Move certificate name checking to mainline, default enabled
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
16Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
a5f239e4
PP
42/* needed to disable PKCS11 autoload unless requested */
43#if GNUTLS_VERSION_NUMBER >= 0x020c00
44# include <gnutls/pkcs11.h>
45#endif
7e07527a
JH
46#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
47# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
48# define DISABLE_OCSP
49#endif
774ef2d7
JH
50#if GNUTLS_VERSION_NUMBER < 0x020a00 && defined(EXPERIMENTAL_EVENT)
51# warning "GnuTLS library version too old; tls:cert event unsupported"
52# undef EXPERIMENTAL_EVENT
a7538db1 53#endif
a7fec7a7
JH
54#if GNUTLS_VERSION_NUMBER >= 0x030306
55# define SUPPORT_CA_DIR
56#else
57# undef SUPPORT_CA_DIR
58#endif
7e07527a 59
f2de3a33 60#ifndef DISABLE_OCSP
2b4a568d
JH
61# include <gnutls/ocsp.h>
62#endif
059ec3d9 63
17c76198 64/* GnuTLS 2 vs 3
059ec3d9 65
17c76198
PP
66GnuTLS 3 only:
67 gnutls_global_set_audit_log_function()
059ec3d9 68
17c76198
PP
69Changes:
70 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
71*/
059ec3d9 72
17c76198 73/* Local static variables for GnuTLS */
059ec3d9 74
17c76198 75/* Values for verify_requirement */
059ec3d9 76
e51c7be2 77enum peer_verify_requirement
aa2a70ba 78 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
059ec3d9 79
17c76198
PP
80/* This holds most state for server or client; with this, we can set up an
81outbound TLS-enabled connection in an ACL callout, while not stomping all
82over the TLS variables available for expansion.
059ec3d9 83
17c76198
PP
84Some of these correspond to variables in globals.c; those variables will
85be set to point to content in one of these instances, as appropriate for
86the stage of the process lifetime.
059ec3d9 87
389ca47a 88Not handled here: global tls_channelbinding_b64.
17c76198 89*/
059ec3d9 90
17c76198 91typedef struct exim_gnutls_state {
9d1c15ef 92 gnutls_session_t session;
17c76198 93 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 94 gnutls_priority_t priority_cache;
17c76198 95 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
96 int fd_in;
97 int fd_out;
98 BOOL peer_cert_verified;
99 BOOL trigger_sni_changes;
100 BOOL have_set_peerdn;
17c76198 101 const struct host_item *host;
9d1c15ef
JH
102 gnutls_x509_crt_t peercert;
103 uschar *peerdn;
104 uschar *ciphersuite;
105 uschar *received_sni;
17c76198
PP
106
107 const uschar *tls_certificate;
108 const uschar *tls_privatekey;
109 const uschar *tls_sni; /* client send only, not received */
110 const uschar *tls_verify_certificates;
111 const uschar *tls_crl;
112 const uschar *tls_require_ciphers;
e51c7be2 113
17c76198
PP
114 uschar *exp_tls_certificate;
115 uschar *exp_tls_privatekey;
17c76198
PP
116 uschar *exp_tls_verify_certificates;
117 uschar *exp_tls_crl;
118 uschar *exp_tls_require_ciphers;
44662487 119 uschar *exp_tls_ocsp_file;
e51c7be2 120 uschar *exp_tls_verify_cert_hostnames;
774ef2d7 121#ifdef EXPERIMENTAL_EVENT
a7538db1
JH
122 uschar *event_action;
123#endif
17c76198 124
389ca47a 125 tls_support *tlsp; /* set in tls_init() */
817d9f57 126
17c76198
PP
127 uschar *xfer_buffer;
128 int xfer_buffer_lwm;
129 int xfer_buffer_hwm;
130 int xfer_eof;
131 int xfer_error;
17c76198
PP
132} exim_gnutls_state_st;
133
134static const exim_gnutls_state_st exim_gnutls_state_init = {
4fe99a6c 135 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
75fe387d 136 NULL, NULL, NULL, NULL,
17c76198 137 NULL, NULL, NULL, NULL, NULL, NULL,
44662487 138 NULL, NULL, NULL, NULL, NULL, NULL, NULL,
01a4a5c5 139 NULL,
774ef2d7 140#ifdef EXPERIMENTAL_EVENT
a7538db1
JH
141 NULL,
142#endif
817d9f57 143 NULL,
17c76198 144 NULL, 0, 0, 0, 0,
17c76198 145};
83da1223 146
17c76198
PP
147/* Not only do we have our own APIs which don't pass around state, assuming
148it's held in globals, GnuTLS doesn't appear to let us register callback data
149for callbacks, or as part of the session, so we have to keep a "this is the
150context we're currently dealing with" pointer and rely upon being
151single-threaded to keep from processing data on an inbound TLS connection while
152talking to another TLS connection for an outbound check. This does mean that
153there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
154second connection.
155XXX But see gnutls_session_get_ptr()
156*/
059ec3d9 157
17c76198 158static exim_gnutls_state_st state_server, state_client;
059ec3d9 159
17c76198
PP
160/* dh_params are initialised once within the lifetime of a process using TLS;
161if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
162don't want to repeat this. */
83da1223 163
17c76198 164static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 165
17c76198 166/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 167
17c76198 168static const int ssl_session_timeout = 200;
059ec3d9 169
17c76198 170static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 171
17c76198 172/* Guard library core initialisation */
83da1223 173
17c76198 174static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 175
059ec3d9 176
17c76198 177/* ------------------------------------------------------------------------ */
17c76198 178/* macros */
83da1223 179
17c76198 180#define MAX_HOST_LEN 255
83da1223 181
17c76198
PP
182/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
183the library logging; a value less than 0 disables the calls to set up logging
184callbacks. */
2c17bb02 185#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
a7538db1 186# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 187#endif
83da1223 188
2c17bb02 189#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 190# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 191#endif
83da1223 192
af3498d6
PP
193/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
194can ask for a bit-strength. Without that, we stick to the constant we had
195before, for now. */
2c17bb02 196#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 197# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 198#endif
af3498d6 199
17c76198
PP
200#define exim_gnutls_err_check(Label) do { \
201 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
059ec3d9 202
17c76198 203#define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
83da1223 204
17c76198 205#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
206# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
207# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
208# define HAVE_GNUTLS_RND
2519e60d
TL
209/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
210 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
211 * isn't available sometimes, so this needs to become a conditional
212 * compilation; the sanest way to deal with this being a problem on
213 * older OSes is to block it in the Local/Makefile with this compiler
214 * definition */
e51c7be2
JH
215# ifndef AVOID_GNUTLS_PKCS11
216# define HAVE_GNUTLS_PKCS11
217# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 218#endif
83da1223 219
af3498d6
PP
220
221
222
223/* ------------------------------------------------------------------------ */
224/* Callback declarations */
225
226#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
227static void exim_gnutls_logger_cb(int level, const char *message);
228#endif
229
230static int exim_sni_handling_cb(gnutls_session_t session);
231
f2de3a33 232#ifndef DISABLE_OCSP
44662487
JH
233static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
234 gnutls_datum_t * ocsp_response);
235#endif
af3498d6
PP
236
237
238
17c76198
PP
239/* ------------------------------------------------------------------------ */
240/* Static functions */
059ec3d9
PH
241
242/*************************************************
243* Handle TLS error *
244*************************************************/
245
246/* Called from lots of places when errors occur before actually starting to do
247the TLS handshake, that is, while the session is still in clear. Always returns
248DEFER for a server and FAIL for a client so that most calls can use "return
249tls_error(...)" to do this processing and then give an appropriate return. A
250single function is used for both server and client, because it is called from
251some shared functions.
252
253Argument:
254 prefix text to include in the logged error
7199e1ee
TF
255 msg additional error string (may be NULL)
256 usually obtained from gnutls_strerror()
17c76198
PP
257 host NULL if setting up a server;
258 the connected host if setting up a client
059ec3d9
PH
259
260Returns: OK/DEFER/FAIL
261*/
262
263static int
17c76198 264tls_error(const uschar *prefix, const char *msg, const host_item *host)
059ec3d9 265{
17c76198
PP
266if (host)
267 {
c562fd30 268 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s)%s%s",
17c76198
PP
269 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
270 return FAIL;
271 }
272else
059ec3d9 273 {
7199e1ee 274 uschar *conn_info = smtp_get_connection_info();
17c76198 275 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee 276 conn_info += 5;
c562fd30 277 /* I'd like to get separated H= here, but too hard for now */
7199e1ee 278 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
17c76198 279 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
059ec3d9
PH
280 return DEFER;
281 }
059ec3d9
PH
282}
283
284
285
17c76198 286
059ec3d9 287/*************************************************
17c76198 288* Deal with logging errors during I/O *
059ec3d9
PH
289*************************************************/
290
17c76198 291/* We have to get the identity of the peer from saved data.
059ec3d9 292
17c76198
PP
293Argument:
294 state the current GnuTLS exim state container
295 rc the GnuTLS error code, or 0 if it's a local error
296 when text identifying read or write
297 text local error text when ec is 0
059ec3d9 298
17c76198 299Returns: nothing
059ec3d9
PH
300*/
301
17c76198
PP
302static void
303record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 304{
17c76198 305const char *msg;
059ec3d9 306
17c76198
PP
307if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
308 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
309 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
310else
311 msg = gnutls_strerror(rc);
059ec3d9 312
17c76198
PP
313tls_error(when, msg, state->host);
314}
059ec3d9 315
059ec3d9 316
059ec3d9 317
059ec3d9 318
17c76198
PP
319/*************************************************
320* Set various Exim expansion vars *
321*************************************************/
059ec3d9 322
e51c7be2
JH
323#define exim_gnutls_cert_err(Label) \
324 do \
325 { \
326 if (rc != GNUTLS_E_SUCCESS) \
327 { \
328 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
329 (Label), gnutls_strerror(rc)); \
330 return rc; \
331 } \
332 } while (0)
9d1c15ef
JH
333
334static int
335import_cert(const gnutls_datum * cert, gnutls_x509_crt_t * crtp)
336{
337int rc;
338
339rc = gnutls_x509_crt_init(crtp);
340exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
341
342rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
343exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
344
345return rc;
346}
347
348#undef exim_gnutls_cert_err
349
350
17c76198
PP
351/* We set various Exim global variables from the state, once a session has
352been established. With TLS callouts, may need to change this to stack
353variables, or just re-call it with the server state after client callout
354has finished.
059ec3d9 355
9d1c15ef 356Make sure anything set here is unset in tls_getc().
17c76198
PP
357
358Sets:
359 tls_active fd
360 tls_bits strength indicator
361 tls_certificate_verified bool indicator
362 tls_channelbinding_b64 for some SASL mechanisms
363 tls_cipher a string
9d1c15ef 364 tls_peercert pointer to library internal
17c76198
PP
365 tls_peerdn a string
366 tls_sni a (UTF-8) string
9d1c15ef 367 tls_ourcert pointer to library internal
17c76198
PP
368
369Argument:
370 state the relevant exim_gnutls_state_st *
371*/
372
373static void
9d1c15ef 374extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 375{
17c76198 376gnutls_cipher_algorithm_t cipher;
17c76198
PP
377#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
378int old_pool;
379int rc;
380gnutls_datum_t channel;
381#endif
9d1c15ef 382tls_support * tlsp = state->tlsp;
17c76198 383
9d1c15ef 384tlsp->active = state->fd_out;
17c76198
PP
385
386cipher = gnutls_cipher_get(state->session);
387/* returns size in "bytes" */
9d1c15ef 388tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 389
9d1c15ef 390tlsp->cipher = state->ciphersuite;
17c76198 391
817d9f57 392DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 393
9d1c15ef 394tlsp->certificate_verified = state->peer_cert_verified;
059ec3d9 395
17c76198
PP
396/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
397only available for use for authenticators while this TLS session is running. */
398
399tls_channelbinding_b64 = NULL;
400#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
401channel.data = NULL;
402channel.size = 0;
403rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
404if (rc) {
405 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
406} else {
407 old_pool = store_pool;
408 store_pool = POOL_PERM;
409 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
410 store_pool = old_pool;
411 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
412}
413#endif
414
9d1c15ef
JH
415/* peercert is set in peer_status() */
416tlsp->peerdn = state->peerdn;
417tlsp->sni = state->received_sni;
418
419/* record our certificate */
420 {
421 const gnutls_datum * cert = gnutls_certificate_get_ours(state->session);
422 gnutls_x509_crt_t crt;
423
424 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
425 }
059ec3d9
PH
426}
427
428
429
17c76198 430
059ec3d9 431/*************************************************
575643cd 432* Setup up DH parameters *
059ec3d9
PH
433*************************************************/
434
575643cd 435/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
436be re-generated every so often, depending on security policy. What we do is to
437keep these parameters in a file in the spool directory. If the file does not
438exist, we generate them. This means that it is easy to cause a regeneration.
439
440The new file is written as a temporary file and renamed, so that an incomplete
441file is never present. If two processes both compute some new parameters, you
442waste a bit of effort, but it doesn't seem worth messing around with locking to
443prevent this.
444
059ec3d9
PH
445Returns: OK/DEFER/FAIL
446*/
447
448static int
17c76198 449init_server_dh(void)
059ec3d9 450{
17c76198
PP
451int fd, rc;
452unsigned int dh_bits;
b5aea5e1 453gnutls_datum m;
a799883d
PP
454uschar filename_buf[PATH_MAX];
455uschar *filename = NULL;
17c76198 456size_t sz;
a799883d
PP
457uschar *exp_tls_dhparam;
458BOOL use_file_in_spool = FALSE;
459BOOL use_fixed_file = FALSE;
17c76198 460host_item *host = NULL; /* dummy for macros */
059ec3d9 461
17c76198 462DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 463
17c76198
PP
464rc = gnutls_dh_params_init(&dh_server_params);
465exim_gnutls_err_check(US"gnutls_dh_params_init");
059ec3d9 466
a799883d
PP
467m.data = NULL;
468m.size = 0;
469
470if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
471 return DEFER;
472
473if (!exp_tls_dhparam)
474 {
475 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
476 m.data = US std_dh_prime_default();
477 m.size = Ustrlen(m.data);
478 }
479else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
480 use_file_in_spool = TRUE;
481else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
482 {
483 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
484 return OK;
485 }
486else if (exp_tls_dhparam[0] != '/')
487 {
488 m.data = US std_dh_prime_named(exp_tls_dhparam);
489 if (m.data == NULL)
490 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
491 m.size = Ustrlen(m.data);
492 }
493else
494 {
495 use_fixed_file = TRUE;
496 filename = exp_tls_dhparam;
497 }
498
499if (m.data)
500 {
501 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
502 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
503 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
504 return OK;
505 }
506
af3498d6
PP
507#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
508/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
509different filename and ensure we have sufficient bits. */
510dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
511if (!dh_bits)
512 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
af3498d6 513DEBUG(D_tls)
b34fc30c 514 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
515 dh_bits);
516#else
517dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
518DEBUG(D_tls)
519 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
520 dh_bits);
521#endif
059ec3d9 522
3375e053
PP
523/* Some clients have hard-coded limits. */
524if (dh_bits > tls_dh_max_bits)
525 {
526 DEBUG(D_tls)
527 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
528 tls_dh_max_bits);
529 dh_bits = tls_dh_max_bits;
530 }
531
a799883d
PP
532if (use_file_in_spool)
533 {
534 if (!string_format(filename_buf, sizeof(filename_buf),
535 "%s/gnutls-params-%d", spool_directory, dh_bits))
536 return tls_error(US"overlong filename", NULL, NULL);
537 filename = filename_buf;
538 }
059ec3d9 539
b5aea5e1 540/* Open the cache file for reading and if successful, read it and set up the
575643cd 541parameters. */
059ec3d9
PH
542
543fd = Uopen(filename, O_RDONLY, 0);
b5aea5e1 544if (fd >= 0)
059ec3d9 545 {
b5aea5e1 546 struct stat statbuf;
17c76198
PP
547 FILE *fp;
548 int saved_errno;
549
550 if (fstat(fd, &statbuf) < 0) /* EIO */
551 {
552 saved_errno = errno;
553 (void)close(fd);
554 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
555 }
556 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
557 {
558 (void)close(fd);
17c76198
PP
559 return tls_error(US"TLS cache not a file", NULL, NULL);
560 }
561 fp = fdopen(fd, "rb");
562 if (!fp)
563 {
564 saved_errno = errno;
565 (void)close(fd);
566 return tls_error(US"fdopen(TLS cache stat fd) failed",
567 strerror(saved_errno), NULL);
b5aea5e1 568 }
059ec3d9 569
b5aea5e1
PH
570 m.size = statbuf.st_size;
571 m.data = malloc(m.size);
572 if (m.data == NULL)
17c76198
PP
573 {
574 fclose(fp);
575 return tls_error(US"malloc failed", strerror(errno), NULL);
576 }
577 sz = fread(m.data, m.size, 1, fp);
578 if (!sz)
579 {
580 saved_errno = errno;
581 fclose(fp);
582 free(m.data);
583 return tls_error(US"fread failed", strerror(saved_errno), NULL);
584 }
585 fclose(fp);
b5aea5e1 586
17c76198 587 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 588 free(m.data);
17c76198
PP
589 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
590 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
591 }
592
593/* If the file does not exist, fall through to compute new data and cache it.
594If there was any other opening error, it is serious. */
595
182ad5cf
PH
596else if (errno == ENOENT)
597 {
17c76198 598 rc = -1;
182ad5cf 599 DEBUG(D_tls)
17c76198 600 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
601 }
602else
17c76198
PP
603 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
604 NULL, NULL);
b5aea5e1
PH
605
606/* If ret < 0, either the cache file does not exist, or the data it contains
607is not useful. One particular case of this is when upgrading from an older
608release of Exim in which the data was stored in a different format. We don't
609try to be clever and support both formats; we just regenerate new data in this
610case. */
611
17c76198 612if (rc < 0)
b5aea5e1 613 {
17c76198 614 uschar *temp_fn;
201f5254 615 unsigned int dh_bits_gen = dh_bits;
059ec3d9 616
17c76198
PP
617 if ((PATH_MAX - Ustrlen(filename)) < 10)
618 return tls_error(US"Filename too long to generate replacement",
619 CS filename, NULL);
059ec3d9 620
17c76198
PP
621 temp_fn = string_copy(US "%s.XXXXXXX");
622 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
059ec3d9 623 if (fd < 0)
17c76198 624 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
059ec3d9
PH
625 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
626
201f5254
PP
627 /* GnuTLS overshoots!
628 * If we ask for 2236, we might get 2237 or more.
629 * But there's no way to ask GnuTLS how many bits there really are.
630 * We can ask how many bits were used in a TLS session, but that's it!
631 * The prime itself is hidden behind too much abstraction.
632 * So we ask for less, and proceed on a wing and a prayer.
633 * First attempt, subtracted 3 for 2233 and got 2240.
634 */
cae6e576 635 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
636 {
637 dh_bits_gen = dh_bits - 10;
638 DEBUG(D_tls)
639 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
640 dh_bits_gen);
641 }
642
643 DEBUG(D_tls)
644 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
645 dh_bits_gen);
646 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
17c76198
PP
647 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
648
649 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
650 and I confirmed that a NULL call to get the size first is how the GnuTLS
651 sample apps handle this. */
652
653 sz = 0;
654 m.data = NULL;
655 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
656 m.data, &sz);
657 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
658 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
659 m.size = sz;
b5aea5e1
PH
660 m.data = malloc(m.size);
661 if (m.data == NULL)
17c76198 662 return tls_error(US"memory allocation failed", strerror(errno), NULL);
1f00591e 663 /* this will return a size 1 less than the allocation size above */
17c76198 664 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 665 m.data, &sz);
17c76198
PP
666 if (rc != GNUTLS_E_SUCCESS)
667 {
668 free(m.data);
669 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
670 }
1f00591e 671 m.size = sz; /* shrink by 1, probably */
059ec3d9 672
17c76198
PP
673 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
674 if (sz != m.size)
675 {
676 free(m.data);
677 return tls_error(US"TLS cache write D-H params failed",
678 strerror(errno), NULL);
679 }
b5aea5e1 680 free(m.data);
17c76198
PP
681 sz = write_to_fd_buf(fd, US"\n", 1);
682 if (sz != 1)
683 return tls_error(US"TLS cache write D-H params final newline failed",
684 strerror(errno), NULL);
685
686 rc = close(fd);
687 if (rc)
688 return tls_error(US"TLS cache write close() failed",
689 strerror(errno), NULL);
059ec3d9 690
17c76198
PP
691 if (Urename(temp_fn, filename) < 0)
692 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
693 temp_fn, filename), strerror(errno), NULL);
059ec3d9 694
17c76198 695 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
696 }
697
17c76198 698DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
699return OK;
700}
701
702
703
704
705/*************************************************
17c76198 706* Variables re-expanded post-SNI *
059ec3d9
PH
707*************************************************/
708
17c76198
PP
709/* Called from both server and client code, via tls_init(), and also from
710the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
711
712We can tell the two apart by state->received_sni being non-NULL in callback.
713
714The callback should not call us unless state->trigger_sni_changes is true,
715which we are responsible for setting on the first pass through.
059ec3d9
PH
716
717Arguments:
17c76198 718 state exim_gnutls_state_st *
059ec3d9
PH
719
720Returns: OK/DEFER/FAIL
721*/
722
723static int
17c76198 724tls_expand_session_files(exim_gnutls_state_st *state)
059ec3d9 725{
1365611d 726struct stat statbuf;
059ec3d9 727int rc;
17c76198
PP
728const host_item *host = state->host; /* macro should be reconsidered? */
729uschar *saved_tls_certificate = NULL;
730uschar *saved_tls_privatekey = NULL;
731uschar *saved_tls_verify_certificates = NULL;
732uschar *saved_tls_crl = NULL;
733int cert_count;
734
735/* We check for tls_sni *before* expansion. */
2b4a568d 736if (!host) /* server */
17c76198
PP
737 {
738 if (!state->received_sni)
739 {
d9b2312b
JH
740 if (state->tls_certificate &&
741 (Ustrstr(state->tls_certificate, US"tls_sni") ||
742 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
743 Ustrstr(state->tls_certificate, US"tls_out_sni")
744 ))
17c76198
PP
745 {
746 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
747 state->trigger_sni_changes = TRUE;
748 }
749 }
750 else
751 {
1365611d 752 /* useful for debugging */
17c76198
PP
753 saved_tls_certificate = state->exp_tls_certificate;
754 saved_tls_privatekey = state->exp_tls_privatekey;
755 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
756 saved_tls_crl = state->exp_tls_crl;
757 }
758 }
059ec3d9 759
1365611d
PP
760rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
761exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
762
17c76198
PP
763/* remember: expand_check_tlsvar() is expand_check() but fiddling with
764state members, assuming consistent naming; and expand_check() returns
765false if expansion failed, unless expansion was forced to fail. */
059ec3d9 766
17c76198
PP
767/* check if we at least have a certificate, before doing expensive
768D-H generation. */
059ec3d9 769
17c76198
PP
770if (!expand_check_tlsvar(tls_certificate))
771 return DEFER;
059ec3d9 772
17c76198 773/* certificate is mandatory in server, optional in client */
059ec3d9 774
17c76198
PP
775if ((state->exp_tls_certificate == NULL) ||
776 (*state->exp_tls_certificate == '\0'))
777 {
2b4a568d 778 if (!host)
17c76198
PP
779 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
780 else
781 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
782 }
059ec3d9 783
17c76198 784if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
059ec3d9
PH
785 return DEFER;
786
17c76198
PP
787/* tls_privatekey is optional, defaulting to same file as certificate */
788
789if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 790 {
17c76198
PP
791 state->tls_privatekey = state->tls_certificate;
792 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 793 }
c91535f3 794
059ec3d9 795
17c76198 796if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
797 {
798 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
799 state->exp_tls_certificate, state->exp_tls_privatekey);
800
801 if (state->received_sni)
de365ded 802 {
17c76198
PP
803 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
804 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
805 {
b34fc30c 806 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
807 }
808 else
809 {
b34fc30c 810 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 811 }
8e669ac1 812 }
059ec3d9 813
1365611d
PP
814 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
815 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
816 GNUTLS_X509_FMT_PEM);
817 exim_gnutls_err_check(
818 string_sprintf("cert/key setup: cert=%s key=%s",
819 state->exp_tls_certificate, state->exp_tls_privatekey));
820 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
b34fc30c 821 } /* tls_certificate */
059ec3d9 822
2b4a568d
JH
823
824/* Set the OCSP stapling server info */
825
f2de3a33 826#ifndef DISABLE_OCSP
2b4a568d
JH
827if ( !host /* server */
828 && tls_ocsp_file
829 )
830 {
44662487
JH
831 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file",
832 &state->exp_tls_ocsp_file))
2b4a568d
JH
833 return DEFER;
834
44662487
JH
835 /* Use the full callback method for stapling just to get observability.
836 More efficient would be to read the file once only, if it never changed
837 (due to SNI). Would need restart on file update, or watch datestamp. */
838
839 gnutls_certificate_set_ocsp_status_request_function(state->x509_cred,
840 server_ocsp_stapling_cb, state->exp_tls_ocsp_file);
2b4a568d 841
44662487 842 DEBUG(D_tls) debug_printf("Set OCSP response file %s\n", &state->exp_tls_ocsp_file);
2b4a568d
JH
843 }
844#endif
845
846
059ec3d9
PH
847/* Set the trusted CAs file if one is provided, and then add the CRL if one is
848provided. Experiment shows that, if the certificate file is empty, an unhelpful
849error message is provided. However, if we just refrain from setting anything up
850in that case, certificate verification fails, which seems to be the correct
851behaviour. */
852
17c76198 853if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 854 {
17c76198 855 if (!expand_check_tlsvar(tls_verify_certificates))
059ec3d9 856 return DEFER;
17c76198
PP
857 if (state->tls_crl && *state->tls_crl)
858 if (!expand_check_tlsvar(tls_crl))
859 return DEFER;
059ec3d9 860
1365611d
PP
861 if (!(state->exp_tls_verify_certificates &&
862 *state->exp_tls_verify_certificates))
b34fc30c
PP
863 {
864 DEBUG(D_tls)
1365611d
PP
865 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
866 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 867 return OK;
b34fc30c 868 }
1365611d 869 }
83e2f8a2
PP
870else
871 {
872 DEBUG(D_tls)
873 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
874 return OK;
875 }
17c76198 876
1365611d
PP
877if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
878 {
879 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
880 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
881 strerror(errno));
882 return DEFER;
883 }
17c76198 884
a7fec7a7 885#ifndef SUPPORT_CA_DIR
619b2b25
PP
886/* The test suite passes in /dev/null; we could check for that path explicitly,
887but who knows if someone has some weird FIFO which always dumps some certs, or
888other weirdness. The thing we really want to check is that it's not a
889directory, since while OpenSSL supports that, GnuTLS does not.
890So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
891if (S_ISDIR(statbuf.st_mode))
1365611d
PP
892 {
893 DEBUG(D_tls)
619b2b25
PP
894 debug_printf("verify certificates path is a dir: \"%s\"\n",
895 state->exp_tls_verify_certificates);
1365611d 896 log_write(0, LOG_MAIN|LOG_PANIC,
619b2b25 897 "tls_verify_certificates \"%s\" is a directory",
1365611d
PP
898 state->exp_tls_verify_certificates);
899 return DEFER;
900 }
a7fec7a7 901#endif
059ec3d9 902
1365611d
PP
903DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
904 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 905
1365611d
PP
906if (statbuf.st_size == 0)
907 {
908 DEBUG(D_tls)
909 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
910 return OK;
911 }
059ec3d9 912
a7fec7a7
JH
913cert_count =
914
915#ifdef SUPPORT_CA_DIR
916 (statbuf.st_mode & S_IFMT) == S_IFDIR
917 ?
918 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
919 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
920 :
921#endif
922 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1365611d 923 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
a7fec7a7 924
1365611d
PP
925if (cert_count < 0)
926 {
927 rc = cert_count;
928 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
929 }
930DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 931
5c8cda3a
PP
932if (state->tls_crl && *state->tls_crl &&
933 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 934 {
5c8cda3a
PP
935 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
936 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
937 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
938 if (cert_count < 0)
1365611d 939 {
5c8cda3a 940 rc = cert_count;
1365611d
PP
941 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
942 }
5c8cda3a 943 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 944 }
059ec3d9 945
059ec3d9
PH
946return OK;
947}
948
949
950
951
952/*************************************************
1365611d
PP
953* Set X.509 state variables *
954*************************************************/
955
956/* In GnuTLS, the registered cert/key are not replaced by a later
957set of a cert/key, so for SNI support we need a whole new x509_cred
958structure. Which means various other non-re-expanded pieces of state
959need to be re-set in the new struct, so the setting logic is pulled
960out to this.
961
962Arguments:
963 state exim_gnutls_state_st *
964
965Returns: OK/DEFER/FAIL
966*/
967
968static int
969tls_set_remaining_x509(exim_gnutls_state_st *state)
970{
971int rc;
972const host_item *host = state->host; /* macro should be reconsidered? */
973
974/* Create D-H parameters, or read them from the cache file. This function does
975its own SMTP error messaging. This only happens for the server, TLS D-H ignores
976client-side params. */
977
978if (!state->host)
979 {
980 if (!dh_server_params)
981 {
982 rc = init_server_dh();
983 if (rc != OK) return rc;
984 }
985 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
986 }
987
988/* Link the credentials to the session. */
989
990rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
991exim_gnutls_err_check(US"gnutls_credentials_set");
992
993return OK;
994}
995
996/*************************************************
17c76198 997* Initialize for GnuTLS *
059ec3d9
PH
998*************************************************/
999
17c76198
PP
1000/* Called from both server and client code. In the case of a server, errors
1001before actual TLS negotiation return DEFER.
059ec3d9
PH
1002
1003Arguments:
17c76198
PP
1004 host connected host, if client; NULL if server
1005 certificate certificate file
1006 privatekey private key file
1007 sni TLS SNI to send, sometimes when client; else NULL
1008 cas CA certs file
1009 crl CRL file
1010 require_ciphers tls_require_ciphers setting
817d9f57 1011 caller_state returned state-info structure
059ec3d9 1012
17c76198 1013Returns: OK/DEFER/FAIL
059ec3d9
PH
1014*/
1015
17c76198
PP
1016static int
1017tls_init(
1018 const host_item *host,
1019 const uschar *certificate,
1020 const uschar *privatekey,
1021 const uschar *sni,
1022 const uschar *cas,
1023 const uschar *crl,
1024 const uschar *require_ciphers,
1025 exim_gnutls_state_st **caller_state)
059ec3d9 1026{
17c76198
PP
1027exim_gnutls_state_st *state;
1028int rc;
1029size_t sz;
1030const char *errpos;
1031uschar *p;
1032BOOL want_default_priorities;
1033
1034if (!exim_gnutls_base_init_done)
059ec3d9 1035 {
17c76198
PP
1036 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1037
a5f239e4
PP
1038#ifdef HAVE_GNUTLS_PKCS11
1039 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1040 which loads modules from a config file, which sounds good and may be wanted
1041 by some sysadmin, but also means in common configurations that GNOME keyring
1042 environment variables are used and so breaks for users calling mailq.
1043 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1044 if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
1045 {
1046 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1047 exim_gnutls_err_check(US"gnutls_pkcs11_init");
1048 }
1049#endif
1050
17c76198
PP
1051 rc = gnutls_global_init();
1052 exim_gnutls_err_check(US"gnutls_global_init");
1053
1054#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1055 DEBUG(D_tls)
059ec3d9 1056 {
17c76198
PP
1057 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1058 /* arbitrarily chosen level; bump upto 9 for more */
1059 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1060 }
17c76198
PP
1061#endif
1062
1063 exim_gnutls_base_init_done = TRUE;
059ec3d9 1064 }
059ec3d9 1065
17c76198
PP
1066if (host)
1067 {
1068 state = &state_client;
1069 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 1070 state->tlsp = &tls_out;
17c76198
PP
1071 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1072 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1073 }
1074else
1075 {
1076 state = &state_server;
1077 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 1078 state->tlsp = &tls_in;
17c76198
PP
1079 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1080 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1081 }
1082exim_gnutls_err_check(US"gnutls_init");
059ec3d9 1083
17c76198 1084state->host = host;
059ec3d9 1085
17c76198
PP
1086state->tls_certificate = certificate;
1087state->tls_privatekey = privatekey;
5779e6aa 1088state->tls_require_ciphers = require_ciphers;
17c76198
PP
1089state->tls_sni = sni;
1090state->tls_verify_certificates = cas;
1091state->tls_crl = crl;
059ec3d9 1092
17c76198
PP
1093/* This handles the variables that might get re-expanded after TLS SNI;
1094that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1095
17c76198
PP
1096DEBUG(D_tls)
1097 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1098rc = tls_expand_session_files(state);
1099if (rc != OK) return rc;
059ec3d9 1100
1365611d
PP
1101/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1102requires a new structure afterwards. */
83da1223 1103
1365611d
PP
1104rc = tls_set_remaining_x509(state);
1105if (rc != OK) return rc;
83da1223 1106
17c76198
PP
1107/* set SNI in client, only */
1108if (host)
1109 {
0df4ab80 1110 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni))
17c76198 1111 return DEFER;
0df4ab80 1112 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1113 {
1114 DEBUG(D_tls)
0df4ab80
JH
1115 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1116 sz = Ustrlen(state->tlsp->sni);
17c76198 1117 rc = gnutls_server_name_set(state->session,
0df4ab80 1118 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
17c76198
PP
1119 exim_gnutls_err_check(US"gnutls_server_name_set");
1120 }
1121 }
1122else if (state->tls_sni)
1123 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1124 "have an SNI set for a client [%s]\n", state->tls_sni);
83da1223 1125
17c76198 1126/* This is the priority string support,
42bfef1e 1127http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1128and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1129This was backwards incompatible, but means Exim no longer needs to track
1130all algorithms and provide string forms for them. */
83da1223 1131
17c76198 1132want_default_priorities = TRUE;
83da1223 1133
17c76198 1134if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1135 {
17c76198
PP
1136 if (!expand_check_tlsvar(tls_require_ciphers))
1137 return DEFER;
1138 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1139 {
17c76198
PP
1140 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1141 state->exp_tls_require_ciphers);
1142
1143 rc = gnutls_priority_init(&state->priority_cache,
1144 CS state->exp_tls_require_ciphers, &errpos);
1145 want_default_priorities = FALSE;
1146 p = state->exp_tls_require_ciphers;
83da1223
PH
1147 }
1148 }
17c76198
PP
1149if (want_default_priorities)
1150 {
83e2f8a2
PP
1151 DEBUG(D_tls)
1152 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1153 exim_default_gnutls_priority);
17c76198
PP
1154 rc = gnutls_priority_init(&state->priority_cache,
1155 exim_default_gnutls_priority, &errpos);
1156 p = US exim_default_gnutls_priority;
1157 }
83da1223 1158
17c76198
PP
1159exim_gnutls_err_check(string_sprintf(
1160 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1161 p, errpos - CS p, errpos));
1162
1163rc = gnutls_priority_set(state->session, state->priority_cache);
1164exim_gnutls_err_check(US"gnutls_priority_set");
1165
1166gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1167
1168/* Reduce security in favour of increased compatibility, if the admin
1169decides to make that trade-off. */
1170if (gnutls_compat_mode)
83da1223 1171 {
17c76198
PP
1172#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1173 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1174 gnutls_session_enable_compatibility_mode(state->session);
1175#else
1176 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1177#endif
83da1223
PH
1178 }
1179
17c76198 1180*caller_state = state;
17c76198 1181return OK;
83da1223
PH
1182}
1183
1184
1185
83da1223 1186/*************************************************
17c76198 1187* Extract peer information *
059ec3d9
PH
1188*************************************************/
1189
17c76198 1190/* Called from both server and client code.
4fe99a6c
PP
1191Only this is allowed to set state->peerdn and state->have_set_peerdn
1192and we use that to detect double-calls.
059ec3d9 1193
75fe387d
PP
1194NOTE: the state blocks last while the TLS connection is up, which is fine
1195for logging in the server side, but for the client side, we log after teardown
1196in src/deliver.c. While the session is up, we can twist about states and
1197repoint tls_* globals, but those variables used for logging or other variable
1198expansion that happens _after_ delivery need to have a longer life-time.
1199
1200So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1201doing this more than once per generation of a state context. We set them in
1202the state context, and repoint tls_* to them. After the state goes away, the
1203tls_* copies of the pointers remain valid and client delivery logging is happy.
1204
1205tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1206don't apply.
1207
059ec3d9 1208Arguments:
17c76198 1209 state exim_gnutls_state_st *
059ec3d9 1210
17c76198 1211Returns: OK/DEFER/FAIL
059ec3d9
PH
1212*/
1213
17c76198
PP
1214static int
1215peer_status(exim_gnutls_state_st *state)
059ec3d9 1216{
75fe387d 1217uschar cipherbuf[256];
17c76198 1218const gnutls_datum *cert_list;
75fe387d 1219int old_pool, rc;
17c76198 1220unsigned int cert_list_size = 0;
4fe99a6c
PP
1221gnutls_protocol_t protocol;
1222gnutls_cipher_algorithm_t cipher;
1223gnutls_kx_algorithm_t kx;
1224gnutls_mac_algorithm_t mac;
17c76198
PP
1225gnutls_certificate_type_t ct;
1226gnutls_x509_crt_t crt;
4fe99a6c 1227uschar *p, *dn_buf;
17c76198 1228size_t sz;
059ec3d9 1229
4fe99a6c 1230if (state->have_set_peerdn)
17c76198 1231 return OK;
4fe99a6c 1232state->have_set_peerdn = TRUE;
059ec3d9 1233
4fe99a6c 1234state->peerdn = NULL;
059ec3d9 1235
4fe99a6c
PP
1236/* tls_cipher */
1237cipher = gnutls_cipher_get(state->session);
1238protocol = gnutls_protocol_get_version(state->session);
1239mac = gnutls_mac_get(state->session);
1240kx = gnutls_kx_get(state->session);
1241
75fe387d 1242string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1243 "%s:%s:%d",
1244 gnutls_protocol_get_name(protocol),
1245 gnutls_cipher_suite_get_name(kx, cipher, mac),
1246 (int) gnutls_cipher_get_key_size(cipher) * 8);
1247
1248/* I don't see a way that spaces could occur, in the current GnuTLS
1249code base, but it was a concern in the old code and perhaps older GnuTLS
1250releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1251for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1252 if (isspace(*p))
1253 *p = '-';
75fe387d
PP
1254old_pool = store_pool;
1255store_pool = POOL_PERM;
1256state->ciphersuite = string_copy(cipherbuf);
1257store_pool = old_pool;
817d9f57 1258state->tlsp->cipher = state->ciphersuite;
4fe99a6c
PP
1259
1260/* tls_peerdn */
17c76198 1261cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1262
17c76198
PP
1263if (cert_list == NULL || cert_list_size == 0)
1264 {
17c76198
PP
1265 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1266 cert_list, cert_list_size);
e51c7be2 1267 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198
PP
1268 return tls_error(US"certificate verification failed",
1269 "no certificate received from peer", state->host);
1270 return OK;
1271 }
059ec3d9 1272
17c76198
PP
1273ct = gnutls_certificate_type_get(state->session);
1274if (ct != GNUTLS_CRT_X509)
059ec3d9 1275 {
17c76198 1276 const char *ctn = gnutls_certificate_type_get_name(ct);
17c76198
PP
1277 DEBUG(D_tls)
1278 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1279 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198
PP
1280 return tls_error(US"certificate verification not possible, unhandled type",
1281 ctn, state->host);
1282 return OK;
83da1223 1283 }
059ec3d9 1284
e51c7be2
JH
1285#define exim_gnutls_peer_err(Label) \
1286 do { \
1287 if (rc != GNUTLS_E_SUCCESS) \
1288 { \
1289 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1290 (Label), gnutls_strerror(rc)); \
1291 if (state->verify_requirement >= VERIFY_REQUIRED) \
1292 return tls_error((Label), gnutls_strerror(rc), state->host); \
1293 return OK; \
1294 } \
1295 } while (0)
17c76198 1296
9d1c15ef
JH
1297rc = import_cert(&cert_list[0], &crt);
1298exim_gnutls_peer_err(US"cert 0");
1299
1300state->tlsp->peercert = state->peercert = crt;
17c76198 1301
17c76198
PP
1302sz = 0;
1303rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1304if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1305 {
17c76198
PP
1306 exim_gnutls_peer_err(US"getting size for cert DN failed");
1307 return FAIL; /* should not happen */
059ec3d9 1308 }
17c76198
PP
1309dn_buf = store_get_perm(sz);
1310rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1311exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1312
17c76198
PP
1313state->peerdn = dn_buf;
1314
1315return OK;
1316#undef exim_gnutls_peer_err
1317}
059ec3d9 1318
059ec3d9 1319
059ec3d9 1320
059ec3d9 1321
17c76198
PP
1322/*************************************************
1323* Verify peer certificate *
1324*************************************************/
059ec3d9 1325
17c76198
PP
1326/* Called from both server and client code.
1327*Should* be using a callback registered with
1328gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1329the peer information, but that's too new for some OSes.
059ec3d9 1330
17c76198
PP
1331Arguments:
1332 state exim_gnutls_state_st *
1333 error where to put an error message
059ec3d9 1334
17c76198
PP
1335Returns:
1336 FALSE if the session should be rejected
1337 TRUE if the cert is okay or we just don't care
1338*/
059ec3d9 1339
17c76198
PP
1340static BOOL
1341verify_certificate(exim_gnutls_state_st *state, const char **error)
1342{
1343int rc;
1344unsigned int verify;
1345
1346*error = NULL;
1347
0a92f87f 1348if ((rc = peer_status(state)) != OK)
e6060e2c 1349 {
17c76198 1350 verify = GNUTLS_CERT_INVALID;
0a92f87f 1351 *error = "certificate not supplied";
17c76198
PP
1352 }
1353else
17c76198 1354 rc = gnutls_certificate_verify_peers2(state->session, &verify);
e6060e2c 1355
17c76198
PP
1356/* Handle the result of verification. INVALID seems to be set as well
1357as REVOKED, but leave the test for both. */
059ec3d9 1358
e51c7be2
JH
1359if (rc < 0 ||
1360 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1361 )
17c76198
PP
1362 {
1363 state->peer_cert_verified = FALSE;
0a92f87f
JH
1364 if (!*error)
1365 *error = verify & GNUTLS_CERT_REVOKED
1366 ? "certificate revoked" : "certificate invalid";
059ec3d9 1367
17c76198 1368 DEBUG(D_tls)
e51c7be2 1369 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
4fe99a6c 1370 *error, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1371
e51c7be2 1372 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1373 {
e51c7be2
JH
1374 gnutls_alert_send(state->session,
1375 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
17c76198
PP
1376 return FALSE;
1377 }
1378 DEBUG(D_tls)
4789da3a 1379 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 1380 }
e51c7be2 1381
17c76198
PP
1382else
1383 {
aa2a70ba 1384 if (state->exp_tls_verify_cert_hostnames)
e51c7be2
JH
1385 {
1386 int sep = 0;
1387 uschar * list = state->exp_tls_verify_cert_hostnames;
1388 uschar * name;
1389 while (name = string_nextinlist(&list, &sep, NULL, 0))
1390 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1391 break;
1392 if (!name)
1393 {
1394 DEBUG(D_tls)
1395 debug_printf("TLS certificate verification failed: cert name mismatch\n");
aa2a70ba
JH
1396 if (state->verify_requirement >= VERIFY_REQUIRED)
1397 {
1398 gnutls_alert_send(state->session,
1399 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1400 return FALSE;
1401 }
1402 return TRUE;
e51c7be2
JH
1403 }
1404 }
17c76198 1405 state->peer_cert_verified = TRUE;
e51c7be2 1406 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 1407 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1408 }
059ec3d9 1409
817d9f57 1410state->tlsp->peerdn = state->peerdn;
059ec3d9 1411
17c76198
PP
1412return TRUE;
1413}
059ec3d9 1414
17c76198
PP
1415
1416
1417
1418/* ------------------------------------------------------------------------ */
1419/* Callbacks */
1420
1421/* Logging function which can be registered with
1422 * gnutls_global_set_log_function()
1423 * gnutls_global_set_log_level() 0..9
1424 */
af3498d6 1425#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1426static void
17c76198 1427exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1428{
8c79eebf
PP
1429 size_t len = strlen(message);
1430 if (len < 1)
1431 {
1432 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1433 return;
1434 }
1435 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1436 message[len-1] == '\n' ? "" : "\n");
17c76198 1437}
af3498d6 1438#endif
059ec3d9 1439
059ec3d9 1440
17c76198
PP
1441/* Called after client hello, should handle SNI work.
1442This will always set tls_sni (state->received_sni) if available,
1443and may trigger presenting different certificates,
1444if state->trigger_sni_changes is TRUE.
059ec3d9 1445
17c76198
PP
1446Should be registered with
1447 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1448
17c76198
PP
1449"This callback must return 0 on success or a gnutls error code to terminate the
1450handshake.".
059ec3d9 1451
17c76198
PP
1452For inability to get SNI information, we return 0.
1453We only return non-zero if re-setup failed.
817d9f57 1454Only used for server-side TLS.
17c76198 1455*/
44bbabb5 1456
17c76198
PP
1457static int
1458exim_sni_handling_cb(gnutls_session_t session)
1459{
1460char sni_name[MAX_HOST_LEN];
1461size_t data_len = MAX_HOST_LEN;
817d9f57 1462exim_gnutls_state_st *state = &state_server;
17c76198
PP
1463unsigned int sni_type;
1464int rc, old_pool;
1465
1466rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1467if (rc != GNUTLS_E_SUCCESS)
1468 {
1469 DEBUG(D_tls) {
1470 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1471 debug_printf("TLS: no SNI presented in handshake.\n");
1472 else
1473 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1474 gnutls_strerror(rc), rc);
1475 };
1476 return 0;
1477 }
1478
17c76198
PP
1479if (sni_type != GNUTLS_NAME_DNS)
1480 {
1481 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1482 return 0;
1483 }
44bbabb5 1484
17c76198
PP
1485/* We now have a UTF-8 string in sni_name */
1486old_pool = store_pool;
1487store_pool = POOL_PERM;
1488state->received_sni = string_copyn(US sni_name, data_len);
1489store_pool = old_pool;
1490
1491/* We set this one now so that variable expansions below will work */
817d9f57 1492state->tlsp->sni = state->received_sni;
17c76198
PP
1493
1494DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1495 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1496
1497if (!state->trigger_sni_changes)
1498 return 0;
1499
1500rc = tls_expand_session_files(state);
1501if (rc != OK)
1502 {
1503 /* If the setup of certs/etc failed before handshake, TLS would not have
1504 been offered. The best we can do now is abort. */
1505 return GNUTLS_E_APPLICATION_ERROR_MIN;
1506 }
1507
1365611d
PP
1508rc = tls_set_remaining_x509(state);
1509if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1510
1511return 0;
059ec3d9
PH
1512}
1513
1514
1515
f2de3a33 1516#ifndef DISABLE_OCSP
44662487
JH
1517
1518static int
1519server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1520 gnutls_datum_t * ocsp_response)
1521{
1522int ret;
1523
44662487
JH
1524if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1525 {
1526 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1527 (char *)ptr);
018058b2 1528 tls_in.ocsp = OCSP_NOT_RESP;
44662487
JH
1529 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1530 }
1531
018058b2 1532tls_in.ocsp = OCSP_VFY_NOT_TRIED;
44662487
JH
1533return 0;
1534}
1535
1536#endif
1537
1538
774ef2d7 1539#ifdef EXPERIMENTAL_EVENT
a7538db1
JH
1540/*
1541We use this callback to get observability and detail-level control
723fe533
JH
1542for an exim TLS connection (either direction), raising a tls:cert event
1543for each cert in the chain presented by the peer. Any event
a7538db1
JH
1544can deny verification.
1545
1546Return 0 for the handshake to continue or non-zero to terminate.
1547*/
1548
1549static int
723fe533 1550verify_cb(gnutls_session_t session)
a7538db1
JH
1551{
1552const gnutls_datum * cert_list;
1553unsigned int cert_list_size = 0;
1554gnutls_x509_crt_t crt;
1555int rc;
b30275b8 1556uschar * yield;
a7538db1
JH
1557exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1558
1559cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1560if (cert_list)
1561 while (cert_list_size--)
1562 {
1563 rc = import_cert(&cert_list[cert_list_size], &crt);
1564 if (rc != GNUTLS_E_SUCCESS)
1565 {
1566 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1567 cert_list_size, gnutls_strerror(rc));
1568 break;
1569 }
1570
1571 state->tlsp->peercert = crt;
b30275b8
JH
1572 if ((yield = event_raise(state->event_action,
1573 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
1574 {
1575 log_write(0, LOG_MAIN,
b30275b8
JH
1576 "SSL verify denied by event-action: depth=%d: %s",
1577 cert_list_size, yield);
a7538db1
JH
1578 return 1; /* reject */
1579 }
1580 state->tlsp->peercert = NULL;
1581 }
1582
1583return 0;
1584}
1585
1586#endif
44662487
JH
1587
1588
17c76198
PP
1589
1590/* ------------------------------------------------------------------------ */
1591/* Exported functions */
1592
1593
1594
1595
059ec3d9
PH
1596/*************************************************
1597* Start a TLS session in a server *
1598*************************************************/
1599
1600/* This is called when Exim is running as a server, after having received
1601the STARTTLS command. It must respond to that command, and then negotiate
1602a TLS session.
1603
1604Arguments:
83da1223 1605 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1606
1607Returns: OK on success
1608 DEFER for errors before the start of the negotiation
1609 FAIL for errors during the negotation; the server can't
1610 continue running.
1611*/
1612
1613int
17c76198 1614tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1615{
1616int rc;
7199e1ee 1617const char *error;
17c76198 1618exim_gnutls_state_st *state = NULL;
059ec3d9
PH
1619
1620/* Check for previous activation */
817d9f57 1621if (tls_in.active >= 0)
059ec3d9 1622 {
17c76198 1623 tls_error(US"STARTTLS received after TLS started", "", NULL);
059ec3d9
PH
1624 smtp_printf("554 Already in TLS\r\n");
1625 return FAIL;
1626 }
1627
1628/* Initialize the library. If it fails, it will already have logged the error
1629and sent an SMTP response. */
1630
17c76198 1631DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 1632
17c76198
PP
1633rc = tls_init(NULL, tls_certificate, tls_privatekey,
1634 NULL, tls_verify_certificates, tls_crl,
1635 require_ciphers, &state);
059ec3d9
PH
1636if (rc != OK) return rc;
1637
059ec3d9
PH
1638/* If this is a host for which certificate verification is mandatory or
1639optional, set up appropriately. */
1640
059ec3d9 1641if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 1642 {
e51c7be2
JH
1643 DEBUG(D_tls)
1644 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
1645 state->verify_requirement = VERIFY_REQUIRED;
1646 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1647 }
059ec3d9 1648else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 1649 {
e51c7be2
JH
1650 DEBUG(D_tls)
1651 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
1652 state->verify_requirement = VERIFY_OPTIONAL;
1653 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1654 }
1655else
1656 {
e51c7be2
JH
1657 DEBUG(D_tls)
1658 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
1659 state->verify_requirement = VERIFY_NONE;
1660 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1661 }
059ec3d9 1662
723fe533
JH
1663#ifdef EXPERIMENTAL_EVENT
1664if (event_action)
1665 {
1666 state->event_action = event_action;
1667 gnutls_session_set_ptr(state->session, state);
1668 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1669 }
1670#endif
1671
17c76198
PP
1672/* Register SNI handling; always, even if not in tls_certificate, so that the
1673expansion variable $tls_sni is always available. */
059ec3d9 1674
17c76198
PP
1675gnutls_handshake_set_post_client_hello_function(state->session,
1676 exim_sni_handling_cb);
059ec3d9
PH
1677
1678/* Set context and tell client to go ahead, except in the case of TLS startup
1679on connection, where outputting anything now upsets the clients and tends to
1680make them disconnect. We need to have an explicit fflush() here, to force out
1681the response. Other smtp_printf() calls do not need it, because in non-TLS
1682mode, the fflush() happens when smtp_getc() is called. */
1683
817d9f57 1684if (!state->tlsp->on_connect)
059ec3d9
PH
1685 {
1686 smtp_printf("220 TLS go ahead\r\n");
9d1c15ef 1687 fflush(smtp_out);
059ec3d9
PH
1688 }
1689
1690/* Now negotiate the TLS session. We put our own timer on it, since it seems
1691that the GnuTLS library doesn't. */
1692
17c76198 1693gnutls_transport_set_ptr2(state->session,
44662487
JH
1694 (gnutls_transport_ptr)(long) fileno(smtp_in),
1695 (gnutls_transport_ptr)(long) fileno(smtp_out));
17c76198
PP
1696state->fd_in = fileno(smtp_in);
1697state->fd_out = fileno(smtp_out);
059ec3d9
PH
1698
1699sigalrm_seen = FALSE;
1700if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198
PP
1701do
1702 {
1703 rc = gnutls_handshake(state->session);
619b2b25
PP
1704 } while ((rc == GNUTLS_E_AGAIN) ||
1705 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1706alarm(0);
1707
17c76198 1708if (rc != GNUTLS_E_SUCCESS)
059ec3d9 1709 {
17c76198
PP
1710 tls_error(US"gnutls_handshake",
1711 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
059ec3d9
PH
1712 /* It seems that, except in the case of a timeout, we have to close the
1713 connection right here; otherwise if the other end is running OpenSSL it hangs
1714 until the server times out. */
1715
1716 if (!sigalrm_seen)
1717 {
f1e894f3
PH
1718 (void)fclose(smtp_out);
1719 (void)fclose(smtp_in);
059ec3d9
PH
1720 }
1721
1722 return FAIL;
1723 }
1724
1725DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1726
17c76198
PP
1727/* Verify after the fact */
1728
9d1c15ef
JH
1729if ( state->verify_requirement != VERIFY_NONE
1730 && !verify_certificate(state, &error))
059ec3d9 1731 {
9d1c15ef 1732 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 1733 {
9d1c15ef
JH
1734 tls_error(US"certificate verification failed", error, NULL);
1735 return FAIL;
17c76198 1736 }
9d1c15ef
JH
1737 DEBUG(D_tls)
1738 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1739 error);
059ec3d9
PH
1740 }
1741
17c76198
PP
1742/* Figure out peer DN, and if authenticated, etc. */
1743
1744rc = peer_status(state);
1745if (rc != OK) return rc;
1746
1747/* Sets various Exim expansion variables; always safe within server */
1748
9d1c15ef 1749extract_exim_vars_from_tls_state(state);
059ec3d9
PH
1750
1751/* TLS has been set up. Adjust the input functions to read via TLS,
1752and initialize appropriately. */
1753
17c76198 1754state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
1755
1756receive_getc = tls_getc;
1757receive_ungetc = tls_ungetc;
1758receive_feof = tls_feof;
1759receive_ferror = tls_ferror;
58eb016e 1760receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1761
059ec3d9
PH
1762return OK;
1763}
1764
1765
1766
1767
aa2a70ba
JH
1768static void
1769tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
1770 smtp_transport_options_block * ob)
1771{
5130845b 1772if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba
JH
1773 {
1774 state->exp_tls_verify_cert_hostnames = host->name;
1775 DEBUG(D_tls)
1776 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
1777 state->exp_tls_verify_cert_hostnames);
1778 }
1779}
aa2a70ba
JH
1780
1781
059ec3d9
PH
1782/*************************************************
1783* Start a TLS session in a client *
1784*************************************************/
1785
1786/* Called from the smtp transport after STARTTLS has been accepted.
1787
1788Arguments:
1789 fd the fd of the connection
1790 host connected host (for messages)
83da1223 1791 addr the first address (not used)
a7538db1 1792 tb transport (always smtp)
059ec3d9
PH
1793
1794Returns: OK/DEFER/FAIL (because using common functions),
1795 but for a client, DEFER and FAIL have the same meaning
1796*/
1797
1798int
17c76198 1799tls_client_start(int fd, host_item *host,
f5d78688 1800 address_item *addr ARG_UNUSED,
0e66b3b6
JH
1801 transport_instance *tb
1802#ifdef EXPERIMENTAL_DANE
1803 , dne_answer * unused_tlsa_dnsa
1804#endif
1805 )
059ec3d9 1806{
a7538db1
JH
1807smtp_transport_options_block *ob =
1808 (smtp_transport_options_block *)tb->options_block;
059ec3d9 1809int rc;
17c76198
PP
1810const char *error;
1811exim_gnutls_state_st *state = NULL;
f2de3a33 1812#ifndef DISABLE_OCSP
5130845b
JH
1813BOOL require_ocsp =
1814 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
44662487 1815BOOL request_ocsp = require_ocsp ? TRUE
5130845b 1816 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2b4a568d 1817#endif
059ec3d9 1818
17c76198 1819DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 1820
65867078
JH
1821if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
1822 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
1823 ob->tls_require_ciphers, &state)) != OK)
2b4a568d 1824 return rc;
059ec3d9 1825
54c90be1 1826 {
65867078
JH
1827 int dh_min_bits = ob->tls_dh_min_bits;
1828 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1829 {
1830 DEBUG(D_tls)
1831 debug_printf("WARNING: tls_dh_min_bits far too low,"
1832 " clamping %d up to %d\n",
1833 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1834 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1835 }
54c90be1 1836
65867078
JH
1837 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
1838 " acceptable bits to %d\n",
1839 dh_min_bits);
1840 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1841 }
83da1223 1842
2b4a568d
JH
1843/* Stick to the old behaviour for compatibility if tls_verify_certificates is
1844set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
1845the specified host patterns if one of them is defined */
1846
aa2a70ba
JH
1847if ( ( state->exp_tls_verify_certificates
1848 && !ob->tls_verify_hosts
1849 && !ob->tls_try_verify_hosts
1850 )
5130845b 1851 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
2b4a568d 1852 )
17c76198 1853 {
aa2a70ba 1854 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
1855 DEBUG(D_tls)
1856 debug_printf("TLS: server certificate verification required.\n");
1857 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
1858 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1859 }
5130845b 1860else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
52f93eed 1861 {
aa2a70ba 1862 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
1863 DEBUG(D_tls)
1864 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 1865 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
1866 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1867 }
1868else
1869 {
e51c7be2
JH
1870 DEBUG(D_tls)
1871 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
1872 state->verify_requirement = VERIFY_NONE;
1873 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 1874 }
059ec3d9 1875
f2de3a33
JH
1876#ifndef DISABLE_OCSP
1877 /* supported since GnuTLS 3.1.3 */
44662487 1878if (request_ocsp)
9d1c15ef
JH
1879 {
1880 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
1881 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
1882 NULL, 0, NULL)) != OK)
9d1c15ef
JH
1883 return tls_error(US"cert-status-req",
1884 gnutls_strerror(rc), state->host);
44662487 1885 tls_out.ocsp = OCSP_NOT_RESP;
9d1c15ef 1886 }
2b4a568d
JH
1887#endif
1888
774ef2d7
JH
1889#ifdef EXPERIMENTAL_EVENT
1890if (tb->event_action)
a7538db1 1891 {
774ef2d7 1892 state->event_action = tb->event_action;
a7538db1 1893 gnutls_session_set_ptr(state->session, state);
723fe533 1894 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
1895 }
1896#endif
1897
44662487 1898gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)(long) fd);
17c76198
PP
1899state->fd_in = fd;
1900state->fd_out = fd;
059ec3d9 1901
9d1c15ef 1902DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
1903/* There doesn't seem to be a built-in timeout on connection. */
1904
1905sigalrm_seen = FALSE;
65867078 1906alarm(ob->command_timeout);
17c76198
PP
1907do
1908 {
1909 rc = gnutls_handshake(state->session);
619b2b25
PP
1910 } while ((rc == GNUTLS_E_AGAIN) ||
1911 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1912alarm(0);
1913
4fe99a6c
PP
1914if (rc != GNUTLS_E_SUCCESS)
1915 return tls_error(US"gnutls_handshake",
1916 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1917
17c76198 1918DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 1919
17c76198 1920/* Verify late */
059ec3d9 1921
17c76198
PP
1922if (state->verify_requirement != VERIFY_NONE &&
1923 !verify_certificate(state, &error))
1924 return tls_error(US"certificate verification failed", error, state->host);
059ec3d9 1925
f2de3a33 1926#ifndef DISABLE_OCSP
2b4a568d
JH
1927if (require_ocsp)
1928 {
1929 DEBUG(D_tls)
1930 {
1931 gnutls_datum_t stapling;
1932 gnutls_ocsp_resp_t resp;
1933 gnutls_datum_t printed;
1934 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
1935 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
1936 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
1937 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
1938 )
1939 {
65867078 1940 debug_printf("%.4096s", printed.data);
2b4a568d
JH
1941 gnutls_free(printed.data);
1942 }
1943 else
1944 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host);
1945 }
1946
2b4a568d 1947 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2
JH
1948 {
1949 tls_out.ocsp = OCSP_FAILED;
2b4a568d 1950 return tls_error(US"certificate status check failed", NULL, state->host);
018058b2 1951 }
2b4a568d 1952 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
44662487 1953 tls_out.ocsp = OCSP_VFIED;
2b4a568d
JH
1954 }
1955#endif
1956
17c76198 1957/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 1958
2b4a568d
JH
1959if ((rc = peer_status(state)) != OK)
1960 return rc;
059ec3d9 1961
4fe99a6c 1962/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 1963
9d1c15ef 1964extract_exim_vars_from_tls_state(state);
059ec3d9 1965
059ec3d9
PH
1966return OK;
1967}
1968
1969
1970
17c76198 1971
059ec3d9 1972/*************************************************
17c76198 1973* Close down a TLS session *
059ec3d9
PH
1974*************************************************/
1975
17c76198
PP
1976/* This is also called from within a delivery subprocess forked from the
1977daemon, to shut down the TLS library, without actually doing a shutdown (which
1978would tamper with the TLS session in the parent process).
059ec3d9 1979
17c76198
PP
1980Arguments: TRUE if gnutls_bye is to be called
1981Returns: nothing
059ec3d9
PH
1982*/
1983
17c76198 1984void
817d9f57 1985tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 1986{
817d9f57 1987exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 1988
389ca47a 1989if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
17c76198
PP
1990
1991if (shutdown)
1992 {
1993 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1994 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1995 }
1996
1997gnutls_deinit(state->session);
1998
389ca47a 1999state->tlsp->active = -1;
17c76198
PP
2000memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2001
2002if ((state_server.session == NULL) && (state_client.session == NULL))
2003 {
2004 gnutls_global_deinit();
2005 exim_gnutls_base_init_done = FALSE;
2006 }
7199e1ee 2007
059ec3d9
PH
2008}
2009
2010
2011
17c76198 2012
059ec3d9
PH
2013/*************************************************
2014* TLS version of getc *
2015*************************************************/
2016
2017/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2018it refills the buffer via the GnuTLS reading function.
817d9f57 2019Only used by the server-side TLS.
059ec3d9 2020
17c76198
PP
2021This feeds DKIM and should be used for all message-body reads.
2022
059ec3d9
PH
2023Arguments: none
2024Returns: the next character or EOF
2025*/
2026
2027int
2028tls_getc(void)
2029{
817d9f57 2030exim_gnutls_state_st *state = &state_server;
17c76198 2031if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
059ec3d9 2032 {
17c76198 2033 ssize_t inbytes;
059ec3d9 2034
17c76198
PP
2035 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2036 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
2037
2038 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 2039 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
059ec3d9
PH
2040 ssl_xfer_buffer_size);
2041 alarm(0);
2042
2043 /* A zero-byte return appears to mean that the TLS session has been
2044 closed down, not that the socket itself has been closed down. Revert to
2045 non-TLS handling. */
2046
2047 if (inbytes == 0)
2048 {
2049 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2050
2051 receive_getc = smtp_getc;
2052 receive_ungetc = smtp_ungetc;
2053 receive_feof = smtp_feof;
2054 receive_ferror = smtp_ferror;
58eb016e 2055 receive_smtp_buffered = smtp_buffered;
059ec3d9 2056
17c76198
PP
2057 gnutls_deinit(state->session);
2058 state->session = NULL;
817d9f57
JH
2059 state->tlsp->active = -1;
2060 state->tlsp->bits = 0;
2061 state->tlsp->certificate_verified = FALSE;
9d1c15ef 2062 tls_channelbinding_b64 = NULL;
817d9f57 2063 state->tlsp->cipher = NULL;
9d1c15ef 2064 state->tlsp->peercert = NULL;
817d9f57 2065 state->tlsp->peerdn = NULL;
059ec3d9
PH
2066
2067 return smtp_getc();
2068 }
2069
2070 /* Handle genuine errors */
2071
2072 else if (inbytes < 0)
2073 {
17c76198
PP
2074 record_io_error(state, (int) inbytes, US"recv", NULL);
2075 state->xfer_error = 1;
059ec3d9
PH
2076 return EOF;
2077 }
80a47a2c 2078#ifndef DISABLE_DKIM
17c76198 2079 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
80a47a2c 2080#endif
17c76198
PP
2081 state->xfer_buffer_hwm = (int) inbytes;
2082 state->xfer_buffer_lwm = 0;
059ec3d9
PH
2083 }
2084
059ec3d9
PH
2085/* Something in the buffer; return next uschar */
2086
17c76198 2087return state->xfer_buffer[state->xfer_buffer_lwm++];
059ec3d9
PH
2088}
2089
2090
2091
17c76198 2092
059ec3d9
PH
2093/*************************************************
2094* Read bytes from TLS channel *
2095*************************************************/
2096
17c76198
PP
2097/* This does not feed DKIM, so if the caller uses this for reading message body,
2098then the caller must feed DKIM.
817d9f57 2099
059ec3d9
PH
2100Arguments:
2101 buff buffer of data
2102 len size of buffer
2103
2104Returns: the number of bytes read
2105 -1 after a failed read
2106*/
2107
2108int
817d9f57 2109tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2110{
817d9f57 2111exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
17c76198 2112ssize_t inbytes;
059ec3d9 2113
17c76198
PP
2114if (len > INT_MAX)
2115 len = INT_MAX;
059ec3d9 2116
17c76198
PP
2117if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2118 DEBUG(D_tls)
2119 debug_printf("*** PROBABLY A BUG *** " \
2120 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2121 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2122
2123DEBUG(D_tls)
2124 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2125 state->session, buff, len);
2126
2127inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
2128if (inbytes > 0) return inbytes;
2129if (inbytes == 0)
2130 {
2131 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2132 }
17c76198 2133else record_io_error(state, (int)inbytes, US"recv", NULL);
059ec3d9
PH
2134
2135return -1;
2136}
2137
2138
2139
17c76198 2140
059ec3d9
PH
2141/*************************************************
2142* Write bytes down TLS channel *
2143*************************************************/
2144
2145/*
2146Arguments:
817d9f57 2147 is_server channel specifier
059ec3d9
PH
2148 buff buffer of data
2149 len number of bytes
2150
2151Returns: the number of bytes after a successful write,
2152 -1 after a failed write
2153*/
2154
2155int
817d9f57 2156tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9 2157{
17c76198
PP
2158ssize_t outbytes;
2159size_t left = len;
817d9f57 2160exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 2161
17c76198 2162DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
059ec3d9
PH
2163while (left > 0)
2164 {
17c76198
PP
2165 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2166 buff, left);
2167 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 2168
17c76198 2169 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
2170 if (outbytes < 0)
2171 {
17c76198 2172 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
2173 return -1;
2174 }
2175 if (outbytes == 0)
2176 {
17c76198 2177 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
2178 return -1;
2179 }
2180
2181 left -= outbytes;
2182 buff += outbytes;
2183 }
2184
17c76198
PP
2185if (len > INT_MAX)
2186 {
2187 DEBUG(D_tls)
2188 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2189 len);
2190 len = INT_MAX;
2191 }
2192
2193return (int) len;
059ec3d9
PH
2194}
2195
2196
2197
17c76198 2198
059ec3d9 2199/*************************************************
17c76198 2200* Random number generation *
059ec3d9
PH
2201*************************************************/
2202
17c76198
PP
2203/* Pseudo-random number generation. The result is not expected to be
2204cryptographically strong but not so weak that someone will shoot themselves
2205in the foot using it as a nonce in input in some email header scheme or
2206whatever weirdness they'll twist this into. The result should handle fork()
2207and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 2208
17c76198
PP
2209Arguments:
2210 max range maximum
2211Returns a random number in range [0, max-1]
059ec3d9
PH
2212*/
2213
af3498d6 2214#ifdef HAVE_GNUTLS_RND
17c76198
PP
2215int
2216vaguely_random_number(int max)
059ec3d9 2217{
17c76198
PP
2218unsigned int r;
2219int i, needed_len;
2220uschar *p;
2221uschar smallbuf[sizeof(r)];
2222
2223if (max <= 1)
2224 return 0;
2225
2226needed_len = sizeof(r);
2227/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2228 * asked for a number less than 10. */
2229for (r = max, i = 0; r; ++i)
2230 r >>= 1;
2231i = (i + 7) / 8;
2232if (i < needed_len)
2233 needed_len = i;
2234
2235i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2236if (i < 0)
059ec3d9 2237 {
17c76198
PP
2238 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2239 return vaguely_random_number_fallback(max);
2240 }
2241r = 0;
2242for (p = smallbuf; needed_len; --needed_len, ++p)
2243 {
2244 r *= 256;
2245 r += *p;
059ec3d9
PH
2246 }
2247
17c76198
PP
2248/* We don't particularly care about weighted results; if someone wants
2249 * smooth distribution and cares enough then they should submit a patch then. */
2250return r % max;
059ec3d9 2251}
af3498d6
PP
2252#else /* HAVE_GNUTLS_RND */
2253int
2254vaguely_random_number(int max)
2255{
2256 return vaguely_random_number_fallback(max);
2257}
2258#endif /* HAVE_GNUTLS_RND */
059ec3d9 2259
36f12725
NM
2260
2261
2262
2263/*************************************************
3375e053
PP
2264* Let tls_require_ciphers be checked at startup *
2265*************************************************/
2266
2267/* The tls_require_ciphers option, if set, must be something which the
2268library can parse.
2269
2270Returns: NULL on success, or error message
2271*/
2272
2273uschar *
2274tls_validate_require_cipher(void)
2275{
2276int rc;
2277uschar *expciphers = NULL;
2278gnutls_priority_t priority_cache;
2279const char *errpos;
2280
2281#define validate_check_rc(Label) do { \
2282 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2283 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2284#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2285
2286if (exim_gnutls_base_init_done)
2287 log_write(0, LOG_MAIN|LOG_PANIC,
2288 "already initialised GnuTLS, Exim developer bug");
2289
a5f239e4 2290#ifdef HAVE_GNUTLS_PKCS11
2519e60d 2291if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
2292 {
2293 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2294 validate_check_rc(US"gnutls_pkcs11_init");
2295 }
2296#endif
3375e053
PP
2297rc = gnutls_global_init();
2298validate_check_rc(US"gnutls_global_init()");
2299exim_gnutls_base_init_done = TRUE;
2300
2301if (!(tls_require_ciphers && *tls_require_ciphers))
2302 return_deinit(NULL);
2303
2304if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2305 return_deinit(US"failed to expand tls_require_ciphers");
2306
2307if (!(expciphers && *expciphers))
2308 return_deinit(NULL);
2309
2310DEBUG(D_tls)
2311 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2312
2313rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2314validate_check_rc(string_sprintf(
2315 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2316 expciphers, errpos - CS expciphers, errpos));
2317
2318#undef return_deinit
2319#undef validate_check_rc
2320gnutls_global_deinit();
2321
2322return NULL;
2323}
2324
2325
2326
2327
2328/*************************************************
36f12725
NM
2329* Report the library versions. *
2330*************************************************/
2331
2332/* See a description in tls-openssl.c for an explanation of why this exists.
2333
2334Arguments: a FILE* to print the results to
2335Returns: nothing
2336*/
2337
2338void
2339tls_version_report(FILE *f)
2340{
754a0503
PP
2341fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2342 " Runtime: %s\n",
2343 LIBGNUTLS_VERSION,
2344 gnutls_check_version(NULL));
36f12725
NM
2345}
2346
2b4a568d
JH
2347/* vi: aw ai sw=2
2348*/
059ec3d9 2349/* End of tls-gnu.c */