1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2012 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
46 gnutls_global_set_audit_log_function()
49 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
52 /* Local static variables for GnuTLS */
54 /* Values for verify_requirement */
56 enum peer_verify_requirement
{ VERIFY_NONE
, VERIFY_OPTIONAL
, VERIFY_REQUIRED
};
58 /* This holds most state for server or client; with this, we can set up an
59 outbound TLS-enabled connection in an ACL callout, while not stomping all
60 over the TLS variables available for expansion.
62 Some of these correspond to variables in globals.c; those variables will
63 be set to point to content in one of these instances, as appropriate for
64 the stage of the process lifetime.
66 Not handled here: globals tls_active, tls_bits, tls_cipher, tls_peerdn,
67 tls_certificate_verified, tls_channelbinding_b64, tls_sni.
70 typedef struct exim_gnutls_state
{
71 gnutls_session_t session
;
72 gnutls_certificate_credentials_t x509_cred
;
73 gnutls_priority_t priority_cache
;
74 enum peer_verify_requirement verify_requirement
;
77 BOOL peer_cert_verified
;
78 BOOL trigger_sni_changes
;
80 const struct host_item
*host
;
84 const uschar
*tls_certificate
;
85 const uschar
*tls_privatekey
;
86 const uschar
*tls_sni
; /* client send only, not received */
87 const uschar
*tls_verify_certificates
;
88 const uschar
*tls_crl
;
89 const uschar
*tls_require_ciphers
;
90 uschar
*exp_tls_certificate
;
91 uschar
*exp_tls_privatekey
;
93 uschar
*exp_tls_verify_certificates
;
95 uschar
*exp_tls_require_ciphers
;
103 uschar cipherbuf
[256];
104 } exim_gnutls_state_st
;
106 static const exim_gnutls_state_st exim_gnutls_state_init
= {
107 NULL
, NULL
, NULL
, VERIFY_NONE
, -1, -1, FALSE
, FALSE
, FALSE
,
109 NULL
, NULL
, NULL
, NULL
, NULL
, NULL
,
110 NULL
, NULL
, NULL
, NULL
, NULL
, NULL
,
115 /* Not only do we have our own APIs which don't pass around state, assuming
116 it's held in globals, GnuTLS doesn't appear to let us register callback data
117 for callbacks, or as part of the session, so we have to keep a "this is the
118 context we're currently dealing with" pointer and rely upon being
119 single-threaded to keep from processing data on an inbound TLS connection while
120 talking to another TLS connection for an outbound check. This does mean that
121 there's no way for heart-beats to be responded to, for the duration of the
122 second connection. */
124 static exim_gnutls_state_st state_server
, state_client
;
125 static exim_gnutls_state_st
*current_global_tls_state
;
127 /* dh_params are initialised once within the lifetime of a process using TLS;
128 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
129 don't want to repeat this. */
131 static gnutls_dh_params_t dh_server_params
= NULL
;
133 /* No idea how this value was chosen; preserving it. Default is 3600. */
135 static const int ssl_session_timeout
= 200;
137 static const char * const exim_default_gnutls_priority
= "NORMAL";
139 /* Guard library core initialisation */
141 static BOOL exim_gnutls_base_init_done
= FALSE
;
144 /* ------------------------------------------------------------------------ */
147 #define MAX_HOST_LEN 255
149 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
150 the library logging; a value less than 0 disables the calls to set up logging
152 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
153 #define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
156 #ifndef EXIM_CLIENT_DH_MIN_BITS
157 #define EXIM_CLIENT_DH_MIN_BITS 1024
160 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
161 can ask for a bit-strength. Without that, we stick to the constant we had
163 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
164 #define EXIM_SERVER_DH_BITS_PRE2_12 1024
167 #define exim_gnutls_err_check(Label) do { \
168 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
170 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
172 #if GNUTLS_VERSION_NUMBER >= 0x020c00
173 #define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
174 #define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
175 #define HAVE_GNUTLS_RND
181 /* ------------------------------------------------------------------------ */
182 /* Callback declarations */
184 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
185 static void exim_gnutls_logger_cb(int level
, const char *message
);
188 static int exim_sni_handling_cb(gnutls_session_t session
);
193 /* ------------------------------------------------------------------------ */
194 /* Static functions */
196 /*************************************************
198 *************************************************/
200 /* Called from lots of places when errors occur before actually starting to do
201 the TLS handshake, that is, while the session is still in clear. Always returns
202 DEFER for a server and FAIL for a client so that most calls can use "return
203 tls_error(...)" to do this processing and then give an appropriate return. A
204 single function is used for both server and client, because it is called from
205 some shared functions.
208 prefix text to include in the logged error
209 msg additional error string (may be NULL)
210 usually obtained from gnutls_strerror()
211 host NULL if setting up a server;
212 the connected host if setting up a client
214 Returns: OK/DEFER/FAIL
218 tls_error(const uschar
*prefix
, const char *msg
, const host_item
*host
)
222 log_write(0, LOG_MAIN
, "TLS error on connection to %s [%s] (%s)%s%s",
223 host
->name
, host
->address
, prefix
, msg
? ": " : "", msg
? msg
: "");
228 uschar
*conn_info
= smtp_get_connection_info();
229 if (Ustrncmp(conn_info
, US
"SMTP ", 5) == 0)
231 log_write(0, LOG_MAIN
, "TLS error on %s (%s)%s%s",
232 conn_info
, prefix
, msg
? ": " : "", msg
? msg
: "");
240 /*************************************************
241 * Deal with logging errors during I/O *
242 *************************************************/
244 /* We have to get the identity of the peer from saved data.
247 state the current GnuTLS exim state container
248 rc the GnuTLS error code, or 0 if it's a local error
249 when text identifying read or write
250 text local error text when ec is 0
256 record_io_error(exim_gnutls_state_st
*state
, int rc
, uschar
*when
, uschar
*text
)
260 if (rc
== GNUTLS_E_FATAL_ALERT_RECEIVED
)
261 msg
= CS
string_sprintf("%s: %s", US
gnutls_strerror(rc
),
262 US
gnutls_alert_get_name(gnutls_alert_get(state
->session
)));
264 msg
= gnutls_strerror(rc
);
266 tls_error(when
, msg
, state
->host
);
272 /*************************************************
273 * Set various Exim expansion vars *
274 *************************************************/
276 /* We set various Exim global variables from the state, once a session has
277 been established. With TLS callouts, may need to change this to stack
278 variables, or just re-call it with the server state after client callout
281 Make sure anything set here is inset in tls_getc().
285 tls_bits strength indicator
286 tls_certificate_verified bool indicator
287 tls_channelbinding_b64 for some SASL mechanisms
290 tls_sni a (UTF-8) string
292 current_global_tls_state for API limitations
295 state the relevant exim_gnutls_state_st *
299 extract_exim_vars_from_tls_state(exim_gnutls_state_st
*state
)
301 gnutls_cipher_algorithm_t cipher
;
302 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
305 gnutls_datum_t channel
;
308 current_global_tls_state
= state
;
310 tls_active
= state
->fd_out
;
312 cipher
= gnutls_cipher_get(state
->session
);
313 /* returns size in "bytes" */
314 tls_bits
= gnutls_cipher_get_key_size(cipher
) * 8;
316 tls_cipher
= state
->cipherbuf
;
318 DEBUG(D_tls
) debug_printf("cipher: %s\n", tls_cipher
);
320 tls_certificate_verified
= state
->peer_cert_verified
;
322 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
323 only available for use for authenticators while this TLS session is running. */
325 tls_channelbinding_b64
= NULL
;
326 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
329 rc
= gnutls_session_channel_binding(state
->session
, GNUTLS_CB_TLS_UNIQUE
, &channel
);
331 DEBUG(D_tls
) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc
));
333 old_pool
= store_pool
;
334 store_pool
= POOL_PERM
;
335 tls_channelbinding_b64
= auth_b64encode(channel
.data
, (int)channel
.size
);
336 store_pool
= old_pool
;
337 DEBUG(D_tls
) debug_printf("Have channel bindings cached for possible auth usage.\n");
341 tls_peerdn
= state
->peerdn
;
343 tls_sni
= state
->received_sni
;
349 /*************************************************
350 * Setup up DH parameters *
351 *************************************************/
353 /* Generating the D-H parameters may take a long time. They only need to
354 be re-generated every so often, depending on security policy. What we do is to
355 keep these parameters in a file in the spool directory. If the file does not
356 exist, we generate them. This means that it is easy to cause a regeneration.
358 The new file is written as a temporary file and renamed, so that an incomplete
359 file is never present. If two processes both compute some new parameters, you
360 waste a bit of effort, but it doesn't seem worth messing around with locking to
364 host NULL for server, server for client (for error handling)
366 Returns: OK/DEFER/FAIL
373 unsigned int dh_bits
;
375 uschar filename
[PATH_MAX
];
377 host_item
*host
= NULL
; /* dummy for macros */
379 DEBUG(D_tls
) debug_printf("Initialising GnuTLS server params.\n");
381 rc
= gnutls_dh_params_init(&dh_server_params
);
382 exim_gnutls_err_check(US
"gnutls_dh_params_init");
384 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
385 /* If you change this constant, also change dh_param_fn_ext so that we can use a
386 different filename and ensure we have sufficient bits. */
387 dh_bits
= gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH
, GNUTLS_SEC_PARAM_NORMAL
);
389 return tls_error(US
"gnutls_sec_param_to_pk_bits() failed", NULL
, NULL
);
391 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
394 dh_bits
= EXIM_SERVER_DH_BITS_PRE2_12
;
396 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
400 if (!string_format(filename
, sizeof(filename
),
401 "%s/gnutls-params-%d", spool_directory
, dh_bits
))
402 return tls_error(US
"overlong filename", NULL
, NULL
);
404 /* Open the cache file for reading and if successful, read it and set up the
407 fd
= Uopen(filename
, O_RDONLY
, 0);
414 if (fstat(fd
, &statbuf
) < 0) /* EIO */
418 return tls_error(US
"TLS cache stat failed", strerror(saved_errno
), NULL
);
420 if (!S_ISREG(statbuf
.st_mode
))
423 return tls_error(US
"TLS cache not a file", NULL
, NULL
);
425 fp
= fdopen(fd
, "rb");
430 return tls_error(US
"fdopen(TLS cache stat fd) failed",
431 strerror(saved_errno
), NULL
);
434 m
.size
= statbuf
.st_size
;
435 m
.data
= malloc(m
.size
);
439 return tls_error(US
"malloc failed", strerror(errno
), NULL
);
441 sz
= fread(m
.data
, m
.size
, 1, fp
);
447 return tls_error(US
"fread failed", strerror(saved_errno
), NULL
);
451 rc
= gnutls_dh_params_import_pkcs3(dh_server_params
, &m
, GNUTLS_X509_FMT_PEM
);
453 exim_gnutls_err_check(US
"gnutls_dh_params_import_pkcs3");
454 DEBUG(D_tls
) debug_printf("read D-H parameters from file \"%s\"\n", filename
);
457 /* If the file does not exist, fall through to compute new data and cache it.
458 If there was any other opening error, it is serious. */
460 else if (errno
== ENOENT
)
464 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename
);
467 return tls_error(string_open_failed(errno
, "\"%s\" for reading", filename
),
470 /* If ret < 0, either the cache file does not exist, or the data it contains
471 is not useful. One particular case of this is when upgrading from an older
472 release of Exim in which the data was stored in a different format. We don't
473 try to be clever and support both formats; we just regenerate new data in this
480 if ((PATH_MAX
- Ustrlen(filename
)) < 10)
481 return tls_error(US
"Filename too long to generate replacement",
484 temp_fn
= string_copy(US
"%s.XXXXXXX");
485 fd
= mkstemp(CS temp_fn
); /* modifies temp_fn */
487 return tls_error(US
"Unable to open temp file", strerror(errno
), NULL
);
488 (void)fchown(fd
, exim_uid
, exim_gid
); /* Probably not necessary */
490 DEBUG(D_tls
) debug_printf("generating %d bits Diffie-Hellman key ...\n", dh_bits
);
491 rc
= gnutls_dh_params_generate2(dh_server_params
, dh_bits
);
492 exim_gnutls_err_check(US
"gnutls_dh_params_generate2");
494 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
495 and I confirmed that a NULL call to get the size first is how the GnuTLS
496 sample apps handle this. */
500 rc
= gnutls_dh_params_export_pkcs3(dh_server_params
, GNUTLS_X509_FMT_PEM
,
502 if (rc
!= GNUTLS_E_SHORT_MEMORY_BUFFER
)
503 exim_gnutls_err_check(US
"gnutls_dh_params_export_pkcs3(NULL) sizing");
505 m
.data
= malloc(m
.size
);
507 return tls_error(US
"memory allocation failed", strerror(errno
), NULL
);
508 rc
= gnutls_dh_params_export_pkcs3(dh_server_params
, GNUTLS_X509_FMT_PEM
,
510 if (rc
!= GNUTLS_E_SUCCESS
)
513 exim_gnutls_err_check(US
"gnutls_dh_params_export_pkcs3() real");
516 sz
= write_to_fd_buf(fd
, m
.data
, (size_t) m
.size
);
520 return tls_error(US
"TLS cache write D-H params failed",
521 strerror(errno
), NULL
);
524 sz
= write_to_fd_buf(fd
, US
"\n", 1);
526 return tls_error(US
"TLS cache write D-H params final newline failed",
527 strerror(errno
), NULL
);
531 return tls_error(US
"TLS cache write close() failed",
532 strerror(errno
), NULL
);
534 if (Urename(temp_fn
, filename
) < 0)
535 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
536 temp_fn
, filename
), strerror(errno
), NULL
);
538 DEBUG(D_tls
) debug_printf("wrote D-H parameters to file \"%s\"\n", filename
);
541 DEBUG(D_tls
) debug_printf("initialized server D-H parameters\n");
548 /*************************************************
549 * Variables re-expanded post-SNI *
550 *************************************************/
552 /* Called from both server and client code, via tls_init(), and also from
553 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
555 We can tell the two apart by state->received_sni being non-NULL in callback.
557 The callback should not call us unless state->trigger_sni_changes is true,
558 which we are responsible for setting on the first pass through.
561 state exim_gnutls_state_st *
563 Returns: OK/DEFER/FAIL
567 tls_expand_session_files(exim_gnutls_state_st
*state
)
571 const host_item
*host
= state
->host
; /* macro should be reconsidered? */
572 uschar
*saved_tls_certificate
= NULL
;
573 uschar
*saved_tls_privatekey
= NULL
;
574 uschar
*saved_tls_verify_certificates
= NULL
;
575 uschar
*saved_tls_crl
= NULL
;
578 /* We check for tls_sni *before* expansion. */
581 if (!state
->received_sni
)
583 if (Ustrstr(state
->tls_certificate
, US
"tls_sni"))
585 DEBUG(D_tls
) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
586 state
->trigger_sni_changes
= TRUE
;
591 /* useful for debugging */
592 saved_tls_certificate
= state
->exp_tls_certificate
;
593 saved_tls_privatekey
= state
->exp_tls_privatekey
;
594 saved_tls_verify_certificates
= state
->exp_tls_verify_certificates
;
595 saved_tls_crl
= state
->exp_tls_crl
;
599 rc
= gnutls_certificate_allocate_credentials(&state
->x509_cred
);
600 exim_gnutls_err_check(US
"gnutls_certificate_allocate_credentials");
602 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
603 state members, assuming consistent naming; and expand_check() returns
604 false if expansion failed, unless expansion was forced to fail. */
606 /* check if we at least have a certificate, before doing expensive
609 if (!expand_check_tlsvar(tls_certificate
))
612 /* certificate is mandatory in server, optional in client */
614 if ((state
->exp_tls_certificate
== NULL
) ||
615 (*state
->exp_tls_certificate
== '\0'))
617 if (state
->host
== NULL
)
618 return tls_error(US
"no TLS server certificate is specified", NULL
, NULL
);
620 DEBUG(D_tls
) debug_printf("TLS: no client certificate specified; okay\n");
623 if (state
->tls_privatekey
&& !expand_check_tlsvar(tls_privatekey
))
626 /* tls_privatekey is optional, defaulting to same file as certificate */
628 if (state
->tls_privatekey
== NULL
|| *state
->tls_privatekey
== '\0')
630 state
->tls_privatekey
= state
->tls_certificate
;
631 state
->exp_tls_privatekey
= state
->exp_tls_certificate
;
635 if (state
->exp_tls_certificate
&& *state
->exp_tls_certificate
)
637 DEBUG(D_tls
) debug_printf("certificate file = %s\nkey file = %s\n",
638 state
->exp_tls_certificate
, state
->exp_tls_privatekey
);
640 if (state
->received_sni
)
642 if ((Ustrcmp(state
->exp_tls_certificate
, saved_tls_certificate
) == 0) &&
643 (Ustrcmp(state
->exp_tls_privatekey
, saved_tls_privatekey
) == 0))
645 DEBUG(D_tls
) debug_printf("TLS SNI: cert and key unchanged\n");
649 DEBUG(D_tls
) debug_printf("TLS SNI: have a changed cert/key pair.\n");
653 rc
= gnutls_certificate_set_x509_key_file(state
->x509_cred
,
654 CS state
->exp_tls_certificate
, CS state
->exp_tls_privatekey
,
655 GNUTLS_X509_FMT_PEM
);
656 exim_gnutls_err_check(
657 string_sprintf("cert/key setup: cert=%s key=%s",
658 state
->exp_tls_certificate
, state
->exp_tls_privatekey
));
659 DEBUG(D_tls
) debug_printf("TLS: cert/key registered\n");
660 } /* tls_certificate */
662 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
663 provided. Experiment shows that, if the certificate file is empty, an unhelpful
664 error message is provided. However, if we just refrain from setting anything up
665 in that case, certificate verification fails, which seems to be the correct
668 if (state
->tls_verify_certificates
&& *state
->tls_verify_certificates
)
670 if (!expand_check_tlsvar(tls_verify_certificates
))
672 if (state
->tls_crl
&& *state
->tls_crl
)
673 if (!expand_check_tlsvar(tls_crl
))
676 if (!(state
->exp_tls_verify_certificates
&&
677 *state
->exp_tls_verify_certificates
))
680 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
681 /* With no tls_verify_certificates, we ignore tls_crl too */
688 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
692 if (Ustat(state
->exp_tls_verify_certificates
, &statbuf
) < 0)
694 log_write(0, LOG_MAIN
|LOG_PANIC
, "could not stat %s "
695 "(tls_verify_certificates): %s", state
->exp_tls_verify_certificates
,
700 if (!S_ISREG(statbuf
.st_mode
))
703 debug_printf("verify certificates path is not a file: \"%s\"\n%s\n",
704 state
->exp_tls_verify_certificates
,
705 S_ISDIR(statbuf
.st_mode
)
706 ? " it's a directory, that's OpenSSL, this is GnuTLS"
707 : " (not a directory either)");
708 log_write(0, LOG_MAIN
|LOG_PANIC
,
709 "tls_verify_certificates \"%s\" is not a file",
710 state
->exp_tls_verify_certificates
);
714 DEBUG(D_tls
) debug_printf("verify certificates = %s size=" OFF_T_FMT
"\n",
715 state
->exp_tls_verify_certificates
, statbuf
.st_size
);
717 if (statbuf
.st_size
== 0)
720 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
724 cert_count
= gnutls_certificate_set_x509_trust_file(state
->x509_cred
,
725 CS state
->exp_tls_verify_certificates
, GNUTLS_X509_FMT_PEM
);
729 exim_gnutls_err_check(US
"gnutls_certificate_set_x509_trust_file");
731 DEBUG(D_tls
) debug_printf("Added %d certificate authorities.\n", cert_count
);
733 if (state
->tls_crl
&& *state
->tls_crl
)
735 if (state
->exp_tls_crl
&& *state
->exp_tls_crl
)
737 DEBUG(D_tls
) debug_printf("loading CRL file = %s\n", state
->exp_tls_crl
);
738 rc
= gnutls_certificate_set_x509_crl_file(state
->x509_cred
,
739 CS state
->exp_tls_crl
, GNUTLS_X509_FMT_PEM
);
740 exim_gnutls_err_check(US
"gnutls_certificate_set_x509_crl_file");
750 /*************************************************
751 * Set X.509 state variables *
752 *************************************************/
754 /* In GnuTLS, the registered cert/key are not replaced by a later
755 set of a cert/key, so for SNI support we need a whole new x509_cred
756 structure. Which means various other non-re-expanded pieces of state
757 need to be re-set in the new struct, so the setting logic is pulled
761 state exim_gnutls_state_st *
763 Returns: OK/DEFER/FAIL
767 tls_set_remaining_x509(exim_gnutls_state_st
*state
)
770 const host_item
*host
= state
->host
; /* macro should be reconsidered? */
772 /* Create D-H parameters, or read them from the cache file. This function does
773 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
774 client-side params. */
778 if (!dh_server_params
)
780 rc
= init_server_dh();
781 if (rc
!= OK
) return rc
;
783 gnutls_certificate_set_dh_params(state
->x509_cred
, dh_server_params
);
786 /* Link the credentials to the session. */
788 rc
= gnutls_credentials_set(state
->session
, GNUTLS_CRD_CERTIFICATE
, state
->x509_cred
);
789 exim_gnutls_err_check(US
"gnutls_credentials_set");
794 /*************************************************
795 * Initialize for GnuTLS *
796 *************************************************/
798 /* Called from both server and client code. In the case of a server, errors
799 before actual TLS negotiation return DEFER.
802 host connected host, if client; NULL if server
803 certificate certificate file
804 privatekey private key file
805 sni TLS SNI to send, sometimes when client; else NULL
808 require_ciphers tls_require_ciphers setting
810 Returns: OK/DEFER/FAIL
815 const host_item
*host
,
816 const uschar
*certificate
,
817 const uschar
*privatekey
,
821 const uschar
*require_ciphers
,
822 exim_gnutls_state_st
**caller_state
)
824 exim_gnutls_state_st
*state
;
829 BOOL want_default_priorities
;
831 if (!exim_gnutls_base_init_done
)
833 DEBUG(D_tls
) debug_printf("GnuTLS global init required.\n");
835 rc
= gnutls_global_init();
836 exim_gnutls_err_check(US
"gnutls_global_init");
838 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
841 gnutls_global_set_log_function(exim_gnutls_logger_cb
);
842 /* arbitrarily chosen level; bump upto 9 for more */
843 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL
);
847 exim_gnutls_base_init_done
= TRUE
;
852 state
= &state_client
;
853 memcpy(state
, &exim_gnutls_state_init
, sizeof(exim_gnutls_state_init
));
854 DEBUG(D_tls
) debug_printf("initialising GnuTLS client session\n");
855 rc
= gnutls_init(&state
->session
, GNUTLS_CLIENT
);
859 state
= &state_server
;
860 memcpy(state
, &exim_gnutls_state_init
, sizeof(exim_gnutls_state_init
));
861 DEBUG(D_tls
) debug_printf("initialising GnuTLS server session\n");
862 rc
= gnutls_init(&state
->session
, GNUTLS_SERVER
);
864 exim_gnutls_err_check(US
"gnutls_init");
868 state
->tls_certificate
= certificate
;
869 state
->tls_privatekey
= privatekey
;
870 state
->tls_sni
= sni
;
871 state
->tls_verify_certificates
= cas
;
872 state
->tls_crl
= crl
;
874 /* This handles the variables that might get re-expanded after TLS SNI;
875 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
878 debug_printf("Expanding various TLS configuration options for session credentials.\n");
879 rc
= tls_expand_session_files(state
);
880 if (rc
!= OK
) return rc
;
882 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
883 requires a new structure afterwards. */
885 rc
= tls_set_remaining_x509(state
);
886 if (rc
!= OK
) return rc
;
888 /* set SNI in client, only */
891 if (!expand_check_tlsvar(tls_sni
))
893 if (state
->exp_tls_sni
&& *state
->exp_tls_sni
)
896 debug_printf("Setting TLS client SNI to \"%s\"\n", state
->exp_tls_sni
);
897 sz
= Ustrlen(state
->exp_tls_sni
);
898 rc
= gnutls_server_name_set(state
->session
,
899 GNUTLS_NAME_DNS
, state
->exp_tls_sni
, sz
);
900 exim_gnutls_err_check(US
"gnutls_server_name_set");
903 else if (state
->tls_sni
)
904 DEBUG(D_tls
) debug_printf("*** PROBABLY A BUG *** " \
905 "have an SNI set for a client [%s]\n", state
->tls_sni
);
907 /* This is the priority string support,
908 http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html
909 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
910 This was backwards incompatible, but means Exim no longer needs to track
911 all algorithms and provide string forms for them. */
913 want_default_priorities
= TRUE
;
915 if (state
->tls_require_ciphers
&& *state
->tls_require_ciphers
)
917 if (!expand_check_tlsvar(tls_require_ciphers
))
919 if (state
->exp_tls_require_ciphers
&& *state
->exp_tls_require_ciphers
)
921 DEBUG(D_tls
) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
922 state
->exp_tls_require_ciphers
);
924 rc
= gnutls_priority_init(&state
->priority_cache
,
925 CS state
->exp_tls_require_ciphers
, &errpos
);
926 want_default_priorities
= FALSE
;
927 p
= state
->exp_tls_require_ciphers
;
930 if (want_default_priorities
)
933 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
934 exim_default_gnutls_priority
);
935 rc
= gnutls_priority_init(&state
->priority_cache
,
936 exim_default_gnutls_priority
, &errpos
);
937 p
= US exim_default_gnutls_priority
;
940 exim_gnutls_err_check(string_sprintf(
941 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
942 p
, errpos
- CS p
, errpos
));
944 rc
= gnutls_priority_set(state
->session
, state
->priority_cache
);
945 exim_gnutls_err_check(US
"gnutls_priority_set");
947 gnutls_db_set_cache_expiration(state
->session
, ssl_session_timeout
);
949 /* Reduce security in favour of increased compatibility, if the admin
950 decides to make that trade-off. */
951 if (gnutls_compat_mode
)
953 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
954 DEBUG(D_tls
) debug_printf("lowering GnuTLS security, compatibility mode\n");
955 gnutls_session_enable_compatibility_mode(state
->session
);
957 DEBUG(D_tls
) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
961 *caller_state
= state
;
962 /* needs to happen before callbacks during handshake */
963 current_global_tls_state
= state
;
970 /*************************************************
971 * Extract peer information *
972 *************************************************/
974 /* Called from both server and client code.
975 Only this is allowed to set state->peerdn and state->have_set_peerdn
976 and we use that to detect double-calls.
979 state exim_gnutls_state_st *
981 Returns: OK/DEFER/FAIL
985 peer_status(exim_gnutls_state_st
*state
)
987 const gnutls_datum
*cert_list
;
989 unsigned int cert_list_size
= 0;
990 gnutls_protocol_t protocol
;
991 gnutls_cipher_algorithm_t cipher
;
992 gnutls_kx_algorithm_t kx
;
993 gnutls_mac_algorithm_t mac
;
994 gnutls_certificate_type_t ct
;
995 gnutls_x509_crt_t crt
;
999 if (state
->have_set_peerdn
)
1001 state
->have_set_peerdn
= TRUE
;
1003 state
->peerdn
= NULL
;
1006 cipher
= gnutls_cipher_get(state
->session
);
1007 protocol
= gnutls_protocol_get_version(state
->session
);
1008 mac
= gnutls_mac_get(state
->session
);
1009 kx
= gnutls_kx_get(state
->session
);
1011 string_format(state
->cipherbuf
, sizeof(state
->cipherbuf
),
1013 gnutls_protocol_get_name(protocol
),
1014 gnutls_cipher_suite_get_name(kx
, cipher
, mac
),
1015 (int) gnutls_cipher_get_key_size(cipher
) * 8);
1017 /* I don't see a way that spaces could occur, in the current GnuTLS
1018 code base, but it was a concern in the old code and perhaps older GnuTLS
1019 releases did return "TLS 1.0"; play it safe, just in case. */
1020 for (p
= state
->cipherbuf
; *p
!= '\0'; ++p
)
1025 cert_list
= gnutls_certificate_get_peers(state
->session
, &cert_list_size
);
1027 if (cert_list
== NULL
|| cert_list_size
== 0)
1029 DEBUG(D_tls
) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1030 cert_list
, cert_list_size
);
1031 if (state
->verify_requirement
== VERIFY_REQUIRED
)
1032 return tls_error(US
"certificate verification failed",
1033 "no certificate received from peer", state
->host
);
1037 ct
= gnutls_certificate_type_get(state
->session
);
1038 if (ct
!= GNUTLS_CRT_X509
)
1040 const char *ctn
= gnutls_certificate_type_get_name(ct
);
1042 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn
);
1043 if (state
->verify_requirement
== VERIFY_REQUIRED
)
1044 return tls_error(US
"certificate verification not possible, unhandled type",
1049 #define exim_gnutls_peer_err(Label) do { \
1050 if (rc != GNUTLS_E_SUCCESS) { \
1051 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1052 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1053 return OK; } } while (0)
1055 rc
= gnutls_x509_crt_init(&crt
);
1056 exim_gnutls_peer_err(US
"gnutls_x509_crt_init (crt)");
1058 rc
= gnutls_x509_crt_import(crt
, &cert_list
[0], GNUTLS_X509_FMT_DER
);
1059 exim_gnutls_peer_err(US
"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1061 rc
= gnutls_x509_crt_get_dn(crt
, NULL
, &sz
);
1062 if (rc
!= GNUTLS_E_SHORT_MEMORY_BUFFER
)
1064 exim_gnutls_peer_err(US
"getting size for cert DN failed");
1065 return FAIL
; /* should not happen */
1067 dn_buf
= store_get_perm(sz
);
1068 rc
= gnutls_x509_crt_get_dn(crt
, CS dn_buf
, &sz
);
1069 exim_gnutls_peer_err(US
"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1070 state
->peerdn
= dn_buf
;
1073 #undef exim_gnutls_peer_err
1079 /*************************************************
1080 * Verify peer certificate *
1081 *************************************************/
1083 /* Called from both server and client code.
1084 *Should* be using a callback registered with
1085 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1086 the peer information, but that's too new for some OSes.
1089 state exim_gnutls_state_st *
1090 error where to put an error message
1093 FALSE if the session should be rejected
1094 TRUE if the cert is okay or we just don't care
1098 verify_certificate(exim_gnutls_state_st
*state
, const char **error
)
1101 unsigned int verify
;
1105 rc
= peer_status(state
);
1108 verify
= GNUTLS_CERT_INVALID
;
1109 *error
= "not supplied";
1113 rc
= gnutls_certificate_verify_peers2(state
->session
, &verify
);
1116 /* Handle the result of verification. INVALID seems to be set as well
1117 as REVOKED, but leave the test for both. */
1119 if ((rc
< 0) || (verify
& (GNUTLS_CERT_INVALID
|GNUTLS_CERT_REVOKED
)) != 0)
1121 state
->peer_cert_verified
= FALSE
;
1123 *error
= ((verify
& GNUTLS_CERT_REVOKED
) != 0) ? "revoked" : "invalid";
1126 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
1127 *error
, state
->peerdn
? state
->peerdn
: US
"<unset>");
1129 if (state
->verify_requirement
== VERIFY_REQUIRED
)
1131 gnutls_alert_send(state
->session
, GNUTLS_AL_FATAL
, GNUTLS_A_BAD_CERTIFICATE
);
1135 debug_printf("TLS verify failure overriden (host in tls_try_verify_hosts)\n");
1139 state
->peer_cert_verified
= TRUE
;
1140 DEBUG(D_tls
) debug_printf("TLS certificate verified: peerdn=%s\n",
1141 state
->peerdn
? state
->peerdn
: US
"<unset>");
1144 tls_peerdn
= state
->peerdn
;
1152 /* ------------------------------------------------------------------------ */
1155 /* Logging function which can be registered with
1156 * gnutls_global_set_log_function()
1157 * gnutls_global_set_log_level() 0..9
1159 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1161 exim_gnutls_logger_cb(int level
, const char *message
)
1163 DEBUG(D_tls
) debug_printf("GnuTLS<%d>: %s\n", level
, message
);
1168 /* Called after client hello, should handle SNI work.
1169 This will always set tls_sni (state->received_sni) if available,
1170 and may trigger presenting different certificates,
1171 if state->trigger_sni_changes is TRUE.
1173 Should be registered with
1174 gnutls_handshake_set_post_client_hello_function()
1176 "This callback must return 0 on success or a gnutls error code to terminate the
1179 For inability to get SNI information, we return 0.
1180 We only return non-zero if re-setup failed.
1184 exim_sni_handling_cb(gnutls_session_t session
)
1186 char sni_name
[MAX_HOST_LEN
];
1187 size_t data_len
= MAX_HOST_LEN
;
1188 exim_gnutls_state_st
*state
= current_global_tls_state
;
1189 unsigned int sni_type
;
1192 rc
= gnutls_server_name_get(session
, sni_name
, &data_len
, &sni_type
, 0);
1193 if (rc
!= GNUTLS_E_SUCCESS
)
1196 if (rc
== GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
)
1197 debug_printf("TLS: no SNI presented in handshake.\n");
1199 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1200 gnutls_strerror(rc
), rc
);
1205 if (sni_type
!= GNUTLS_NAME_DNS
)
1207 DEBUG(D_tls
) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type
);
1211 /* We now have a UTF-8 string in sni_name */
1212 old_pool
= store_pool
;
1213 store_pool
= POOL_PERM
;
1214 state
->received_sni
= string_copyn(US sni_name
, data_len
);
1215 store_pool
= old_pool
;
1217 /* We set this one now so that variable expansions below will work */
1218 tls_sni
= state
->received_sni
;
1220 DEBUG(D_tls
) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name
,
1221 state
->trigger_sni_changes
? "" : " (unused for certificate selection)");
1223 if (!state
->trigger_sni_changes
)
1226 rc
= tls_expand_session_files(state
);
1229 /* If the setup of certs/etc failed before handshake, TLS would not have
1230 been offered. The best we can do now is abort. */
1231 return GNUTLS_E_APPLICATION_ERROR_MIN
;
1234 rc
= tls_set_remaining_x509(state
);
1235 if (rc
!= OK
) return GNUTLS_E_APPLICATION_ERROR_MIN
;
1243 /* ------------------------------------------------------------------------ */
1244 /* Exported functions */
1249 /*************************************************
1250 * Start a TLS session in a server *
1251 *************************************************/
1253 /* This is called when Exim is running as a server, after having received
1254 the STARTTLS command. It must respond to that command, and then negotiate
1258 require_ciphers list of allowed ciphers or NULL
1260 Returns: OK on success
1261 DEFER for errors before the start of the negotiation
1262 FAIL for errors during the negotation; the server can't
1267 tls_server_start(const uschar
*require_ciphers
)
1271 exim_gnutls_state_st
*state
= NULL
;
1273 /* Check for previous activation */
1274 /* nb: this will not be TLS callout safe, needs reworking as part of that. */
1276 if (tls_active
>= 0)
1278 tls_error(US
"STARTTLS received after TLS started", "", NULL
);
1279 smtp_printf("554 Already in TLS\r\n");
1283 /* Initialize the library. If it fails, it will already have logged the error
1284 and sent an SMTP response. */
1286 DEBUG(D_tls
) debug_printf("initialising GnuTLS as a server\n");
1288 rc
= tls_init(NULL
, tls_certificate
, tls_privatekey
,
1289 NULL
, tls_verify_certificates
, tls_crl
,
1290 require_ciphers
, &state
);
1291 if (rc
!= OK
) return rc
;
1293 /* If this is a host for which certificate verification is mandatory or
1294 optional, set up appropriately. */
1296 if (verify_check_host(&tls_verify_hosts
) == OK
)
1298 DEBUG(D_tls
) debug_printf("TLS: a client certificate will be required.\n");
1299 state
->verify_requirement
= VERIFY_REQUIRED
;
1300 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUIRE
);
1302 else if (verify_check_host(&tls_try_verify_hosts
) == OK
)
1304 DEBUG(D_tls
) debug_printf("TLS: a client certificate will be requested but not required.\n");
1305 state
->verify_requirement
= VERIFY_OPTIONAL
;
1306 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUEST
);
1310 DEBUG(D_tls
) debug_printf("TLS: a client certificate will not be requested.\n");
1311 state
->verify_requirement
= VERIFY_NONE
;
1312 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_IGNORE
);
1315 /* Register SNI handling; always, even if not in tls_certificate, so that the
1316 expansion variable $tls_sni is always available. */
1318 gnutls_handshake_set_post_client_hello_function(state
->session
,
1319 exim_sni_handling_cb
);
1321 /* Set context and tell client to go ahead, except in the case of TLS startup
1322 on connection, where outputting anything now upsets the clients and tends to
1323 make them disconnect. We need to have an explicit fflush() here, to force out
1324 the response. Other smtp_printf() calls do not need it, because in non-TLS
1325 mode, the fflush() happens when smtp_getc() is called. */
1327 if (!tls_on_connect
)
1329 smtp_printf("220 TLS go ahead\r\n");
1333 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1334 that the GnuTLS library doesn't. */
1336 gnutls_transport_set_ptr2(state
->session
,
1337 (gnutls_transport_ptr
)fileno(smtp_in
),
1338 (gnutls_transport_ptr
)fileno(smtp_out
));
1339 state
->fd_in
= fileno(smtp_in
);
1340 state
->fd_out
= fileno(smtp_out
);
1342 sigalrm_seen
= FALSE
;
1343 if (smtp_receive_timeout
> 0) alarm(smtp_receive_timeout
);
1346 rc
= gnutls_handshake(state
->session
);
1347 } while ((rc
== GNUTLS_E_AGAIN
) || (rc
== GNUTLS_E_INTERRUPTED
));
1350 if (rc
!= GNUTLS_E_SUCCESS
)
1352 tls_error(US
"gnutls_handshake",
1353 sigalrm_seen
? "timed out" : gnutls_strerror(rc
), NULL
);
1354 /* It seems that, except in the case of a timeout, we have to close the
1355 connection right here; otherwise if the other end is running OpenSSL it hangs
1356 until the server times out. */
1360 (void)fclose(smtp_out
);
1361 (void)fclose(smtp_in
);
1367 DEBUG(D_tls
) debug_printf("gnutls_handshake was successful\n");
1369 /* Verify after the fact */
1371 if (state
->verify_requirement
!= VERIFY_NONE
)
1373 if (!verify_certificate(state
, &error
))
1375 if (state
->verify_requirement
== VERIFY_OPTIONAL
)
1378 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1383 tls_error(US
"certificate verification failed", error
, NULL
);
1389 /* Figure out peer DN, and if authenticated, etc. */
1391 rc
= peer_status(state
);
1392 if (rc
!= OK
) return rc
;
1394 /* Sets various Exim expansion variables; always safe within server */
1396 extract_exim_vars_from_tls_state(state
);
1398 /* TLS has been set up. Adjust the input functions to read via TLS,
1399 and initialize appropriately. */
1401 state
->xfer_buffer
= store_malloc(ssl_xfer_buffer_size
);
1403 receive_getc
= tls_getc
;
1404 receive_ungetc
= tls_ungetc
;
1405 receive_feof
= tls_feof
;
1406 receive_ferror
= tls_ferror
;
1407 receive_smtp_buffered
= tls_smtp_buffered
;
1415 /*************************************************
1416 * Start a TLS session in a client *
1417 *************************************************/
1419 /* Called from the smtp transport after STARTTLS has been accepted.
1422 fd the fd of the connection
1423 host connected host (for messages)
1424 addr the first address (not used)
1425 dhparam DH parameter file (ignored, we're a client)
1426 certificate certificate file
1427 privatekey private key file
1428 sni TLS SNI to send to remote host
1429 verify_certs file for certificate verify
1430 verify_crl CRL for verify
1431 require_ciphers list of allowed ciphers or NULL
1432 timeout startup timeout
1434 Returns: OK/DEFER/FAIL (because using common functions),
1435 but for a client, DEFER and FAIL have the same meaning
1439 tls_client_start(int fd
, host_item
*host
,
1440 address_item
*addr ARG_UNUSED
, uschar
*dhparam ARG_UNUSED
,
1441 uschar
*certificate
, uschar
*privatekey
, uschar
*sni
,
1442 uschar
*verify_certs
, uschar
*verify_crl
,
1443 uschar
*require_ciphers
, int timeout
)
1447 exim_gnutls_state_st
*state
= NULL
;
1449 DEBUG(D_tls
) debug_printf("initialising GnuTLS as a client on fd %d\n", fd
);
1451 rc
= tls_init(host
, certificate
, privatekey
,
1452 sni
, verify_certs
, verify_crl
, require_ciphers
, &state
);
1453 if (rc
!= OK
) return rc
;
1455 gnutls_dh_set_prime_bits(state
->session
, EXIM_CLIENT_DH_MIN_BITS
);
1457 if (verify_certs
== NULL
)
1459 DEBUG(D_tls
) debug_printf("TLS: server certificate verification not required\n");
1460 state
->verify_requirement
= VERIFY_NONE
;
1461 /* we still ask for it, to log it, etc */
1462 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUEST
);
1466 DEBUG(D_tls
) debug_printf("TLS: server certificate verification required\n");
1467 state
->verify_requirement
= VERIFY_REQUIRED
;
1468 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUIRE
);
1471 gnutls_transport_set_ptr(state
->session
, (gnutls_transport_ptr
)fd
);
1475 /* There doesn't seem to be a built-in timeout on connection. */
1477 sigalrm_seen
= FALSE
;
1481 rc
= gnutls_handshake(state
->session
);
1482 } while ((rc
== GNUTLS_E_AGAIN
) || (rc
== GNUTLS_E_INTERRUPTED
));
1485 if (rc
!= GNUTLS_E_SUCCESS
)
1486 return tls_error(US
"gnutls_handshake",
1487 sigalrm_seen
? "timed out" : gnutls_strerror(rc
), state
->host
);
1489 DEBUG(D_tls
) debug_printf("gnutls_handshake was successful\n");
1493 if (state
->verify_requirement
!= VERIFY_NONE
&&
1494 !verify_certificate(state
, &error
))
1495 return tls_error(US
"certificate verification failed", error
, state
->host
);
1497 /* Figure out peer DN, and if authenticated, etc. */
1499 rc
= peer_status(state
);
1500 if (rc
!= OK
) return rc
;
1502 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
1504 extract_exim_vars_from_tls_state(state
);
1512 /*************************************************
1513 * Close down a TLS session *
1514 *************************************************/
1516 /* This is also called from within a delivery subprocess forked from the
1517 daemon, to shut down the TLS library, without actually doing a shutdown (which
1518 would tamper with the TLS session in the parent process).
1520 Arguments: TRUE if gnutls_bye is to be called
1525 tls_close(BOOL shutdown
)
1527 exim_gnutls_state_st
*state
= current_global_tls_state
;
1529 if (tls_active
< 0) return; /* TLS was not active */
1533 DEBUG(D_tls
) debug_printf("tls_close(): shutting down TLS\n");
1534 gnutls_bye(state
->session
, GNUTLS_SHUT_WR
);
1537 gnutls_deinit(state
->session
);
1539 memcpy(state
, &exim_gnutls_state_init
, sizeof(exim_gnutls_state_init
));
1541 if ((state_server
.session
== NULL
) && (state_client
.session
== NULL
))
1543 gnutls_global_deinit();
1544 exim_gnutls_base_init_done
= FALSE
;
1553 /*************************************************
1554 * TLS version of getc *
1555 *************************************************/
1557 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
1558 it refills the buffer via the GnuTLS reading function.
1560 This feeds DKIM and should be used for all message-body reads.
1563 Returns: the next character or EOF
1569 exim_gnutls_state_st
*state
= current_global_tls_state
;
1570 if (state
->xfer_buffer_lwm
>= state
->xfer_buffer_hwm
)
1574 DEBUG(D_tls
) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1575 state
->session
, state
->xfer_buffer
, ssl_xfer_buffer_size
);
1577 if (smtp_receive_timeout
> 0) alarm(smtp_receive_timeout
);
1578 inbytes
= gnutls_record_recv(state
->session
, state
->xfer_buffer
,
1579 ssl_xfer_buffer_size
);
1582 /* A zero-byte return appears to mean that the TLS session has been
1583 closed down, not that the socket itself has been closed down. Revert to
1584 non-TLS handling. */
1588 DEBUG(D_tls
) debug_printf("Got TLS_EOF\n");
1590 receive_getc
= smtp_getc
;
1591 receive_ungetc
= smtp_ungetc
;
1592 receive_feof
= smtp_feof
;
1593 receive_ferror
= smtp_ferror
;
1594 receive_smtp_buffered
= smtp_buffered
;
1596 gnutls_deinit(state
->session
);
1597 state
->session
= NULL
;
1600 tls_certificate_verified
= FALSE
;
1601 tls_channelbinding_b64
= NULL
;
1608 /* Handle genuine errors */
1610 else if (inbytes
< 0)
1612 record_io_error(state
, (int) inbytes
, US
"recv", NULL
);
1613 state
->xfer_error
= 1;
1616 #ifndef DISABLE_DKIM
1617 dkim_exim_verify_feed(state
->xfer_buffer
, inbytes
);
1619 state
->xfer_buffer_hwm
= (int) inbytes
;
1620 state
->xfer_buffer_lwm
= 0;
1623 /* Something in the buffer; return next uschar */
1625 return state
->xfer_buffer
[state
->xfer_buffer_lwm
++];
1631 /*************************************************
1632 * Read bytes from TLS channel *
1633 *************************************************/
1635 /* This does not feed DKIM, so if the caller uses this for reading message body,
1636 then the caller must feed DKIM.
1641 Returns: the number of bytes read
1642 -1 after a failed read
1646 tls_read(uschar
*buff
, size_t len
)
1648 exim_gnutls_state_st
*state
= current_global_tls_state
;
1654 if (state
->xfer_buffer_lwm
< state
->xfer_buffer_hwm
)
1656 debug_printf("*** PROBABLY A BUG *** " \
1657 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1658 state
->xfer_buffer_hwm
- state
->xfer_buffer_lwm
);
1661 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT
")\n",
1662 state
->session
, buff
, len
);
1664 inbytes
= gnutls_record_recv(state
->session
, buff
, len
);
1665 if (inbytes
> 0) return inbytes
;
1668 DEBUG(D_tls
) debug_printf("Got TLS_EOF\n");
1670 else record_io_error(state
, (int)inbytes
, US
"recv", NULL
);
1678 /*************************************************
1679 * Write bytes down TLS channel *
1680 *************************************************/
1687 Returns: the number of bytes after a successful write,
1688 -1 after a failed write
1692 tls_write(const uschar
*buff
, size_t len
)
1696 exim_gnutls_state_st
*state
= current_global_tls_state
;
1698 DEBUG(D_tls
) debug_printf("tls_do_write(%p, " SIZE_T_FMT
")\n", buff
, left
);
1701 DEBUG(D_tls
) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT
")\n",
1703 outbytes
= gnutls_record_send(state
->session
, buff
, left
);
1705 DEBUG(D_tls
) debug_printf("outbytes=" SSIZE_T_FMT
"\n", outbytes
);
1708 record_io_error(state
, outbytes
, US
"send", NULL
);
1713 record_io_error(state
, 0, US
"send", US
"TLS channel closed on write");
1724 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT
") than INT_MAX\n",
1735 /*************************************************
1736 * Random number generation *
1737 *************************************************/
1739 /* Pseudo-random number generation. The result is not expected to be
1740 cryptographically strong but not so weak that someone will shoot themselves
1741 in the foot using it as a nonce in input in some email header scheme or
1742 whatever weirdness they'll twist this into. The result should handle fork()
1743 and avoid repeating sequences. OpenSSL handles that for us.
1747 Returns a random number in range [0, max-1]
1750 #ifdef HAVE_GNUTLS_RND
1752 vaguely_random_number(int max
)
1757 uschar smallbuf
[sizeof(r
)];
1762 needed_len
= sizeof(r
);
1763 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
1764 * asked for a number less than 10. */
1765 for (r
= max
, i
= 0; r
; ++i
)
1771 i
= gnutls_rnd(GNUTLS_RND_NONCE
, smallbuf
, needed_len
);
1774 DEBUG(D_all
) debug_printf("gnutls_rnd() failed, using fallback.\n");
1775 return vaguely_random_number_fallback(max
);
1778 for (p
= smallbuf
; needed_len
; --needed_len
, ++p
)
1784 /* We don't particularly care about weighted results; if someone wants
1785 * smooth distribution and cares enough then they should submit a patch then. */
1788 #else /* HAVE_GNUTLS_RND */
1790 vaguely_random_number(int max
)
1792 return vaguely_random_number_fallback(max
);
1794 #endif /* HAVE_GNUTLS_RND */
1799 /*************************************************
1800 * Report the library versions. *
1801 *************************************************/
1803 /* See a description in tls-openssl.c for an explanation of why this exists.
1805 Arguments: a FILE* to print the results to
1810 tls_version_report(FILE *f
)
1812 fprintf(f
, "Library version: GnuTLS: Compile: %s\n"
1815 gnutls_check_version(NULL
));
1818 /* End of tls-gnu.c */