Make "system" location for certificate CA bundle the default
[exim.git] / src / src / tls-gnu.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2014 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Copyright (c) Phil Pennock 2012 */
9
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
13
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
17 appropriate.
18
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
23
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
26
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
31
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
35 */
36
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42 /* needed to disable PKCS11 autoload unless requested */
43 #if GNUTLS_VERSION_NUMBER >= 0x020c00
44 # include <gnutls/pkcs11.h>
45 #endif
46 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
47 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
48 # define DISABLE_OCSP
49 #endif
50 #if GNUTLS_VERSION_NUMBER < 0x020a00 && defined(EXPERIMENTAL_EVENT)
51 # warning "GnuTLS library version too old; tls:cert event unsupported"
52 # undef EXPERIMENTAL_EVENT
53 #endif
54 #if GNUTLS_VERSION_NUMBER >= 0x030306
55 # define SUPPORT_CA_DIR
56 #else
57 # undef SUPPORT_CA_DIR
58 #endif
59 #if GNUTLS_VERSION_NUMBER >= 0x030314
60 # define SUPPORT_SYSDEFAULT_CABUNDLE
61 #endif
62
63 #ifndef DISABLE_OCSP
64 # include <gnutls/ocsp.h>
65 #endif
66
67 /* GnuTLS 2 vs 3
68
69 GnuTLS 3 only:
70 gnutls_global_set_audit_log_function()
71
72 Changes:
73 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
74 */
75
76 /* Local static variables for GnuTLS */
77
78 /* Values for verify_requirement */
79
80 enum peer_verify_requirement
81 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
82
83 /* This holds most state for server or client; with this, we can set up an
84 outbound TLS-enabled connection in an ACL callout, while not stomping all
85 over the TLS variables available for expansion.
86
87 Some of these correspond to variables in globals.c; those variables will
88 be set to point to content in one of these instances, as appropriate for
89 the stage of the process lifetime.
90
91 Not handled here: global tls_channelbinding_b64.
92 */
93
94 typedef struct exim_gnutls_state {
95 gnutls_session_t session;
96 gnutls_certificate_credentials_t x509_cred;
97 gnutls_priority_t priority_cache;
98 enum peer_verify_requirement verify_requirement;
99 int fd_in;
100 int fd_out;
101 BOOL peer_cert_verified;
102 BOOL trigger_sni_changes;
103 BOOL have_set_peerdn;
104 const struct host_item *host;
105 gnutls_x509_crt_t peercert;
106 uschar *peerdn;
107 uschar *ciphersuite;
108 uschar *received_sni;
109
110 const uschar *tls_certificate;
111 const uschar *tls_privatekey;
112 const uschar *tls_sni; /* client send only, not received */
113 const uschar *tls_verify_certificates;
114 const uschar *tls_crl;
115 const uschar *tls_require_ciphers;
116
117 uschar *exp_tls_certificate;
118 uschar *exp_tls_privatekey;
119 uschar *exp_tls_verify_certificates;
120 uschar *exp_tls_crl;
121 uschar *exp_tls_require_ciphers;
122 uschar *exp_tls_ocsp_file;
123 uschar *exp_tls_verify_cert_hostnames;
124 #ifdef EXPERIMENTAL_EVENT
125 uschar *event_action;
126 #endif
127
128 tls_support *tlsp; /* set in tls_init() */
129
130 uschar *xfer_buffer;
131 int xfer_buffer_lwm;
132 int xfer_buffer_hwm;
133 int xfer_eof;
134 int xfer_error;
135 } exim_gnutls_state_st;
136
137 static const exim_gnutls_state_st exim_gnutls_state_init = {
138 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
139 NULL, NULL, NULL, NULL,
140 NULL, NULL, NULL, NULL, NULL, NULL,
141 NULL, NULL, NULL, NULL, NULL, NULL, NULL,
142 NULL,
143 #ifdef EXPERIMENTAL_EVENT
144 NULL,
145 #endif
146 NULL,
147 NULL, 0, 0, 0, 0,
148 };
149
150 /* Not only do we have our own APIs which don't pass around state, assuming
151 it's held in globals, GnuTLS doesn't appear to let us register callback data
152 for callbacks, or as part of the session, so we have to keep a "this is the
153 context we're currently dealing with" pointer and rely upon being
154 single-threaded to keep from processing data on an inbound TLS connection while
155 talking to another TLS connection for an outbound check. This does mean that
156 there's no way for heart-beats to be responded to, for the duration of the
157 second connection.
158 XXX But see gnutls_session_get_ptr()
159 */
160
161 static exim_gnutls_state_st state_server, state_client;
162
163 /* dh_params are initialised once within the lifetime of a process using TLS;
164 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
165 don't want to repeat this. */
166
167 static gnutls_dh_params_t dh_server_params = NULL;
168
169 /* No idea how this value was chosen; preserving it. Default is 3600. */
170
171 static const int ssl_session_timeout = 200;
172
173 static const char * const exim_default_gnutls_priority = "NORMAL";
174
175 /* Guard library core initialisation */
176
177 static BOOL exim_gnutls_base_init_done = FALSE;
178
179
180 /* ------------------------------------------------------------------------ */
181 /* macros */
182
183 #define MAX_HOST_LEN 255
184
185 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
186 the library logging; a value less than 0 disables the calls to set up logging
187 callbacks. */
188 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
189 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
190 #endif
191
192 #ifndef EXIM_CLIENT_DH_MIN_BITS
193 # define EXIM_CLIENT_DH_MIN_BITS 1024
194 #endif
195
196 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
197 can ask for a bit-strength. Without that, we stick to the constant we had
198 before, for now. */
199 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
200 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
201 #endif
202
203 #define exim_gnutls_err_check(Label) do { \
204 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
205
206 #define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
207
208 #if GNUTLS_VERSION_NUMBER >= 0x020c00
209 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
210 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
211 # define HAVE_GNUTLS_RND
212 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
213 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
214 * isn't available sometimes, so this needs to become a conditional
215 * compilation; the sanest way to deal with this being a problem on
216 * older OSes is to block it in the Local/Makefile with this compiler
217 * definition */
218 # ifndef AVOID_GNUTLS_PKCS11
219 # define HAVE_GNUTLS_PKCS11
220 # endif /* AVOID_GNUTLS_PKCS11 */
221 #endif
222
223
224
225
226 /* ------------------------------------------------------------------------ */
227 /* Callback declarations */
228
229 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
230 static void exim_gnutls_logger_cb(int level, const char *message);
231 #endif
232
233 static int exim_sni_handling_cb(gnutls_session_t session);
234
235 #ifndef DISABLE_OCSP
236 static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
237 gnutls_datum_t * ocsp_response);
238 #endif
239
240
241
242 /* ------------------------------------------------------------------------ */
243 /* Static functions */
244
245 /*************************************************
246 * Handle TLS error *
247 *************************************************/
248
249 /* Called from lots of places when errors occur before actually starting to do
250 the TLS handshake, that is, while the session is still in clear. Always returns
251 DEFER for a server and FAIL for a client so that most calls can use "return
252 tls_error(...)" to do this processing and then give an appropriate return. A
253 single function is used for both server and client, because it is called from
254 some shared functions.
255
256 Argument:
257 prefix text to include in the logged error
258 msg additional error string (may be NULL)
259 usually obtained from gnutls_strerror()
260 host NULL if setting up a server;
261 the connected host if setting up a client
262
263 Returns: OK/DEFER/FAIL
264 */
265
266 static int
267 tls_error(const uschar *prefix, const char *msg, const host_item *host)
268 {
269 if (host)
270 {
271 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s)%s%s",
272 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
273 return FAIL;
274 }
275 else
276 {
277 uschar *conn_info = smtp_get_connection_info();
278 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
279 conn_info += 5;
280 /* I'd like to get separated H= here, but too hard for now */
281 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
282 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
283 return DEFER;
284 }
285 }
286
287
288
289
290 /*************************************************
291 * Deal with logging errors during I/O *
292 *************************************************/
293
294 /* We have to get the identity of the peer from saved data.
295
296 Argument:
297 state the current GnuTLS exim state container
298 rc the GnuTLS error code, or 0 if it's a local error
299 when text identifying read or write
300 text local error text when ec is 0
301
302 Returns: nothing
303 */
304
305 static void
306 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
307 {
308 const char *msg;
309
310 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
311 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
312 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
313 else
314 msg = gnutls_strerror(rc);
315
316 tls_error(when, msg, state->host);
317 }
318
319
320
321
322 /*************************************************
323 * Set various Exim expansion vars *
324 *************************************************/
325
326 #define exim_gnutls_cert_err(Label) \
327 do \
328 { \
329 if (rc != GNUTLS_E_SUCCESS) \
330 { \
331 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
332 (Label), gnutls_strerror(rc)); \
333 return rc; \
334 } \
335 } while (0)
336
337 static int
338 import_cert(const gnutls_datum * cert, gnutls_x509_crt_t * crtp)
339 {
340 int rc;
341
342 rc = gnutls_x509_crt_init(crtp);
343 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
344
345 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
346 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
347
348 return rc;
349 }
350
351 #undef exim_gnutls_cert_err
352
353
354 /* We set various Exim global variables from the state, once a session has
355 been established. With TLS callouts, may need to change this to stack
356 variables, or just re-call it with the server state after client callout
357 has finished.
358
359 Make sure anything set here is unset in tls_getc().
360
361 Sets:
362 tls_active fd
363 tls_bits strength indicator
364 tls_certificate_verified bool indicator
365 tls_channelbinding_b64 for some SASL mechanisms
366 tls_cipher a string
367 tls_peercert pointer to library internal
368 tls_peerdn a string
369 tls_sni a (UTF-8) string
370 tls_ourcert pointer to library internal
371
372 Argument:
373 state the relevant exim_gnutls_state_st *
374 */
375
376 static void
377 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
378 {
379 gnutls_cipher_algorithm_t cipher;
380 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
381 int old_pool;
382 int rc;
383 gnutls_datum_t channel;
384 #endif
385 tls_support * tlsp = state->tlsp;
386
387 tlsp->active = state->fd_out;
388
389 cipher = gnutls_cipher_get(state->session);
390 /* returns size in "bytes" */
391 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
392
393 tlsp->cipher = state->ciphersuite;
394
395 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
396
397 tlsp->certificate_verified = state->peer_cert_verified;
398
399 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
400 only available for use for authenticators while this TLS session is running. */
401
402 tls_channelbinding_b64 = NULL;
403 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
404 channel.data = NULL;
405 channel.size = 0;
406 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
407 if (rc) {
408 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
409 } else {
410 old_pool = store_pool;
411 store_pool = POOL_PERM;
412 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
413 store_pool = old_pool;
414 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
415 }
416 #endif
417
418 /* peercert is set in peer_status() */
419 tlsp->peerdn = state->peerdn;
420 tlsp->sni = state->received_sni;
421
422 /* record our certificate */
423 {
424 const gnutls_datum * cert = gnutls_certificate_get_ours(state->session);
425 gnutls_x509_crt_t crt;
426
427 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
428 }
429 }
430
431
432
433
434 /*************************************************
435 * Setup up DH parameters *
436 *************************************************/
437
438 /* Generating the D-H parameters may take a long time. They only need to
439 be re-generated every so often, depending on security policy. What we do is to
440 keep these parameters in a file in the spool directory. If the file does not
441 exist, we generate them. This means that it is easy to cause a regeneration.
442
443 The new file is written as a temporary file and renamed, so that an incomplete
444 file is never present. If two processes both compute some new parameters, you
445 waste a bit of effort, but it doesn't seem worth messing around with locking to
446 prevent this.
447
448 Returns: OK/DEFER/FAIL
449 */
450
451 static int
452 init_server_dh(void)
453 {
454 int fd, rc;
455 unsigned int dh_bits;
456 gnutls_datum m;
457 uschar filename_buf[PATH_MAX];
458 uschar *filename = NULL;
459 size_t sz;
460 uschar *exp_tls_dhparam;
461 BOOL use_file_in_spool = FALSE;
462 BOOL use_fixed_file = FALSE;
463 host_item *host = NULL; /* dummy for macros */
464
465 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
466
467 rc = gnutls_dh_params_init(&dh_server_params);
468 exim_gnutls_err_check(US"gnutls_dh_params_init");
469
470 m.data = NULL;
471 m.size = 0;
472
473 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
474 return DEFER;
475
476 if (!exp_tls_dhparam)
477 {
478 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
479 m.data = US std_dh_prime_default();
480 m.size = Ustrlen(m.data);
481 }
482 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
483 use_file_in_spool = TRUE;
484 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
485 {
486 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
487 return OK;
488 }
489 else if (exp_tls_dhparam[0] != '/')
490 {
491 m.data = US std_dh_prime_named(exp_tls_dhparam);
492 if (m.data == NULL)
493 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
494 m.size = Ustrlen(m.data);
495 }
496 else
497 {
498 use_fixed_file = TRUE;
499 filename = exp_tls_dhparam;
500 }
501
502 if (m.data)
503 {
504 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
505 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
506 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
507 return OK;
508 }
509
510 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
511 /* If you change this constant, also change dh_param_fn_ext so that we can use a
512 different filename and ensure we have sufficient bits. */
513 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
514 if (!dh_bits)
515 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
516 DEBUG(D_tls)
517 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
518 dh_bits);
519 #else
520 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
521 DEBUG(D_tls)
522 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
523 dh_bits);
524 #endif
525
526 /* Some clients have hard-coded limits. */
527 if (dh_bits > tls_dh_max_bits)
528 {
529 DEBUG(D_tls)
530 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
531 tls_dh_max_bits);
532 dh_bits = tls_dh_max_bits;
533 }
534
535 if (use_file_in_spool)
536 {
537 if (!string_format(filename_buf, sizeof(filename_buf),
538 "%s/gnutls-params-%d", spool_directory, dh_bits))
539 return tls_error(US"overlong filename", NULL, NULL);
540 filename = filename_buf;
541 }
542
543 /* Open the cache file for reading and if successful, read it and set up the
544 parameters. */
545
546 fd = Uopen(filename, O_RDONLY, 0);
547 if (fd >= 0)
548 {
549 struct stat statbuf;
550 FILE *fp;
551 int saved_errno;
552
553 if (fstat(fd, &statbuf) < 0) /* EIO */
554 {
555 saved_errno = errno;
556 (void)close(fd);
557 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
558 }
559 if (!S_ISREG(statbuf.st_mode))
560 {
561 (void)close(fd);
562 return tls_error(US"TLS cache not a file", NULL, NULL);
563 }
564 fp = fdopen(fd, "rb");
565 if (!fp)
566 {
567 saved_errno = errno;
568 (void)close(fd);
569 return tls_error(US"fdopen(TLS cache stat fd) failed",
570 strerror(saved_errno), NULL);
571 }
572
573 m.size = statbuf.st_size;
574 m.data = malloc(m.size);
575 if (m.data == NULL)
576 {
577 fclose(fp);
578 return tls_error(US"malloc failed", strerror(errno), NULL);
579 }
580 sz = fread(m.data, m.size, 1, fp);
581 if (!sz)
582 {
583 saved_errno = errno;
584 fclose(fp);
585 free(m.data);
586 return tls_error(US"fread failed", strerror(saved_errno), NULL);
587 }
588 fclose(fp);
589
590 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
591 free(m.data);
592 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
593 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
594 }
595
596 /* If the file does not exist, fall through to compute new data and cache it.
597 If there was any other opening error, it is serious. */
598
599 else if (errno == ENOENT)
600 {
601 rc = -1;
602 DEBUG(D_tls)
603 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
604 }
605 else
606 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
607 NULL, NULL);
608
609 /* If ret < 0, either the cache file does not exist, or the data it contains
610 is not useful. One particular case of this is when upgrading from an older
611 release of Exim in which the data was stored in a different format. We don't
612 try to be clever and support both formats; we just regenerate new data in this
613 case. */
614
615 if (rc < 0)
616 {
617 uschar *temp_fn;
618 unsigned int dh_bits_gen = dh_bits;
619
620 if ((PATH_MAX - Ustrlen(filename)) < 10)
621 return tls_error(US"Filename too long to generate replacement",
622 CS filename, NULL);
623
624 temp_fn = string_copy(US "%s.XXXXXXX");
625 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
626 if (fd < 0)
627 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
628 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
629
630 /* GnuTLS overshoots!
631 * If we ask for 2236, we might get 2237 or more.
632 * But there's no way to ask GnuTLS how many bits there really are.
633 * We can ask how many bits were used in a TLS session, but that's it!
634 * The prime itself is hidden behind too much abstraction.
635 * So we ask for less, and proceed on a wing and a prayer.
636 * First attempt, subtracted 3 for 2233 and got 2240.
637 */
638 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
639 {
640 dh_bits_gen = dh_bits - 10;
641 DEBUG(D_tls)
642 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
643 dh_bits_gen);
644 }
645
646 DEBUG(D_tls)
647 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
648 dh_bits_gen);
649 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
650 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
651
652 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
653 and I confirmed that a NULL call to get the size first is how the GnuTLS
654 sample apps handle this. */
655
656 sz = 0;
657 m.data = NULL;
658 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
659 m.data, &sz);
660 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
661 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
662 m.size = sz;
663 m.data = malloc(m.size);
664 if (m.data == NULL)
665 return tls_error(US"memory allocation failed", strerror(errno), NULL);
666 /* this will return a size 1 less than the allocation size above */
667 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
668 m.data, &sz);
669 if (rc != GNUTLS_E_SUCCESS)
670 {
671 free(m.data);
672 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
673 }
674 m.size = sz; /* shrink by 1, probably */
675
676 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
677 if (sz != m.size)
678 {
679 free(m.data);
680 return tls_error(US"TLS cache write D-H params failed",
681 strerror(errno), NULL);
682 }
683 free(m.data);
684 sz = write_to_fd_buf(fd, US"\n", 1);
685 if (sz != 1)
686 return tls_error(US"TLS cache write D-H params final newline failed",
687 strerror(errno), NULL);
688
689 rc = close(fd);
690 if (rc)
691 return tls_error(US"TLS cache write close() failed",
692 strerror(errno), NULL);
693
694 if (Urename(temp_fn, filename) < 0)
695 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
696 temp_fn, filename), strerror(errno), NULL);
697
698 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
699 }
700
701 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
702 return OK;
703 }
704
705
706
707
708 /*************************************************
709 * Variables re-expanded post-SNI *
710 *************************************************/
711
712 /* Called from both server and client code, via tls_init(), and also from
713 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
714
715 We can tell the two apart by state->received_sni being non-NULL in callback.
716
717 The callback should not call us unless state->trigger_sni_changes is true,
718 which we are responsible for setting on the first pass through.
719
720 Arguments:
721 state exim_gnutls_state_st *
722
723 Returns: OK/DEFER/FAIL
724 */
725
726 static int
727 tls_expand_session_files(exim_gnutls_state_st *state)
728 {
729 struct stat statbuf;
730 int rc;
731 const host_item *host = state->host; /* macro should be reconsidered? */
732 uschar *saved_tls_certificate = NULL;
733 uschar *saved_tls_privatekey = NULL;
734 uschar *saved_tls_verify_certificates = NULL;
735 uschar *saved_tls_crl = NULL;
736 int cert_count;
737
738 /* We check for tls_sni *before* expansion. */
739 if (!host) /* server */
740 {
741 if (!state->received_sni)
742 {
743 if (state->tls_certificate &&
744 (Ustrstr(state->tls_certificate, US"tls_sni") ||
745 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
746 Ustrstr(state->tls_certificate, US"tls_out_sni")
747 ))
748 {
749 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
750 state->trigger_sni_changes = TRUE;
751 }
752 }
753 else
754 {
755 /* useful for debugging */
756 saved_tls_certificate = state->exp_tls_certificate;
757 saved_tls_privatekey = state->exp_tls_privatekey;
758 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
759 saved_tls_crl = state->exp_tls_crl;
760 }
761 }
762
763 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
764 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
765
766 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
767 state members, assuming consistent naming; and expand_check() returns
768 false if expansion failed, unless expansion was forced to fail. */
769
770 /* check if we at least have a certificate, before doing expensive
771 D-H generation. */
772
773 if (!expand_check_tlsvar(tls_certificate))
774 return DEFER;
775
776 /* certificate is mandatory in server, optional in client */
777
778 if ((state->exp_tls_certificate == NULL) ||
779 (*state->exp_tls_certificate == '\0'))
780 {
781 if (!host)
782 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
783 else
784 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
785 }
786
787 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
788 return DEFER;
789
790 /* tls_privatekey is optional, defaulting to same file as certificate */
791
792 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
793 {
794 state->tls_privatekey = state->tls_certificate;
795 state->exp_tls_privatekey = state->exp_tls_certificate;
796 }
797
798
799 if (state->exp_tls_certificate && *state->exp_tls_certificate)
800 {
801 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
802 state->exp_tls_certificate, state->exp_tls_privatekey);
803
804 if (state->received_sni)
805 {
806 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
807 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
808 {
809 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
810 }
811 else
812 {
813 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
814 }
815 }
816
817 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
818 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
819 GNUTLS_X509_FMT_PEM);
820 exim_gnutls_err_check(
821 string_sprintf("cert/key setup: cert=%s key=%s",
822 state->exp_tls_certificate, state->exp_tls_privatekey));
823 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
824 } /* tls_certificate */
825
826
827 /* Set the OCSP stapling server info */
828
829 #ifndef DISABLE_OCSP
830 if ( !host /* server */
831 && tls_ocsp_file
832 )
833 {
834 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file",
835 &state->exp_tls_ocsp_file))
836 return DEFER;
837
838 /* Use the full callback method for stapling just to get observability.
839 More efficient would be to read the file once only, if it never changed
840 (due to SNI). Would need restart on file update, or watch datestamp. */
841
842 gnutls_certificate_set_ocsp_status_request_function(state->x509_cred,
843 server_ocsp_stapling_cb, state->exp_tls_ocsp_file);
844
845 DEBUG(D_tls) debug_printf("Set OCSP response file %s\n", &state->exp_tls_ocsp_file);
846 }
847 #endif
848
849
850 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
851 provided. Experiment shows that, if the certificate file is empty, an unhelpful
852 error message is provided. However, if we just refrain from setting anything up
853 in that case, certificate verification fails, which seems to be the correct
854 behaviour. */
855
856 if ( state->tls_verify_certificates && *state->tls_verify_certificates
857 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
858 && Ustrcmp(state->exp_tls_verify_certificates, "system") != 0
859 #endif
860 )
861 {
862 if (!expand_check_tlsvar(tls_verify_certificates))
863 return DEFER;
864 if (state->tls_crl && *state->tls_crl)
865 if (!expand_check_tlsvar(tls_crl))
866 return DEFER;
867
868 if (!(state->exp_tls_verify_certificates &&
869 *state->exp_tls_verify_certificates))
870 {
871 DEBUG(D_tls)
872 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
873 /* With no tls_verify_certificates, we ignore tls_crl too */
874 return OK;
875 }
876 }
877 else
878 {
879 DEBUG(D_tls)
880 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
881 return OK;
882 }
883
884 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
885 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
886 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
887 else
888 #endif
889 {
890 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
891 {
892 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
893 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
894 strerror(errno));
895 return DEFER;
896 }
897
898 #ifndef SUPPORT_CA_DIR
899 /* The test suite passes in /dev/null; we could check for that path explicitly,
900 but who knows if someone has some weird FIFO which always dumps some certs, or
901 other weirdness. The thing we really want to check is that it's not a
902 directory, since while OpenSSL supports that, GnuTLS does not.
903 So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
904 if (S_ISDIR(statbuf.st_mode))
905 {
906 DEBUG(D_tls)
907 debug_printf("verify certificates path is a dir: \"%s\"\n",
908 state->exp_tls_verify_certificates);
909 log_write(0, LOG_MAIN|LOG_PANIC,
910 "tls_verify_certificates \"%s\" is a directory",
911 state->exp_tls_verify_certificates);
912 return DEFER;
913 }
914 #endif
915
916 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
917 state->exp_tls_verify_certificates, statbuf.st_size);
918
919 if (statbuf.st_size == 0)
920 {
921 DEBUG(D_tls)
922 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
923 return OK;
924 }
925
926 cert_count =
927
928 #ifdef SUPPORT_CA_DIR
929 (statbuf.st_mode & S_IFMT) == S_IFDIR
930 ?
931 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
932 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
933 :
934 #endif
935 gnutls_certificate_set_x509_trust_file(state->x509_cred,
936 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
937 }
938
939 if (cert_count < 0)
940 {
941 rc = cert_count;
942 exim_gnutls_err_check(US"setting certificate trust");
943 }
944 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
945
946 if (state->tls_crl && *state->tls_crl &&
947 state->exp_tls_crl && *state->exp_tls_crl)
948 {
949 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
950 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
951 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
952 if (cert_count < 0)
953 {
954 rc = cert_count;
955 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
956 }
957 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
958 }
959
960 return OK;
961 }
962
963
964
965
966 /*************************************************
967 * Set X.509 state variables *
968 *************************************************/
969
970 /* In GnuTLS, the registered cert/key are not replaced by a later
971 set of a cert/key, so for SNI support we need a whole new x509_cred
972 structure. Which means various other non-re-expanded pieces of state
973 need to be re-set in the new struct, so the setting logic is pulled
974 out to this.
975
976 Arguments:
977 state exim_gnutls_state_st *
978
979 Returns: OK/DEFER/FAIL
980 */
981
982 static int
983 tls_set_remaining_x509(exim_gnutls_state_st *state)
984 {
985 int rc;
986 const host_item *host = state->host; /* macro should be reconsidered? */
987
988 /* Create D-H parameters, or read them from the cache file. This function does
989 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
990 client-side params. */
991
992 if (!state->host)
993 {
994 if (!dh_server_params)
995 {
996 rc = init_server_dh();
997 if (rc != OK) return rc;
998 }
999 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1000 }
1001
1002 /* Link the credentials to the session. */
1003
1004 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1005 exim_gnutls_err_check(US"gnutls_credentials_set");
1006
1007 return OK;
1008 }
1009
1010 /*************************************************
1011 * Initialize for GnuTLS *
1012 *************************************************/
1013
1014 /* Called from both server and client code. In the case of a server, errors
1015 before actual TLS negotiation return DEFER.
1016
1017 Arguments:
1018 host connected host, if client; NULL if server
1019 certificate certificate file
1020 privatekey private key file
1021 sni TLS SNI to send, sometimes when client; else NULL
1022 cas CA certs file
1023 crl CRL file
1024 require_ciphers tls_require_ciphers setting
1025 caller_state returned state-info structure
1026
1027 Returns: OK/DEFER/FAIL
1028 */
1029
1030 static int
1031 tls_init(
1032 const host_item *host,
1033 const uschar *certificate,
1034 const uschar *privatekey,
1035 const uschar *sni,
1036 const uschar *cas,
1037 const uschar *crl,
1038 const uschar *require_ciphers,
1039 exim_gnutls_state_st **caller_state)
1040 {
1041 exim_gnutls_state_st *state;
1042 int rc;
1043 size_t sz;
1044 const char *errpos;
1045 uschar *p;
1046 BOOL want_default_priorities;
1047
1048 if (!exim_gnutls_base_init_done)
1049 {
1050 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1051
1052 #ifdef HAVE_GNUTLS_PKCS11
1053 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1054 which loads modules from a config file, which sounds good and may be wanted
1055 by some sysadmin, but also means in common configurations that GNOME keyring
1056 environment variables are used and so breaks for users calling mailq.
1057 To prevent this, we init PKCS11 first, which is the documented approach. */
1058 if (!gnutls_allow_auto_pkcs11)
1059 {
1060 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1061 exim_gnutls_err_check(US"gnutls_pkcs11_init");
1062 }
1063 #endif
1064
1065 rc = gnutls_global_init();
1066 exim_gnutls_err_check(US"gnutls_global_init");
1067
1068 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1069 DEBUG(D_tls)
1070 {
1071 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1072 /* arbitrarily chosen level; bump upto 9 for more */
1073 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1074 }
1075 #endif
1076
1077 exim_gnutls_base_init_done = TRUE;
1078 }
1079
1080 if (host)
1081 {
1082 state = &state_client;
1083 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1084 state->tlsp = &tls_out;
1085 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1086 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1087 }
1088 else
1089 {
1090 state = &state_server;
1091 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1092 state->tlsp = &tls_in;
1093 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1094 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1095 }
1096 exim_gnutls_err_check(US"gnutls_init");
1097
1098 state->host = host;
1099
1100 state->tls_certificate = certificate;
1101 state->tls_privatekey = privatekey;
1102 state->tls_require_ciphers = require_ciphers;
1103 state->tls_sni = sni;
1104 state->tls_verify_certificates = cas;
1105 state->tls_crl = crl;
1106
1107 /* This handles the variables that might get re-expanded after TLS SNI;
1108 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1109
1110 DEBUG(D_tls)
1111 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1112 rc = tls_expand_session_files(state);
1113 if (rc != OK) return rc;
1114
1115 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1116 requires a new structure afterwards. */
1117
1118 rc = tls_set_remaining_x509(state);
1119 if (rc != OK) return rc;
1120
1121 /* set SNI in client, only */
1122 if (host)
1123 {
1124 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni))
1125 return DEFER;
1126 if (state->tlsp->sni && *state->tlsp->sni)
1127 {
1128 DEBUG(D_tls)
1129 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1130 sz = Ustrlen(state->tlsp->sni);
1131 rc = gnutls_server_name_set(state->session,
1132 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
1133 exim_gnutls_err_check(US"gnutls_server_name_set");
1134 }
1135 }
1136 else if (state->tls_sni)
1137 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1138 "have an SNI set for a client [%s]\n", state->tls_sni);
1139
1140 /* This is the priority string support,
1141 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1142 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1143 This was backwards incompatible, but means Exim no longer needs to track
1144 all algorithms and provide string forms for them. */
1145
1146 want_default_priorities = TRUE;
1147
1148 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1149 {
1150 if (!expand_check_tlsvar(tls_require_ciphers))
1151 return DEFER;
1152 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1153 {
1154 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1155 state->exp_tls_require_ciphers);
1156
1157 rc = gnutls_priority_init(&state->priority_cache,
1158 CS state->exp_tls_require_ciphers, &errpos);
1159 want_default_priorities = FALSE;
1160 p = state->exp_tls_require_ciphers;
1161 }
1162 }
1163 if (want_default_priorities)
1164 {
1165 DEBUG(D_tls)
1166 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1167 exim_default_gnutls_priority);
1168 rc = gnutls_priority_init(&state->priority_cache,
1169 exim_default_gnutls_priority, &errpos);
1170 p = US exim_default_gnutls_priority;
1171 }
1172
1173 exim_gnutls_err_check(string_sprintf(
1174 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1175 p, errpos - CS p, errpos));
1176
1177 rc = gnutls_priority_set(state->session, state->priority_cache);
1178 exim_gnutls_err_check(US"gnutls_priority_set");
1179
1180 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1181
1182 /* Reduce security in favour of increased compatibility, if the admin
1183 decides to make that trade-off. */
1184 if (gnutls_compat_mode)
1185 {
1186 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1187 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1188 gnutls_session_enable_compatibility_mode(state->session);
1189 #else
1190 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1191 #endif
1192 }
1193
1194 *caller_state = state;
1195 return OK;
1196 }
1197
1198
1199
1200 /*************************************************
1201 * Extract peer information *
1202 *************************************************/
1203
1204 /* Called from both server and client code.
1205 Only this is allowed to set state->peerdn and state->have_set_peerdn
1206 and we use that to detect double-calls.
1207
1208 NOTE: the state blocks last while the TLS connection is up, which is fine
1209 for logging in the server side, but for the client side, we log after teardown
1210 in src/deliver.c. While the session is up, we can twist about states and
1211 repoint tls_* globals, but those variables used for logging or other variable
1212 expansion that happens _after_ delivery need to have a longer life-time.
1213
1214 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1215 doing this more than once per generation of a state context. We set them in
1216 the state context, and repoint tls_* to them. After the state goes away, the
1217 tls_* copies of the pointers remain valid and client delivery logging is happy.
1218
1219 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1220 don't apply.
1221
1222 Arguments:
1223 state exim_gnutls_state_st *
1224
1225 Returns: OK/DEFER/FAIL
1226 */
1227
1228 static int
1229 peer_status(exim_gnutls_state_st *state)
1230 {
1231 uschar cipherbuf[256];
1232 const gnutls_datum *cert_list;
1233 int old_pool, rc;
1234 unsigned int cert_list_size = 0;
1235 gnutls_protocol_t protocol;
1236 gnutls_cipher_algorithm_t cipher;
1237 gnutls_kx_algorithm_t kx;
1238 gnutls_mac_algorithm_t mac;
1239 gnutls_certificate_type_t ct;
1240 gnutls_x509_crt_t crt;
1241 uschar *p, *dn_buf;
1242 size_t sz;
1243
1244 if (state->have_set_peerdn)
1245 return OK;
1246 state->have_set_peerdn = TRUE;
1247
1248 state->peerdn = NULL;
1249
1250 /* tls_cipher */
1251 cipher = gnutls_cipher_get(state->session);
1252 protocol = gnutls_protocol_get_version(state->session);
1253 mac = gnutls_mac_get(state->session);
1254 kx = gnutls_kx_get(state->session);
1255
1256 string_format(cipherbuf, sizeof(cipherbuf),
1257 "%s:%s:%d",
1258 gnutls_protocol_get_name(protocol),
1259 gnutls_cipher_suite_get_name(kx, cipher, mac),
1260 (int) gnutls_cipher_get_key_size(cipher) * 8);
1261
1262 /* I don't see a way that spaces could occur, in the current GnuTLS
1263 code base, but it was a concern in the old code and perhaps older GnuTLS
1264 releases did return "TLS 1.0"; play it safe, just in case. */
1265 for (p = cipherbuf; *p != '\0'; ++p)
1266 if (isspace(*p))
1267 *p = '-';
1268 old_pool = store_pool;
1269 store_pool = POOL_PERM;
1270 state->ciphersuite = string_copy(cipherbuf);
1271 store_pool = old_pool;
1272 state->tlsp->cipher = state->ciphersuite;
1273
1274 /* tls_peerdn */
1275 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1276
1277 if (cert_list == NULL || cert_list_size == 0)
1278 {
1279 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1280 cert_list, cert_list_size);
1281 if (state->verify_requirement >= VERIFY_REQUIRED)
1282 return tls_error(US"certificate verification failed",
1283 "no certificate received from peer", state->host);
1284 return OK;
1285 }
1286
1287 ct = gnutls_certificate_type_get(state->session);
1288 if (ct != GNUTLS_CRT_X509)
1289 {
1290 const char *ctn = gnutls_certificate_type_get_name(ct);
1291 DEBUG(D_tls)
1292 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1293 if (state->verify_requirement >= VERIFY_REQUIRED)
1294 return tls_error(US"certificate verification not possible, unhandled type",
1295 ctn, state->host);
1296 return OK;
1297 }
1298
1299 #define exim_gnutls_peer_err(Label) \
1300 do { \
1301 if (rc != GNUTLS_E_SUCCESS) \
1302 { \
1303 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1304 (Label), gnutls_strerror(rc)); \
1305 if (state->verify_requirement >= VERIFY_REQUIRED) \
1306 return tls_error((Label), gnutls_strerror(rc), state->host); \
1307 return OK; \
1308 } \
1309 } while (0)
1310
1311 rc = import_cert(&cert_list[0], &crt);
1312 exim_gnutls_peer_err(US"cert 0");
1313
1314 state->tlsp->peercert = state->peercert = crt;
1315
1316 sz = 0;
1317 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1318 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1319 {
1320 exim_gnutls_peer_err(US"getting size for cert DN failed");
1321 return FAIL; /* should not happen */
1322 }
1323 dn_buf = store_get_perm(sz);
1324 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1325 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1326
1327 state->peerdn = dn_buf;
1328
1329 return OK;
1330 #undef exim_gnutls_peer_err
1331 }
1332
1333
1334
1335
1336 /*************************************************
1337 * Verify peer certificate *
1338 *************************************************/
1339
1340 /* Called from both server and client code.
1341 *Should* be using a callback registered with
1342 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1343 the peer information, but that's too new for some OSes.
1344
1345 Arguments:
1346 state exim_gnutls_state_st *
1347 error where to put an error message
1348
1349 Returns:
1350 FALSE if the session should be rejected
1351 TRUE if the cert is okay or we just don't care
1352 */
1353
1354 static BOOL
1355 verify_certificate(exim_gnutls_state_st *state, const char **error)
1356 {
1357 int rc;
1358 unsigned int verify;
1359
1360 *error = NULL;
1361
1362 if ((rc = peer_status(state)) != OK)
1363 {
1364 verify = GNUTLS_CERT_INVALID;
1365 *error = "certificate not supplied";
1366 }
1367 else
1368 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1369
1370 /* Handle the result of verification. INVALID seems to be set as well
1371 as REVOKED, but leave the test for both. */
1372
1373 if (rc < 0 ||
1374 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1375 )
1376 {
1377 state->peer_cert_verified = FALSE;
1378 if (!*error)
1379 *error = verify & GNUTLS_CERT_REVOKED
1380 ? "certificate revoked" : "certificate invalid";
1381
1382 DEBUG(D_tls)
1383 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1384 *error, state->peerdn ? state->peerdn : US"<unset>");
1385
1386 if (state->verify_requirement >= VERIFY_REQUIRED)
1387 {
1388 gnutls_alert_send(state->session,
1389 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1390 return FALSE;
1391 }
1392 DEBUG(D_tls)
1393 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1394 }
1395
1396 else
1397 {
1398 if (state->exp_tls_verify_cert_hostnames)
1399 {
1400 int sep = 0;
1401 uschar * list = state->exp_tls_verify_cert_hostnames;
1402 uschar * name;
1403 while (name = string_nextinlist(&list, &sep, NULL, 0))
1404 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1405 break;
1406 if (!name)
1407 {
1408 DEBUG(D_tls)
1409 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1410 if (state->verify_requirement >= VERIFY_REQUIRED)
1411 {
1412 gnutls_alert_send(state->session,
1413 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1414 return FALSE;
1415 }
1416 return TRUE;
1417 }
1418 }
1419 state->peer_cert_verified = TRUE;
1420 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1421 state->peerdn ? state->peerdn : US"<unset>");
1422 }
1423
1424 state->tlsp->peerdn = state->peerdn;
1425
1426 return TRUE;
1427 }
1428
1429
1430
1431
1432 /* ------------------------------------------------------------------------ */
1433 /* Callbacks */
1434
1435 /* Logging function which can be registered with
1436 * gnutls_global_set_log_function()
1437 * gnutls_global_set_log_level() 0..9
1438 */
1439 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1440 static void
1441 exim_gnutls_logger_cb(int level, const char *message)
1442 {
1443 size_t len = strlen(message);
1444 if (len < 1)
1445 {
1446 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1447 return;
1448 }
1449 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1450 message[len-1] == '\n' ? "" : "\n");
1451 }
1452 #endif
1453
1454
1455 /* Called after client hello, should handle SNI work.
1456 This will always set tls_sni (state->received_sni) if available,
1457 and may trigger presenting different certificates,
1458 if state->trigger_sni_changes is TRUE.
1459
1460 Should be registered with
1461 gnutls_handshake_set_post_client_hello_function()
1462
1463 "This callback must return 0 on success or a gnutls error code to terminate the
1464 handshake.".
1465
1466 For inability to get SNI information, we return 0.
1467 We only return non-zero if re-setup failed.
1468 Only used for server-side TLS.
1469 */
1470
1471 static int
1472 exim_sni_handling_cb(gnutls_session_t session)
1473 {
1474 char sni_name[MAX_HOST_LEN];
1475 size_t data_len = MAX_HOST_LEN;
1476 exim_gnutls_state_st *state = &state_server;
1477 unsigned int sni_type;
1478 int rc, old_pool;
1479
1480 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1481 if (rc != GNUTLS_E_SUCCESS)
1482 {
1483 DEBUG(D_tls) {
1484 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1485 debug_printf("TLS: no SNI presented in handshake.\n");
1486 else
1487 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1488 gnutls_strerror(rc), rc);
1489 };
1490 return 0;
1491 }
1492
1493 if (sni_type != GNUTLS_NAME_DNS)
1494 {
1495 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1496 return 0;
1497 }
1498
1499 /* We now have a UTF-8 string in sni_name */
1500 old_pool = store_pool;
1501 store_pool = POOL_PERM;
1502 state->received_sni = string_copyn(US sni_name, data_len);
1503 store_pool = old_pool;
1504
1505 /* We set this one now so that variable expansions below will work */
1506 state->tlsp->sni = state->received_sni;
1507
1508 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1509 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1510
1511 if (!state->trigger_sni_changes)
1512 return 0;
1513
1514 rc = tls_expand_session_files(state);
1515 if (rc != OK)
1516 {
1517 /* If the setup of certs/etc failed before handshake, TLS would not have
1518 been offered. The best we can do now is abort. */
1519 return GNUTLS_E_APPLICATION_ERROR_MIN;
1520 }
1521
1522 rc = tls_set_remaining_x509(state);
1523 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1524
1525 return 0;
1526 }
1527
1528
1529
1530 #ifndef DISABLE_OCSP
1531
1532 static int
1533 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1534 gnutls_datum_t * ocsp_response)
1535 {
1536 int ret;
1537
1538 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1539 {
1540 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1541 (char *)ptr);
1542 tls_in.ocsp = OCSP_NOT_RESP;
1543 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1544 }
1545
1546 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1547 return 0;
1548 }
1549
1550 #endif
1551
1552
1553 #ifdef EXPERIMENTAL_EVENT
1554 /*
1555 We use this callback to get observability and detail-level control
1556 for an exim TLS connection (either direction), raising a tls:cert event
1557 for each cert in the chain presented by the peer. Any event
1558 can deny verification.
1559
1560 Return 0 for the handshake to continue or non-zero to terminate.
1561 */
1562
1563 static int
1564 verify_cb(gnutls_session_t session)
1565 {
1566 const gnutls_datum * cert_list;
1567 unsigned int cert_list_size = 0;
1568 gnutls_x509_crt_t crt;
1569 int rc;
1570 uschar * yield;
1571 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1572
1573 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1574 if (cert_list)
1575 while (cert_list_size--)
1576 {
1577 rc = import_cert(&cert_list[cert_list_size], &crt);
1578 if (rc != GNUTLS_E_SUCCESS)
1579 {
1580 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1581 cert_list_size, gnutls_strerror(rc));
1582 break;
1583 }
1584
1585 state->tlsp->peercert = crt;
1586 if ((yield = event_raise(state->event_action,
1587 US"tls:cert", string_sprintf("%d", cert_list_size))))
1588 {
1589 log_write(0, LOG_MAIN,
1590 "SSL verify denied by event-action: depth=%d: %s",
1591 cert_list_size, yield);
1592 return 1; /* reject */
1593 }
1594 state->tlsp->peercert = NULL;
1595 }
1596
1597 return 0;
1598 }
1599
1600 #endif
1601
1602
1603
1604 /* ------------------------------------------------------------------------ */
1605 /* Exported functions */
1606
1607
1608
1609
1610 /*************************************************
1611 * Start a TLS session in a server *
1612 *************************************************/
1613
1614 /* This is called when Exim is running as a server, after having received
1615 the STARTTLS command. It must respond to that command, and then negotiate
1616 a TLS session.
1617
1618 Arguments:
1619 require_ciphers list of allowed ciphers or NULL
1620
1621 Returns: OK on success
1622 DEFER for errors before the start of the negotiation
1623 FAIL for errors during the negotation; the server can't
1624 continue running.
1625 */
1626
1627 int
1628 tls_server_start(const uschar *require_ciphers)
1629 {
1630 int rc;
1631 const char *error;
1632 exim_gnutls_state_st *state = NULL;
1633
1634 /* Check for previous activation */
1635 if (tls_in.active >= 0)
1636 {
1637 tls_error(US"STARTTLS received after TLS started", "", NULL);
1638 smtp_printf("554 Already in TLS\r\n");
1639 return FAIL;
1640 }
1641
1642 /* Initialize the library. If it fails, it will already have logged the error
1643 and sent an SMTP response. */
1644
1645 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
1646
1647 rc = tls_init(NULL, tls_certificate, tls_privatekey,
1648 NULL, tls_verify_certificates, tls_crl,
1649 require_ciphers, &state);
1650 if (rc != OK) return rc;
1651
1652 /* If this is a host for which certificate verification is mandatory or
1653 optional, set up appropriately. */
1654
1655 if (verify_check_host(&tls_verify_hosts) == OK)
1656 {
1657 DEBUG(D_tls)
1658 debug_printf("TLS: a client certificate will be required.\n");
1659 state->verify_requirement = VERIFY_REQUIRED;
1660 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1661 }
1662 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1663 {
1664 DEBUG(D_tls)
1665 debug_printf("TLS: a client certificate will be requested but not required.\n");
1666 state->verify_requirement = VERIFY_OPTIONAL;
1667 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1668 }
1669 else
1670 {
1671 DEBUG(D_tls)
1672 debug_printf("TLS: a client certificate will not be requested.\n");
1673 state->verify_requirement = VERIFY_NONE;
1674 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1675 }
1676
1677 #ifdef EXPERIMENTAL_EVENT
1678 if (event_action)
1679 {
1680 state->event_action = event_action;
1681 gnutls_session_set_ptr(state->session, state);
1682 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1683 }
1684 #endif
1685
1686 /* Register SNI handling; always, even if not in tls_certificate, so that the
1687 expansion variable $tls_sni is always available. */
1688
1689 gnutls_handshake_set_post_client_hello_function(state->session,
1690 exim_sni_handling_cb);
1691
1692 /* Set context and tell client to go ahead, except in the case of TLS startup
1693 on connection, where outputting anything now upsets the clients and tends to
1694 make them disconnect. We need to have an explicit fflush() here, to force out
1695 the response. Other smtp_printf() calls do not need it, because in non-TLS
1696 mode, the fflush() happens when smtp_getc() is called. */
1697
1698 if (!state->tlsp->on_connect)
1699 {
1700 smtp_printf("220 TLS go ahead\r\n");
1701 fflush(smtp_out);
1702 }
1703
1704 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1705 that the GnuTLS library doesn't. */
1706
1707 gnutls_transport_set_ptr2(state->session,
1708 (gnutls_transport_ptr)(long) fileno(smtp_in),
1709 (gnutls_transport_ptr)(long) fileno(smtp_out));
1710 state->fd_in = fileno(smtp_in);
1711 state->fd_out = fileno(smtp_out);
1712
1713 sigalrm_seen = FALSE;
1714 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1715 do
1716 {
1717 rc = gnutls_handshake(state->session);
1718 } while ((rc == GNUTLS_E_AGAIN) ||
1719 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1720 alarm(0);
1721
1722 if (rc != GNUTLS_E_SUCCESS)
1723 {
1724 tls_error(US"gnutls_handshake",
1725 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
1726 /* It seems that, except in the case of a timeout, we have to close the
1727 connection right here; otherwise if the other end is running OpenSSL it hangs
1728 until the server times out. */
1729
1730 if (!sigalrm_seen)
1731 {
1732 (void)fclose(smtp_out);
1733 (void)fclose(smtp_in);
1734 }
1735
1736 return FAIL;
1737 }
1738
1739 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1740
1741 /* Verify after the fact */
1742
1743 if ( state->verify_requirement != VERIFY_NONE
1744 && !verify_certificate(state, &error))
1745 {
1746 if (state->verify_requirement != VERIFY_OPTIONAL)
1747 {
1748 tls_error(US"certificate verification failed", error, NULL);
1749 return FAIL;
1750 }
1751 DEBUG(D_tls)
1752 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1753 error);
1754 }
1755
1756 /* Figure out peer DN, and if authenticated, etc. */
1757
1758 rc = peer_status(state);
1759 if (rc != OK) return rc;
1760
1761 /* Sets various Exim expansion variables; always safe within server */
1762
1763 extract_exim_vars_from_tls_state(state);
1764
1765 /* TLS has been set up. Adjust the input functions to read via TLS,
1766 and initialize appropriately. */
1767
1768 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1769
1770 receive_getc = tls_getc;
1771 receive_ungetc = tls_ungetc;
1772 receive_feof = tls_feof;
1773 receive_ferror = tls_ferror;
1774 receive_smtp_buffered = tls_smtp_buffered;
1775
1776 return OK;
1777 }
1778
1779
1780
1781
1782 static void
1783 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
1784 smtp_transport_options_block * ob)
1785 {
1786 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
1787 {
1788 state->exp_tls_verify_cert_hostnames = host->name;
1789 DEBUG(D_tls)
1790 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
1791 state->exp_tls_verify_cert_hostnames);
1792 }
1793 }
1794
1795
1796 /*************************************************
1797 * Start a TLS session in a client *
1798 *************************************************/
1799
1800 /* Called from the smtp transport after STARTTLS has been accepted.
1801
1802 Arguments:
1803 fd the fd of the connection
1804 host connected host (for messages)
1805 addr the first address (not used)
1806 tb transport (always smtp)
1807
1808 Returns: OK/DEFER/FAIL (because using common functions),
1809 but for a client, DEFER and FAIL have the same meaning
1810 */
1811
1812 int
1813 tls_client_start(int fd, host_item *host,
1814 address_item *addr ARG_UNUSED,
1815 transport_instance *tb
1816 #ifdef EXPERIMENTAL_DANE
1817 , dne_answer * unused_tlsa_dnsa
1818 #endif
1819 )
1820 {
1821 smtp_transport_options_block *ob =
1822 (smtp_transport_options_block *)tb->options_block;
1823 int rc;
1824 const char *error;
1825 exim_gnutls_state_st *state = NULL;
1826 #ifndef DISABLE_OCSP
1827 BOOL require_ocsp =
1828 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
1829 BOOL request_ocsp = require_ocsp ? TRUE
1830 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
1831 #endif
1832
1833 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
1834
1835 if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
1836 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
1837 ob->tls_require_ciphers, &state)) != OK)
1838 return rc;
1839
1840 {
1841 int dh_min_bits = ob->tls_dh_min_bits;
1842 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1843 {
1844 DEBUG(D_tls)
1845 debug_printf("WARNING: tls_dh_min_bits far too low,"
1846 " clamping %d up to %d\n",
1847 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1848 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1849 }
1850
1851 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
1852 " acceptable bits to %d\n",
1853 dh_min_bits);
1854 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1855 }
1856
1857 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
1858 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
1859 the specified host patterns if one of them is defined */
1860
1861 if ( ( state->exp_tls_verify_certificates
1862 && !ob->tls_verify_hosts
1863 && !ob->tls_try_verify_hosts
1864 )
1865 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
1866 )
1867 {
1868 tls_client_setup_hostname_checks(host, state, ob);
1869 DEBUG(D_tls)
1870 debug_printf("TLS: server certificate verification required.\n");
1871 state->verify_requirement = VERIFY_REQUIRED;
1872 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1873 }
1874 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
1875 {
1876 tls_client_setup_hostname_checks(host, state, ob);
1877 DEBUG(D_tls)
1878 debug_printf("TLS: server certificate verification optional.\n");
1879 state->verify_requirement = VERIFY_OPTIONAL;
1880 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1881 }
1882 else
1883 {
1884 DEBUG(D_tls)
1885 debug_printf("TLS: server certificate verification not required.\n");
1886 state->verify_requirement = VERIFY_NONE;
1887 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1888 }
1889
1890 #ifndef DISABLE_OCSP
1891 /* supported since GnuTLS 3.1.3 */
1892 if (request_ocsp)
1893 {
1894 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
1895 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
1896 NULL, 0, NULL)) != OK)
1897 return tls_error(US"cert-status-req",
1898 gnutls_strerror(rc), state->host);
1899 tls_out.ocsp = OCSP_NOT_RESP;
1900 }
1901 #endif
1902
1903 #ifdef EXPERIMENTAL_EVENT
1904 if (tb->event_action)
1905 {
1906 state->event_action = tb->event_action;
1907 gnutls_session_set_ptr(state->session, state);
1908 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1909 }
1910 #endif
1911
1912 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)(long) fd);
1913 state->fd_in = fd;
1914 state->fd_out = fd;
1915
1916 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
1917 /* There doesn't seem to be a built-in timeout on connection. */
1918
1919 sigalrm_seen = FALSE;
1920 alarm(ob->command_timeout);
1921 do
1922 {
1923 rc = gnutls_handshake(state->session);
1924 } while ((rc == GNUTLS_E_AGAIN) ||
1925 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
1926 alarm(0);
1927
1928 if (rc != GNUTLS_E_SUCCESS)
1929 return tls_error(US"gnutls_handshake",
1930 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1931
1932 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1933
1934 /* Verify late */
1935
1936 if (state->verify_requirement != VERIFY_NONE &&
1937 !verify_certificate(state, &error))
1938 return tls_error(US"certificate verification failed", error, state->host);
1939
1940 #ifndef DISABLE_OCSP
1941 if (require_ocsp)
1942 {
1943 DEBUG(D_tls)
1944 {
1945 gnutls_datum_t stapling;
1946 gnutls_ocsp_resp_t resp;
1947 gnutls_datum_t printed;
1948 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
1949 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
1950 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
1951 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
1952 )
1953 {
1954 debug_printf("%.4096s", printed.data);
1955 gnutls_free(printed.data);
1956 }
1957 else
1958 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host);
1959 }
1960
1961 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
1962 {
1963 tls_out.ocsp = OCSP_FAILED;
1964 return tls_error(US"certificate status check failed", NULL, state->host);
1965 }
1966 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
1967 tls_out.ocsp = OCSP_VFIED;
1968 }
1969 #endif
1970
1971 /* Figure out peer DN, and if authenticated, etc. */
1972
1973 if ((rc = peer_status(state)) != OK)
1974 return rc;
1975
1976 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
1977
1978 extract_exim_vars_from_tls_state(state);
1979
1980 return OK;
1981 }
1982
1983
1984
1985
1986 /*************************************************
1987 * Close down a TLS session *
1988 *************************************************/
1989
1990 /* This is also called from within a delivery subprocess forked from the
1991 daemon, to shut down the TLS library, without actually doing a shutdown (which
1992 would tamper with the TLS session in the parent process).
1993
1994 Arguments: TRUE if gnutls_bye is to be called
1995 Returns: nothing
1996 */
1997
1998 void
1999 tls_close(BOOL is_server, BOOL shutdown)
2000 {
2001 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2002
2003 if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
2004
2005 if (shutdown)
2006 {
2007 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
2008 gnutls_bye(state->session, GNUTLS_SHUT_WR);
2009 }
2010
2011 gnutls_deinit(state->session);
2012
2013 state->tlsp->active = -1;
2014 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2015
2016 if ((state_server.session == NULL) && (state_client.session == NULL))
2017 {
2018 gnutls_global_deinit();
2019 exim_gnutls_base_init_done = FALSE;
2020 }
2021
2022 }
2023
2024
2025
2026
2027 /*************************************************
2028 * TLS version of getc *
2029 *************************************************/
2030
2031 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2032 it refills the buffer via the GnuTLS reading function.
2033 Only used by the server-side TLS.
2034
2035 This feeds DKIM and should be used for all message-body reads.
2036
2037 Arguments: none
2038 Returns: the next character or EOF
2039 */
2040
2041 int
2042 tls_getc(void)
2043 {
2044 exim_gnutls_state_st *state = &state_server;
2045 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2046 {
2047 ssize_t inbytes;
2048
2049 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2050 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2051
2052 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2053 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2054 ssl_xfer_buffer_size);
2055 alarm(0);
2056
2057 /* A zero-byte return appears to mean that the TLS session has been
2058 closed down, not that the socket itself has been closed down. Revert to
2059 non-TLS handling. */
2060
2061 if (inbytes == 0)
2062 {
2063 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2064
2065 receive_getc = smtp_getc;
2066 receive_ungetc = smtp_ungetc;
2067 receive_feof = smtp_feof;
2068 receive_ferror = smtp_ferror;
2069 receive_smtp_buffered = smtp_buffered;
2070
2071 gnutls_deinit(state->session);
2072 state->session = NULL;
2073 state->tlsp->active = -1;
2074 state->tlsp->bits = 0;
2075 state->tlsp->certificate_verified = FALSE;
2076 tls_channelbinding_b64 = NULL;
2077 state->tlsp->cipher = NULL;
2078 state->tlsp->peercert = NULL;
2079 state->tlsp->peerdn = NULL;
2080
2081 return smtp_getc();
2082 }
2083
2084 /* Handle genuine errors */
2085
2086 else if (inbytes < 0)
2087 {
2088 record_io_error(state, (int) inbytes, US"recv", NULL);
2089 state->xfer_error = 1;
2090 return EOF;
2091 }
2092 #ifndef DISABLE_DKIM
2093 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2094 #endif
2095 state->xfer_buffer_hwm = (int) inbytes;
2096 state->xfer_buffer_lwm = 0;
2097 }
2098
2099 /* Something in the buffer; return next uschar */
2100
2101 return state->xfer_buffer[state->xfer_buffer_lwm++];
2102 }
2103
2104
2105
2106
2107 /*************************************************
2108 * Read bytes from TLS channel *
2109 *************************************************/
2110
2111 /* This does not feed DKIM, so if the caller uses this for reading message body,
2112 then the caller must feed DKIM.
2113
2114 Arguments:
2115 buff buffer of data
2116 len size of buffer
2117
2118 Returns: the number of bytes read
2119 -1 after a failed read
2120 */
2121
2122 int
2123 tls_read(BOOL is_server, uschar *buff, size_t len)
2124 {
2125 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2126 ssize_t inbytes;
2127
2128 if (len > INT_MAX)
2129 len = INT_MAX;
2130
2131 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2132 DEBUG(D_tls)
2133 debug_printf("*** PROBABLY A BUG *** " \
2134 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2135 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2136
2137 DEBUG(D_tls)
2138 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2139 state->session, buff, len);
2140
2141 inbytes = gnutls_record_recv(state->session, buff, len);
2142 if (inbytes > 0) return inbytes;
2143 if (inbytes == 0)
2144 {
2145 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2146 }
2147 else record_io_error(state, (int)inbytes, US"recv", NULL);
2148
2149 return -1;
2150 }
2151
2152
2153
2154
2155 /*************************************************
2156 * Write bytes down TLS channel *
2157 *************************************************/
2158
2159 /*
2160 Arguments:
2161 is_server channel specifier
2162 buff buffer of data
2163 len number of bytes
2164
2165 Returns: the number of bytes after a successful write,
2166 -1 after a failed write
2167 */
2168
2169 int
2170 tls_write(BOOL is_server, const uschar *buff, size_t len)
2171 {
2172 ssize_t outbytes;
2173 size_t left = len;
2174 exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
2175
2176 DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
2177 while (left > 0)
2178 {
2179 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2180 buff, left);
2181 outbytes = gnutls_record_send(state->session, buff, left);
2182
2183 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
2184 if (outbytes < 0)
2185 {
2186 record_io_error(state, outbytes, US"send", NULL);
2187 return -1;
2188 }
2189 if (outbytes == 0)
2190 {
2191 record_io_error(state, 0, US"send", US"TLS channel closed on write");
2192 return -1;
2193 }
2194
2195 left -= outbytes;
2196 buff += outbytes;
2197 }
2198
2199 if (len > INT_MAX)
2200 {
2201 DEBUG(D_tls)
2202 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2203 len);
2204 len = INT_MAX;
2205 }
2206
2207 return (int) len;
2208 }
2209
2210
2211
2212
2213 /*************************************************
2214 * Random number generation *
2215 *************************************************/
2216
2217 /* Pseudo-random number generation. The result is not expected to be
2218 cryptographically strong but not so weak that someone will shoot themselves
2219 in the foot using it as a nonce in input in some email header scheme or
2220 whatever weirdness they'll twist this into. The result should handle fork()
2221 and avoid repeating sequences. OpenSSL handles that for us.
2222
2223 Arguments:
2224 max range maximum
2225 Returns a random number in range [0, max-1]
2226 */
2227
2228 #ifdef HAVE_GNUTLS_RND
2229 int
2230 vaguely_random_number(int max)
2231 {
2232 unsigned int r;
2233 int i, needed_len;
2234 uschar *p;
2235 uschar smallbuf[sizeof(r)];
2236
2237 if (max <= 1)
2238 return 0;
2239
2240 needed_len = sizeof(r);
2241 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2242 * asked for a number less than 10. */
2243 for (r = max, i = 0; r; ++i)
2244 r >>= 1;
2245 i = (i + 7) / 8;
2246 if (i < needed_len)
2247 needed_len = i;
2248
2249 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2250 if (i < 0)
2251 {
2252 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2253 return vaguely_random_number_fallback(max);
2254 }
2255 r = 0;
2256 for (p = smallbuf; needed_len; --needed_len, ++p)
2257 {
2258 r *= 256;
2259 r += *p;
2260 }
2261
2262 /* We don't particularly care about weighted results; if someone wants
2263 * smooth distribution and cares enough then they should submit a patch then. */
2264 return r % max;
2265 }
2266 #else /* HAVE_GNUTLS_RND */
2267 int
2268 vaguely_random_number(int max)
2269 {
2270 return vaguely_random_number_fallback(max);
2271 }
2272 #endif /* HAVE_GNUTLS_RND */
2273
2274
2275
2276
2277 /*************************************************
2278 * Let tls_require_ciphers be checked at startup *
2279 *************************************************/
2280
2281 /* The tls_require_ciphers option, if set, must be something which the
2282 library can parse.
2283
2284 Returns: NULL on success, or error message
2285 */
2286
2287 uschar *
2288 tls_validate_require_cipher(void)
2289 {
2290 int rc;
2291 uschar *expciphers = NULL;
2292 gnutls_priority_t priority_cache;
2293 const char *errpos;
2294
2295 #define validate_check_rc(Label) do { \
2296 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2297 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2298 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2299
2300 if (exim_gnutls_base_init_done)
2301 log_write(0, LOG_MAIN|LOG_PANIC,
2302 "already initialised GnuTLS, Exim developer bug");
2303
2304 #ifdef HAVE_GNUTLS_PKCS11
2305 if (!gnutls_allow_auto_pkcs11)
2306 {
2307 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2308 validate_check_rc(US"gnutls_pkcs11_init");
2309 }
2310 #endif
2311 rc = gnutls_global_init();
2312 validate_check_rc(US"gnutls_global_init()");
2313 exim_gnutls_base_init_done = TRUE;
2314
2315 if (!(tls_require_ciphers && *tls_require_ciphers))
2316 return_deinit(NULL);
2317
2318 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2319 return_deinit(US"failed to expand tls_require_ciphers");
2320
2321 if (!(expciphers && *expciphers))
2322 return_deinit(NULL);
2323
2324 DEBUG(D_tls)
2325 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2326
2327 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2328 validate_check_rc(string_sprintf(
2329 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2330 expciphers, errpos - CS expciphers, errpos));
2331
2332 #undef return_deinit
2333 #undef validate_check_rc
2334 gnutls_global_deinit();
2335
2336 return NULL;
2337 }
2338
2339
2340
2341
2342 /*************************************************
2343 * Report the library versions. *
2344 *************************************************/
2345
2346 /* See a description in tls-openssl.c for an explanation of why this exists.
2347
2348 Arguments: a FILE* to print the results to
2349 Returns: nothing
2350 */
2351
2352 void
2353 tls_version_report(FILE *f)
2354 {
2355 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2356 " Runtime: %s\n",
2357 LIBGNUTLS_VERSION,
2358 gnutls_check_version(NULL));
2359 }
2360
2361 /* vi: aw ai sw=2
2362 */
2363 /* End of tls-gnu.c */