1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42 /* needed to disable PKCS11 autoload unless requested */
43 #if GNUTLS_VERSION_NUMBER >= 0x020c00
44 # include <gnutls/pkcs11.h>
45 # define SUPPORT_PARAM_TO_PK_BITS
47 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
48 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
51 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
52 # warning "GnuTLS library version too old; tls:cert event unsupported"
53 # define DISABLE_EVENT
55 #if GNUTLS_VERSION_NUMBER >= 0x030306
56 # define SUPPORT_CA_DIR
58 # undef SUPPORT_CA_DIR
60 #if GNUTLS_VERSION_NUMBER >= 0x030014
61 # define SUPPORT_SYSDEFAULT_CABUNDLE
63 #if GNUTLS_VERSION_NUMBER >= 0x030109
66 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
67 # define SUPPORT_SRV_OCSP_STACK
71 # if GNUTLS_VERSION_NUMBER >= 0x030000
72 # define DANESSL_USAGE_DANE_TA 2
73 # define DANESSL_USAGE_DANE_EE 3
75 # error GnuTLS version too early for DANE
77 # if GNUTLS_VERSION_NUMBER < 0x999999
78 # define GNUTLS_BROKEN_DANE_VALIDATION
83 # include <gnutls/ocsp.h>
86 # include <gnutls/dane.h>
92 gnutls_global_set_audit_log_function()
95 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
98 /* Local static variables for GnuTLS */
100 /* Values for verify_requirement */
102 enum peer_verify_requirement
103 { VERIFY_NONE
, VERIFY_OPTIONAL
, VERIFY_REQUIRED
, VERIFY_DANE
};
105 /* This holds most state for server or client; with this, we can set up an
106 outbound TLS-enabled connection in an ACL callout, while not stomping all
107 over the TLS variables available for expansion.
109 Some of these correspond to variables in globals.c; those variables will
110 be set to point to content in one of these instances, as appropriate for
111 the stage of the process lifetime.
113 Not handled here: global tls_channelbinding_b64.
116 typedef struct exim_gnutls_state
{
117 gnutls_session_t session
;
118 gnutls_certificate_credentials_t x509_cred
;
119 gnutls_priority_t priority_cache
;
120 enum peer_verify_requirement verify_requirement
;
123 BOOL peer_cert_verified
;
124 BOOL peer_dane_verified
;
125 BOOL trigger_sni_changes
;
126 BOOL have_set_peerdn
;
127 const struct host_item
*host
;
128 gnutls_x509_crt_t peercert
;
131 uschar
*received_sni
;
133 const uschar
*tls_certificate
;
134 const uschar
*tls_privatekey
;
135 const uschar
*tls_sni
; /* client send only, not received */
136 const uschar
*tls_verify_certificates
;
137 const uschar
*tls_crl
;
138 const uschar
*tls_require_ciphers
;
140 uschar
*exp_tls_certificate
;
141 uschar
*exp_tls_privatekey
;
142 uschar
*exp_tls_verify_certificates
;
144 uschar
*exp_tls_require_ciphers
;
145 const uschar
*exp_tls_verify_cert_hostnames
;
146 #ifndef DISABLE_EVENT
147 uschar
*event_action
;
150 char * const * dane_data
;
151 const int * dane_data_len
;
154 tls_support
*tlsp
; /* set in tls_init() */
159 BOOL xfer_eof
; /*XXX never gets set! */
161 } exim_gnutls_state_st
;
163 static const exim_gnutls_state_st exim_gnutls_state_init
= {
166 .priority_cache
= NULL
,
167 .verify_requirement
= VERIFY_NONE
,
170 .peer_cert_verified
= FALSE
,
171 .peer_dane_verified
= FALSE
,
172 .trigger_sni_changes
=FALSE
,
173 .have_set_peerdn
= FALSE
,
178 .received_sni
= NULL
,
180 .tls_certificate
= NULL
,
181 .tls_privatekey
= NULL
,
183 .tls_verify_certificates
= NULL
,
185 .tls_require_ciphers
=NULL
,
187 .exp_tls_certificate
= NULL
,
188 .exp_tls_privatekey
= NULL
,
189 .exp_tls_verify_certificates
= NULL
,
191 .exp_tls_require_ciphers
= NULL
,
192 .exp_tls_verify_cert_hostnames
= NULL
,
193 #ifndef DISABLE_EVENT
194 .event_action
= NULL
,
199 .xfer_buffer_lwm
= 0,
200 .xfer_buffer_hwm
= 0,
205 /* Not only do we have our own APIs which don't pass around state, assuming
206 it's held in globals, GnuTLS doesn't appear to let us register callback data
207 for callbacks, or as part of the session, so we have to keep a "this is the
208 context we're currently dealing with" pointer and rely upon being
209 single-threaded to keep from processing data on an inbound TLS connection while
210 talking to another TLS connection for an outbound check. This does mean that
211 there's no way for heart-beats to be responded to, for the duration of the
213 XXX But see gnutls_session_get_ptr()
216 static exim_gnutls_state_st state_server
;
218 /* dh_params are initialised once within the lifetime of a process using TLS;
219 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
220 don't want to repeat this. */
222 static gnutls_dh_params_t dh_server_params
= NULL
;
224 /* No idea how this value was chosen; preserving it. Default is 3600. */
226 static const int ssl_session_timeout
= 200;
228 static const char * const exim_default_gnutls_priority
= "NORMAL";
230 /* Guard library core initialisation */
232 static BOOL exim_gnutls_base_init_done
= FALSE
;
235 static BOOL gnutls_buggy_ocsp
= FALSE
;
239 /* ------------------------------------------------------------------------ */
242 #define MAX_HOST_LEN 255
244 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
245 the library logging; a value less than 0 disables the calls to set up logging
246 callbacks. Possibly GNuTLS also looks for an environment variable
247 "GNUTLS_DEBUG_LEVEL". */
248 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
249 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
252 #ifndef EXIM_CLIENT_DH_MIN_BITS
253 # define EXIM_CLIENT_DH_MIN_BITS 1024
256 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
257 can ask for a bit-strength. Without that, we stick to the constant we had
259 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
260 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
263 #define exim_gnutls_err_check(rc, Label) do { \
264 if ((rc) != GNUTLS_E_SUCCESS) \
265 return tls_error((Label), gnutls_strerror(rc), host, errstr); \
268 #define expand_check_tlsvar(Varname, errstr) \
269 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
271 #if GNUTLS_VERSION_NUMBER >= 0x020c00
272 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
273 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
274 # define HAVE_GNUTLS_RND
275 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
276 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
277 * isn't available sometimes, so this needs to become a conditional
278 * compilation; the sanest way to deal with this being a problem on
279 * older OSes is to block it in the Local/Makefile with this compiler
281 # ifndef AVOID_GNUTLS_PKCS11
282 # define HAVE_GNUTLS_PKCS11
283 # endif /* AVOID_GNUTLS_PKCS11 */
289 /* ------------------------------------------------------------------------ */
290 /* Callback declarations */
292 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
293 static void exim_gnutls_logger_cb(int level
, const char *message
);
296 static int exim_sni_handling_cb(gnutls_session_t session
);
299 static int server_ocsp_stapling_cb(gnutls_session_t session
, void * ptr
,
300 gnutls_datum_t
* ocsp_response
);
305 /* ------------------------------------------------------------------------ */
306 /* Static functions */
308 /*************************************************
310 *************************************************/
312 /* Called from lots of places when errors occur before actually starting to do
313 the TLS handshake, that is, while the session is still in clear. Always returns
314 DEFER for a server and FAIL for a client so that most calls can use "return
315 tls_error(...)" to do this processing and then give an appropriate return. A
316 single function is used for both server and client, because it is called from
317 some shared functions.
320 prefix text to include in the logged error
321 msg additional error string (may be NULL)
322 usually obtained from gnutls_strerror()
323 host NULL if setting up a server;
324 the connected host if setting up a client
325 errstr pointer to returned error string
327 Returns: OK/DEFER/FAIL
331 tls_error(const uschar
*prefix
, const char *msg
, const host_item
*host
,
335 *errstr
= string_sprintf("(%s)%s%s", prefix
, msg
? ": " : "", msg
? msg
: "");
336 return host
? FAIL
: DEFER
;
342 /*************************************************
343 * Deal with logging errors during I/O *
344 *************************************************/
346 /* We have to get the identity of the peer from saved data.
349 state the current GnuTLS exim state container
350 rc the GnuTLS error code, or 0 if it's a local error
351 when text identifying read or write
352 text local error text when ec is 0
358 record_io_error(exim_gnutls_state_st
*state
, int rc
, uschar
*when
, uschar
*text
)
363 if (rc
== GNUTLS_E_FATAL_ALERT_RECEIVED
)
364 msg
= CS
string_sprintf("%s: %s", US
gnutls_strerror(rc
),
365 US
gnutls_alert_get_name(gnutls_alert_get(state
->session
)));
367 msg
= gnutls_strerror(rc
);
369 (void) tls_error(when
, msg
, state
->host
, &errstr
);
372 log_write(0, LOG_MAIN
, "H=%s [%s] TLS error on connection %s",
373 state
->host
->name
, state
->host
->address
, errstr
);
376 uschar
* conn_info
= smtp_get_connection_info();
377 if (Ustrncmp(conn_info
, US
"SMTP ", 5) == 0) conn_info
+= 5;
378 /* I'd like to get separated H= here, but too hard for now */
379 log_write(0, LOG_MAIN
, "TLS error on %s %s", conn_info
, errstr
);
386 /*************************************************
387 * Set various Exim expansion vars *
388 *************************************************/
390 #define exim_gnutls_cert_err(Label) \
393 if (rc != GNUTLS_E_SUCCESS) \
395 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
396 (Label), gnutls_strerror(rc)); \
402 import_cert(const gnutls_datum_t
* cert
, gnutls_x509_crt_t
* crtp
)
406 rc
= gnutls_x509_crt_init(crtp
);
407 exim_gnutls_cert_err(US
"gnutls_x509_crt_init (crt)");
409 rc
= gnutls_x509_crt_import(*crtp
, cert
, GNUTLS_X509_FMT_DER
);
410 exim_gnutls_cert_err(US
"failed to import certificate [gnutls_x509_crt_import(cert)]");
415 #undef exim_gnutls_cert_err
418 /* We set various Exim global variables from the state, once a session has
419 been established. With TLS callouts, may need to change this to stack
420 variables, or just re-call it with the server state after client callout
423 Make sure anything set here is unset in tls_getc().
427 tls_bits strength indicator
428 tls_certificate_verified bool indicator
429 tls_channelbinding_b64 for some SASL mechanisms
431 tls_peercert pointer to library internal
433 tls_sni a (UTF-8) string
434 tls_ourcert pointer to library internal
437 state the relevant exim_gnutls_state_st *
441 extract_exim_vars_from_tls_state(exim_gnutls_state_st
* state
)
443 gnutls_cipher_algorithm_t cipher
;
444 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
447 gnutls_datum_t channel
;
449 tls_support
* tlsp
= state
->tlsp
;
451 tlsp
->active
.sock
= state
->fd_out
;
452 tlsp
->active
.tls_ctx
= state
;
454 cipher
= gnutls_cipher_get(state
->session
);
455 /* returns size in "bytes" */
456 tlsp
->bits
= gnutls_cipher_get_key_size(cipher
) * 8;
458 tlsp
->cipher
= state
->ciphersuite
;
460 DEBUG(D_tls
) debug_printf("cipher: %s\n", state
->ciphersuite
);
462 tlsp
->certificate_verified
= state
->peer_cert_verified
;
464 tlsp
->dane_verified
= state
->peer_dane_verified
;
467 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
468 only available for use for authenticators while this TLS session is running. */
470 tls_channelbinding_b64
= NULL
;
471 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
474 rc
= gnutls_session_channel_binding(state
->session
, GNUTLS_CB_TLS_UNIQUE
, &channel
);
476 DEBUG(D_tls
) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc
));
478 old_pool
= store_pool
;
479 store_pool
= POOL_PERM
;
480 tls_channelbinding_b64
= b64encode(channel
.data
, (int)channel
.size
);
481 store_pool
= old_pool
;
482 DEBUG(D_tls
) debug_printf("Have channel bindings cached for possible auth usage.\n");
486 /* peercert is set in peer_status() */
487 tlsp
->peerdn
= state
->peerdn
;
488 tlsp
->sni
= state
->received_sni
;
490 /* record our certificate */
492 const gnutls_datum_t
* cert
= gnutls_certificate_get_ours(state
->session
);
493 gnutls_x509_crt_t crt
;
495 tlsp
->ourcert
= cert
&& import_cert(cert
, &crt
)==0 ? crt
: NULL
;
502 /*************************************************
503 * Setup up DH parameters *
504 *************************************************/
506 /* Generating the D-H parameters may take a long time. They only need to
507 be re-generated every so often, depending on security policy. What we do is to
508 keep these parameters in a file in the spool directory. If the file does not
509 exist, we generate them. This means that it is easy to cause a regeneration.
511 The new file is written as a temporary file and renamed, so that an incomplete
512 file is never present. If two processes both compute some new parameters, you
513 waste a bit of effort, but it doesn't seem worth messing around with locking to
516 Returns: OK/DEFER/FAIL
520 init_server_dh(uschar
** errstr
)
523 unsigned int dh_bits
;
525 uschar filename_buf
[PATH_MAX
];
526 uschar
*filename
= NULL
;
528 uschar
*exp_tls_dhparam
;
529 BOOL use_file_in_spool
= FALSE
;
530 BOOL use_fixed_file
= FALSE
;
531 host_item
*host
= NULL
; /* dummy for macros */
533 DEBUG(D_tls
) debug_printf("Initialising GnuTLS server params.\n");
535 rc
= gnutls_dh_params_init(&dh_server_params
);
536 exim_gnutls_err_check(rc
, US
"gnutls_dh_params_init");
541 if (!expand_check(tls_dhparam
, US
"tls_dhparam", &exp_tls_dhparam
, errstr
))
544 if (!exp_tls_dhparam
)
546 DEBUG(D_tls
) debug_printf("Loading default hard-coded DH params\n");
547 m
.data
= US
std_dh_prime_default();
548 m
.size
= Ustrlen(m
.data
);
550 else if (Ustrcmp(exp_tls_dhparam
, "historic") == 0)
551 use_file_in_spool
= TRUE
;
552 else if (Ustrcmp(exp_tls_dhparam
, "none") == 0)
554 DEBUG(D_tls
) debug_printf("Requested no DH parameters.\n");
557 else if (exp_tls_dhparam
[0] != '/')
559 if (!(m
.data
= US
std_dh_prime_named(exp_tls_dhparam
)))
560 return tls_error(US
"No standard prime named", CS exp_tls_dhparam
, NULL
, errstr
);
561 m
.size
= Ustrlen(m
.data
);
565 use_fixed_file
= TRUE
;
566 filename
= exp_tls_dhparam
;
571 rc
= gnutls_dh_params_import_pkcs3(dh_server_params
, &m
, GNUTLS_X509_FMT_PEM
);
572 exim_gnutls_err_check(rc
, US
"gnutls_dh_params_import_pkcs3");
573 DEBUG(D_tls
) debug_printf("Loaded fixed standard D-H parameters\n");
577 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
578 /* If you change this constant, also change dh_param_fn_ext so that we can use a
579 different filename and ensure we have sufficient bits. */
580 dh_bits
= gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH
, GNUTLS_SEC_PARAM_NORMAL
);
582 return tls_error(US
"gnutls_sec_param_to_pk_bits() failed", NULL
, NULL
, errstr
);
584 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
587 dh_bits
= EXIM_SERVER_DH_BITS_PRE2_12
;
589 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
593 /* Some clients have hard-coded limits. */
594 if (dh_bits
> tls_dh_max_bits
)
597 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
599 dh_bits
= tls_dh_max_bits
;
602 if (use_file_in_spool
)
604 if (!string_format(filename_buf
, sizeof(filename_buf
),
605 "%s/gnutls-params-%d", spool_directory
, dh_bits
))
606 return tls_error(US
"overlong filename", NULL
, NULL
, errstr
);
607 filename
= filename_buf
;
610 /* Open the cache file for reading and if successful, read it and set up the
613 if ((fd
= Uopen(filename
, O_RDONLY
, 0)) >= 0)
619 if (fstat(fd
, &statbuf
) < 0) /* EIO */
623 return tls_error(US
"TLS cache stat failed", strerror(saved_errno
), NULL
, errstr
);
625 if (!S_ISREG(statbuf
.st_mode
))
628 return tls_error(US
"TLS cache not a file", NULL
, NULL
, errstr
);
630 if (!(fp
= fdopen(fd
, "rb")))
634 return tls_error(US
"fdopen(TLS cache stat fd) failed",
635 strerror(saved_errno
), NULL
, errstr
);
638 m
.size
= statbuf
.st_size
;
639 if (!(m
.data
= malloc(m
.size
)))
642 return tls_error(US
"malloc failed", strerror(errno
), NULL
, errstr
);
644 if (!(sz
= fread(m
.data
, m
.size
, 1, fp
)))
649 return tls_error(US
"fread failed", strerror(saved_errno
), NULL
, errstr
);
653 rc
= gnutls_dh_params_import_pkcs3(dh_server_params
, &m
, GNUTLS_X509_FMT_PEM
);
655 exim_gnutls_err_check(rc
, US
"gnutls_dh_params_import_pkcs3");
656 DEBUG(D_tls
) debug_printf("read D-H parameters from file \"%s\"\n", filename
);
659 /* If the file does not exist, fall through to compute new data and cache it.
660 If there was any other opening error, it is serious. */
662 else if (errno
== ENOENT
)
666 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename
);
669 return tls_error(string_open_failed(errno
, "\"%s\" for reading", filename
),
672 /* If ret < 0, either the cache file does not exist, or the data it contains
673 is not useful. One particular case of this is when upgrading from an older
674 release of Exim in which the data was stored in a different format. We don't
675 try to be clever and support both formats; we just regenerate new data in this
681 unsigned int dh_bits_gen
= dh_bits
;
683 if ((PATH_MAX
- Ustrlen(filename
)) < 10)
684 return tls_error(US
"Filename too long to generate replacement",
685 CS filename
, NULL
, errstr
);
687 temp_fn
= string_copy(US
"%s.XXXXXXX");
688 if ((fd
= mkstemp(CS temp_fn
)) < 0) /* modifies temp_fn */
689 return tls_error(US
"Unable to open temp file", strerror(errno
), NULL
, errstr
);
690 (void)fchown(fd
, exim_uid
, exim_gid
); /* Probably not necessary */
692 /* GnuTLS overshoots!
693 * If we ask for 2236, we might get 2237 or more.
694 * But there's no way to ask GnuTLS how many bits there really are.
695 * We can ask how many bits were used in a TLS session, but that's it!
696 * The prime itself is hidden behind too much abstraction.
697 * So we ask for less, and proceed on a wing and a prayer.
698 * First attempt, subtracted 3 for 2233 and got 2240.
700 if (dh_bits
>= EXIM_CLIENT_DH_MIN_BITS
+ 10)
702 dh_bits_gen
= dh_bits
- 10;
704 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
709 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
711 rc
= gnutls_dh_params_generate2(dh_server_params
, dh_bits_gen
);
712 exim_gnutls_err_check(rc
, US
"gnutls_dh_params_generate2");
714 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
715 and I confirmed that a NULL call to get the size first is how the GnuTLS
716 sample apps handle this. */
720 rc
= gnutls_dh_params_export_pkcs3(dh_server_params
, GNUTLS_X509_FMT_PEM
,
722 if (rc
!= GNUTLS_E_SHORT_MEMORY_BUFFER
)
723 exim_gnutls_err_check(rc
, US
"gnutls_dh_params_export_pkcs3(NULL) sizing");
725 if (!(m
.data
= malloc(m
.size
)))
726 return tls_error(US
"memory allocation failed", strerror(errno
), NULL
, errstr
);
728 /* this will return a size 1 less than the allocation size above */
729 rc
= gnutls_dh_params_export_pkcs3(dh_server_params
, GNUTLS_X509_FMT_PEM
,
731 if (rc
!= GNUTLS_E_SUCCESS
)
734 exim_gnutls_err_check(rc
, US
"gnutls_dh_params_export_pkcs3() real");
736 m
.size
= sz
; /* shrink by 1, probably */
738 if ((sz
= write_to_fd_buf(fd
, m
.data
, (size_t) m
.size
)) != m
.size
)
741 return tls_error(US
"TLS cache write D-H params failed",
742 strerror(errno
), NULL
, errstr
);
745 if ((sz
= write_to_fd_buf(fd
, US
"\n", 1)) != 1)
746 return tls_error(US
"TLS cache write D-H params final newline failed",
747 strerror(errno
), NULL
, errstr
);
749 if ((rc
= close(fd
)))
750 return tls_error(US
"TLS cache write close() failed", strerror(errno
), NULL
, errstr
);
752 if (Urename(temp_fn
, filename
) < 0)
753 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
754 temp_fn
, filename
), strerror(errno
), NULL
, errstr
);
756 DEBUG(D_tls
) debug_printf("wrote D-H parameters to file \"%s\"\n", filename
);
759 DEBUG(D_tls
) debug_printf("initialized server D-H parameters\n");
766 /* Create and install a selfsigned certificate, for use in server mode */
769 tls_install_selfsign(exim_gnutls_state_st
* state
, uschar
** errstr
)
771 gnutls_x509_crt_t cert
= NULL
;
773 gnutls_x509_privkey_t pkey
= NULL
;
774 const uschar
* where
;
777 where
= US
"initialising pkey";
778 if ((rc
= gnutls_x509_privkey_init(&pkey
))) goto err
;
780 where
= US
"initialising cert";
781 if ((rc
= gnutls_x509_crt_init(&cert
))) goto err
;
783 where
= US
"generating pkey";
784 if ((rc
= gnutls_x509_privkey_generate(pkey
, GNUTLS_PK_RSA
,
785 #ifdef SUPPORT_PARAM_TO_PK_BITS
786 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA
, GNUTLS_SEC_PARAM_LOW
),
793 where
= US
"configuring cert";
795 if ( (rc
= gnutls_x509_crt_set_version(cert
, 3))
796 || (rc
= gnutls_x509_crt_set_serial(cert
, &now
, sizeof(now
)))
797 || (rc
= gnutls_x509_crt_set_activation_time(cert
, now
= time(NULL
)))
798 || (rc
= gnutls_x509_crt_set_expiration_time(cert
, now
+ 60 * 60)) /* 1 hr */
799 || (rc
= gnutls_x509_crt_set_key(cert
, pkey
))
801 || (rc
= gnutls_x509_crt_set_dn_by_oid(cert
,
802 GNUTLS_OID_X520_COUNTRY_NAME
, 0, "UK", 2))
803 || (rc
= gnutls_x509_crt_set_dn_by_oid(cert
,
804 GNUTLS_OID_X520_ORGANIZATION_NAME
, 0, "Exim Developers", 15))
805 || (rc
= gnutls_x509_crt_set_dn_by_oid(cert
,
806 GNUTLS_OID_X520_COMMON_NAME
, 0,
807 smtp_active_hostname
, Ustrlen(smtp_active_hostname
)))
811 where
= US
"signing cert";
812 if ((rc
= gnutls_x509_crt_sign(cert
, cert
, pkey
))) goto err
;
814 where
= US
"installing selfsign cert";
816 if ((rc
= gnutls_certificate_set_x509_key(state
->x509_cred
, &cert
, 1, pkey
)))
822 if (cert
) gnutls_x509_crt_deinit(cert
);
823 if (pkey
) gnutls_x509_privkey_deinit(pkey
);
827 rc
= tls_error(where
, gnutls_strerror(rc
), NULL
, errstr
);
834 /* Add certificate and key, from files.
837 Zero or negative: good. Negate value for certificate index if < 0.
838 Greater than zero: FAIL or DEFER code.
842 tls_add_certfile(exim_gnutls_state_st
* state
, const host_item
* host
,
843 uschar
* certfile
, uschar
* keyfile
, uschar
** errstr
)
845 int rc
= gnutls_certificate_set_x509_key_file(state
->x509_cred
,
846 CS certfile
, CS keyfile
, GNUTLS_X509_FMT_PEM
);
849 string_sprintf("cert/key setup: cert=%s key=%s", certfile
, keyfile
),
850 gnutls_strerror(rc
), host
, errstr
);
855 /*************************************************
856 * Variables re-expanded post-SNI *
857 *************************************************/
859 /* Called from both server and client code, via tls_init(), and also from
860 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
862 We can tell the two apart by state->received_sni being non-NULL in callback.
864 The callback should not call us unless state->trigger_sni_changes is true,
865 which we are responsible for setting on the first pass through.
868 state exim_gnutls_state_st *
869 errstr error string pointer
871 Returns: OK/DEFER/FAIL
875 tls_expand_session_files(exim_gnutls_state_st
* state
, uschar
** errstr
)
879 const host_item
*host
= state
->host
; /* macro should be reconsidered? */
880 uschar
*saved_tls_certificate
= NULL
;
881 uschar
*saved_tls_privatekey
= NULL
;
882 uschar
*saved_tls_verify_certificates
= NULL
;
883 uschar
*saved_tls_crl
= NULL
;
886 /* We check for tls_sni *before* expansion. */
887 if (!host
) /* server */
888 if (!state
->received_sni
)
890 if ( state
->tls_certificate
891 && ( Ustrstr(state
->tls_certificate
, US
"tls_sni")
892 || Ustrstr(state
->tls_certificate
, US
"tls_in_sni")
893 || Ustrstr(state
->tls_certificate
, US
"tls_out_sni")
896 DEBUG(D_tls
) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
897 state
->trigger_sni_changes
= TRUE
;
902 /* useful for debugging */
903 saved_tls_certificate
= state
->exp_tls_certificate
;
904 saved_tls_privatekey
= state
->exp_tls_privatekey
;
905 saved_tls_verify_certificates
= state
->exp_tls_verify_certificates
;
906 saved_tls_crl
= state
->exp_tls_crl
;
909 rc
= gnutls_certificate_allocate_credentials(&state
->x509_cred
);
910 exim_gnutls_err_check(rc
, US
"gnutls_certificate_allocate_credentials");
912 #ifdef SUPPORT_SRV_OCSP_STACK
913 gnutls_certificate_set_flags(state
->x509_cred
, GNUTLS_CERTIFICATE_API_V2
);
916 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
917 state members, assuming consistent naming; and expand_check() returns
918 false if expansion failed, unless expansion was forced to fail. */
920 /* check if we at least have a certificate, before doing expensive
923 if (!expand_check_tlsvar(tls_certificate
, errstr
))
926 /* certificate is mandatory in server, optional in client */
928 if ( !state
->exp_tls_certificate
929 || !*state
->exp_tls_certificate
932 return tls_install_selfsign(state
, errstr
);
934 DEBUG(D_tls
) debug_printf("TLS: no client certificate specified; okay\n");
936 if (state
->tls_privatekey
&& !expand_check_tlsvar(tls_privatekey
, errstr
))
939 /* tls_privatekey is optional, defaulting to same file as certificate */
941 if (state
->tls_privatekey
== NULL
|| *state
->tls_privatekey
== '\0')
943 state
->tls_privatekey
= state
->tls_certificate
;
944 state
->exp_tls_privatekey
= state
->exp_tls_certificate
;
948 if (state
->exp_tls_certificate
&& *state
->exp_tls_certificate
)
950 DEBUG(D_tls
) debug_printf("certificate file = %s\nkey file = %s\n",
951 state
->exp_tls_certificate
, state
->exp_tls_privatekey
);
953 if (state
->received_sni
)
954 if ( Ustrcmp(state
->exp_tls_certificate
, saved_tls_certificate
) == 0
955 && Ustrcmp(state
->exp_tls_privatekey
, saved_tls_privatekey
) == 0
958 DEBUG(D_tls
) debug_printf("TLS SNI: cert and key unchanged\n");
962 DEBUG(D_tls
) debug_printf("TLS SNI: have a changed cert/key pair.\n");
965 if (!host
) /* server */
967 const uschar
* clist
= state
->exp_tls_certificate
;
968 const uschar
* klist
= state
->exp_tls_privatekey
;
969 const uschar
* olist
;
970 int csep
= 0, ksep
= 0, osep
= 0, cnt
= 0;
971 uschar
* cfile
, * kfile
, * ofile
;
974 if (!expand_check(tls_ocsp_file
, US
"tls_ocsp_file", &ofile
, errstr
))
979 while (cfile
= string_nextinlist(&clist
, &csep
, NULL
, 0))
981 if (!(kfile
= string_nextinlist(&klist
, &ksep
, NULL
, 0)))
982 return tls_error(US
"cert/key setup: out of keys", NULL
, host
, errstr
);
983 else if (0 < (rc
= tls_add_certfile(state
, host
, cfile
, kfile
, errstr
)))
987 int gnutls_cert_index
= -rc
;
988 DEBUG(D_tls
) debug_printf("TLS: cert/key %s registered\n", cfile
);
990 /* Set the OCSP stapling server info */
994 if (gnutls_buggy_ocsp
)
997 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
999 else if ((ofile
= string_nextinlist(&olist
, &osep
, NULL
, 0)))
1001 /* Use the full callback method for stapling just to get
1002 observability. More efficient would be to read the file once only,
1003 if it never changed (due to SNI). Would need restart on file update,
1004 or watch datestamp. */
1006 # ifdef SUPPORT_SRV_OCSP_STACK
1007 rc
= gnutls_certificate_set_ocsp_status_request_function2(
1008 state
->x509_cred
, gnutls_cert_index
,
1009 server_ocsp_stapling_cb
, ofile
);
1011 exim_gnutls_err_check(rc
,
1012 US
"gnutls_certificate_set_ocsp_status_request_function2");
1017 debug_printf("oops; multiple OCSP files not supported\n");
1020 gnutls_certificate_set_ocsp_status_request_function(
1021 state
->x509_cred
, server_ocsp_stapling_cb
, ofile
);
1024 DEBUG(D_tls
) debug_printf("OCSP response file = %s\n", ofile
);
1027 DEBUG(D_tls
) debug_printf("ran out of OCSP response files in list\n");
1033 if (0 < (rc
= tls_add_certfile(state
, host
,
1034 state
->exp_tls_certificate
, state
->exp_tls_privatekey
, errstr
)))
1036 DEBUG(D_tls
) debug_printf("TLS: cert/key registered\n");
1039 } /* tls_certificate */
1042 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1043 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1044 error message is provided. However, if we just refrain from setting anything up
1045 in that case, certificate verification fails, which seems to be the correct
1048 if (state
->tls_verify_certificates
&& *state
->tls_verify_certificates
)
1050 if (!expand_check_tlsvar(tls_verify_certificates
, errstr
))
1052 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1053 if (Ustrcmp(state
->exp_tls_verify_certificates
, "system") == 0)
1054 state
->exp_tls_verify_certificates
= NULL
;
1056 if (state
->tls_crl
&& *state
->tls_crl
)
1057 if (!expand_check_tlsvar(tls_crl
, errstr
))
1060 if (!(state
->exp_tls_verify_certificates
&&
1061 *state
->exp_tls_verify_certificates
))
1064 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1065 /* With no tls_verify_certificates, we ignore tls_crl too */
1072 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1076 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1077 if (Ustrcmp(state
->exp_tls_verify_certificates
, "system") == 0)
1078 cert_count
= gnutls_certificate_set_x509_system_trust(state
->x509_cred
);
1082 if (Ustat(state
->exp_tls_verify_certificates
, &statbuf
) < 0)
1084 log_write(0, LOG_MAIN
|LOG_PANIC
, "could not stat %s "
1085 "(tls_verify_certificates): %s", state
->exp_tls_verify_certificates
,
1090 #ifndef SUPPORT_CA_DIR
1091 /* The test suite passes in /dev/null; we could check for that path explicitly,
1092 but who knows if someone has some weird FIFO which always dumps some certs, or
1093 other weirdness. The thing we really want to check is that it's not a
1094 directory, since while OpenSSL supports that, GnuTLS does not.
1095 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1096 if (S_ISDIR(statbuf
.st_mode
))
1099 debug_printf("verify certificates path is a dir: \"%s\"\n",
1100 state
->exp_tls_verify_certificates
);
1101 log_write(0, LOG_MAIN
|LOG_PANIC
,
1102 "tls_verify_certificates \"%s\" is a directory",
1103 state
->exp_tls_verify_certificates
);
1108 DEBUG(D_tls
) debug_printf("verify certificates = %s size=" OFF_T_FMT
"\n",
1109 state
->exp_tls_verify_certificates
, statbuf
.st_size
);
1111 if (statbuf
.st_size
== 0)
1114 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1120 #ifdef SUPPORT_CA_DIR
1121 (statbuf
.st_mode
& S_IFMT
) == S_IFDIR
1123 gnutls_certificate_set_x509_trust_dir(state
->x509_cred
,
1124 CS state
->exp_tls_verify_certificates
, GNUTLS_X509_FMT_PEM
)
1127 gnutls_certificate_set_x509_trust_file(state
->x509_cred
,
1128 CS state
->exp_tls_verify_certificates
, GNUTLS_X509_FMT_PEM
);
1134 exim_gnutls_err_check(rc
, US
"setting certificate trust");
1136 DEBUG(D_tls
) debug_printf("Added %d certificate authorities.\n", cert_count
);
1138 if (state
->tls_crl
&& *state
->tls_crl
&&
1139 state
->exp_tls_crl
&& *state
->exp_tls_crl
)
1141 DEBUG(D_tls
) debug_printf("loading CRL file = %s\n", state
->exp_tls_crl
);
1142 cert_count
= gnutls_certificate_set_x509_crl_file(state
->x509_cred
,
1143 CS state
->exp_tls_crl
, GNUTLS_X509_FMT_PEM
);
1147 exim_gnutls_err_check(rc
, US
"gnutls_certificate_set_x509_crl_file");
1149 DEBUG(D_tls
) debug_printf("Processed %d CRLs.\n", cert_count
);
1158 /*************************************************
1159 * Set X.509 state variables *
1160 *************************************************/
1162 /* In GnuTLS, the registered cert/key are not replaced by a later
1163 set of a cert/key, so for SNI support we need a whole new x509_cred
1164 structure. Which means various other non-re-expanded pieces of state
1165 need to be re-set in the new struct, so the setting logic is pulled
1169 state exim_gnutls_state_st *
1170 errstr error string pointer
1172 Returns: OK/DEFER/FAIL
1176 tls_set_remaining_x509(exim_gnutls_state_st
*state
, uschar
** errstr
)
1179 const host_item
*host
= state
->host
; /* macro should be reconsidered? */
1181 /* Create D-H parameters, or read them from the cache file. This function does
1182 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1183 client-side params. */
1187 if (!dh_server_params
)
1189 rc
= init_server_dh(errstr
);
1190 if (rc
!= OK
) return rc
;
1192 gnutls_certificate_set_dh_params(state
->x509_cred
, dh_server_params
);
1195 /* Link the credentials to the session. */
1197 rc
= gnutls_credentials_set(state
->session
, GNUTLS_CRD_CERTIFICATE
, state
->x509_cred
);
1198 exim_gnutls_err_check(rc
, US
"gnutls_credentials_set");
1203 /*************************************************
1204 * Initialize for GnuTLS *
1205 *************************************************/
1208 #ifndef DISABLE_OCSP
1211 tls_is_buggy_ocsp(void)
1214 uschar maj
, mid
, mic
;
1216 s
= CUS
gnutls_check_version(NULL
);
1220 while (*s
&& *s
!= '.') s
++;
1221 mid
= atoi(CCS
++s
);
1228 while (*s
&& *s
!= '.') s
++;
1229 mic
= atoi(CCS
++s
);
1230 return mic
<= (mid
== 3 ? 16 : 3);
1239 /* Called from both server and client code. In the case of a server, errors
1240 before actual TLS negotiation return DEFER.
1243 host connected host, if client; NULL if server
1244 certificate certificate file
1245 privatekey private key file
1246 sni TLS SNI to send, sometimes when client; else NULL
1249 require_ciphers tls_require_ciphers setting
1250 caller_state returned state-info structure
1251 errstr error string pointer
1253 Returns: OK/DEFER/FAIL
1258 const host_item
*host
,
1259 const uschar
*certificate
,
1260 const uschar
*privatekey
,
1264 const uschar
*require_ciphers
,
1265 exim_gnutls_state_st
**caller_state
,
1269 exim_gnutls_state_st
*state
;
1274 BOOL want_default_priorities
;
1276 if (!exim_gnutls_base_init_done
)
1278 DEBUG(D_tls
) debug_printf("GnuTLS global init required.\n");
1280 #ifdef HAVE_GNUTLS_PKCS11
1281 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1282 which loads modules from a config file, which sounds good and may be wanted
1283 by some sysadmin, but also means in common configurations that GNOME keyring
1284 environment variables are used and so breaks for users calling mailq.
1285 To prevent this, we init PKCS11 first, which is the documented approach. */
1286 if (!gnutls_allow_auto_pkcs11
)
1288 rc
= gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL
, NULL
);
1289 exim_gnutls_err_check(rc
, US
"gnutls_pkcs11_init");
1293 rc
= gnutls_global_init();
1294 exim_gnutls_err_check(rc
, US
"gnutls_global_init");
1296 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1299 gnutls_global_set_log_function(exim_gnutls_logger_cb
);
1300 /* arbitrarily chosen level; bump upto 9 for more */
1301 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL
);
1305 #ifndef DISABLE_OCSP
1306 if (tls_ocsp_file
&& (gnutls_buggy_ocsp
= tls_is_buggy_ocsp()))
1307 log_write(0, LOG_MAIN
, "OCSP unusable with this GnuTLS library version");
1310 exim_gnutls_base_init_done
= TRUE
;
1315 /* For client-side sessions we allocate a context. This lets us run
1316 several in parallel. */
1317 int old_pool
= store_pool
;
1318 store_pool
= POOL_PERM
;
1319 state
= store_get(sizeof(exim_gnutls_state_st
));
1320 store_pool
= old_pool
;
1322 memcpy(state
, &exim_gnutls_state_init
, sizeof(exim_gnutls_state_init
));
1324 DEBUG(D_tls
) debug_printf("initialising GnuTLS client session\n");
1325 rc
= gnutls_init(&state
->session
, GNUTLS_CLIENT
);
1329 state
= &state_server
;
1330 memcpy(state
, &exim_gnutls_state_init
, sizeof(exim_gnutls_state_init
));
1332 DEBUG(D_tls
) debug_printf("initialising GnuTLS server session\n");
1333 rc
= gnutls_init(&state
->session
, GNUTLS_SERVER
);
1335 exim_gnutls_err_check(rc
, US
"gnutls_init");
1339 state
->tls_certificate
= certificate
;
1340 state
->tls_privatekey
= privatekey
;
1341 state
->tls_require_ciphers
= require_ciphers
;
1342 state
->tls_sni
= sni
;
1343 state
->tls_verify_certificates
= cas
;
1344 state
->tls_crl
= crl
;
1346 /* This handles the variables that might get re-expanded after TLS SNI;
1347 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1350 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1351 if ((rc
= tls_expand_session_files(state
, errstr
)) != OK
) return rc
;
1353 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1354 requires a new structure afterwards. */
1356 if ((rc
= tls_set_remaining_x509(state
, errstr
)) != OK
) return rc
;
1358 /* set SNI in client, only */
1361 if (!expand_check(sni
, US
"tls_out_sni", &state
->tlsp
->sni
, errstr
))
1363 if (state
->tlsp
->sni
&& *state
->tlsp
->sni
)
1366 debug_printf("Setting TLS client SNI to \"%s\"\n", state
->tlsp
->sni
);
1367 sz
= Ustrlen(state
->tlsp
->sni
);
1368 rc
= gnutls_server_name_set(state
->session
,
1369 GNUTLS_NAME_DNS
, state
->tlsp
->sni
, sz
);
1370 exim_gnutls_err_check(rc
, US
"gnutls_server_name_set");
1373 else if (state
->tls_sni
)
1374 DEBUG(D_tls
) debug_printf("*** PROBABLY A BUG *** " \
1375 "have an SNI set for a server [%s]\n", state
->tls_sni
);
1377 /* This is the priority string support,
1378 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1379 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1380 This was backwards incompatible, but means Exim no longer needs to track
1381 all algorithms and provide string forms for them. */
1383 want_default_priorities
= TRUE
;
1385 if (state
->tls_require_ciphers
&& *state
->tls_require_ciphers
)
1387 if (!expand_check_tlsvar(tls_require_ciphers
, errstr
))
1389 if (state
->exp_tls_require_ciphers
&& *state
->exp_tls_require_ciphers
)
1391 DEBUG(D_tls
) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1392 state
->exp_tls_require_ciphers
);
1394 rc
= gnutls_priority_init(&state
->priority_cache
,
1395 CS state
->exp_tls_require_ciphers
, &errpos
);
1396 want_default_priorities
= FALSE
;
1397 p
= state
->exp_tls_require_ciphers
;
1400 if (want_default_priorities
)
1403 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1404 exim_default_gnutls_priority
);
1405 rc
= gnutls_priority_init(&state
->priority_cache
,
1406 exim_default_gnutls_priority
, &errpos
);
1407 p
= US exim_default_gnutls_priority
;
1410 exim_gnutls_err_check(rc
, string_sprintf(
1411 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1412 p
, errpos
- CS p
, errpos
));
1414 rc
= gnutls_priority_set(state
->session
, state
->priority_cache
);
1415 exim_gnutls_err_check(rc
, US
"gnutls_priority_set");
1417 gnutls_db_set_cache_expiration(state
->session
, ssl_session_timeout
);
1419 /* Reduce security in favour of increased compatibility, if the admin
1420 decides to make that trade-off. */
1421 if (gnutls_compat_mode
)
1423 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1424 DEBUG(D_tls
) debug_printf("lowering GnuTLS security, compatibility mode\n");
1425 gnutls_session_enable_compatibility_mode(state
->session
);
1427 DEBUG(D_tls
) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1431 *caller_state
= state
;
1437 /*************************************************
1438 * Extract peer information *
1439 *************************************************/
1441 /* Called from both server and client code.
1442 Only this is allowed to set state->peerdn and state->have_set_peerdn
1443 and we use that to detect double-calls.
1445 NOTE: the state blocks last while the TLS connection is up, which is fine
1446 for logging in the server side, but for the client side, we log after teardown
1447 in src/deliver.c. While the session is up, we can twist about states and
1448 repoint tls_* globals, but those variables used for logging or other variable
1449 expansion that happens _after_ delivery need to have a longer life-time.
1451 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1452 doing this more than once per generation of a state context. We set them in
1453 the state context, and repoint tls_* to them. After the state goes away, the
1454 tls_* copies of the pointers remain valid and client delivery logging is happy.
1456 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1460 state exim_gnutls_state_st *
1461 errstr pointer to error string
1463 Returns: OK/DEFER/FAIL
1467 peer_status(exim_gnutls_state_st
*state
, uschar
** errstr
)
1469 uschar cipherbuf
[256];
1470 const gnutls_datum_t
*cert_list
;
1472 unsigned int cert_list_size
= 0;
1473 gnutls_protocol_t protocol
;
1474 gnutls_cipher_algorithm_t cipher
;
1475 gnutls_kx_algorithm_t kx
;
1476 gnutls_mac_algorithm_t mac
;
1477 gnutls_certificate_type_t ct
;
1478 gnutls_x509_crt_t crt
;
1482 if (state
->have_set_peerdn
)
1484 state
->have_set_peerdn
= TRUE
;
1486 state
->peerdn
= NULL
;
1489 cipher
= gnutls_cipher_get(state
->session
);
1490 protocol
= gnutls_protocol_get_version(state
->session
);
1491 mac
= gnutls_mac_get(state
->session
);
1492 kx
= gnutls_kx_get(state
->session
);
1494 string_format(cipherbuf
, sizeof(cipherbuf
),
1496 gnutls_protocol_get_name(protocol
),
1497 gnutls_cipher_suite_get_name(kx
, cipher
, mac
),
1498 (int) gnutls_cipher_get_key_size(cipher
) * 8);
1500 /* I don't see a way that spaces could occur, in the current GnuTLS
1501 code base, but it was a concern in the old code and perhaps older GnuTLS
1502 releases did return "TLS 1.0"; play it safe, just in case. */
1503 for (p
= cipherbuf
; *p
!= '\0'; ++p
)
1506 old_pool
= store_pool
;
1507 store_pool
= POOL_PERM
;
1508 state
->ciphersuite
= string_copy(cipherbuf
);
1509 store_pool
= old_pool
;
1510 state
->tlsp
->cipher
= state
->ciphersuite
;
1513 cert_list
= gnutls_certificate_get_peers(state
->session
, &cert_list_size
);
1515 if (cert_list
== NULL
|| cert_list_size
== 0)
1517 DEBUG(D_tls
) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1518 cert_list
, cert_list_size
);
1519 if (state
->verify_requirement
>= VERIFY_REQUIRED
)
1520 return tls_error(US
"certificate verification failed",
1521 "no certificate received from peer", state
->host
, errstr
);
1525 ct
= gnutls_certificate_type_get(state
->session
);
1526 if (ct
!= GNUTLS_CRT_X509
)
1528 const char *ctn
= gnutls_certificate_type_get_name(ct
);
1530 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn
);
1531 if (state
->verify_requirement
>= VERIFY_REQUIRED
)
1532 return tls_error(US
"certificate verification not possible, unhandled type",
1533 ctn
, state
->host
, errstr
);
1537 #define exim_gnutls_peer_err(Label) \
1539 if (rc != GNUTLS_E_SUCCESS) \
1541 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1542 (Label), gnutls_strerror(rc)); \
1543 if (state->verify_requirement >= VERIFY_REQUIRED) \
1544 return tls_error((Label), gnutls_strerror(rc), state->host, errstr); \
1549 rc
= import_cert(&cert_list
[0], &crt
);
1550 exim_gnutls_peer_err(US
"cert 0");
1552 state
->tlsp
->peercert
= state
->peercert
= crt
;
1555 rc
= gnutls_x509_crt_get_dn(crt
, NULL
, &sz
);
1556 if (rc
!= GNUTLS_E_SHORT_MEMORY_BUFFER
)
1558 exim_gnutls_peer_err(US
"getting size for cert DN failed");
1559 return FAIL
; /* should not happen */
1561 dn_buf
= store_get_perm(sz
);
1562 rc
= gnutls_x509_crt_get_dn(crt
, CS dn_buf
, &sz
);
1563 exim_gnutls_peer_err(US
"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1565 state
->peerdn
= dn_buf
;
1568 #undef exim_gnutls_peer_err
1574 /*************************************************
1575 * Verify peer certificate *
1576 *************************************************/
1578 /* Called from both server and client code.
1579 *Should* be using a callback registered with
1580 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1581 the peer information, but that's too new for some OSes.
1584 state exim_gnutls_state_st *
1585 errstr where to put an error message
1588 FALSE if the session should be rejected
1589 TRUE if the cert is okay or we just don't care
1593 verify_certificate(exim_gnutls_state_st
* state
, uschar
** errstr
)
1598 if (state
->verify_requirement
== VERIFY_NONE
)
1603 if ((rc
= peer_status(state
, errstr
)) != OK
)
1605 verify
= GNUTLS_CERT_INVALID
;
1606 *errstr
= US
"certificate not supplied";
1612 if (state
->verify_requirement
== VERIFY_DANE
&& state
->host
)
1614 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1615 including talking to a DNS resolver. But we want to do that bit ourselves
1616 as the testsuite intercepts and fakes its own DNS environment. */
1621 const gnutls_datum_t
* certlist
=
1622 gnutls_certificate_get_peers(state
->session
, &lsize
);
1623 int usage
= tls_out
.tlsa_usage
;
1625 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1626 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1627 dane-verification separately so that we know which selector verified;
1628 then we know whether to do CA-chain-verification and name-verification
1629 (needed for TA but not EE). */
1631 if (usage
== ((1<<DANESSL_USAGE_DANE_TA
) | (1<<DANESSL_USAGE_DANE_EE
)))
1632 { /* a mixed-usage bundle */
1637 for(nrec
= 0; state
->dane_data_len
[nrec
]; ) nrec
++;
1640 dd
= store_get(nrec
* sizeof(uschar
*));
1641 ddl
= store_get(nrec
* sizeof(int));
1644 if ((rc
= dane_state_init(&s
, 0)))
1647 for (usage
= DANESSL_USAGE_DANE_EE
;
1648 usage
>= DANESSL_USAGE_DANE_TA
; usage
--)
1649 { /* take records with this usage */
1650 for (j
= i
= 0; i
< nrec
; i
++)
1651 if (state
->dane_data
[i
][0] == usage
)
1653 dd
[j
] = state
->dane_data
[i
];
1654 ddl
[j
++] = state
->dane_data_len
[i
];
1661 if ((rc
= dane_raw_tlsa(s
, &r
, (char * const *)dd
, ddl
, 1, 0)))
1664 if ((rc
= dane_verify_crt_raw(s
, certlist
, lsize
,
1665 gnutls_certificate_type_get(state
->session
),
1667 usage
== DANESSL_USAGE_DANE_EE
1668 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE
: 0,
1672 debug_printf("TLSA record problem: %s\n", dane_strerror(rc
));
1674 else if (verify
== 0) /* verification passed */
1682 if (rc
) goto tlsa_prob
;
1687 if ( (rc
= dane_state_init(&s
, 0))
1688 || (rc
= dane_raw_tlsa(s
, &r
, state
->dane_data
, state
->dane_data_len
,
1690 || (rc
= dane_verify_crt_raw(s
, certlist
, lsize
,
1691 gnutls_certificate_type_get(state
->session
),
1693 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1694 usage
== (1 << DANESSL_USAGE_DANE_EE
)
1695 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE
: 0,
1704 if (verify
!= 0) /* verification failed */
1707 (void) dane_verification_status_print(verify
, &str
, 0);
1708 *errstr
= US str
.data
; /* don't bother to free */
1711 state
->peer_dane_verified
= TRUE
;
1713 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1714 /* If a TA-mode TLSA record was used for verification we must additionally
1715 verify the CA chain and the cert name. For EE-mode, skip it. */
1717 if (usage
& (1 << DANESSL_USAGE_DANE_EE
))
1720 state
->peer_cert_verified
= TRUE
;
1726 rc
= gnutls_certificate_verify_peers2(state
->session
, &verify
);
1729 /* Handle the result of verification. INVALID is set if any others are. */
1731 if (rc
< 0 || verify
& (GNUTLS_CERT_INVALID
|GNUTLS_CERT_REVOKED
))
1733 state
->peer_cert_verified
= FALSE
;
1735 *errstr
= verify
& GNUTLS_CERT_REVOKED
1736 ? US
"certificate revoked" : US
"certificate invalid";
1739 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1740 *errstr
, state
->peerdn
? state
->peerdn
: US
"<unset>");
1742 if (state
->verify_requirement
>= VERIFY_REQUIRED
)
1745 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1750 if (state
->exp_tls_verify_cert_hostnames
)
1753 const uschar
* list
= state
->exp_tls_verify_cert_hostnames
;
1755 while ((name
= string_nextinlist(&list
, &sep
, NULL
, 0)))
1756 if (gnutls_x509_crt_check_hostname(state
->tlsp
->peercert
, CS name
))
1761 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1762 if (state
->verify_requirement
>= VERIFY_REQUIRED
)
1767 state
->peer_cert_verified
= TRUE
;
1768 DEBUG(D_tls
) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1769 state
->peerdn
? state
->peerdn
: US
"<unset>");
1773 state
->tlsp
->peerdn
= state
->peerdn
;
1778 *errstr
= string_sprintf("TLSA record problem: %s", dane_strerror(rc
));
1782 gnutls_alert_send(state
->session
, GNUTLS_AL_FATAL
, GNUTLS_A_BAD_CERTIFICATE
);
1789 /* ------------------------------------------------------------------------ */
1792 /* Logging function which can be registered with
1793 * gnutls_global_set_log_function()
1794 * gnutls_global_set_log_level() 0..9
1796 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1798 exim_gnutls_logger_cb(int level
, const char *message
)
1800 size_t len
= strlen(message
);
1803 DEBUG(D_tls
) debug_printf("GnuTLS<%d> empty debug message\n", level
);
1806 DEBUG(D_tls
) debug_printf("GnuTLS<%d>: %s%s", level
, message
,
1807 message
[len
-1] == '\n' ? "" : "\n");
1812 /* Called after client hello, should handle SNI work.
1813 This will always set tls_sni (state->received_sni) if available,
1814 and may trigger presenting different certificates,
1815 if state->trigger_sni_changes is TRUE.
1817 Should be registered with
1818 gnutls_handshake_set_post_client_hello_function()
1820 "This callback must return 0 on success or a gnutls error code to terminate the
1823 For inability to get SNI information, we return 0.
1824 We only return non-zero if re-setup failed.
1825 Only used for server-side TLS.
1829 exim_sni_handling_cb(gnutls_session_t session
)
1831 char sni_name
[MAX_HOST_LEN
];
1832 size_t data_len
= MAX_HOST_LEN
;
1833 exim_gnutls_state_st
*state
= &state_server
;
1834 unsigned int sni_type
;
1836 uschar
* dummy_errstr
;
1838 rc
= gnutls_server_name_get(session
, sni_name
, &data_len
, &sni_type
, 0);
1839 if (rc
!= GNUTLS_E_SUCCESS
)
1842 if (rc
== GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
)
1843 debug_printf("TLS: no SNI presented in handshake.\n");
1845 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1846 gnutls_strerror(rc
), rc
);
1851 if (sni_type
!= GNUTLS_NAME_DNS
)
1853 DEBUG(D_tls
) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type
);
1857 /* We now have a UTF-8 string in sni_name */
1858 old_pool
= store_pool
;
1859 store_pool
= POOL_PERM
;
1860 state
->received_sni
= string_copyn(US sni_name
, data_len
);
1861 store_pool
= old_pool
;
1863 /* We set this one now so that variable expansions below will work */
1864 state
->tlsp
->sni
= state
->received_sni
;
1866 DEBUG(D_tls
) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name
,
1867 state
->trigger_sni_changes
? "" : " (unused for certificate selection)");
1869 if (!state
->trigger_sni_changes
)
1872 if ((rc
= tls_expand_session_files(state
, &dummy_errstr
)) != OK
)
1874 /* If the setup of certs/etc failed before handshake, TLS would not have
1875 been offered. The best we can do now is abort. */
1876 return GNUTLS_E_APPLICATION_ERROR_MIN
;
1879 rc
= tls_set_remaining_x509(state
, &dummy_errstr
);
1880 if (rc
!= OK
) return GNUTLS_E_APPLICATION_ERROR_MIN
;
1887 #ifndef DISABLE_OCSP
1890 server_ocsp_stapling_cb(gnutls_session_t session
, void * ptr
,
1891 gnutls_datum_t
* ocsp_response
)
1894 DEBUG(D_tls
) debug_printf("OCSP stapling callback: %s\n", US ptr
);
1896 if ((ret
= gnutls_load_file(ptr
, ocsp_response
)) < 0)
1898 DEBUG(D_tls
) debug_printf("Failed to load ocsp stapling file %s\n",
1900 tls_in
.ocsp
= OCSP_NOT_RESP
;
1901 return GNUTLS_E_NO_CERTIFICATE_STATUS
;
1904 tls_in
.ocsp
= OCSP_VFY_NOT_TRIED
;
1911 #ifndef DISABLE_EVENT
1913 We use this callback to get observability and detail-level control
1914 for an exim TLS connection (either direction), raising a tls:cert event
1915 for each cert in the chain presented by the peer. Any event
1916 can deny verification.
1918 Return 0 for the handshake to continue or non-zero to terminate.
1922 verify_cb(gnutls_session_t session
)
1924 const gnutls_datum_t
* cert_list
;
1925 unsigned int cert_list_size
= 0;
1926 gnutls_x509_crt_t crt
;
1929 exim_gnutls_state_st
* state
= gnutls_session_get_ptr(session
);
1931 if ((cert_list
= gnutls_certificate_get_peers(session
, &cert_list_size
)))
1932 while (cert_list_size
--)
1934 if ((rc
= import_cert(&cert_list
[cert_list_size
], &crt
)) != GNUTLS_E_SUCCESS
)
1936 DEBUG(D_tls
) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1937 cert_list_size
, gnutls_strerror(rc
));
1941 state
->tlsp
->peercert
= crt
;
1942 if ((yield
= event_raise(state
->event_action
,
1943 US
"tls:cert", string_sprintf("%d", cert_list_size
))))
1945 log_write(0, LOG_MAIN
,
1946 "SSL verify denied by event-action: depth=%d: %s",
1947 cert_list_size
, yield
);
1948 return 1; /* reject */
1950 state
->tlsp
->peercert
= NULL
;
1960 /* ------------------------------------------------------------------------ */
1961 /* Exported functions */
1966 /*************************************************
1967 * Start a TLS session in a server *
1968 *************************************************/
1970 /* This is called when Exim is running as a server, after having received
1971 the STARTTLS command. It must respond to that command, and then negotiate
1975 require_ciphers list of allowed ciphers or NULL
1976 errstr pointer to error string
1978 Returns: OK on success
1979 DEFER for errors before the start of the negotiation
1980 FAIL for errors during the negotiation; the server can't
1985 tls_server_start(const uschar
* require_ciphers
, uschar
** errstr
)
1988 exim_gnutls_state_st
* state
= NULL
;
1990 /* Check for previous activation */
1991 if (tls_in
.active
.sock
>= 0)
1993 tls_error(US
"STARTTLS received after TLS started", "", NULL
, errstr
);
1994 smtp_printf("554 Already in TLS\r\n", FALSE
);
1998 /* Initialize the library. If it fails, it will already have logged the error
1999 and sent an SMTP response. */
2001 DEBUG(D_tls
) debug_printf("initialising GnuTLS as a server\n");
2003 if ((rc
= tls_init(NULL
, tls_certificate
, tls_privatekey
,
2004 NULL
, tls_verify_certificates
, tls_crl
,
2005 require_ciphers
, &state
, &tls_in
, errstr
)) != OK
) return rc
;
2007 /* If this is a host for which certificate verification is mandatory or
2008 optional, set up appropriately. */
2010 if (verify_check_host(&tls_verify_hosts
) == OK
)
2013 debug_printf("TLS: a client certificate will be required.\n");
2014 state
->verify_requirement
= VERIFY_REQUIRED
;
2015 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUIRE
);
2017 else if (verify_check_host(&tls_try_verify_hosts
) == OK
)
2020 debug_printf("TLS: a client certificate will be requested but not required.\n");
2021 state
->verify_requirement
= VERIFY_OPTIONAL
;
2022 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUEST
);
2027 debug_printf("TLS: a client certificate will not be requested.\n");
2028 state
->verify_requirement
= VERIFY_NONE
;
2029 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_IGNORE
);
2032 #ifndef DISABLE_EVENT
2035 state
->event_action
= event_action
;
2036 gnutls_session_set_ptr(state
->session
, state
);
2037 gnutls_certificate_set_verify_function(state
->x509_cred
, verify_cb
);
2041 /* Register SNI handling; always, even if not in tls_certificate, so that the
2042 expansion variable $tls_sni is always available. */
2044 gnutls_handshake_set_post_client_hello_function(state
->session
,
2045 exim_sni_handling_cb
);
2047 /* Set context and tell client to go ahead, except in the case of TLS startup
2048 on connection, where outputting anything now upsets the clients and tends to
2049 make them disconnect. We need to have an explicit fflush() here, to force out
2050 the response. Other smtp_printf() calls do not need it, because in non-TLS
2051 mode, the fflush() happens when smtp_getc() is called. */
2053 if (!state
->tlsp
->on_connect
)
2055 smtp_printf("220 TLS go ahead\r\n", FALSE
);
2059 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2060 that the GnuTLS library doesn't. */
2062 gnutls_transport_set_ptr2(state
->session
,
2063 (gnutls_transport_ptr_t
)(long) fileno(smtp_in
),
2064 (gnutls_transport_ptr_t
)(long) fileno(smtp_out
));
2065 state
->fd_in
= fileno(smtp_in
);
2066 state
->fd_out
= fileno(smtp_out
);
2068 sigalrm_seen
= FALSE
;
2069 if (smtp_receive_timeout
> 0) alarm(smtp_receive_timeout
);
2071 rc
= gnutls_handshake(state
->session
);
2072 while (rc
== GNUTLS_E_AGAIN
|| rc
== GNUTLS_E_INTERRUPTED
&& !sigalrm_seen
);
2075 if (rc
!= GNUTLS_E_SUCCESS
)
2077 /* It seems that, except in the case of a timeout, we have to close the
2078 connection right here; otherwise if the other end is running OpenSSL it hangs
2079 until the server times out. */
2083 tls_error(US
"gnutls_handshake", "timed out", NULL
, errstr
);
2084 gnutls_db_remove_session(state
->session
);
2088 tls_error(US
"gnutls_handshake", gnutls_strerror(rc
), NULL
, errstr
);
2089 (void) gnutls_alert_send_appropriate(state
->session
, rc
);
2090 gnutls_deinit(state
->session
);
2091 gnutls_certificate_free_credentials(state
->x509_cred
);
2093 shutdown(state
->fd_out
, SHUT_WR
);
2094 for (rc
= 1024; fgetc(smtp_in
) != EOF
&& rc
> 0; ) rc
--; /* drain skt */
2095 (void)fclose(smtp_out
);
2096 (void)fclose(smtp_in
);
2097 smtp_out
= smtp_in
= NULL
;
2103 DEBUG(D_tls
) debug_printf("gnutls_handshake was successful\n");
2105 /* Verify after the fact */
2107 if (!verify_certificate(state
, errstr
))
2109 if (state
->verify_requirement
!= VERIFY_OPTIONAL
)
2111 (void) tls_error(US
"certificate verification failed", *errstr
, NULL
, errstr
);
2115 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
2119 /* Figure out peer DN, and if authenticated, etc. */
2121 if ((rc
= peer_status(state
, NULL
)) != OK
) return rc
;
2123 /* Sets various Exim expansion variables; always safe within server */
2125 extract_exim_vars_from_tls_state(state
);
2127 /* TLS has been set up. Adjust the input functions to read via TLS,
2128 and initialize appropriately. */
2130 state
->xfer_buffer
= store_malloc(ssl_xfer_buffer_size
);
2132 receive_getc
= tls_getc
;
2133 receive_getbuf
= tls_getbuf
;
2134 receive_get_cache
= tls_get_cache
;
2135 receive_ungetc
= tls_ungetc
;
2136 receive_feof
= tls_feof
;
2137 receive_ferror
= tls_ferror
;
2138 receive_smtp_buffered
= tls_smtp_buffered
;
2147 tls_client_setup_hostname_checks(host_item
* host
, exim_gnutls_state_st
* state
,
2148 smtp_transport_options_block
* ob
)
2150 if (verify_check_given_host(&ob
->tls_verify_cert_hostnames
, host
) == OK
)
2152 state
->exp_tls_verify_cert_hostnames
=
2154 string_domain_utf8_to_alabel(host
->name
, NULL
);
2159 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2160 state
->exp_tls_verify_cert_hostnames
);
2168 /* Given our list of RRs from the TLSA lookup, build a lookup block in
2169 GnuTLS-DANE's preferred format. Hang it on the state str for later
2170 use in DANE verification.
2172 We point at the dnsa data not copy it, so it must remain valid until
2173 after verification is done.*/
2176 dane_tlsa_load(exim_gnutls_state_st
* state
, dns_answer
* dnsa
)
2181 const char ** dane_data
;
2182 int * dane_data_len
;
2184 for (rr
= dns_next_rr(dnsa
, &dnss
, RESET_ANSWERS
), i
= 1;
2186 rr
= dns_next_rr(dnsa
, &dnss
, RESET_NEXT
)
2187 ) if (rr
->type
== T_TLSA
) i
++;
2189 dane_data
= store_get(i
* sizeof(uschar
*));
2190 dane_data_len
= store_get(i
* sizeof(int));
2192 for (rr
= dns_next_rr(dnsa
, &dnss
, RESET_ANSWERS
), i
= 0;
2194 rr
= dns_next_rr(dnsa
, &dnss
, RESET_NEXT
)
2195 ) if (rr
->type
== T_TLSA
)
2197 const uschar
* p
= rr
->data
;
2198 uint8_t usage
= p
[0], sel
= p
[1], type
= p
[2];
2201 debug_printf("TLSA: %d %d %d size %d\n", usage
, sel
, type
, rr
->size
);
2203 if ( (usage
!= DANESSL_USAGE_DANE_TA
&& usage
!= DANESSL_USAGE_DANE_EE
)
2204 || (sel
!= 0 && sel
!= 1)
2209 case 0: /* Full: cannot check at present */
2211 case 1: if (rr
->size
!= 3 + 256/8) continue; /* sha2-256 */
2213 case 2: if (rr
->size
!= 3 + 512/8) continue; /* sha2-512 */
2218 tls_out
.tlsa_usage
|= 1<<usage
;
2220 dane_data_len
[i
++] = rr
->size
;
2223 if (!i
) return FALSE
;
2225 dane_data
[i
] = NULL
;
2226 dane_data_len
[i
] = 0;
2228 state
->dane_data
= (char * const *)dane_data
;
2229 state
->dane_data_len
= dane_data_len
;
2236 /*************************************************
2237 * Start a TLS session in a client *
2238 *************************************************/
2240 /* Called from the smtp transport after STARTTLS has been accepted.
2243 fd the fd of the connection
2244 host connected host (for messages and option-tests)
2245 addr the first address (not used)
2246 tb transport (always smtp)
2247 tlsa_dnsa non-NULL, either request or require dane for this host, and
2248 a TLSA record found. Therefore, dane verify required.
2249 Which implies cert must be requested and supplied, dane
2250 verify must pass, and cert verify irrelevant (incl.
2251 hostnames), and (caller handled) require_tls
2252 tlsp record details of channel configuration
2253 errstr error string pointer
2255 Returns: Pointer to TLS session context, or NULL on error
2259 tls_client_start(int fd
, host_item
*host
,
2260 address_item
*addr ARG_UNUSED
,
2261 transport_instance
* tb
,
2263 dns_answer
* tlsa_dnsa
,
2265 tls_support
* tlsp
, uschar
** errstr
)
2267 smtp_transport_options_block
*ob
= tb
2268 ? (smtp_transport_options_block
*)tb
->options_block
2269 : &smtp_transport_option_defaults
;
2271 exim_gnutls_state_st
* state
= NULL
;
2272 uschar
*cipher_list
= NULL
;
2274 #ifndef DISABLE_OCSP
2276 verify_check_given_host(&ob
->hosts_require_ocsp
, host
) == OK
;
2277 BOOL request_ocsp
= require_ocsp
? TRUE
2278 : verify_check_given_host(&ob
->hosts_request_ocsp
, host
) == OK
;
2281 DEBUG(D_tls
) debug_printf("initialising GnuTLS as a client on fd %d\n", fd
);
2284 if (tlsa_dnsa
&& ob
->dane_require_tls_ciphers
)
2286 /* not using expand_check_tlsvar because not yet in state */
2287 if (!expand_check(ob
->dane_require_tls_ciphers
, US
"dane_require_tls_ciphers",
2288 &cipher_list
, errstr
))
2290 cipher_list
= cipher_list
&& *cipher_list
2291 ? ob
->dane_require_tls_ciphers
: ob
->tls_require_ciphers
;
2296 cipher_list
= ob
->tls_require_ciphers
;
2298 if (tls_init(host
, ob
->tls_certificate
, ob
->tls_privatekey
,
2299 ob
->tls_sni
, ob
->tls_verify_certificates
, ob
->tls_crl
,
2300 cipher_list
, &state
, tlsp
, errstr
) != OK
)
2304 int dh_min_bits
= ob
->tls_dh_min_bits
;
2305 if (dh_min_bits
< EXIM_CLIENT_DH_MIN_MIN_BITS
)
2308 debug_printf("WARNING: tls_dh_min_bits far too low,"
2309 " clamping %d up to %d\n",
2310 dh_min_bits
, EXIM_CLIENT_DH_MIN_MIN_BITS
);
2311 dh_min_bits
= EXIM_CLIENT_DH_MIN_MIN_BITS
;
2314 DEBUG(D_tls
) debug_printf("Setting D-H prime minimum"
2315 " acceptable bits to %d\n",
2317 gnutls_dh_set_prime_bits(state
->session
, dh_min_bits
);
2320 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
2321 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2322 the specified host patterns if one of them is defined */
2325 if (tlsa_dnsa
&& dane_tlsa_load(state
, tlsa_dnsa
))
2328 debug_printf("TLS: server certificate DANE required.\n");
2329 state
->verify_requirement
= VERIFY_DANE
;
2330 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUIRE
);
2334 if ( ( state
->exp_tls_verify_certificates
2335 && !ob
->tls_verify_hosts
2336 && (!ob
->tls_try_verify_hosts
|| !*ob
->tls_try_verify_hosts
)
2338 || verify_check_given_host(&ob
->tls_verify_hosts
, host
) == OK
2341 tls_client_setup_hostname_checks(host
, state
, ob
);
2343 debug_printf("TLS: server certificate verification required.\n");
2344 state
->verify_requirement
= VERIFY_REQUIRED
;
2345 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUIRE
);
2347 else if (verify_check_given_host(&ob
->tls_try_verify_hosts
, host
) == OK
)
2349 tls_client_setup_hostname_checks(host
, state
, ob
);
2351 debug_printf("TLS: server certificate verification optional.\n");
2352 state
->verify_requirement
= VERIFY_OPTIONAL
;
2353 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUEST
);
2358 debug_printf("TLS: server certificate verification not required.\n");
2359 state
->verify_requirement
= VERIFY_NONE
;
2360 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_IGNORE
);
2363 #ifndef DISABLE_OCSP
2364 /* supported since GnuTLS 3.1.3 */
2367 DEBUG(D_tls
) debug_printf("TLS: will request OCSP stapling\n");
2368 if ((rc
= gnutls_ocsp_status_request_enable_client(state
->session
,
2369 NULL
, 0, NULL
)) != OK
)
2371 tls_error(US
"cert-status-req", gnutls_strerror(rc
), state
->host
, errstr
);
2374 tlsp
->ocsp
= OCSP_NOT_RESP
;
2378 #ifndef DISABLE_EVENT
2379 if (tb
&& tb
->event_action
)
2381 state
->event_action
= tb
->event_action
;
2382 gnutls_session_set_ptr(state
->session
, state
);
2383 gnutls_certificate_set_verify_function(state
->x509_cred
, verify_cb
);
2387 gnutls_transport_set_ptr(state
->session
, (gnutls_transport_ptr_t
)(long) fd
);
2391 DEBUG(D_tls
) debug_printf("about to gnutls_handshake\n");
2392 /* There doesn't seem to be a built-in timeout on connection. */
2394 sigalrm_seen
= FALSE
;
2395 alarm(ob
->command_timeout
);
2397 rc
= gnutls_handshake(state
->session
);
2398 while (rc
== GNUTLS_E_AGAIN
|| rc
== GNUTLS_E_INTERRUPTED
&& !sigalrm_seen
);
2401 if (rc
!= GNUTLS_E_SUCCESS
)
2405 gnutls_alert_send(state
->session
, GNUTLS_AL_FATAL
, GNUTLS_A_USER_CANCELED
);
2406 tls_error(US
"gnutls_handshake", "timed out", state
->host
, errstr
);
2409 tls_error(US
"gnutls_handshake", gnutls_strerror(rc
), state
->host
, errstr
);
2413 DEBUG(D_tls
) debug_printf("gnutls_handshake was successful\n");
2417 if (!verify_certificate(state
, errstr
))
2419 tls_error(US
"certificate verification failed", *errstr
, state
->host
, errstr
);
2423 #ifndef DISABLE_OCSP
2428 gnutls_datum_t stapling
;
2429 gnutls_ocsp_resp_t resp
;
2430 gnutls_datum_t printed
;
2431 if ( (rc
= gnutls_ocsp_status_request_get(state
->session
, &stapling
)) == 0
2432 && (rc
= gnutls_ocsp_resp_init(&resp
)) == 0
2433 && (rc
= gnutls_ocsp_resp_import(resp
, &stapling
)) == 0
2434 && (rc
= gnutls_ocsp_resp_print(resp
, GNUTLS_OCSP_PRINT_FULL
, &printed
)) == 0
2437 debug_printf("%.4096s", printed
.data
);
2438 gnutls_free(printed
.data
);
2441 (void) tls_error(US
"ocsp decode", gnutls_strerror(rc
), state
->host
, errstr
);
2444 if (gnutls_ocsp_status_request_is_checked(state
->session
, 0) == 0)
2446 tlsp
->ocsp
= OCSP_FAILED
;
2447 tls_error(US
"certificate status check failed", NULL
, state
->host
, errstr
);
2450 DEBUG(D_tls
) debug_printf("Passed OCSP checking\n");
2451 tlsp
->ocsp
= OCSP_VFIED
;
2455 /* Figure out peer DN, and if authenticated, etc. */
2457 if (peer_status(state
, errstr
) != OK
)
2460 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
2462 extract_exim_vars_from_tls_state(state
);
2470 /*************************************************
2471 * Close down a TLS session *
2472 *************************************************/
2474 /* This is also called from within a delivery subprocess forked from the
2475 daemon, to shut down the TLS library, without actually doing a shutdown (which
2476 would tamper with the TLS session in the parent process).
2479 ct_ctx client context pointer, or NULL for the one global server context
2480 shutdown 1 if TLS close-alert is to be sent,
2481 2 if also response to be waited for
2487 tls_close(void * ct_ctx
, int shutdown
)
2489 exim_gnutls_state_st
* state
= ct_ctx
? ct_ctx
: &state_server
;
2491 if (!state
->tlsp
|| state
->tlsp
->active
.sock
< 0) return; /* TLS was not active */
2495 DEBUG(D_tls
) debug_printf("tls_close(): shutting down TLS%s\n",
2496 shutdown
> 1 ? " (with response-wait)" : "");
2499 gnutls_bye(state
->session
, shutdown
> 1 ? GNUTLS_SHUT_RDWR
: GNUTLS_SHUT_WR
);
2503 gnutls_deinit(state
->session
);
2504 gnutls_certificate_free_credentials(state
->x509_cred
);
2507 state
->tlsp
->active
.sock
= -1;
2508 state
->tlsp
->active
.tls_ctx
= NULL
;
2509 if (state
->xfer_buffer
) store_free(state
->xfer_buffer
);
2510 memcpy(state
, &exim_gnutls_state_init
, sizeof(exim_gnutls_state_init
));
2517 tls_refill(unsigned lim
)
2519 exim_gnutls_state_st
* state
= &state_server
;
2522 DEBUG(D_tls
) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2523 state
->session
, state
->xfer_buffer
, ssl_xfer_buffer_size
);
2525 sigalrm_seen
= FALSE
;
2526 if (smtp_receive_timeout
> 0) alarm(smtp_receive_timeout
);
2527 inbytes
= gnutls_record_recv(state
->session
, state
->xfer_buffer
,
2528 MIN(ssl_xfer_buffer_size
, lim
));
2529 if (smtp_receive_timeout
> 0) alarm(0);
2531 if (had_command_timeout
) /* set by signal handler */
2532 smtp_command_timeout_exit(); /* does not return */
2533 if (had_command_sigterm
)
2534 smtp_command_sigterm_exit();
2535 if (had_data_timeout
)
2536 smtp_data_timeout_exit();
2537 if (had_data_sigint
)
2538 smtp_data_sigint_exit();
2540 /* Timeouts do not get this far. A zero-byte return appears to mean that the
2541 TLS session has been closed down, not that the socket itself has been closed
2542 down. Revert to non-TLS handling. */
2546 DEBUG(D_tls
) debug_printf("Got tls read timeout\n");
2547 state
->xfer_error
= TRUE
;
2551 else if (inbytes
== 0)
2553 DEBUG(D_tls
) debug_printf("Got TLS_EOF\n");
2555 receive_getc
= smtp_getc
;
2556 receive_getbuf
= smtp_getbuf
;
2557 receive_get_cache
= smtp_get_cache
;
2558 receive_ungetc
= smtp_ungetc
;
2559 receive_feof
= smtp_feof
;
2560 receive_ferror
= smtp_ferror
;
2561 receive_smtp_buffered
= smtp_buffered
;
2563 gnutls_deinit(state
->session
);
2564 gnutls_certificate_free_credentials(state
->x509_cred
);
2566 state
->session
= NULL
;
2567 state
->tlsp
->active
.sock
= -1;
2568 state
->tlsp
->active
.tls_ctx
= NULL
;
2569 state
->tlsp
->bits
= 0;
2570 state
->tlsp
->certificate_verified
= FALSE
;
2571 tls_channelbinding_b64
= NULL
;
2572 state
->tlsp
->cipher
= NULL
;
2573 state
->tlsp
->peercert
= NULL
;
2574 state
->tlsp
->peerdn
= NULL
;
2579 /* Handle genuine errors */
2581 else if (inbytes
< 0)
2583 record_io_error(state
, (int) inbytes
, US
"recv", NULL
);
2584 state
->xfer_error
= TRUE
;
2587 #ifndef DISABLE_DKIM
2588 dkim_exim_verify_feed(state
->xfer_buffer
, inbytes
);
2590 state
->xfer_buffer_hwm
= (int) inbytes
;
2591 state
->xfer_buffer_lwm
= 0;
2595 /*************************************************
2596 * TLS version of getc *
2597 *************************************************/
2599 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2600 it refills the buffer via the GnuTLS reading function.
2601 Only used by the server-side TLS.
2603 This feeds DKIM and should be used for all message-body reads.
2605 Arguments: lim Maximum amount to read/bufffer
2606 Returns: the next character or EOF
2610 tls_getc(unsigned lim
)
2612 exim_gnutls_state_st
* state
= &state_server
;
2614 if (state
->xfer_buffer_lwm
>= state
->xfer_buffer_hwm
)
2615 if (!tls_refill(lim
))
2616 return state
->xfer_error
? EOF
: smtp_getc(lim
);
2618 /* Something in the buffer; return next uschar */
2620 return state
->xfer_buffer
[state
->xfer_buffer_lwm
++];
2624 tls_getbuf(unsigned * len
)
2626 exim_gnutls_state_st
* state
= &state_server
;
2630 if (state
->xfer_buffer_lwm
>= state
->xfer_buffer_hwm
)
2631 if (!tls_refill(*len
))
2633 if (!state
->xfer_error
) return smtp_getbuf(len
);
2638 if ((size
= state
->xfer_buffer_hwm
- state
->xfer_buffer_lwm
) > *len
)
2640 buf
= &state
->xfer_buffer
[state
->xfer_buffer_lwm
];
2641 state
->xfer_buffer_lwm
+= size
;
2650 #ifndef DISABLE_DKIM
2651 exim_gnutls_state_st
* state
= &state_server
;
2652 int n
= state
->xfer_buffer_hwm
- state
->xfer_buffer_lwm
;
2654 dkim_exim_verify_feed(state
->xfer_buffer
+state
->xfer_buffer_lwm
, n
);
2660 tls_could_read(void)
2662 return state_server
.xfer_buffer_lwm
< state_server
.xfer_buffer_hwm
2663 || gnutls_record_check_pending(state_server
.session
) > 0;
2669 /*************************************************
2670 * Read bytes from TLS channel *
2671 *************************************************/
2673 /* This does not feed DKIM, so if the caller uses this for reading message body,
2674 then the caller must feed DKIM.
2677 ct_ctx client context pointer, or NULL for the one global server context
2681 Returns: the number of bytes read
2682 -1 after a failed read, including EOF
2686 tls_read(void * ct_ctx
, uschar
*buff
, size_t len
)
2688 exim_gnutls_state_st
* state
= ct_ctx
? ct_ctx
: &state_server
;
2694 if (state
->xfer_buffer_lwm
< state
->xfer_buffer_hwm
)
2696 debug_printf("*** PROBABLY A BUG *** " \
2697 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2698 state
->xfer_buffer_hwm
- state
->xfer_buffer_lwm
);
2701 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT
")\n",
2702 state
->session
, buff
, len
);
2704 inbytes
= gnutls_record_recv(state
->session
, buff
, len
);
2705 if (inbytes
> 0) return inbytes
;
2708 DEBUG(D_tls
) debug_printf("Got TLS_EOF\n");
2710 else record_io_error(state
, (int)inbytes
, US
"recv", NULL
);
2718 /*************************************************
2719 * Write bytes down TLS channel *
2720 *************************************************/
2724 ct_ctx client context pointer, or NULL for the one global server context
2727 more more data expected soon
2729 Returns: the number of bytes after a successful write,
2730 -1 after a failed write
2734 tls_write(void * ct_ctx
, const uschar
* buff
, size_t len
, BOOL more
)
2738 exim_gnutls_state_st
* state
= ct_ctx
? ct_ctx
: &state_server
;
2740 static BOOL corked
= FALSE
;
2742 if (more
&& !corked
) gnutls_record_cork(state
->session
);
2745 DEBUG(D_tls
) debug_printf("%s(%p, " SIZE_T_FMT
"%s)\n", __FUNCTION__
,
2746 buff
, left
, more
? ", more" : "");
2750 DEBUG(D_tls
) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT
")\n",
2752 outbytes
= gnutls_record_send(state
->session
, buff
, left
);
2754 DEBUG(D_tls
) debug_printf("outbytes=" SSIZE_T_FMT
"\n", outbytes
);
2757 record_io_error(state
, outbytes
, US
"send", NULL
);
2762 record_io_error(state
, 0, US
"send", US
"TLS channel closed on write");
2773 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT
") than INT_MAX\n",
2781 if (!more
) (void) gnutls_record_uncork(state
->session
, 0);
2792 /*************************************************
2793 * Random number generation *
2794 *************************************************/
2796 /* Pseudo-random number generation. The result is not expected to be
2797 cryptographically strong but not so weak that someone will shoot themselves
2798 in the foot using it as a nonce in input in some email header scheme or
2799 whatever weirdness they'll twist this into. The result should handle fork()
2800 and avoid repeating sequences. OpenSSL handles that for us.
2804 Returns a random number in range [0, max-1]
2807 #ifdef HAVE_GNUTLS_RND
2809 vaguely_random_number(int max
)
2814 uschar smallbuf
[sizeof(r
)];
2819 needed_len
= sizeof(r
);
2820 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2821 * asked for a number less than 10. */
2822 for (r
= max
, i
= 0; r
; ++i
)
2828 i
= gnutls_rnd(GNUTLS_RND_NONCE
, smallbuf
, needed_len
);
2831 DEBUG(D_all
) debug_printf("gnutls_rnd() failed, using fallback.\n");
2832 return vaguely_random_number_fallback(max
);
2835 for (p
= smallbuf
; needed_len
; --needed_len
, ++p
)
2841 /* We don't particularly care about weighted results; if someone wants
2842 * smooth distribution and cares enough then they should submit a patch then. */
2845 #else /* HAVE_GNUTLS_RND */
2847 vaguely_random_number(int max
)
2849 return vaguely_random_number_fallback(max
);
2851 #endif /* HAVE_GNUTLS_RND */
2856 /*************************************************
2857 * Let tls_require_ciphers be checked at startup *
2858 *************************************************/
2860 /* The tls_require_ciphers option, if set, must be something which the
2863 Returns: NULL on success, or error message
2867 tls_validate_require_cipher(void)
2870 uschar
*expciphers
= NULL
;
2871 gnutls_priority_t priority_cache
;
2873 uschar
* dummy_errstr
;
2875 #define validate_check_rc(Label) do { \
2876 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2877 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2878 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2880 if (exim_gnutls_base_init_done
)
2881 log_write(0, LOG_MAIN
|LOG_PANIC
,
2882 "already initialised GnuTLS, Exim developer bug");
2884 #ifdef HAVE_GNUTLS_PKCS11
2885 if (!gnutls_allow_auto_pkcs11
)
2887 rc
= gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL
, NULL
);
2888 validate_check_rc(US
"gnutls_pkcs11_init");
2891 rc
= gnutls_global_init();
2892 validate_check_rc(US
"gnutls_global_init()");
2893 exim_gnutls_base_init_done
= TRUE
;
2895 if (!(tls_require_ciphers
&& *tls_require_ciphers
))
2896 return_deinit(NULL
);
2898 if (!expand_check(tls_require_ciphers
, US
"tls_require_ciphers", &expciphers
,
2900 return_deinit(US
"failed to expand tls_require_ciphers");
2902 if (!(expciphers
&& *expciphers
))
2903 return_deinit(NULL
);
2906 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers
);
2908 rc
= gnutls_priority_init(&priority_cache
, CS expciphers
, &errpos
);
2909 validate_check_rc(string_sprintf(
2910 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2911 expciphers
, errpos
- CS expciphers
, errpos
));
2913 #undef return_deinit
2914 #undef validate_check_rc
2915 gnutls_global_deinit();
2923 /*************************************************
2924 * Report the library versions. *
2925 *************************************************/
2927 /* See a description in tls-openssl.c for an explanation of why this exists.
2929 Arguments: a FILE* to print the results to
2934 tls_version_report(FILE *f
)
2936 fprintf(f
, "Library version: GnuTLS: Compile: %s\n"
2939 gnutls_check_version(NULL
));
2944 /* End of tls-gnu.c */