1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2012 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Copyright (c) Phil Pennock 2012 */
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
46 gnutls_global_set_audit_log_function()
49 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
52 /* Local static variables for GnuTLS */
54 /* Values for verify_requirement */
56 enum peer_verify_requirement
{ VERIFY_NONE
, VERIFY_OPTIONAL
, VERIFY_REQUIRED
};
58 /* This holds most state for server or client; with this, we can set up an
59 outbound TLS-enabled connection in an ACL callout, while not stomping all
60 over the TLS variables available for expansion.
62 Some of these correspond to variables in globals.c; those variables will
63 be set to point to content in one of these instances, as appropriate for
64 the stage of the process lifetime.
66 Not handled here: globals tls_active, tls_bits, tls_cipher, tls_peerdn,
67 tls_certificate_verified, tls_channelbinding_b64, tls_sni.
70 typedef struct exim_gnutls_state
{
71 gnutls_session_t session
;
72 gnutls_certificate_credentials_t x509_cred
;
73 gnutls_priority_t priority_cache
;
74 enum peer_verify_requirement verify_requirement
;
77 BOOL peer_cert_verified
;
78 BOOL trigger_sni_changes
;
80 const struct host_item
*host
;
85 const uschar
*tls_certificate
;
86 const uschar
*tls_privatekey
;
87 const uschar
*tls_sni
; /* client send only, not received */
88 const uschar
*tls_verify_certificates
;
89 const uschar
*tls_crl
;
90 const uschar
*tls_require_ciphers
;
91 uschar
*exp_tls_certificate
;
92 uschar
*exp_tls_privatekey
;
94 uschar
*exp_tls_verify_certificates
;
96 uschar
*exp_tls_require_ciphers
;
103 } exim_gnutls_state_st
;
105 static const exim_gnutls_state_st exim_gnutls_state_init
= {
106 NULL
, NULL
, NULL
, VERIFY_NONE
, -1, -1, FALSE
, FALSE
, FALSE
,
107 NULL
, NULL
, NULL
, NULL
,
108 NULL
, NULL
, NULL
, NULL
, NULL
, NULL
,
109 NULL
, NULL
, NULL
, NULL
, NULL
, NULL
,
113 /* Not only do we have our own APIs which don't pass around state, assuming
114 it's held in globals, GnuTLS doesn't appear to let us register callback data
115 for callbacks, or as part of the session, so we have to keep a "this is the
116 context we're currently dealing with" pointer and rely upon being
117 single-threaded to keep from processing data on an inbound TLS connection while
118 talking to another TLS connection for an outbound check. This does mean that
119 there's no way for heart-beats to be responded to, for the duration of the
120 second connection. */
122 static exim_gnutls_state_st state_server
, state_client
;
123 static exim_gnutls_state_st
*current_global_tls_state
;
125 /* dh_params are initialised once within the lifetime of a process using TLS;
126 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
127 don't want to repeat this. */
129 static gnutls_dh_params_t dh_server_params
= NULL
;
131 /* No idea how this value was chosen; preserving it. Default is 3600. */
133 static const int ssl_session_timeout
= 200;
135 static const char * const exim_default_gnutls_priority
= "NORMAL";
137 /* Guard library core initialisation */
139 static BOOL exim_gnutls_base_init_done
= FALSE
;
142 /* ------------------------------------------------------------------------ */
145 #define MAX_HOST_LEN 255
147 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
148 the library logging; a value less than 0 disables the calls to set up logging
150 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
151 #define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
154 #ifndef EXIM_CLIENT_DH_MIN_BITS
155 #define EXIM_CLIENT_DH_MIN_BITS 1024
158 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
159 can ask for a bit-strength. Without that, we stick to the constant we had
161 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
162 #define EXIM_SERVER_DH_BITS_PRE2_12 1024
165 #define exim_gnutls_err_check(Label) do { \
166 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
168 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
170 #if GNUTLS_VERSION_NUMBER >= 0x020c00
171 #define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
172 #define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
173 #define HAVE_GNUTLS_RND
179 /* ------------------------------------------------------------------------ */
180 /* Callback declarations */
182 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
183 static void exim_gnutls_logger_cb(int level
, const char *message
);
186 static int exim_sni_handling_cb(gnutls_session_t session
);
191 /* ------------------------------------------------------------------------ */
192 /* Static functions */
194 /*************************************************
196 *************************************************/
198 /* Called from lots of places when errors occur before actually starting to do
199 the TLS handshake, that is, while the session is still in clear. Always returns
200 DEFER for a server and FAIL for a client so that most calls can use "return
201 tls_error(...)" to do this processing and then give an appropriate return. A
202 single function is used for both server and client, because it is called from
203 some shared functions.
206 prefix text to include in the logged error
207 msg additional error string (may be NULL)
208 usually obtained from gnutls_strerror()
209 host NULL if setting up a server;
210 the connected host if setting up a client
212 Returns: OK/DEFER/FAIL
216 tls_error(const uschar
*prefix
, const char *msg
, const host_item
*host
)
220 log_write(0, LOG_MAIN
, "TLS error on connection to %s [%s] (%s)%s%s",
221 host
->name
, host
->address
, prefix
, msg
? ": " : "", msg
? msg
: "");
226 uschar
*conn_info
= smtp_get_connection_info();
227 if (Ustrncmp(conn_info
, US
"SMTP ", 5) == 0)
229 log_write(0, LOG_MAIN
, "TLS error on %s (%s)%s%s",
230 conn_info
, prefix
, msg
? ": " : "", msg
? msg
: "");
238 /*************************************************
239 * Deal with logging errors during I/O *
240 *************************************************/
242 /* We have to get the identity of the peer from saved data.
245 state the current GnuTLS exim state container
246 rc the GnuTLS error code, or 0 if it's a local error
247 when text identifying read or write
248 text local error text when ec is 0
254 record_io_error(exim_gnutls_state_st
*state
, int rc
, uschar
*when
, uschar
*text
)
258 if (rc
== GNUTLS_E_FATAL_ALERT_RECEIVED
)
259 msg
= CS
string_sprintf("%s: %s", US
gnutls_strerror(rc
),
260 US
gnutls_alert_get_name(gnutls_alert_get(state
->session
)));
262 msg
= gnutls_strerror(rc
);
264 tls_error(when
, msg
, state
->host
);
270 /*************************************************
271 * Set various Exim expansion vars *
272 *************************************************/
274 /* We set various Exim global variables from the state, once a session has
275 been established. With TLS callouts, may need to change this to stack
276 variables, or just re-call it with the server state after client callout
279 Make sure anything set here is inset in tls_getc().
283 tls_bits strength indicator
284 tls_certificate_verified bool indicator
285 tls_channelbinding_b64 for some SASL mechanisms
288 tls_sni a (UTF-8) string
290 current_global_tls_state for API limitations
293 state the relevant exim_gnutls_state_st *
297 extract_exim_vars_from_tls_state(exim_gnutls_state_st
*state
)
299 gnutls_cipher_algorithm_t cipher
;
300 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
303 gnutls_datum_t channel
;
306 current_global_tls_state
= state
;
308 tls_active
= state
->fd_out
;
310 cipher
= gnutls_cipher_get(state
->session
);
311 /* returns size in "bytes" */
312 tls_bits
= gnutls_cipher_get_key_size(cipher
) * 8;
314 tls_cipher
= state
->ciphersuite
;
316 DEBUG(D_tls
) debug_printf("cipher: %s\n", tls_cipher
);
318 tls_certificate_verified
= state
->peer_cert_verified
;
320 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
321 only available for use for authenticators while this TLS session is running. */
323 tls_channelbinding_b64
= NULL
;
324 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
327 rc
= gnutls_session_channel_binding(state
->session
, GNUTLS_CB_TLS_UNIQUE
, &channel
);
329 DEBUG(D_tls
) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc
));
331 old_pool
= store_pool
;
332 store_pool
= POOL_PERM
;
333 tls_channelbinding_b64
= auth_b64encode(channel
.data
, (int)channel
.size
);
334 store_pool
= old_pool
;
335 DEBUG(D_tls
) debug_printf("Have channel bindings cached for possible auth usage.\n");
339 tls_peerdn
= state
->peerdn
;
341 tls_sni
= state
->received_sni
;
347 /*************************************************
348 * Setup up DH parameters *
349 *************************************************/
351 /* Generating the D-H parameters may take a long time. They only need to
352 be re-generated every so often, depending on security policy. What we do is to
353 keep these parameters in a file in the spool directory. If the file does not
354 exist, we generate them. This means that it is easy to cause a regeneration.
356 The new file is written as a temporary file and renamed, so that an incomplete
357 file is never present. If two processes both compute some new parameters, you
358 waste a bit of effort, but it doesn't seem worth messing around with locking to
362 host NULL for server, server for client (for error handling)
364 Returns: OK/DEFER/FAIL
371 unsigned int dh_bits
;
373 uschar filename
[PATH_MAX
];
375 host_item
*host
= NULL
; /* dummy for macros */
377 DEBUG(D_tls
) debug_printf("Initialising GnuTLS server params.\n");
379 rc
= gnutls_dh_params_init(&dh_server_params
);
380 exim_gnutls_err_check(US
"gnutls_dh_params_init");
382 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
383 /* If you change this constant, also change dh_param_fn_ext so that we can use a
384 different filename and ensure we have sufficient bits. */
385 dh_bits
= gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH
, GNUTLS_SEC_PARAM_NORMAL
);
387 return tls_error(US
"gnutls_sec_param_to_pk_bits() failed", NULL
, NULL
);
389 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
392 dh_bits
= EXIM_SERVER_DH_BITS_PRE2_12
;
394 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
398 if (!string_format(filename
, sizeof(filename
),
399 "%s/gnutls-params-%d", spool_directory
, dh_bits
))
400 return tls_error(US
"overlong filename", NULL
, NULL
);
402 /* Open the cache file for reading and if successful, read it and set up the
405 fd
= Uopen(filename
, O_RDONLY
, 0);
412 if (fstat(fd
, &statbuf
) < 0) /* EIO */
416 return tls_error(US
"TLS cache stat failed", strerror(saved_errno
), NULL
);
418 if (!S_ISREG(statbuf
.st_mode
))
421 return tls_error(US
"TLS cache not a file", NULL
, NULL
);
423 fp
= fdopen(fd
, "rb");
428 return tls_error(US
"fdopen(TLS cache stat fd) failed",
429 strerror(saved_errno
), NULL
);
432 m
.size
= statbuf
.st_size
;
433 m
.data
= malloc(m
.size
);
437 return tls_error(US
"malloc failed", strerror(errno
), NULL
);
439 sz
= fread(m
.data
, m
.size
, 1, fp
);
445 return tls_error(US
"fread failed", strerror(saved_errno
), NULL
);
449 rc
= gnutls_dh_params_import_pkcs3(dh_server_params
, &m
, GNUTLS_X509_FMT_PEM
);
451 exim_gnutls_err_check(US
"gnutls_dh_params_import_pkcs3");
452 DEBUG(D_tls
) debug_printf("read D-H parameters from file \"%s\"\n", filename
);
455 /* If the file does not exist, fall through to compute new data and cache it.
456 If there was any other opening error, it is serious. */
458 else if (errno
== ENOENT
)
462 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename
);
465 return tls_error(string_open_failed(errno
, "\"%s\" for reading", filename
),
468 /* If ret < 0, either the cache file does not exist, or the data it contains
469 is not useful. One particular case of this is when upgrading from an older
470 release of Exim in which the data was stored in a different format. We don't
471 try to be clever and support both formats; we just regenerate new data in this
478 if ((PATH_MAX
- Ustrlen(filename
)) < 10)
479 return tls_error(US
"Filename too long to generate replacement",
482 temp_fn
= string_copy(US
"%s.XXXXXXX");
483 fd
= mkstemp(CS temp_fn
); /* modifies temp_fn */
485 return tls_error(US
"Unable to open temp file", strerror(errno
), NULL
);
486 (void)fchown(fd
, exim_uid
, exim_gid
); /* Probably not necessary */
488 DEBUG(D_tls
) debug_printf("generating %d bits Diffie-Hellman key ...\n", dh_bits
);
489 rc
= gnutls_dh_params_generate2(dh_server_params
, dh_bits
);
490 exim_gnutls_err_check(US
"gnutls_dh_params_generate2");
492 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
493 and I confirmed that a NULL call to get the size first is how the GnuTLS
494 sample apps handle this. */
498 rc
= gnutls_dh_params_export_pkcs3(dh_server_params
, GNUTLS_X509_FMT_PEM
,
500 if (rc
!= GNUTLS_E_SHORT_MEMORY_BUFFER
)
501 exim_gnutls_err_check(US
"gnutls_dh_params_export_pkcs3(NULL) sizing");
503 m
.data
= malloc(m
.size
);
505 return tls_error(US
"memory allocation failed", strerror(errno
), NULL
);
506 rc
= gnutls_dh_params_export_pkcs3(dh_server_params
, GNUTLS_X509_FMT_PEM
,
508 if (rc
!= GNUTLS_E_SUCCESS
)
511 exim_gnutls_err_check(US
"gnutls_dh_params_export_pkcs3() real");
514 sz
= write_to_fd_buf(fd
, m
.data
, (size_t) m
.size
);
518 return tls_error(US
"TLS cache write D-H params failed",
519 strerror(errno
), NULL
);
522 sz
= write_to_fd_buf(fd
, US
"\n", 1);
524 return tls_error(US
"TLS cache write D-H params final newline failed",
525 strerror(errno
), NULL
);
529 return tls_error(US
"TLS cache write close() failed",
530 strerror(errno
), NULL
);
532 if (Urename(temp_fn
, filename
) < 0)
533 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
534 temp_fn
, filename
), strerror(errno
), NULL
);
536 DEBUG(D_tls
) debug_printf("wrote D-H parameters to file \"%s\"\n", filename
);
539 DEBUG(D_tls
) debug_printf("initialized server D-H parameters\n");
546 /*************************************************
547 * Variables re-expanded post-SNI *
548 *************************************************/
550 /* Called from both server and client code, via tls_init(), and also from
551 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
553 We can tell the two apart by state->received_sni being non-NULL in callback.
555 The callback should not call us unless state->trigger_sni_changes is true,
556 which we are responsible for setting on the first pass through.
559 state exim_gnutls_state_st *
561 Returns: OK/DEFER/FAIL
565 tls_expand_session_files(exim_gnutls_state_st
*state
)
569 const host_item
*host
= state
->host
; /* macro should be reconsidered? */
570 uschar
*saved_tls_certificate
= NULL
;
571 uschar
*saved_tls_privatekey
= NULL
;
572 uschar
*saved_tls_verify_certificates
= NULL
;
573 uschar
*saved_tls_crl
= NULL
;
576 /* We check for tls_sni *before* expansion. */
579 if (!state
->received_sni
)
581 if (Ustrstr(state
->tls_certificate
, US
"tls_sni"))
583 DEBUG(D_tls
) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
584 state
->trigger_sni_changes
= TRUE
;
589 /* useful for debugging */
590 saved_tls_certificate
= state
->exp_tls_certificate
;
591 saved_tls_privatekey
= state
->exp_tls_privatekey
;
592 saved_tls_verify_certificates
= state
->exp_tls_verify_certificates
;
593 saved_tls_crl
= state
->exp_tls_crl
;
597 rc
= gnutls_certificate_allocate_credentials(&state
->x509_cred
);
598 exim_gnutls_err_check(US
"gnutls_certificate_allocate_credentials");
600 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
601 state members, assuming consistent naming; and expand_check() returns
602 false if expansion failed, unless expansion was forced to fail. */
604 /* check if we at least have a certificate, before doing expensive
607 if (!expand_check_tlsvar(tls_certificate
))
610 /* certificate is mandatory in server, optional in client */
612 if ((state
->exp_tls_certificate
== NULL
) ||
613 (*state
->exp_tls_certificate
== '\0'))
615 if (state
->host
== NULL
)
616 return tls_error(US
"no TLS server certificate is specified", NULL
, NULL
);
618 DEBUG(D_tls
) debug_printf("TLS: no client certificate specified; okay\n");
621 if (state
->tls_privatekey
&& !expand_check_tlsvar(tls_privatekey
))
624 /* tls_privatekey is optional, defaulting to same file as certificate */
626 if (state
->tls_privatekey
== NULL
|| *state
->tls_privatekey
== '\0')
628 state
->tls_privatekey
= state
->tls_certificate
;
629 state
->exp_tls_privatekey
= state
->exp_tls_certificate
;
633 if (state
->exp_tls_certificate
&& *state
->exp_tls_certificate
)
635 DEBUG(D_tls
) debug_printf("certificate file = %s\nkey file = %s\n",
636 state
->exp_tls_certificate
, state
->exp_tls_privatekey
);
638 if (state
->received_sni
)
640 if ((Ustrcmp(state
->exp_tls_certificate
, saved_tls_certificate
) == 0) &&
641 (Ustrcmp(state
->exp_tls_privatekey
, saved_tls_privatekey
) == 0))
643 DEBUG(D_tls
) debug_printf("TLS SNI: cert and key unchanged\n");
647 DEBUG(D_tls
) debug_printf("TLS SNI: have a changed cert/key pair.\n");
651 rc
= gnutls_certificate_set_x509_key_file(state
->x509_cred
,
652 CS state
->exp_tls_certificate
, CS state
->exp_tls_privatekey
,
653 GNUTLS_X509_FMT_PEM
);
654 exim_gnutls_err_check(
655 string_sprintf("cert/key setup: cert=%s key=%s",
656 state
->exp_tls_certificate
, state
->exp_tls_privatekey
));
657 DEBUG(D_tls
) debug_printf("TLS: cert/key registered\n");
658 } /* tls_certificate */
660 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
661 provided. Experiment shows that, if the certificate file is empty, an unhelpful
662 error message is provided. However, if we just refrain from setting anything up
663 in that case, certificate verification fails, which seems to be the correct
666 if (state
->tls_verify_certificates
&& *state
->tls_verify_certificates
)
668 if (!expand_check_tlsvar(tls_verify_certificates
))
670 if (state
->tls_crl
&& *state
->tls_crl
)
671 if (!expand_check_tlsvar(tls_crl
))
674 if (!(state
->exp_tls_verify_certificates
&&
675 *state
->exp_tls_verify_certificates
))
678 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
679 /* With no tls_verify_certificates, we ignore tls_crl too */
686 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
690 if (Ustat(state
->exp_tls_verify_certificates
, &statbuf
) < 0)
692 log_write(0, LOG_MAIN
|LOG_PANIC
, "could not stat %s "
693 "(tls_verify_certificates): %s", state
->exp_tls_verify_certificates
,
698 if (!S_ISREG(statbuf
.st_mode
))
701 debug_printf("verify certificates path is not a file: \"%s\"\n%s\n",
702 state
->exp_tls_verify_certificates
,
703 S_ISDIR(statbuf
.st_mode
)
704 ? " it's a directory, that's OpenSSL, this is GnuTLS"
705 : " (not a directory either)");
706 log_write(0, LOG_MAIN
|LOG_PANIC
,
707 "tls_verify_certificates \"%s\" is not a file",
708 state
->exp_tls_verify_certificates
);
712 DEBUG(D_tls
) debug_printf("verify certificates = %s size=" OFF_T_FMT
"\n",
713 state
->exp_tls_verify_certificates
, statbuf
.st_size
);
715 if (statbuf
.st_size
== 0)
718 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
722 cert_count
= gnutls_certificate_set_x509_trust_file(state
->x509_cred
,
723 CS state
->exp_tls_verify_certificates
, GNUTLS_X509_FMT_PEM
);
727 exim_gnutls_err_check(US
"gnutls_certificate_set_x509_trust_file");
729 DEBUG(D_tls
) debug_printf("Added %d certificate authorities.\n", cert_count
);
731 if (state
->tls_crl
&& *state
->tls_crl
&&
732 state
->exp_tls_crl
&& *state
->exp_tls_crl
)
734 DEBUG(D_tls
) debug_printf("loading CRL file = %s\n", state
->exp_tls_crl
);
735 cert_count
= gnutls_certificate_set_x509_crl_file(state
->x509_cred
,
736 CS state
->exp_tls_crl
, GNUTLS_X509_FMT_PEM
);
740 exim_gnutls_err_check(US
"gnutls_certificate_set_x509_crl_file");
742 DEBUG(D_tls
) debug_printf("Processed %d CRLs.\n", cert_count
);
751 /*************************************************
752 * Set X.509 state variables *
753 *************************************************/
755 /* In GnuTLS, the registered cert/key are not replaced by a later
756 set of a cert/key, so for SNI support we need a whole new x509_cred
757 structure. Which means various other non-re-expanded pieces of state
758 need to be re-set in the new struct, so the setting logic is pulled
762 state exim_gnutls_state_st *
764 Returns: OK/DEFER/FAIL
768 tls_set_remaining_x509(exim_gnutls_state_st
*state
)
771 const host_item
*host
= state
->host
; /* macro should be reconsidered? */
773 /* Create D-H parameters, or read them from the cache file. This function does
774 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
775 client-side params. */
779 if (!dh_server_params
)
781 rc
= init_server_dh();
782 if (rc
!= OK
) return rc
;
784 gnutls_certificate_set_dh_params(state
->x509_cred
, dh_server_params
);
787 /* Link the credentials to the session. */
789 rc
= gnutls_credentials_set(state
->session
, GNUTLS_CRD_CERTIFICATE
, state
->x509_cred
);
790 exim_gnutls_err_check(US
"gnutls_credentials_set");
795 /*************************************************
796 * Initialize for GnuTLS *
797 *************************************************/
799 /* Called from both server and client code. In the case of a server, errors
800 before actual TLS negotiation return DEFER.
803 host connected host, if client; NULL if server
804 certificate certificate file
805 privatekey private key file
806 sni TLS SNI to send, sometimes when client; else NULL
809 require_ciphers tls_require_ciphers setting
811 Returns: OK/DEFER/FAIL
816 const host_item
*host
,
817 const uschar
*certificate
,
818 const uschar
*privatekey
,
822 const uschar
*require_ciphers
,
823 exim_gnutls_state_st
**caller_state
)
825 exim_gnutls_state_st
*state
;
830 BOOL want_default_priorities
;
832 if (!exim_gnutls_base_init_done
)
834 DEBUG(D_tls
) debug_printf("GnuTLS global init required.\n");
836 rc
= gnutls_global_init();
837 exim_gnutls_err_check(US
"gnutls_global_init");
839 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
842 gnutls_global_set_log_function(exim_gnutls_logger_cb
);
843 /* arbitrarily chosen level; bump upto 9 for more */
844 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL
);
848 exim_gnutls_base_init_done
= TRUE
;
853 state
= &state_client
;
854 memcpy(state
, &exim_gnutls_state_init
, sizeof(exim_gnutls_state_init
));
855 DEBUG(D_tls
) debug_printf("initialising GnuTLS client session\n");
856 rc
= gnutls_init(&state
->session
, GNUTLS_CLIENT
);
860 state
= &state_server
;
861 memcpy(state
, &exim_gnutls_state_init
, sizeof(exim_gnutls_state_init
));
862 DEBUG(D_tls
) debug_printf("initialising GnuTLS server session\n");
863 rc
= gnutls_init(&state
->session
, GNUTLS_SERVER
);
865 exim_gnutls_err_check(US
"gnutls_init");
869 state
->tls_certificate
= certificate
;
870 state
->tls_privatekey
= privatekey
;
871 state
->tls_sni
= sni
;
872 state
->tls_verify_certificates
= cas
;
873 state
->tls_crl
= crl
;
875 /* This handles the variables that might get re-expanded after TLS SNI;
876 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
879 debug_printf("Expanding various TLS configuration options for session credentials.\n");
880 rc
= tls_expand_session_files(state
);
881 if (rc
!= OK
) return rc
;
883 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
884 requires a new structure afterwards. */
886 rc
= tls_set_remaining_x509(state
);
887 if (rc
!= OK
) return rc
;
889 /* set SNI in client, only */
892 if (!expand_check_tlsvar(tls_sni
))
894 if (state
->exp_tls_sni
&& *state
->exp_tls_sni
)
897 debug_printf("Setting TLS client SNI to \"%s\"\n", state
->exp_tls_sni
);
898 sz
= Ustrlen(state
->exp_tls_sni
);
899 rc
= gnutls_server_name_set(state
->session
,
900 GNUTLS_NAME_DNS
, state
->exp_tls_sni
, sz
);
901 exim_gnutls_err_check(US
"gnutls_server_name_set");
904 else if (state
->tls_sni
)
905 DEBUG(D_tls
) debug_printf("*** PROBABLY A BUG *** " \
906 "have an SNI set for a client [%s]\n", state
->tls_sni
);
908 /* This is the priority string support,
909 http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html
910 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
911 This was backwards incompatible, but means Exim no longer needs to track
912 all algorithms and provide string forms for them. */
914 want_default_priorities
= TRUE
;
916 if (state
->tls_require_ciphers
&& *state
->tls_require_ciphers
)
918 if (!expand_check_tlsvar(tls_require_ciphers
))
920 if (state
->exp_tls_require_ciphers
&& *state
->exp_tls_require_ciphers
)
922 DEBUG(D_tls
) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
923 state
->exp_tls_require_ciphers
);
925 rc
= gnutls_priority_init(&state
->priority_cache
,
926 CS state
->exp_tls_require_ciphers
, &errpos
);
927 want_default_priorities
= FALSE
;
928 p
= state
->exp_tls_require_ciphers
;
931 if (want_default_priorities
)
934 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
935 exim_default_gnutls_priority
);
936 rc
= gnutls_priority_init(&state
->priority_cache
,
937 exim_default_gnutls_priority
, &errpos
);
938 p
= US exim_default_gnutls_priority
;
941 exim_gnutls_err_check(string_sprintf(
942 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
943 p
, errpos
- CS p
, errpos
));
945 rc
= gnutls_priority_set(state
->session
, state
->priority_cache
);
946 exim_gnutls_err_check(US
"gnutls_priority_set");
948 gnutls_db_set_cache_expiration(state
->session
, ssl_session_timeout
);
950 /* Reduce security in favour of increased compatibility, if the admin
951 decides to make that trade-off. */
952 if (gnutls_compat_mode
)
954 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
955 DEBUG(D_tls
) debug_printf("lowering GnuTLS security, compatibility mode\n");
956 gnutls_session_enable_compatibility_mode(state
->session
);
958 DEBUG(D_tls
) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
962 *caller_state
= state
;
963 /* needs to happen before callbacks during handshake */
964 current_global_tls_state
= state
;
971 /*************************************************
972 * Extract peer information *
973 *************************************************/
975 /* Called from both server and client code.
976 Only this is allowed to set state->peerdn and state->have_set_peerdn
977 and we use that to detect double-calls.
979 NOTE: the state blocks last while the TLS connection is up, which is fine
980 for logging in the server side, but for the client side, we log after teardown
981 in src/deliver.c. While the session is up, we can twist about states and
982 repoint tls_* globals, but those variables used for logging or other variable
983 expansion that happens _after_ delivery need to have a longer life-time.
985 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
986 doing this more than once per generation of a state context. We set them in
987 the state context, and repoint tls_* to them. After the state goes away, the
988 tls_* copies of the pointers remain valid and client delivery logging is happy.
990 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
994 state exim_gnutls_state_st *
996 Returns: OK/DEFER/FAIL
1000 peer_status(exim_gnutls_state_st
*state
)
1002 uschar cipherbuf
[256];
1003 const gnutls_datum
*cert_list
;
1005 unsigned int cert_list_size
= 0;
1006 gnutls_protocol_t protocol
;
1007 gnutls_cipher_algorithm_t cipher
;
1008 gnutls_kx_algorithm_t kx
;
1009 gnutls_mac_algorithm_t mac
;
1010 gnutls_certificate_type_t ct
;
1011 gnutls_x509_crt_t crt
;
1015 if (state
->have_set_peerdn
)
1017 state
->have_set_peerdn
= TRUE
;
1019 state
->peerdn
= NULL
;
1022 cipher
= gnutls_cipher_get(state
->session
);
1023 protocol
= gnutls_protocol_get_version(state
->session
);
1024 mac
= gnutls_mac_get(state
->session
);
1025 kx
= gnutls_kx_get(state
->session
);
1027 string_format(cipherbuf
, sizeof(cipherbuf
),
1029 gnutls_protocol_get_name(protocol
),
1030 gnutls_cipher_suite_get_name(kx
, cipher
, mac
),
1031 (int) gnutls_cipher_get_key_size(cipher
) * 8);
1033 /* I don't see a way that spaces could occur, in the current GnuTLS
1034 code base, but it was a concern in the old code and perhaps older GnuTLS
1035 releases did return "TLS 1.0"; play it safe, just in case. */
1036 for (p
= cipherbuf
; *p
!= '\0'; ++p
)
1039 old_pool
= store_pool
;
1040 store_pool
= POOL_PERM
;
1041 state
->ciphersuite
= string_copy(cipherbuf
);
1042 store_pool
= old_pool
;
1043 tls_cipher
= state
->ciphersuite
;
1046 cert_list
= gnutls_certificate_get_peers(state
->session
, &cert_list_size
);
1048 if (cert_list
== NULL
|| cert_list_size
== 0)
1050 DEBUG(D_tls
) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1051 cert_list
, cert_list_size
);
1052 if (state
->verify_requirement
== VERIFY_REQUIRED
)
1053 return tls_error(US
"certificate verification failed",
1054 "no certificate received from peer", state
->host
);
1058 ct
= gnutls_certificate_type_get(state
->session
);
1059 if (ct
!= GNUTLS_CRT_X509
)
1061 const char *ctn
= gnutls_certificate_type_get_name(ct
);
1063 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn
);
1064 if (state
->verify_requirement
== VERIFY_REQUIRED
)
1065 return tls_error(US
"certificate verification not possible, unhandled type",
1070 #define exim_gnutls_peer_err(Label) do { \
1071 if (rc != GNUTLS_E_SUCCESS) { \
1072 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1073 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1074 return OK; } } while (0)
1076 rc
= gnutls_x509_crt_init(&crt
);
1077 exim_gnutls_peer_err(US
"gnutls_x509_crt_init (crt)");
1079 rc
= gnutls_x509_crt_import(crt
, &cert_list
[0], GNUTLS_X509_FMT_DER
);
1080 exim_gnutls_peer_err(US
"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1082 rc
= gnutls_x509_crt_get_dn(crt
, NULL
, &sz
);
1083 if (rc
!= GNUTLS_E_SHORT_MEMORY_BUFFER
)
1085 exim_gnutls_peer_err(US
"getting size for cert DN failed");
1086 return FAIL
; /* should not happen */
1088 dn_buf
= store_get_perm(sz
);
1089 rc
= gnutls_x509_crt_get_dn(crt
, CS dn_buf
, &sz
);
1090 exim_gnutls_peer_err(US
"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1091 state
->peerdn
= dn_buf
;
1094 #undef exim_gnutls_peer_err
1100 /*************************************************
1101 * Verify peer certificate *
1102 *************************************************/
1104 /* Called from both server and client code.
1105 *Should* be using a callback registered with
1106 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1107 the peer information, but that's too new for some OSes.
1110 state exim_gnutls_state_st *
1111 error where to put an error message
1114 FALSE if the session should be rejected
1115 TRUE if the cert is okay or we just don't care
1119 verify_certificate(exim_gnutls_state_st
*state
, const char **error
)
1122 unsigned int verify
;
1126 rc
= peer_status(state
);
1129 verify
= GNUTLS_CERT_INVALID
;
1130 *error
= "not supplied";
1134 rc
= gnutls_certificate_verify_peers2(state
->session
, &verify
);
1137 /* Handle the result of verification. INVALID seems to be set as well
1138 as REVOKED, but leave the test for both. */
1140 if ((rc
< 0) || (verify
& (GNUTLS_CERT_INVALID
|GNUTLS_CERT_REVOKED
)) != 0)
1142 state
->peer_cert_verified
= FALSE
;
1144 *error
= ((verify
& GNUTLS_CERT_REVOKED
) != 0) ? "revoked" : "invalid";
1147 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
1148 *error
, state
->peerdn
? state
->peerdn
: US
"<unset>");
1150 if (state
->verify_requirement
== VERIFY_REQUIRED
)
1152 gnutls_alert_send(state
->session
, GNUTLS_AL_FATAL
, GNUTLS_A_BAD_CERTIFICATE
);
1156 debug_printf("TLS verify failure overriden (host in tls_try_verify_hosts)\n");
1160 state
->peer_cert_verified
= TRUE
;
1161 DEBUG(D_tls
) debug_printf("TLS certificate verified: peerdn=%s\n",
1162 state
->peerdn
? state
->peerdn
: US
"<unset>");
1165 tls_peerdn
= state
->peerdn
;
1173 /* ------------------------------------------------------------------------ */
1176 /* Logging function which can be registered with
1177 * gnutls_global_set_log_function()
1178 * gnutls_global_set_log_level() 0..9
1180 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1182 exim_gnutls_logger_cb(int level
, const char *message
)
1184 DEBUG(D_tls
) debug_printf("GnuTLS<%d>: %s\n", level
, message
);
1189 /* Called after client hello, should handle SNI work.
1190 This will always set tls_sni (state->received_sni) if available,
1191 and may trigger presenting different certificates,
1192 if state->trigger_sni_changes is TRUE.
1194 Should be registered with
1195 gnutls_handshake_set_post_client_hello_function()
1197 "This callback must return 0 on success or a gnutls error code to terminate the
1200 For inability to get SNI information, we return 0.
1201 We only return non-zero if re-setup failed.
1205 exim_sni_handling_cb(gnutls_session_t session
)
1207 char sni_name
[MAX_HOST_LEN
];
1208 size_t data_len
= MAX_HOST_LEN
;
1209 exim_gnutls_state_st
*state
= current_global_tls_state
;
1210 unsigned int sni_type
;
1213 rc
= gnutls_server_name_get(session
, sni_name
, &data_len
, &sni_type
, 0);
1214 if (rc
!= GNUTLS_E_SUCCESS
)
1217 if (rc
== GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
)
1218 debug_printf("TLS: no SNI presented in handshake.\n");
1220 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1221 gnutls_strerror(rc
), rc
);
1226 if (sni_type
!= GNUTLS_NAME_DNS
)
1228 DEBUG(D_tls
) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type
);
1232 /* We now have a UTF-8 string in sni_name */
1233 old_pool
= store_pool
;
1234 store_pool
= POOL_PERM
;
1235 state
->received_sni
= string_copyn(US sni_name
, data_len
);
1236 store_pool
= old_pool
;
1238 /* We set this one now so that variable expansions below will work */
1239 tls_sni
= state
->received_sni
;
1241 DEBUG(D_tls
) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name
,
1242 state
->trigger_sni_changes
? "" : " (unused for certificate selection)");
1244 if (!state
->trigger_sni_changes
)
1247 rc
= tls_expand_session_files(state
);
1250 /* If the setup of certs/etc failed before handshake, TLS would not have
1251 been offered. The best we can do now is abort. */
1252 return GNUTLS_E_APPLICATION_ERROR_MIN
;
1255 rc
= tls_set_remaining_x509(state
);
1256 if (rc
!= OK
) return GNUTLS_E_APPLICATION_ERROR_MIN
;
1264 /* ------------------------------------------------------------------------ */
1265 /* Exported functions */
1270 /*************************************************
1271 * Start a TLS session in a server *
1272 *************************************************/
1274 /* This is called when Exim is running as a server, after having received
1275 the STARTTLS command. It must respond to that command, and then negotiate
1279 require_ciphers list of allowed ciphers or NULL
1281 Returns: OK on success
1282 DEFER for errors before the start of the negotiation
1283 FAIL for errors during the negotation; the server can't
1288 tls_server_start(const uschar
*require_ciphers
)
1292 exim_gnutls_state_st
*state
= NULL
;
1294 /* Check for previous activation */
1295 /* nb: this will not be TLS callout safe, needs reworking as part of that. */
1297 if (tls_active
>= 0)
1299 tls_error(US
"STARTTLS received after TLS started", "", NULL
);
1300 smtp_printf("554 Already in TLS\r\n");
1304 /* Initialize the library. If it fails, it will already have logged the error
1305 and sent an SMTP response. */
1307 DEBUG(D_tls
) debug_printf("initialising GnuTLS as a server\n");
1309 rc
= tls_init(NULL
, tls_certificate
, tls_privatekey
,
1310 NULL
, tls_verify_certificates
, tls_crl
,
1311 require_ciphers
, &state
);
1312 if (rc
!= OK
) return rc
;
1314 /* If this is a host for which certificate verification is mandatory or
1315 optional, set up appropriately. */
1317 if (verify_check_host(&tls_verify_hosts
) == OK
)
1319 DEBUG(D_tls
) debug_printf("TLS: a client certificate will be required.\n");
1320 state
->verify_requirement
= VERIFY_REQUIRED
;
1321 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUIRE
);
1323 else if (verify_check_host(&tls_try_verify_hosts
) == OK
)
1325 DEBUG(D_tls
) debug_printf("TLS: a client certificate will be requested but not required.\n");
1326 state
->verify_requirement
= VERIFY_OPTIONAL
;
1327 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUEST
);
1331 DEBUG(D_tls
) debug_printf("TLS: a client certificate will not be requested.\n");
1332 state
->verify_requirement
= VERIFY_NONE
;
1333 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_IGNORE
);
1336 /* Register SNI handling; always, even if not in tls_certificate, so that the
1337 expansion variable $tls_sni is always available. */
1339 gnutls_handshake_set_post_client_hello_function(state
->session
,
1340 exim_sni_handling_cb
);
1342 /* Set context and tell client to go ahead, except in the case of TLS startup
1343 on connection, where outputting anything now upsets the clients and tends to
1344 make them disconnect. We need to have an explicit fflush() here, to force out
1345 the response. Other smtp_printf() calls do not need it, because in non-TLS
1346 mode, the fflush() happens when smtp_getc() is called. */
1348 if (!tls_on_connect
)
1350 smtp_printf("220 TLS go ahead\r\n");
1354 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1355 that the GnuTLS library doesn't. */
1357 gnutls_transport_set_ptr2(state
->session
,
1358 (gnutls_transport_ptr
)fileno(smtp_in
),
1359 (gnutls_transport_ptr
)fileno(smtp_out
));
1360 state
->fd_in
= fileno(smtp_in
);
1361 state
->fd_out
= fileno(smtp_out
);
1363 sigalrm_seen
= FALSE
;
1364 if (smtp_receive_timeout
> 0) alarm(smtp_receive_timeout
);
1367 rc
= gnutls_handshake(state
->session
);
1368 } while ((rc
== GNUTLS_E_AGAIN
) || (rc
== GNUTLS_E_INTERRUPTED
));
1371 if (rc
!= GNUTLS_E_SUCCESS
)
1373 tls_error(US
"gnutls_handshake",
1374 sigalrm_seen
? "timed out" : gnutls_strerror(rc
), NULL
);
1375 /* It seems that, except in the case of a timeout, we have to close the
1376 connection right here; otherwise if the other end is running OpenSSL it hangs
1377 until the server times out. */
1381 (void)fclose(smtp_out
);
1382 (void)fclose(smtp_in
);
1388 DEBUG(D_tls
) debug_printf("gnutls_handshake was successful\n");
1390 /* Verify after the fact */
1392 if (state
->verify_requirement
!= VERIFY_NONE
)
1394 if (!verify_certificate(state
, &error
))
1396 if (state
->verify_requirement
== VERIFY_OPTIONAL
)
1399 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1404 tls_error(US
"certificate verification failed", error
, NULL
);
1410 /* Figure out peer DN, and if authenticated, etc. */
1412 rc
= peer_status(state
);
1413 if (rc
!= OK
) return rc
;
1415 /* Sets various Exim expansion variables; always safe within server */
1417 extract_exim_vars_from_tls_state(state
);
1419 /* TLS has been set up. Adjust the input functions to read via TLS,
1420 and initialize appropriately. */
1422 state
->xfer_buffer
= store_malloc(ssl_xfer_buffer_size
);
1424 receive_getc
= tls_getc
;
1425 receive_ungetc
= tls_ungetc
;
1426 receive_feof
= tls_feof
;
1427 receive_ferror
= tls_ferror
;
1428 receive_smtp_buffered
= tls_smtp_buffered
;
1436 /*************************************************
1437 * Start a TLS session in a client *
1438 *************************************************/
1440 /* Called from the smtp transport after STARTTLS has been accepted.
1443 fd the fd of the connection
1444 host connected host (for messages)
1445 addr the first address (not used)
1446 dhparam DH parameter file (ignored, we're a client)
1447 certificate certificate file
1448 privatekey private key file
1449 sni TLS SNI to send to remote host
1450 verify_certs file for certificate verify
1451 verify_crl CRL for verify
1452 require_ciphers list of allowed ciphers or NULL
1453 timeout startup timeout
1455 Returns: OK/DEFER/FAIL (because using common functions),
1456 but for a client, DEFER and FAIL have the same meaning
1460 tls_client_start(int fd
, host_item
*host
,
1461 address_item
*addr ARG_UNUSED
, uschar
*dhparam ARG_UNUSED
,
1462 uschar
*certificate
, uschar
*privatekey
, uschar
*sni
,
1463 uschar
*verify_certs
, uschar
*verify_crl
,
1464 uschar
*require_ciphers
, int timeout
)
1468 exim_gnutls_state_st
*state
= NULL
;
1470 DEBUG(D_tls
) debug_printf("initialising GnuTLS as a client on fd %d\n", fd
);
1472 rc
= tls_init(host
, certificate
, privatekey
,
1473 sni
, verify_certs
, verify_crl
, require_ciphers
, &state
);
1474 if (rc
!= OK
) return rc
;
1476 gnutls_dh_set_prime_bits(state
->session
, EXIM_CLIENT_DH_MIN_BITS
);
1478 if (verify_certs
== NULL
)
1480 DEBUG(D_tls
) debug_printf("TLS: server certificate verification not required\n");
1481 state
->verify_requirement
= VERIFY_NONE
;
1482 /* we still ask for it, to log it, etc */
1483 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUEST
);
1487 DEBUG(D_tls
) debug_printf("TLS: server certificate verification required\n");
1488 state
->verify_requirement
= VERIFY_REQUIRED
;
1489 gnutls_certificate_server_set_request(state
->session
, GNUTLS_CERT_REQUIRE
);
1492 gnutls_transport_set_ptr(state
->session
, (gnutls_transport_ptr
)fd
);
1496 /* There doesn't seem to be a built-in timeout on connection. */
1498 sigalrm_seen
= FALSE
;
1502 rc
= gnutls_handshake(state
->session
);
1503 } while ((rc
== GNUTLS_E_AGAIN
) || (rc
== GNUTLS_E_INTERRUPTED
));
1506 if (rc
!= GNUTLS_E_SUCCESS
)
1507 return tls_error(US
"gnutls_handshake",
1508 sigalrm_seen
? "timed out" : gnutls_strerror(rc
), state
->host
);
1510 DEBUG(D_tls
) debug_printf("gnutls_handshake was successful\n");
1514 if (state
->verify_requirement
!= VERIFY_NONE
&&
1515 !verify_certificate(state
, &error
))
1516 return tls_error(US
"certificate verification failed", error
, state
->host
);
1518 /* Figure out peer DN, and if authenticated, etc. */
1520 rc
= peer_status(state
);
1521 if (rc
!= OK
) return rc
;
1523 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
1525 extract_exim_vars_from_tls_state(state
);
1533 /*************************************************
1534 * Close down a TLS session *
1535 *************************************************/
1537 /* This is also called from within a delivery subprocess forked from the
1538 daemon, to shut down the TLS library, without actually doing a shutdown (which
1539 would tamper with the TLS session in the parent process).
1541 Arguments: TRUE if gnutls_bye is to be called
1546 tls_close(BOOL shutdown
)
1548 exim_gnutls_state_st
*state
= current_global_tls_state
;
1550 if (tls_active
< 0) return; /* TLS was not active */
1554 DEBUG(D_tls
) debug_printf("tls_close(): shutting down TLS\n");
1555 gnutls_bye(state
->session
, GNUTLS_SHUT_WR
);
1558 gnutls_deinit(state
->session
);
1560 memcpy(state
, &exim_gnutls_state_init
, sizeof(exim_gnutls_state_init
));
1562 if ((state_server
.session
== NULL
) && (state_client
.session
== NULL
))
1564 gnutls_global_deinit();
1565 exim_gnutls_base_init_done
= FALSE
;
1574 /*************************************************
1575 * TLS version of getc *
1576 *************************************************/
1578 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
1579 it refills the buffer via the GnuTLS reading function.
1581 This feeds DKIM and should be used for all message-body reads.
1584 Returns: the next character or EOF
1590 exim_gnutls_state_st
*state
= current_global_tls_state
;
1591 if (state
->xfer_buffer_lwm
>= state
->xfer_buffer_hwm
)
1595 DEBUG(D_tls
) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1596 state
->session
, state
->xfer_buffer
, ssl_xfer_buffer_size
);
1598 if (smtp_receive_timeout
> 0) alarm(smtp_receive_timeout
);
1599 inbytes
= gnutls_record_recv(state
->session
, state
->xfer_buffer
,
1600 ssl_xfer_buffer_size
);
1603 /* A zero-byte return appears to mean that the TLS session has been
1604 closed down, not that the socket itself has been closed down. Revert to
1605 non-TLS handling. */
1609 DEBUG(D_tls
) debug_printf("Got TLS_EOF\n");
1611 receive_getc
= smtp_getc
;
1612 receive_ungetc
= smtp_ungetc
;
1613 receive_feof
= smtp_feof
;
1614 receive_ferror
= smtp_ferror
;
1615 receive_smtp_buffered
= smtp_buffered
;
1617 gnutls_deinit(state
->session
);
1618 state
->session
= NULL
;
1621 tls_certificate_verified
= FALSE
;
1622 tls_channelbinding_b64
= NULL
;
1629 /* Handle genuine errors */
1631 else if (inbytes
< 0)
1633 record_io_error(state
, (int) inbytes
, US
"recv", NULL
);
1634 state
->xfer_error
= 1;
1637 #ifndef DISABLE_DKIM
1638 dkim_exim_verify_feed(state
->xfer_buffer
, inbytes
);
1640 state
->xfer_buffer_hwm
= (int) inbytes
;
1641 state
->xfer_buffer_lwm
= 0;
1644 /* Something in the buffer; return next uschar */
1646 return state
->xfer_buffer
[state
->xfer_buffer_lwm
++];
1652 /*************************************************
1653 * Read bytes from TLS channel *
1654 *************************************************/
1656 /* This does not feed DKIM, so if the caller uses this for reading message body,
1657 then the caller must feed DKIM.
1662 Returns: the number of bytes read
1663 -1 after a failed read
1667 tls_read(uschar
*buff
, size_t len
)
1669 exim_gnutls_state_st
*state
= current_global_tls_state
;
1675 if (state
->xfer_buffer_lwm
< state
->xfer_buffer_hwm
)
1677 debug_printf("*** PROBABLY A BUG *** " \
1678 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1679 state
->xfer_buffer_hwm
- state
->xfer_buffer_lwm
);
1682 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT
")\n",
1683 state
->session
, buff
, len
);
1685 inbytes
= gnutls_record_recv(state
->session
, buff
, len
);
1686 if (inbytes
> 0) return inbytes
;
1689 DEBUG(D_tls
) debug_printf("Got TLS_EOF\n");
1691 else record_io_error(state
, (int)inbytes
, US
"recv", NULL
);
1699 /*************************************************
1700 * Write bytes down TLS channel *
1701 *************************************************/
1708 Returns: the number of bytes after a successful write,
1709 -1 after a failed write
1713 tls_write(const uschar
*buff
, size_t len
)
1717 exim_gnutls_state_st
*state
= current_global_tls_state
;
1719 DEBUG(D_tls
) debug_printf("tls_do_write(%p, " SIZE_T_FMT
")\n", buff
, left
);
1722 DEBUG(D_tls
) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT
")\n",
1724 outbytes
= gnutls_record_send(state
->session
, buff
, left
);
1726 DEBUG(D_tls
) debug_printf("outbytes=" SSIZE_T_FMT
"\n", outbytes
);
1729 record_io_error(state
, outbytes
, US
"send", NULL
);
1734 record_io_error(state
, 0, US
"send", US
"TLS channel closed on write");
1745 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT
") than INT_MAX\n",
1756 /*************************************************
1757 * Random number generation *
1758 *************************************************/
1760 /* Pseudo-random number generation. The result is not expected to be
1761 cryptographically strong but not so weak that someone will shoot themselves
1762 in the foot using it as a nonce in input in some email header scheme or
1763 whatever weirdness they'll twist this into. The result should handle fork()
1764 and avoid repeating sequences. OpenSSL handles that for us.
1768 Returns a random number in range [0, max-1]
1771 #ifdef HAVE_GNUTLS_RND
1773 vaguely_random_number(int max
)
1778 uschar smallbuf
[sizeof(r
)];
1783 needed_len
= sizeof(r
);
1784 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
1785 * asked for a number less than 10. */
1786 for (r
= max
, i
= 0; r
; ++i
)
1792 i
= gnutls_rnd(GNUTLS_RND_NONCE
, smallbuf
, needed_len
);
1795 DEBUG(D_all
) debug_printf("gnutls_rnd() failed, using fallback.\n");
1796 return vaguely_random_number_fallback(max
);
1799 for (p
= smallbuf
; needed_len
; --needed_len
, ++p
)
1805 /* We don't particularly care about weighted results; if someone wants
1806 * smooth distribution and cares enough then they should submit a patch then. */
1809 #else /* HAVE_GNUTLS_RND */
1811 vaguely_random_number(int max
)
1813 return vaguely_random_number_fallback(max
);
1815 #endif /* HAVE_GNUTLS_RND */
1820 /*************************************************
1821 * Report the library versions. *
1822 *************************************************/
1824 /* See a description in tls-openssl.c for an explanation of why this exists.
1826 Arguments: a FILE* to print the results to
1831 tls_version_report(FILE *f
)
1833 fprintf(f
, "Library version: GnuTLS: Compile: %s\n"
1836 gnutls_check_version(NULL
));
1839 /* End of tls-gnu.c */