1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2015 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42 /* needed to disable PKCS11 autoload unless requested */
43 #if GNUTLS_VERSION_NUMBER >= 0x020c00
44 # include <gnutls/pkcs11.h>
46 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
47 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50 #if GNUTLS_VERSION_NUMBER < 0x020a00 && defined(EXPERIMENTAL_EVENT)
51 # warning "GnuTLS library version too old; tls:cert event unsupported"
52 # undef EXPERIMENTAL_EVENT
54 #if GNUTLS_VERSION_NUMBER >= 0x030306
55 # define SUPPORT_CA_DIR
57 # undef SUPPORT_CA_DIR
59 #if GNUTLS_VERSION_NUMBER >= 0x030314
60 # define SUPPORT_SYSDEFAULT_CABUNDLE
64 # include <gnutls/ocsp.h>
70 gnutls_global_set_audit_log_function()
73 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
76 /* Local static variables for GnuTLS */
78 /* Values for verify_requirement */
80 enum peer_verify_requirement
81 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
83 /* This holds most state for server or client; with this, we can set up an
84 outbound TLS-enabled connection in an ACL callout, while not stomping all
85 over the TLS variables available for expansion.
87 Some of these correspond to variables in globals.c; those variables will
88 be set to point to content in one of these instances, as appropriate for
89 the stage of the process lifetime.
91 Not handled here: global tls_channelbinding_b64.
94 typedef struct exim_gnutls_state {
95 gnutls_session_t session;
96 gnutls_certificate_credentials_t x509_cred;
97 gnutls_priority_t priority_cache;
98 enum peer_verify_requirement verify_requirement;
101 BOOL peer_cert_verified;
102 BOOL trigger_sni_changes;
103 BOOL have_set_peerdn;
104 const struct host_item *host;
105 gnutls_x509_crt_t peercert;
108 uschar *received_sni;
110 const uschar *tls_certificate;
111 const uschar *tls_privatekey;
112 const uschar *tls_sni; /* client send only, not received */
113 const uschar *tls_verify_certificates;
114 const uschar *tls_crl;
115 const uschar *tls_require_ciphers;
117 uschar *exp_tls_certificate;
118 uschar *exp_tls_privatekey;
119 uschar *exp_tls_verify_certificates;
121 uschar *exp_tls_require_ciphers;
122 uschar *exp_tls_ocsp_file;
123 const uschar *exp_tls_verify_cert_hostnames;
124 #ifdef EXPERIMENTAL_EVENT
125 uschar *event_action;
128 tls_support *tlsp; /* set in tls_init() */
135 } exim_gnutls_state_st;
137 static const exim_gnutls_state_st exim_gnutls_state_init = {
138 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
139 NULL, NULL, NULL, NULL,
140 NULL, NULL, NULL, NULL, NULL, NULL,
141 NULL, NULL, NULL, NULL, NULL, NULL, NULL,
143 #ifdef EXPERIMENTAL_EVENT
150 /* Not only do we have our own APIs which don't pass around state, assuming
151 it's held in globals, GnuTLS doesn't appear to let us register callback data
152 for callbacks, or as part of the session, so we have to keep a "this is the
153 context we're currently dealing with" pointer and rely upon being
154 single-threaded to keep from processing data on an inbound TLS connection while
155 talking to another TLS connection for an outbound check. This does mean that
156 there's no way for heart-beats to be responded to, for the duration of the
158 XXX But see gnutls_session_get_ptr()
161 static exim_gnutls_state_st state_server, state_client;
163 /* dh_params are initialised once within the lifetime of a process using TLS;
164 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
165 don't want to repeat this. */
167 static gnutls_dh_params_t dh_server_params = NULL;
169 /* No idea how this value was chosen; preserving it. Default is 3600. */
171 static const int ssl_session_timeout = 200;
173 static const char * const exim_default_gnutls_priority = "NORMAL";
175 /* Guard library core initialisation */
177 static BOOL exim_gnutls_base_init_done = FALSE;
179 static BOOL gnutls_buggy_ocsp = FALSE;
182 /* ------------------------------------------------------------------------ */
185 #define MAX_HOST_LEN 255
187 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
188 the library logging; a value less than 0 disables the calls to set up logging
190 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
191 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
194 #ifndef EXIM_CLIENT_DH_MIN_BITS
195 # define EXIM_CLIENT_DH_MIN_BITS 1024
198 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
199 can ask for a bit-strength. Without that, we stick to the constant we had
201 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
202 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
205 #define exim_gnutls_err_check(Label) do { \
206 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
208 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
210 #if GNUTLS_VERSION_NUMBER >= 0x020c00
211 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
212 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
213 # define HAVE_GNUTLS_RND
214 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
215 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
216 * isn't available sometimes, so this needs to become a conditional
217 * compilation; the sanest way to deal with this being a problem on
218 * older OSes is to block it in the Local/Makefile with this compiler
220 # ifndef AVOID_GNUTLS_PKCS11
221 # define HAVE_GNUTLS_PKCS11
222 # endif /* AVOID_GNUTLS_PKCS11 */
228 /* ------------------------------------------------------------------------ */
229 /* Callback declarations */
231 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
232 static void exim_gnutls_logger_cb(int level, const char *message);
235 static int exim_sni_handling_cb(gnutls_session_t session);
238 static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
239 gnutls_datum_t * ocsp_response);
244 /* ------------------------------------------------------------------------ */
245 /* Static functions */
247 /*************************************************
249 *************************************************/
251 /* Called from lots of places when errors occur before actually starting to do
252 the TLS handshake, that is, while the session is still in clear. Always returns
253 DEFER for a server and FAIL for a client so that most calls can use "return
254 tls_error(...)" to do this processing and then give an appropriate return. A
255 single function is used for both server and client, because it is called from
256 some shared functions.
259 prefix text to include in the logged error
260 msg additional error string (may be NULL)
261 usually obtained from gnutls_strerror()
262 host NULL if setting up a server;
263 the connected host if setting up a client
265 Returns: OK/DEFER/FAIL
269 tls_error(const uschar *prefix, const char *msg, const host_item *host)
273 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s)%s%s",
274 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
279 uschar *conn_info = smtp_get_connection_info();
280 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
282 /* I'd like to get separated H= here, but too hard for now */
283 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
284 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
292 /*************************************************
293 * Deal with logging errors during I/O *
294 *************************************************/
296 /* We have to get the identity of the peer from saved data.
299 state the current GnuTLS exim state container
300 rc the GnuTLS error code, or 0 if it's a local error
301 when text identifying read or write
302 text local error text when ec is 0
308 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
312 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
313 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
314 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
316 msg = gnutls_strerror(rc);
318 tls_error(when, msg, state->host);
324 /*************************************************
325 * Set various Exim expansion vars *
326 *************************************************/
328 #define exim_gnutls_cert_err(Label) \
331 if (rc != GNUTLS_E_SUCCESS) \
333 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
334 (Label), gnutls_strerror(rc)); \
340 import_cert(const gnutls_datum * cert, gnutls_x509_crt_t * crtp)
344 rc = gnutls_x509_crt_init(crtp);
345 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
347 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
348 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
353 #undef exim_gnutls_cert_err
356 /* We set various Exim global variables from the state, once a session has
357 been established. With TLS callouts, may need to change this to stack
358 variables, or just re-call it with the server state after client callout
361 Make sure anything set here is unset in tls_getc().
365 tls_bits strength indicator
366 tls_certificate_verified bool indicator
367 tls_channelbinding_b64 for some SASL mechanisms
369 tls_peercert pointer to library internal
371 tls_sni a (UTF-8) string
372 tls_ourcert pointer to library internal
375 state the relevant exim_gnutls_state_st *
379 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
381 gnutls_cipher_algorithm_t cipher;
382 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
385 gnutls_datum_t channel;
387 tls_support * tlsp = state->tlsp;
389 tlsp->active = state->fd_out;
391 cipher = gnutls_cipher_get(state->session);
392 /* returns size in "bytes" */
393 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
395 tlsp->cipher = state->ciphersuite;
397 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
399 tlsp->certificate_verified = state->peer_cert_verified;
401 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
402 only available for use for authenticators while this TLS session is running. */
404 tls_channelbinding_b64 = NULL;
405 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
408 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
410 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
412 old_pool = store_pool;
413 store_pool = POOL_PERM;
414 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
415 store_pool = old_pool;
416 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
420 /* peercert is set in peer_status() */
421 tlsp->peerdn = state->peerdn;
422 tlsp->sni = state->received_sni;
424 /* record our certificate */
426 const gnutls_datum * cert = gnutls_certificate_get_ours(state->session);
427 gnutls_x509_crt_t crt;
429 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
436 /*************************************************
437 * Setup up DH parameters *
438 *************************************************/
440 /* Generating the D-H parameters may take a long time. They only need to
441 be re-generated every so often, depending on security policy. What we do is to
442 keep these parameters in a file in the spool directory. If the file does not
443 exist, we generate them. This means that it is easy to cause a regeneration.
445 The new file is written as a temporary file and renamed, so that an incomplete
446 file is never present. If two processes both compute some new parameters, you
447 waste a bit of effort, but it doesn't seem worth messing around with locking to
450 Returns: OK/DEFER/FAIL
457 unsigned int dh_bits;
459 uschar filename_buf[PATH_MAX];
460 uschar *filename = NULL;
462 uschar *exp_tls_dhparam;
463 BOOL use_file_in_spool = FALSE;
464 BOOL use_fixed_file = FALSE;
465 host_item *host = NULL; /* dummy for macros */
467 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
469 rc = gnutls_dh_params_init(&dh_server_params);
470 exim_gnutls_err_check(US"gnutls_dh_params_init");
475 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
478 if (!exp_tls_dhparam)
480 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
481 m.data = US std_dh_prime_default();
482 m.size = Ustrlen(m.data);
484 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
485 use_file_in_spool = TRUE;
486 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
488 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
491 else if (exp_tls_dhparam[0] != '/')
493 m.data = US std_dh_prime_named(exp_tls_dhparam);
495 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
496 m.size = Ustrlen(m.data);
500 use_fixed_file = TRUE;
501 filename = exp_tls_dhparam;
506 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
507 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
508 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
512 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
513 /* If you change this constant, also change dh_param_fn_ext so that we can use a
514 different filename and ensure we have sufficient bits. */
515 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
517 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
519 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
522 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
524 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
528 /* Some clients have hard-coded limits. */
529 if (dh_bits > tls_dh_max_bits)
532 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
534 dh_bits = tls_dh_max_bits;
537 if (use_file_in_spool)
539 if (!string_format(filename_buf, sizeof(filename_buf),
540 "%s/gnutls-params-%d", spool_directory, dh_bits))
541 return tls_error(US"overlong filename", NULL, NULL);
542 filename = filename_buf;
545 /* Open the cache file for reading and if successful, read it and set up the
548 fd = Uopen(filename, O_RDONLY, 0);
555 if (fstat(fd, &statbuf) < 0) /* EIO */
559 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
561 if (!S_ISREG(statbuf.st_mode))
564 return tls_error(US"TLS cache not a file", NULL, NULL);
566 fp = fdopen(fd, "rb");
571 return tls_error(US"fdopen(TLS cache stat fd) failed",
572 strerror(saved_errno), NULL);
575 m.size = statbuf.st_size;
576 m.data = malloc(m.size);
580 return tls_error(US"malloc failed", strerror(errno), NULL);
582 sz = fread(m.data, m.size, 1, fp);
588 return tls_error(US"fread failed", strerror(saved_errno), NULL);
592 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
594 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
595 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
598 /* If the file does not exist, fall through to compute new data and cache it.
599 If there was any other opening error, it is serious. */
601 else if (errno == ENOENT)
605 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
608 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
611 /* If ret < 0, either the cache file does not exist, or the data it contains
612 is not useful. One particular case of this is when upgrading from an older
613 release of Exim in which the data was stored in a different format. We don't
614 try to be clever and support both formats; we just regenerate new data in this
620 unsigned int dh_bits_gen = dh_bits;
622 if ((PATH_MAX - Ustrlen(filename)) < 10)
623 return tls_error(US"Filename too long to generate replacement",
626 temp_fn = string_copy(US "%s.XXXXXXX");
627 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
629 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
630 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
632 /* GnuTLS overshoots!
633 * If we ask for 2236, we might get 2237 or more.
634 * But there's no way to ask GnuTLS how many bits there really are.
635 * We can ask how many bits were used in a TLS session, but that's it!
636 * The prime itself is hidden behind too much abstraction.
637 * So we ask for less, and proceed on a wing and a prayer.
638 * First attempt, subtracted 3 for 2233 and got 2240.
640 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
642 dh_bits_gen = dh_bits - 10;
644 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
649 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
651 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
652 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
654 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
655 and I confirmed that a NULL call to get the size first is how the GnuTLS
656 sample apps handle this. */
660 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
662 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
663 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
665 m.data = malloc(m.size);
667 return tls_error(US"memory allocation failed", strerror(errno), NULL);
668 /* this will return a size 1 less than the allocation size above */
669 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
671 if (rc != GNUTLS_E_SUCCESS)
674 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
676 m.size = sz; /* shrink by 1, probably */
678 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
682 return tls_error(US"TLS cache write D-H params failed",
683 strerror(errno), NULL);
686 sz = write_to_fd_buf(fd, US"\n", 1);
688 return tls_error(US"TLS cache write D-H params final newline failed",
689 strerror(errno), NULL);
693 return tls_error(US"TLS cache write close() failed",
694 strerror(errno), NULL);
696 if (Urename(temp_fn, filename) < 0)
697 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
698 temp_fn, filename), strerror(errno), NULL);
700 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
703 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
710 /*************************************************
711 * Variables re-expanded post-SNI *
712 *************************************************/
714 /* Called from both server and client code, via tls_init(), and also from
715 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
717 We can tell the two apart by state->received_sni being non-NULL in callback.
719 The callback should not call us unless state->trigger_sni_changes is true,
720 which we are responsible for setting on the first pass through.
723 state exim_gnutls_state_st *
725 Returns: OK/DEFER/FAIL
729 tls_expand_session_files(exim_gnutls_state_st *state)
733 const host_item *host = state->host; /* macro should be reconsidered? */
734 uschar *saved_tls_certificate = NULL;
735 uschar *saved_tls_privatekey = NULL;
736 uschar *saved_tls_verify_certificates = NULL;
737 uschar *saved_tls_crl = NULL;
740 /* We check for tls_sni *before* expansion. */
741 if (!host) /* server */
743 if (!state->received_sni)
745 if (state->tls_certificate &&
746 (Ustrstr(state->tls_certificate, US"tls_sni") ||
747 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
748 Ustrstr(state->tls_certificate, US"tls_out_sni")
751 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
752 state->trigger_sni_changes = TRUE;
757 /* useful for debugging */
758 saved_tls_certificate = state->exp_tls_certificate;
759 saved_tls_privatekey = state->exp_tls_privatekey;
760 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
761 saved_tls_crl = state->exp_tls_crl;
765 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
766 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
768 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
769 state members, assuming consistent naming; and expand_check() returns
770 false if expansion failed, unless expansion was forced to fail. */
772 /* check if we at least have a certificate, before doing expensive
775 if (!expand_check_tlsvar(tls_certificate))
778 /* certificate is mandatory in server, optional in client */
780 if ((state->exp_tls_certificate == NULL) ||
781 (*state->exp_tls_certificate == '\0'))
784 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
786 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
789 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
792 /* tls_privatekey is optional, defaulting to same file as certificate */
794 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
796 state->tls_privatekey = state->tls_certificate;
797 state->exp_tls_privatekey = state->exp_tls_certificate;
801 if (state->exp_tls_certificate && *state->exp_tls_certificate)
803 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
804 state->exp_tls_certificate, state->exp_tls_privatekey);
806 if (state->received_sni)
808 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
809 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
811 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
815 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
819 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
820 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
821 GNUTLS_X509_FMT_PEM);
822 exim_gnutls_err_check(
823 string_sprintf("cert/key setup: cert=%s key=%s",
824 state->exp_tls_certificate, state->exp_tls_privatekey));
825 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
826 } /* tls_certificate */
829 /* Set the OCSP stapling server info */
832 if ( !host /* server */
836 if (gnutls_buggy_ocsp)
838 DEBUG(D_tls) debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
842 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file",
843 &state->exp_tls_ocsp_file))
846 /* Use the full callback method for stapling just to get observability.
847 More efficient would be to read the file once only, if it never changed
848 (due to SNI). Would need restart on file update, or watch datestamp. */
850 gnutls_certificate_set_ocsp_status_request_function(state->x509_cred,
851 server_ocsp_stapling_cb, state->exp_tls_ocsp_file);
853 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", state->exp_tls_ocsp_file);
859 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
860 provided. Experiment shows that, if the certificate file is empty, an unhelpful
861 error message is provided. However, if we just refrain from setting anything up
862 in that case, certificate verification fails, which seems to be the correct
865 if (state->tls_verify_certificates && *state->tls_verify_certificates)
867 if (!expand_check_tlsvar(tls_verify_certificates))
869 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
870 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
871 state->exp_tls_verify_certificates = NULL;
873 if (state->tls_crl && *state->tls_crl)
874 if (!expand_check_tlsvar(tls_crl))
877 if (!(state->exp_tls_verify_certificates &&
878 *state->exp_tls_verify_certificates))
881 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
882 /* With no tls_verify_certificates, we ignore tls_crl too */
889 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
893 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
894 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
895 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
899 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
901 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
902 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
907 #ifndef SUPPORT_CA_DIR
908 /* The test suite passes in /dev/null; we could check for that path explicitly,
909 but who knows if someone has some weird FIFO which always dumps some certs, or
910 other weirdness. The thing we really want to check is that it's not a
911 directory, since while OpenSSL supports that, GnuTLS does not.
912 So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
913 if (S_ISDIR(statbuf.st_mode))
916 debug_printf("verify certificates path is a dir: \"%s\"\n",
917 state->exp_tls_verify_certificates);
918 log_write(0, LOG_MAIN|LOG_PANIC,
919 "tls_verify_certificates \"%s\" is a directory",
920 state->exp_tls_verify_certificates);
925 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
926 state->exp_tls_verify_certificates, statbuf.st_size);
928 if (statbuf.st_size == 0)
931 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
937 #ifdef SUPPORT_CA_DIR
938 (statbuf.st_mode & S_IFMT) == S_IFDIR
940 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
941 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
944 gnutls_certificate_set_x509_trust_file(state->x509_cred,
945 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
951 exim_gnutls_err_check(US"setting certificate trust");
953 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
955 if (state->tls_crl && *state->tls_crl &&
956 state->exp_tls_crl && *state->exp_tls_crl)
958 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
959 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
960 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
964 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
966 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
975 /*************************************************
976 * Set X.509 state variables *
977 *************************************************/
979 /* In GnuTLS, the registered cert/key are not replaced by a later
980 set of a cert/key, so for SNI support we need a whole new x509_cred
981 structure. Which means various other non-re-expanded pieces of state
982 need to be re-set in the new struct, so the setting logic is pulled
986 state exim_gnutls_state_st *
988 Returns: OK/DEFER/FAIL
992 tls_set_remaining_x509(exim_gnutls_state_st *state)
995 const host_item *host = state->host; /* macro should be reconsidered? */
997 /* Create D-H parameters, or read them from the cache file. This function does
998 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
999 client-side params. */
1003 if (!dh_server_params)
1005 rc = init_server_dh();
1006 if (rc != OK) return rc;
1008 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1011 /* Link the credentials to the session. */
1013 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1014 exim_gnutls_err_check(US"gnutls_credentials_set");
1019 /*************************************************
1020 * Initialize for GnuTLS *
1021 *************************************************/
1025 tls_is_buggy_ocsp(void)
1028 uschar maj, mid, mic;
1030 s = CUS gnutls_check_version(NULL);
1034 while (*s && *s != '.') s++;
1035 mid = atoi(CCS ++s);
1042 while (*s && *s != '.') s++;
1043 mic = atoi(CCS ++s);
1044 return mic <= (mid == 3 ? 16 : 3);
1052 /* Called from both server and client code. In the case of a server, errors
1053 before actual TLS negotiation return DEFER.
1056 host connected host, if client; NULL if server
1057 certificate certificate file
1058 privatekey private key file
1059 sni TLS SNI to send, sometimes when client; else NULL
1062 require_ciphers tls_require_ciphers setting
1063 caller_state returned state-info structure
1065 Returns: OK/DEFER/FAIL
1070 const host_item *host,
1071 const uschar *certificate,
1072 const uschar *privatekey,
1076 const uschar *require_ciphers,
1077 exim_gnutls_state_st **caller_state)
1079 exim_gnutls_state_st *state;
1084 BOOL want_default_priorities;
1086 if (!exim_gnutls_base_init_done)
1088 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1090 #ifdef HAVE_GNUTLS_PKCS11
1091 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1092 which loads modules from a config file, which sounds good and may be wanted
1093 by some sysadmin, but also means in common configurations that GNOME keyring
1094 environment variables are used and so breaks for users calling mailq.
1095 To prevent this, we init PKCS11 first, which is the documented approach. */
1096 if (!gnutls_allow_auto_pkcs11)
1098 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1099 exim_gnutls_err_check(US"gnutls_pkcs11_init");
1103 rc = gnutls_global_init();
1104 exim_gnutls_err_check(US"gnutls_global_init");
1106 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1109 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1110 /* arbitrarily chosen level; bump upto 9 for more */
1111 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1115 if ((gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1116 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1118 exim_gnutls_base_init_done = TRUE;
1123 state = &state_client;
1124 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1125 state->tlsp = &tls_out;
1126 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1127 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1131 state = &state_server;
1132 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1133 state->tlsp = &tls_in;
1134 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1135 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1137 exim_gnutls_err_check(US"gnutls_init");
1141 state->tls_certificate = certificate;
1142 state->tls_privatekey = privatekey;
1143 state->tls_require_ciphers = require_ciphers;
1144 state->tls_sni = sni;
1145 state->tls_verify_certificates = cas;
1146 state->tls_crl = crl;
1148 /* This handles the variables that might get re-expanded after TLS SNI;
1149 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1152 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1153 rc = tls_expand_session_files(state);
1154 if (rc != OK) return rc;
1156 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1157 requires a new structure afterwards. */
1159 rc = tls_set_remaining_x509(state);
1160 if (rc != OK) return rc;
1162 /* set SNI in client, only */
1165 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni))
1167 if (state->tlsp->sni && *state->tlsp->sni)
1170 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1171 sz = Ustrlen(state->tlsp->sni);
1172 rc = gnutls_server_name_set(state->session,
1173 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
1174 exim_gnutls_err_check(US"gnutls_server_name_set");
1177 else if (state->tls_sni)
1178 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1179 "have an SNI set for a client [%s]\n", state->tls_sni);
1181 /* This is the priority string support,
1182 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1183 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1184 This was backwards incompatible, but means Exim no longer needs to track
1185 all algorithms and provide string forms for them. */
1187 want_default_priorities = TRUE;
1189 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1191 if (!expand_check_tlsvar(tls_require_ciphers))
1193 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1195 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1196 state->exp_tls_require_ciphers);
1198 rc = gnutls_priority_init(&state->priority_cache,
1199 CS state->exp_tls_require_ciphers, &errpos);
1200 want_default_priorities = FALSE;
1201 p = state->exp_tls_require_ciphers;
1204 if (want_default_priorities)
1207 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1208 exim_default_gnutls_priority);
1209 rc = gnutls_priority_init(&state->priority_cache,
1210 exim_default_gnutls_priority, &errpos);
1211 p = US exim_default_gnutls_priority;
1214 exim_gnutls_err_check(string_sprintf(
1215 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1216 p, errpos - CS p, errpos));
1218 rc = gnutls_priority_set(state->session, state->priority_cache);
1219 exim_gnutls_err_check(US"gnutls_priority_set");
1221 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1223 /* Reduce security in favour of increased compatibility, if the admin
1224 decides to make that trade-off. */
1225 if (gnutls_compat_mode)
1227 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1228 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1229 gnutls_session_enable_compatibility_mode(state->session);
1231 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1235 *caller_state = state;
1241 /*************************************************
1242 * Extract peer information *
1243 *************************************************/
1245 /* Called from both server and client code.
1246 Only this is allowed to set state->peerdn and state->have_set_peerdn
1247 and we use that to detect double-calls.
1249 NOTE: the state blocks last while the TLS connection is up, which is fine
1250 for logging in the server side, but for the client side, we log after teardown
1251 in src/deliver.c. While the session is up, we can twist about states and
1252 repoint tls_* globals, but those variables used for logging or other variable
1253 expansion that happens _after_ delivery need to have a longer life-time.
1255 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1256 doing this more than once per generation of a state context. We set them in
1257 the state context, and repoint tls_* to them. After the state goes away, the
1258 tls_* copies of the pointers remain valid and client delivery logging is happy.
1260 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1264 state exim_gnutls_state_st *
1266 Returns: OK/DEFER/FAIL
1270 peer_status(exim_gnutls_state_st *state)
1272 uschar cipherbuf[256];
1273 const gnutls_datum *cert_list;
1275 unsigned int cert_list_size = 0;
1276 gnutls_protocol_t protocol;
1277 gnutls_cipher_algorithm_t cipher;
1278 gnutls_kx_algorithm_t kx;
1279 gnutls_mac_algorithm_t mac;
1280 gnutls_certificate_type_t ct;
1281 gnutls_x509_crt_t crt;
1285 if (state->have_set_peerdn)
1287 state->have_set_peerdn = TRUE;
1289 state->peerdn = NULL;
1292 cipher = gnutls_cipher_get(state->session);
1293 protocol = gnutls_protocol_get_version(state->session);
1294 mac = gnutls_mac_get(state->session);
1295 kx = gnutls_kx_get(state->session);
1297 string_format(cipherbuf, sizeof(cipherbuf),
1299 gnutls_protocol_get_name(protocol),
1300 gnutls_cipher_suite_get_name(kx, cipher, mac),
1301 (int) gnutls_cipher_get_key_size(cipher) * 8);
1303 /* I don't see a way that spaces could occur, in the current GnuTLS
1304 code base, but it was a concern in the old code and perhaps older GnuTLS
1305 releases did return "TLS 1.0"; play it safe, just in case. */
1306 for (p = cipherbuf; *p != '\0'; ++p)
1309 old_pool = store_pool;
1310 store_pool = POOL_PERM;
1311 state->ciphersuite = string_copy(cipherbuf);
1312 store_pool = old_pool;
1313 state->tlsp->cipher = state->ciphersuite;
1316 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1318 if (cert_list == NULL || cert_list_size == 0)
1320 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1321 cert_list, cert_list_size);
1322 if (state->verify_requirement >= VERIFY_REQUIRED)
1323 return tls_error(US"certificate verification failed",
1324 "no certificate received from peer", state->host);
1328 ct = gnutls_certificate_type_get(state->session);
1329 if (ct != GNUTLS_CRT_X509)
1331 const char *ctn = gnutls_certificate_type_get_name(ct);
1333 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1334 if (state->verify_requirement >= VERIFY_REQUIRED)
1335 return tls_error(US"certificate verification not possible, unhandled type",
1340 #define exim_gnutls_peer_err(Label) \
1342 if (rc != GNUTLS_E_SUCCESS) \
1344 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1345 (Label), gnutls_strerror(rc)); \
1346 if (state->verify_requirement >= VERIFY_REQUIRED) \
1347 return tls_error((Label), gnutls_strerror(rc), state->host); \
1352 rc = import_cert(&cert_list[0], &crt);
1353 exim_gnutls_peer_err(US"cert 0");
1355 state->tlsp->peercert = state->peercert = crt;
1358 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1359 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1361 exim_gnutls_peer_err(US"getting size for cert DN failed");
1362 return FAIL; /* should not happen */
1364 dn_buf = store_get_perm(sz);
1365 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1366 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1368 state->peerdn = dn_buf;
1371 #undef exim_gnutls_peer_err
1377 /*************************************************
1378 * Verify peer certificate *
1379 *************************************************/
1381 /* Called from both server and client code.
1382 *Should* be using a callback registered with
1383 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1384 the peer information, but that's too new for some OSes.
1387 state exim_gnutls_state_st *
1388 error where to put an error message
1391 FALSE if the session should be rejected
1392 TRUE if the cert is okay or we just don't care
1396 verify_certificate(exim_gnutls_state_st *state, const char **error)
1399 unsigned int verify;
1403 if ((rc = peer_status(state)) != OK)
1405 verify = GNUTLS_CERT_INVALID;
1406 *error = "certificate not supplied";
1409 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1411 /* Handle the result of verification. INVALID seems to be set as well
1412 as REVOKED, but leave the test for both. */
1415 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1418 state->peer_cert_verified = FALSE;
1420 *error = verify & GNUTLS_CERT_REVOKED
1421 ? "certificate revoked" : "certificate invalid";
1424 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1425 *error, state->peerdn ? state->peerdn : US"<unset>");
1427 if (state->verify_requirement >= VERIFY_REQUIRED)
1429 gnutls_alert_send(state->session,
1430 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1434 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1439 if (state->exp_tls_verify_cert_hostnames)
1442 const uschar * list = state->exp_tls_verify_cert_hostnames;
1444 while (name = string_nextinlist(&list, &sep, NULL, 0))
1445 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1450 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1451 if (state->verify_requirement >= VERIFY_REQUIRED)
1453 gnutls_alert_send(state->session,
1454 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1460 state->peer_cert_verified = TRUE;
1461 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1462 state->peerdn ? state->peerdn : US"<unset>");
1465 state->tlsp->peerdn = state->peerdn;
1473 /* ------------------------------------------------------------------------ */
1476 /* Logging function which can be registered with
1477 * gnutls_global_set_log_function()
1478 * gnutls_global_set_log_level() 0..9
1480 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1482 exim_gnutls_logger_cb(int level, const char *message)
1484 size_t len = strlen(message);
1487 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1490 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1491 message[len-1] == '\n' ? "" : "\n");
1496 /* Called after client hello, should handle SNI work.
1497 This will always set tls_sni (state->received_sni) if available,
1498 and may trigger presenting different certificates,
1499 if state->trigger_sni_changes is TRUE.
1501 Should be registered with
1502 gnutls_handshake_set_post_client_hello_function()
1504 "This callback must return 0 on success or a gnutls error code to terminate the
1507 For inability to get SNI information, we return 0.
1508 We only return non-zero if re-setup failed.
1509 Only used for server-side TLS.
1513 exim_sni_handling_cb(gnutls_session_t session)
1515 char sni_name[MAX_HOST_LEN];
1516 size_t data_len = MAX_HOST_LEN;
1517 exim_gnutls_state_st *state = &state_server;
1518 unsigned int sni_type;
1521 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1522 if (rc != GNUTLS_E_SUCCESS)
1525 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1526 debug_printf("TLS: no SNI presented in handshake.\n");
1528 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1529 gnutls_strerror(rc), rc);
1534 if (sni_type != GNUTLS_NAME_DNS)
1536 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1540 /* We now have a UTF-8 string in sni_name */
1541 old_pool = store_pool;
1542 store_pool = POOL_PERM;
1543 state->received_sni = string_copyn(US sni_name, data_len);
1544 store_pool = old_pool;
1546 /* We set this one now so that variable expansions below will work */
1547 state->tlsp->sni = state->received_sni;
1549 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1550 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1552 if (!state->trigger_sni_changes)
1555 rc = tls_expand_session_files(state);
1558 /* If the setup of certs/etc failed before handshake, TLS would not have
1559 been offered. The best we can do now is abort. */
1560 return GNUTLS_E_APPLICATION_ERROR_MIN;
1563 rc = tls_set_remaining_x509(state);
1564 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1571 #ifndef DISABLE_OCSP
1574 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1575 gnutls_datum_t * ocsp_response)
1579 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1581 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1583 tls_in.ocsp = OCSP_NOT_RESP;
1584 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1587 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1594 #ifdef EXPERIMENTAL_EVENT
1596 We use this callback to get observability and detail-level control
1597 for an exim TLS connection (either direction), raising a tls:cert event
1598 for each cert in the chain presented by the peer. Any event
1599 can deny verification.
1601 Return 0 for the handshake to continue or non-zero to terminate.
1605 verify_cb(gnutls_session_t session)
1607 const gnutls_datum * cert_list;
1608 unsigned int cert_list_size = 0;
1609 gnutls_x509_crt_t crt;
1612 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1614 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1616 while (cert_list_size--)
1618 rc = import_cert(&cert_list[cert_list_size], &crt);
1619 if (rc != GNUTLS_E_SUCCESS)
1621 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1622 cert_list_size, gnutls_strerror(rc));
1626 state->tlsp->peercert = crt;
1627 if ((yield = event_raise(state->event_action,
1628 US"tls:cert", string_sprintf("%d", cert_list_size))))
1630 log_write(0, LOG_MAIN,
1631 "SSL verify denied by event-action: depth=%d: %s",
1632 cert_list_size, yield);
1633 return 1; /* reject */
1635 state->tlsp->peercert = NULL;
1645 /* ------------------------------------------------------------------------ */
1646 /* Exported functions */
1651 /*************************************************
1652 * Start a TLS session in a server *
1653 *************************************************/
1655 /* This is called when Exim is running as a server, after having received
1656 the STARTTLS command. It must respond to that command, and then negotiate
1660 require_ciphers list of allowed ciphers or NULL
1662 Returns: OK on success
1663 DEFER for errors before the start of the negotiation
1664 FAIL for errors during the negotation; the server can't
1669 tls_server_start(const uschar *require_ciphers)
1673 exim_gnutls_state_st *state = NULL;
1675 /* Check for previous activation */
1676 if (tls_in.active >= 0)
1678 tls_error(US"STARTTLS received after TLS started", "", NULL);
1679 smtp_printf("554 Already in TLS\r\n");
1683 /* Initialize the library. If it fails, it will already have logged the error
1684 and sent an SMTP response. */
1686 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1688 rc = tls_init(NULL, tls_certificate, tls_privatekey,
1689 NULL, tls_verify_certificates, tls_crl,
1690 require_ciphers, &state);
1691 if (rc != OK) return rc;
1693 /* If this is a host for which certificate verification is mandatory or
1694 optional, set up appropriately. */
1696 if (verify_check_host(&tls_verify_hosts) == OK)
1699 debug_printf("TLS: a client certificate will be required.\n");
1700 state->verify_requirement = VERIFY_REQUIRED;
1701 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1703 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1706 debug_printf("TLS: a client certificate will be requested but not required.\n");
1707 state->verify_requirement = VERIFY_OPTIONAL;
1708 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1713 debug_printf("TLS: a client certificate will not be requested.\n");
1714 state->verify_requirement = VERIFY_NONE;
1715 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1718 #ifdef EXPERIMENTAL_EVENT
1721 state->event_action = event_action;
1722 gnutls_session_set_ptr(state->session, state);
1723 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1727 /* Register SNI handling; always, even if not in tls_certificate, so that the
1728 expansion variable $tls_sni is always available. */
1730 gnutls_handshake_set_post_client_hello_function(state->session,
1731 exim_sni_handling_cb);
1733 /* Set context and tell client to go ahead, except in the case of TLS startup
1734 on connection, where outputting anything now upsets the clients and tends to
1735 make them disconnect. We need to have an explicit fflush() here, to force out
1736 the response. Other smtp_printf() calls do not need it, because in non-TLS
1737 mode, the fflush() happens when smtp_getc() is called. */
1739 if (!state->tlsp->on_connect)
1741 smtp_printf("220 TLS go ahead\r\n");
1745 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1746 that the GnuTLS library doesn't. */
1748 gnutls_transport_set_ptr2(state->session,
1749 (gnutls_transport_ptr)(long) fileno(smtp_in),
1750 (gnutls_transport_ptr)(long) fileno(smtp_out));
1751 state->fd_in = fileno(smtp_in);
1752 state->fd_out = fileno(smtp_out);
1754 sigalrm_seen = FALSE;
1755 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1758 rc = gnutls_handshake(state->session);
1759 } while ((rc == GNUTLS_E_AGAIN) ||
1760 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1763 if (rc != GNUTLS_E_SUCCESS)
1765 tls_error(US"gnutls_handshake",
1766 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
1767 /* It seems that, except in the case of a timeout, we have to close the
1768 connection right here; otherwise if the other end is running OpenSSL it hangs
1769 until the server times out. */
1773 (void)fclose(smtp_out);
1774 (void)fclose(smtp_in);
1780 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1782 /* Verify after the fact */
1784 if ( state->verify_requirement != VERIFY_NONE
1785 && !verify_certificate(state, &error))
1787 if (state->verify_requirement != VERIFY_OPTIONAL)
1789 tls_error(US"certificate verification failed", error, NULL);
1793 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1797 /* Figure out peer DN, and if authenticated, etc. */
1799 rc = peer_status(state);
1800 if (rc != OK) return rc;
1802 /* Sets various Exim expansion variables; always safe within server */
1804 extract_exim_vars_from_tls_state(state);
1806 /* TLS has been set up. Adjust the input functions to read via TLS,
1807 and initialize appropriately. */
1809 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1811 receive_getc = tls_getc;
1812 receive_ungetc = tls_ungetc;
1813 receive_feof = tls_feof;
1814 receive_ferror = tls_ferror;
1815 receive_smtp_buffered = tls_smtp_buffered;
1824 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
1825 smtp_transport_options_block * ob)
1827 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
1829 state->exp_tls_verify_cert_hostnames =
1830 #ifdef EXPERIMENTAL_INTERNATIONAL
1831 string_domain_utf8_to_alabel(host->name, NULL);
1836 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
1837 state->exp_tls_verify_cert_hostnames);
1842 /*************************************************
1843 * Start a TLS session in a client *
1844 *************************************************/
1846 /* Called from the smtp transport after STARTTLS has been accepted.
1849 fd the fd of the connection
1850 host connected host (for messages)
1851 addr the first address (not used)
1852 tb transport (always smtp)
1854 Returns: OK/DEFER/FAIL (because using common functions),
1855 but for a client, DEFER and FAIL have the same meaning
1859 tls_client_start(int fd, host_item *host,
1860 address_item *addr ARG_UNUSED,
1861 transport_instance *tb
1862 #ifdef EXPERIMENTAL_DANE
1863 , dne_answer * unused_tlsa_dnsa
1867 smtp_transport_options_block *ob =
1868 (smtp_transport_options_block *)tb->options_block;
1871 exim_gnutls_state_st *state = NULL;
1872 #ifndef DISABLE_OCSP
1874 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
1875 BOOL request_ocsp = require_ocsp ? TRUE
1876 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
1879 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
1881 if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
1882 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
1883 ob->tls_require_ciphers, &state)) != OK)
1887 int dh_min_bits = ob->tls_dh_min_bits;
1888 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1891 debug_printf("WARNING: tls_dh_min_bits far too low,"
1892 " clamping %d up to %d\n",
1893 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1894 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1897 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
1898 " acceptable bits to %d\n",
1900 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1903 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
1904 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
1905 the specified host patterns if one of them is defined */
1907 if ( ( state->exp_tls_verify_certificates
1908 && !ob->tls_verify_hosts
1909 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
1911 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
1914 tls_client_setup_hostname_checks(host, state, ob);
1916 debug_printf("TLS: server certificate verification required.\n");
1917 state->verify_requirement = VERIFY_REQUIRED;
1918 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1920 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
1922 tls_client_setup_hostname_checks(host, state, ob);
1924 debug_printf("TLS: server certificate verification optional.\n");
1925 state->verify_requirement = VERIFY_OPTIONAL;
1926 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1931 debug_printf("TLS: server certificate verification not required.\n");
1932 state->verify_requirement = VERIFY_NONE;
1933 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1936 #ifndef DISABLE_OCSP
1937 /* supported since GnuTLS 3.1.3 */
1940 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
1941 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
1942 NULL, 0, NULL)) != OK)
1943 return tls_error(US"cert-status-req",
1944 gnutls_strerror(rc), state->host);
1945 tls_out.ocsp = OCSP_NOT_RESP;
1949 #ifdef EXPERIMENTAL_EVENT
1950 if (tb->event_action)
1952 state->event_action = tb->event_action;
1953 gnutls_session_set_ptr(state->session, state);
1954 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1958 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)(long) fd);
1962 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
1963 /* There doesn't seem to be a built-in timeout on connection. */
1965 sigalrm_seen = FALSE;
1966 alarm(ob->command_timeout);
1969 rc = gnutls_handshake(state->session);
1970 } while ((rc == GNUTLS_E_AGAIN) ||
1971 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1974 if (rc != GNUTLS_E_SUCCESS)
1975 return tls_error(US"gnutls_handshake",
1976 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1978 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1982 if (state->verify_requirement != VERIFY_NONE &&
1983 !verify_certificate(state, &error))
1984 return tls_error(US"certificate verification failed", error, state->host);
1986 #ifndef DISABLE_OCSP
1991 gnutls_datum_t stapling;
1992 gnutls_ocsp_resp_t resp;
1993 gnutls_datum_t printed;
1994 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
1995 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
1996 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
1997 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2000 debug_printf("%.4096s", printed.data);
2001 gnutls_free(printed.data);
2004 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host);
2007 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
2009 tls_out.ocsp = OCSP_FAILED;
2010 return tls_error(US"certificate status check failed", NULL, state->host);
2012 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
2013 tls_out.ocsp = OCSP_VFIED;
2017 /* Figure out peer DN, and if authenticated, etc. */
2019 if ((rc = peer_status(state)) != OK)
2022 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
2024 extract_exim_vars_from_tls_state(state);
2032 /*************************************************
2033 * Close down a TLS session *
2034 *************************************************/
2036 /* This is also called from within a delivery subprocess forked from the
2037 daemon, to shut down the TLS library, without actually doing a shutdown (which
2038 would tamper with the TLS session in the parent process).
2040 Arguments: TRUE if gnutls_bye is to be called
2045 tls_close(BOOL is_server, BOOL shutdown)
2047 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2049 if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
2053 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
2054 gnutls_bye(state->session, GNUTLS_SHUT_WR);
2057 gnutls_deinit(state->session);
2059 state->tlsp->active = -1;
2060 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2062 if ((state_server.session == NULL) && (state_client.session == NULL))
2064 gnutls_global_deinit();
2065 exim_gnutls_base_init_done = FALSE;
2073 /*************************************************
2074 * TLS version of getc *
2075 *************************************************/
2077 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2078 it refills the buffer via the GnuTLS reading function.
2079 Only used by the server-side TLS.
2081 This feeds DKIM and should be used for all message-body reads.
2084 Returns: the next character or EOF
2090 exim_gnutls_state_st *state = &state_server;
2091 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2095 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2096 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2098 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2099 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2100 ssl_xfer_buffer_size);
2103 /* A zero-byte return appears to mean that the TLS session has been
2104 closed down, not that the socket itself has been closed down. Revert to
2105 non-TLS handling. */
2109 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2111 receive_getc = smtp_getc;
2112 receive_ungetc = smtp_ungetc;
2113 receive_feof = smtp_feof;
2114 receive_ferror = smtp_ferror;
2115 receive_smtp_buffered = smtp_buffered;
2117 gnutls_deinit(state->session);
2118 state->session = NULL;
2119 state->tlsp->active = -1;
2120 state->tlsp->bits = 0;
2121 state->tlsp->certificate_verified = FALSE;
2122 tls_channelbinding_b64 = NULL;
2123 state->tlsp->cipher = NULL;
2124 state->tlsp->peercert = NULL;
2125 state->tlsp->peerdn = NULL;
2130 /* Handle genuine errors */
2132 else if (inbytes < 0)
2134 record_io_error(state, (int) inbytes, US"recv", NULL);
2135 state->xfer_error = 1;
2138 #ifndef DISABLE_DKIM
2139 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2141 state->xfer_buffer_hwm = (int) inbytes;
2142 state->xfer_buffer_lwm = 0;
2145 /* Something in the buffer; return next uschar */
2147 return state->xfer_buffer[state->xfer_buffer_lwm++];
2153 /*************************************************
2154 * Read bytes from TLS channel *
2155 *************************************************/
2157 /* This does not feed DKIM, so if the caller uses this for reading message body,
2158 then the caller must feed DKIM.
2164 Returns: the number of bytes read
2165 -1 after a failed read
2169 tls_read(BOOL is_server, uschar *buff, size_t len)
2171 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2177 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2179 debug_printf("*** PROBABLY A BUG *** " \
2180 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2181 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2184 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2185 state->session, buff, len);
2187 inbytes = gnutls_record_recv(state->session, buff, len);
2188 if (inbytes > 0) return inbytes;
2191 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2193 else record_io_error(state, (int)inbytes, US"recv", NULL);
2201 /*************************************************
2202 * Write bytes down TLS channel *
2203 *************************************************/
2207 is_server channel specifier
2211 Returns: the number of bytes after a successful write,
2212 -1 after a failed write
2216 tls_write(BOOL is_server, const uschar *buff, size_t len)
2220 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2222 DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
2225 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2227 outbytes = gnutls_record_send(state->session, buff, left);
2229 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
2232 record_io_error(state, outbytes, US"send", NULL);
2237 record_io_error(state, 0, US"send", US"TLS channel closed on write");
2248 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2259 /*************************************************
2260 * Random number generation *
2261 *************************************************/
2263 /* Pseudo-random number generation. The result is not expected to be
2264 cryptographically strong but not so weak that someone will shoot themselves
2265 in the foot using it as a nonce in input in some email header scheme or
2266 whatever weirdness they'll twist this into. The result should handle fork()
2267 and avoid repeating sequences. OpenSSL handles that for us.
2271 Returns a random number in range [0, max-1]
2274 #ifdef HAVE_GNUTLS_RND
2276 vaguely_random_number(int max)
2281 uschar smallbuf[sizeof(r)];
2286 needed_len = sizeof(r);
2287 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2288 * asked for a number less than 10. */
2289 for (r = max, i = 0; r; ++i)
2295 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2298 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2299 return vaguely_random_number_fallback(max);
2302 for (p = smallbuf; needed_len; --needed_len, ++p)
2308 /* We don't particularly care about weighted results; if someone wants
2309 * smooth distribution and cares enough then they should submit a patch then. */
2312 #else /* HAVE_GNUTLS_RND */
2314 vaguely_random_number(int max)
2316 return vaguely_random_number_fallback(max);
2318 #endif /* HAVE_GNUTLS_RND */
2323 /*************************************************
2324 * Let tls_require_ciphers be checked at startup *
2325 *************************************************/
2327 /* The tls_require_ciphers option, if set, must be something which the
2330 Returns: NULL on success, or error message
2334 tls_validate_require_cipher(void)
2337 uschar *expciphers = NULL;
2338 gnutls_priority_t priority_cache;
2341 #define validate_check_rc(Label) do { \
2342 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2343 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2344 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2346 if (exim_gnutls_base_init_done)
2347 log_write(0, LOG_MAIN|LOG_PANIC,
2348 "already initialised GnuTLS, Exim developer bug");
2350 #ifdef HAVE_GNUTLS_PKCS11
2351 if (!gnutls_allow_auto_pkcs11)
2353 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2354 validate_check_rc(US"gnutls_pkcs11_init");
2357 rc = gnutls_global_init();
2358 validate_check_rc(US"gnutls_global_init()");
2359 exim_gnutls_base_init_done = TRUE;
2361 if (!(tls_require_ciphers && *tls_require_ciphers))
2362 return_deinit(NULL);
2364 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2365 return_deinit(US"failed to expand tls_require_ciphers");
2367 if (!(expciphers && *expciphers))
2368 return_deinit(NULL);
2371 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2373 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2374 validate_check_rc(string_sprintf(
2375 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2376 expciphers, errpos - CS expciphers, errpos));
2378 #undef return_deinit
2379 #undef validate_check_rc
2380 gnutls_global_deinit();
2388 /*************************************************
2389 * Report the library versions. *
2390 *************************************************/
2392 /* See a description in tls-openssl.c for an explanation of why this exists.
2394 Arguments: a FILE* to print the results to
2399 tls_version_report(FILE *f)
2401 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2404 gnutls_check_version(NULL));
2409 /* End of tls-gnu.c */