certificate */
827 /* Set the OCSP stapling server info */
830 if ( !host /* server */
834 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file",
835 &state->exp_tls_ocsp_file))
838 /* Use the full callback method for stapling just to get observability.
839 More efficient would be to read the file once only, if it never changed
840 (due to SNI). Would need restart on file update, or watch datestamp. */
842 gnutls_certificate_set_ocsp_status_request_function(state->x509_cred,
843 server_ocsp_stapling_cb, state->exp_tls_ocsp_file);
845 DEBUG(D_tls) debug_printf("Set OCSP response file %s\n", &state->exp_tls_ocsp_file);
850 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
851 provided. Experiment shows that, if the certificate file is empty, an unhelpful
852 error message is provided. However, if we just refrain from setting anything up
853 in that case, certificate verification fails, which seems to be the correct
856 if (state->tls_verify_certificates && *state->tls_verify_certificates)
858 if (!expand_check_tlsvar(tls_verify_certificates))
860 if (state->tls_crl && *state->tls_crl)
861 if (!expand_check_tlsvar(tls_crl))
864 if (!(state->exp_tls_verify_certificates &&
865 *state->exp_tls_verify_certificates))
868 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
869 /* With no tls_verify_certificates, we ignore tls_crl too */
876 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
880 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
881 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
882 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
886 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
888 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
889 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
894 #ifndef SUPPORT_CA_DIR
895 /* The test suite passes in /dev/null; we could check for that path explicitly,
896 but who knows if someone has some weird FIFO which always dumps some certs, or
897 other weirdness. The thing we really want to check is that it's not a
898 directory, since while OpenSSL supports that, GnuTLS does not.
899 So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
900 if (S_ISDIR(statbuf.st_mode))
903 debug_printf("verify certificates path is a dir: \"%s\"\n",
904 state->exp_tls_verify_certificates);
905 log_write(0, LOG_MAIN|LOG_PANIC,
906 "tls_verify_certificates \"%s\" is a directory",
907 state->exp_tls_verify_certificates);
912 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
913 state->exp_tls_verify_certificates, statbuf.st_size);
915 if (statbuf.st_size == 0)
918 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
924 #ifdef SUPPORT_CA_DIR
925 (statbuf.st_mode & S_IFMT) == S_IFDIR
927 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
928 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
931 gnutls_certificate_set_x509_trust_file(state->x509_cred,
932 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
938 exim_gnutls_err_check(US"setting certificate trust");
940 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
942 if (state->tls_crl && *state->tls_crl &&
943 state->exp_tls_crl && *state->exp_tls_crl)
945 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
946 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
947 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
951 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
953 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
962 /*************************************************
963 * Set X.509 state variables *
964 *************************************************/
966 /* In GnuTLS, the registered cert/key are not replaced by a later
967 set of a cert/key, so for SNI support we need a whole new x509_cred
968 structure. Which means various other non-re-expanded pieces of state
969 need to be re-set in the new struct, so the setting logic is pulled
973 state exim_gnutls_state_st *
975 Returns: OK/DEFER/FAIL
979 tls_set_remaining_x509(exim_gnutls_state_st *state)
982 const host_item *host = state->host; /* macro should be reconsidered? */
984 /* Create D-H parameters, or read them from the cache file. This function does
985 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
986 client-side params. */
990 if (!dh_server_params)
992 rc = init_server_dh();
993 if (rc != OK) return rc;
995 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
998 /* Link the credentials to the session. */
1000 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1001 exim_gnutls_err_check(US"gnutls_credentials_set");
1006 /*************************************************
1007 * Initialize for GnuTLS *
1008 *************************************************/
1010 /* Called from both server and client code. In the case of a server, errors
1011 before actual TLS negotiation return DEFER.
1014 host connected host, if client; NULL if server
1015 certificate certificate file
1016 privatekey private key file
1017 sni TLS SNI to send, sometimes when client; else NULL
1020 require_ciphers tls_require_ciphers setting
1021 caller_state returned state-info structure
1023 Returns: OK/DEFER/FAIL
1028 const host_item *host,
1029 const uschar *certificate,
1030 const uschar *privatekey,
1034 const uschar *require_ciphers,
1035 exim_gnutls_state_st **caller_state)
1037 exim_gnutls_state_st *state;
1042 BOOL want_default_priorities;
1044 if (!exim_gnutls_base_init_done)
1046 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1048 #ifdef HAVE_GNUTLS_PKCS11
1049 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1050 which loads modules from a config file, which sounds good and may be wanted
1051 by some sysadmin, but also means in common configurations that GNOME keyring
1052 environment variables are used and so breaks for users calling mailq.
1053 To prevent this, we init PKCS11 first, which is the documented approach. */
1054 if (!gnutls_allow_auto_pkcs11)
1056 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1057 exim_gnutls_err_check(US"gnutls_pkcs11_init");
1061 rc = gnutls_global_init();
1062 exim_gnutls_err_check(US"gnutls_global_init");
1064 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1067 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1068 /* arbitrarily chosen level; bump upto 9 for more */
1069 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1073 exim_gnutls_base_init_done = TRUE;
1078 state = &state_client;
1079 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1080 state->tlsp = &tls_out;
1081 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1082 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1086 state = &state_server;
1087 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1088 state->tlsp = &tls_in;
1089 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1090 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1092 exim_gnutls_err_check(US"gnutls_init");
1096 state->tls_certificate = certificate;
1097 state->tls_privatekey = privatekey;
1098 state->tls_require_ciphers = require_ciphers;
1099 state->tls_sni = sni;
1100 state->tls_verify_certificates = cas;
1101 state->tls_crl = crl;
1103 /* This handles the variables that might get re-expanded after TLS SNI;
1104 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1107 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1108 rc = tls_expand_session_files(state);
1109 if (rc != OK) return rc;
1111 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1112 requires a new structure afterwards. */
1114 rc = tls_set_remaining_x509(state);
1115 if (rc != OK) return rc;
1117 /* set SNI in client, only */
1120 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni))
1122 if (state->tlsp->sni && *state->tlsp->sni)
1125 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1126 sz = Ustrlen(state->tlsp->sni);
1127 rc = gnutls_server_name_set(state->session,
1128 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
1129 exim_gnutls_err_check(US"gnutls_server_name_set");
1132 else if (state->tls_sni)
1133 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1134 "have an SNI set for a client [%s]\n", state->tls_sni);
1136 /* This is the priority string support,
1137 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1138 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1139 This was backwards incompatible, but means Exim no longer needs to track
1140 all algorithms and provide string forms for them. */
1142 want_default_priorities = TRUE;
1144 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1146 if (!expand_check_tlsvar(tls_require_ciphers))
1148 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1150 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1151 state->exp_tls_require_ciphers);
1153 rc = gnutls_priority_init(&state->priority_cache,
1154 CS state->exp_tls_require_ciphers, &errpos);
1155 want_default_priorities = FALSE;
1156 p = state->exp_tls_require_ciphers;
1159 if (want_default_priorities)
1162 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1163 exim_default_gnutls_priority);
1164 rc = gnutls_priority_init(&state->priority_cache,
1165 exim_default_gnutls_priority, &errpos);
1166 p = US exim_default_gnutls_priority;
1169 exim_gnutls_err_check(string_sprintf(
1170 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1171 p, errpos - CS p, errpos));
1173 rc = gnutls_priority_set(state->session, state->priority_cache);
1174 exim_gnutls_err_check(US"gnutls_priority_set");
1176 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1178 /* Reduce security in favour of increased compatibility, if the admin
1179 decides to make that trade-off. */
1180 if (gnutls_compat_mode)
1182 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1183 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1184 gnutls_session_enable_compatibility_mode(state->session);
1186 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1190 *caller_state = state;
1196 /*************************************************
1197 * Extract peer information *
1198 *************************************************/
1200 /* Called from both server and client code.
1201 Only this is allowed to set state->peerdn and state->have_set_peerdn
1202 and we use that to detect double-calls.
1204 NOTE: the state blocks last while the TLS connection is up, which is fine
1205 for logging in the server side, but for the client side, we log after teardown
1206 in src/deliver.c. While the session is up, we can twist about states and
1207 repoint tls_* globals, but those variables used for logging or other variable
1208 expansion that happens _after_ delivery need to have a longer life-time.
1210 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1211 doing this more than once per generation of a state context. We set them in
1212 the state context, and repoint tls_* to them. After the state goes away, the
1213 tls_* copies of the pointers remain valid and client delivery logging is happy.
1215 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1219 state exim_gnutls_state_st *
1221 Returns: OK/DEFER/FAIL
1225 peer_status(exim_gnutls_state_st *state)
1227 uschar cipherbuf[256];
1228 const gnutls_datum *cert_list;
1230 unsigned int cert_list_size = 0;
1231 gnutls_protocol_t protocol;
1232 gnutls_cipher_algorithm_t cipher;
1233 gnutls_kx_algorithm_t kx;
1234 gnutls_mac_algorithm_t mac;
1235 gnutls_certificate_type_t ct;
1236 gnutls_x509_crt_t crt;
1240 if (state->have_set_peerdn)
1242 state->have_set_peerdn = TRUE;
1244 state->peerdn = NULL;
1247 cipher = gnutls_cipher_get(state->session);
1248 protocol = gnutls_protocol_get_version(state->session);
1249 mac = gnutls_mac_get(state->session);
1250 kx = gnutls_kx_get(state->session);
1252 string_format(cipherbuf, sizeof(cipherbuf),
1254 gnutls_protocol_get_name(protocol),
1255 gnutls_cipher_suite_get_name(kx, cipher, mac),
1256 (int) gnutls_cipher_get_key_size(cipher) * 8);
1258 /* I don't see a way that spaces could occur, in the current GnuTLS
1259 code base, but it was a concern in the old code and perhaps older GnuTLS
1260 releases did return "TLS 1.0"; play it safe, just in case. */
1261 for (p = cipherbuf; *p != '\0'; ++p)
1264 old_pool = store_pool;
1265 store_pool = POOL_PERM;
1266 state->ciphersuite = string_copy(cipherbuf);
1267 store_pool = old_pool;
1268 state->tlsp->cipher = state->ciphersuite;
1271 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1273 if (cert_list == NULL || cert_list_size == 0)
1275 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1276 cert_list, cert_list_size);
1277 if (state->verify_requirement >= VERIFY_REQUIRED)
1278 return tls_error(US"certificate verification failed",
1279 "no certificate received from peer", state->host);
1283 ct = gnutls_certificate_type_get(state->session);
1284 if (ct != GNUTLS_CRT_X509)
1286 const char *ctn = gnutls_certificate_type_get_name(ct);
1288 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1289 if (state->verify_requirement >= VERIFY_REQUIRED)
1290 return tls_error(US"certificate verification not possible, unhandled type",
1295 #define exim_gnutls_peer_err(Label) \
1297 if (rc != GNUTLS_E_SUCCESS) \
1299 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1300 (Label), gnutls_strerror(rc)); \
1301 if (state->verify_requirement >= VERIFY_REQUIRED) \
1302 return tls_error((Label), gnutls_strerror(rc), state->host); \
1307 rc = import_cert(&cert_list[0], &crt);
1308 exim_gnutls_peer_err(US"cert 0");
1310 state->tlsp->peercert = state->peercert = crt;
1313 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1314 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1316 exim_gnutls_peer_err(US"getting size for cert DN failed");
1317 return FAIL; /* should not happen */
1319 dn_buf = store_get_perm(sz);
1320 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1321 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1323 state->peerdn = dn_buf;
1326 #undef exim_gnutls_peer_err
1332 /*************************************************
1333 * Verify peer certificate *
1334 *************************************************/
1336 /* Called from both server and client code.
1337 *Should* be using a callback registered with
1338 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1339 the peer information, but that's too new for some OSes.
1342 state exim_gnutls_state_st *
1343 error where to put an error message
1346 FALSE if the session should be rejected
1347 TRUE if the cert is okay or we just don't care
1351 verify_certificate(exim_gnutls_state_st *state, const char **error)
1354 unsigned int verify;
1358 if ((rc = peer_status(state)) != OK)
1360 verify = GNUTLS_CERT_INVALID;
1361 *error = "certificate not supplied";
1364 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1366 /* Handle the result of verification. INVALID seems to be set as well
1367 as REVOKED, but leave the test for both. */
1370 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1373 state->peer_cert_verified = FALSE;
1375 *error = verify & GNUTLS_CERT_REVOKED
1376 ? "certificate revoked" : "certificate invalid";
1379 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1380 *error, state->peerdn ? state->peerdn : US"<unset>");
1382 if (state->verify_requirement >= VERIFY_REQUIRED)
1384 gnutls_alert_send(state->session,
1385 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1389 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1394 if (state->exp_tls_verify_cert_hostnames)
1397 uschar * list = state->exp_tls_verify_cert_hostnames;
1399 while (name = string_nextinlist(&list, &sep, NULL, 0))
1400 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1405 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1406 if (state->verify_requirement >= VERIFY_REQUIRED)
1408 gnutls_alert_send(state->session,
1409 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1415 state->peer_cert_verified = TRUE;
1416 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1417 state->peerdn ? state->peerdn : US"<unset>");
1420 state->tlsp->peerdn = state->peerdn;
1428 /* ------------------------------------------------------------------------ */
1431 /* Logging function which can be registered with
1432 * gnutls_global_set_log_function()
1433 * gnutls_global_set_log_level() 0..9
1435 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1437 exim_gnutls_logger_cb(int level, const char *message)
1439 size_t len = strlen(message);
1442 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1445 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1446 message[len-1] == '\n' ? "" : "\n");
1451 /* Called after client hello, should handle SNI work.
1452 This will always set tls_sni (state->received_sni) if available,
1453 and may trigger presenting different certificates,
1454 if state->trigger_sni_changes is TRUE.
1456 Should be registered with
1457 gnutls_handshake_set_post_client_hello_function()
1459 "This callback must return 0 on success or a gnutls error code to terminate the
1462 For inability to get SNI information, we return 0.
1463 We only return non-zero if re-setup failed.
1464 Only used for server-side TLS.
1468 exim_sni_handling_cb(gnutls_session_t session)
1470 char sni_name[MAX_HOST_LEN];
1471 size_t data_len = MAX_HOST_LEN;
1472 exim_gnutls_state_st *state = &state_server;
1473 unsigned int sni_type;
1476 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1477 if (rc != GNUTLS_E_SUCCESS)
1480 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1481 debug_printf("TLS: no SNI presented in handshake.\n");
1483 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1484 gnutls_strerror(rc), rc);
1489 if (sni_type != GNUTLS_NAME_DNS)
1491 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1495 /* We now have a UTF-8 string in sni_name */
1496 old_pool = store_pool;
1497 store_pool = POOL_PERM;
1498 state->received_sni = string_copyn(US sni_name, data_len);
1499 store_pool = old_pool;
1501 /* We set this one now so that variable expansions below will work */
1502 state->tlsp->sni = state->received_sni;
1504 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1505 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1507 if (!state->trigger_sni_changes)
1510 rc = tls_expand_session_files(state);
1513 /* If the setup of certs/etc failed before handshake, TLS would not have
1514 been offered. The best we can do now is abort. */
1515 return GNUTLS_E_APPLICATION_ERROR_MIN;
1518 rc = tls_set_remaining_x509(state);
1519 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1526 #ifndef DISABLE_OCSP
1529 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1530 gnutls_datum_t * ocsp_response)
1534 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1536 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1538 tls_in.ocsp = OCSP_NOT_RESP;
1539 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1542 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1549 #ifdef EXPERIMENTAL_EVENT
1551 We use this callback to get observability and detail-level control
1552 for an exim TLS connection (either direction), raising a tls:cert event
1553 for each cert in the chain presented by the peer. Any event
1554 can deny verification.
1556 Return 0 for the handshake to continue or non-zero to terminate.
1560 verify_cb(gnutls_session_t session)
1562 const gnutls_datum * cert_list;
1563 unsigned int cert_list_size = 0;
1564 gnutls_x509_crt_t crt;
1567 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1569 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1571 while (cert_list_size--)
1573 rc = import_cert(&cert_list[cert_list_size], &crt);
1574 if (rc != GNUTLS_E_SUCCESS)
1576 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1577 cert_list_size, gnutls_strerror(rc));
1581 state->tlsp->peercert = crt;
1582 if ((yield = event_raise(state->event_action,
1583 US"tls:cert", string_sprintf("%d", cert_list_size))))
1585 log_write(0, LOG_MAIN,
1586 "SSL verify denied by event-action: depth=%d: %s",
1587 cert_list_size, yield);
1588 return 1; /* reject */
1590 state->tlsp->peercert = NULL;
1600 /* ------------------------------------------------------------------------ */
1601 /* Exported functions */
1606 /*************************************************
1607 * Start a TLS session in a server *
1608 *************************************************/
1610 /* This is called when Exim is running as a server, after having received
1611 the STARTTLS command. It must respond to that command, and then negotiate
1615 require_ciphers list of allowed ciphers or NULL
1617 Returns: OK on success
1618 DEFER for errors before the start of the negotiation
1619 FAIL for errors during the negotation; the server can't
1624 tls_server_start(const uschar *require_ciphers)
1628 exim_gnutls_state_st *state = NULL;
1630 /* Check for previous activation */
1631 if (tls_in.active >= 0)
1633 tls_error(US"STARTTLS received after TLS started", "", NULL);
1634 smtp_printf("554 Already in TLS\r\n");
1638 /* Initialize the library. If it fails, it will already have logged the error
1639 and sent an SMTP response. */
1641 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1643 rc = tls_init(NULL, tls_certificate, tls_privatekey,
1644 NULL, tls_verify_certificates, tls_crl,
1645 require_ciphers, &state);
1646 if (rc != OK) return rc;
1648 /* If this is a host for which certificate verification is mandatory or
1649 optional, set up appropriately. */
1651 if (verify_check_host(&tls_verify_hosts) == OK)
1654 debug_printf("TLS: a client certificate will be required.\n");
1655 state->verify_requirement = VERIFY_REQUIRED;
1656 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1658 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1661 debug_printf("TLS: a client certificate will be requested but not required.\n");
1662 state->verify_requirement = VERIFY_OPTIONAL;
1663 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1668 debug_printf("TLS: a client certificate will not be requested.\n");
1669 state->verify_requirement = VERIFY_NONE;
1670 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1673 #ifdef EXPERIMENTAL_EVENT
1676 state->event_action = event_action;
1677 gnutls_session_set_ptr(state->session, state);
1678 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1682 /* Register SNI handling; always, even if not in tls_certificate, so that the
1683 expansion variable $tls_sni is always available. */
1685 gnutls_handshake_set_post_client_hello_function(state->session,
1686 exim_sni_handling_cb);
1688 /* Set context and tell client to go ahead, except in the case of TLS startup
1689 on connection, where outputting anything now upsets the clients and tends to
1690 make them disconnect. We need to have an explicit fflush() here, to force out
1691 the response. Other smtp_printf() calls do not need it, because in non-TLS
1692 mode, the fflush() happens when smtp_getc() is called. */
1694 if (!state->tlsp->on_connect)
1696 smtp_printf("220 TLS go ahead\r\n");
1700 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1701 that the GnuTLS library doesn't. */
1703 gnutls_transport_set_ptr2(state->session,
1704 (gnutls_transport_ptr)(long) fileno(smtp_in),
1705 (gnutls_transport_ptr)(long) fileno(smtp_out));
1706 state->fd_in = fileno(smtp_in);
1707 state->fd_out = fileno(smtp_out);
1709 sigalrm_seen = FALSE;
1710 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1713 rc = gnutls_handshake(state->session);
1714 } while ((rc == GNUTLS_E_AGAIN) ||
1715 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1718 if (rc != GNUTLS_E_SUCCESS)
1720 tls_error(US"gnutls_handshake",
1721 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
1722 /* It seems that, except in the case of a timeout, we have to close the
1723 connection right here; otherwise if the other end is running OpenSSL it hangs
1724 until the server times out. */
1728 (void)fclose(smtp_out);
1729 (void)fclose(smtp_in);
1735 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1737 /* Verify after the fact */
1739 if ( state->verify_requirement != VERIFY_NONE
1740 && !verify_certificate(state, &error))
1742 if (state->verify_requirement != VERIFY_OPTIONAL)
1744 tls_error(US"certificate verification failed", error, NULL);
1748 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1752 /* Figure out peer DN, and if authenticated, etc. */
1754 rc = peer_status(state);
1755 if (rc != OK) return rc;
1757 /* Sets various Exim expansion variables; always safe within server */
1759 extract_exim_vars_from_tls_state(state);
1761 /* TLS has been set up. Adjust the input functions to read via TLS,
1762 and initialize appropriately. */
1764 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1766 receive_getc = tls_getc;
1767 receive_ungetc = tls_ungetc;
1768 receive_feof = tls_feof;
1769 receive_ferror = tls_ferror;
1770 receive_smtp_buffered = tls_smtp_buffered;
1779 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
1780 smtp_transport_options_block * ob)
1782 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
1784 state->exp_tls_verify_cert_hostnames = host->name;
1786 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
1787 state->exp_tls_verify_cert_hostnames);
1792 /*************************************************
1793 * Start a TLS session in a client *
1794 *************************************************/
1796 /* Called from the smtp transport after STARTTLS has been accepted.
1799 fd the fd of the connection
1800 host connected host (for messages)
1801 addr the first address (not used)
1802 tb transport (always smtp)
1804 Returns: OK/DEFER/FAIL (because using common functions),
1805 but for a client, DEFER and FAIL have the same meaning
1809 tls_client_start(int fd, host_item *host,
1810 address_item *addr ARG_UNUSED,
1811 transport_instance *tb
1812 #ifdef EXPERIMENTAL_DANE
1813 , dne_answer * unused_tlsa_dnsa
1817 smtp_transport_options_block *ob =
1818 (smtp_transport_options_block *)tb->options_block;
1821 exim_gnutls_state_st *state = NULL;
1822 #ifndef DISABLE_OCSP
1824 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
1825 BOOL request_ocsp = require_ocsp ? TRUE
1826 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
1829 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
1831 if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
1832 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
1833 ob->tls_require_ciphers, &state)) != OK)
1837 int dh_min_bits = ob->tls_dh_min_bits;
1838 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1841 debug_printf("WARNING: tls_dh_min_bits far too low,"
1842 " clamping %d up to %d\n",
1843 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1844 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1847 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
1848 " acceptable bits to %d\n",
1850 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1853 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
1854 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
1855 the specified host patterns if one of them is defined */
1857 if ( ( state->exp_tls_verify_certificates
1858 && !ob->tls_verify_hosts
1859 && !ob->tls_try_verify_hosts
1861 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
1864 tls_client_setup_hostname_checks(host, state, ob);
1866 debug_printf("TLS: server certificate verification required.\n");
1867 state->verify_requirement = VERIFY_REQUIRED;
1868 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1870 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
1872 tls_client_setup_hostname_checks(host, state, ob);
1874 debug_printf("TLS: server certificate verification optional.\n");
1875 state->verify_requirement = VERIFY_OPTIONAL;
1876 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1881 debug_printf("TLS: server certificate verification not required.\n");
1882 state->verify_requirement = VERIFY_NONE;
1883 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1886 #ifndef DISABLE_OCSP
1887 /* supported since GnuTLS 3.1.3 */
1890 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
1891 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
1892 NULL, 0, NULL)) != OK)
1893 return tls_error(US"cert-status-req",
1894 gnutls_strerror(rc), state->host);
1895 tls_out.ocsp = OCSP_NOT_RESP;
1899 #ifdef EXPERIMENTAL_EVENT
1900 if (tb->event_action)
1902 state->event_action = tb->event_action;
1903 gnutls_session_set_ptr(state->session, state);
1904 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1908 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)(long) fd);
1912 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
1913 /* There doesn't seem to be a built-in timeout on connection. */
1915 sigalrm_seen = FALSE;
1916 alarm(ob->command_timeout);
1919 rc = gnutls_handshake(state->session);
1920 } while ((rc == GNUTLS_E_AGAIN) ||
1921 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1924 if (rc != GNUTLS_E_SUCCESS)
1925 return tls_error(US"gnutls_handshake",
1926 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1928 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1932 if (state->verify_requirement != VERIFY_NONE &&
1933 !verify_certificate(state, &error))
1934 return tls_error(US"certificate verification failed", error, state->host);
1936 #ifndef DISABLE_OCSP
1941 gnutls_datum_t stapling;
1942 gnutls_ocsp_resp_t resp;
1943 gnutls_datum_t printed;
1944 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
1945 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
1946 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
1947 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
1950 debug_printf("%.4096s", printed.data);
1951 gnutls_free(printed.data);
1954 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host);
1957 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
1959 tls_out.ocsp = OCSP_FAILED;
1960 return tls_error(US"certificate status check failed", NULL, state->host);
1962 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
1963 tls_out.ocsp = OCSP_VFIED;
1967 /* Figure out peer DN, and if authenticated, etc. */
1969 if ((rc = peer_status(state)) != OK)
1972 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
1974 extract_exim_vars_from_tls_state(state);
1982 /*************************************************
1983 * Close down a TLS session *
1984 *************************************************/
1986 /* This is also called from within a delivery subprocess forked from the
1987 daemon, to shut down the TLS library, without actually doing a shutdown (which
1988 would tamper with the TLS session in the parent process).
1990 Arguments: TRUE if gnutls_bye is to be called
1995 tls_close(BOOL is_server, BOOL shutdown)
1997 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
1999 if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
2003 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
2004 gnutls_bye(state->session, GNUTLS_SHUT_WR);
2007 gnutls_deinit(state->session);
2009 state->tlsp->active = -1;
2010 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2012 if ((state_server.session == NULL) && (state_client.session == NULL))
2014 gnutls_global_deinit();
2015 exim_gnutls_base_init_done = FALSE;
2023 /*************************************************
2024 * TLS version of getc *
2025 *************************************************/
2027 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2028 it refills the buffer via the GnuTLS reading function.
2029 Only used by the server-side TLS.
2031 This feeds DKIM and should be used for all message-body reads.
2034 Returns: the next character or EOF
2040 exim_gnutls_state_st *state = &state_server;
2041 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2045 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2046 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2048 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2049 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2050 ssl_xfer_buffer_size);
2053 /* A zero-byte return appears to mean that the TLS session has been
2054 closed down, not that the socket itself has been closed down. Revert to
2055 non-TLS handling. */
2059 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2061 receive_getc = smtp_getc;
2062 receive_ungetc = smtp_ungetc;
2063 receive_feof = smtp_feof;
2064 receive_ferror = smtp_ferror;
2065 receive_smtp_buffered = smtp_buffered;
2067 gnutls_deinit(state->session);
2068 state->session = NULL;
2069 state->tlsp->active = -1;
2070 state->tlsp->bits = 0;
2071 state->tlsp->certificate_verified = FALSE;
2072 tls_channelbinding_b64 = NULL;
2073 state->tlsp->cipher = NULL;
2074 state->tlsp->peercert = NULL;
2075 state->tlsp->peerdn = NULL;
2080 /* Handle genuine errors */
2082 else if (inbytes < 0)
2084 record_io_error(state, (int) inbytes, US"recv", NULL);
2085 state->xfer_error = 1;
2088 #ifndef DISABLE_DKIM
2089 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2091 state->xfer_buffer_hwm = (int) inbytes;
2092 state->xfer_buffer_lwm = 0;
2095 /* Something in the buffer; return next uschar */
2097 return state->xfer_buffer[state->xfer_buffer_lwm++];
2103 /*************************************************
2104 * Read bytes from TLS channel *
2105 *************************************************/
2107 /* This does not feed DKIM, so if the caller uses this for reading message body,
2108 then the caller must feed DKIM.
2114 Returns: the number of bytes read
2115 -1 after a failed read
2119 tls_read(BOOL is_server, uschar *buff, size_t len)
2121 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2127 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2129 debug_printf("*** PROBABLY A BUG *** " \
2130 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2131 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2134 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2135 state->session, buff, len);
2137 inbytes = gnutls_record_recv(state->session, buff, len);
2138 if (inbytes > 0) return inbytes;
2141 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2143 else record_io_error(state, (int)inbytes, US"recv", NULL);
2151 /*************************************************
2152 * Write bytes down TLS channel *
2153 *************************************************/
2157 is_server channel specifier
2161 Returns: the number of bytes after a successful write,
2162 -1 after a failed write
2166 tls_write(BOOL is_server, const uschar *buff, size_t len)
2170 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2172 DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
2175 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2177 outbytes = gnutls_record_send(state->session, buff, left);
2179 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
2182 record_io_error(state, outbytes, US"send", NULL);
2187 record_io_error(state, 0, US"send", US"TLS channel closed on write");
2198 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2209 /*************************************************
2210 * Random number generation *
2211 *************************************************/
2213 /* Pseudo-random number generation. The result is not expected to be
2214 cryptographically strong but not so weak that someone will shoot themselves
2215 in the foot using it as a nonce in input in some email header scheme or
2216 whatever weirdness they'll twist this into. The result should handle fork()
2217 and avoid repeating sequences. OpenSSL handles that for us.
2221 Returns a random number in range [0, max-1]
2224 #ifdef HAVE_GNUTLS_RND
2226 vaguely_random_number(int max)
2231 uschar smallbuf[sizeof(r)];
2236 needed_len = sizeof(r);
2237 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2238 * asked for a number less than 10. */
2239 for (r = max, i = 0; r; ++i)
2245 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2248 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2249 return vaguely_random_number_fallback(max);
2252 for (p = smallbuf; needed_len; --needed_len, ++p)
2258 /* We don't particularly care about weighted results; if someone wants
2259 * smooth distribution and cares enough then they should submit a patch then. */
2262 #else /* HAVE_GNUTLS_RND */
2264 vaguely_random_number(int max)
2266 return vaguely_random_number_fallback(max);
2268 #endif /* HAVE_GNUTLS_RND */
2273 /*************************************************
2274 * Let tls_require_ciphers be checked at startup *
2275 *************************************************/
2277 /* The tls_require_ciphers option, if set, must be something which the
2280 Returns: NULL on success, or error message
2284 tls_validate_require_cipher(void)
2287 uschar *expciphers = NULL;
2288 gnutls_priority_t priority_cache;
2291 #define validate_check_rc(Label) do { \
2292 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2293 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2294 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2296 if (exim_gnutls_base_init_done)
2297 log_write(0, LOG_MAIN|LOG_PANIC,
2298 "already initialised GnuTLS, Exim developer bug");
2300 #ifdef HAVE_GNUTLS_PKCS11
2301 if (!gnutls_allow_auto_pkcs11)
2303 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2304 validate_check_rc(US"gnutls_pkcs11_init");
2307 rc = gnutls_global_init();
2308 validate_check_rc(US"gnutls_global_init()");
2309 exim_gnutls_base_init_done = TRUE;
2311 if (!(tls_require_ciphers && *tls_require_ciphers))
2312 return_deinit(NULL);
2314 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2315 return_deinit(US"failed to expand tls_require_ciphers");
2317 if (!(expciphers && *expciphers))
2318 return_deinit(NULL);
2321 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2323 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2324 validate_check_rc(string_sprintf(
2325 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2326 expciphers, errpos - CS expciphers, errpos));
2328 #undef return_deinit
2329 #undef validate_check_rc
2330 gnutls_global_deinit();
2338 /*************************************************
2339 * Report the library versions. *
2340 *************************************************/
2342 /* See a description in tls-openssl.c for an explanation of why this exists.
2344 Arguments: a FILE* to print the results to
2349 tls_version_report(FILE *f)
2351 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2354 gnutls_check_version(NULL));
2359 /* End of tls-gnu.c */