Revert "Avoid repeated string-copy building command-string for rspamd"
[exim.git] / src / src / tls-gnu.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Copyright (c) Phil Pennock 2012 */
9
10 /* This file provides TLS/SSL support for Exim using the GnuTLS library,
11 one of the available supported implementations. This file is #included into
12 tls.c when USE_GNUTLS has been set.
13
14 The code herein is a revamp of GnuTLS integration using the current APIs; the
15 original tls-gnu.c was based on a patch which was contributed by Nikos
16 Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17 appropriate.
18
19 APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20 which is not widely deployed by OS vendors. Will note issues below, which may
21 assist in updating the code in the future. Another sources of hints is
22 mod_gnutls for Apache (SNI callback registration and handling).
23
24 Keeping client and server variables more split than before and is currently
25 the norm, in anticipation of TLS in ACL callouts.
26
27 I wanted to switch to gnutls_certificate_set_verify_function() so that
28 certificate rejection could happen during handshake where it belongs, rather
29 than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30 (6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
31
32 (I wasn't looking for libraries quite that old, when updating to get rid of
33 compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34 require current GnuTLS, then we'll drop support for the ancient libraries).
35 */
36
37 #include <gnutls/gnutls.h>
38 /* needed for cert checks in verification and DN extraction: */
39 #include <gnutls/x509.h>
40 /* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41 #include <gnutls/crypto.h>
42 /* needed to disable PKCS11 autoload unless requested */
43 #if GNUTLS_VERSION_NUMBER >= 0x020c00
44 # include <gnutls/pkcs11.h>
45 # define SUPPORT_PARAM_TO_PK_BITS
46 #endif
47 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
48 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
49 # define DISABLE_OCSP
50 #endif
51 #if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
52 # warning "GnuTLS library version too old; tls:cert event unsupported"
53 # define DISABLE_EVENT
54 #endif
55 #if GNUTLS_VERSION_NUMBER >= 0x030306
56 # define SUPPORT_CA_DIR
57 #else
58 # undef SUPPORT_CA_DIR
59 #endif
60 #if GNUTLS_VERSION_NUMBER >= 0x030014
61 # define SUPPORT_SYSDEFAULT_CABUNDLE
62 #endif
63 #if GNUTLS_VERSION_NUMBER >= 0x030109
64 # define SUPPORT_CORK
65 #endif
66 #if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
67 # define SUPPORT_SRV_OCSP_STACK
68 #endif
69
70 #ifdef SUPPORT_DANE
71 # if GNUTLS_VERSION_NUMBER >= 0x030000
72 # define DANESSL_USAGE_DANE_TA 2
73 # define DANESSL_USAGE_DANE_EE 3
74 # else
75 # error GnuTLS version too early for DANE
76 # endif
77 # if GNUTLS_VERSION_NUMBER < 0x999999
78 # define GNUTLS_BROKEN_DANE_VALIDATION
79 # endif
80 #endif
81
82 #ifndef DISABLE_OCSP
83 # include <gnutls/ocsp.h>
84 #endif
85 #ifdef SUPPORT_DANE
86 # include <gnutls/dane.h>
87 #endif
88
89 /* GnuTLS 2 vs 3
90
91 GnuTLS 3 only:
92 gnutls_global_set_audit_log_function()
93
94 Changes:
95 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
96 */
97
98 /* Local static variables for GnuTLS */
99
100 /* Values for verify_requirement */
101
102 enum peer_verify_requirement
103 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
104
105 /* This holds most state for server or client; with this, we can set up an
106 outbound TLS-enabled connection in an ACL callout, while not stomping all
107 over the TLS variables available for expansion.
108
109 Some of these correspond to variables in globals.c; those variables will
110 be set to point to content in one of these instances, as appropriate for
111 the stage of the process lifetime.
112
113 Not handled here: global tls_channelbinding_b64.
114 */
115
116 typedef struct exim_gnutls_state {
117 gnutls_session_t session;
118 gnutls_certificate_credentials_t x509_cred;
119 gnutls_priority_t priority_cache;
120 enum peer_verify_requirement verify_requirement;
121 int fd_in;
122 int fd_out;
123 BOOL peer_cert_verified;
124 BOOL peer_dane_verified;
125 BOOL trigger_sni_changes;
126 BOOL have_set_peerdn;
127 const struct host_item *host;
128 gnutls_x509_crt_t peercert;
129 uschar *peerdn;
130 uschar *ciphersuite;
131 uschar *received_sni;
132
133 const uschar *tls_certificate;
134 const uschar *tls_privatekey;
135 const uschar *tls_sni; /* client send only, not received */
136 const uschar *tls_verify_certificates;
137 const uschar *tls_crl;
138 const uschar *tls_require_ciphers;
139
140 uschar *exp_tls_certificate;
141 uschar *exp_tls_privatekey;
142 uschar *exp_tls_verify_certificates;
143 uschar *exp_tls_crl;
144 uschar *exp_tls_require_ciphers;
145 const uschar *exp_tls_verify_cert_hostnames;
146 #ifndef DISABLE_EVENT
147 uschar *event_action;
148 #endif
149 #ifdef SUPPORT_DANE
150 char * const * dane_data;
151 const int * dane_data_len;
152 #endif
153
154 tls_support *tlsp; /* set in tls_init() */
155
156 uschar *xfer_buffer;
157 int xfer_buffer_lwm;
158 int xfer_buffer_hwm;
159 BOOL xfer_eof; /*XXX never gets set! */
160 BOOL xfer_error;
161 } exim_gnutls_state_st;
162
163 static const exim_gnutls_state_st exim_gnutls_state_init = {
164 .session = NULL,
165 .x509_cred = NULL,
166 .priority_cache = NULL,
167 .verify_requirement = VERIFY_NONE,
168 .fd_in = -1,
169 .fd_out = -1,
170 .peer_cert_verified = FALSE,
171 .peer_dane_verified = FALSE,
172 .trigger_sni_changes =FALSE,
173 .have_set_peerdn = FALSE,
174 .host = NULL,
175 .peercert = NULL,
176 .peerdn = NULL,
177 .ciphersuite = NULL,
178 .received_sni = NULL,
179
180 .tls_certificate = NULL,
181 .tls_privatekey = NULL,
182 .tls_sni = NULL,
183 .tls_verify_certificates = NULL,
184 .tls_crl = NULL,
185 .tls_require_ciphers =NULL,
186
187 .exp_tls_certificate = NULL,
188 .exp_tls_privatekey = NULL,
189 .exp_tls_verify_certificates = NULL,
190 .exp_tls_crl = NULL,
191 .exp_tls_require_ciphers = NULL,
192 .exp_tls_verify_cert_hostnames = NULL,
193 #ifndef DISABLE_EVENT
194 .event_action = NULL,
195 #endif
196 .tlsp = NULL,
197
198 .xfer_buffer = NULL,
199 .xfer_buffer_lwm = 0,
200 .xfer_buffer_hwm = 0,
201 .xfer_eof = FALSE,
202 .xfer_error = FALSE,
203 };
204
205 /* Not only do we have our own APIs which don't pass around state, assuming
206 it's held in globals, GnuTLS doesn't appear to let us register callback data
207 for callbacks, or as part of the session, so we have to keep a "this is the
208 context we're currently dealing with" pointer and rely upon being
209 single-threaded to keep from processing data on an inbound TLS connection while
210 talking to another TLS connection for an outbound check. This does mean that
211 there's no way for heart-beats to be responded to, for the duration of the
212 second connection.
213 XXX But see gnutls_session_get_ptr()
214 */
215
216 static exim_gnutls_state_st state_server;
217
218 /* dh_params are initialised once within the lifetime of a process using TLS;
219 if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
220 don't want to repeat this. */
221
222 static gnutls_dh_params_t dh_server_params = NULL;
223
224 /* No idea how this value was chosen; preserving it. Default is 3600. */
225
226 static const int ssl_session_timeout = 200;
227
228 static const char * const exim_default_gnutls_priority = "NORMAL";
229
230 /* Guard library core initialisation */
231
232 static BOOL exim_gnutls_base_init_done = FALSE;
233
234 #ifndef DISABLE_OCSP
235 static BOOL gnutls_buggy_ocsp = FALSE;
236 #endif
237
238
239 /* ------------------------------------------------------------------------ */
240 /* macros */
241
242 #define MAX_HOST_LEN 255
243
244 /* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
245 the library logging; a value less than 0 disables the calls to set up logging
246 callbacks. Possibly GNuTLS also looks for an environment variable
247 "GNUTLS_DEBUG_LEVEL". */
248 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
249 # define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
250 #endif
251
252 #ifndef EXIM_CLIENT_DH_MIN_BITS
253 # define EXIM_CLIENT_DH_MIN_BITS 1024
254 #endif
255
256 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
257 can ask for a bit-strength. Without that, we stick to the constant we had
258 before, for now. */
259 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
260 # define EXIM_SERVER_DH_BITS_PRE2_12 1024
261 #endif
262
263 #define exim_gnutls_err_check(rc, Label) do { \
264 if ((rc) != GNUTLS_E_SUCCESS) \
265 return tls_error((Label), gnutls_strerror(rc), host, errstr); \
266 } while (0)
267
268 #define expand_check_tlsvar(Varname, errstr) \
269 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
270
271 #if GNUTLS_VERSION_NUMBER >= 0x020c00
272 # define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
273 # define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
274 # define HAVE_GNUTLS_RND
275 /* The security fix we provide with the gnutls_allow_auto_pkcs11 option
276 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
277 * isn't available sometimes, so this needs to become a conditional
278 * compilation; the sanest way to deal with this being a problem on
279 * older OSes is to block it in the Local/Makefile with this compiler
280 * definition */
281 # ifndef AVOID_GNUTLS_PKCS11
282 # define HAVE_GNUTLS_PKCS11
283 # endif /* AVOID_GNUTLS_PKCS11 */
284 #endif
285
286
287
288
289 /* ------------------------------------------------------------------------ */
290 /* Callback declarations */
291
292 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
293 static void exim_gnutls_logger_cb(int level, const char *message);
294 #endif
295
296 static int exim_sni_handling_cb(gnutls_session_t session);
297
298 #ifndef DISABLE_OCSP
299 static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
300 gnutls_datum_t * ocsp_response);
301 #endif
302
303
304
305 /* ------------------------------------------------------------------------ */
306 /* Static functions */
307
308 /*************************************************
309 * Handle TLS error *
310 *************************************************/
311
312 /* Called from lots of places when errors occur before actually starting to do
313 the TLS handshake, that is, while the session is still in clear. Always returns
314 DEFER for a server and FAIL for a client so that most calls can use "return
315 tls_error(...)" to do this processing and then give an appropriate return. A
316 single function is used for both server and client, because it is called from
317 some shared functions.
318
319 Argument:
320 prefix text to include in the logged error
321 msg additional error string (may be NULL)
322 usually obtained from gnutls_strerror()
323 host NULL if setting up a server;
324 the connected host if setting up a client
325 errstr pointer to returned error string
326
327 Returns: OK/DEFER/FAIL
328 */
329
330 static int
331 tls_error(const uschar *prefix, const char *msg, const host_item *host,
332 uschar ** errstr)
333 {
334 if (errstr)
335 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : "");
336 return host ? FAIL : DEFER;
337 }
338
339
340
341
342 /*************************************************
343 * Deal with logging errors during I/O *
344 *************************************************/
345
346 /* We have to get the identity of the peer from saved data.
347
348 Argument:
349 state the current GnuTLS exim state container
350 rc the GnuTLS error code, or 0 if it's a local error
351 when text identifying read or write
352 text local error text when ec is 0
353
354 Returns: nothing
355 */
356
357 static void
358 record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
359 {
360 const char * msg;
361 uschar * errstr;
362
363 if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
364 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
365 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
366 else
367 msg = gnutls_strerror(rc);
368
369 (void) tls_error(when, msg, state->host, &errstr);
370
371 if (state->host)
372 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
373 state->host->name, state->host->address, errstr);
374 else
375 {
376 uschar * conn_info = smtp_get_connection_info();
377 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
378 /* I'd like to get separated H= here, but too hard for now */
379 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
380 }
381 }
382
383
384
385
386 /*************************************************
387 * Set various Exim expansion vars *
388 *************************************************/
389
390 #define exim_gnutls_cert_err(Label) \
391 do \
392 { \
393 if (rc != GNUTLS_E_SUCCESS) \
394 { \
395 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
396 (Label), gnutls_strerror(rc)); \
397 return rc; \
398 } \
399 } while (0)
400
401 static int
402 import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
403 {
404 int rc;
405
406 rc = gnutls_x509_crt_init(crtp);
407 exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
408
409 rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
410 exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
411
412 return rc;
413 }
414
415 #undef exim_gnutls_cert_err
416
417
418 /* We set various Exim global variables from the state, once a session has
419 been established. With TLS callouts, may need to change this to stack
420 variables, or just re-call it with the server state after client callout
421 has finished.
422
423 Make sure anything set here is unset in tls_getc().
424
425 Sets:
426 tls_active fd
427 tls_bits strength indicator
428 tls_certificate_verified bool indicator
429 tls_channelbinding_b64 for some SASL mechanisms
430 tls_cipher a string
431 tls_peercert pointer to library internal
432 tls_peerdn a string
433 tls_sni a (UTF-8) string
434 tls_ourcert pointer to library internal
435
436 Argument:
437 state the relevant exim_gnutls_state_st *
438 */
439
440 static void
441 extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
442 {
443 gnutls_cipher_algorithm_t cipher;
444 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
445 int old_pool;
446 int rc;
447 gnutls_datum_t channel;
448 #endif
449 tls_support * tlsp = state->tlsp;
450
451 tlsp->active.sock = state->fd_out;
452 tlsp->active.tls_ctx = state;
453
454 cipher = gnutls_cipher_get(state->session);
455 /* returns size in "bytes" */
456 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
457
458 tlsp->cipher = state->ciphersuite;
459
460 DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
461
462 tlsp->certificate_verified = state->peer_cert_verified;
463 #ifdef SUPPORT_DANE
464 tlsp->dane_verified = state->peer_dane_verified;
465 #endif
466
467 /* note that tls_channelbinding_b64 is not saved to the spool file, since it's
468 only available for use for authenticators while this TLS session is running. */
469
470 tls_channelbinding_b64 = NULL;
471 #ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
472 channel.data = NULL;
473 channel.size = 0;
474 rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
475 if (rc) {
476 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
477 } else {
478 old_pool = store_pool;
479 store_pool = POOL_PERM;
480 tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
481 store_pool = old_pool;
482 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
483 }
484 #endif
485
486 /* peercert is set in peer_status() */
487 tlsp->peerdn = state->peerdn;
488 tlsp->sni = state->received_sni;
489
490 /* record our certificate */
491 {
492 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
493 gnutls_x509_crt_t crt;
494
495 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
496 }
497 }
498
499
500
501
502 /*************************************************
503 * Setup up DH parameters *
504 *************************************************/
505
506 /* Generating the D-H parameters may take a long time. They only need to
507 be re-generated every so often, depending on security policy. What we do is to
508 keep these parameters in a file in the spool directory. If the file does not
509 exist, we generate them. This means that it is easy to cause a regeneration.
510
511 The new file is written as a temporary file and renamed, so that an incomplete
512 file is never present. If two processes both compute some new parameters, you
513 waste a bit of effort, but it doesn't seem worth messing around with locking to
514 prevent this.
515
516 Returns: OK/DEFER/FAIL
517 */
518
519 static int
520 init_server_dh(uschar ** errstr)
521 {
522 int fd, rc;
523 unsigned int dh_bits;
524 gnutls_datum_t m;
525 uschar filename_buf[PATH_MAX];
526 uschar *filename = NULL;
527 size_t sz;
528 uschar *exp_tls_dhparam;
529 BOOL use_file_in_spool = FALSE;
530 BOOL use_fixed_file = FALSE;
531 host_item *host = NULL; /* dummy for macros */
532
533 DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
534
535 rc = gnutls_dh_params_init(&dh_server_params);
536 exim_gnutls_err_check(rc, US"gnutls_dh_params_init");
537
538 m.data = NULL;
539 m.size = 0;
540
541 if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
542 return DEFER;
543
544 if (!exp_tls_dhparam)
545 {
546 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
547 m.data = US std_dh_prime_default();
548 m.size = Ustrlen(m.data);
549 }
550 else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
551 use_file_in_spool = TRUE;
552 else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
553 {
554 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
555 return OK;
556 }
557 else if (exp_tls_dhparam[0] != '/')
558 {
559 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
560 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL, errstr);
561 m.size = Ustrlen(m.data);
562 }
563 else
564 {
565 use_fixed_file = TRUE;
566 filename = exp_tls_dhparam;
567 }
568
569 if (m.data)
570 {
571 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
572 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
573 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
574 return OK;
575 }
576
577 #ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
578 /* If you change this constant, also change dh_param_fn_ext so that we can use a
579 different filename and ensure we have sufficient bits. */
580 dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
581 if (!dh_bits)
582 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
583 DEBUG(D_tls)
584 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
585 dh_bits);
586 #else
587 dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
588 DEBUG(D_tls)
589 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
590 dh_bits);
591 #endif
592
593 /* Some clients have hard-coded limits. */
594 if (dh_bits > tls_dh_max_bits)
595 {
596 DEBUG(D_tls)
597 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
598 tls_dh_max_bits);
599 dh_bits = tls_dh_max_bits;
600 }
601
602 if (use_file_in_spool)
603 {
604 if (!string_format(filename_buf, sizeof(filename_buf),
605 "%s/gnutls-params-%d", spool_directory, dh_bits))
606 return tls_error(US"overlong filename", NULL, NULL, errstr);
607 filename = filename_buf;
608 }
609
610 /* Open the cache file for reading and if successful, read it and set up the
611 parameters. */
612
613 if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
614 {
615 struct stat statbuf;
616 FILE *fp;
617 int saved_errno;
618
619 if (fstat(fd, &statbuf) < 0) /* EIO */
620 {
621 saved_errno = errno;
622 (void)close(fd);
623 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL, errstr);
624 }
625 if (!S_ISREG(statbuf.st_mode))
626 {
627 (void)close(fd);
628 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
629 }
630 if (!(fp = fdopen(fd, "rb")))
631 {
632 saved_errno = errno;
633 (void)close(fd);
634 return tls_error(US"fdopen(TLS cache stat fd) failed",
635 strerror(saved_errno), NULL, errstr);
636 }
637
638 m.size = statbuf.st_size;
639 if (!(m.data = malloc(m.size)))
640 {
641 fclose(fp);
642 return tls_error(US"malloc failed", strerror(errno), NULL, errstr);
643 }
644 if (!(sz = fread(m.data, m.size, 1, fp)))
645 {
646 saved_errno = errno;
647 fclose(fp);
648 free(m.data);
649 return tls_error(US"fread failed", strerror(saved_errno), NULL, errstr);
650 }
651 fclose(fp);
652
653 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
654 free(m.data);
655 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
656 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
657 }
658
659 /* If the file does not exist, fall through to compute new data and cache it.
660 If there was any other opening error, it is serious. */
661
662 else if (errno == ENOENT)
663 {
664 rc = -1;
665 DEBUG(D_tls)
666 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
667 }
668 else
669 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
670 NULL, NULL, errstr);
671
672 /* If ret < 0, either the cache file does not exist, or the data it contains
673 is not useful. One particular case of this is when upgrading from an older
674 release of Exim in which the data was stored in a different format. We don't
675 try to be clever and support both formats; we just regenerate new data in this
676 case. */
677
678 if (rc < 0)
679 {
680 uschar *temp_fn;
681 unsigned int dh_bits_gen = dh_bits;
682
683 if ((PATH_MAX - Ustrlen(filename)) < 10)
684 return tls_error(US"Filename too long to generate replacement",
685 CS filename, NULL, errstr);
686
687 temp_fn = string_copy(US "%s.XXXXXXX");
688 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
689 return tls_error(US"Unable to open temp file", strerror(errno), NULL, errstr);
690 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
691
692 /* GnuTLS overshoots!
693 * If we ask for 2236, we might get 2237 or more.
694 * But there's no way to ask GnuTLS how many bits there really are.
695 * We can ask how many bits were used in a TLS session, but that's it!
696 * The prime itself is hidden behind too much abstraction.
697 * So we ask for less, and proceed on a wing and a prayer.
698 * First attempt, subtracted 3 for 2233 and got 2240.
699 */
700 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
701 {
702 dh_bits_gen = dh_bits - 10;
703 DEBUG(D_tls)
704 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
705 dh_bits_gen);
706 }
707
708 DEBUG(D_tls)
709 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
710 dh_bits_gen);
711 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
712 exim_gnutls_err_check(rc, US"gnutls_dh_params_generate2");
713
714 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
715 and I confirmed that a NULL call to get the size first is how the GnuTLS
716 sample apps handle this. */
717
718 sz = 0;
719 m.data = NULL;
720 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
721 m.data, &sz);
722 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
723 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3(NULL) sizing");
724 m.size = sz;
725 if (!(m.data = malloc(m.size)))
726 return tls_error(US"memory allocation failed", strerror(errno), NULL, errstr);
727
728 /* this will return a size 1 less than the allocation size above */
729 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
730 m.data, &sz);
731 if (rc != GNUTLS_E_SUCCESS)
732 {
733 free(m.data);
734 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3() real");
735 }
736 m.size = sz; /* shrink by 1, probably */
737
738 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
739 {
740 free(m.data);
741 return tls_error(US"TLS cache write D-H params failed",
742 strerror(errno), NULL, errstr);
743 }
744 free(m.data);
745 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
746 return tls_error(US"TLS cache write D-H params final newline failed",
747 strerror(errno), NULL, errstr);
748
749 if ((rc = close(fd)))
750 return tls_error(US"TLS cache write close() failed", strerror(errno), NULL, errstr);
751
752 if (Urename(temp_fn, filename) < 0)
753 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
754 temp_fn, filename), strerror(errno), NULL, errstr);
755
756 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
757 }
758
759 DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
760 return OK;
761 }
762
763
764
765
766 /* Create and install a selfsigned certificate, for use in server mode */
767
768 static int
769 tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
770 {
771 gnutls_x509_crt_t cert = NULL;
772 time_t now;
773 gnutls_x509_privkey_t pkey = NULL;
774 const uschar * where;
775 int rc;
776
777 where = US"initialising pkey";
778 if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
779
780 where = US"initialising cert";
781 if ((rc = gnutls_x509_crt_init(&cert))) goto err;
782
783 where = US"generating pkey";
784 if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
785 #ifdef SUPPORT_PARAM_TO_PK_BITS
786 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_LOW),
787 #else
788 1024,
789 #endif
790 0)))
791 goto err;
792
793 where = US"configuring cert";
794 now = 1;
795 if ( (rc = gnutls_x509_crt_set_version(cert, 3))
796 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
797 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
798 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
799 || (rc = gnutls_x509_crt_set_key(cert, pkey))
800
801 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
802 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
803 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
804 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
805 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
806 GNUTLS_OID_X520_COMMON_NAME, 0,
807 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
808 )
809 goto err;
810
811 where = US"signing cert";
812 if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
813
814 where = US"installing selfsign cert";
815 /* Since: 2.4.0 */
816 if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
817 goto err;
818
819 rc = OK;
820
821 out:
822 if (cert) gnutls_x509_crt_deinit(cert);
823 if (pkey) gnutls_x509_privkey_deinit(pkey);
824 return rc;
825
826 err:
827 rc = tls_error(where, gnutls_strerror(rc), NULL, errstr);
828 goto out;
829 }
830
831
832
833
834 /* Add certificate and key, from files.
835
836 Return:
837 Zero or negative: good. Negate value for certificate index if < 0.
838 Greater than zero: FAIL or DEFER code.
839 */
840
841 static int
842 tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
843 uschar * certfile, uschar * keyfile, uschar ** errstr)
844 {
845 int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
846 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
847 if (rc < 0)
848 return tls_error(
849 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
850 gnutls_strerror(rc), host, errstr);
851 return -rc;
852 }
853
854
855 /*************************************************
856 * Variables re-expanded post-SNI *
857 *************************************************/
858
859 /* Called from both server and client code, via tls_init(), and also from
860 the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
861
862 We can tell the two apart by state->received_sni being non-NULL in callback.
863
864 The callback should not call us unless state->trigger_sni_changes is true,
865 which we are responsible for setting on the first pass through.
866
867 Arguments:
868 state exim_gnutls_state_st *
869 errstr error string pointer
870
871 Returns: OK/DEFER/FAIL
872 */
873
874 static int
875 tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
876 {
877 struct stat statbuf;
878 int rc;
879 const host_item *host = state->host; /* macro should be reconsidered? */
880 uschar *saved_tls_certificate = NULL;
881 uschar *saved_tls_privatekey = NULL;
882 uschar *saved_tls_verify_certificates = NULL;
883 uschar *saved_tls_crl = NULL;
884 int cert_count;
885
886 /* We check for tls_sni *before* expansion. */
887 if (!host) /* server */
888 if (!state->received_sni)
889 {
890 if ( state->tls_certificate
891 && ( Ustrstr(state->tls_certificate, US"tls_sni")
892 || Ustrstr(state->tls_certificate, US"tls_in_sni")
893 || Ustrstr(state->tls_certificate, US"tls_out_sni")
894 ) )
895 {
896 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
897 state->trigger_sni_changes = TRUE;
898 }
899 }
900 else
901 {
902 /* useful for debugging */
903 saved_tls_certificate = state->exp_tls_certificate;
904 saved_tls_privatekey = state->exp_tls_privatekey;
905 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
906 saved_tls_crl = state->exp_tls_crl;
907 }
908
909 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
910 exim_gnutls_err_check(rc, US"gnutls_certificate_allocate_credentials");
911
912 #ifdef SUPPORT_SRV_OCSP_STACK
913 gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
914 #endif
915
916 /* remember: expand_check_tlsvar() is expand_check() but fiddling with
917 state members, assuming consistent naming; and expand_check() returns
918 false if expansion failed, unless expansion was forced to fail. */
919
920 /* check if we at least have a certificate, before doing expensive
921 D-H generation. */
922
923 if (!expand_check_tlsvar(tls_certificate, errstr))
924 return DEFER;
925
926 /* certificate is mandatory in server, optional in client */
927
928 if ( !state->exp_tls_certificate
929 || !*state->exp_tls_certificate
930 )
931 if (!host)
932 return tls_install_selfsign(state, errstr);
933 else
934 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
935
936 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
937 return DEFER;
938
939 /* tls_privatekey is optional, defaulting to same file as certificate */
940
941 if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
942 {
943 state->tls_privatekey = state->tls_certificate;
944 state->exp_tls_privatekey = state->exp_tls_certificate;
945 }
946
947
948 if (state->exp_tls_certificate && *state->exp_tls_certificate)
949 {
950 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
951 state->exp_tls_certificate, state->exp_tls_privatekey);
952
953 if (state->received_sni)
954 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
955 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
956 )
957 {
958 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
959 }
960 else
961 {
962 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
963 }
964
965 if (!host) /* server */
966 {
967 const uschar * clist = state->exp_tls_certificate;
968 const uschar * klist = state->exp_tls_privatekey;
969 const uschar * olist;
970 int csep = 0, ksep = 0, osep = 0, cnt = 0;
971 uschar * cfile, * kfile, * ofile;
972
973 #ifndef DISABLE_OCSP
974 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
975 return DEFER;
976 olist = ofile;
977 #endif
978
979 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
980
981 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
982 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
983 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
984 return rc;
985 else
986 {
987 int gnutls_cert_index = -rc;
988 DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile);
989
990 /* Set the OCSP stapling server info */
991
992 #ifndef DISABLE_OCSP
993 if (tls_ocsp_file)
994 if (gnutls_buggy_ocsp)
995 {
996 DEBUG(D_tls)
997 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
998 }
999 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1000 {
1001 /* Use the full callback method for stapling just to get
1002 observability. More efficient would be to read the file once only,
1003 if it never changed (due to SNI). Would need restart on file update,
1004 or watch datestamp. */
1005
1006 # ifdef SUPPORT_SRV_OCSP_STACK
1007 rc = gnutls_certificate_set_ocsp_status_request_function2(
1008 state->x509_cred, gnutls_cert_index,
1009 server_ocsp_stapling_cb, ofile);
1010
1011 exim_gnutls_err_check(rc,
1012 US"gnutls_certificate_set_ocsp_status_request_function2");
1013 # else
1014 if (cnt++ > 0)
1015 {
1016 DEBUG(D_tls)
1017 debug_printf("oops; multiple OCSP files not supported\n");
1018 break;
1019 }
1020 gnutls_certificate_set_ocsp_status_request_function(
1021 state->x509_cred, server_ocsp_stapling_cb, ofile);
1022 # endif
1023
1024 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile);
1025 }
1026 else
1027 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1028 #endif
1029 }
1030 }
1031 else
1032 {
1033 if (0 < (rc = tls_add_certfile(state, host,
1034 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1035 return rc;
1036 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1037 }
1038
1039 } /* tls_certificate */
1040
1041
1042 /* Set the trusted CAs file if one is provided, and then add the CRL if one is
1043 provided. Experiment shows that, if the certificate file is empty, an unhelpful
1044 error message is provided. However, if we just refrain from setting anything up
1045 in that case, certificate verification fails, which seems to be the correct
1046 behaviour. */
1047
1048 if (state->tls_verify_certificates && *state->tls_verify_certificates)
1049 {
1050 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
1051 return DEFER;
1052 #ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1053 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1054 state->exp_tls_verify_certificates = NULL;
1055 #endif
1056 if (state->tls_crl && *state->tls_crl)
1057 if (!expand_check_tlsvar(tls_crl, errstr))
1058 return DEFER;
1059
1060 if (!(state->exp_tls_verify_certificates &&
1061 *state->exp_tls_verify_certificates))
1062 {
1063 DEBUG(D_tls)
1064 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1065 /* With no tls_verify_certificates, we ignore tls_crl too */
1066 return OK;
1067 }
1068 }
1069 else
1070 {
1071 DEBUG(D_tls)
1072 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1073 return OK;
1074 }
1075
1076 #ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1077 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1078 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1079 else
1080 #endif
1081 {
1082 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1083 {
1084 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1085 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1086 strerror(errno));
1087 return DEFER;
1088 }
1089
1090 #ifndef SUPPORT_CA_DIR
1091 /* The test suite passes in /dev/null; we could check for that path explicitly,
1092 but who knows if someone has some weird FIFO which always dumps some certs, or
1093 other weirdness. The thing we really want to check is that it's not a
1094 directory, since while OpenSSL supports that, GnuTLS does not.
1095 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
1096 if (S_ISDIR(statbuf.st_mode))
1097 {
1098 DEBUG(D_tls)
1099 debug_printf("verify certificates path is a dir: \"%s\"\n",
1100 state->exp_tls_verify_certificates);
1101 log_write(0, LOG_MAIN|LOG_PANIC,
1102 "tls_verify_certificates \"%s\" is a directory",
1103 state->exp_tls_verify_certificates);
1104 return DEFER;
1105 }
1106 #endif
1107
1108 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1109 state->exp_tls_verify_certificates, statbuf.st_size);
1110
1111 if (statbuf.st_size == 0)
1112 {
1113 DEBUG(D_tls)
1114 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1115 return OK;
1116 }
1117
1118 cert_count =
1119
1120 #ifdef SUPPORT_CA_DIR
1121 (statbuf.st_mode & S_IFMT) == S_IFDIR
1122 ?
1123 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1124 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1125 :
1126 #endif
1127 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1128 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1129 }
1130
1131 if (cert_count < 0)
1132 {
1133 rc = cert_count;
1134 exim_gnutls_err_check(rc, US"setting certificate trust");
1135 }
1136 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
1137
1138 if (state->tls_crl && *state->tls_crl &&
1139 state->exp_tls_crl && *state->exp_tls_crl)
1140 {
1141 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1142 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1143 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1144 if (cert_count < 0)
1145 {
1146 rc = cert_count;
1147 exim_gnutls_err_check(rc, US"gnutls_certificate_set_x509_crl_file");
1148 }
1149 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1150 }
1151
1152 return OK;
1153 }
1154
1155
1156
1157
1158 /*************************************************
1159 * Set X.509 state variables *
1160 *************************************************/
1161
1162 /* In GnuTLS, the registered cert/key are not replaced by a later
1163 set of a cert/key, so for SNI support we need a whole new x509_cred
1164 structure. Which means various other non-re-expanded pieces of state
1165 need to be re-set in the new struct, so the setting logic is pulled
1166 out to this.
1167
1168 Arguments:
1169 state exim_gnutls_state_st *
1170 errstr error string pointer
1171
1172 Returns: OK/DEFER/FAIL
1173 */
1174
1175 static int
1176 tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1177 {
1178 int rc;
1179 const host_item *host = state->host; /* macro should be reconsidered? */
1180
1181 /* Create D-H parameters, or read them from the cache file. This function does
1182 its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1183 client-side params. */
1184
1185 if (!state->host)
1186 {
1187 if (!dh_server_params)
1188 {
1189 rc = init_server_dh(errstr);
1190 if (rc != OK) return rc;
1191 }
1192 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1193 }
1194
1195 /* Link the credentials to the session. */
1196
1197 rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1198 exim_gnutls_err_check(rc, US"gnutls_credentials_set");
1199
1200 return OK;
1201 }
1202
1203 /*************************************************
1204 * Initialize for GnuTLS *
1205 *************************************************/
1206
1207
1208 #ifndef DISABLE_OCSP
1209
1210 static BOOL
1211 tls_is_buggy_ocsp(void)
1212 {
1213 const uschar * s;
1214 uschar maj, mid, mic;
1215
1216 s = CUS gnutls_check_version(NULL);
1217 maj = atoi(CCS s);
1218 if (maj == 3)
1219 {
1220 while (*s && *s != '.') s++;
1221 mid = atoi(CCS ++s);
1222 if (mid <= 2)
1223 return TRUE;
1224 else if (mid >= 5)
1225 return FALSE;
1226 else
1227 {
1228 while (*s && *s != '.') s++;
1229 mic = atoi(CCS ++s);
1230 return mic <= (mid == 3 ? 16 : 3);
1231 }
1232 }
1233 return FALSE;
1234 }
1235
1236 #endif
1237
1238
1239 /* Called from both server and client code. In the case of a server, errors
1240 before actual TLS negotiation return DEFER.
1241
1242 Arguments:
1243 host connected host, if client; NULL if server
1244 certificate certificate file
1245 privatekey private key file
1246 sni TLS SNI to send, sometimes when client; else NULL
1247 cas CA certs file
1248 crl CRL file
1249 require_ciphers tls_require_ciphers setting
1250 caller_state returned state-info structure
1251 errstr error string pointer
1252
1253 Returns: OK/DEFER/FAIL
1254 */
1255
1256 static int
1257 tls_init(
1258 const host_item *host,
1259 const uschar *certificate,
1260 const uschar *privatekey,
1261 const uschar *sni,
1262 const uschar *cas,
1263 const uschar *crl,
1264 const uschar *require_ciphers,
1265 exim_gnutls_state_st **caller_state,
1266 tls_support * tlsp,
1267 uschar ** errstr)
1268 {
1269 exim_gnutls_state_st *state;
1270 int rc;
1271 size_t sz;
1272 const char *errpos;
1273 uschar *p;
1274 BOOL want_default_priorities;
1275
1276 if (!exim_gnutls_base_init_done)
1277 {
1278 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1279
1280 #ifdef HAVE_GNUTLS_PKCS11
1281 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1282 which loads modules from a config file, which sounds good and may be wanted
1283 by some sysadmin, but also means in common configurations that GNOME keyring
1284 environment variables are used and so breaks for users calling mailq.
1285 To prevent this, we init PKCS11 first, which is the documented approach. */
1286 if (!gnutls_allow_auto_pkcs11)
1287 {
1288 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1289 exim_gnutls_err_check(rc, US"gnutls_pkcs11_init");
1290 }
1291 #endif
1292
1293 rc = gnutls_global_init();
1294 exim_gnutls_err_check(rc, US"gnutls_global_init");
1295
1296 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1297 DEBUG(D_tls)
1298 {
1299 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1300 /* arbitrarily chosen level; bump upto 9 for more */
1301 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
1302 }
1303 #endif
1304
1305 #ifndef DISABLE_OCSP
1306 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1307 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1308 #endif
1309
1310 exim_gnutls_base_init_done = TRUE;
1311 }
1312
1313 if (host)
1314 {
1315 /* For client-side sessions we allocate a context. This lets us run
1316 several in parallel. */
1317 int old_pool = store_pool;
1318 store_pool = POOL_PERM;
1319 state = store_get(sizeof(exim_gnutls_state_st));
1320 store_pool = old_pool;
1321
1322 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1323 state->tlsp = tlsp;
1324 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1325 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1326 }
1327 else
1328 {
1329 state = &state_server;
1330 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1331 state->tlsp = tlsp;
1332 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1333 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1334 }
1335 exim_gnutls_err_check(rc, US"gnutls_init");
1336
1337 state->host = host;
1338
1339 state->tls_certificate = certificate;
1340 state->tls_privatekey = privatekey;
1341 state->tls_require_ciphers = require_ciphers;
1342 state->tls_sni = sni;
1343 state->tls_verify_certificates = cas;
1344 state->tls_crl = crl;
1345
1346 /* This handles the variables that might get re-expanded after TLS SNI;
1347 that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
1348
1349 DEBUG(D_tls)
1350 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1351 if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
1352
1353 /* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1354 requires a new structure afterwards. */
1355
1356 if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
1357
1358 /* set SNI in client, only */
1359 if (host)
1360 {
1361 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
1362 return DEFER;
1363 if (state->tlsp->sni && *state->tlsp->sni)
1364 {
1365 DEBUG(D_tls)
1366 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1367 sz = Ustrlen(state->tlsp->sni);
1368 rc = gnutls_server_name_set(state->session,
1369 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
1370 exim_gnutls_err_check(rc, US"gnutls_server_name_set");
1371 }
1372 }
1373 else if (state->tls_sni)
1374 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1375 "have an SNI set for a server [%s]\n", state->tls_sni);
1376
1377 /* This is the priority string support,
1378 http://www.gnutls.org/manual/html_node/Priority-Strings.html
1379 and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1380 This was backwards incompatible, but means Exim no longer needs to track
1381 all algorithms and provide string forms for them. */
1382
1383 want_default_priorities = TRUE;
1384
1385 if (state->tls_require_ciphers && *state->tls_require_ciphers)
1386 {
1387 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
1388 return DEFER;
1389 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
1390 {
1391 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1392 state->exp_tls_require_ciphers);
1393
1394 rc = gnutls_priority_init(&state->priority_cache,
1395 CS state->exp_tls_require_ciphers, &errpos);
1396 want_default_priorities = FALSE;
1397 p = state->exp_tls_require_ciphers;
1398 }
1399 }
1400 if (want_default_priorities)
1401 {
1402 DEBUG(D_tls)
1403 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1404 exim_default_gnutls_priority);
1405 rc = gnutls_priority_init(&state->priority_cache,
1406 exim_default_gnutls_priority, &errpos);
1407 p = US exim_default_gnutls_priority;
1408 }
1409
1410 exim_gnutls_err_check(rc, string_sprintf(
1411 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1412 p, errpos - CS p, errpos));
1413
1414 rc = gnutls_priority_set(state->session, state->priority_cache);
1415 exim_gnutls_err_check(rc, US"gnutls_priority_set");
1416
1417 gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1418
1419 /* Reduce security in favour of increased compatibility, if the admin
1420 decides to make that trade-off. */
1421 if (gnutls_compat_mode)
1422 {
1423 #if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1424 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1425 gnutls_session_enable_compatibility_mode(state->session);
1426 #else
1427 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1428 #endif
1429 }
1430
1431 *caller_state = state;
1432 return OK;
1433 }
1434
1435
1436
1437 /*************************************************
1438 * Extract peer information *
1439 *************************************************/
1440
1441 /* Called from both server and client code.
1442 Only this is allowed to set state->peerdn and state->have_set_peerdn
1443 and we use that to detect double-calls.
1444
1445 NOTE: the state blocks last while the TLS connection is up, which is fine
1446 for logging in the server side, but for the client side, we log after teardown
1447 in src/deliver.c. While the session is up, we can twist about states and
1448 repoint tls_* globals, but those variables used for logging or other variable
1449 expansion that happens _after_ delivery need to have a longer life-time.
1450
1451 So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1452 doing this more than once per generation of a state context. We set them in
1453 the state context, and repoint tls_* to them. After the state goes away, the
1454 tls_* copies of the pointers remain valid and client delivery logging is happy.
1455
1456 tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1457 don't apply.
1458
1459 Arguments:
1460 state exim_gnutls_state_st *
1461 errstr pointer to error string
1462
1463 Returns: OK/DEFER/FAIL
1464 */
1465
1466 static int
1467 peer_status(exim_gnutls_state_st *state, uschar ** errstr)
1468 {
1469 uschar cipherbuf[256];
1470 const gnutls_datum_t *cert_list;
1471 int old_pool, rc;
1472 unsigned int cert_list_size = 0;
1473 gnutls_protocol_t protocol;
1474 gnutls_cipher_algorithm_t cipher;
1475 gnutls_kx_algorithm_t kx;
1476 gnutls_mac_algorithm_t mac;
1477 gnutls_certificate_type_t ct;
1478 gnutls_x509_crt_t crt;
1479 uschar *p, *dn_buf;
1480 size_t sz;
1481
1482 if (state->have_set_peerdn)
1483 return OK;
1484 state->have_set_peerdn = TRUE;
1485
1486 state->peerdn = NULL;
1487
1488 /* tls_cipher */
1489 cipher = gnutls_cipher_get(state->session);
1490 protocol = gnutls_protocol_get_version(state->session);
1491 mac = gnutls_mac_get(state->session);
1492 kx = gnutls_kx_get(state->session);
1493
1494 string_format(cipherbuf, sizeof(cipherbuf),
1495 "%s:%s:%d",
1496 gnutls_protocol_get_name(protocol),
1497 gnutls_cipher_suite_get_name(kx, cipher, mac),
1498 (int) gnutls_cipher_get_key_size(cipher) * 8);
1499
1500 /* I don't see a way that spaces could occur, in the current GnuTLS
1501 code base, but it was a concern in the old code and perhaps older GnuTLS
1502 releases did return "TLS 1.0"; play it safe, just in case. */
1503 for (p = cipherbuf; *p != '\0'; ++p)
1504 if (isspace(*p))
1505 *p = '-';
1506 old_pool = store_pool;
1507 store_pool = POOL_PERM;
1508 state->ciphersuite = string_copy(cipherbuf);
1509 store_pool = old_pool;
1510 state->tlsp->cipher = state->ciphersuite;
1511
1512 /* tls_peerdn */
1513 cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
1514
1515 if (cert_list == NULL || cert_list_size == 0)
1516 {
1517 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1518 cert_list, cert_list_size);
1519 if (state->verify_requirement >= VERIFY_REQUIRED)
1520 return tls_error(US"certificate verification failed",
1521 "no certificate received from peer", state->host, errstr);
1522 return OK;
1523 }
1524
1525 ct = gnutls_certificate_type_get(state->session);
1526 if (ct != GNUTLS_CRT_X509)
1527 {
1528 const char *ctn = gnutls_certificate_type_get_name(ct);
1529 DEBUG(D_tls)
1530 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1531 if (state->verify_requirement >= VERIFY_REQUIRED)
1532 return tls_error(US"certificate verification not possible, unhandled type",
1533 ctn, state->host, errstr);
1534 return OK;
1535 }
1536
1537 #define exim_gnutls_peer_err(Label) \
1538 do { \
1539 if (rc != GNUTLS_E_SUCCESS) \
1540 { \
1541 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1542 (Label), gnutls_strerror(rc)); \
1543 if (state->verify_requirement >= VERIFY_REQUIRED) \
1544 return tls_error((Label), gnutls_strerror(rc), state->host, errstr); \
1545 return OK; \
1546 } \
1547 } while (0)
1548
1549 rc = import_cert(&cert_list[0], &crt);
1550 exim_gnutls_peer_err(US"cert 0");
1551
1552 state->tlsp->peercert = state->peercert = crt;
1553
1554 sz = 0;
1555 rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1556 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
1557 {
1558 exim_gnutls_peer_err(US"getting size for cert DN failed");
1559 return FAIL; /* should not happen */
1560 }
1561 dn_buf = store_get_perm(sz);
1562 rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1563 exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1564
1565 state->peerdn = dn_buf;
1566
1567 return OK;
1568 #undef exim_gnutls_peer_err
1569 }
1570
1571
1572
1573
1574 /*************************************************
1575 * Verify peer certificate *
1576 *************************************************/
1577
1578 /* Called from both server and client code.
1579 *Should* be using a callback registered with
1580 gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1581 the peer information, but that's too new for some OSes.
1582
1583 Arguments:
1584 state exim_gnutls_state_st *
1585 errstr where to put an error message
1586
1587 Returns:
1588 FALSE if the session should be rejected
1589 TRUE if the cert is okay or we just don't care
1590 */
1591
1592 static BOOL
1593 verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
1594 {
1595 int rc;
1596 uint verify;
1597
1598 if (state->verify_requirement == VERIFY_NONE)
1599 return TRUE;
1600
1601 *errstr = NULL;
1602
1603 if ((rc = peer_status(state, errstr)) != OK)
1604 {
1605 verify = GNUTLS_CERT_INVALID;
1606 *errstr = US"certificate not supplied";
1607 }
1608 else
1609
1610 {
1611 #ifdef SUPPORT_DANE
1612 if (state->verify_requirement == VERIFY_DANE && state->host)
1613 {
1614 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1615 including talking to a DNS resolver. But we want to do that bit ourselves
1616 as the testsuite intercepts and fakes its own DNS environment. */
1617
1618 dane_state_t s;
1619 dane_query_t r;
1620 uint lsize;
1621 const gnutls_datum_t * certlist =
1622 gnutls_certificate_get_peers(state->session, &lsize);
1623 int usage = tls_out.tlsa_usage;
1624
1625 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1626 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1627 dane-verification separately so that we know which selector verified;
1628 then we know whether to do CA-chain-verification and name-verification
1629 (needed for TA but not EE). */
1630
1631 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
1632 { /* a mixed-usage bundle */
1633 int i, j, nrec;
1634 const char ** dd;
1635 int * ddl;
1636
1637 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1638 nrec++;
1639
1640 dd = store_get(nrec * sizeof(uschar *));
1641 ddl = store_get(nrec * sizeof(int));
1642 nrec--;
1643
1644 if ((rc = dane_state_init(&s, 0)))
1645 goto tlsa_prob;
1646
1647 for (usage = DANESSL_USAGE_DANE_EE;
1648 usage >= DANESSL_USAGE_DANE_TA; usage--)
1649 { /* take records with this usage */
1650 for (j = i = 0; i < nrec; i++)
1651 if (state->dane_data[i][0] == usage)
1652 {
1653 dd[j] = state->dane_data[i];
1654 ddl[j++] = state->dane_data_len[i];
1655 }
1656 if (j)
1657 {
1658 dd[j] = NULL;
1659 ddl[j] = 0;
1660
1661 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1662 goto tlsa_prob;
1663
1664 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1665 gnutls_certificate_type_get(state->session),
1666 r, 0,
1667 usage == DANESSL_USAGE_DANE_EE
1668 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1669 &verify)))
1670 {
1671 DEBUG(D_tls)
1672 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1673 }
1674 else if (verify == 0) /* verification passed */
1675 {
1676 usage = 1 << usage;
1677 break;
1678 }
1679 }
1680 }
1681
1682 if (rc) goto tlsa_prob;
1683 }
1684 else
1685 # endif
1686 {
1687 if ( (rc = dane_state_init(&s, 0))
1688 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1689 1, 0))
1690 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1691 gnutls_certificate_type_get(state->session),
1692 r, 0,
1693 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1694 usage == (1 << DANESSL_USAGE_DANE_EE)
1695 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1696 # else
1697 0,
1698 # endif
1699 &verify))
1700 )
1701 goto tlsa_prob;
1702 }
1703
1704 if (verify != 0) /* verification failed */
1705 {
1706 gnutls_datum_t str;
1707 (void) dane_verification_status_print(verify, &str, 0);
1708 *errstr = US str.data; /* don't bother to free */
1709 goto badcert;
1710 }
1711 state->peer_dane_verified = TRUE;
1712
1713 # ifdef GNUTLS_BROKEN_DANE_VALIDATION
1714 /* If a TA-mode TLSA record was used for verification we must additionally
1715 verify the CA chain and the cert name. For EE-mode, skip it. */
1716
1717 if (usage & (1 << DANESSL_USAGE_DANE_EE))
1718 # endif
1719 {
1720 state->peer_cert_verified = TRUE;
1721 goto goodcert;
1722 }
1723 }
1724 #endif
1725
1726 rc = gnutls_certificate_verify_peers2(state->session, &verify);
1727 }
1728
1729 /* Handle the result of verification. INVALID is set if any others are. */
1730
1731 if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
1732 {
1733 state->peer_cert_verified = FALSE;
1734 if (!*errstr)
1735 *errstr = verify & GNUTLS_CERT_REVOKED
1736 ? US"certificate revoked" : US"certificate invalid";
1737
1738 DEBUG(D_tls)
1739 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
1740 *errstr, state->peerdn ? state->peerdn : US"<unset>");
1741
1742 if (state->verify_requirement >= VERIFY_REQUIRED)
1743 goto badcert;
1744 DEBUG(D_tls)
1745 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
1746 }
1747
1748 else
1749 {
1750 if (state->exp_tls_verify_cert_hostnames)
1751 {
1752 int sep = 0;
1753 const uschar * list = state->exp_tls_verify_cert_hostnames;
1754 uschar * name;
1755 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
1756 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1757 break;
1758 if (!name)
1759 {
1760 DEBUG(D_tls)
1761 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1762 if (state->verify_requirement >= VERIFY_REQUIRED)
1763 goto badcert;
1764 return TRUE;
1765 }
1766 }
1767 state->peer_cert_verified = TRUE;
1768 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
1769 state->peerdn ? state->peerdn : US"<unset>");
1770 }
1771
1772 goodcert:
1773 state->tlsp->peerdn = state->peerdn;
1774 return TRUE;
1775
1776 #ifdef SUPPORT_DANE
1777 tlsa_prob:
1778 *errstr = string_sprintf("TLSA record problem: %s", dane_strerror(rc));
1779 #endif
1780
1781 badcert:
1782 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1783 return FALSE;
1784 }
1785
1786
1787
1788
1789 /* ------------------------------------------------------------------------ */
1790 /* Callbacks */
1791
1792 /* Logging function which can be registered with
1793 * gnutls_global_set_log_function()
1794 * gnutls_global_set_log_level() 0..9
1795 */
1796 #if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1797 static void
1798 exim_gnutls_logger_cb(int level, const char *message)
1799 {
1800 size_t len = strlen(message);
1801 if (len < 1)
1802 {
1803 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1804 return;
1805 }
1806 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1807 message[len-1] == '\n' ? "" : "\n");
1808 }
1809 #endif
1810
1811
1812 /* Called after client hello, should handle SNI work.
1813 This will always set tls_sni (state->received_sni) if available,
1814 and may trigger presenting different certificates,
1815 if state->trigger_sni_changes is TRUE.
1816
1817 Should be registered with
1818 gnutls_handshake_set_post_client_hello_function()
1819
1820 "This callback must return 0 on success or a gnutls error code to terminate the
1821 handshake.".
1822
1823 For inability to get SNI information, we return 0.
1824 We only return non-zero if re-setup failed.
1825 Only used for server-side TLS.
1826 */
1827
1828 static int
1829 exim_sni_handling_cb(gnutls_session_t session)
1830 {
1831 char sni_name[MAX_HOST_LEN];
1832 size_t data_len = MAX_HOST_LEN;
1833 exim_gnutls_state_st *state = &state_server;
1834 unsigned int sni_type;
1835 int rc, old_pool;
1836 uschar * dummy_errstr;
1837
1838 rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
1839 if (rc != GNUTLS_E_SUCCESS)
1840 {
1841 DEBUG(D_tls) {
1842 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1843 debug_printf("TLS: no SNI presented in handshake.\n");
1844 else
1845 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1846 gnutls_strerror(rc), rc);
1847 }
1848 return 0;
1849 }
1850
1851 if (sni_type != GNUTLS_NAME_DNS)
1852 {
1853 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1854 return 0;
1855 }
1856
1857 /* We now have a UTF-8 string in sni_name */
1858 old_pool = store_pool;
1859 store_pool = POOL_PERM;
1860 state->received_sni = string_copyn(US sni_name, data_len);
1861 store_pool = old_pool;
1862
1863 /* We set this one now so that variable expansions below will work */
1864 state->tlsp->sni = state->received_sni;
1865
1866 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1867 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1868
1869 if (!state->trigger_sni_changes)
1870 return 0;
1871
1872 if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
1873 {
1874 /* If the setup of certs/etc failed before handshake, TLS would not have
1875 been offered. The best we can do now is abort. */
1876 return GNUTLS_E_APPLICATION_ERROR_MIN;
1877 }
1878
1879 rc = tls_set_remaining_x509(state, &dummy_errstr);
1880 if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1881
1882 return 0;
1883 }
1884
1885
1886
1887 #ifndef DISABLE_OCSP
1888
1889 static int
1890 server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1891 gnutls_datum_t * ocsp_response)
1892 {
1893 int ret;
1894 DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
1895
1896 if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1897 {
1898 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1899 CS ptr);
1900 tls_in.ocsp = OCSP_NOT_RESP;
1901 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1902 }
1903
1904 tls_in.ocsp = OCSP_VFY_NOT_TRIED;
1905 return 0;
1906 }
1907
1908 #endif
1909
1910
1911 #ifndef DISABLE_EVENT
1912 /*
1913 We use this callback to get observability and detail-level control
1914 for an exim TLS connection (either direction), raising a tls:cert event
1915 for each cert in the chain presented by the peer. Any event
1916 can deny verification.
1917
1918 Return 0 for the handshake to continue or non-zero to terminate.
1919 */
1920
1921 static int
1922 verify_cb(gnutls_session_t session)
1923 {
1924 const gnutls_datum_t * cert_list;
1925 unsigned int cert_list_size = 0;
1926 gnutls_x509_crt_t crt;
1927 int rc;
1928 uschar * yield;
1929 exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1930
1931 if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
1932 while (cert_list_size--)
1933 {
1934 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
1935 {
1936 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1937 cert_list_size, gnutls_strerror(rc));
1938 break;
1939 }
1940
1941 state->tlsp->peercert = crt;
1942 if ((yield = event_raise(state->event_action,
1943 US"tls:cert", string_sprintf("%d", cert_list_size))))
1944 {
1945 log_write(0, LOG_MAIN,
1946 "SSL verify denied by event-action: depth=%d: %s",
1947 cert_list_size, yield);
1948 return 1; /* reject */
1949 }
1950 state->tlsp->peercert = NULL;
1951 }
1952
1953 return 0;
1954 }
1955
1956 #endif
1957
1958
1959
1960 /* ------------------------------------------------------------------------ */
1961 /* Exported functions */
1962
1963
1964
1965
1966 /*************************************************
1967 * Start a TLS session in a server *
1968 *************************************************/
1969
1970 /* This is called when Exim is running as a server, after having received
1971 the STARTTLS command. It must respond to that command, and then negotiate
1972 a TLS session.
1973
1974 Arguments:
1975 require_ciphers list of allowed ciphers or NULL
1976 errstr pointer to error string
1977
1978 Returns: OK on success
1979 DEFER for errors before the start of the negotiation
1980 FAIL for errors during the negotiation; the server can't
1981 continue running.
1982 */
1983
1984 int
1985 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
1986 {
1987 int rc;
1988 exim_gnutls_state_st * state = NULL;
1989
1990 /* Check for previous activation */
1991 if (tls_in.active.sock >= 0)
1992 {
1993 tls_error(US"STARTTLS received after TLS started", "", NULL, errstr);
1994 smtp_printf("554 Already in TLS\r\n", FALSE);
1995 return FAIL;
1996 }
1997
1998 /* Initialize the library. If it fails, it will already have logged the error
1999 and sent an SMTP response. */
2000
2001 DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
2002
2003 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
2004 NULL, tls_verify_certificates, tls_crl,
2005 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2006
2007 /* If this is a host for which certificate verification is mandatory or
2008 optional, set up appropriately. */
2009
2010 if (verify_check_host(&tls_verify_hosts) == OK)
2011 {
2012 DEBUG(D_tls)
2013 debug_printf("TLS: a client certificate will be required.\n");
2014 state->verify_requirement = VERIFY_REQUIRED;
2015 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2016 }
2017 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2018 {
2019 DEBUG(D_tls)
2020 debug_printf("TLS: a client certificate will be requested but not required.\n");
2021 state->verify_requirement = VERIFY_OPTIONAL;
2022 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2023 }
2024 else
2025 {
2026 DEBUG(D_tls)
2027 debug_printf("TLS: a client certificate will not be requested.\n");
2028 state->verify_requirement = VERIFY_NONE;
2029 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2030 }
2031
2032 #ifndef DISABLE_EVENT
2033 if (event_action)
2034 {
2035 state->event_action = event_action;
2036 gnutls_session_set_ptr(state->session, state);
2037 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2038 }
2039 #endif
2040
2041 /* Register SNI handling; always, even if not in tls_certificate, so that the
2042 expansion variable $tls_sni is always available. */
2043
2044 gnutls_handshake_set_post_client_hello_function(state->session,
2045 exim_sni_handling_cb);
2046
2047 /* Set context and tell client to go ahead, except in the case of TLS startup
2048 on connection, where outputting anything now upsets the clients and tends to
2049 make them disconnect. We need to have an explicit fflush() here, to force out
2050 the response. Other smtp_printf() calls do not need it, because in non-TLS
2051 mode, the fflush() happens when smtp_getc() is called. */
2052
2053 if (!state->tlsp->on_connect)
2054 {
2055 smtp_printf("220 TLS go ahead\r\n", FALSE);
2056 fflush(smtp_out);
2057 }
2058
2059 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2060 that the GnuTLS library doesn't. */
2061
2062 gnutls_transport_set_ptr2(state->session,
2063 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2064 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
2065 state->fd_in = fileno(smtp_in);
2066 state->fd_out = fileno(smtp_out);
2067
2068 sigalrm_seen = FALSE;
2069 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2070 do
2071 rc = gnutls_handshake(state->session);
2072 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2073 alarm(0);
2074
2075 if (rc != GNUTLS_E_SUCCESS)
2076 {
2077 /* It seems that, except in the case of a timeout, we have to close the
2078 connection right here; otherwise if the other end is running OpenSSL it hangs
2079 until the server times out. */
2080
2081 if (sigalrm_seen)
2082 {
2083 tls_error(US"gnutls_handshake", "timed out", NULL, errstr);
2084 gnutls_db_remove_session(state->session);
2085 }
2086 else
2087 {
2088 tls_error(US"gnutls_handshake", gnutls_strerror(rc), NULL, errstr);
2089 (void) gnutls_alert_send_appropriate(state->session, rc);
2090 gnutls_deinit(state->session);
2091 gnutls_certificate_free_credentials(state->x509_cred);
2092 millisleep(500);
2093 shutdown(state->fd_out, SHUT_WR);
2094 for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--; /* drain skt */
2095 (void)fclose(smtp_out);
2096 (void)fclose(smtp_in);
2097 smtp_out = smtp_in = NULL;
2098 }
2099
2100 return FAIL;
2101 }
2102
2103 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2104
2105 /* Verify after the fact */
2106
2107 if (!verify_certificate(state, errstr))
2108 {
2109 if (state->verify_requirement != VERIFY_OPTIONAL)
2110 {
2111 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
2112 return FAIL;
2113 }
2114 DEBUG(D_tls)
2115 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
2116 *errstr);
2117 }
2118
2119 /* Figure out peer DN, and if authenticated, etc. */
2120
2121 if ((rc = peer_status(state, NULL)) != OK) return rc;
2122
2123 /* Sets various Exim expansion variables; always safe within server */
2124
2125 extract_exim_vars_from_tls_state(state);
2126
2127 /* TLS has been set up. Adjust the input functions to read via TLS,
2128 and initialize appropriately. */
2129
2130 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2131
2132 receive_getc = tls_getc;
2133 receive_getbuf = tls_getbuf;
2134 receive_get_cache = tls_get_cache;
2135 receive_ungetc = tls_ungetc;
2136 receive_feof = tls_feof;
2137 receive_ferror = tls_ferror;
2138 receive_smtp_buffered = tls_smtp_buffered;
2139
2140 return OK;
2141 }
2142
2143
2144
2145
2146 static void
2147 tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2148 smtp_transport_options_block * ob)
2149 {
2150 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
2151 {
2152 state->exp_tls_verify_cert_hostnames =
2153 #ifdef SUPPORT_I18N
2154 string_domain_utf8_to_alabel(host->name, NULL);
2155 #else
2156 host->name;
2157 #endif
2158 DEBUG(D_tls)
2159 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2160 state->exp_tls_verify_cert_hostnames);
2161 }
2162 }
2163
2164
2165
2166
2167 #ifdef SUPPORT_DANE
2168 /* Given our list of RRs from the TLSA lookup, build a lookup block in
2169 GnuTLS-DANE's preferred format. Hang it on the state str for later
2170 use in DANE verification.
2171
2172 We point at the dnsa data not copy it, so it must remain valid until
2173 after verification is done.*/
2174
2175 static BOOL
2176 dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2177 {
2178 dns_record * rr;
2179 dns_scan dnss;
2180 int i;
2181 const char ** dane_data;
2182 int * dane_data_len;
2183
2184 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 1;
2185 rr;
2186 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2187 ) if (rr->type == T_TLSA) i++;
2188
2189 dane_data = store_get(i * sizeof(uschar *));
2190 dane_data_len = store_get(i * sizeof(int));
2191
2192 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 0;
2193 rr;
2194 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2195 ) if (rr->type == T_TLSA)
2196 {
2197 const uschar * p = rr->data;
2198 uint8_t usage = p[0], sel = p[1], type = p[2];
2199
2200 DEBUG(D_tls)
2201 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2202
2203 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2204 || (sel != 0 && sel != 1)
2205 )
2206 continue;
2207 switch(type)
2208 {
2209 case 0: /* Full: cannot check at present */
2210 break;
2211 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2212 break;
2213 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2214 break;
2215 default: continue;
2216 }
2217
2218 tls_out.tlsa_usage |= 1<<usage;
2219 dane_data[i] = p;
2220 dane_data_len[i++] = rr->size;
2221 }
2222
2223 if (!i) return FALSE;
2224
2225 dane_data[i] = NULL;
2226 dane_data_len[i] = 0;
2227
2228 state->dane_data = (char * const *)dane_data;
2229 state->dane_data_len = dane_data_len;
2230 return TRUE;
2231 }
2232 #endif
2233
2234
2235
2236 /*************************************************
2237 * Start a TLS session in a client *
2238 *************************************************/
2239
2240 /* Called from the smtp transport after STARTTLS has been accepted.
2241
2242 Arguments:
2243 fd the fd of the connection
2244 host connected host (for messages and option-tests)
2245 addr the first address (not used)
2246 tb transport (always smtp)
2247 tlsa_dnsa non-NULL, either request or require dane for this host, and
2248 a TLSA record found. Therefore, dane verify required.
2249 Which implies cert must be requested and supplied, dane
2250 verify must pass, and cert verify irrelevant (incl.
2251 hostnames), and (caller handled) require_tls
2252 tlsp record details of channel configuration
2253 errstr error string pointer
2254
2255 Returns: Pointer to TLS session context, or NULL on error
2256 */
2257
2258 void *
2259 tls_client_start(int fd, host_item *host,
2260 address_item *addr ARG_UNUSED,
2261 transport_instance * tb,
2262 #ifdef SUPPORT_DANE
2263 dns_answer * tlsa_dnsa,
2264 #endif
2265 tls_support * tlsp, uschar ** errstr)
2266 {
2267 smtp_transport_options_block *ob = tb
2268 ? (smtp_transport_options_block *)tb->options_block
2269 : &smtp_transport_option_defaults;
2270 int rc;
2271 exim_gnutls_state_st * state = NULL;
2272 uschar *cipher_list = NULL;
2273
2274 #ifndef DISABLE_OCSP
2275 BOOL require_ocsp =
2276 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
2277 BOOL request_ocsp = require_ocsp ? TRUE
2278 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2279 #endif
2280
2281 DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
2282
2283 #ifdef SUPPORT_DANE
2284 if (tlsa_dnsa && ob->dane_require_tls_ciphers)
2285 {
2286 /* not using expand_check_tlsvar because not yet in state */
2287 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2288 &cipher_list, errstr))
2289 return NULL;
2290 cipher_list = cipher_list && *cipher_list
2291 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
2292 }
2293 #endif
2294
2295 if (!cipher_list)
2296 cipher_list = ob->tls_require_ciphers;
2297
2298 if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2299 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2300 cipher_list, &state, tlsp, errstr) != OK)
2301 return NULL;
2302
2303 {
2304 int dh_min_bits = ob->tls_dh_min_bits;
2305 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2306 {
2307 DEBUG(D_tls)
2308 debug_printf("WARNING: tls_dh_min_bits far too low,"
2309 " clamping %d up to %d\n",
2310 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2311 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2312 }
2313
2314 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2315 " acceptable bits to %d\n",
2316 dh_min_bits);
2317 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2318 }
2319
2320 /* Stick to the old behaviour for compatibility if tls_verify_certificates is
2321 set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2322 the specified host patterns if one of them is defined */
2323
2324 #ifdef SUPPORT_DANE
2325 if (tlsa_dnsa && dane_tlsa_load(state, tlsa_dnsa))
2326 {
2327 DEBUG(D_tls)
2328 debug_printf("TLS: server certificate DANE required.\n");
2329 state->verify_requirement = VERIFY_DANE;
2330 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2331 }
2332 else
2333 #endif
2334 if ( ( state->exp_tls_verify_certificates
2335 && !ob->tls_verify_hosts
2336 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2337 )
2338 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
2339 )
2340 {
2341 tls_client_setup_hostname_checks(host, state, ob);
2342 DEBUG(D_tls)
2343 debug_printf("TLS: server certificate verification required.\n");
2344 state->verify_requirement = VERIFY_REQUIRED;
2345 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2346 }
2347 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
2348 {
2349 tls_client_setup_hostname_checks(host, state, ob);
2350 DEBUG(D_tls)
2351 debug_printf("TLS: server certificate verification optional.\n");
2352 state->verify_requirement = VERIFY_OPTIONAL;
2353 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2354 }
2355 else
2356 {
2357 DEBUG(D_tls)
2358 debug_printf("TLS: server certificate verification not required.\n");
2359 state->verify_requirement = VERIFY_NONE;
2360 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2361 }
2362
2363 #ifndef DISABLE_OCSP
2364 /* supported since GnuTLS 3.1.3 */
2365 if (request_ocsp)
2366 {
2367 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
2368 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2369 NULL, 0, NULL)) != OK)
2370 {
2371 tls_error(US"cert-status-req", gnutls_strerror(rc), state->host, errstr);
2372 return NULL;
2373 }
2374 tlsp->ocsp = OCSP_NOT_RESP;
2375 }
2376 #endif
2377
2378 #ifndef DISABLE_EVENT
2379 if (tb && tb->event_action)
2380 {
2381 state->event_action = tb->event_action;
2382 gnutls_session_set_ptr(state->session, state);
2383 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2384 }
2385 #endif
2386
2387 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
2388 state->fd_in = fd;
2389 state->fd_out = fd;
2390
2391 DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
2392 /* There doesn't seem to be a built-in timeout on connection. */
2393
2394 sigalrm_seen = FALSE;
2395 alarm(ob->command_timeout);
2396 do
2397 rc = gnutls_handshake(state->session);
2398 while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
2399 alarm(0);
2400
2401 if (rc != GNUTLS_E_SUCCESS)
2402 {
2403 if (sigalrm_seen)
2404 {
2405 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
2406 tls_error(US"gnutls_handshake", "timed out", state->host, errstr);
2407 }
2408 else
2409 tls_error(US"gnutls_handshake", gnutls_strerror(rc), state->host, errstr);
2410 return NULL;
2411 }
2412
2413 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2414
2415 /* Verify late */
2416
2417 if (!verify_certificate(state, errstr))
2418 {
2419 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
2420 return NULL;
2421 }
2422
2423 #ifndef DISABLE_OCSP
2424 if (require_ocsp)
2425 {
2426 DEBUG(D_tls)
2427 {
2428 gnutls_datum_t stapling;
2429 gnutls_ocsp_resp_t resp;
2430 gnutls_datum_t printed;
2431 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2432 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2433 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2434 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2435 )
2436 {
2437 debug_printf("%.4096s", printed.data);
2438 gnutls_free(printed.data);
2439 }
2440 else
2441 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host, errstr);
2442 }
2443
2444 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
2445 {
2446 tlsp->ocsp = OCSP_FAILED;
2447 tls_error(US"certificate status check failed", NULL, state->host, errstr);
2448 return NULL;
2449 }
2450 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
2451 tlsp->ocsp = OCSP_VFIED;
2452 }
2453 #endif
2454
2455 /* Figure out peer DN, and if authenticated, etc. */
2456
2457 if (peer_status(state, errstr) != OK)
2458 return NULL;
2459
2460 /* Sets various Exim expansion variables; may need to adjust for ACL callouts */
2461
2462 extract_exim_vars_from_tls_state(state);
2463
2464 return state;
2465 }
2466
2467
2468
2469
2470 /*************************************************
2471 * Close down a TLS session *
2472 *************************************************/
2473
2474 /* This is also called from within a delivery subprocess forked from the
2475 daemon, to shut down the TLS library, without actually doing a shutdown (which
2476 would tamper with the TLS session in the parent process).
2477
2478 Arguments:
2479 ct_ctx client context pointer, or NULL for the one global server context
2480 shutdown 1 if TLS close-alert is to be sent,
2481 2 if also response to be waited for
2482
2483 Returns: nothing
2484 */
2485
2486 void
2487 tls_close(void * ct_ctx, int shutdown)
2488 {
2489 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
2490
2491 if (!state->tlsp || state->tlsp->active.sock < 0) return; /* TLS was not active */
2492
2493 if (shutdown)
2494 {
2495 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
2496 shutdown > 1 ? " (with response-wait)" : "");
2497
2498 alarm(2);
2499 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
2500 alarm(0);
2501 }
2502
2503 gnutls_deinit(state->session);
2504 gnutls_certificate_free_credentials(state->x509_cred);
2505
2506
2507 state->tlsp->active.sock = -1;
2508 state->tlsp->active.tls_ctx = NULL;
2509 if (state->xfer_buffer) store_free(state->xfer_buffer);
2510 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2511 }
2512
2513
2514
2515
2516 static BOOL
2517 tls_refill(unsigned lim)
2518 {
2519 exim_gnutls_state_st * state = &state_server;
2520 ssize_t inbytes;
2521
2522 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2523 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2524
2525 sigalrm_seen = FALSE;
2526 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2527 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2528 MIN(ssl_xfer_buffer_size, lim));
2529 if (smtp_receive_timeout > 0) alarm(0);
2530
2531 if (had_command_timeout) /* set by signal handler */
2532 smtp_command_timeout_exit(); /* does not return */
2533 if (had_command_sigterm)
2534 smtp_command_sigterm_exit();
2535 if (had_data_timeout)
2536 smtp_data_timeout_exit();
2537 if (had_data_sigint)
2538 smtp_data_sigint_exit();
2539
2540 /* Timeouts do not get this far. A zero-byte return appears to mean that the
2541 TLS session has been closed down, not that the socket itself has been closed
2542 down. Revert to non-TLS handling. */
2543
2544 if (sigalrm_seen)
2545 {
2546 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
2547 state->xfer_error = TRUE;
2548 return FALSE;
2549 }
2550
2551 else if (inbytes == 0)
2552 {
2553 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2554
2555 receive_getc = smtp_getc;
2556 receive_getbuf = smtp_getbuf;
2557 receive_get_cache = smtp_get_cache;
2558 receive_ungetc = smtp_ungetc;
2559 receive_feof = smtp_feof;
2560 receive_ferror = smtp_ferror;
2561 receive_smtp_buffered = smtp_buffered;
2562
2563 gnutls_deinit(state->session);
2564 gnutls_certificate_free_credentials(state->x509_cred);
2565
2566 state->session = NULL;
2567 state->tlsp->active.sock = -1;
2568 state->tlsp->active.tls_ctx = NULL;
2569 state->tlsp->bits = 0;
2570 state->tlsp->certificate_verified = FALSE;
2571 tls_channelbinding_b64 = NULL;
2572 state->tlsp->cipher = NULL;
2573 state->tlsp->peercert = NULL;
2574 state->tlsp->peerdn = NULL;
2575
2576 return FALSE;
2577 }
2578
2579 /* Handle genuine errors */
2580
2581 else if (inbytes < 0)
2582 {
2583 record_io_error(state, (int) inbytes, US"recv", NULL);
2584 state->xfer_error = TRUE;
2585 return FALSE;
2586 }
2587 #ifndef DISABLE_DKIM
2588 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2589 #endif
2590 state->xfer_buffer_hwm = (int) inbytes;
2591 state->xfer_buffer_lwm = 0;
2592 return TRUE;
2593 }
2594
2595 /*************************************************
2596 * TLS version of getc *
2597 *************************************************/
2598
2599 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2600 it refills the buffer via the GnuTLS reading function.
2601 Only used by the server-side TLS.
2602
2603 This feeds DKIM and should be used for all message-body reads.
2604
2605 Arguments: lim Maximum amount to read/bufffer
2606 Returns: the next character or EOF
2607 */
2608
2609 int
2610 tls_getc(unsigned lim)
2611 {
2612 exim_gnutls_state_st * state = &state_server;
2613
2614 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2615 if (!tls_refill(lim))
2616 return state->xfer_error ? EOF : smtp_getc(lim);
2617
2618 /* Something in the buffer; return next uschar */
2619
2620 return state->xfer_buffer[state->xfer_buffer_lwm++];
2621 }
2622
2623 uschar *
2624 tls_getbuf(unsigned * len)
2625 {
2626 exim_gnutls_state_st * state = &state_server;
2627 unsigned size;
2628 uschar * buf;
2629
2630 if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2631 if (!tls_refill(*len))
2632 {
2633 if (!state->xfer_error) return smtp_getbuf(len);
2634 *len = 0;
2635 return NULL;
2636 }
2637
2638 if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
2639 size = *len;
2640 buf = &state->xfer_buffer[state->xfer_buffer_lwm];
2641 state->xfer_buffer_lwm += size;
2642 *len = size;
2643 return buf;
2644 }
2645
2646
2647 void
2648 tls_get_cache()
2649 {
2650 #ifndef DISABLE_DKIM
2651 exim_gnutls_state_st * state = &state_server;
2652 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2653 if (n > 0)
2654 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
2655 #endif
2656 }
2657
2658
2659 BOOL
2660 tls_could_read(void)
2661 {
2662 return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
2663 || gnutls_record_check_pending(state_server.session) > 0;
2664 }
2665
2666
2667
2668
2669 /*************************************************
2670 * Read bytes from TLS channel *
2671 *************************************************/
2672
2673 /* This does not feed DKIM, so if the caller uses this for reading message body,
2674 then the caller must feed DKIM.
2675
2676 Arguments:
2677 ct_ctx client context pointer, or NULL for the one global server context
2678 buff buffer of data
2679 len size of buffer
2680
2681 Returns: the number of bytes read
2682 -1 after a failed read, including EOF
2683 */
2684
2685 int
2686 tls_read(void * ct_ctx, uschar *buff, size_t len)
2687 {
2688 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
2689 ssize_t inbytes;
2690
2691 if (len > INT_MAX)
2692 len = INT_MAX;
2693
2694 if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2695 DEBUG(D_tls)
2696 debug_printf("*** PROBABLY A BUG *** " \
2697 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2698 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2699
2700 DEBUG(D_tls)
2701 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2702 state->session, buff, len);
2703
2704 inbytes = gnutls_record_recv(state->session, buff, len);
2705 if (inbytes > 0) return inbytes;
2706 if (inbytes == 0)
2707 {
2708 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2709 }
2710 else record_io_error(state, (int)inbytes, US"recv", NULL);
2711
2712 return -1;
2713 }
2714
2715
2716
2717
2718 /*************************************************
2719 * Write bytes down TLS channel *
2720 *************************************************/
2721
2722 /*
2723 Arguments:
2724 ct_ctx client context pointer, or NULL for the one global server context
2725 buff buffer of data
2726 len number of bytes
2727 more more data expected soon
2728
2729 Returns: the number of bytes after a successful write,
2730 -1 after a failed write
2731 */
2732
2733 int
2734 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
2735 {
2736 ssize_t outbytes;
2737 size_t left = len;
2738 exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
2739 #ifdef SUPPORT_CORK
2740 static BOOL corked = FALSE;
2741
2742 if (more && !corked) gnutls_record_cork(state->session);
2743 #endif
2744
2745 DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
2746 buff, left, more ? ", more" : "");
2747
2748 while (left > 0)
2749 {
2750 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2751 buff, left);
2752 outbytes = gnutls_record_send(state->session, buff, left);
2753
2754 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
2755 if (outbytes < 0)
2756 {
2757 record_io_error(state, outbytes, US"send", NULL);
2758 return -1;
2759 }
2760 if (outbytes == 0)
2761 {
2762 record_io_error(state, 0, US"send", US"TLS channel closed on write");
2763 return -1;
2764 }
2765
2766 left -= outbytes;
2767 buff += outbytes;
2768 }
2769
2770 if (len > INT_MAX)
2771 {
2772 DEBUG(D_tls)
2773 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2774 len);
2775 len = INT_MAX;
2776 }
2777
2778 #ifdef SUPPORT_CORK
2779 if (more != corked)
2780 {
2781 if (!more) (void) gnutls_record_uncork(state->session, 0);
2782 corked = more;
2783 }
2784 #endif
2785
2786 return (int) len;
2787 }
2788
2789
2790
2791
2792 /*************************************************
2793 * Random number generation *
2794 *************************************************/
2795
2796 /* Pseudo-random number generation. The result is not expected to be
2797 cryptographically strong but not so weak that someone will shoot themselves
2798 in the foot using it as a nonce in input in some email header scheme or
2799 whatever weirdness they'll twist this into. The result should handle fork()
2800 and avoid repeating sequences. OpenSSL handles that for us.
2801
2802 Arguments:
2803 max range maximum
2804 Returns a random number in range [0, max-1]
2805 */
2806
2807 #ifdef HAVE_GNUTLS_RND
2808 int
2809 vaguely_random_number(int max)
2810 {
2811 unsigned int r;
2812 int i, needed_len;
2813 uschar *p;
2814 uschar smallbuf[sizeof(r)];
2815
2816 if (max <= 1)
2817 return 0;
2818
2819 needed_len = sizeof(r);
2820 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2821 * asked for a number less than 10. */
2822 for (r = max, i = 0; r; ++i)
2823 r >>= 1;
2824 i = (i + 7) / 8;
2825 if (i < needed_len)
2826 needed_len = i;
2827
2828 i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2829 if (i < 0)
2830 {
2831 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2832 return vaguely_random_number_fallback(max);
2833 }
2834 r = 0;
2835 for (p = smallbuf; needed_len; --needed_len, ++p)
2836 {
2837 r *= 256;
2838 r += *p;
2839 }
2840
2841 /* We don't particularly care about weighted results; if someone wants
2842 * smooth distribution and cares enough then they should submit a patch then. */
2843 return r % max;
2844 }
2845 #else /* HAVE_GNUTLS_RND */
2846 int
2847 vaguely_random_number(int max)
2848 {
2849 return vaguely_random_number_fallback(max);
2850 }
2851 #endif /* HAVE_GNUTLS_RND */
2852
2853
2854
2855
2856 /*************************************************
2857 * Let tls_require_ciphers be checked at startup *
2858 *************************************************/
2859
2860 /* The tls_require_ciphers option, if set, must be something which the
2861 library can parse.
2862
2863 Returns: NULL on success, or error message
2864 */
2865
2866 uschar *
2867 tls_validate_require_cipher(void)
2868 {
2869 int rc;
2870 uschar *expciphers = NULL;
2871 gnutls_priority_t priority_cache;
2872 const char *errpos;
2873 uschar * dummy_errstr;
2874
2875 #define validate_check_rc(Label) do { \
2876 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2877 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2878 #define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2879
2880 if (exim_gnutls_base_init_done)
2881 log_write(0, LOG_MAIN|LOG_PANIC,
2882 "already initialised GnuTLS, Exim developer bug");
2883
2884 #ifdef HAVE_GNUTLS_PKCS11
2885 if (!gnutls_allow_auto_pkcs11)
2886 {
2887 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2888 validate_check_rc(US"gnutls_pkcs11_init");
2889 }
2890 #endif
2891 rc = gnutls_global_init();
2892 validate_check_rc(US"gnutls_global_init()");
2893 exim_gnutls_base_init_done = TRUE;
2894
2895 if (!(tls_require_ciphers && *tls_require_ciphers))
2896 return_deinit(NULL);
2897
2898 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
2899 &dummy_errstr))
2900 return_deinit(US"failed to expand tls_require_ciphers");
2901
2902 if (!(expciphers && *expciphers))
2903 return_deinit(NULL);
2904
2905 DEBUG(D_tls)
2906 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2907
2908 rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2909 validate_check_rc(string_sprintf(
2910 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2911 expciphers, errpos - CS expciphers, errpos));
2912
2913 #undef return_deinit
2914 #undef validate_check_rc
2915 gnutls_global_deinit();
2916
2917 return NULL;
2918 }
2919
2920
2921
2922
2923 /*************************************************
2924 * Report the library versions. *
2925 *************************************************/
2926
2927 /* See a description in tls-openssl.c for an explanation of why this exists.
2928
2929 Arguments: a FILE* to print the results to
2930 Returns: nothing
2931 */
2932
2933 void
2934 tls_version_report(FILE *f)
2935 {
2936 fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2937 " Runtime: %s\n",
2938 LIBGNUTLS_VERSION,
2939 gnutls_check_version(NULL));
2940 }
2941
2942 /* vi: aw ai sw=2
2943 */
2944 /* End of tls-gnu.c */