1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2014 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42 /* needed to disable PKCS11 autoload unless requested */
43 #if GNUTLS_VERSION_NUMBER >= 0x020c00
44 # include <gnutls/pkcs11.h>
46 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
47 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50 #if GNUTLS_VERSION_NUMBER < 0x020a00 && defined(EXPERIMENTAL_EVENT)
51 # warning "GnuTLS library version too old; tls:cert event unsupported"
52 # undef EXPERIMENTAL_EVENT
54 #if GNUTLS_VERSION_NUMBER >= 0x030306
55 # define SUPPORT_CA_DIR
57 # undef SUPPORT_CA_DIR
61 # include <gnutls/ocsp.h>
67 gnutls_global_set_audit_log_function()
70 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
73 /* Local static variables for GnuTLS */
75 /* Values for verify_requirement */
77 enum peer_verify_requirement
78 { VERIFY_NONE
, VERIFY_OPTIONAL
, VERIFY_REQUIRED
};
80 /* This holds most state for server or client; with this, we can set up an
81 outbound TLS-enabled connection in an ACL callout, while not stomping all
82 over the TLS variables available for expansion.
84 Some of these correspond to variables in globals.c; those variables will
85 be set to point to content in one of these instances, as appropriate for
86 the stage of the process lifetime.
88 Not handled here: global tls_channelbinding_b64.
91 typedef struct exim_gnutls_state
{
92 gnutls_session_t session
;
93 gnutls_certificate_credentials_t x509_cred
;
94 gnutls_priority_t priority_cache
;
95 enum peer_verify_requirement verify_requirement
;
98 BOOL peer_cert_verified
;
99 BOOL trigger_sni_changes
;
100 BOOL have_set_peerdn
;
101 const struct host_item
*host
;
102 gnutls_x509_crt_t peercert
;
105 uschar
*received_sni
;
107 const uschar
*tls_certificate
;
108 const uschar
*tls_privatekey
;
109 const uschar
*tls_sni
; /* client send only, not received */
110 const uschar
*tls_verify_certificates
;
111 const uschar
*tls_crl
;
112 const uschar
*tls_require_ciphers
;
114 uschar
*exp_tls_certificate
;
115 uschar
*exp_tls_privatekey
;
116 uschar
*exp_tls_verify_certificates
;
118 uschar
*exp_tls_require_ciphers
;
119 uschar
*exp_tls_ocsp_file
;
120 uschar
*exp_tls_verify_cert_hostnames
;
121 #ifdef EXPERIMENTAL_EVENT
122 uschar
*event_action
;
125 tls_support
*tlsp
; /* set in tls_init() */
132 } exim_gnutls_state_st
;
134 static const exim_gnutls_state_st exim_gnutls_state_init
= {
135 NULL
, NULL
, NULL
, VERIFY_NONE
, -1, -1, FALSE
, FALSE
, FALSE
,
136 NULL
, NULL
, NULL
, NULL
,
137 NULL
, NULL
, NULL
, NULL
, NULL
, NULL
,
138 NULL
, NULL
, NULL
, NULL
, NULL
, NULL
, NULL
,
140 #ifdef EXPERIMENTAL_EVENT
147 /* Not only do we have our own APIs which don't pass around state, assuming
148 it's held in globals, GnuTLS doesn't appear to let us register callback data
149 for callbacks, or as part of the session, so we have to keep a "this is the
150 context we're currently dealing with" pointer and rely upon being
151 single-threaded to keep from processing data on an inbound TLS connection while
152 talking to another TLS connection for an outbound check. This does mean that
153 there's no way for heart-beats to be responded to, for the duration of the
155 XXX But see gnutls_session_get_ptr()
158 static exim_gnutls_state_st state_server
, state_client
;
160 /* dh_params are initialised once within the lifetime of a process using TLS;
161 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
162 don't want to repeat this. */
164 static gnutls_dh_params_t dh_server_params
= NULL
;
166 /* No idea how this value was chosen; preserving it. Default is 3600. */
168 static const int ssl_session_timeout
= 200;
170 static const char * const exim_default_gnutls_priority
= "NORMAL";
172 /* Guard library core initialisation */
174 static BOOL exim_gnutls_base_init_done
= FALSE
;
177 /* ------------------------------------------------------------------------ */
180 #define MAX_HOST_LEN 255
182 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
183 the library logging; a value less than 0 disables the calls to set up logging
185 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
186 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
189 #ifndef EXIM_CLIENT_DH_MIN_BITS
190 # define EXIM_CLIENT_DH_MIN_BITS 1024
193 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
194 can ask for a bit-strength. Without that, we stick to the constant we had
196 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
197 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
200 #define exim_gnutls_err_check(Label) do { \
201 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
203 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
205 #if GNUTLS_VERSION_NUMBER >= 0x020c00
206 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
207 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
208 # define HAVE_GNUTLS_RND
209 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
210 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
211 * isn't available sometimes, so this needs to become a conditional
212 * compilation; the sanest way to deal with this being a problem on
213 * older OSes is to block it in the Local/Makefile with this compiler
215 # ifndef AVOID_GNUTLS_PKCS11
216 # define HAVE_GNUTLS_PKCS11
217 # endif /* AVOID_GNUTLS_PKCS11 */
223 /* ------------------------------------------------------------------------ */
224 /* Callback declarations */
226 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
227 static void exim_gnutls_logger_cb(int level
, const char *message
);
230 static int exim_sni_handling_cb(gnutls_session_t session
);
233 static int server_ocsp_stapling_cb(gnutls_session_t session
, void * ptr
,
234 gnutls_datum_t
* ocsp_response
);
239 /* ------------------------------------------------------------------------ */
240 /* Static functions */
242 /*************************************************
244 *************************************************/
246 /* Called from lots of places when errors occur before actually starting to do
247 the TLS handshake, that is, while the session is still in clear. Always returns
248 DEFER for a server and FAIL for a client so that most calls can use "return
249 tls_error(...)" to do this processing and then give an appropriate return. A
250 single function is used for both server and client, because it is called from
251 some shared functions.
254 prefix text to include in the logged error
255 msg additional error string (may be NULL)
256 usually obtained from gnutls_strerror()
257 host NULL if setting up a server;
258 the connected host if setting up a client
260 Returns: OK/DEFER/FAIL
264 tls_error(const uschar
*prefix
, const char *msg
, const host_item
*host
)
268 log_write(0, LOG_MAIN
, "H=%s [%s] TLS error on connection (%s)%s%s",
269 host
->name
, host
->address
, prefix
, msg
? ": " : "", msg
? msg
: "");
274 uschar
*conn_info
= smtp_get_connection_info();
275 if (Ustrncmp(conn_info
, US
"SMTP ", 5) == 0)
277 /* I'd like to get separated H= here, but too hard for now */
278 log_write(0, LOG_MAIN
, "TLS error on %s (%s)%s%s",
279 conn_info
, prefix
, msg
? ": " : "", msg
? msg
: "");
287 /*************************************************
288 * Deal with logging errors during I/O *
289 *************************************************/
291 /* We have to get the identity of the peer from saved data.
294 state the current GnuTLS exim state container
295 rc the GnuTLS error code, or 0 if it's a local error
296 when text identifying read or write
297 text local error text when ec is 0
303 record_io_error(exim_gnutls_state_st
*state
, int rc
, uschar
*when
, uschar
*text
)
307 if (rc
== GNUTLS_E_FATAL_ALERT_RECEIVED
)
308 msg
= CS
string_sprintf("%s: %s", US
gnutls_strerror(rc
),
309 US
gnutls_alert_get_name(gnutls_alert_get(state
->session
)));
311 msg
= gnutls_strerror(rc
);
313 tls_error(when
, msg
, state
->host
);
319 /*************************************************
320 * Set various Exim expansion vars *
321 *************************************************/
323 #define exim_gnutls_cert_err(Label) \
326 if (rc != GNUTLS_E_SUCCESS) \
328 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
329 (Label), gnutls_strerror(rc)); \
335 import_cert(const gnutls_datum
* cert
, gnutls_x509_crt_t
* crtp
)
339 rc
= gnutls_x509_crt_init(crtp
);
340 exim_gnutls_cert_err(US
"gnutls_x509_crt_init (crt)");
342 rc
= gnutls_x509_crt_import(*crtp
, cert
, GNUTLS_X509_FMT_DER
);
343 exim_gnutls_cert_err(US
"failed to import certificate [gnutls_x509_crt_import(cert)]");
348 #undef exim_gnutls_cert_err
351 /* We set various Exim global variables from the state, once a session has
352 been established. With TLS callouts, may need to change this to stack
353 variables, or just re-call it with the server state after client callout
356 Make sure anything set here is unset in tls_getc().
360 tls_bits strength indicator
361 tls_certificate_verified bool indicator
362 tls_channelbinding_b64 for some SASL mechanisms
364 tls_peercert pointer to library internal
366 tls_sni a (UTF-8) string
367 tls_ourcert pointer to library internal
370 state the relevant exim_gnutls_state_st *
374 extract_exim_vars_from_tls_state(exim_gnutls_state_st
* state
)
376 gnutls_cipher_algorithm_t cipher
;
377 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
380 gnutls_datum_t channel
;
382 tls_support
* tlsp
= state
->tlsp
;
384 tlsp
->active
= state
->fd_out
;
386 cipher
= gnutls_cipher_get(state
->session
);
387 /* returns size in "bytes" */
388 tlsp
->bits
= gnutls_cipher_get_key_size(cipher
) * 8;
390 tlsp
->cipher
= state
->ciphersuite
;
392 DEBUG(D_tls
) debug_printf("cipher: %s\n", state
->ciphersuite
);
394 tlsp
->certificate_verified
= state
->peer_cert_verified
;
396 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
397 only available for use for authenticators while this TLS session is running. */
399 tls_channelbinding_b64
= NULL
;
400 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
403 rc
= gnutls_session_channel_binding(state
->session
, GNUTLS_CB_TLS_UNIQUE
, &channel
);
405 DEBUG(D_tls
) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc
));
407 old_pool
= store_pool
;
408 store_pool
= POOL_PERM
;
409 tls_channelbinding_b64
= auth_b64encode(channel
.data
, (int)channel
.size
);
410 store_pool
= old_pool
;
411 DEBUG(D_tls
) debug_printf("Have channel bindings cached for possible auth usage.\n");
415 /* peercert is set in peer_status() */
416 tlsp
->peerdn
= state
->peerdn
;
417 tlsp
->sni
= state
->received_sni
;
419 /* record our certificate */
421 const gnutls_datum
* cert
= gnutls_certificate_get_ours(state
->session
);
422 gnutls_x509_crt_t crt
;
424 tlsp
->ourcert
= cert
&& import_cert(cert
, &crt
)==0 ? crt
: NULL
;
431 /*************************************************
432 * Setup up DH parameters *
433 *************************************************/
435 /* Generating the D-H parameters may take a long time. They only need to
436 be re-generated every so often, depending on security policy. What we do is to
437 keep these parameters in a file in the spool directory. If the file does not
438 exist, we generate them. This means that it is easy to cause a regeneration.
440 The new file is written as a temporary file and renamed, so that an incomplete
441 file is never present. If two processes both compute some new parameters, you
442 waste a bit of effort, but it doesn't seem worth messing around with locking to
445 Returns: OK/DEFER/FAIL
452 unsigned int dh_bits
;
454 uschar filename_buf
[PATH_MAX
];
455 uschar
*filename
= NULL
;
457 uschar
*exp_tls_dhparam
;
458 BOOL use_file_in_spool
= FALSE
;
459 BOOL use_fixed_file
= FALSE
;
460 host_item
*host
= NULL
; /* dummy for macros */
462 DEBUG(D_tls
) debug_printf("Initialising GnuTLS server params.\n");
464 rc
= gnutls_dh_params_init(&dh_server_params
);
465 exim_gnutls_err_check(US
"gnutls_dh_params_init");
470 if (!expand_check(tls_dhparam
, US
"tls_dhparam", &exp_tls_dhparam
))
473 if (!exp_tls_dhparam
)
475 DEBUG(D_tls
) debug_printf("Loading default hard-coded DH params\n");
476 m
.data
= US
std_dh_prime_default();
477 m
.size
= Ustrlen(m
.data
);
479 else if (Ustrcmp(exp_tls_dhparam
, "historic") == 0)
480 use_file_in_spool
= TRUE
;
481 else if (Ustrcmp(exp_tls_dhparam
, "none") == 0)
483 DEBUG(D_tls
) debug_printf("Requested no DH parameters.\n");
486 else if (exp_tls_dhparam
[0] != '/')
488 m
.data
= US
std_dh_prime_named(exp_tls_dhparam
);
490 return tls_error(US
"No standard prime named", CS exp_tls_dhparam
, NULL
);
491 m
.size
= Ustrlen(m
.data
);
495 use_fixed_file
= TRUE
;
496 filename
= exp_tls_dhparam
;
501 rc
= gnutls_dh_params_import_pkcs3(dh_server_params
, &m
, GNUTLS_X509_FMT_PEM
);
502 exim_gnutls_err_check(US
"gnutls_dh_params_import_pkcs3");
503 DEBUG(D_tls
) debug_printf("Loaded fixed standard D-H parameters\n");
507 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
508 /* If you change this constant, also change dh_param_fn_ext so that we can use a
509 different filename and ensure we have sufficient bits. */
510 dh_bits
= gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH
, GNUTLS_SEC_PARAM_NORMAL
);
512 return tls_error(US
"gnutls_sec_param_to_pk_bits() failed", NULL
, NULL
);
514 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
517 dh_bits
= EXIM_SERVER_DH_BITS_PRE2_12
;
519 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
523 /* Some clients have hard-coded limits. */
524 if (dh_bits
> tls_dh_max_bits
)
527 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
529 dh_bits
= tls_dh_max_bits
;
532 if (use_file_in_spool
)
534 if (!string_format(filename_buf
, sizeof(filename_buf
),
535 "%s/gnutls-params-%d", spool_directory
, dh_bits
))
536 return tls_error(US
"overlong filename", NULL
, NULL
);
537 filename
= filename_buf
;
540 /* Open the cache file for reading and if successful, read it and set up the
543 fd
= Uopen(filename
, O_RDONLY
, 0);
550 if (fstat(fd
, &statbuf
) < 0) /* EIO */
554 return tls_error(US
"TLS cache stat failed", strerror(saved_errno
), NULL
);
556 if (!S_ISREG(statbuf
.st_mode
))
559 return tls_error(US
"TLS cache not a file", NULL
, NULL
);
561 fp
= fdopen(fd
, "rb");
566 return tls_error(US
"fdopen(TLS cache stat fd) failed",
567 strerror(saved_errno
), NULL
);
570 m
.size
= statbuf
.st_size
;
571 m
.data
= malloc(m
.size
);
575 return tls_error(US
"malloc failed", strerror(errno
), NULL
);
577 sz
= fread(m
.data
, m
.size
, 1, fp
);
583 return tls_error(US
"fread failed", strerror(saved_errno
), NULL
);
587 rc
= gnutls_dh_params_import_pkcs3(dh_server_params
, &m
, GNUTLS_X509_FMT_PEM
);
589 exim_gnutls_err_check(US
"gnutls_dh_params_import_pkcs3");
590 DEBUG(D_tls
) debug_printf("read D-H parameters from file \"%s\"\n", filename
);
593 /* If the file does not exist, fall through to compute new data and cache it.
594 If there was any other opening error, it is serious. */
596 else if (errno
== ENOENT
)
600 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename
);
603 return tls_error(string_open_failed(errno
, "\"%s\" for reading", filename
),
606 /* If ret < 0, either the cache file does not exist, or the data it contains
607 is not useful. One particular case of this is when upgrading from an older
608 release of Exim in which the data was stored in a different format. We don't
609 try to be clever and support both formats; we just regenerate new data in this
615 unsigned int dh_bits_gen
= dh_bits
;
617 if ((PATH_MAX
- Ustrlen(filename
)) < 10)
618 return tls_error(US
"Filename too long to generate replacement",
621 temp_fn
= string_copy(US
"%s.XXXXXXX");
622 fd
= mkstemp(CS temp_fn
); /* modifies temp_fn */
624 return tls_error(US
"Unable to open temp file", strerror(errno
), NULL
);
625 (void)fchown(fd
, exim_uid
, exim_gid
); /* Probably not necessary */
627 /* GnuTLS overshoots!
628 * If we ask for 2236, we might get 2237 or more.
629 * But there's no way to ask GnuTLS how many bits there really are.
630 * We can ask how many bits were used in a TLS session, but that's it!
631 * The prime itself is hidden behind too much abstraction.
632 * So we ask for less, and proceed on a wing and a prayer.
633 * First attempt, subtracted 3 for 2233 and got 2240.
635 if (dh_bits
>= EXIM_CLIENT_DH_MIN_BITS
+ 10)
637 dh_bits_gen
= dh_bits
- 10;
639 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
644 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
646 rc
= gnutls_dh_params_generate2(dh_server_params
, dh_bits_gen
);
647 exim_gnutls_err_check(US
"gnutls_dh_params_generate2");
649 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
650 and I confirmed that a NULL call to get the size first is how the GnuTLS
651 sample apps handle this. */
655 rc
= gnutls_dh_params_export_pkcs3(dh_server_params
, GNUTLS_X509_FMT_PEM
,
657 if (rc
!= GNUTLS_E_SHORT_MEMORY_BUFFER
)
658 exim_gnutls_err_check(US
"gnutls_dh_params_export_pkcs3(NULL) sizing");
660 m
.data
= malloc(m
.size
);
662 return tls_error(US
"memory allocation failed", strerror(errno
), NULL
);
663 /* this will return a size 1 less than the allocation size above */
664 rc
= gnutls_dh_params_export_pkcs3(dh_server_params
, GNUTLS_X509_FMT_PEM
,
666 if (rc
!= GNUTLS_E_SUCCESS
)
669 exim_gnutls_err_check(US
"gnutls_dh_params_export_pkcs3() real");
671 m
.size
= sz
; /* shrink by 1, probably */
673 sz
= write_to_fd_buf(fd
, m
.data
, (size_t) m
.size
);
677 return tls_error(US
"TLS cache write D-H params failed",
678 strerror(errno
), NULL
);
681 sz
= write_to_fd_buf(fd
, US
"\n", 1);
683 return tls_error(US
"TLS cache write D-H params final newline failed",
684 strerror(errno
), NULL
);
688 return tls_error(US
"TLS cache write close() failed",
689 strerror(errno
), NULL
);
691 if (Urename(temp_fn
, filename
) < 0)
692 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
693 temp_fn
, filename
), strerror(errno
), NULL
);
695 DEBUG(D_tls
) debug_printf("wrote D-H parameters to file \"%s\"\n", filename
);
698 DEBUG(D_tls
) debug_printf("initialized server D-H parameters\n");
705 /*************************************************
706 * Variables re-expanded post-SNI *
707 *************************************************/
709 /* Called from both server and client code, via tls_init(), and also from
710 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
712 We can tell the two apart by state->received_sni being non-NULL in callback.
714 The callback should not call us unless state->trigger_sni_changes is true,
715 which we are responsible for setting on the first pass through.
718 state exim_gnutls_state_st *
720 Returns: OK/DEFER/FAIL
724 tls_expand_session_files(exim_gnutls_state_st
*state
)
728 const host_item
*host
= state
->host
; /* macro should be reconsidered? */
729 uschar
*saved_tls_certificate
= NULL
;
730 uschar
*saved_tls_privatekey
= NULL
;
731 uschar
*saved_tls_verify_certificates
= NULL
;
732 uschar
*saved_tls_crl
= NULL
;
735 /* We check for tls_sni *before* expansion. */
736 if (!host
) /* server */
738 if (!state
->received_sni
)
740 if (state
->tls_certificate
&&
741 (Ustrstr(state
->tls_certificate
, US
"tls_sni") ||
742 Ustrstr(state
->tls_certificate
, US
"tls_in_sni") ||
743 Ustrstr(state
->tls_certificate
, US
"tls_out_sni")
746 DEBUG(D_tls
) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
747 state
->trigger_sni_changes
= TRUE
;
752 /* useful for debugging */
753 saved_tls_certificate
= state
->exp_tls_certificate
;
754 saved_tls_privatekey
= state
->exp_tls_privatekey
;
755 saved_tls_verify_certificates
= state
->exp_tls_verify_certificates
;
756 saved_tls_crl
= state
->exp_tls_crl
;
760 rc
= gnutls_certificate_allocate_credentials(&state
->x509_cred
);
761 exim_gnutls_err_check(US
"gnutls_certificate_allocate_credentials");
763 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
764 state members, assuming consistent naming; and expand_check() returns
765 false if expansion failed, unless expansion was forced to fail. */
767 /* check if we at least have a certificate, before doing expensive
770 if (!expand_check_tlsvar(tls_certificate
))
773 /* certificate is mandatory in server, optional in client */
775 if ((state
->exp_tls_certificate
== NULL
) ||
776 (*state
->exp_tls_certificate
== '\0'))
779 return tls_error(US
"no TLS server certificate is specified", NULL
, NULL
);
781 DEBUG(D_tls
) debug_printf("TLS: no client certificate specified; okay\n");
784 if (state
->tls_privatekey
&& !expand_check_tlsvar(tls_privatekey
))
787 /* tls_privatekey is optional, defaulting to same file as certificate */
789 if (state
->tls_privatekey
== NULL
|| *state
->tls_privatekey
== '\0')
791 state
->tls_privatekey
= state
->tls_certificate
;
792 state
->exp_tls_privatekey
= state
->exp_tls_certificate
;
796 if (state
->exp_tls_certificate
&& *state
->exp_tls_certificate
)
798 DEBUG(D_tls
) debug_printf("certificate file = %s\nkey file = %s\n",
799 state
->exp_tls_certificate
, state
->exp_tls_privatekey
);
801 if (state
->received_sni
)
803 if ((Ustrcmp(state
->exp_tls_certificate
, saved_tls_certificate
) == 0) &&
804 (Ustrcmp(state
->exp_tls_privatekey
, saved_tls_privatekey
) == 0))
806 DEBUG(D_tls
) debug_printf("TLS SNI: cert and key unchanged\n");
810 DEBUG(D_tls
) debug_printf("TLS SNI: have a changed cert/key pair.\n");
814 rc
= gnutls_certificate_set_x509_key_file(state
->x509_cred
,
815 CS state
->exp_tls_certificate
, CS state
->exp_tls_privatekey
,
816 GNUTLS_X509_FMT_PEM
);
817 exim_gnutls_err_check(
818 string_sprintf("cert/key setup: cert=%s key=%s",
819 state
->exp_tls_certificate
, state
->exp_tls_privatekey
));
820 DEBUG(D_tls
) debug_printf("TLS: cert/key registered\n");
821 } /* tls_certificate */
824 /* Set the OCSP stapling server info */
827 if ( !host
/* server */
831 if (!expand_check(tls_ocsp_file
, US
"tls_ocsp_file",
832 &state
->exp_tls_ocsp_file
))
835 /* Use the full callback method for stapling just to get observability.
836 More efficient would be to read the file once only, if it never changed
837 (due to SNI). Would need restart on file update, or watch datestamp. */
839 gnutls_certificate_set_ocsp_status_request_function(state
->x509_cred
,
840 server_ocsp_stapling_cb
, state
->exp_tls_ocsp_file
);
842 DEBUG(D_tls
) debug_printf("Set OCSP response file %s\n", &state
->exp_tls_ocsp_file
);
847 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
848 provided. Experiment shows that, if the certificate file is empty, an unhelpful
849 error message is provided. However, if we just refrain from setting anything up
850 in that case, certificate verification fails, which seems to be the correct
853 if (state
->tls_verify_certificates
&& *state
->tls_verify_certificates
)
855 if (!expand_check_tlsvar(tls_verify_certificates
))
857 if (state
->tls_crl
&& *state
->tls_crl
)
858 if (!expand_check_tlsvar(tls_crl
))
861 if (!(state
->exp_tls_verify_certificates
&&
862 *state
->exp_tls_verify_certificates
))
865 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
866 /* With no tls_verify_certificates, we ignore tls_crl too */
873 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
877 if (Ustat(state
->exp_tls_verify_certificates
, &statbuf
) < 0)
879 log_write(0, LOG_MAIN
|LOG_PANIC
, "could not stat %s "
880 "(tls_verify_certificates): %s", state
->exp_tls_verify_certificates
,
885 #ifndef SUPPORT_CA_DIR
886 /* The test suite passes in /dev/null; we could check for that path explicitly,
887 but who knows if someone has some weird FIFO which always dumps some certs, or
888 other weirdness. The thing we really want to check is that it's not a
889 directory, since while OpenSSL supports that, GnuTLS does not.
890 So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
891 if (S_ISDIR(statbuf
.st_mode
))
894 debug_printf("verify certificates path is a dir: \"%s\"\n",
895 state
->exp_tls_verify_certificates
);
896 log_write(0, LOG_MAIN
|LOG_PANIC
,
897 "tls_verify_certificates \"%s\" is a directory",
898 state
->exp_tls_verify_certificates
);
903 DEBUG(D_tls
) debug_printf("verify certificates = %s size=" OFF_T_FMT
"\n",
904 state
->exp_tls_verify_certificates
, statbuf
.st_size
);
906 if (statbuf
.st_size
== 0)
909 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
915 #ifdef SUPPORT_CA_DIR
916 (statbuf
.st_mode
& S_IFMT
) == S_IFDIR
918 gnutls_certificate_set_x509_trust_dir(state
->x509_cred
,
919 CS state
->exp_tls_verify_certificates
, GNUTLS_X509_FMT_PEM
)
922 gnutls_certificate_set_x509_trust_file(state
->x509_cred
,
923 CS state
->exp_tls_verify_certificates
, GNUTLS_X509_FMT_PEM
);
928 exim_gnutls_err_check(US
"gnutls_certificate_set_x509_trust_file");
930 DEBUG(D_tls
) debug_printf("Added %d certificate authorities.\n", cert_count
);
932 if (state
->tls_crl
&& *state
->tls_crl
&&
933 state
->exp_tls_crl
&& *state
->exp_tls_crl
)
935 DEBUG(D_tls
) debug_printf("loading CRL file = %s\n", state
->exp_tls_crl
);
936 cert_count
= gnutls_certificate_set_x509_crl_file(state
->x509_cred
,
937 CS state
->exp_tls_crl
, GNUTLS_X509_FMT_PEM
);
941 exim_gnutls_err_check(US
"gnutls_certificate_set_x509_crl_file");
943 DEBUG(D_tls
) debug_printf("Processed %d CRLs.\n", cert_count
);
952 /*************************************************
953 * Set X.509 state variables *
954 *************************************************/
956 /* In GnuTLS, the registered cert/key are not replaced by a later
957 set of a cert/key, so for SNI support we need a whole new x509_cred
958 structure. Which means various other non-re-expanded pieces of state
959 need to be re-set in the new struct, so the setting logic is pulled
963 state exim_gnutls_state_st *
965 Returns: OK/DEFER/FAIL
969 tls_set_remaining_x509(exim_gnutls_state_st
*state
)
972 const host_item
*host
= state
->host
; /* macro should be reconsidered? */
974 /* Create D-H parameters, or read them from the cache file. This function does
975 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
976 client-side params. */
980 if (!dh_server_params
)
982 rc
= init_server_dh();
983 if (rc
!= OK
) return rc
;
985 gnutls_certificate_set_dh_params(state
->x509_cred
, dh_server_params
);
988 /* Link the credentials to the session. */
990 rc
= gnutls_credentials_set(state
->session
, GNUTLS_CRD_CERTIFICATE
, state
->x509_cred
);
991 exim_gnutls_err_check(US
"gnutls_credentials_set");
996 /*************************************************
997 * Initialize for GnuTLS *
998 *************************************************/
1000 /* Called from both server and client code. In the case of a server, errors
1001 before actual TLS negotiation return DEFER.
1004 host connected host, if client; NULL if server
1005 certificate certificate file
1006 privatekey private key file
1007 sni TLS SNI to send, sometimes when client; else NULL
1010 require_ciphers tls_require_ciphers setting
1011 caller_state returned state-info structure
1013 Returns: OK/DEFER/FAIL
1018 const host_item
*host
,
1019 const uschar
*certificate
,
1020 const uschar
*privatekey
,
1024 const uschar
*require_ciphers
,
1025 exim_gnutls_state_st
**caller_state
)
1027 exim_gnutls_state_st
*state
;
1032 BOOL want_default_priorities
;
1034 if (!exim_gnutls_base_init_done
)
1036 DEBUG(D_tls
) debug_printf("GnuTLS global init required.\n");
1038 #ifdef HAVE_GNUTLS_PKCS11
1039 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1040 which loads modules from a config file, which sounds good and may be wanted
1041 by some sysadmin, but also means in common configurations that GNOME keyring
1042 environment variables are used and so breaks for users calling mailq.
1043 To prevent this, we init PKCS11 first, which is the documented approach. */
1044 if (!gnutls_allow_auto_pkcs11
)
1046 rc
= gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL
, NULL
);
1047 exim_gnutls_err_check(US
"gnutls_pkcs11_init");
1051 rc
= gnutls_global_init();
1052 exim_gnutls_err_check(US
"gnutls_global_init");
1054 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1057 gnutls_global_set_log_function(exim_gnutls_logger_cb
);
1058 /* arbitrarily chosen level; bump upto 9 for more */
1059 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL
);
1063 exim_gnutls_base_init_done
= TRUE
;
1068 state
= &state_client
;
1069 memcpy(state
, &exim_gnutls_state_init
, sizeof(exim_gnutls_state_init
));
1070 state
->tlsp
= &tls_out
;
1071 DEBUG(D_tls
) debug_printf("initialising GnuTLS client session\n");
1072 rc
= gnutls_init(&state
->session
, GNUTLS_CLIENT
);
1076 state
= &state_server
;
1077 memcpy(state
, &exim_gnutls_state_init
, sizeof(exim_gnutls_state_init
));
1078 state
->tlsp
= &tls_in
;
1079 DEBUG(D_tls
) debug_printf("initialising GnuTLS server session\n");
1080 rc
= gnutls_init(&state
->session
, GNUTLS_SERVER
);
1082 exim_gnutls_err_check(US
"gnutls_init");
1086 state
->tls_certificate
= certificate
;
1087 state
->tls_privatekey
= privatekey
;
1088 state
->tls_require_ciphers
= require_ciphers
;
1089 state
->tls_sni
= sni
;
1090 state
->tls_verify_certificates
= cas
;
1091 state
->tls_crl
= crl
;
1093 /* This handles the variables that might get re-expanded after TLS SNI;
1094 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1097 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1098 rc
= tls_expand_session_files(state
);
1099 if (rc
!= OK
) return rc
;
1101 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1102 requires a new structure afterwards. */
1104 rc
= tls_set_remaining_x509(state
);
1105 if (rc
!= OK
) return rc
;
1107 /* set SNI in client, only */
1110 if (!expand_check(sni
, US
"tls_out_sni", &state
->tlsp
->sni
))
1112 if (state
->tlsp
->sni
&& *state
->tlsp
->sni
)
1115 debug_printf("Setting TLS client SNI to \"%s\"\n", state
->tlsp
->sni
);
1116 sz
= Ustrlen(state
->tlsp
->sni
);
1117 rc
= gnutls_server_name_set(state
->session
,
1118 GNUTLS_NAME_DNS
, state
->tlsp
->sni
, sz
);
1119 exim_gnutls_err_check(US
"gnutls_server_name_set");
1122 else if (state
->tls_sni
)
1123 DEBUG(D_tls
) debug_printf("*** PROBABLY A BUG *** " \
1124 "have an SNI set for a client [%s]\n", state
->tls_sni
);
1126 /* This is the priority string support,
1127 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1128 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1129 This was backwards incompatible, but means Exim no longer needs to track
1130 all algorithms and provide string forms for them. */
1132 want_default_priorities
= TRUE
;
1134 if (state
->tls_require_ciphers
&& *state
->tls_require_ciphers
)
1136 if (!expand_check_tlsvar(tls_require_ciphers
))
1138 if (state
->exp_tls_require_ciphers
&& *state
->exp_tls_require_ciphers
)
1140 DEBUG(D_tls
) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1141 state
->exp_tls_require_ciphers
);
1143 rc
= gnutls_priority_init(&state
->priority_cache
,
1144 CS state
->exp_tls_require_ciphers
, &errpos
);
1145 want_default_priorities
= FALSE
;
1146 p
= state
->exp_tls_require_ciphers
;
1149 if (want_default_priorities
)
1152 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1153 exim_default_gnutls_priority
);
1154 rc
= gnutls_priority_init(&state
->priority_cache
,
1155 exim_default_gnutls_priority
, &errpos
);
1156 p
= US exim_default_gnutls_priority
;
1159 exim_gnutls_err_check(string_sprintf(
1160 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1161 p
, errpos
- CS p
, errpos
));
1163 rc
= gnutls_priority_set(state
->session
, state
->priority_cache
);
1164 exim_gnutls_err_check(US
"gnutls_priority_set");
1166 gnutls_db_set_cache_expiration(state
->session
, ssl_session_timeout
);
1168 /* Reduce security in favour of increased compatibility, if the admin
1169 decides to make that trade-off. */
1170 if (gnutls_compat_mode
)
1172 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1173 DEBUG(D_tls
) debug_printf("lowering GnuTLS security, compatibility mode\n");
1174 gnutls_session_enable_compatibility_mode(state
->session
);
1176 DEBUG(D_tls
) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1180 *caller_state
= state
;
1186 /*************************************************
1187 * Extract peer information *
1188 *************************************************/
1190 /* Called from both server and client code.
1191 Only this is allowed to set state->peerdn and state->have_set_peerdn
1192 and we use that to detect double-calls.
1194 NOTE: the state blocks last while the TLS connection is up, which is fine
1195 for logging in the server side, but for the client side, we log after teardown
1196 in src/deliver.c. While the session is up, we can twist about states and
1197 repoint tls_* globals, but those variables used for logging or other variable
1198 expansion that happens _after_ delivery need to have a longer life-time.
1200 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1201 doing this more than once per generation of a state context. We set them in
1202 the state context, and repoint tls_* to them. After the state goes away, the
1203 tls_* copies of the pointers remain valid and client delivery logging is happy.
1205 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1209 state exim_gnutls_state_st *
1211 Returns: OK/DEFER/FAIL
1215 peer_status(exim_gnutls_state_st
*state
)
1217 uschar cipherbuf
[256];
1218 const gnutls_datum
*cert_list
;
1220 unsigned int cert_list_size
= 0;
1221 gnutls_protocol_t protocol
;
1222 gnutls_cipher_algorithm_t cipher
;
1223 gnutls_kx_algorithm_t kx
;
1224 gnutls_mac_algorithm_t mac
;
1225 gnutls_certificate_type_t ct
;
1226 gnutls_x509_crt_t crt
;
1230 if (state
->have_set_peerdn
)
1232 state
->have_set_peerdn
= TRUE
;
1234 state
->peerdn
= NULL
;
1237 cipher
= gnutls_cipher_get(state
->session
);
1238 protocol
= gnutls_protocol_get_version(state
->session
);
1239 mac
= gnutls_mac_get(state
->session
);
1240 kx
= gnutls_kx_get(state
->session
);
1242 string_format(cipherbuf
, sizeof(cipherbuf
),
1244 gnutls_protocol_get_name(protocol
),
1245 gnutls_cipher_suite_get_name(kx
, cipher
, mac
),
1246 (int) gnutls_cipher_get_key_size(cipher
) * 8);
1248 /* I don't see a way that spaces could occur, in the current GnuTLS
1249 code base, but it was a concern in the old code and perhaps older GnuTLS
1250 releases did return "TLS 1.0"; play it safe, just in case. */
1251 for (p
= cipherbuf
; *p
!= '\0'; ++p
)
1254 old_pool
= store_pool
;
1255 store_pool
= POOL_PERM
;
1256 state
->ciphersuite
= string_copy(cipherbuf
);
1257 store_pool
= old_pool
;
1258 state
->tlsp
->cipher
= state
->ciphersuite
;
1261 cert_list
= gnutls_certificate_get_peers(state
->session
, &cert_list_size
);
1263 if (cert_list
== NULL
|| cert_list_size
== 0)
1265 DEBUG(D_tls
) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1266 cert_list
, cert_list_size
);
1267 if (state
->verify_requirement
>= VERIFY_REQUIRED
)
1268 return tls_error(US
"certificate verification failed",
1269 "no certificate received from peer", state
->host
);
1273 ct
= gnutls_certificate_type_get(state
->session
);
1274 if (ct
!= GNUTLS_CRT_X509
)
1276 const char *ctn
= gnutls_certificate_type_get_name(ct
);
1278 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn
);
1279 if (state
->verify_requirement
>= VERIFY_REQUIRED
)
1280 return tls_error(US
"certificate verification not possible, unhandled type",
1285 #define exim_gnutls_peer_err(Label) \
1287 if (rc != GNUTLS_E_SUCCESS) \
1289 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1290 (Label), gnutls_strerror(rc)); \
1291 if (state->verify_requirement >= VERIFY_REQUIRED) \
1292 return tls_error((Label), gnutls_strerror(rc), state->host); \
1297 rc
= import_cert(&cert_list
[0], &crt
);
1298 exim_gnutls_peer_err(US
"cert 0");
1300 state
->tlsp
->peercert
= state
->peercert
= crt
;
1303 rc
= gnutls_x509_crt_get_dn(crt
, NULL
, &sz
);
1304 if (rc
!= GNUTLS_E_SHORT_MEMORY_BUFFER
)
1306 exim_gnutls_peer_err(US
"getting size for cert DN failed");
1307 return FAIL
; /* should not happen */
1309 dn_buf
= store_get_perm(sz
);
1310 rc
= gnutls_x509_crt_get_dn(crt
, CS dn_buf
, &sz
);
1311 exim_gnutls_peer_err(US
"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1313 state
->peerdn
= dn_buf
;
1316 #undef exim_gnutls_peer_err
1322 /*************************************************
1323 * Verify peer certificate *
1324 *************************************************/
1326 /* Called from both server and client code.
1327 *Should* be using a callback registered with
1328 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1329 the peer information, but that's too new for some OSes.
1332 state exim_gnutls_state_st *
1333 error where to put an error message
1336 FALSE if the session should be rejected
1337 TRUE if the cert is okay or we just don't care
1341 verify_certificate(exim_gnutls_state_st
*state
, const char **error
)
1344 unsigned int verify
;
1348 if ((rc
= peer_status(state
)) != OK
)
1350 verify
= GNUTLS_CERT_INVALID
;
1351 *error
= "certificate not supplied";
1354 rc
= gnutls_certificate_verify_peers2(state
->session
, &verify
);
1356 /* Handle the result of verification. INVALID seems to be set as well
1357 as REVOKED, but leave the test for both. */
1360 verify
& (GNUTLS_CERT_INVALID
|GNUTLS_CERT_REVOKED
)
1363 state
->peer_cert_verified
= FALSE
;
1365 *error
= verify
& GNUTLS_CERT_REVOKED
1366 ? "certificate revoked" : "certificate invalid";
1369 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1370 *error
, state
->peerdn
? state
->peerdn
: US
"<unset>");
1372 if (state
->verify_requirement
>= VERIFY_REQUIRED
)
1374 gnutls_alert_send(state
->session
,
1375 GNUTLS_AL_FATAL
, GNUTLS_A_BAD_CERTIFICATE
);
1379 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1384 if (state
->exp_tls_verify_cert_hostnames
)
1387 uschar
* list
= state
->exp_tls_verify_cert_hostnames
;
1389 while (name
= string_nextinlist(&list
, &sep
, NULL
, 0))
1390 if (gnutls_x509_crt_check_hostname(state
->tlsp
->peercert
, CS name
))
1395 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1396 if (state
->verify_requirement
>= VERIFY_REQUIRED
)
1398 gnutls_alert_send(state
->session
,
1399 GNUTLS_AL_FATAL
, GNUTLS_A_BAD_CERTIFICATE
);
1405 state
->peer_cert_verified
= TRUE
;
1406 DEBUG(D_tls
) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1407 state
->peerdn
? state
->peerdn
: US
"<unset>");
1410 state
->tlsp
->peerdn
= state
->peerdn
;
1418 /* ------------------------------------------------------------------------ */
1421 /* Logging function which can be registered with
1422 * gnutls_global_set_log_function()
1423 * gnutls_global_set_log_level() 0..9
1425 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1427 exim_gnutls_logger_cb(int level
, const char *message
)
1429 size_t len
= strlen(message
);
1432 DEBUG(D_tls
) debug_printf("GnuTLS<%d> empty debug message\n", level
);
1435 DEBUG(D_tls
) debug_printf("GnuTLS<%d>: %s%s", level
, message
,
1436 message
[len
-1] == '\n' ? "" : "\n");
1441 /* Called after client hello, should handle SNI work.
1442 This will always set tls_sni (state->received_sni) if available,
1443 and may trigger presenting different certificates,
1444 if state->trigger_sni_changes is TRUE.
1446 Should be registered with
1447 gnutls_handshake_set_post_client_hello_function()
1449 "This callback must return 0 on success or a gnutls error code to terminate the
1452 For inability to get SNI information, we return 0.
1453 We only return non-zero if re-setup failed.
1454 Only used for server-side TLS.
1458 exim_sni_handling_cb(gnutls_session_t session
)
1460 char sni_name
[MAX_HOST_LEN
];
1461 size_t data_len
= MAX_HOST_LEN
;
1462 exim_gnutls_state_st
*state
= &state_server
;
1463 unsigned int sni_type
;
1466 rc
= gnutls_server_name_get(session
, sni_name
, &data_len
, &sni_type
, 0);
1467 if (rc
!= GNUTLS_E_SUCCESS
)
1470 if (rc
== GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
)
1471 debug_printf("TLS: no SNI presented in handshake.\n");
1473 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1474 gnutls_strerror(rc
), rc
);
1479 if (sni_type
!= GNUTLS_NAME_DNS
)
1481 DEBUG(D_tls
) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type
);
1485 /* We now have a UTF-8 string in sni_name */
1486 old_pool
= store_pool
;
1487 store_pool
= POOL_PERM
;
1488 state
->received_sni
= string_copyn(US sni_name
, data_len
);
1489 store_pool
= old_pool
;
1491 /* We set this one now so that variable expansions below will work */
1492 state
->tlsp
->sni
= state
->received_sni
;
1494 DEBUG(D_tls
) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name
,
1495 state
->trigger_sni_changes
? "" : " (unused for certificate selection)");
1497 if (!state
->trigger_sni_changes
)
1500 rc
= tls_expand_session_files(state
);
1503 /* If the setup of certs/etc failed before handshake, TLS would not have
1504 been offered. The best we can do now is abort. */
1505 return GNUTLS_E_APPLICATION_ERROR_MIN
;
1508 rc
= tls_set_remaining_x509(state
);
1509 if (rc
!= OK
) return GNUTLS_E_APPLICATION_ERROR_MIN
;
1516 #ifndef DISABLE_OCSP
1519 server_ocsp_stapling_cb(gnutls_session_t session
, void * ptr
,
1520 gnutls_datum_t
* ocsp_response
)
1524 if ((ret
= gnutls_load_file(ptr
, ocsp_response
)) < 0)
1526 DEBUG(D_tls
) debug_printf("Failed to load ocsp stapling file %s\n",
1528 tls_in
.ocsp
= OCSP_NOT_RESP
;
1529 return GNUTLS_E_NO_CERTIFICATE_STATUS
;
1532 tls_in
.ocsp
= OCSP_VFY_NOT_TRIED
;
1539 #ifdef EXPERIMENTAL_EVENT
1541 We use this callback to get observability and detail-level control
1542 for an exim TLS connection (either direction), raising a tls:cert event
1543 for each cert in the chain presented by the peer. Any event
1544 can deny verification.
1546 Return 0 for the handshake to continue or non-zero to terminate.
1550 verify_cb(gnutls_session_t session
)
1552 const gnutls_datum
* cert_list
;
1553 unsigned int cert_list_size
= 0;
1554 gnutls_x509_crt_t crt
;
1557 exim_gnutls_state_st
* state
= gnutls_session_get_ptr(session
);
1559 cert_list
= gnutls_certificate_get_peers(session
, &cert_list_size
);
1561 while (cert_list_size
--)
1563 rc
= import_cert(&cert_list
[cert_list_size
], &crt
);
1564 if (rc
!= GNUTLS_E_SUCCESS
)
1566 DEBUG(D_tls
) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1567 cert_list_size
, gnutls_strerror(rc
));
1571 state
->tlsp
->peercert
= crt
;
1572 if ((yield
= event_raise(state
->event_action
,
1573 US
"tls:cert", string_sprintf("%d", cert_list_size
))))
1575 log_write(0, LOG_MAIN
,
1576 "SSL verify denied by event-action: depth=%d: %s",
1577 cert_list_size
, yield
);
1578 return 1; /* reject */
1580 state
->tlsp
->peercert
= NULL
;
1590 /* ------------------------------------------------------------------------ */
1591 /* Exported functions */
1596 /*************************************************
1597 * Start a TLS session in a server *
1598 *************************************************/
1600 /* This is called when Exim is running as a server, after having received
1601 the STARTTLS command. It must respond to that command, and then negotiate
1605 require_ciphers list of allowed ciphers or NULL
1607 Returns: OK on success
1608 DEFER for errors before the start of the negotiation
1609 FAIL for errors during the negotation; the server can't
1614 tls_server_start(const uschar
*require_ciphers
)
1618 exim_gnutls_state_st
*state
= NULL
;
1620 /* Check for previous activation */
1621 if (tls_in
.active
>= 0)
1623 tls_error(US
"STARTTLS received after TLS started", "", NULL
);
1624 smtp_printf("554 Already in TLS\r\n");
1628 /* Initialize the library. If it fails, it will already have logged the error
1629 and sent an SMTP response. */
1631 DEBUG(D_tls
) debug_printf("initialising GnuTLS as a server\n");
1633 rc
= tls_init(NULL
, tls_certificate
, tls_privatekey
,
1634 NULL
, tls_verify_certificates
, tls_crl
,
1635 require_ciphers
, &state
);
1636 if (rc
!= OK
) return rc
;
1638 /* If this is a host for which certificate verification is mandatory or
1639 optional, set up appropriately. */
1641 if (verify_check_host(&tls_verify_hosts
) == OK
)
1644 debug_printf("TLS: a client certificate will be required.\n");
1645 state
->verify_requirement
= VERIFY_REQUIRED
;
1646 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUIRE
);
1648 else if (verify_check_host(&tls_try_verify_hosts
) == OK
)
1651 debug_printf("TLS: a client certificate will be requested but not required.\n");
1652 state
->verify_requirement
= VERIFY_OPTIONAL
;
1653 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUEST
);
1658 debug_printf("TLS: a client certificate will not be requested.\n");
1659 state
->verify_requirement
= VERIFY_NONE
;
1660 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_IGNORE
);
1663 #ifdef EXPERIMENTAL_EVENT
1666 state
->event_action
= event_action
;
1667 gnutls_session_set_ptr(state
->session
, state
);
1668 gnutls_certificate_set_verify_function(state
->x509_cred
, verify_cb
);
1672 /* Register SNI handling; always, even if not in tls_certificate, so that the
1673 expansion variable $tls_sni is always available. */
1675 gnutls_handshake_set_post_client_hello_function(state
->session
,
1676 exim_sni_handling_cb
);
1678 /* Set context and tell client to go ahead, except in the case of TLS startup
1679 on connection, where outputting anything now upsets the clients and tends to
1680 make them disconnect. We need to have an explicit fflush() here, to force out
1681 the response. Other smtp_printf() calls do not need it, because in non-TLS
1682 mode, the fflush() happens when smtp_getc() is called. */
1684 if (!state
->tlsp
->on_connect
)
1686 smtp_printf("220 TLS go ahead\r\n");
1690 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1691 that the GnuTLS library doesn't. */
1693 gnutls_transport_set_ptr2(state
->session
,
1694 (gnutls_transport_ptr
)(long) fileno(smtp_in
),
1695 (gnutls_transport_ptr
)(long) fileno(smtp_out
));
1696 state
->fd_in
= fileno(smtp_in
);
1697 state
->fd_out
= fileno(smtp_out
);
1699 sigalrm_seen
= FALSE
;
1700 if (smtp_receive_timeout
> 0) alarm(smtp_receive_timeout
);
1703 rc
= gnutls_handshake(state
->session
);
1704 } while ((rc
== GNUTLS_E_AGAIN
) ||
1705 (rc
== GNUTLS_E_INTERRUPTED
&& !sigalrm_seen
));
1708 if (rc
!= GNUTLS_E_SUCCESS
)
1710 tls_error(US
"gnutls_handshake",
1711 sigalrm_seen
? "timed out" : gnutls_strerror(rc
), NULL
);
1712 /* It seems that, except in the case of a timeout, we have to close the
1713 connection right here; otherwise if the other end is running OpenSSL it hangs
1714 until the server times out. */
1718 (void)fclose(smtp_out
);
1719 (void)fclose(smtp_in
);
1725 DEBUG(D_tls
) debug_printf("gnutls_handshake was successful\n");
1727 /* Verify after the fact */
1729 if ( state
->verify_requirement
!= VERIFY_NONE
1730 && !verify_certificate(state
, &error
))
1732 if (state
->verify_requirement
!= VERIFY_OPTIONAL
)
1734 tls_error(US
"certificate verification failed", error
, NULL
);
1738 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1742 /* Figure out peer DN, and if authenticated, etc. */
1744 rc
= peer_status(state
);
1745 if (rc
!= OK
) return rc
;
1747 /* Sets various Exim expansion variables; always safe within server */
1749 extract_exim_vars_from_tls_state(state
);
1751 /* TLS has been set up. Adjust the input functions to read via TLS,
1752 and initialize appropriately. */
1754 state
->xfer_buffer
= store_malloc(ssl_xfer_buffer_size
);
1756 receive_getc
= tls_getc
;
1757 receive_ungetc
= tls_ungetc
;
1758 receive_feof
= tls_feof
;
1759 receive_ferror
= tls_ferror
;
1760 receive_smtp_buffered
= tls_smtp_buffered
;
1769 tls_client_setup_hostname_checks(host_item
* host
, exim_gnutls_state_st
* state
,
1770 smtp_transport_options_block
* ob
)
1772 if (verify_check_given_host(&ob
->tls_verify_cert_hostnames
, host
) == OK
)
1774 state
->exp_tls_verify_cert_hostnames
= host
->name
;
1776 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
1777 state
->exp_tls_verify_cert_hostnames
);
1782 /*************************************************
1783 * Start a TLS session in a client *
1784 *************************************************/
1786 /* Called from the smtp transport after STARTTLS has been accepted.
1789 fd the fd of the connection
1790 host connected host (for messages)
1791 addr the first address (not used)
1792 tb transport (always smtp)
1794 Returns: OK/DEFER/FAIL (because using common functions),
1795 but for a client, DEFER and FAIL have the same meaning
1799 tls_client_start(int fd
, host_item
*host
,
1800 address_item
*addr ARG_UNUSED
,
1801 transport_instance
*tb
1802 #ifdef EXPERIMENTAL_DANE
1803 , dne_answer
* unused_tlsa_dnsa
1807 smtp_transport_options_block
*ob
=
1808 (smtp_transport_options_block
*)tb
->options_block
;
1811 exim_gnutls_state_st
*state
= NULL
;
1812 #ifndef DISABLE_OCSP
1814 verify_check_given_host(&ob
->hosts_require_ocsp
, host
) == OK
;
1815 BOOL request_ocsp
= require_ocsp
? TRUE
1816 : verify_check_given_host(&ob
->hosts_request_ocsp
, host
) == OK
;
1819 DEBUG(D_tls
) debug_printf("initialising GnuTLS as a client on fd %d\n", fd
);
1821 if ((rc
= tls_init(host
, ob
->tls_certificate
, ob
->tls_privatekey
,
1822 ob
->tls_sni
, ob
->tls_verify_certificates
, ob
->tls_crl
,
1823 ob
->tls_require_ciphers
, &state
)) != OK
)
1827 int dh_min_bits
= ob
->tls_dh_min_bits
;
1828 if (dh_min_bits
< EXIM_CLIENT_DH_MIN_MIN_BITS
)
1831 debug_printf("WARNING: tls_dh_min_bits far too low,"
1832 " clamping %d up to %d\n",
1833 dh_min_bits
, EXIM_CLIENT_DH_MIN_MIN_BITS
);
1834 dh_min_bits
= EXIM_CLIENT_DH_MIN_MIN_BITS
;
1837 DEBUG(D_tls
) debug_printf("Setting D-H prime minimum"
1838 " acceptable bits to %d\n",
1840 gnutls_dh_set_prime_bits(state
->session
, dh_min_bits
);
1843 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
1844 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
1845 the specified host patterns if one of them is defined */
1847 if ( ( state
->exp_tls_verify_certificates
1848 && !ob
->tls_verify_hosts
1849 && !ob
->tls_try_verify_hosts
1851 || verify_check_given_host(&ob
->tls_verify_hosts
, host
) == OK
1854 tls_client_setup_hostname_checks(host
, state
, ob
);
1856 debug_printf("TLS: server certificate verification required.\n");
1857 state
->verify_requirement
= VERIFY_REQUIRED
;
1858 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUIRE
);
1860 else if (verify_check_given_host(&ob
->tls_try_verify_hosts
, host
) == OK
)
1862 tls_client_setup_hostname_checks(host
, state
, ob
);
1864 debug_printf("TLS: server certificate verification optional.\n");
1865 state
->verify_requirement
= VERIFY_OPTIONAL
;
1866 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUEST
);
1871 debug_printf("TLS: server certificate verification not required.\n");
1872 state
->verify_requirement
= VERIFY_NONE
;
1873 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_IGNORE
);
1876 #ifndef DISABLE_OCSP
1877 /* supported since GnuTLS 3.1.3 */
1880 DEBUG(D_tls
) debug_printf("TLS: will request OCSP stapling\n");
1881 if ((rc
= gnutls_ocsp_status_request_enable_client(state
->session
,
1882 NULL
, 0, NULL
)) != OK
)
1883 return tls_error(US
"cert-status-req",
1884 gnutls_strerror(rc
), state
->host
);
1885 tls_out
.ocsp
= OCSP_NOT_RESP
;
1889 #ifdef EXPERIMENTAL_EVENT
1890 if (tb
->event_action
)
1892 state
->event_action
= tb
->event_action
;
1893 gnutls_session_set_ptr(state
->session
, state
);
1894 gnutls_certificate_set_verify_function(state
->x509_cred
, verify_cb
);
1898 gnutls_transport_set_ptr(state
->session
, (gnutls_transport_ptr
)(long) fd
);
1902 DEBUG(D_tls
) debug_printf("about to gnutls_handshake\n");
1903 /* There doesn't seem to be a built-in timeout on connection. */
1905 sigalrm_seen
= FALSE
;
1906 alarm(ob
->command_timeout
);
1909 rc
= gnutls_handshake(state
->session
);
1910 } while ((rc
== GNUTLS_E_AGAIN
) ||
1911 (rc
== GNUTLS_E_INTERRUPTED
&& !sigalrm_seen
));
1914 if (rc
!= GNUTLS_E_SUCCESS
)
1915 return tls_error(US
"gnutls_handshake",
1916 sigalrm_seen
? "timed out" : gnutls_strerror(rc
), state
->host
);
1918 DEBUG(D_tls
) debug_printf("gnutls_handshake was successful\n");
1922 if (state
->verify_requirement
!= VERIFY_NONE
&&
1923 !verify_certificate(state
, &error
))
1924 return tls_error(US
"certificate verification failed", error
, state
->host
);
1926 #ifndef DISABLE_OCSP
1931 gnutls_datum_t stapling
;
1932 gnutls_ocsp_resp_t resp
;
1933 gnutls_datum_t printed
;
1934 if ( (rc
= gnutls_ocsp_status_request_get(state
->session
, &stapling
)) == 0
1935 && (rc
= gnutls_ocsp_resp_init(&resp
)) == 0
1936 && (rc
= gnutls_ocsp_resp_import(resp
, &stapling
)) == 0
1937 && (rc
= gnutls_ocsp_resp_print(resp
, GNUTLS_OCSP_PRINT_FULL
, &printed
)) == 0
1940 debug_printf("%.4096s", printed
.data
);
1941 gnutls_free(printed
.data
);
1944 (void) tls_error(US
"ocsp decode", gnutls_strerror(rc
), state
->host
);
1947 if (gnutls_ocsp_status_request_is_checked(state
->session
, 0) == 0)
1949 tls_out
.ocsp
= OCSP_FAILED
;
1950 return tls_error(US
"certificate status check failed", NULL
, state
->host
);
1952 DEBUG(D_tls
) debug_printf("Passed OCSP checking\n");
1953 tls_out
.ocsp
= OCSP_VFIED
;
1957 /* Figure out peer DN, and if authenticated, etc. */
1959 if ((rc
= peer_status(state
)) != OK
)
1962 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
1964 extract_exim_vars_from_tls_state(state
);
1972 /*************************************************
1973 * Close down a TLS session *
1974 *************************************************/
1976 /* This is also called from within a delivery subprocess forked from the
1977 daemon, to shut down the TLS library, without actually doing a shutdown (which
1978 would tamper with the TLS session in the parent process).
1980 Arguments: TRUE if gnutls_bye is to be called
1985 tls_close(BOOL is_server
, BOOL shutdown
)
1987 exim_gnutls_state_st
*state
= is_server
? &state_server
: &state_client
;
1989 if (!state
->tlsp
|| state
->tlsp
->active
< 0) return; /* TLS was not active */
1993 DEBUG(D_tls
) debug_printf("tls_close(): shutting down TLS\n");
1994 gnutls_bye(state
->session
, GNUTLS_SHUT_WR
);
1997 gnutls_deinit(state
->session
);
1999 state
->tlsp
->active
= -1;
2000 memcpy(state
, &exim_gnutls_state_init
, sizeof(exim_gnutls_state_init
));
2002 if ((state_server
.session
== NULL
) && (state_client
.session
== NULL
))
2004 gnutls_global_deinit();
2005 exim_gnutls_base_init_done
= FALSE
;
2013 /*************************************************
2014 * TLS version of getc *
2015 *************************************************/
2017 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2018 it refills the buffer via the GnuTLS reading function.
2019 Only used by the server-side TLS.
2021 This feeds DKIM and should be used for all message-body reads.
2024 Returns: the next character or EOF
2030 exim_gnutls_state_st
*state
= &state_server
;
2031 if (state
->xfer_buffer_lwm
>= state
->xfer_buffer_hwm
)
2035 DEBUG(D_tls
) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2036 state
->session
, state
->xfer_buffer
, ssl_xfer_buffer_size
);
2038 if (smtp_receive_timeout
> 0) alarm(smtp_receive_timeout
);
2039 inbytes
= gnutls_record_recv(state
->session
, state
->xfer_buffer
,
2040 ssl_xfer_buffer_size
);
2043 /* A zero-byte return appears to mean that the TLS session has been
2044 closed down, not that the socket itself has been closed down. Revert to
2045 non-TLS handling. */
2049 DEBUG(D_tls
) debug_printf("Got TLS_EOF\n");
2051 receive_getc
= smtp_getc
;
2052 receive_ungetc
= smtp_ungetc
;
2053 receive_feof
= smtp_feof
;
2054 receive_ferror
= smtp_ferror
;
2055 receive_smtp_buffered
= smtp_buffered
;
2057 gnutls_deinit(state
->session
);
2058 state
->session
= NULL
;
2059 state
->tlsp
->active
= -1;
2060 state
->tlsp
->bits
= 0;
2061 state
->tlsp
->certificate_verified
= FALSE
;
2062 tls_channelbinding_b64
= NULL
;
2063 state
->tlsp
->cipher
= NULL
;
2064 state
->tlsp
->peercert
= NULL
;
2065 state
->tlsp
->peerdn
= NULL
;
2070 /* Handle genuine errors */
2072 else if (inbytes
< 0)
2074 record_io_error(state
, (int) inbytes
, US
"recv", NULL
);
2075 state
->xfer_error
= 1;
2078 #ifndef DISABLE_DKIM
2079 dkim_exim_verify_feed(state
->xfer_buffer
, inbytes
);
2081 state
->xfer_buffer_hwm
= (int) inbytes
;
2082 state
->xfer_buffer_lwm
= 0;
2085 /* Something in the buffer; return next uschar */
2087 return state
->xfer_buffer
[state
->xfer_buffer_lwm
++];
2093 /*************************************************
2094 * Read bytes from TLS channel *
2095 *************************************************/
2097 /* This does not feed DKIM, so if the caller uses this for reading message body,
2098 then the caller must feed DKIM.
2104 Returns: the number of bytes read
2105 -1 after a failed read
2109 tls_read(BOOL is_server
, uschar
*buff
, size_t len
)
2111 exim_gnutls_state_st
*state
= is_server
? &state_server
: &state_client
;
2117 if (state
->xfer_buffer_lwm
< state
->xfer_buffer_hwm
)
2119 debug_printf("*** PROBABLY A BUG *** " \
2120 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2121 state
->xfer_buffer_hwm
- state
->xfer_buffer_lwm
);
2124 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT
")\n",
2125 state
->session
, buff
, len
);
2127 inbytes
= gnutls_record_recv(state
->session
, buff
, len
);
2128 if (inbytes
> 0) return inbytes
;
2131 DEBUG(D_tls
) debug_printf("Got TLS_EOF\n");
2133 else record_io_error(state
, (int)inbytes
, US
"recv", NULL
);
2141 /*************************************************
2142 * Write bytes down TLS channel *
2143 *************************************************/
2147 is_server channel specifier
2151 Returns: the number of bytes after a successful write,
2152 -1 after a failed write
2156 tls_write(BOOL is_server
, const uschar
*buff
, size_t len
)
2160 exim_gnutls_state_st
*state
= is_server
? &state_server
: &state_client
;
2162 DEBUG(D_tls
) debug_printf("tls_do_write(%p, " SIZE_T_FMT
")\n", buff
, left
);
2165 DEBUG(D_tls
) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT
")\n",
2167 outbytes
= gnutls_record_send(state
->session
, buff
, left
);
2169 DEBUG(D_tls
) debug_printf("outbytes=" SSIZE_T_FMT
"\n", outbytes
);
2172 record_io_error(state
, outbytes
, US
"send", NULL
);
2177 record_io_error(state
, 0, US
"send", US
"TLS channel closed on write");
2188 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT
") than INT_MAX\n",
2199 /*************************************************
2200 * Random number generation *
2201 *************************************************/
2203 /* Pseudo-random number generation. The result is not expected to be
2204 cryptographically strong but not so weak that someone will shoot themselves
2205 in the foot using it as a nonce in input in some email header scheme or
2206 whatever weirdness they'll twist this into. The result should handle fork()
2207 and avoid repeating sequences. OpenSSL handles that for us.
2211 Returns a random number in range [0, max-1]
2214 #ifdef HAVE_GNUTLS_RND
2216 vaguely_random_number(int max
)
2221 uschar smallbuf
[sizeof(r
)];
2226 needed_len
= sizeof(r
);
2227 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2228 * asked for a number less than 10. */
2229 for (r
= max
, i
= 0; r
; ++i
)
2235 i
= gnutls_rnd(GNUTLS_RND_NONCE
, smallbuf
, needed_len
);
2238 DEBUG(D_all
) debug_printf("gnutls_rnd() failed, using fallback.\n");
2239 return vaguely_random_number_fallback(max
);
2242 for (p
= smallbuf
; needed_len
; --needed_len
, ++p
)
2248 /* We don't particularly care about weighted results; if someone wants
2249 * smooth distribution and cares enough then they should submit a patch then. */
2252 #else /* HAVE_GNUTLS_RND */
2254 vaguely_random_number(int max
)
2256 return vaguely_random_number_fallback(max
);
2258 #endif /* HAVE_GNUTLS_RND */
2263 /*************************************************
2264 * Let tls_require_ciphers be checked at startup *
2265 *************************************************/
2267 /* The tls_require_ciphers option, if set, must be something which the
2270 Returns: NULL on success, or error message
2274 tls_validate_require_cipher(void)
2277 uschar
*expciphers
= NULL
;
2278 gnutls_priority_t priority_cache
;
2281 #define validate_check_rc(Label) do { \
2282 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2283 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2284 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2286 if (exim_gnutls_base_init_done
)
2287 log_write(0, LOG_MAIN
|LOG_PANIC
,
2288 "already initialised GnuTLS, Exim developer bug");
2290 #ifdef HAVE_GNUTLS_PKCS11
2291 if (!gnutls_allow_auto_pkcs11
)
2293 rc
= gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL
, NULL
);
2294 validate_check_rc(US
"gnutls_pkcs11_init");
2297 rc
= gnutls_global_init();
2298 validate_check_rc(US
"gnutls_global_init()");
2299 exim_gnutls_base_init_done
= TRUE
;
2301 if (!(tls_require_ciphers
&& *tls_require_ciphers
))
2302 return_deinit(NULL
);
2304 if (!expand_check(tls_require_ciphers
, US
"tls_require_ciphers", &expciphers
))
2305 return_deinit(US
"failed to expand tls_require_ciphers");
2307 if (!(expciphers
&& *expciphers
))
2308 return_deinit(NULL
);
2311 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers
);
2313 rc
= gnutls_priority_init(&priority_cache
, CS expciphers
, &errpos
);
2314 validate_check_rc(string_sprintf(
2315 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2316 expciphers
, errpos
- CS expciphers
, errpos
));
2318 #undef return_deinit
2319 #undef validate_check_rc
2320 gnutls_global_deinit();
2328 /*************************************************
2329 * Report the library versions. *
2330 *************************************************/
2332 /* See a description in tls-openssl.c for an explanation of why this exists.
2334 Arguments: a FILE* to print the results to
2339 tls_version_report(FILE *f
)
2341 fprintf(f
, "Library version: GnuTLS: Compile: %s\n"
2344 gnutls_check_version(NULL
));
2349 /* End of tls-gnu.c */