1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
43 /* needed to disable PKCS11 autoload unless requested */
44 #if GNUTLS_VERSION_NUMBER >= 0x020c00
45 # include <gnutls/pkcs11.h>
46 # define SUPPORT_PARAM_TO_PK_BITS
48 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
52 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
53 # warning "GnuTLS library version too old; tls:cert event unsupported"
54 # define DISABLE_EVENT
56 #if GNUTLS_VERSION_NUMBER >= 0x030306
57 # define SUPPORT_CA_DIR
59 # undef SUPPORT_CA_DIR
61 #if GNUTLS_VERSION_NUMBER >= 0x030014
62 # define SUPPORT_SYSDEFAULT_CABUNDLE
64 #if GNUTLS_VERSION_NUMBER >= 0x030104
65 # define GNUTLS_CERT_VFY_STATUS_PRINT
67 #if GNUTLS_VERSION_NUMBER >= 0x030109
70 #if GNUTLS_VERSION_NUMBER >= 0x03010a
71 # define SUPPORT_GNUTLS_SESS_DESC
73 #if GNUTLS_VERSION_NUMBER >= 0x030300
74 # define GNUTLS_AUTO_GLOBAL_INIT
75 # define GNUTLS_AUTO_PKCS11_MANUAL
77 #if (GNUTLS_VERSION_NUMBER >= 0x030404) \
78 || (GNUTLS_VERSION_NUMBER >= 0x030311) && (GNUTLS_VERSION_NUMBER & 0xffff00 == 0x030300)
80 # define EXIM_HAVE_OCSP
83 #if GNUTLS_VERSION_NUMBER >= 0x030500
84 # define SUPPORT_GNUTLS_KEYLOG
86 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
87 # define SUPPORT_SRV_OCSP_STACK
89 #if GNUTLS_VERSION_NUMBER >= 0x030600
90 # define GNUTLS_AUTO_DHPARAMS
92 #if GNUTLS_VERSION_NUMBER >= 0x030603
93 # define EXIM_HAVE_TLS1_3
94 # define SUPPORT_GNUTLS_EXT_RAW_PARSE
95 # define GNUTLS_OCSP_STATUS_REQUEST_GET2
99 # if GNUTLS_VERSION_NUMBER >= 0x030000
100 # define DANESSL_USAGE_DANE_TA 2
101 # define DANESSL_USAGE_DANE_EE 3
103 # error GnuTLS version too early for DANE
105 # if GNUTLS_VERSION_NUMBER < 0x999999
106 # define GNUTLS_BROKEN_DANE_VALIDATION
110 #ifdef EXPERIMENTAL_TLS_RESUME
111 # if GNUTLS_VERSION_NUMBER < 0x030603
112 # error GNUTLS version too early for session-resumption
117 # include <gnutls/ocsp.h>
120 # include <gnutls/dane.h>
123 #include "tls-cipher-stdname.c"
130 # ifdef EXPERIMENTAL_TLS_RESUME
131 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
133 # ifdef EXIM_HAVE_TLS1_3
134 builtin_macro_create(US"_HAVE_TLS1_3");
136 # ifdef EXIM_HAVE_OCSP
137 builtin_macro_create(US"_HAVE_TLS_OCSP");
139 # ifdef SUPPORT_SRV_OCSP_STACK
140 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
149 gnutls_global_set_audit_log_function()
152 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
155 /* Local static variables for GnuTLS */
157 /* Values for verify_requirement */
159 enum peer_verify_requirement
160 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
162 /* This holds most state for server or client; with this, we can set up an
163 outbound TLS-enabled connection in an ACL callout, while not stomping all
164 over the TLS variables available for expansion.
166 Some of these correspond to variables in globals.c; those variables will
167 be set to point to content in one of these instances, as appropriate for
168 the stage of the process lifetime.
170 Not handled here: global tlsp->tls_channelbinding.
173 typedef struct exim_gnutls_state {
174 gnutls_session_t session;
175 gnutls_certificate_credentials_t x509_cred;
176 gnutls_priority_t priority_cache;
177 enum peer_verify_requirement verify_requirement;
181 BOOL peer_cert_verified:1;
182 BOOL peer_dane_verified:1;
183 BOOL trigger_sni_changes:1;
184 BOOL have_set_peerdn:1;
185 BOOL xfer_eof:1; /*XXX never gets set! */
191 const struct host_item *host; /* NULL if server */
192 gnutls_x509_crt_t peercert;
195 uschar *received_sni;
197 const uschar *tls_certificate;
198 const uschar *tls_privatekey;
199 const uschar *tls_sni; /* client send only, not received */
200 const uschar *tls_verify_certificates;
201 const uschar *tls_crl;
202 const uschar *tls_require_ciphers;
204 uschar *exp_tls_certificate;
205 uschar *exp_tls_privatekey;
206 uschar *exp_tls_verify_certificates;
208 uschar *exp_tls_require_ciphers;
209 const uschar *exp_tls_verify_cert_hostnames;
210 #ifndef DISABLE_EVENT
211 uschar *event_action;
214 char * const * dane_data;
215 const int * dane_data_len;
218 tls_support *tlsp; /* set in tls_init() */
223 } exim_gnutls_state_st;
225 static const exim_gnutls_state_st exim_gnutls_state_init = {
226 /* all elements not explicitly intialised here get 0/NULL/FALSE */
231 /* Not only do we have our own APIs which don't pass around state, assuming
232 it's held in globals, GnuTLS doesn't appear to let us register callback data
233 for callbacks, or as part of the session, so we have to keep a "this is the
234 context we're currently dealing with" pointer and rely upon being
235 single-threaded to keep from processing data on an inbound TLS connection while
236 talking to another TLS connection for an outbound check. This does mean that
237 there's no way for heart-beats to be responded to, for the duration of the
239 XXX But see gnutls_session_get_ptr()
242 static exim_gnutls_state_st state_server;
244 #ifndef GNUTLS_AUTO_DHPARAMS
245 /* dh_params are initialised once within the lifetime of a process using TLS;
246 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
247 don't want to repeat this. */
249 static gnutls_dh_params_t dh_server_params = NULL;
252 static int ssl_session_timeout = 7200; /* Two hours */
254 static const uschar * const exim_default_gnutls_priority = US"NORMAL";
256 /* Guard library core initialisation */
258 static BOOL exim_gnutls_base_init_done = FALSE;
261 static BOOL gnutls_buggy_ocsp = FALSE;
262 static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
265 #ifdef EXPERIMENTAL_TLS_RESUME
266 static gnutls_datum_t server_sessticket_key;
269 /* ------------------------------------------------------------------------ */
272 #define MAX_HOST_LEN 255
274 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
275 the library logging; a value less than 0 disables the calls to set up logging
276 callbacks. GNuTLS also looks for an environment variable - except not for
277 setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
278 Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
279 but the env var must be added to /etc/sudoers too. */
280 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
281 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
284 #ifndef EXIM_CLIENT_DH_MIN_BITS
285 # define EXIM_CLIENT_DH_MIN_BITS 1024
288 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
289 can ask for a bit-strength. Without that, we stick to the constant we had
291 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
292 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
295 #define expand_check_tlsvar(Varname, errstr) \
296 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
298 #if GNUTLS_VERSION_NUMBER >= 0x020c00
299 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
300 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
301 # define HAVE_GNUTLS_RND
302 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
303 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
304 * isn't available sometimes, so this needs to become a conditional
305 * compilation; the sanest way to deal with this being a problem on
306 * older OSes is to block it in the Local/Makefile with this compiler
308 # ifndef AVOID_GNUTLS_PKCS11
309 # define HAVE_GNUTLS_PKCS11
310 # endif /* AVOID_GNUTLS_PKCS11 */
316 /* ------------------------------------------------------------------------ */
317 /* Callback declarations */
319 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
320 static void exim_gnutls_logger_cb(int level, const char *message);
323 static int exim_sni_handling_cb(gnutls_session_t session);
325 #ifdef EXPERIMENTAL_TLS_RESUME
327 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
328 unsigned incoming, const gnutls_datum_t * msg);
332 /* Daemon one-time initialisation */
334 tls_daemon_init(void)
336 #ifdef EXPERIMENTAL_TLS_RESUME
337 /* We are dependent on the GnuTLS implementation of the Session Ticket
338 encryption; both the strength and the key rotation period. We hope that
339 the strength at least matches that of the ciphersuite (but GnuTLS does not
342 static BOOL once = FALSE;
345 gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
346 if (f.running_in_test_harness) ssl_session_timeout = 6;
350 /* ------------------------------------------------------------------------ */
351 /* Static functions */
353 /*************************************************
355 *************************************************/
357 /* Called from lots of places when errors occur before actually starting to do
358 the TLS handshake, that is, while the session is still in clear. Always returns
359 DEFER for a server and FAIL for a client so that most calls can use "return
360 tls_error(...)" to do this processing and then give an appropriate return. A
361 single function is used for both server and client, because it is called from
362 some shared functions.
365 prefix text to include in the logged error
366 msg additional error string (may be NULL)
367 usually obtained from gnutls_strerror()
368 host NULL if setting up a server;
369 the connected host if setting up a client
370 errstr pointer to returned error string
372 Returns: OK/DEFER/FAIL
376 tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
380 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
381 return host ? FAIL : DEFER;
386 tls_error_gnu(const uschar *prefix, int err, const host_item *host,
389 return tls_error(prefix, US gnutls_strerror(err), host, errstr);
393 tls_error_sys(const uschar *prefix, int err, const host_item *host,
396 return tls_error(prefix, US strerror(err), host, errstr);
400 /*************************************************
401 * Deal with logging errors during I/O *
402 *************************************************/
404 /* We have to get the identity of the peer from saved data.
407 state the current GnuTLS exim state container
408 rc the GnuTLS error code, or 0 if it's a local error
409 when text identifying read or write
410 text local error text when rc is 0
416 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
421 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
422 msg = string_sprintf("A TLS fatal alert has been received: %s",
423 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
425 msg = US gnutls_strerror(rc);
427 (void) tls_error(when, msg, state->host, &errstr);
430 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
431 state->host->name, state->host->address, errstr);
434 uschar * conn_info = smtp_get_connection_info();
435 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
436 /* I'd like to get separated H= here, but too hard for now */
437 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
444 /*************************************************
445 * Set various Exim expansion vars *
446 *************************************************/
448 #define exim_gnutls_cert_err(Label) \
451 if (rc != GNUTLS_E_SUCCESS) \
453 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
454 (Label), gnutls_strerror(rc)); \
460 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
464 rc = gnutls_x509_crt_init(crtp);
465 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
467 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
468 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
473 #undef exim_gnutls_cert_err
476 /* We set various Exim global variables from the state, once a session has
477 been established. With TLS callouts, may need to change this to stack
478 variables, or just re-call it with the server state after client callout
481 Make sure anything set here is unset in tls_getc().
485 tls_bits strength indicator
486 tls_certificate_verified bool indicator
487 tls_channelbinding for some SASL mechanisms
490 tls_peercert pointer to library internal
492 tls_sni a (UTF-8) string
493 tls_ourcert pointer to library internal
496 state the relevant exim_gnutls_state_st *
500 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
502 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
505 gnutls_datum_t channel;
507 tls_support * tlsp = state->tlsp;
509 tlsp->active.sock = state->fd_out;
510 tlsp->active.tls_ctx = state;
512 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
514 tlsp->certificate_verified = state->peer_cert_verified;
516 tlsp->dane_verified = state->peer_dane_verified;
519 /* note that tls_channelbinding is not saved to the spool file, since it's
520 only available for use for authenticators while this TLS session is running. */
522 tlsp->channelbinding = NULL;
523 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
526 if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
527 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
530 /* Declare the taintedness of the binding info. On server, untainted; on
531 client, tainted - being the Finish msg from the server. */
533 old_pool = store_pool;
534 store_pool = POOL_PERM;
535 tlsp->channelbinding = b64encode_taint(CUS channel.data, (int)channel.size,
537 store_pool = old_pool;
538 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage\n");
542 /* peercert is set in peer_status() */
543 tlsp->peerdn = state->peerdn;
544 tlsp->sni = state->received_sni;
546 /* record our certificate */
548 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
549 gnutls_x509_crt_t crt;
551 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
558 #ifndef GNUTLS_AUTO_DHPARAMS
559 /*************************************************
560 * Setup up DH parameters *
561 *************************************************/
563 /* Generating the D-H parameters may take a long time. They only need to
564 be re-generated every so often, depending on security policy. What we do is to
565 keep these parameters in a file in the spool directory. If the file does not
566 exist, we generate them. This means that it is easy to cause a regeneration.
568 The new file is written as a temporary file and renamed, so that an incomplete
569 file is never present. If two processes both compute some new parameters, you
570 waste a bit of effort, but it doesn't seem worth messing around with locking to
573 Returns: OK/DEFER/FAIL
577 init_server_dh(uschar ** errstr)
580 unsigned int dh_bits;
581 gnutls_datum_t m = {.data = NULL, .size = 0};
582 uschar filename_buf[PATH_MAX];
583 uschar *filename = NULL;
585 uschar *exp_tls_dhparam;
586 BOOL use_file_in_spool = FALSE;
587 host_item *host = NULL; /* dummy for macros */
589 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
591 if ((rc = gnutls_dh_params_init(&dh_server_params)))
592 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
594 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
597 if (!exp_tls_dhparam)
599 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
600 m.data = US std_dh_prime_default();
601 m.size = Ustrlen(m.data);
603 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
604 use_file_in_spool = TRUE;
605 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
607 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
610 else if (exp_tls_dhparam[0] != '/')
612 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
613 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
614 m.size = Ustrlen(m.data);
617 filename = exp_tls_dhparam;
621 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
622 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
623 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
627 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
628 /* If you change this constant, also change dh_param_fn_ext so that we can use a
629 different filename and ensure we have sufficient bits. */
631 if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
632 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
634 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
637 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
639 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
643 /* Some clients have hard-coded limits. */
644 if (dh_bits > tls_dh_max_bits)
647 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
649 dh_bits = tls_dh_max_bits;
652 if (use_file_in_spool)
654 if (!string_format(filename_buf, sizeof(filename_buf),
655 "%s/gnutls-params-%d", spool_directory, dh_bits))
656 return tls_error(US"overlong filename", NULL, NULL, errstr);
657 filename = filename_buf;
660 /* Open the cache file for reading and if successful, read it and set up the
663 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
669 if (fstat(fd, &statbuf) < 0) /* EIO */
673 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
675 if (!S_ISREG(statbuf.st_mode))
678 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
680 if (!(fp = fdopen(fd, "rb")))
684 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
685 saved_errno, NULL, errstr);
688 m.size = statbuf.st_size;
689 if (!(m.data = store_malloc(m.size)))
692 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
694 if (!(sz = fread(m.data, m.size, 1, fp)))
699 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
703 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
706 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
707 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
710 /* If the file does not exist, fall through to compute new data and cache it.
711 If there was any other opening error, it is serious. */
713 else if (errno == ENOENT)
717 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
720 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
723 /* If ret < 0, either the cache file does not exist, or the data it contains
724 is not useful. One particular case of this is when upgrading from an older
725 release of Exim in which the data was stored in a different format. We don't
726 try to be clever and support both formats; we just regenerate new data in this
732 unsigned int dh_bits_gen = dh_bits;
734 if ((PATH_MAX - Ustrlen(filename)) < 10)
735 return tls_error(US"Filename too long to generate replacement",
736 filename, NULL, errstr);
738 temp_fn = string_copy(US"%s.XXXXXXX");
739 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
740 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
741 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
743 /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But
744 there's no way to ask GnuTLS how many bits there really are. We can ask
745 how many bits were used in a TLS session, but that's it! The prime itself
746 is hidden behind too much abstraction. So we ask for less, and proceed on
747 a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */
749 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
751 dh_bits_gen = dh_bits - 10;
753 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
758 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
760 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
761 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
763 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
764 and I confirmed that a NULL call to get the size first is how the GnuTLS
765 sample apps handle this. */
769 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
770 GNUTLS_X509_FMT_PEM, m.data, &sz))
771 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
772 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
775 if (!(m.data = store_malloc(m.size)))
776 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
778 /* this will return a size 1 less than the allocation size above */
779 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
783 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
785 m.size = sz; /* shrink by 1, probably */
787 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
790 return tls_error_sys(US"TLS cache write D-H params failed",
791 errno, NULL, errstr);
794 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
795 return tls_error_sys(US"TLS cache write D-H params final newline failed",
796 errno, NULL, errstr);
798 if ((rc = close(fd)))
799 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
801 if (Urename(temp_fn, filename) < 0)
802 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
803 temp_fn, filename), errno, NULL, errstr);
805 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
808 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
816 /* Create and install a selfsigned certificate, for use in server mode */
819 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
821 gnutls_x509_crt_t cert = NULL;
823 gnutls_x509_privkey_t pkey = NULL;
824 const uschar * where;
827 where = US"initialising pkey";
828 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
830 where = US"initialising cert";
831 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
833 where = US"generating pkey";
834 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
835 #ifdef SUPPORT_PARAM_TO_PK_BITS
836 # ifndef GNUTLS_SEC_PARAM_MEDIUM
837 # define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
839 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
846 where = US"configuring cert";
848 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
849 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
850 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
851 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
852 || (rc = gnutls_x509_crt_set_key(cert, pkey))
854 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
855 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
856 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
857 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
858 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
859 GNUTLS_OID_X520_COMMON_NAME, 0,
860 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
864 where = US"signing cert";
865 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
867 where = US"installing selfsign cert";
869 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
875 if (cert) gnutls_x509_crt_deinit(cert);
876 if (pkey) gnutls_x509_privkey_deinit(pkey);
880 rc = tls_error_gnu(where, rc, NULL, errstr);
887 /* Add certificate and key, from files.
890 Zero or negative: good. Negate value for certificate index if < 0.
891 Greater than zero: FAIL or DEFER code.
895 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
896 uschar * certfile, uschar * keyfile, uschar ** errstr)
898 int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
899 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
901 return tls_error_gnu(
902 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
908 #if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
909 /* Load an OCSP proof from file for sending by the server. Called
910 on getting a status-request handshake message, for earlier versions
914 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
915 gnutls_datum_t * ocsp_response)
918 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
920 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
922 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
924 tls_in.ocsp = OCSP_NOT_RESP;
925 return GNUTLS_E_NO_CERTIFICATE_STATUS;
928 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
934 #ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
935 /* Make a note that we saw a status-request */
937 tls_server_clienthello_ext(void * ctx, unsigned tls_id,
938 const unsigned char *data, unsigned size)
940 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
941 if (tls_id == 5) /* status_request */
943 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
944 tls_in.ocsp = OCSP_NOT_RESP;
949 /* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
951 tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
952 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
954 /* Call fn for each extension seen. 3.6.3 onwards */
955 return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
956 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
960 /* Make a note that we saw a status-response */
962 tls_server_servercerts_ext(void * ctx, unsigned tls_id,
963 const unsigned char *data, unsigned size)
965 /* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
966 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
967 if (FALSE && tls_id == 5) /* status_request */
969 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
970 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
971 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
976 /* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
978 tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
979 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
981 /* Call fn for each extension seen. 3.6.3 onwards */
984 return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
989 /*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
990 "Handshake Protocol: Certificate" record.
991 So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
993 This is different to tls1.2 - where it is a separate record (wireshake term) / handshake message (gnutls term).
996 #if defined(EXPERIMENTAL_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
997 /* Callback for certificate-status, on server. We sent stapled OCSP. */
999 tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
1000 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
1002 DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
1003 #ifdef SUPPORT_SRV_OCSP_STACK
1004 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
1005 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
1007 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1012 /* Callback for handshake messages, on server */
1014 tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
1015 unsigned incoming, const gnutls_datum_t * msg)
1017 /* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
1020 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1021 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1022 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
1023 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1024 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
1026 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1027 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
1028 # ifdef EXPERIMENTAL_TLS_RESUME
1029 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1030 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
1039 #if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1041 tls_server_testharness_ocsp_fiddle(void)
1043 extern char ** environ;
1044 if (environ) for (uschar ** p = USS environ; *p; p++)
1045 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1047 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1048 exim_testharness_disable_ocsp_validity_check = TRUE;
1053 /*************************************************
1054 * Variables re-expanded post-SNI *
1055 *************************************************/
1057 /* Called from both server and client code, via tls_init(), and also from
1058 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1060 We can tell the two apart by state->received_sni being non-NULL in callback.
1062 The callback should not call us unless state->trigger_sni_changes is true,
1063 which we are responsible for setting on the first pass through.
1066 state exim_gnutls_state_st *
1067 errstr error string pointer
1069 Returns: OK/DEFER/FAIL
1073 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
1075 struct stat statbuf;
1077 const host_item *host = state->host; /* macro should be reconsidered? */
1078 uschar *saved_tls_certificate = NULL;
1079 uschar *saved_tls_privatekey = NULL;
1080 uschar *saved_tls_verify_certificates = NULL;
1081 uschar *saved_tls_crl = NULL;
1084 /* We check for tls_sni *before* expansion. */
1085 if (!host) /* server */
1086 if (!state->received_sni)
1088 if ( state->tls_certificate
1089 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1090 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1091 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1094 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
1095 state->trigger_sni_changes = TRUE;
1100 /* useful for debugging */
1101 saved_tls_certificate = state->exp_tls_certificate;
1102 saved_tls_privatekey = state->exp_tls_privatekey;
1103 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1104 saved_tls_crl = state->exp_tls_crl;
1107 if ((rc = gnutls_certificate_allocate_credentials(&state->x509_cred)))
1108 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
1111 #ifdef SUPPORT_SRV_OCSP_STACK
1112 gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
1114 # if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1115 if (!host && tls_ocsp_file)
1117 if (f.running_in_test_harness)
1118 tls_server_testharness_ocsp_fiddle();
1120 if (exim_testharness_disable_ocsp_validity_check)
1121 gnutls_certificate_set_flags(state->x509_cred,
1122 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1127 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
1128 state members, assuming consistent naming; and expand_check() returns
1129 false if expansion failed, unless expansion was forced to fail. */
1131 /* check if we at least have a certificate, before doing expensive
1134 if (!expand_check_tlsvar(tls_certificate, errstr))
1137 /* certificate is mandatory in server, optional in client */
1139 if ( !state->exp_tls_certificate
1140 || !*state->exp_tls_certificate
1143 return tls_install_selfsign(state, errstr);
1145 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
1147 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
1150 /* tls_privatekey is optional, defaulting to same file as certificate */
1152 if (!state->tls_privatekey || !*state->tls_privatekey)
1154 state->tls_privatekey = state->tls_certificate;
1155 state->exp_tls_privatekey = state->exp_tls_certificate;
1159 if (state->exp_tls_certificate && *state->exp_tls_certificate)
1161 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
1162 state->exp_tls_certificate, state->exp_tls_privatekey);
1164 if (state->received_sni)
1165 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1166 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1169 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
1173 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
1176 if (!host) /* server */
1178 const uschar * clist = state->exp_tls_certificate;
1179 const uschar * klist = state->exp_tls_privatekey;
1180 const uschar * olist;
1181 int csep = 0, ksep = 0, osep = 0, cnt = 0;
1182 uschar * cfile, * kfile, * ofile;
1183 #ifndef DISABLE_OCSP
1184 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1185 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1188 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
1193 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
1195 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1196 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
1197 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
1201 int gnutls_cert_index = -rc;
1202 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1203 gnutls_cert_index, cfile);
1205 #ifndef DISABLE_OCSP
1208 /* Set the OCSP stapling server info */
1209 if (gnutls_buggy_ocsp)
1212 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1214 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1216 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1217 gnutls_cert_index, ofile);
1218 # ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1219 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1221 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1224 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1226 ocsp_fmt = GNUTLS_X509_FMT_DER;
1230 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1231 state->x509_cred, CCS ofile, gnutls_cert_index,
1233 return tls_error_gnu(
1234 US"gnutls_certificate_set_ocsp_status_request_file2",
1237 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
1239 /* Arrange callbacks for OCSP request observability */
1241 gnutls_handshake_set_hook_function(state->session,
1242 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1245 # if defined(SUPPORT_SRV_OCSP_STACK)
1246 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1247 state->x509_cred, gnutls_cert_index,
1248 server_ocsp_stapling_cb, ofile)))
1249 return tls_error_gnu(
1250 US"gnutls_certificate_set_ocsp_status_request_function2",
1258 debug_printf("oops; multiple OCSP files not supported\n");
1261 gnutls_certificate_set_ocsp_status_request_function(
1262 state->x509_cred, server_ocsp_stapling_cb, ofile);
1264 # endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
1267 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1269 #endif /* DISABLE_OCSP */
1274 if (0 < (rc = tls_add_certfile(state, host,
1275 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1277 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1280 } /* tls_certificate */
1283 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1284 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1285 error message is provided. However, if we just refrain from setting anything up
1286 in that case, certificate verification fails, which seems to be the correct
1289 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1291 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
1293 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1294 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1295 state->exp_tls_verify_certificates = NULL;
1297 if (state->tls_crl && *state->tls_crl)
1298 if (!expand_check_tlsvar(tls_crl, errstr))
1301 if (!(state->exp_tls_verify_certificates &&
1302 *state->exp_tls_verify_certificates))
1305 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1306 /* With no tls_verify_certificates, we ignore tls_crl too */
1313 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1317 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1318 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1319 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1323 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1325 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
1326 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1331 #ifndef SUPPORT_CA_DIR
1332 /* The test suite passes in /dev/null; we could check for that path explicitly,
1333 but who knows if someone has some weird FIFO which always dumps some certs, or
1334 other weirdness. The thing we really want to check is that it's not a
1335 directory, since while OpenSSL supports that, GnuTLS does not.
1336 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1337 if (S_ISDIR(statbuf.st_mode))
1340 debug_printf("verify certificates path is a dir: \"%s\"\n",
1341 state->exp_tls_verify_certificates);
1342 log_write(0, LOG_MAIN|LOG_PANIC,
1343 "tls_verify_certificates \"%s\" is a directory",
1344 state->exp_tls_verify_certificates);
1349 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1350 state->exp_tls_verify_certificates, statbuf.st_size);
1352 if (statbuf.st_size == 0)
1355 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1361 #ifdef SUPPORT_CA_DIR
1362 (statbuf.st_mode & S_IFMT) == S_IFDIR
1364 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1365 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1368 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1369 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1371 #ifdef SUPPORT_CA_DIR
1372 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1373 when using the directory-of-certs config model. */
1375 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1376 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1381 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1383 debug_printf("Added %d certificate authorities.\n", cert_count);
1385 if (state->tls_crl && *state->tls_crl &&
1386 state->exp_tls_crl && *state->exp_tls_crl)
1388 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1389 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1390 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM)) < 0)
1391 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1392 cert_count, host, errstr);
1394 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1403 /*************************************************
1404 * Set X.509 state variables *
1405 *************************************************/
1407 /* In GnuTLS, the registered cert/key are not replaced by a later
1408 set of a cert/key, so for SNI support we need a whole new x509_cred
1409 structure. Which means various other non-re-expanded pieces of state
1410 need to be re-set in the new struct, so the setting logic is pulled
1414 state exim_gnutls_state_st *
1415 errstr error string pointer
1417 Returns: OK/DEFER/FAIL
1421 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1424 const host_item *host = state->host; /* macro should be reconsidered? */
1426 #ifndef GNUTLS_AUTO_DHPARAMS
1427 /* Create D-H parameters, or read them from the cache file. This function does
1428 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1429 client-side params. */
1433 if (!dh_server_params)
1434 if ((rc = init_server_dh(errstr)) != OK) return rc;
1436 /* Unnecessary & discouraged with 3.6.0 or later */
1437 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1441 /* Link the credentials to the session. */
1443 if ((rc = gnutls_credentials_set(state->session,
1444 GNUTLS_CRD_CERTIFICATE, state->x509_cred)))
1445 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1450 /*************************************************
1451 * Initialize for GnuTLS *
1452 *************************************************/
1455 #ifndef DISABLE_OCSP
1458 tls_is_buggy_ocsp(void)
1461 uschar maj, mid, mic;
1463 s = CUS gnutls_check_version(NULL);
1467 while (*s && *s != '.') s++;
1468 mid = atoi(CCS ++s);
1475 while (*s && *s != '.') s++;
1476 mic = atoi(CCS ++s);
1477 return mic <= (mid == 3 ? 16 : 3);
1486 /* Called from both server and client code. In the case of a server, errors
1487 before actual TLS negotiation return DEFER.
1490 host connected host, if client; NULL if server
1491 certificate certificate file
1492 privatekey private key file
1493 sni TLS SNI to send, sometimes when client; else NULL
1496 require_ciphers tls_require_ciphers setting
1497 caller_state returned state-info structure
1498 errstr error string pointer
1500 Returns: OK/DEFER/FAIL
1505 const host_item *host,
1506 const uschar *certificate,
1507 const uschar *privatekey,
1511 const uschar *require_ciphers,
1512 exim_gnutls_state_st **caller_state,
1516 exim_gnutls_state_st * state;
1519 const char * errpos;
1522 if (!exim_gnutls_base_init_done)
1524 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1526 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
1527 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1528 which loads modules from a config file, which sounds good and may be wanted
1529 by some sysadmin, but also means in common configurations that GNOME keyring
1530 environment variables are used and so breaks for users calling mailq.
1531 To prevent this, we init PKCS11 first, which is the documented approach. */
1532 if (!gnutls_allow_auto_pkcs11)
1533 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
1534 return tls_error_gnu(US"gnutls_pkcs11_init", rc, host, errstr);
1537 #ifndef GNUTLS_AUTO_GLOBAL_INIT
1538 if ((rc = gnutls_global_init()))
1539 return tls_error_gnu(US"gnutls_global_init", rc, host, errstr);
1542 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1545 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1546 /* arbitrarily chosen level; bump up to 9 for more */
1547 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1551 #ifndef DISABLE_OCSP
1552 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1553 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1556 exim_gnutls_base_init_done = TRUE;
1561 /* For client-side sessions we allocate a context. This lets us run
1562 several in parallel. */
1563 int old_pool = store_pool;
1564 store_pool = POOL_PERM;
1565 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
1566 store_pool = old_pool;
1568 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1570 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1571 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1575 state = &state_server;
1576 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1578 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1579 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1582 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
1586 state->tls_certificate = certificate;
1587 state->tls_privatekey = privatekey;
1588 state->tls_require_ciphers = require_ciphers;
1589 state->tls_sni = sni;
1590 state->tls_verify_certificates = cas;
1591 state->tls_crl = crl;
1593 /* This handles the variables that might get re-expanded after TLS SNI;
1594 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1597 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1598 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1600 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1601 requires a new structure afterwards. */
1603 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
1605 /* set SNI in client, only */
1608 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
1610 if (state->tlsp->sni && *state->tlsp->sni)
1613 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1614 sz = Ustrlen(state->tlsp->sni);
1615 if ((rc = gnutls_server_name_set(state->session,
1616 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
1617 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
1620 else if (state->tls_sni)
1621 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1622 "have an SNI set for a server [%s]\n", state->tls_sni);
1624 /* This is the priority string support,
1625 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1626 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1627 This was backwards incompatible, but means Exim no longer needs to track
1628 all algorithms and provide string forms for them. */
1631 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1633 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
1635 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1637 p = state->exp_tls_require_ciphers;
1638 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
1643 p = exim_default_gnutls_priority;
1645 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
1648 if ((rc = gnutls_priority_init(&state->priority_cache, CCS p, &errpos)))
1649 return tls_error_gnu(string_sprintf(
1650 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1651 p, errpos - CS p, errpos),
1654 if ((rc = gnutls_priority_set(state->session, state->priority_cache)))
1655 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
1657 /* This also sets the server ticket expiration time to the same, and
1658 the STEK rotation time to 3x. */
1660 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1662 /* Reduce security in favour of increased compatibility, if the admin
1663 decides to make that trade-off. */
1664 if (gnutls_compat_mode)
1666 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1667 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1668 gnutls_session_enable_compatibility_mode(state->session);
1670 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1674 *caller_state = state;
1680 /*************************************************
1681 * Extract peer information *
1682 *************************************************/
1684 static const uschar *
1685 cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
1686 gnutls_mac_algorithm_t mac)
1689 gnutls_kx_algorithm_t kx_i;
1690 gnutls_cipher_algorithm_t cipher_i;
1691 gnutls_mac_algorithm_t mac_i;
1694 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
1696 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
1697 return cipher_stdname(cs_id[0], cs_id[1]);
1703 /* Called from both server and client code.
1704 Only this is allowed to set state->peerdn and state->have_set_peerdn
1705 and we use that to detect double-calls.
1707 NOTE: the state blocks last while the TLS connection is up, which is fine
1708 for logging in the server side, but for the client side, we log after teardown
1709 in src/deliver.c. While the session is up, we can twist about states and
1710 repoint tls_* globals, but those variables used for logging or other variable
1711 expansion that happens _after_ delivery need to have a longer life-time.
1713 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1714 doing this more than once per generation of a state context. We set them in
1715 the state context, and repoint tls_* to them. After the state goes away, the
1716 tls_* copies of the pointers remain valid and client delivery logging is happy.
1718 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1722 state exim_gnutls_state_st *
1723 errstr pointer to error string
1725 Returns: OK/DEFER/FAIL
1729 peer_status(exim_gnutls_state_st * state, uschar ** errstr)
1731 gnutls_session_t session = state->session;
1732 const gnutls_datum_t * cert_list;
1734 unsigned int cert_list_size = 0;
1735 gnutls_protocol_t protocol;
1736 gnutls_cipher_algorithm_t cipher;
1737 gnutls_kx_algorithm_t kx;
1738 gnutls_mac_algorithm_t mac;
1739 gnutls_certificate_type_t ct;
1740 gnutls_x509_crt_t crt;
1744 if (state->have_set_peerdn)
1746 state->have_set_peerdn = TRUE;
1748 state->peerdn = NULL;
1751 cipher = gnutls_cipher_get(session);
1752 protocol = gnutls_protocol_get_version(session);
1753 mac = gnutls_mac_get(session);
1755 #ifdef GNUTLS_TLS1_3
1756 protocol >= GNUTLS_TLS1_3 ? 0 :
1758 gnutls_kx_get(session);
1760 old_pool = store_pool;
1762 tls_support * tlsp = state->tlsp;
1763 store_pool = POOL_PERM;
1765 #ifdef SUPPORT_GNUTLS_SESS_DESC
1768 uschar * s = US gnutls_session_get_desc(session), c;
1770 /* Nikos M suggests we use this by preference. It returns like:
1771 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
1773 For partial back-compat, put a colon after the TLS version, replace the
1774 )-( grouping with __, replace in-group - with _ and append the :keysize. */
1776 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
1778 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
1780 tlsp->ver = string_copyn(g->s, g->ptr);
1781 for (uschar * p = US tlsp->ver; *p; p++)
1782 if (*p == '-') { *p = '\0'; break; } /* TLS1.0-PKIX -> TLS1.0 */
1784 g = string_catn(g, US":", 1);
1785 if (*s) s++; /* now on _ between groups */
1788 for (*++s && ++s; (c = *s) && c != ')'; s++)
1789 g = string_catn(g, c == '-' ? US"_" : s, 1);
1790 /* now on ) closing group */
1791 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
1792 /* now on _ between groups */
1794 g = string_catn(g, US":", 1);
1795 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
1796 state->ciphersuite = string_from_gstring(g);
1799 state->ciphersuite = string_sprintf("%s:%s:%d",
1800 gnutls_protocol_get_name(protocol),
1801 gnutls_cipher_suite_get_name(kx, cipher, mac),
1802 (int) gnutls_cipher_get_key_size(cipher) * 8);
1804 /* I don't see a way that spaces could occur, in the current GnuTLS
1805 code base, but it was a concern in the old code and perhaps older GnuTLS
1806 releases did return "TLS 1.0"; play it safe, just in case. */
1808 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
1809 tlsp->ver = string_copyn(state->ciphersuite,
1810 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
1813 /* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
1815 tlsp->cipher = state->ciphersuite;
1816 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
1818 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
1820 store_pool = old_pool;
1823 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1825 if (!cert_list || cert_list_size == 0)
1827 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1828 cert_list, cert_list_size);
1829 if (state->verify_requirement >= VERIFY_REQUIRED)
1830 return tls_error(US"certificate verification failed",
1831 US"no certificate received from peer", state->host, errstr);
1835 if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
1837 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
1839 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1840 if (state->verify_requirement >= VERIFY_REQUIRED)
1841 return tls_error(US"certificate verification not possible, unhandled type",
1842 ctn, state->host, errstr);
1846 #define exim_gnutls_peer_err(Label) \
1848 if (rc != GNUTLS_E_SUCCESS) \
1850 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1851 (Label), gnutls_strerror(rc)); \
1852 if (state->verify_requirement >= VERIFY_REQUIRED) \
1853 return tls_error_gnu((Label), rc, state->host, errstr); \
1858 rc = import_cert(&cert_list[0], &crt);
1859 exim_gnutls_peer_err(US"cert 0");
1861 state->tlsp->peercert = state->peercert = crt;
1864 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1865 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1867 exim_gnutls_peer_err(US"getting size for cert DN failed");
1868 return FAIL; /* should not happen */
1870 dn_buf = store_get_perm(sz, TRUE); /* tainted */
1871 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1872 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1874 state->peerdn = dn_buf;
1877 #undef exim_gnutls_peer_err
1883 /*************************************************
1884 * Verify peer certificate *
1885 *************************************************/
1887 /* Called from both server and client code.
1888 *Should* be using a callback registered with
1889 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1890 the peer information, but that's too new for some OSes.
1893 state exim_gnutls_state_st *
1894 errstr where to put an error message
1897 FALSE if the session should be rejected
1898 TRUE if the cert is okay or we just don't care
1902 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
1907 DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
1909 rc = peer_status(state, errstr);
1911 if (state->verify_requirement == VERIFY_NONE)
1914 if (rc != OK || !state->peerdn)
1916 verify = GNUTLS_CERT_INVALID;
1917 *errstr = US"certificate not supplied";
1923 if (state->verify_requirement == VERIFY_DANE && state->host)
1925 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1926 including talking to a DNS resolver. But we want to do that bit ourselves
1927 as the testsuite intercepts and fakes its own DNS environment. */
1932 const gnutls_datum_t * certlist =
1933 gnutls_certificate_get_peers(state->session, &lsize);
1934 int usage = tls_out.tlsa_usage;
1936 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1937 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1938 dane-verification separately so that we know which selector verified;
1939 then we know whether to do name-verification (needed for TA but not EE). */
1941 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
1942 { /* a mixed-usage bundle */
1947 for (nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1950 dd = store_get(nrec * sizeof(uschar *), FALSE);
1951 ddl = store_get(nrec * sizeof(int), FALSE);
1954 if ((rc = dane_state_init(&s, 0)))
1957 for (usage = DANESSL_USAGE_DANE_EE;
1958 usage >= DANESSL_USAGE_DANE_TA; usage--)
1959 { /* take records with this usage */
1960 for (j = i = 0; i < nrec; i++)
1961 if (state->dane_data[i][0] == usage)
1963 dd[j] = state->dane_data[i];
1964 ddl[j++] = state->dane_data_len[i];
1971 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1974 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1975 gnutls_certificate_type_get(state->session),
1977 usage == DANESSL_USAGE_DANE_EE
1978 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1982 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1984 else if (verify == 0) /* verification passed */
1992 if (rc) goto tlsa_prob;
1997 if ( (rc = dane_state_init(&s, 0))
1998 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
2000 || (rc = dane_verify_crt_raw(s, certlist, lsize,
2001 gnutls_certificate_type_get(state->session),
2003 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2004 usage == (1 << DANESSL_USAGE_DANE_EE)
2005 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
2014 if (verify != 0) /* verification failed */
2017 (void) dane_verification_status_print(verify, &str, 0);
2018 *errstr = US str.data; /* don't bother to free */
2022 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2023 /* If a TA-mode TLSA record was used for verification we must additionally
2024 verify the cert name (but not the CA chain). For EE-mode, skip it. */
2026 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2029 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2032 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
2033 /* Assume that the name on the A-record is the one that should be matching
2034 the cert. An alternate view is that the domain part of the email address
2035 is also permissible. */
2037 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2038 CS state->host->name))
2040 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2045 #endif /*SUPPORT_DANE*/
2047 rc = gnutls_certificate_verify_peers2(state->session, &verify);
2050 /* Handle the result of verification. INVALID is set if any others are. */
2052 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
2054 state->peer_cert_verified = FALSE;
2057 #ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2062 if (gnutls_certificate_verification_status_print(verify,
2063 gnutls_certificate_type_get(state->session), &txt, 0)
2064 == GNUTLS_E_SUCCESS)
2066 debug_printf("%s\n", txt.data);
2067 gnutls_free(txt.data);
2071 *errstr = verify & GNUTLS_CERT_REVOKED
2072 ? US"certificate revoked" : US"certificate invalid";
2076 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
2077 *errstr, state->peerdn ? state->peerdn : US"<unset>");
2079 if (state->verify_requirement >= VERIFY_REQUIRED)
2082 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
2087 /* Client side, check the server's certificate name versus the name on the
2088 A-record for the connection we made. What to do for server side - what name
2089 to use for client? We document that there is no such checking for server
2092 if ( state->exp_tls_verify_cert_hostnames
2093 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2094 CS state->exp_tls_verify_cert_hostnames)
2098 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2099 if (state->verify_requirement >= VERIFY_REQUIRED)
2104 state->peer_cert_verified = TRUE;
2105 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
2106 state->peerdn ? state->peerdn : US"<unset>");
2110 state->tlsp->peerdn = state->peerdn;
2115 *errstr = string_sprintf("TLSA record problem: %s",
2116 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
2120 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2127 /* ------------------------------------------------------------------------ */
2130 /* Logging function which can be registered with
2131 * gnutls_global_set_log_function()
2132 * gnutls_global_set_log_level() 0..9
2134 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
2136 exim_gnutls_logger_cb(int level, const char *message)
2138 size_t len = strlen(message);
2141 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2144 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2145 message[len-1] == '\n' ? "" : "\n");
2150 /* Called after client hello, should handle SNI work.
2151 This will always set tls_sni (state->received_sni) if available,
2152 and may trigger presenting different certificates,
2153 if state->trigger_sni_changes is TRUE.
2155 Should be registered with
2156 gnutls_handshake_set_post_client_hello_function()
2158 "This callback must return 0 on success or a gnutls error code to terminate the
2161 For inability to get SNI information, we return 0.
2162 We only return non-zero if re-setup failed.
2163 Only used for server-side TLS.
2167 exim_sni_handling_cb(gnutls_session_t session)
2169 char sni_name[MAX_HOST_LEN];
2170 size_t data_len = MAX_HOST_LEN;
2171 exim_gnutls_state_st *state = &state_server;
2172 unsigned int sni_type;
2174 uschar * dummy_errstr;
2176 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
2177 if (rc != GNUTLS_E_SUCCESS)
2180 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2181 debug_printf("TLS: no SNI presented in handshake.\n");
2183 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2184 gnutls_strerror(rc), rc);
2188 if (sni_type != GNUTLS_NAME_DNS)
2190 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2194 /* We now have a UTF-8 string in sni_name */
2195 old_pool = store_pool;
2196 store_pool = POOL_PERM;
2197 state->received_sni = string_copy_taint(US sni_name, TRUE);
2198 store_pool = old_pool;
2200 /* We set this one now so that variable expansions below will work */
2201 state->tlsp->sni = state->received_sni;
2203 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2204 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2206 if (!state->trigger_sni_changes)
2209 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
2211 /* If the setup of certs/etc failed before handshake, TLS would not have
2212 been offered. The best we can do now is abort. */
2213 return GNUTLS_E_APPLICATION_ERROR_MIN;
2216 rc = tls_set_remaining_x509(state, &dummy_errstr);
2217 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2224 #ifndef DISABLE_EVENT
2226 We use this callback to get observability and detail-level control
2227 for an exim TLS connection (either direction), raising a tls:cert event
2228 for each cert in the chain presented by the peer. Any event
2229 can deny verification.
2231 Return 0 for the handshake to continue or non-zero to terminate.
2235 verify_cb(gnutls_session_t session)
2237 const gnutls_datum_t * cert_list;
2238 unsigned int cert_list_size = 0;
2239 gnutls_x509_crt_t crt;
2242 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2244 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
2245 while (cert_list_size--)
2247 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
2249 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2250 cert_list_size, gnutls_strerror(rc));
2254 state->tlsp->peercert = crt;
2255 if ((yield = event_raise(state->event_action,
2256 US"tls:cert", string_sprintf("%d", cert_list_size))))
2258 log_write(0, LOG_MAIN,
2259 "SSL verify denied by event-action: depth=%d: %s",
2260 cert_list_size, yield);
2261 return 1; /* reject */
2263 state->tlsp->peercert = NULL;
2273 ddump(gnutls_datum_t * d)
2275 gstring * g = string_get((d->size+1) * 2);
2276 uschar * s = d->data;
2277 for (unsigned i = d->size; i > 0; i--, s++)
2279 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2280 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2286 post_handshake_debug(exim_gnutls_state_st * state)
2288 #ifdef SUPPORT_GNUTLS_SESS_DESC
2289 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2292 #ifdef SUPPORT_GNUTLS_KEYLOG
2293 # ifdef EXIM_HAVE_TLS1_3
2294 if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
2299 gnutls_datum_t c, s;
2301 /* For TLS1.2 we only want the client random and the master secret */
2302 gnutls_session_get_random(state->session, &c, &s);
2303 gnutls_session_get_master_secret(state->session, &s);
2306 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2309 debug_printf("To get keying info for TLS1.3 is hard:\n"
2310 " set environment variable SSLKEYLOGFILE to a filename writable by uid exim\n"
2311 " add SSLKEYLOGFILE to keep_environment in the exim config\n"
2312 " run exim as root\n"
2313 " if using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2314 " (works for TLS1.2 also, and saves cut-paste into file)"
2315 " Trying to use add_environment for this will not work\n");
2320 #ifdef EXPERIMENTAL_TLS_RESUME
2322 tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2323 unsigned incoming, const gnutls_datum_t * msg)
2325 DEBUG(D_tls) debug_printf("newticket cb\n");
2326 tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2331 tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2333 /* Should the server offer session resumption? */
2334 tls_in.resumption = RESUME_SUPPORTED;
2335 if (verify_check_host(&tls_resumption_hosts) == OK)
2338 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2339 an offered resumption is unacceptable. We lose one resumption per ticket
2340 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2341 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2342 least they go out in a single packet. */
2344 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2345 &server_sessticket_key)))
2346 tls_in.resumption |= RESUME_SERVER_TICKET;
2349 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2351 /* Try to tell if we see a ticket request */
2352 gnutls_handshake_set_hook_function(state->session,
2353 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
2358 tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2360 if (gnutls_session_resumption_requested(state->session))
2362 /* This tells us the client sent a full ticket. We use a
2363 callback on session-ticket request, elsewhere, to tell
2364 if a client asked for a ticket. */
2366 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2367 DEBUG(D_tls) debug_printf("client requested resumption\n");
2369 if (gnutls_session_is_resumed(state->session))
2371 tls_in.resumption |= RESUME_USED;
2372 DEBUG(D_tls) debug_printf("Session resumed\n");
2376 /* ------------------------------------------------------------------------ */
2377 /* Exported functions */
2382 /*************************************************
2383 * Start a TLS session in a server *
2384 *************************************************/
2386 /* This is called when Exim is running as a server, after having received
2387 the STARTTLS command. It must respond to that command, and then negotiate
2391 require_ciphers list of allowed ciphers or NULL
2392 errstr pointer to error string
2394 Returns: OK on success
2395 DEFER for errors before the start of the negotiation
2396 FAIL for errors during the negotiation; the server can't
2401 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
2404 exim_gnutls_state_st * state = NULL;
2406 /* Check for previous activation */
2407 if (tls_in.active.sock >= 0)
2409 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
2410 smtp_printf("554 Already in TLS\r\n", FALSE);
2414 /* Initialize the library. If it fails, it will already have logged the error
2415 and sent an SMTP response. */
2417 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2420 #ifdef MEASURE_TIMING
2422 gettimeofday(&t0, NULL);
2425 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
2426 NULL, tls_verify_certificates, tls_crl,
2427 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2429 #ifdef MEASURE_TIMING
2430 report_time_since(&t0, US"server tls_init (delta)");
2434 #ifdef EXPERIMENTAL_TLS_RESUME
2435 tls_server_resume_prehandshake(state);
2438 /* If this is a host for which certificate verification is mandatory or
2439 optional, set up appropriately. */
2441 if (verify_check_host(&tls_verify_hosts) == OK)
2444 debug_printf("TLS: a client certificate will be required.\n");
2445 state->verify_requirement = VERIFY_REQUIRED;
2446 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2448 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2451 debug_printf("TLS: a client certificate will be requested but not required.\n");
2452 state->verify_requirement = VERIFY_OPTIONAL;
2453 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2458 debug_printf("TLS: a client certificate will not be requested.\n");
2459 state->verify_requirement = VERIFY_NONE;
2460 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2463 #ifndef DISABLE_EVENT
2466 state->event_action = event_action;
2467 gnutls_session_set_ptr(state->session, state);
2468 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2472 /* Register SNI handling; always, even if not in tls_certificate, so that the
2473 expansion variable $tls_sni is always available. */
2475 gnutls_handshake_set_post_client_hello_function(state->session,
2476 exim_sni_handling_cb);
2478 /* Set context and tell client to go ahead, except in the case of TLS startup
2479 on connection, where outputting anything now upsets the clients and tends to
2480 make them disconnect. We need to have an explicit fflush() here, to force out
2481 the response. Other smtp_printf() calls do not need it, because in non-TLS
2482 mode, the fflush() happens when smtp_getc() is called. */
2484 if (!state->tlsp->on_connect)
2486 smtp_printf("220 TLS go ahead\r\n", FALSE);
2490 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2491 that the GnuTLS library doesn't.
2492 From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2493 to set (and clear down afterwards) up a pull-timeout callback function that does
2494 a select, so we're no better off unless avoiding signals becomes an issue. */
2496 gnutls_transport_set_ptr2(state->session,
2497 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2498 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
2499 state->fd_in = fileno(smtp_in);
2500 state->fd_out = fileno(smtp_out);
2502 sigalrm_seen = FALSE;
2503 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2505 rc = gnutls_handshake(state->session);
2506 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2509 if (rc != GNUTLS_E_SUCCESS)
2511 /* It seems that, except in the case of a timeout, we have to close the
2512 connection right here; otherwise if the other end is running OpenSSL it hangs
2513 until the server times out. */
2517 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
2518 gnutls_db_remove_session(state->session);
2522 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
2523 (void) gnutls_alert_send_appropriate(state->session, rc);
2524 gnutls_deinit(state->session);
2525 gnutls_certificate_free_credentials(state->x509_cred);
2527 shutdown(state->fd_out, SHUT_WR);
2528 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
2529 (void)fclose(smtp_out);
2530 (void)fclose(smtp_in);
2531 smtp_out = smtp_in = NULL;
2537 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
2538 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
2539 tls_in.ext_master_secret = TRUE;
2542 #ifdef EXPERIMENTAL_TLS_RESUME
2543 tls_server_resume_posthandshake(state);
2546 DEBUG(D_tls) post_handshake_debug(state);
2548 /* Verify after the fact */
2550 if (!verify_certificate(state, errstr))
2552 if (state->verify_requirement != VERIFY_OPTIONAL)
2554 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
2558 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
2562 /* Sets various Exim expansion variables; always safe within server */
2564 extract_exim_vars_from_tls_state(state);
2566 /* TLS has been set up. Adjust the input functions to read via TLS,
2567 and initialize appropriately. */
2569 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2571 receive_getc = tls_getc;
2572 receive_getbuf = tls_getbuf;
2573 receive_get_cache = tls_get_cache;
2574 receive_ungetc = tls_ungetc;
2575 receive_feof = tls_feof;
2576 receive_ferror = tls_ferror;
2577 receive_smtp_buffered = tls_smtp_buffered;
2586 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2587 smtp_transport_options_block * ob)
2589 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2591 state->exp_tls_verify_cert_hostnames =
2593 string_domain_utf8_to_alabel(host->name, NULL);
2598 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2599 state->exp_tls_verify_cert_hostnames);
2607 /* Given our list of RRs from the TLSA lookup, build a lookup block in
2608 GnuTLS-DANE's preferred format. Hang it on the state str for later
2609 use in DANE verification.
2611 We point at the dnsa data not copy it, so it must remain valid until
2612 after verification is done.*/
2615 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2619 const char ** dane_data;
2620 int * dane_data_len;
2623 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2624 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2625 ) if (rr->type == T_TLSA) i++;
2627 dane_data = store_get(i * sizeof(uschar *), FALSE);
2628 dane_data_len = store_get(i * sizeof(int), FALSE);
2631 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2632 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2633 ) if (rr->type == T_TLSA && rr->size > 3)
2635 const uschar * p = rr->data;
2636 /*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
2637 uint8_t usage = p[0], sel = p[1], type = p[2];
2640 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2642 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2643 || (sel != 0 && sel != 1)
2648 case 0: /* Full: cannot check at present */
2650 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2652 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2657 tls_out.tlsa_usage |= 1<<usage;
2658 dane_data[i] = CS p;
2659 dane_data_len[i++] = rr->size;
2662 if (!i) return FALSE;
2664 dane_data[i] = NULL;
2665 dane_data_len[i] = 0;
2667 state->dane_data = (char * const *)dane_data;
2668 state->dane_data_len = dane_data_len;
2675 #ifdef EXPERIMENTAL_TLS_RESUME
2676 /* On the client, get any stashed session for the given IP from hints db
2677 and apply it to the ssl-connection for attempted resumption. Although
2678 there is a gnutls_session_ticket_enable_client() interface it is
2679 documented as unnecessary (as of 3.6.7) as "session tickets are emabled
2680 by deafult". There seems to be no way to disable them, so even hosts not
2681 enabled by the transport option will be sent a ticket request. We will
2682 however avoid storing and retrieving session information. */
2685 tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
2686 host_item * host, smtp_transport_options_block * ob)
2688 tlsp->resumption = RESUME_SUPPORTED;
2689 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
2691 dbdata_tls_session * dt;
2693 open_db dbblock, * dbm_file;
2696 debug_printf("check for resumable session for %s\n", host->address);
2697 tlsp->host_resumable = TRUE;
2698 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2699 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
2701 /* Key for the db is the IP. We'd like to filter the retrieved session
2702 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
2704 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
2705 if (!(rc = gnutls_session_set_data(session,
2706 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
2708 DEBUG(D_tls) debug_printf("good session\n");
2709 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2711 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
2712 US gnutls_strerror(rc));
2713 dbfn_close(dbm_file);
2720 tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
2722 /* TLS 1.2 - we get both the callback and the direct posthandshake call,
2723 but this flag is not set until the second. TLS 1.3 it's the other way about.
2724 Keep both calls as the session data cannot be extracted before handshake
2727 if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
2732 DEBUG(D_tls) debug_printf("server offered session ticket\n");
2733 tlsp->ticket_received = TRUE;
2734 tlsp->resumption |= RESUME_SERVER_TICKET;
2736 if (tlsp->host_resumable)
2737 if (!(rc = gnutls_session_get_data2(session, &tkt)))
2739 open_db dbblock, * dbm_file;
2740 int dlen = sizeof(dbdata_tls_session) + tkt.size;
2741 dbdata_tls_session * dt = store_get(dlen, TRUE);
2743 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
2744 memcpy(dt->session, tkt.data, tkt.size);
2745 gnutls_free(tkt.data);
2747 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
2749 /* key for the db is the IP */
2750 dbfn_delete(dbm_file, host->address);
2751 dbfn_write(dbm_file, host->address, dt, dlen);
2752 dbfn_close(dbm_file);
2755 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
2759 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
2764 /* With a TLS1.3 session, the ticket(s) are not seen until
2765 the first data read is attempted. And there's often two of them.
2766 Pick them up with this callback. We are also called for 1.2
2770 tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2771 unsigned incoming, const gnutls_datum_t * msg)
2773 exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
2774 tls_support * tlsp = state->tlsp;
2776 DEBUG(D_tls) debug_printf("newticket cb\n");
2778 if (!tlsp->ticket_received)
2779 tls_save_session(tlsp, sess, state->host);
2785 tls_client_resume_prehandshake(exim_gnutls_state_st * state,
2786 tls_support * tlsp, host_item * host,
2787 smtp_transport_options_block * ob)
2789 gnutls_session_set_ptr(state->session, state);
2790 gnutls_handshake_set_hook_function(state->session,
2791 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
2793 tls_retrieve_session(tlsp, state->session, host, ob);
2797 tls_client_resume_posthandshake(exim_gnutls_state_st * state,
2798 tls_support * tlsp, host_item * host)
2800 if (gnutls_session_is_resumed(state->session))
2802 DEBUG(D_tls) debug_printf("Session resumed\n");
2803 tlsp->resumption |= RESUME_USED;
2806 tls_save_session(tlsp, state->session, host);
2808 #endif /* EXPERIMENTAL_TLS_RESUME */
2811 /*************************************************
2812 * Start a TLS session in a client *
2813 *************************************************/
2815 /* Called from the smtp transport after STARTTLS has been accepted.
2818 cctx connection context
2819 conn_args connection details
2820 cookie datum for randomness (not used)
2821 tlsp record details of channel configuration here; must be non-NULL
2822 errstr error string pointer
2824 Returns: TRUE for success with TLS session context set in smtp context,
2829 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2830 void * cookie ARG_UNUSED,
2831 tls_support * tlsp, uschar ** errstr)
2833 host_item * host = conn_args->host; /* for msgs and option-tests */
2834 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
2835 smtp_transport_options_block * ob = tb
2836 ? (smtp_transport_options_block *)tb->options_block
2837 : &smtp_transport_option_defaults;
2839 exim_gnutls_state_st * state = NULL;
2840 uschar * cipher_list = NULL;
2842 #ifndef DISABLE_OCSP
2844 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
2845 BOOL request_ocsp = require_ocsp ? TRUE
2846 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2849 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
2852 /* If dane is flagged, have either request or require dane for this host, and
2853 a TLSA record found. Therefore, dane verify required. Which implies cert must
2854 be requested and supplied, dane verify must pass, and cert verify irrelevant
2855 (incl. hostnames), and (caller handled) require_tls */
2857 if (conn_args->dane && ob->dane_require_tls_ciphers)
2859 /* not using expand_check_tlsvar because not yet in state */
2860 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2861 &cipher_list, errstr))
2863 cipher_list = cipher_list && *cipher_list
2864 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
2869 cipher_list = ob->tls_require_ciphers;
2872 #ifdef MEASURE_TIMING
2874 gettimeofday(&t0, NULL);
2877 if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2878 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2879 cipher_list, &state, tlsp, errstr) != OK)
2882 #ifdef MEASURE_TIMING
2883 report_time_since(&t0, US"client tls_init (delta)");
2888 int dh_min_bits = ob->tls_dh_min_bits;
2889 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2892 debug_printf("WARNING: tls_dh_min_bits far too low,"
2893 " clamping %d up to %d\n",
2894 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2895 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2898 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2899 " acceptable bits to %d\n",
2901 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2904 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
2905 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2906 the specified host patterns if one of them is defined */
2909 if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
2912 debug_printf("TLS: server certificate DANE required.\n");
2913 state->verify_requirement = VERIFY_DANE;
2914 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2918 if ( ( state->exp_tls_verify_certificates
2919 && !ob->tls_verify_hosts
2920 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2922 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
2925 tls_client_setup_hostname_checks(host, state, ob);
2927 debug_printf("TLS: server certificate verification required.\n");
2928 state->verify_requirement = VERIFY_REQUIRED;
2929 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2931 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
2933 tls_client_setup_hostname_checks(host, state, ob);
2935 debug_printf("TLS: server certificate verification optional.\n");
2936 state->verify_requirement = VERIFY_OPTIONAL;
2937 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2942 debug_printf("TLS: server certificate verification not required.\n");
2943 state->verify_requirement = VERIFY_NONE;
2944 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2947 #ifndef DISABLE_OCSP
2948 /* supported since GnuTLS 3.1.3 */
2951 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2952 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2953 NULL, 0, NULL)) != OK)
2955 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
2958 tlsp->ocsp = OCSP_NOT_RESP;
2962 #ifdef EXPERIMENTAL_TLS_RESUME
2963 tls_client_resume_prehandshake(state, tlsp, host, ob);
2966 #ifndef DISABLE_EVENT
2967 if (tb && tb->event_action)
2969 state->event_action = tb->event_action;
2970 gnutls_session_set_ptr(state->session, state);
2971 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2975 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
2976 state->fd_in = cctx->sock;
2977 state->fd_out = cctx->sock;
2979 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2980 /* There doesn't seem to be a built-in timeout on connection. */
2982 sigalrm_seen = FALSE;
2983 ALARM(ob->command_timeout);
2985 rc = gnutls_handshake(state->session);
2986 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2989 if (rc != GNUTLS_E_SUCCESS)
2993 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
2994 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
2997 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
3001 DEBUG(D_tls) post_handshake_debug(state);
3005 if (!verify_certificate(state, errstr))
3007 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
3011 #ifdef GNUTLS_SFLAGS_EXT_MASTER_SECRET
3012 if (gnutls_session_get_flags(state->session) & GNUTLS_SFLAGS_EXT_MASTER_SECRET)
3013 tlsp->ext_master_secret = TRUE;
3016 #ifndef DISABLE_OCSP
3021 gnutls_datum_t stapling;
3022 gnutls_ocsp_resp_t resp;
3023 gnutls_datum_t printed;
3027 # ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
3028 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
3030 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
3033 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
3034 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
3035 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
3038 debug_printf("%.4096s", printed.data);
3039 gnutls_free(printed.data);
3042 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3044 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3047 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
3049 tlsp->ocsp = OCSP_FAILED;
3050 tls_error(US"certificate status check failed", NULL, state->host, errstr);
3056 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3057 tlsp->ocsp = OCSP_VFIED;
3062 #ifdef EXPERIMENTAL_TLS_RESUME
3063 tls_client_resume_posthandshake(state, tlsp, host);
3066 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
3068 extract_exim_vars_from_tls_state(state);
3070 cctx->tls_ctx = state;
3077 /*************************************************
3078 * Close down a TLS session *
3079 *************************************************/
3081 /* This is also called from within a delivery subprocess forked from the
3082 daemon, to shut down the TLS library, without actually doing a shutdown (which
3083 would tamper with the TLS session in the parent process).
3086 ct_ctx client context pointer, or NULL for the one global server context
3087 shutdown 1 if TLS close-alert is to be sent,
3088 2 if also response to be waited for
3094 tls_close(void * ct_ctx, int shutdown)
3096 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3097 tls_support * tlsp = state->tlsp;
3099 if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
3103 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3104 shutdown > 1 ? " (with response-wait)" : "");
3107 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
3111 if (!ct_ctx) /* server */
3113 receive_getc = smtp_getc;
3114 receive_getbuf = smtp_getbuf;
3115 receive_get_cache = smtp_get_cache;
3116 receive_ungetc = smtp_ungetc;
3117 receive_feof = smtp_feof;
3118 receive_ferror = smtp_ferror;
3119 receive_smtp_buffered = smtp_buffered;
3122 gnutls_deinit(state->session);
3123 gnutls_certificate_free_credentials(state->x509_cred);
3125 tlsp->active.sock = -1;
3126 tlsp->active.tls_ctx = NULL;
3127 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3128 tlsp->channelbinding = NULL;
3131 if (state->xfer_buffer) store_free(state->xfer_buffer);
3132 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
3139 tls_refill(unsigned lim)
3141 exim_gnutls_state_st * state = &state_server;
3144 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
3145 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3147 sigalrm_seen = FALSE;
3148 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3151 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3152 MIN(ssl_xfer_buffer_size, lim));
3153 while (inbytes == GNUTLS_E_AGAIN);
3155 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3157 if (had_command_timeout) /* set by signal handler */
3158 smtp_command_timeout_exit(); /* does not return */
3159 if (had_command_sigterm)
3160 smtp_command_sigterm_exit();
3161 if (had_data_timeout)
3162 smtp_data_timeout_exit();
3163 if (had_data_sigint)
3164 smtp_data_sigint_exit();
3166 /* Timeouts do not get this far. A zero-byte return appears to mean that the
3167 TLS session has been closed down, not that the socket itself has been closed
3168 down. Revert to non-TLS handling. */
3172 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
3173 state->xfer_error = TRUE;
3177 else if (inbytes == 0)
3179 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3180 tls_close(NULL, TLS_NO_SHUTDOWN);
3184 /* Handle genuine errors */
3186 else if (inbytes < 0)
3188 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3189 record_io_error(state, (int) inbytes, US"recv", NULL);
3190 state->xfer_error = TRUE;
3193 #ifndef DISABLE_DKIM
3194 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3196 state->xfer_buffer_hwm = (int) inbytes;
3197 state->xfer_buffer_lwm = 0;
3201 /*************************************************
3202 * TLS version of getc *
3203 *************************************************/
3205 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3206 it refills the buffer via the GnuTLS reading function.
3207 Only used by the server-side TLS.
3209 This feeds DKIM and should be used for all message-body reads.
3211 Arguments: lim Maximum amount to read/buffer
3212 Returns: the next character or EOF
3216 tls_getc(unsigned lim)
3218 exim_gnutls_state_st * state = &state_server;
3220 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3221 if (!tls_refill(lim))
3222 return state->xfer_error ? EOF : smtp_getc(lim);
3224 /* Something in the buffer; return next uschar */
3226 return state->xfer_buffer[state->xfer_buffer_lwm++];
3230 tls_getbuf(unsigned * len)
3232 exim_gnutls_state_st * state = &state_server;
3236 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3237 if (!tls_refill(*len))
3239 if (!state->xfer_error) return smtp_getbuf(len);
3244 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3246 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3247 state->xfer_buffer_lwm += size;
3256 #ifndef DISABLE_DKIM
3257 exim_gnutls_state_st * state = &state_server;
3258 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3260 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
3266 tls_could_read(void)
3268 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3269 || gnutls_record_check_pending(state_server.session) > 0;
3275 /*************************************************
3276 * Read bytes from TLS channel *
3277 *************************************************/
3279 /* This does not feed DKIM, so if the caller uses this for reading message body,
3280 then the caller must feed DKIM.
3283 ct_ctx client context pointer, or NULL for the one global server context
3287 Returns: the number of bytes read
3288 -1 after a failed read, including EOF
3292 tls_read(void * ct_ctx, uschar *buff, size_t len)
3294 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3300 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3302 debug_printf("*** PROBABLY A BUG *** " \
3303 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3304 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3307 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
3308 state->session, buff, len);
3311 inbytes = gnutls_record_recv(state->session, buff, len);
3312 while (inbytes == GNUTLS_E_AGAIN);
3314 if (inbytes > 0) return inbytes;
3317 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3321 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
3322 record_io_error(state, (int)inbytes, US"recv", NULL);
3331 /*************************************************
3332 * Write bytes down TLS channel *
3333 *************************************************/
3337 ct_ctx client context pointer, or NULL for the one global server context
3340 more more data expected soon
3342 Calling with len zero and more unset will flush buffered writes. The buff
3343 argument can be null for that case.
3345 Returns: the number of bytes after a successful write,
3346 -1 after a failed write
3350 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
3354 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
3357 if (more && !state->corked) gnutls_record_cork(state->session);
3360 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
3361 buff, left, more ? ", more" : "");
3365 DEBUG(D_tls) debug_printf("gnutls_record_send(%p, %p, " SIZE_T_FMT ")\n",
3366 state->session, buff, left);
3369 outbytes = gnutls_record_send(state->session, buff, left);
3370 while (outbytes == GNUTLS_E_AGAIN);
3372 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
3375 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
3376 record_io_error(state, outbytes, US"send", NULL);
3381 record_io_error(state, 0, US"send", US"TLS channel closed on write");
3392 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
3398 if (more != state->corked)
3400 if (!more) (void) gnutls_record_uncork(state->session, 0);
3401 state->corked = more;
3411 /*************************************************
3412 * Random number generation *
3413 *************************************************/
3415 /* Pseudo-random number generation. The result is not expected to be
3416 cryptographically strong but not so weak that someone will shoot themselves
3417 in the foot using it as a nonce in input in some email header scheme or
3418 whatever weirdness they'll twist this into. The result should handle fork()
3419 and avoid repeating sequences. OpenSSL handles that for us.
3423 Returns a random number in range [0, max-1]
3426 #ifdef HAVE_GNUTLS_RND
3428 vaguely_random_number(int max)
3432 uschar smallbuf[sizeof(r)];
3437 needed_len = sizeof(r);
3438 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
3439 asked for a number less than 10. */
3441 for (r = max, i = 0; r; ++i)
3447 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
3450 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
3451 return vaguely_random_number_fallback(max);
3454 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
3457 /* We don't particularly care about weighted results; if someone wants
3458 * smooth distribution and cares enough then they should submit a patch then. */
3461 #else /* HAVE_GNUTLS_RND */
3463 vaguely_random_number(int max)
3465 return vaguely_random_number_fallback(max);
3467 #endif /* HAVE_GNUTLS_RND */
3472 /*************************************************
3473 * Let tls_require_ciphers be checked at startup *
3474 *************************************************/
3476 /* The tls_require_ciphers option, if set, must be something which the
3479 Returns: NULL on success, or error message
3483 tls_validate_require_cipher(void)
3486 uschar *expciphers = NULL;
3487 gnutls_priority_t priority_cache;
3489 uschar * dummy_errstr;
3491 #ifdef GNUTLS_AUTO_GLOBAL_INIT
3492 # define validate_check_rc(Label) do { \
3493 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) \
3494 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3495 # define return_deinit(Label) do { return (Label); } while (0)
3497 # define validate_check_rc(Label) do { \
3498 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
3499 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3500 # define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
3503 if (exim_gnutls_base_init_done)
3504 log_write(0, LOG_MAIN|LOG_PANIC,
3505 "already initialised GnuTLS, Exim developer bug");
3507 #if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
3508 if (!gnutls_allow_auto_pkcs11)
3510 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
3511 validate_check_rc(US"gnutls_pkcs11_init");
3514 #ifndef GNUTLS_AUTO_GLOBAL_INIT
3515 rc = gnutls_global_init();
3516 validate_check_rc(US"gnutls_global_init()");
3518 exim_gnutls_base_init_done = TRUE;
3520 if (!(tls_require_ciphers && *tls_require_ciphers))
3521 return_deinit(NULL);
3523 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
3525 return_deinit(US"failed to expand tls_require_ciphers");
3527 if (!(expciphers && *expciphers))
3528 return_deinit(NULL);
3531 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
3533 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
3534 validate_check_rc(string_sprintf(
3535 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
3536 expciphers, errpos - CS expciphers, errpos));
3538 #undef return_deinit
3539 #undef validate_check_rc
3540 #ifndef GNUTLS_AUTO_GLOBAL_INIT
3541 gnutls_global_deinit();
3550 /*************************************************
3551 * Report the library versions. *
3552 *************************************************/
3554 /* See a description in tls-openssl.c for an explanation of why this exists.
3556 Arguments: a FILE* to print the results to
3561 tls_version_report(FILE *f)
3563 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
3566 gnutls_check_version(NULL));
3569 #endif /*!MACRO_PREDEF*/
3572 /* End of tls-gnu.c */