Testsuite: GnuTLS version variances
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
6aa6fc9c 16Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17c76198 17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
184384c3 42
a5f239e4
PP
43/* needed to disable PKCS11 autoload unless requested */
44#if GNUTLS_VERSION_NUMBER >= 0x020c00
45# include <gnutls/pkcs11.h>
76075bb5 46# define SUPPORT_PARAM_TO_PK_BITS
a5f239e4 47#endif
7e07527a
JH
48#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50# define DISABLE_OCSP
51#endif
0cbf2b82 52#if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
774ef2d7 53# warning "GnuTLS library version too old; tls:cert event unsupported"
0cbf2b82 54# define DISABLE_EVENT
a7538db1 55#endif
a7fec7a7
JH
56#if GNUTLS_VERSION_NUMBER >= 0x030306
57# define SUPPORT_CA_DIR
58#else
59# undef SUPPORT_CA_DIR
60#endif
11a04b5a 61#if GNUTLS_VERSION_NUMBER >= 0x030014
cb1d7830
JH
62# define SUPPORT_SYSDEFAULT_CABUNDLE
63#endif
184384c3
JH
64#if GNUTLS_VERSION_NUMBER >= 0x030104
65# define GNUTLS_CERT_VFY_STATUS_PRINT
66#endif
925ac8e4
JH
67#if GNUTLS_VERSION_NUMBER >= 0x030109
68# define SUPPORT_CORK
69#endif
f20cfa4a
JH
70#if GNUTLS_VERSION_NUMBER >= 0x03010a
71# define SUPPORT_GNUTLS_SESS_DESC
72#endif
73#if GNUTLS_VERSION_NUMBER >= 0x030500
74# define SUPPORT_GNUTLS_KEYLOG
75#endif
47195144
JH
76#if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
77# define SUPPORT_SRV_OCSP_STACK
78#endif
c0635b6d
JH
79
80#ifdef SUPPORT_DANE
81# if GNUTLS_VERSION_NUMBER >= 0x030000
82# define DANESSL_USAGE_DANE_TA 2
83# define DANESSL_USAGE_DANE_EE 3
84# else
85# error GnuTLS version too early for DANE
86# endif
87# if GNUTLS_VERSION_NUMBER < 0x999999
88# define GNUTLS_BROKEN_DANE_VALIDATION
89# endif
899b8bbc 90#endif
7e07527a 91
f2de3a33 92#ifndef DISABLE_OCSP
2b4a568d
JH
93# include <gnutls/ocsp.h>
94#endif
899b8bbc
JH
95#ifdef SUPPORT_DANE
96# include <gnutls/dane.h>
97#endif
059ec3d9 98
f1be21cf
JH
99#include "tls-cipher-stdname.c"
100
101
17c76198 102/* GnuTLS 2 vs 3
059ec3d9 103
17c76198
PP
104GnuTLS 3 only:
105 gnutls_global_set_audit_log_function()
059ec3d9 106
17c76198
PP
107Changes:
108 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
109*/
059ec3d9 110
17c76198 111/* Local static variables for GnuTLS */
059ec3d9 112
17c76198 113/* Values for verify_requirement */
059ec3d9 114
e51c7be2 115enum peer_verify_requirement
899b8bbc 116 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
059ec3d9 117
17c76198
PP
118/* This holds most state for server or client; with this, we can set up an
119outbound TLS-enabled connection in an ACL callout, while not stomping all
120over the TLS variables available for expansion.
059ec3d9 121
17c76198
PP
122Some of these correspond to variables in globals.c; those variables will
123be set to point to content in one of these instances, as appropriate for
124the stage of the process lifetime.
059ec3d9 125
389ca47a 126Not handled here: global tls_channelbinding_b64.
17c76198 127*/
059ec3d9 128
17c76198 129typedef struct exim_gnutls_state {
9d1c15ef 130 gnutls_session_t session;
17c76198 131 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 132 gnutls_priority_t priority_cache;
17c76198 133 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
134 int fd_in;
135 int fd_out;
136 BOOL peer_cert_verified;
899b8bbc 137 BOOL peer_dane_verified;
9d1c15ef
JH
138 BOOL trigger_sni_changes;
139 BOOL have_set_peerdn;
5fd28bb8 140 const struct host_item *host; /* NULL if server */
afdb5e9c 141 gnutls_x509_crt_t peercert;
9d1c15ef
JH
142 uschar *peerdn;
143 uschar *ciphersuite;
144 uschar *received_sni;
17c76198
PP
145
146 const uschar *tls_certificate;
147 const uschar *tls_privatekey;
148 const uschar *tls_sni; /* client send only, not received */
149 const uschar *tls_verify_certificates;
150 const uschar *tls_crl;
151 const uschar *tls_require_ciphers;
e51c7be2 152
17c76198
PP
153 uschar *exp_tls_certificate;
154 uschar *exp_tls_privatekey;
17c76198
PP
155 uschar *exp_tls_verify_certificates;
156 uschar *exp_tls_crl;
157 uschar *exp_tls_require_ciphers;
55414b25 158 const uschar *exp_tls_verify_cert_hostnames;
0cbf2b82 159#ifndef DISABLE_EVENT
a7538db1
JH
160 uschar *event_action;
161#endif
899b8bbc
JH
162#ifdef SUPPORT_DANE
163 char * const * dane_data;
164 const int * dane_data_len;
165#endif
17c76198 166
389ca47a 167 tls_support *tlsp; /* set in tls_init() */
817d9f57 168
17c76198
PP
169 uschar *xfer_buffer;
170 int xfer_buffer_lwm;
171 int xfer_buffer_hwm;
8b77d27a
JH
172 BOOL xfer_eof; /*XXX never gets set! */
173 BOOL xfer_error;
17c76198
PP
174} exim_gnutls_state_st;
175
176static const exim_gnutls_state_st exim_gnutls_state_init = {
f2ed27cf
JH
177 .session = NULL,
178 .x509_cred = NULL,
179 .priority_cache = NULL,
180 .verify_requirement = VERIFY_NONE,
181 .fd_in = -1,
182 .fd_out = -1,
183 .peer_cert_verified = FALSE,
899b8bbc 184 .peer_dane_verified = FALSE,
f2ed27cf
JH
185 .trigger_sni_changes =FALSE,
186 .have_set_peerdn = FALSE,
187 .host = NULL,
188 .peercert = NULL,
189 .peerdn = NULL,
190 .ciphersuite = NULL,
191 .received_sni = NULL,
192
193 .tls_certificate = NULL,
194 .tls_privatekey = NULL,
195 .tls_sni = NULL,
196 .tls_verify_certificates = NULL,
197 .tls_crl = NULL,
198 .tls_require_ciphers =NULL,
199
200 .exp_tls_certificate = NULL,
201 .exp_tls_privatekey = NULL,
202 .exp_tls_verify_certificates = NULL,
203 .exp_tls_crl = NULL,
204 .exp_tls_require_ciphers = NULL,
f2ed27cf 205 .exp_tls_verify_cert_hostnames = NULL,
0cbf2b82 206#ifndef DISABLE_EVENT
f2ed27cf 207 .event_action = NULL,
a7538db1 208#endif
f2ed27cf
JH
209 .tlsp = NULL,
210
211 .xfer_buffer = NULL,
212 .xfer_buffer_lwm = 0,
213 .xfer_buffer_hwm = 0,
8b77d27a
JH
214 .xfer_eof = FALSE,
215 .xfer_error = FALSE,
17c76198 216};
83da1223 217
17c76198
PP
218/* Not only do we have our own APIs which don't pass around state, assuming
219it's held in globals, GnuTLS doesn't appear to let us register callback data
220for callbacks, or as part of the session, so we have to keep a "this is the
221context we're currently dealing with" pointer and rely upon being
222single-threaded to keep from processing data on an inbound TLS connection while
223talking to another TLS connection for an outbound check. This does mean that
224there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
225second connection.
226XXX But see gnutls_session_get_ptr()
227*/
059ec3d9 228
74f1a423 229static exim_gnutls_state_st state_server;
059ec3d9 230
17c76198
PP
231/* dh_params are initialised once within the lifetime of a process using TLS;
232if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
233don't want to repeat this. */
83da1223 234
17c76198 235static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 236
17c76198 237/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 238
17c76198 239static const int ssl_session_timeout = 200;
059ec3d9 240
fc243e94 241static const uschar * const exim_default_gnutls_priority = US"NORMAL";
83da1223 242
17c76198 243/* Guard library core initialisation */
83da1223 244
17c76198 245static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 246
4fb7df6d 247#ifndef DISABLE_OCSP
9196d5bf 248static BOOL gnutls_buggy_ocsp = FALSE;
4fb7df6d 249#endif
9196d5bf 250
059ec3d9 251
17c76198 252/* ------------------------------------------------------------------------ */
17c76198 253/* macros */
83da1223 254
17c76198 255#define MAX_HOST_LEN 255
83da1223 256
17c76198
PP
257/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
258the library logging; a value less than 0 disables the calls to set up logging
dc6d1769
JH
259callbacks. GNuTLS also looks for an environment variable - except not for
260setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
261Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
262but the env var must be added to /etc/sudoers too. */
2c17bb02 263#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
a7538db1 264# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 265#endif
83da1223 266
2c17bb02 267#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 268# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 269#endif
83da1223 270
af3498d6
PP
271/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
272can ask for a bit-strength. Without that, we stick to the constant we had
273before, for now. */
2c17bb02 274#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 275# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 276#endif
af3498d6 277
cf0c6164
JH
278#define expand_check_tlsvar(Varname, errstr) \
279 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
83da1223 280
17c76198 281#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
282# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
283# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
284# define HAVE_GNUTLS_RND
2519e60d
TL
285/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
286 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
287 * isn't available sometimes, so this needs to become a conditional
288 * compilation; the sanest way to deal with this being a problem on
289 * older OSes is to block it in the Local/Makefile with this compiler
290 * definition */
e51c7be2
JH
291# ifndef AVOID_GNUTLS_PKCS11
292# define HAVE_GNUTLS_PKCS11
293# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 294#endif
83da1223 295
af3498d6
PP
296
297
298
299/* ------------------------------------------------------------------------ */
300/* Callback declarations */
301
302#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
303static void exim_gnutls_logger_cb(int level, const char *message);
304#endif
305
306static int exim_sni_handling_cb(gnutls_session_t session);
307
f2de3a33 308#ifndef DISABLE_OCSP
44662487
JH
309static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
310 gnutls_datum_t * ocsp_response);
311#endif
af3498d6
PP
312
313
314
17c76198
PP
315/* ------------------------------------------------------------------------ */
316/* Static functions */
059ec3d9
PH
317
318/*************************************************
319* Handle TLS error *
320*************************************************/
321
322/* Called from lots of places when errors occur before actually starting to do
323the TLS handshake, that is, while the session is still in clear. Always returns
324DEFER for a server and FAIL for a client so that most calls can use "return
325tls_error(...)" to do this processing and then give an appropriate return. A
326single function is used for both server and client, because it is called from
327some shared functions.
328
329Argument:
330 prefix text to include in the logged error
7199e1ee
TF
331 msg additional error string (may be NULL)
332 usually obtained from gnutls_strerror()
17c76198
PP
333 host NULL if setting up a server;
334 the connected host if setting up a client
cf0c6164 335 errstr pointer to returned error string
059ec3d9
PH
336
337Returns: OK/DEFER/FAIL
338*/
339
340static int
48224640 341tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
cf0c6164 342 uschar ** errstr)
059ec3d9 343{
cf0c6164 344if (errstr)
48224640 345 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
cf0c6164 346return host ? FAIL : DEFER;
059ec3d9
PH
347}
348
349
452a164f
JH
350static int
351tls_error_gnu(const uschar *prefix, int err, const host_item *host,
352 uschar ** errstr)
353{
354return tls_error(prefix, US gnutls_strerror(err), host, errstr);
355}
356
357static int
358tls_error_sys(const uschar *prefix, int err, const host_item *host,
359 uschar ** errstr)
360{
361return tls_error(prefix, US strerror(err), host, errstr);
362}
059ec3d9 363
17c76198 364
059ec3d9 365/*************************************************
17c76198 366* Deal with logging errors during I/O *
059ec3d9
PH
367*************************************************/
368
17c76198 369/* We have to get the identity of the peer from saved data.
059ec3d9 370
17c76198
PP
371Argument:
372 state the current GnuTLS exim state container
373 rc the GnuTLS error code, or 0 if it's a local error
374 when text identifying read or write
95f52235 375 text local error text when rc is 0
059ec3d9 376
17c76198 377Returns: nothing
059ec3d9
PH
378*/
379
17c76198
PP
380static void
381record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 382{
48224640 383const uschar * msg;
cf0c6164 384uschar * errstr;
059ec3d9 385
17c76198 386if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
95f52235 387 msg = string_sprintf("A TLS fatal alert has been received: %s",
17c76198
PP
388 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
389else
48224640 390 msg = US gnutls_strerror(rc);
059ec3d9 391
cf0c6164
JH
392(void) tls_error(when, msg, state->host, &errstr);
393
394if (state->host)
395 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
396 state->host->name, state->host->address, errstr);
397else
398 {
399 uschar * conn_info = smtp_get_connection_info();
400 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
401 /* I'd like to get separated H= here, but too hard for now */
402 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
403 }
17c76198 404}
059ec3d9 405
059ec3d9 406
059ec3d9 407
059ec3d9 408
17c76198
PP
409/*************************************************
410* Set various Exim expansion vars *
411*************************************************/
059ec3d9 412
e51c7be2
JH
413#define exim_gnutls_cert_err(Label) \
414 do \
415 { \
416 if (rc != GNUTLS_E_SUCCESS) \
417 { \
418 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
419 (Label), gnutls_strerror(rc)); \
420 return rc; \
421 } \
422 } while (0)
9d1c15ef
JH
423
424static int
27f19eb4 425import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
9d1c15ef
JH
426{
427int rc;
428
429rc = gnutls_x509_crt_init(crtp);
430exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
431
432rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
433exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
434
435return rc;
436}
437
438#undef exim_gnutls_cert_err
439
440
17c76198
PP
441/* We set various Exim global variables from the state, once a session has
442been established. With TLS callouts, may need to change this to stack
443variables, or just re-call it with the server state after client callout
444has finished.
059ec3d9 445
9d1c15ef 446Make sure anything set here is unset in tls_getc().
17c76198
PP
447
448Sets:
449 tls_active fd
450 tls_bits strength indicator
451 tls_certificate_verified bool indicator
452 tls_channelbinding_b64 for some SASL mechanisms
453 tls_cipher a string
9d1c15ef 454 tls_peercert pointer to library internal
17c76198
PP
455 tls_peerdn a string
456 tls_sni a (UTF-8) string
9d1c15ef 457 tls_ourcert pointer to library internal
17c76198
PP
458
459Argument:
460 state the relevant exim_gnutls_state_st *
461*/
462
463static void
9d1c15ef 464extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 465{
17c76198 466gnutls_cipher_algorithm_t cipher;
17c76198
PP
467#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
468int old_pool;
469int rc;
470gnutls_datum_t channel;
471#endif
9d1c15ef 472tls_support * tlsp = state->tlsp;
17c76198 473
74f1a423
JH
474tlsp->active.sock = state->fd_out;
475tlsp->active.tls_ctx = state;
17c76198
PP
476
477cipher = gnutls_cipher_get(state->session);
478/* returns size in "bytes" */
9d1c15ef 479tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 480
9d1c15ef 481tlsp->cipher = state->ciphersuite;
17c76198 482
817d9f57 483DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 484
9d1c15ef 485tlsp->certificate_verified = state->peer_cert_verified;
899b8bbc
JH
486#ifdef SUPPORT_DANE
487tlsp->dane_verified = state->peer_dane_verified;
488#endif
059ec3d9 489
17c76198
PP
490/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
491only available for use for authenticators while this TLS session is running. */
492
493tls_channelbinding_b64 = NULL;
494#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
495channel.data = NULL;
496channel.size = 0;
1f20760b
JH
497if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
498 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
499else
500 {
17c76198
PP
501 old_pool = store_pool;
502 store_pool = POOL_PERM;
1f20760b 503 tls_channelbinding_b64 = b64encode(CUS channel.data, (int)channel.size);
17c76198
PP
504 store_pool = old_pool;
505 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
1f20760b 506 }
17c76198
PP
507#endif
508
9d1c15ef
JH
509/* peercert is set in peer_status() */
510tlsp->peerdn = state->peerdn;
511tlsp->sni = state->received_sni;
512
513/* record our certificate */
514 {
27f19eb4 515 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
9d1c15ef
JH
516 gnutls_x509_crt_t crt;
517
518 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
519 }
059ec3d9
PH
520}
521
522
523
17c76198 524
059ec3d9 525/*************************************************
575643cd 526* Setup up DH parameters *
059ec3d9
PH
527*************************************************/
528
575643cd 529/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
530be re-generated every so often, depending on security policy. What we do is to
531keep these parameters in a file in the spool directory. If the file does not
532exist, we generate them. This means that it is easy to cause a regeneration.
533
534The new file is written as a temporary file and renamed, so that an incomplete
535file is never present. If two processes both compute some new parameters, you
536waste a bit of effort, but it doesn't seem worth messing around with locking to
537prevent this.
538
059ec3d9
PH
539Returns: OK/DEFER/FAIL
540*/
541
542static int
cf0c6164 543init_server_dh(uschar ** errstr)
059ec3d9 544{
17c76198
PP
545int fd, rc;
546unsigned int dh_bits;
27f19eb4 547gnutls_datum_t m;
a799883d
PP
548uschar filename_buf[PATH_MAX];
549uschar *filename = NULL;
17c76198 550size_t sz;
a799883d
PP
551uschar *exp_tls_dhparam;
552BOOL use_file_in_spool = FALSE;
17c76198 553host_item *host = NULL; /* dummy for macros */
059ec3d9 554
17c76198 555DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 556
452a164f
JH
557if ((rc = gnutls_dh_params_init(&dh_server_params)))
558 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
059ec3d9 559
a799883d
PP
560m.data = NULL;
561m.size = 0;
562
cf0c6164 563if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
a799883d
PP
564 return DEFER;
565
566if (!exp_tls_dhparam)
567 {
568 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
569 m.data = US std_dh_prime_default();
570 m.size = Ustrlen(m.data);
571 }
572else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
573 use_file_in_spool = TRUE;
574else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
575 {
576 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
577 return OK;
578 }
579else if (exp_tls_dhparam[0] != '/')
580 {
f5d25c2b 581 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
48224640 582 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
a799883d
PP
583 m.size = Ustrlen(m.data);
584 }
585else
a799883d 586 filename = exp_tls_dhparam;
a799883d
PP
587
588if (m.data)
589 {
452a164f
JH
590 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
591 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
a799883d
PP
592 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
593 return OK;
594 }
595
af3498d6
PP
596#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
597/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198 598different filename and ensure we have sufficient bits. */
452a164f
JH
599
600if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
cf0c6164 601 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
af3498d6 602DEBUG(D_tls)
b34fc30c 603 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
604 dh_bits);
605#else
606dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
607DEBUG(D_tls)
608 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
609 dh_bits);
610#endif
059ec3d9 611
3375e053
PP
612/* Some clients have hard-coded limits. */
613if (dh_bits > tls_dh_max_bits)
614 {
615 DEBUG(D_tls)
616 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
617 tls_dh_max_bits);
618 dh_bits = tls_dh_max_bits;
619 }
620
a799883d
PP
621if (use_file_in_spool)
622 {
623 if (!string_format(filename_buf, sizeof(filename_buf),
624 "%s/gnutls-params-%d", spool_directory, dh_bits))
cf0c6164 625 return tls_error(US"overlong filename", NULL, NULL, errstr);
a799883d
PP
626 filename = filename_buf;
627 }
059ec3d9 628
b5aea5e1 629/* Open the cache file for reading and if successful, read it and set up the
575643cd 630parameters. */
059ec3d9 631
f5d25c2b 632if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
059ec3d9 633 {
b5aea5e1 634 struct stat statbuf;
17c76198
PP
635 FILE *fp;
636 int saved_errno;
637
638 if (fstat(fd, &statbuf) < 0) /* EIO */
639 {
640 saved_errno = errno;
641 (void)close(fd);
452a164f 642 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
17c76198
PP
643 }
644 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
645 {
646 (void)close(fd);
cf0c6164 647 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
17c76198 648 }
40c90bca 649 if (!(fp = fdopen(fd, "rb")))
17c76198
PP
650 {
651 saved_errno = errno;
652 (void)close(fd);
452a164f
JH
653 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
654 saved_errno, NULL, errstr);
b5aea5e1 655 }
059ec3d9 656
b5aea5e1 657 m.size = statbuf.st_size;
40c90bca 658 if (!(m.data = malloc(m.size)))
17c76198
PP
659 {
660 fclose(fp);
452a164f 661 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
17c76198 662 }
40c90bca 663 if (!(sz = fread(m.data, m.size, 1, fp)))
17c76198
PP
664 {
665 saved_errno = errno;
666 fclose(fp);
667 free(m.data);
452a164f 668 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
17c76198
PP
669 }
670 fclose(fp);
b5aea5e1 671
17c76198 672 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 673 free(m.data);
452a164f
JH
674 if (rc)
675 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
17c76198 676 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
677 }
678
679/* If the file does not exist, fall through to compute new data and cache it.
680If there was any other opening error, it is serious. */
681
182ad5cf
PH
682else if (errno == ENOENT)
683 {
17c76198 684 rc = -1;
182ad5cf 685 DEBUG(D_tls)
17c76198 686 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
687 }
688else
17c76198 689 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
cf0c6164 690 NULL, NULL, errstr);
b5aea5e1
PH
691
692/* If ret < 0, either the cache file does not exist, or the data it contains
693is not useful. One particular case of this is when upgrading from an older
694release of Exim in which the data was stored in a different format. We don't
695try to be clever and support both formats; we just regenerate new data in this
696case. */
697
17c76198 698if (rc < 0)
b5aea5e1 699 {
17c76198 700 uschar *temp_fn;
201f5254 701 unsigned int dh_bits_gen = dh_bits;
059ec3d9 702
17c76198
PP
703 if ((PATH_MAX - Ustrlen(filename)) < 10)
704 return tls_error(US"Filename too long to generate replacement",
48224640 705 filename, NULL, errstr);
059ec3d9 706
48224640 707 temp_fn = string_copy(US"%s.XXXXXXX");
f5d25c2b 708 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
452a164f 709 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
b66fecb4 710 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
059ec3d9 711
201f5254
PP
712 /* GnuTLS overshoots!
713 * If we ask for 2236, we might get 2237 or more.
714 * But there's no way to ask GnuTLS how many bits there really are.
715 * We can ask how many bits were used in a TLS session, but that's it!
716 * The prime itself is hidden behind too much abstraction.
717 * So we ask for less, and proceed on a wing and a prayer.
718 * First attempt, subtracted 3 for 2233 and got 2240.
719 */
cae6e576 720 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
721 {
722 dh_bits_gen = dh_bits - 10;
723 DEBUG(D_tls)
724 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
725 dh_bits_gen);
726 }
727
728 DEBUG(D_tls)
729 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
730 dh_bits_gen);
452a164f
JH
731 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
732 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
17c76198
PP
733
734 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
735 and I confirmed that a NULL call to get the size first is how the GnuTLS
736 sample apps handle this. */
737
738 sz = 0;
739 m.data = NULL;
452a164f
JH
740 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
741 GNUTLS_X509_FMT_PEM, m.data, &sz))
742 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
743 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
744 rc, host, errstr);
17c76198 745 m.size = sz;
40c90bca 746 if (!(m.data = malloc(m.size)))
452a164f 747 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
40c90bca 748
1f00591e 749 /* this will return a size 1 less than the allocation size above */
452a164f
JH
750 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
751 m.data, &sz)))
17c76198
PP
752 {
753 free(m.data);
452a164f 754 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
17c76198 755 }
1f00591e 756 m.size = sz; /* shrink by 1, probably */
059ec3d9 757
f5d25c2b 758 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
17c76198
PP
759 {
760 free(m.data);
452a164f
JH
761 return tls_error_sys(US"TLS cache write D-H params failed",
762 errno, NULL, errstr);
17c76198 763 }
b5aea5e1 764 free(m.data);
f5d25c2b 765 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
452a164f
JH
766 return tls_error_sys(US"TLS cache write D-H params final newline failed",
767 errno, NULL, errstr);
17c76198 768
f5d25c2b 769 if ((rc = close(fd)))
452a164f 770 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
059ec3d9 771
17c76198 772 if (Urename(temp_fn, filename) < 0)
452a164f
JH
773 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
774 temp_fn, filename), errno, NULL, errstr);
059ec3d9 775
17c76198 776 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
777 }
778
17c76198 779DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
780return OK;
781}
782
783
784
785
23bb6982
JH
786/* Create and install a selfsigned certificate, for use in server mode */
787
788static int
cf0c6164 789tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
23bb6982
JH
790{
791gnutls_x509_crt_t cert = NULL;
792time_t now;
793gnutls_x509_privkey_t pkey = NULL;
794const uschar * where;
795int rc;
796
797where = US"initialising pkey";
798if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
799
800where = US"initialising cert";
801if ((rc = gnutls_x509_crt_init(&cert))) goto err;
802
803where = US"generating pkey";
804if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
76075bb5 805#ifdef SUPPORT_PARAM_TO_PK_BITS
4312da48
JH
806# ifndef GNUTLS_SEC_PARAM_MEDIUM
807# define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
808# endif
6aac3239 809 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
76075bb5 810#else
6aac3239 811 2048,
76075bb5
JH
812#endif
813 0)))
23bb6982
JH
814 goto err;
815
816where = US"configuring cert";
1613fd68 817now = 1;
23bb6982
JH
818if ( (rc = gnutls_x509_crt_set_version(cert, 3))
819 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
820 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
821 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
822 || (rc = gnutls_x509_crt_set_key(cert, pkey))
823
824 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
825 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
826 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
827 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
828 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
829 GNUTLS_OID_X520_COMMON_NAME, 0,
830 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
831 )
832 goto err;
833
834where = US"signing cert";
835if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
836
837where = US"installing selfsign cert";
838 /* Since: 2.4.0 */
839if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
840 goto err;
841
842rc = OK;
843
844out:
845 if (cert) gnutls_x509_crt_deinit(cert);
846 if (pkey) gnutls_x509_privkey_deinit(pkey);
847 return rc;
848
849err:
452a164f 850 rc = tls_error_gnu(where, rc, NULL, errstr);
23bb6982
JH
851 goto out;
852}
853
854
855
856
47195144
JH
857/* Add certificate and key, from files.
858
859Return:
860 Zero or negative: good. Negate value for certificate index if < 0.
861 Greater than zero: FAIL or DEFER code.
862*/
863
ba86e143
JH
864static int
865tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
866 uschar * certfile, uschar * keyfile, uschar ** errstr)
867{
868int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
869 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
47195144 870if (rc < 0)
452a164f 871 return tls_error_gnu(
47195144 872 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
452a164f 873 rc, host, errstr);
47195144 874return -rc;
ba86e143
JH
875}
876
877
059ec3d9 878/*************************************************
17c76198 879* Variables re-expanded post-SNI *
059ec3d9
PH
880*************************************************/
881
17c76198
PP
882/* Called from both server and client code, via tls_init(), and also from
883the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
884
885We can tell the two apart by state->received_sni being non-NULL in callback.
886
887The callback should not call us unless state->trigger_sni_changes is true,
888which we are responsible for setting on the first pass through.
059ec3d9
PH
889
890Arguments:
17c76198 891 state exim_gnutls_state_st *
cf0c6164 892 errstr error string pointer
059ec3d9
PH
893
894Returns: OK/DEFER/FAIL
895*/
896
897static int
ba86e143 898tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
059ec3d9 899{
1365611d 900struct stat statbuf;
059ec3d9 901int rc;
17c76198
PP
902const host_item *host = state->host; /* macro should be reconsidered? */
903uschar *saved_tls_certificate = NULL;
904uschar *saved_tls_privatekey = NULL;
905uschar *saved_tls_verify_certificates = NULL;
906uschar *saved_tls_crl = NULL;
907int cert_count;
908
909/* We check for tls_sni *before* expansion. */
2b4a568d 910if (!host) /* server */
17c76198
PP
911 if (!state->received_sni)
912 {
ba86e143
JH
913 if ( state->tls_certificate
914 && ( Ustrstr(state->tls_certificate, US"tls_sni")
915 || Ustrstr(state->tls_certificate, US"tls_in_sni")
916 || Ustrstr(state->tls_certificate, US"tls_out_sni")
917 ) )
17c76198
PP
918 {
919 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
920 state->trigger_sni_changes = TRUE;
921 }
922 }
923 else
924 {
1365611d 925 /* useful for debugging */
17c76198
PP
926 saved_tls_certificate = state->exp_tls_certificate;
927 saved_tls_privatekey = state->exp_tls_privatekey;
928 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
929 saved_tls_crl = state->exp_tls_crl;
930 }
059ec3d9 931
452a164f
JH
932if ((rc = gnutls_certificate_allocate_credentials(&state->x509_cred)))
933 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
934 rc, host, errstr);
47195144
JH
935
936#ifdef SUPPORT_SRV_OCSP_STACK
937gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
938#endif
1365611d 939
17c76198
PP
940/* remember: expand_check_tlsvar() is expand_check() but fiddling with
941state members, assuming consistent naming; and expand_check() returns
942false if expansion failed, unless expansion was forced to fail. */
059ec3d9 943
17c76198
PP
944/* check if we at least have a certificate, before doing expensive
945D-H generation. */
059ec3d9 946
cf0c6164 947if (!expand_check_tlsvar(tls_certificate, errstr))
17c76198 948 return DEFER;
059ec3d9 949
17c76198 950/* certificate is mandatory in server, optional in client */
059ec3d9 951
23bb6982
JH
952if ( !state->exp_tls_certificate
953 || !*state->exp_tls_certificate
954 )
2b4a568d 955 if (!host)
cf0c6164 956 return tls_install_selfsign(state, errstr);
17c76198
PP
957 else
958 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
059ec3d9 959
cf0c6164 960if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
059ec3d9
PH
961 return DEFER;
962
17c76198
PP
963/* tls_privatekey is optional, defaulting to same file as certificate */
964
965if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 966 {
17c76198
PP
967 state->tls_privatekey = state->tls_certificate;
968 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 969 }
c91535f3 970
059ec3d9 971
17c76198 972if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
973 {
974 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
975 state->exp_tls_certificate, state->exp_tls_privatekey);
976
977 if (state->received_sni)
23bb6982
JH
978 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
979 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
980 )
17c76198 981 {
b34fc30c 982 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
983 }
984 else
985 {
b34fc30c 986 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 987 }
059ec3d9 988
ba86e143
JH
989 if (!host) /* server */
990 {
991 const uschar * clist = state->exp_tls_certificate;
992 const uschar * klist = state->exp_tls_privatekey;
47195144
JH
993 const uschar * olist;
994 int csep = 0, ksep = 0, osep = 0, cnt = 0;
995 uschar * cfile, * kfile, * ofile;
996
997#ifndef DISABLE_OCSP
998 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
999 return DEFER;
1000 olist = ofile;
1001#endif
ba86e143
JH
1002
1003 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
47195144 1004
ba86e143
JH
1005 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1006 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
47195144 1007 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
ba86e143
JH
1008 return rc;
1009 else
47195144
JH
1010 {
1011 int gnutls_cert_index = -rc;
ba86e143 1012 DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile);
47195144
JH
1013
1014 /* Set the OCSP stapling server info */
1015
1016#ifndef DISABLE_OCSP
1017 if (tls_ocsp_file)
1018 if (gnutls_buggy_ocsp)
1019 {
1020 DEBUG(D_tls)
1021 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1022 }
1023 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1024 {
1025 /* Use the full callback method for stapling just to get
1026 observability. More efficient would be to read the file once only,
1027 if it never changed (due to SNI). Would need restart on file update,
1028 or watch datestamp. */
1029
1030# ifdef SUPPORT_SRV_OCSP_STACK
452a164f
JH
1031 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1032 state->x509_cred, gnutls_cert_index,
1033 server_ocsp_stapling_cb, ofile)))
1034 return tls_error_gnu(
1035 US"gnutls_certificate_set_ocsp_status_request_function2",
1036 rc, host, errstr);
47195144
JH
1037# else
1038 if (cnt++ > 0)
1039 {
1040 DEBUG(D_tls)
1041 debug_printf("oops; multiple OCSP files not supported\n");
1042 break;
1043 }
1044 gnutls_certificate_set_ocsp_status_request_function(
1045 state->x509_cred, server_ocsp_stapling_cb, ofile);
1046# endif
1047
1048 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile);
1049 }
1050 else
1051 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1052#endif
1053 }
ba86e143
JH
1054 }
1055 else
1056 {
47195144 1057 if (0 < (rc = tls_add_certfile(state, host,
ba86e143
JH
1058 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1059 return rc;
1060 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1061 }
1062
b34fc30c 1063 } /* tls_certificate */
059ec3d9 1064
2b4a568d 1065
059ec3d9
PH
1066/* Set the trusted CAs file if one is provided, and then add the CRL if one is
1067provided. Experiment shows that, if the certificate file is empty, an unhelpful
1068error message is provided. However, if we just refrain from setting anything up
1069in that case, certificate verification fails, which seems to be the correct
1070behaviour. */
1071
610ff438 1072if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 1073 {
cf0c6164 1074 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
059ec3d9 1075 return DEFER;
610ff438
JH
1076#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1077 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1078 state->exp_tls_verify_certificates = NULL;
1079#endif
17c76198 1080 if (state->tls_crl && *state->tls_crl)
cf0c6164 1081 if (!expand_check_tlsvar(tls_crl, errstr))
17c76198 1082 return DEFER;
059ec3d9 1083
1365611d
PP
1084 if (!(state->exp_tls_verify_certificates &&
1085 *state->exp_tls_verify_certificates))
b34fc30c
PP
1086 {
1087 DEBUG(D_tls)
1365611d
PP
1088 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1089 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 1090 return OK;
b34fc30c 1091 }
1365611d 1092 }
83e2f8a2
PP
1093else
1094 {
1095 DEBUG(D_tls)
1096 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1097 return OK;
1098 }
17c76198 1099
cb1d7830
JH
1100#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1101if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1102 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1103else
1104#endif
1365611d 1105 {
cb1d7830
JH
1106 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1107 {
1108 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1109 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1110 strerror(errno));
1111 return DEFER;
1112 }
17c76198 1113
a7fec7a7 1114#ifndef SUPPORT_CA_DIR
cb1d7830
JH
1115 /* The test suite passes in /dev/null; we could check for that path explicitly,
1116 but who knows if someone has some weird FIFO which always dumps some certs, or
1117 other weirdness. The thing we really want to check is that it's not a
1118 directory, since while OpenSSL supports that, GnuTLS does not.
60f914bc 1119 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
cb1d7830
JH
1120 if (S_ISDIR(statbuf.st_mode))
1121 {
1122 DEBUG(D_tls)
1123 debug_printf("verify certificates path is a dir: \"%s\"\n",
1124 state->exp_tls_verify_certificates);
1125 log_write(0, LOG_MAIN|LOG_PANIC,
1126 "tls_verify_certificates \"%s\" is a directory",
1127 state->exp_tls_verify_certificates);
1128 return DEFER;
1129 }
a7fec7a7 1130#endif
059ec3d9 1131
cb1d7830
JH
1132 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1133 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 1134
cb1d7830
JH
1135 if (statbuf.st_size == 0)
1136 {
1137 DEBUG(D_tls)
1138 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1139 return OK;
1140 }
059ec3d9 1141
cb1d7830 1142 cert_count =
a7fec7a7
JH
1143
1144#ifdef SUPPORT_CA_DIR
cb1d7830
JH
1145 (statbuf.st_mode & S_IFMT) == S_IFDIR
1146 ?
1147 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1148 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1149 :
a7fec7a7 1150#endif
cb1d7830
JH
1151 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1152 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1153 }
a7fec7a7 1154
1365611d 1155if (cert_count < 0)
452a164f
JH
1156 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1157DEBUG(D_tls)
1158 debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 1159
5c8cda3a
PP
1160if (state->tls_crl && *state->tls_crl &&
1161 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 1162 {
5c8cda3a 1163 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
452a164f
JH
1164 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1165 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM)) < 0)
1166 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1167 cert_count, host, errstr);
1168
5c8cda3a 1169 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 1170 }
059ec3d9 1171
059ec3d9
PH
1172return OK;
1173}
1174
1175
1176
1177
1178/*************************************************
1365611d
PP
1179* Set X.509 state variables *
1180*************************************************/
1181
1182/* In GnuTLS, the registered cert/key are not replaced by a later
1183set of a cert/key, so for SNI support we need a whole new x509_cred
1184structure. Which means various other non-re-expanded pieces of state
1185need to be re-set in the new struct, so the setting logic is pulled
1186out to this.
1187
1188Arguments:
1189 state exim_gnutls_state_st *
cf0c6164 1190 errstr error string pointer
1365611d
PP
1191
1192Returns: OK/DEFER/FAIL
1193*/
1194
1195static int
cf0c6164 1196tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1365611d
PP
1197{
1198int rc;
1199const host_item *host = state->host; /* macro should be reconsidered? */
1200
1201/* Create D-H parameters, or read them from the cache file. This function does
1202its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1203client-side params. */
1204
1205if (!state->host)
1206 {
1207 if (!dh_server_params)
452a164f 1208 if ((rc = init_server_dh(errstr)) != OK) return rc;
1365611d
PP
1209 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1210 }
1211
1212/* Link the credentials to the session. */
1213
452a164f
JH
1214if ((rc = gnutls_credentials_set(state->session,
1215 GNUTLS_CRD_CERTIFICATE, state->x509_cred)))
1216 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1365611d
PP
1217
1218return OK;
1219}
1220
1221/*************************************************
17c76198 1222* Initialize for GnuTLS *
059ec3d9
PH
1223*************************************************/
1224
9196d5bf 1225
4fb7df6d
JH
1226#ifndef DISABLE_OCSP
1227
9196d5bf
JH
1228static BOOL
1229tls_is_buggy_ocsp(void)
1230{
1231const uschar * s;
1232uschar maj, mid, mic;
1233
1234s = CUS gnutls_check_version(NULL);
1235maj = atoi(CCS s);
1236if (maj == 3)
1237 {
1238 while (*s && *s != '.') s++;
1239 mid = atoi(CCS ++s);
1240 if (mid <= 2)
1241 return TRUE;
1242 else if (mid >= 5)
1243 return FALSE;
1244 else
1245 {
1246 while (*s && *s != '.') s++;
1247 mic = atoi(CCS ++s);
1248 return mic <= (mid == 3 ? 16 : 3);
1249 }
1250 }
1251return FALSE;
1252}
1253
4fb7df6d 1254#endif
9196d5bf
JH
1255
1256
17c76198
PP
1257/* Called from both server and client code. In the case of a server, errors
1258before actual TLS negotiation return DEFER.
059ec3d9
PH
1259
1260Arguments:
17c76198
PP
1261 host connected host, if client; NULL if server
1262 certificate certificate file
1263 privatekey private key file
1264 sni TLS SNI to send, sometimes when client; else NULL
1265 cas CA certs file
1266 crl CRL file
1267 require_ciphers tls_require_ciphers setting
817d9f57 1268 caller_state returned state-info structure
cf0c6164 1269 errstr error string pointer
059ec3d9 1270
17c76198 1271Returns: OK/DEFER/FAIL
059ec3d9
PH
1272*/
1273
17c76198
PP
1274static int
1275tls_init(
1276 const host_item *host,
1277 const uschar *certificate,
1278 const uschar *privatekey,
1279 const uschar *sni,
1280 const uschar *cas,
1281 const uschar *crl,
1282 const uschar *require_ciphers,
cf0c6164 1283 exim_gnutls_state_st **caller_state,
74f1a423 1284 tls_support * tlsp,
cf0c6164 1285 uschar ** errstr)
059ec3d9 1286{
00c0dd4e 1287exim_gnutls_state_st * state;
17c76198
PP
1288int rc;
1289size_t sz;
00c0dd4e
JH
1290const char * errpos;
1291const uschar * p;
17c76198
PP
1292
1293if (!exim_gnutls_base_init_done)
059ec3d9 1294 {
17c76198
PP
1295 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1296
a5f239e4
PP
1297#ifdef HAVE_GNUTLS_PKCS11
1298 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1299 which loads modules from a config file, which sounds good and may be wanted
1300 by some sysadmin, but also means in common configurations that GNOME keyring
1301 environment variables are used and so breaks for users calling mailq.
1302 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1303 if (!gnutls_allow_auto_pkcs11)
452a164f
JH
1304 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
1305 return tls_error_gnu(US"gnutls_pkcs11_init", rc, host, errstr);
a5f239e4
PP
1306#endif
1307
452a164f
JH
1308 if ((rc = gnutls_global_init()))
1309 return tls_error_gnu(US"gnutls_global_init", rc, host, errstr);
17c76198
PP
1310
1311#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1312 DEBUG(D_tls)
059ec3d9 1313 {
17c76198 1314 gnutls_global_set_log_function(exim_gnutls_logger_cb);
aded2255 1315 /* arbitrarily chosen level; bump up to 9 for more */
17c76198 1316 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1317 }
17c76198
PP
1318#endif
1319
4fb7df6d
JH
1320#ifndef DISABLE_OCSP
1321 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
9196d5bf 1322 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
4fb7df6d 1323#endif
9196d5bf 1324
17c76198 1325 exim_gnutls_base_init_done = TRUE;
059ec3d9 1326 }
059ec3d9 1327
17c76198
PP
1328if (host)
1329 {
74f1a423
JH
1330 /* For client-side sessions we allocate a context. This lets us run
1331 several in parallel. */
1332 int old_pool = store_pool;
1333 store_pool = POOL_PERM;
1334 state = store_get(sizeof(exim_gnutls_state_st));
1335 store_pool = old_pool;
1336
17c76198 1337 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1338 state->tlsp = tlsp;
17c76198
PP
1339 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1340 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1341 }
1342else
1343 {
1344 state = &state_server;
1345 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1346 state->tlsp = tlsp;
17c76198
PP
1347 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1348 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1349 }
452a164f
JH
1350if (rc)
1351 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
059ec3d9 1352
17c76198 1353state->host = host;
059ec3d9 1354
17c76198
PP
1355state->tls_certificate = certificate;
1356state->tls_privatekey = privatekey;
5779e6aa 1357state->tls_require_ciphers = require_ciphers;
17c76198
PP
1358state->tls_sni = sni;
1359state->tls_verify_certificates = cas;
1360state->tls_crl = crl;
059ec3d9 1361
17c76198
PP
1362/* This handles the variables that might get re-expanded after TLS SNI;
1363that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1364
17c76198
PP
1365DEBUG(D_tls)
1366 debug_printf("Expanding various TLS configuration options for session credentials.\n");
cf0c6164 1367if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
059ec3d9 1368
1365611d
PP
1369/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1370requires a new structure afterwards. */
83da1223 1371
cf0c6164 1372if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
83da1223 1373
17c76198
PP
1374/* set SNI in client, only */
1375if (host)
1376 {
cf0c6164 1377 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
17c76198 1378 return DEFER;
0df4ab80 1379 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1380 {
1381 DEBUG(D_tls)
0df4ab80
JH
1382 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1383 sz = Ustrlen(state->tlsp->sni);
452a164f
JH
1384 if ((rc = gnutls_server_name_set(state->session,
1385 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
1386 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
17c76198
PP
1387 }
1388 }
1389else if (state->tls_sni)
1390 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
ba86e143 1391 "have an SNI set for a server [%s]\n", state->tls_sni);
83da1223 1392
17c76198 1393/* This is the priority string support,
42bfef1e 1394http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1395and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1396This was backwards incompatible, but means Exim no longer needs to track
1397all algorithms and provide string forms for them. */
83da1223 1398
fc243e94 1399p = NULL;
17c76198 1400if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1401 {
cf0c6164 1402 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
17c76198
PP
1403 return DEFER;
1404 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1405 {
17c76198 1406 p = state->exp_tls_require_ciphers;
fc243e94 1407 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
83da1223
PH
1408 }
1409 }
fc243e94 1410if (!p)
17c76198 1411 {
fc243e94 1412 p = exim_default_gnutls_priority;
83e2f8a2 1413 DEBUG(D_tls)
fc243e94 1414 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
17c76198 1415 }
83da1223 1416
452a164f
JH
1417if ((rc = gnutls_priority_init(&state->priority_cache, CCS p, &errpos)))
1418 return tls_error_gnu(string_sprintf(
1419 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1420 p, errpos - CS p, errpos),
1421 rc, host, errstr);
17c76198 1422
452a164f
JH
1423if ((rc = gnutls_priority_set(state->session, state->priority_cache)))
1424 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
17c76198
PP
1425
1426gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1427
1428/* Reduce security in favour of increased compatibility, if the admin
1429decides to make that trade-off. */
1430if (gnutls_compat_mode)
83da1223 1431 {
17c76198
PP
1432#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1433 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1434 gnutls_session_enable_compatibility_mode(state->session);
1435#else
1436 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1437#endif
83da1223
PH
1438 }
1439
17c76198 1440*caller_state = state;
17c76198 1441return OK;
83da1223
PH
1442}
1443
1444
1445
83da1223 1446/*************************************************
17c76198 1447* Extract peer information *
059ec3d9
PH
1448*************************************************/
1449
f1be21cf
JH
1450static const uschar *
1451cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
1452 gnutls_mac_algorithm_t mac)
1453{
1454uschar cs_id[2];
1455gnutls_kx_algorithm_t kx_i;
1456gnutls_cipher_algorithm_t cipher_i;
1457gnutls_mac_algorithm_t mac_i;
1458
1459for (size_t i = 0;
1460 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
1461 i++)
1462 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
1463 return cipher_stdname(cs_id[0], cs_id[1]);
1464return NULL;
1465}
1466
1467
1468
17c76198 1469/* Called from both server and client code.
4fe99a6c
PP
1470Only this is allowed to set state->peerdn and state->have_set_peerdn
1471and we use that to detect double-calls.
059ec3d9 1472
75fe387d
PP
1473NOTE: the state blocks last while the TLS connection is up, which is fine
1474for logging in the server side, but for the client side, we log after teardown
1475in src/deliver.c. While the session is up, we can twist about states and
1476repoint tls_* globals, but those variables used for logging or other variable
1477expansion that happens _after_ delivery need to have a longer life-time.
1478
1479So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1480doing this more than once per generation of a state context. We set them in
1481the state context, and repoint tls_* to them. After the state goes away, the
1482tls_* copies of the pointers remain valid and client delivery logging is happy.
1483
1484tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1485don't apply.
1486
059ec3d9 1487Arguments:
17c76198 1488 state exim_gnutls_state_st *
cf0c6164 1489 errstr pointer to error string
059ec3d9 1490
17c76198 1491Returns: OK/DEFER/FAIL
059ec3d9
PH
1492*/
1493
17c76198 1494static int
cf0c6164 1495peer_status(exim_gnutls_state_st *state, uschar ** errstr)
059ec3d9 1496{
27f19eb4 1497const gnutls_datum_t *cert_list;
75fe387d 1498int old_pool, rc;
17c76198 1499unsigned int cert_list_size = 0;
4fe99a6c
PP
1500gnutls_protocol_t protocol;
1501gnutls_cipher_algorithm_t cipher;
1502gnutls_kx_algorithm_t kx;
1503gnutls_mac_algorithm_t mac;
17c76198
PP
1504gnutls_certificate_type_t ct;
1505gnutls_x509_crt_t crt;
d7978c0f 1506uschar *dn_buf;
17c76198 1507size_t sz;
059ec3d9 1508
4fe99a6c 1509if (state->have_set_peerdn)
17c76198 1510 return OK;
4fe99a6c 1511state->have_set_peerdn = TRUE;
059ec3d9 1512
4fe99a6c 1513state->peerdn = NULL;
059ec3d9 1514
4fe99a6c
PP
1515/* tls_cipher */
1516cipher = gnutls_cipher_get(state->session);
1517protocol = gnutls_protocol_get_version(state->session);
1518mac = gnutls_mac_get(state->session);
b9c6f63c
JH
1519kx =
1520#ifdef GNUTLS_TLS1_3
1521 protocol >= GNUTLS_TLS1_3 ? 0 :
1522#endif
1523 gnutls_kx_get(state->session);
4fe99a6c 1524
75fe387d 1525old_pool = store_pool;
f1be21cf
JH
1526 {
1527 store_pool = POOL_PERM;
d9acfc1c
JH
1528
1529#ifdef SUPPORT_GNUTLS_SESS_DESC
1530 {
1531 gstring * g = NULL;
1532 uschar * s = US gnutls_session_get_desc(state->session), c;
1533
1534 /* Nikos M suggests we use this by preference. It returns like:
1535 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
1536
1537 For partial back-compat, put a colon after the TLS version, replace the
1538 )-( grouping with __, replace in-group - with _ and append the :keysize. */
1539
1540 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
1541
1542 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
1543 g = string_catn(g, US":", 1);
1544 if (*s) s++; /* now on _ between groups */
1545 while ((c = *s))
1546 {
1547 for (*++s && ++s; (c = *s) && c != ')'; s++) g = string_catn(g, c == '-' ? US"_" : s, 1);
1548 /* now on ) closing group */
1549 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
1550 /* now on _ between groups */
1551 }
1552 g = string_catn(g, US":", 1);
1553 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
1554 state->ciphersuite = string_from_gstring(g);
1555 }
1556#else
f1be21cf
JH
1557 state->ciphersuite = string_sprintf("%s:%s:%d",
1558 gnutls_protocol_get_name(protocol),
1559 gnutls_cipher_suite_get_name(kx, cipher, mac),
1560 (int) gnutls_cipher_get_key_size(cipher) * 8);
1561
1562 /* I don't see a way that spaces could occur, in the current GnuTLS
1563 code base, but it was a concern in the old code and perhaps older GnuTLS
1564 releases did return "TLS 1.0"; play it safe, just in case. */
1565
1566 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
d9acfc1c
JH
1567#endif
1568
1569/* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
1570
f1be21cf 1571 state->tlsp->cipher = state->ciphersuite;
d9acfc1c 1572 state->tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
f1be21cf
JH
1573
1574 state->tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
1575 }
75fe387d 1576store_pool = old_pool;
4fe99a6c
PP
1577
1578/* tls_peerdn */
17c76198 1579cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1580
f1be21cf 1581if (!cert_list || cert_list_size == 0)
17c76198 1582 {
17c76198
PP
1583 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1584 cert_list, cert_list_size);
e51c7be2 1585 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1586 return tls_error(US"certificate verification failed",
48224640 1587 US"no certificate received from peer", state->host, errstr);
17c76198
PP
1588 return OK;
1589 }
059ec3d9 1590
95f52235 1591if ((ct = gnutls_certificate_type_get(state->session)) != GNUTLS_CRT_X509)
059ec3d9 1592 {
95f52235 1593 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
17c76198
PP
1594 DEBUG(D_tls)
1595 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1596 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1597 return tls_error(US"certificate verification not possible, unhandled type",
cf0c6164 1598 ctn, state->host, errstr);
17c76198 1599 return OK;
83da1223 1600 }
059ec3d9 1601
e51c7be2
JH
1602#define exim_gnutls_peer_err(Label) \
1603 do { \
1604 if (rc != GNUTLS_E_SUCCESS) \
1605 { \
1606 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1607 (Label), gnutls_strerror(rc)); \
1608 if (state->verify_requirement >= VERIFY_REQUIRED) \
452a164f 1609 return tls_error_gnu((Label), rc, state->host, errstr); \
e51c7be2
JH
1610 return OK; \
1611 } \
1612 } while (0)
17c76198 1613
9d1c15ef
JH
1614rc = import_cert(&cert_list[0], &crt);
1615exim_gnutls_peer_err(US"cert 0");
1616
1617state->tlsp->peercert = state->peercert = crt;
17c76198 1618
17c76198
PP
1619sz = 0;
1620rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1621if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1622 {
17c76198
PP
1623 exim_gnutls_peer_err(US"getting size for cert DN failed");
1624 return FAIL; /* should not happen */
059ec3d9 1625 }
17c76198
PP
1626dn_buf = store_get_perm(sz);
1627rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1628exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1629
17c76198
PP
1630state->peerdn = dn_buf;
1631
1632return OK;
1633#undef exim_gnutls_peer_err
1634}
059ec3d9 1635
059ec3d9 1636
059ec3d9 1637
059ec3d9 1638
17c76198
PP
1639/*************************************************
1640* Verify peer certificate *
1641*************************************************/
059ec3d9 1642
17c76198
PP
1643/* Called from both server and client code.
1644*Should* be using a callback registered with
1645gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1646the peer information, but that's too new for some OSes.
059ec3d9 1647
17c76198 1648Arguments:
899b8bbc
JH
1649 state exim_gnutls_state_st *
1650 errstr where to put an error message
059ec3d9 1651
17c76198
PP
1652Returns:
1653 FALSE if the session should be rejected
1654 TRUE if the cert is okay or we just don't care
1655*/
059ec3d9 1656
17c76198 1657static BOOL
28646fa9 1658verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
17c76198
PP
1659{
1660int rc;
899b8bbc
JH
1661uint verify;
1662
1663if (state->verify_requirement == VERIFY_NONE)
1664 return TRUE;
17c76198 1665
8008accd 1666DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
cf0c6164 1667*errstr = NULL;
17c76198 1668
95f52235 1669if ((rc = peer_status(state, errstr)) != OK || !state->peerdn)
e6060e2c 1670 {
17c76198 1671 verify = GNUTLS_CERT_INVALID;
cf0c6164 1672 *errstr = US"certificate not supplied";
17c76198
PP
1673 }
1674else
899b8bbc
JH
1675
1676 {
1677#ifdef SUPPORT_DANE
1678 if (state->verify_requirement == VERIFY_DANE && state->host)
1679 {
1680 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1681 including talking to a DNS resolver. But we want to do that bit ourselves
1682 as the testsuite intercepts and fakes its own DNS environment. */
1683
1684 dane_state_t s;
1685 dane_query_t r;
899b8bbc 1686 uint lsize;
94c13285
JH
1687 const gnutls_datum_t * certlist =
1688 gnutls_certificate_get_peers(state->session, &lsize);
1689 int usage = tls_out.tlsa_usage;
1690
1691# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1692 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1693 dane-verification separately so that we know which selector verified;
570cb1bd 1694 then we know whether to do name-verification (needed for TA but not EE). */
94c13285
JH
1695
1696 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
bd5b3f3c 1697 { /* a mixed-usage bundle */
94c13285
JH
1698 int i, j, nrec;
1699 const char ** dd;
1700 int * ddl;
1701
1702 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1703 nrec++;
1704
1705 dd = store_get(nrec * sizeof(uschar *));
1706 ddl = store_get(nrec * sizeof(int));
1707 nrec--;
1708
1709 if ((rc = dane_state_init(&s, 0)))
1710 goto tlsa_prob;
1711
1712 for (usage = DANESSL_USAGE_DANE_EE;
1713 usage >= DANESSL_USAGE_DANE_TA; usage--)
1714 { /* take records with this usage */
1715 for (j = i = 0; i < nrec; i++)
1716 if (state->dane_data[i][0] == usage)
1717 {
1718 dd[j] = state->dane_data[i];
1719 ddl[j++] = state->dane_data_len[i];
1720 }
1721 if (j)
1722 {
1723 dd[j] = NULL;
1724 ddl[j] = 0;
1725
1726 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1727 goto tlsa_prob;
1728
1729 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1730 gnutls_certificate_type_get(state->session),
1731 r, 0,
1732 usage == DANESSL_USAGE_DANE_EE
1733 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1734 &verify)))
1735 {
1736 DEBUG(D_tls)
1737 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1738 }
1739 else if (verify == 0) /* verification passed */
1740 {
1741 usage = 1 << usage;
1742 break;
1743 }
1744 }
1745 }
899b8bbc 1746
94c13285
JH
1747 if (rc) goto tlsa_prob;
1748 }
1749 else
1750# endif
899b8bbc 1751 {
94c13285
JH
1752 if ( (rc = dane_state_init(&s, 0))
1753 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1754 1, 0))
1755 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1756 gnutls_certificate_type_get(state->session),
5ec37a55 1757 r, 0,
94c13285
JH
1758# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1759 usage == (1 << DANESSL_USAGE_DANE_EE)
1760 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1761# else
1762 0,
1763# endif
1764 &verify))
1765 )
1766 goto tlsa_prob;
899b8bbc 1767 }
94c13285
JH
1768
1769 if (verify != 0) /* verification failed */
899b8bbc
JH
1770 {
1771 gnutls_datum_t str;
1772 (void) dane_verification_status_print(verify, &str, 0);
1773 *errstr = US str.data; /* don't bother to free */
1774 goto badcert;
1775 }
28646fa9 1776
94c13285
JH
1777# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1778 /* If a TA-mode TLSA record was used for verification we must additionally
570cb1bd 1779 verify the cert name (but not the CA chain). For EE-mode, skip it. */
28646fa9 1780
94c13285
JH
1781 if (usage & (1 << DANESSL_USAGE_DANE_EE))
1782# endif
28646fa9 1783 {
570cb1bd 1784 state->peer_dane_verified = state->peer_cert_verified = TRUE;
28646fa9
JH
1785 goto goodcert;
1786 }
570cb1bd
JH
1787# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1788 /* Assume that the name on the A-record is the one that should be matching
1789 the cert. An alternate view is that the domain part of the email address
1790 is also permissible. */
1791
1792 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1793 CS state->host->name))
1794 {
1795 state->peer_dane_verified = state->peer_cert_verified = TRUE;
1796 goto goodcert;
1797 }
1798# endif
899b8bbc 1799 }
570cb1bd 1800#endif /*SUPPORT_DANE*/
899b8bbc 1801
17c76198 1802 rc = gnutls_certificate_verify_peers2(state->session, &verify);
899b8bbc 1803 }
e6060e2c 1804
899b8bbc 1805/* Handle the result of verification. INVALID is set if any others are. */
059ec3d9 1806
28646fa9 1807if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
17c76198
PP
1808 {
1809 state->peer_cert_verified = FALSE;
cf0c6164 1810 if (!*errstr)
184384c3
JH
1811 {
1812#ifdef GNUTLS_CERT_VFY_STATUS_PRINT
1813 DEBUG(D_tls)
1814 {
1815 gnutls_datum_t txt;
1816
1817 if (gnutls_certificate_verification_status_print(verify,
1818 gnutls_certificate_type_get(state->session), &txt, 0)
1819 == GNUTLS_E_SUCCESS)
1820 {
1821 debug_printf("%s\n", txt.data);
1822 gnutls_free(txt.data);
1823 }
1824 }
1825#endif
cf0c6164
JH
1826 *errstr = verify & GNUTLS_CERT_REVOKED
1827 ? US"certificate revoked" : US"certificate invalid";
184384c3 1828 }
059ec3d9 1829
17c76198 1830 DEBUG(D_tls)
e51c7be2 1831 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
cf0c6164 1832 *errstr, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1833
e51c7be2 1834 if (state->verify_requirement >= VERIFY_REQUIRED)
899b8bbc 1835 goto badcert;
17c76198 1836 DEBUG(D_tls)
4789da3a 1837 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 1838 }
e51c7be2 1839
17c76198
PP
1840else
1841 {
5fd28bb8
JH
1842 /* Client side, check the server's certificate name versus the name on the
1843 A-record for the connection we made. What to do for server side - what name
1844 to use for client? We document that there is no such checking for server
1845 side. */
1846
1847 if ( state->exp_tls_verify_cert_hostnames
1848 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1849 CS state->exp_tls_verify_cert_hostnames)
1850 )
e51c7be2 1851 {
5fd28bb8
JH
1852 DEBUG(D_tls)
1853 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1854 if (state->verify_requirement >= VERIFY_REQUIRED)
1855 goto badcert;
1856 return TRUE;
e51c7be2 1857 }
5fd28bb8 1858
17c76198 1859 state->peer_cert_verified = TRUE;
e51c7be2 1860 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 1861 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1862 }
059ec3d9 1863
28646fa9
JH
1864goodcert:
1865 state->tlsp->peerdn = state->peerdn;
1866 return TRUE;
899b8bbc 1867
b83314e3 1868#ifdef SUPPORT_DANE
94c13285 1869tlsa_prob:
624f33df
JH
1870 *errstr = string_sprintf("TLSA record problem: %s",
1871 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
b83314e3
JH
1872#endif
1873
899b8bbc
JH
1874badcert:
1875 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1876 return FALSE;
17c76198 1877}
059ec3d9 1878
17c76198
PP
1879
1880
1881
1882/* ------------------------------------------------------------------------ */
1883/* Callbacks */
1884
1885/* Logging function which can be registered with
1886 * gnutls_global_set_log_function()
1887 * gnutls_global_set_log_level() 0..9
1888 */
af3498d6 1889#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1890static void
17c76198 1891exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1892{
8c79eebf
PP
1893 size_t len = strlen(message);
1894 if (len < 1)
1895 {
1896 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1897 return;
1898 }
1899 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1900 message[len-1] == '\n' ? "" : "\n");
17c76198 1901}
af3498d6 1902#endif
059ec3d9 1903
059ec3d9 1904
17c76198
PP
1905/* Called after client hello, should handle SNI work.
1906This will always set tls_sni (state->received_sni) if available,
1907and may trigger presenting different certificates,
1908if state->trigger_sni_changes is TRUE.
059ec3d9 1909
17c76198
PP
1910Should be registered with
1911 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1912
17c76198
PP
1913"This callback must return 0 on success or a gnutls error code to terminate the
1914handshake.".
059ec3d9 1915
17c76198
PP
1916For inability to get SNI information, we return 0.
1917We only return non-zero if re-setup failed.
817d9f57 1918Only used for server-side TLS.
17c76198 1919*/
44bbabb5 1920
17c76198
PP
1921static int
1922exim_sni_handling_cb(gnutls_session_t session)
1923{
1924char sni_name[MAX_HOST_LEN];
1925size_t data_len = MAX_HOST_LEN;
817d9f57 1926exim_gnutls_state_st *state = &state_server;
17c76198
PP
1927unsigned int sni_type;
1928int rc, old_pool;
cf0c6164 1929uschar * dummy_errstr;
17c76198
PP
1930
1931rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1932if (rc != GNUTLS_E_SUCCESS)
1933 {
1934 DEBUG(D_tls) {
1935 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1936 debug_printf("TLS: no SNI presented in handshake.\n");
1937 else
1938 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1939 gnutls_strerror(rc), rc);
cf0c6164 1940 }
b34fc30c
PP
1941 return 0;
1942 }
1943
17c76198
PP
1944if (sni_type != GNUTLS_NAME_DNS)
1945 {
1946 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1947 return 0;
1948 }
44bbabb5 1949
17c76198
PP
1950/* We now have a UTF-8 string in sni_name */
1951old_pool = store_pool;
1952store_pool = POOL_PERM;
1953state->received_sni = string_copyn(US sni_name, data_len);
1954store_pool = old_pool;
1955
1956/* We set this one now so that variable expansions below will work */
817d9f57 1957state->tlsp->sni = state->received_sni;
17c76198
PP
1958
1959DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1960 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1961
1962if (!state->trigger_sni_changes)
1963 return 0;
1964
cf0c6164 1965if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
17c76198
PP
1966 {
1967 /* If the setup of certs/etc failed before handshake, TLS would not have
1968 been offered. The best we can do now is abort. */
1969 return GNUTLS_E_APPLICATION_ERROR_MIN;
1970 }
1971
cf0c6164 1972rc = tls_set_remaining_x509(state, &dummy_errstr);
1365611d
PP
1973if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1974
1975return 0;
059ec3d9
PH
1976}
1977
1978
1979
f2de3a33 1980#ifndef DISABLE_OCSP
44662487
JH
1981
1982static int
1983server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1984 gnutls_datum_t * ocsp_response)
1985{
1986int ret;
47195144 1987DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
44662487 1988
44662487
JH
1989if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1990 {
1991 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
5903c6ff 1992 CS ptr);
018058b2 1993 tls_in.ocsp = OCSP_NOT_RESP;
44662487
JH
1994 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1995 }
1996
018058b2 1997tls_in.ocsp = OCSP_VFY_NOT_TRIED;
44662487
JH
1998return 0;
1999}
2000
2001#endif
2002
2003
0cbf2b82 2004#ifndef DISABLE_EVENT
a7538db1
JH
2005/*
2006We use this callback to get observability and detail-level control
723fe533
JH
2007for an exim TLS connection (either direction), raising a tls:cert event
2008for each cert in the chain presented by the peer. Any event
a7538db1
JH
2009can deny verification.
2010
2011Return 0 for the handshake to continue or non-zero to terminate.
2012*/
2013
2014static int
723fe533 2015verify_cb(gnutls_session_t session)
a7538db1 2016{
27f19eb4 2017const gnutls_datum_t * cert_list;
a7538db1
JH
2018unsigned int cert_list_size = 0;
2019gnutls_x509_crt_t crt;
2020int rc;
b30275b8 2021uschar * yield;
a7538db1
JH
2022exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2023
bd5b3f3c 2024if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
a7538db1
JH
2025 while (cert_list_size--)
2026 {
bd5b3f3c 2027 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
a7538db1
JH
2028 {
2029 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2030 cert_list_size, gnutls_strerror(rc));
2031 break;
2032 }
2033
2034 state->tlsp->peercert = crt;
b30275b8
JH
2035 if ((yield = event_raise(state->event_action,
2036 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
2037 {
2038 log_write(0, LOG_MAIN,
b30275b8
JH
2039 "SSL verify denied by event-action: depth=%d: %s",
2040 cert_list_size, yield);
a7538db1
JH
2041 return 1; /* reject */
2042 }
2043 state->tlsp->peercert = NULL;
2044 }
2045
2046return 0;
2047}
2048
2049#endif
44662487
JH
2050
2051
f20cfa4a
JH
2052static gstring *
2053ddump(gnutls_datum_t * d)
2054{
2055gstring * g = string_get((d->size+1) * 2);
2056uschar * s = d->data;
2057for (unsigned i = d->size; i > 0; i--, s++)
2058 {
2059 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2060 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2061 }
2062return g;
2063}
17c76198 2064
dc6d1769
JH
2065static void
2066post_handshake_debug(exim_gnutls_state_st * state)
2067{
2068debug_printf("gnutls_handshake was successful\n");
2069#ifdef SUPPORT_GNUTLS_SESS_DESC
2070debug_printf("%s\n", gnutls_session_get_desc(state->session));
2071#endif
2072#ifdef SUPPORT_GNUTLS_KEYLOG
a8af957d 2073# ifdef GNUTLS_TLS1_3
dc6d1769 2074if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
a8af957d
JH
2075#else
2076if (TRUE)
2077#endif
dc6d1769
JH
2078 {
2079 gnutls_datum_t c, s;
2080 gstring * gc, * gs;
2081 /* we only want the client random and the master secret */
2082 gnutls_session_get_random(state->session, &c, &s);
2083 gnutls_session_get_master_secret(state->session, &s);
2084 gc = ddump(&c);
2085 gs = ddump(&s);
2086 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2087 }
2088else
2089 debug_printf("To get keying info for TLS1.3 is hard:\n"
2090 " set environment variable SSLKEYLOGFILE to a filename writable by uid exim\n"
2091 " add SSLKEYLOGFILE to keep_environment in the exim config\n"
2092 " run exim as root\n"
2093 " if using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n");
2094#endif
2095}
2096
17c76198
PP
2097/* ------------------------------------------------------------------------ */
2098/* Exported functions */
2099
2100
2101
2102
059ec3d9
PH
2103/*************************************************
2104* Start a TLS session in a server *
2105*************************************************/
2106
2107/* This is called when Exim is running as a server, after having received
2108the STARTTLS command. It must respond to that command, and then negotiate
2109a TLS session.
2110
2111Arguments:
83da1223 2112 require_ciphers list of allowed ciphers or NULL
cf0c6164 2113 errstr pointer to error string
059ec3d9
PH
2114
2115Returns: OK on success
2116 DEFER for errors before the start of the negotiation
4c04137d 2117 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
2118 continue running.
2119*/
2120
2121int
cf0c6164 2122tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
2123{
2124int rc;
cf0c6164 2125exim_gnutls_state_st * state = NULL;
059ec3d9
PH
2126
2127/* Check for previous activation */
74f1a423 2128if (tls_in.active.sock >= 0)
059ec3d9 2129 {
48224640 2130 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
925ac8e4 2131 smtp_printf("554 Already in TLS\r\n", FALSE);
059ec3d9
PH
2132 return FAIL;
2133 }
2134
2135/* Initialize the library. If it fails, it will already have logged the error
2136and sent an SMTP response. */
2137
17c76198 2138DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 2139
cf0c6164 2140if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
17c76198 2141 NULL, tls_verify_certificates, tls_crl,
74f1a423 2142 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
059ec3d9 2143
059ec3d9
PH
2144/* If this is a host for which certificate verification is mandatory or
2145optional, set up appropriately. */
2146
059ec3d9 2147if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 2148 {
e51c7be2
JH
2149 DEBUG(D_tls)
2150 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
2151 state->verify_requirement = VERIFY_REQUIRED;
2152 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2153 }
059ec3d9 2154else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 2155 {
e51c7be2
JH
2156 DEBUG(D_tls)
2157 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
2158 state->verify_requirement = VERIFY_OPTIONAL;
2159 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2160 }
2161else
2162 {
e51c7be2
JH
2163 DEBUG(D_tls)
2164 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
2165 state->verify_requirement = VERIFY_NONE;
2166 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2167 }
059ec3d9 2168
0cbf2b82 2169#ifndef DISABLE_EVENT
723fe533
JH
2170if (event_action)
2171 {
2172 state->event_action = event_action;
2173 gnutls_session_set_ptr(state->session, state);
2174 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2175 }
2176#endif
2177
17c76198
PP
2178/* Register SNI handling; always, even if not in tls_certificate, so that the
2179expansion variable $tls_sni is always available. */
059ec3d9 2180
17c76198
PP
2181gnutls_handshake_set_post_client_hello_function(state->session,
2182 exim_sni_handling_cb);
059ec3d9
PH
2183
2184/* Set context and tell client to go ahead, except in the case of TLS startup
2185on connection, where outputting anything now upsets the clients and tends to
2186make them disconnect. We need to have an explicit fflush() here, to force out
2187the response. Other smtp_printf() calls do not need it, because in non-TLS
2188mode, the fflush() happens when smtp_getc() is called. */
2189
817d9f57 2190if (!state->tlsp->on_connect)
059ec3d9 2191 {
925ac8e4 2192 smtp_printf("220 TLS go ahead\r\n", FALSE);
9d1c15ef 2193 fflush(smtp_out);
059ec3d9
PH
2194 }
2195
2196/* Now negotiate the TLS session. We put our own timer on it, since it seems
8008accd
JH
2197that the GnuTLS library doesn't.
2198From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2199to set (and clear down afterwards) up a pull-timeout callback function that does
2200a select, so we're no better off unless avoiding signals becomes an issue. */
059ec3d9 2201
17c76198 2202gnutls_transport_set_ptr2(state->session,
27f19eb4
JH
2203 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2204 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
17c76198
PP
2205state->fd_in = fileno(smtp_in);
2206state->fd_out = fileno(smtp_out);
059ec3d9
PH
2207
2208sigalrm_seen = FALSE;
c2a1bba0 2209if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
17c76198 2210do
17c76198 2211 rc = gnutls_handshake(state->session);
157a7880 2212while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2213ALARM_CLR(0);
059ec3d9 2214
17c76198 2215if (rc != GNUTLS_E_SUCCESS)
059ec3d9 2216 {
059ec3d9
PH
2217 /* It seems that, except in the case of a timeout, we have to close the
2218 connection right here; otherwise if the other end is running OpenSSL it hangs
2219 until the server times out. */
2220
60d10ce7 2221 if (sigalrm_seen)
ad7fc6eb 2222 {
48224640 2223 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
ad7fc6eb
JH
2224 gnutls_db_remove_session(state->session);
2225 }
60d10ce7 2226 else
059ec3d9 2227 {
452a164f 2228 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
f5d25c2b 2229 (void) gnutls_alert_send_appropriate(state->session, rc);
ad7fc6eb 2230 gnutls_deinit(state->session);
ed62aae3 2231 gnutls_certificate_free_credentials(state->x509_cred);
60d10ce7 2232 millisleep(500);
ad7fc6eb 2233 shutdown(state->fd_out, SHUT_WR);
d7978c0f 2234 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
f1e894f3
PH
2235 (void)fclose(smtp_out);
2236 (void)fclose(smtp_in);
60d10ce7 2237 smtp_out = smtp_in = NULL;
059ec3d9
PH
2238 }
2239
2240 return FAIL;
2241 }
2242
dc6d1769 2243DEBUG(D_tls) post_handshake_debug(state);
059ec3d9 2244
17c76198
PP
2245/* Verify after the fact */
2246
899b8bbc 2247if (!verify_certificate(state, errstr))
059ec3d9 2248 {
9d1c15ef 2249 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 2250 {
cf0c6164 2251 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
9d1c15ef 2252 return FAIL;
17c76198 2253 }
9d1c15ef
JH
2254 DEBUG(D_tls)
2255 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
cf0c6164 2256 *errstr);
059ec3d9
PH
2257 }
2258
17c76198
PP
2259/* Figure out peer DN, and if authenticated, etc. */
2260
cf0c6164 2261if ((rc = peer_status(state, NULL)) != OK) return rc;
17c76198
PP
2262
2263/* Sets various Exim expansion variables; always safe within server */
2264
9d1c15ef 2265extract_exim_vars_from_tls_state(state);
059ec3d9
PH
2266
2267/* TLS has been set up. Adjust the input functions to read via TLS,
2268and initialize appropriately. */
2269
17c76198 2270state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
2271
2272receive_getc = tls_getc;
0d81dabc 2273receive_getbuf = tls_getbuf;
584e96c6 2274receive_get_cache = tls_get_cache;
059ec3d9
PH
2275receive_ungetc = tls_ungetc;
2276receive_feof = tls_feof;
2277receive_ferror = tls_ferror;
58eb016e 2278receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2279
059ec3d9
PH
2280return OK;
2281}
2282
2283
2284
2285
aa2a70ba
JH
2286static void
2287tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2288 smtp_transport_options_block * ob)
2289{
3fb3231c 2290if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 2291 {
4af0d74a 2292 state->exp_tls_verify_cert_hostnames =
8c5d388a 2293#ifdef SUPPORT_I18N
4af0d74a
JH
2294 string_domain_utf8_to_alabel(host->name, NULL);
2295#else
2296 host->name;
2297#endif
aa2a70ba
JH
2298 DEBUG(D_tls)
2299 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2300 state->exp_tls_verify_cert_hostnames);
2301 }
2302}
aa2a70ba
JH
2303
2304
899b8bbc
JH
2305
2306
2307#ifdef SUPPORT_DANE
2308/* Given our list of RRs from the TLSA lookup, build a lookup block in
2309GnuTLS-DANE's preferred format. Hang it on the state str for later
2310use in DANE verification.
2311
2312We point at the dnsa data not copy it, so it must remain valid until
2313after verification is done.*/
2314
3674140c 2315static BOOL
899b8bbc
JH
2316dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2317{
899b8bbc
JH
2318dns_scan dnss;
2319int i;
2320const char ** dane_data;
2321int * dane_data_len;
2322
d7978c0f
JH
2323i = 1;
2324for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
899b8bbc
JH
2325 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2326 ) if (rr->type == T_TLSA) i++;
2327
2328dane_data = store_get(i * sizeof(uschar *));
2329dane_data_len = store_get(i * sizeof(int));
2330
d7978c0f
JH
2331i = 0;
2332for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
899b8bbc 2333 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1b76ad22 2334 ) if (rr->type == T_TLSA && rr->size > 3)
899b8bbc
JH
2335 {
2336 const uschar * p = rr->data;
3674140c
JH
2337 uint8_t usage = p[0], sel = p[1], type = p[2];
2338
2339 DEBUG(D_tls)
2340 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2341
94c13285
JH
2342 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2343 || (sel != 0 && sel != 1)
2344 )
2345 continue;
3674140c
JH
2346 switch(type)
2347 {
2348 case 0: /* Full: cannot check at present */
2349 break;
2350 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2351 break;
2352 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2353 break;
2354 default: continue;
2355 }
899b8bbc
JH
2356
2357 tls_out.tlsa_usage |= 1<<usage;
48224640 2358 dane_data[i] = CS p;
899b8bbc
JH
2359 dane_data_len[i++] = rr->size;
2360 }
3674140c
JH
2361
2362if (!i) return FALSE;
2363
899b8bbc
JH
2364dane_data[i] = NULL;
2365dane_data_len[i] = 0;
2366
2367state->dane_data = (char * const *)dane_data;
2368state->dane_data_len = dane_data_len;
3674140c 2369return TRUE;
899b8bbc
JH
2370}
2371#endif
2372
2373
2374
059ec3d9
PH
2375/*************************************************
2376* Start a TLS session in a client *
2377*************************************************/
2378
2379/* Called from the smtp transport after STARTTLS has been accepted.
2380
2381Arguments:
c05bdbd6
JH
2382 cctx connection context
2383 conn_args connection details
2384 cookie datum for randomness (not used)
2385 tlsp record details of channel configuration here; must be non-NULL
2386 errstr error string pointer
2387
2388Returns: TRUE for success with TLS session context set in smtp context,
2389 FALSE on error
059ec3d9
PH
2390*/
2391
c05bdbd6
JH
2392BOOL
2393tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2394 void * cookie ARG_UNUSED,
2395 tls_support * tlsp, uschar ** errstr)
059ec3d9 2396{
c05bdbd6
JH
2397host_item * host = conn_args->host; /* for msgs and option-tests */
2398transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
2399smtp_transport_options_block * ob = tb
afdb5e9c
JH
2400 ? (smtp_transport_options_block *)tb->options_block
2401 : &smtp_transport_option_defaults;
059ec3d9 2402int rc;
899b8bbc 2403exim_gnutls_state_st * state = NULL;
c05bdbd6 2404uschar * cipher_list = NULL;
74f1a423 2405
f2de3a33 2406#ifndef DISABLE_OCSP
5130845b 2407BOOL require_ocsp =
3fb3231c 2408 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
44662487 2409BOOL request_ocsp = require_ocsp ? TRUE
3fb3231c 2410 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2b4a568d 2411#endif
059ec3d9 2412
c05bdbd6 2413DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
059ec3d9 2414
5ec37a55 2415#ifdef SUPPORT_DANE
c05bdbd6
JH
2416/* If dane is flagged, have either request or require dane for this host, and
2417a TLSA record found. Therefore, dane verify required. Which implies cert must
2418be requested and supplied, dane verify must pass, and cert verify irrelevant
2419(incl. hostnames), and (caller handled) require_tls */
2420
2421if (conn_args->dane && ob->dane_require_tls_ciphers)
5ec37a55
PP
2422 {
2423 /* not using expand_check_tlsvar because not yet in state */
2424 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2425 &cipher_list, errstr))
c05bdbd6 2426 return FALSE;
cf260049
JH
2427 cipher_list = cipher_list && *cipher_list
2428 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
5ec37a55
PP
2429 }
2430#endif
2431
2432if (!cipher_list)
2433 cipher_list = ob->tls_require_ciphers;
2434
74f1a423 2435if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
65867078 2436 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
74f1a423 2437 cipher_list, &state, tlsp, errstr) != OK)
c05bdbd6 2438 return FALSE;
059ec3d9 2439
54c90be1 2440 {
65867078
JH
2441 int dh_min_bits = ob->tls_dh_min_bits;
2442 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2443 {
2444 DEBUG(D_tls)
2445 debug_printf("WARNING: tls_dh_min_bits far too low,"
2446 " clamping %d up to %d\n",
2447 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2448 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2449 }
54c90be1 2450
65867078
JH
2451 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2452 " acceptable bits to %d\n",
2453 dh_min_bits);
2454 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2455 }
83da1223 2456
94431adb 2457/* Stick to the old behaviour for compatibility if tls_verify_certificates is
2b4a568d
JH
2458set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2459the specified host patterns if one of them is defined */
2460
899b8bbc 2461#ifdef SUPPORT_DANE
c05bdbd6 2462if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
899b8bbc
JH
2463 {
2464 DEBUG(D_tls)
2465 debug_printf("TLS: server certificate DANE required.\n");
2466 state->verify_requirement = VERIFY_DANE;
2467 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
899b8bbc
JH
2468 }
2469else
2470#endif
2471 if ( ( state->exp_tls_verify_certificates
2472 && !ob->tls_verify_hosts
2473 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2474 )
3fb3231c 2475 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
899b8bbc 2476 )
17c76198 2477 {
aa2a70ba 2478 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
2479 DEBUG(D_tls)
2480 debug_printf("TLS: server certificate verification required.\n");
2481 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
2482 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2483 }
3fb3231c 2484else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
52f93eed 2485 {
aa2a70ba 2486 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
2487 DEBUG(D_tls)
2488 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 2489 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
2490 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2491 }
2492else
2493 {
e51c7be2
JH
2494 DEBUG(D_tls)
2495 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
2496 state->verify_requirement = VERIFY_NONE;
2497 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 2498 }
059ec3d9 2499
f2de3a33
JH
2500#ifndef DISABLE_OCSP
2501 /* supported since GnuTLS 3.1.3 */
44662487 2502if (request_ocsp)
9d1c15ef
JH
2503 {
2504 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
2505 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2506 NULL, 0, NULL)) != OK)
74f1a423 2507 {
452a164f 2508 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
c05bdbd6 2509 return FALSE;
74f1a423
JH
2510 }
2511 tlsp->ocsp = OCSP_NOT_RESP;
9d1c15ef 2512 }
2b4a568d
JH
2513#endif
2514
0cbf2b82 2515#ifndef DISABLE_EVENT
afdb5e9c 2516if (tb && tb->event_action)
a7538db1 2517 {
774ef2d7 2518 state->event_action = tb->event_action;
a7538db1 2519 gnutls_session_set_ptr(state->session, state);
723fe533 2520 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
2521 }
2522#endif
2523
c05bdbd6
JH
2524gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
2525state->fd_in = cctx->sock;
2526state->fd_out = cctx->sock;
059ec3d9 2527
9d1c15ef 2528DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
2529/* There doesn't seem to be a built-in timeout on connection. */
2530
2531sigalrm_seen = FALSE;
c2a1bba0 2532ALARM(ob->command_timeout);
17c76198 2533do
17c76198 2534 rc = gnutls_handshake(state->session);
f1fed05b 2535while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2536ALARM_CLR(0);
059ec3d9 2537
4fe99a6c 2538if (rc != GNUTLS_E_SUCCESS)
74f1a423 2539 {
60d10ce7
JH
2540 if (sigalrm_seen)
2541 {
2542 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
48224640 2543 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
60d10ce7
JH
2544 }
2545 else
452a164f 2546 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
c05bdbd6 2547 return FALSE;
74f1a423 2548 }
4fe99a6c 2549
dc6d1769 2550DEBUG(D_tls) post_handshake_debug(state);
059ec3d9 2551
17c76198 2552/* Verify late */
059ec3d9 2553
899b8bbc 2554if (!verify_certificate(state, errstr))
74f1a423
JH
2555 {
2556 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
c05bdbd6 2557 return FALSE;
74f1a423 2558 }
059ec3d9 2559
f2de3a33 2560#ifndef DISABLE_OCSP
2b4a568d
JH
2561if (require_ocsp)
2562 {
2563 DEBUG(D_tls)
2564 {
2565 gnutls_datum_t stapling;
2566 gnutls_ocsp_resp_t resp;
2567 gnutls_datum_t printed;
2568 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2569 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2570 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2571 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2572 )
2573 {
65867078 2574 debug_printf("%.4096s", printed.data);
2b4a568d
JH
2575 gnutls_free(printed.data);
2576 }
2577 else
452a164f 2578 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
2b4a568d
JH
2579 }
2580
2b4a568d 2581 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2 2582 {
74f1a423
JH
2583 tlsp->ocsp = OCSP_FAILED;
2584 tls_error(US"certificate status check failed", NULL, state->host, errstr);
c05bdbd6 2585 return FALSE;
018058b2 2586 }
2b4a568d 2587 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
74f1a423 2588 tlsp->ocsp = OCSP_VFIED;
2b4a568d
JH
2589 }
2590#endif
2591
17c76198 2592/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 2593
74f1a423 2594if (peer_status(state, errstr) != OK)
c05bdbd6 2595 return FALSE;
059ec3d9 2596
4fe99a6c 2597/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 2598
9d1c15ef 2599extract_exim_vars_from_tls_state(state);
059ec3d9 2600
c05bdbd6
JH
2601cctx->tls_ctx = state;
2602return TRUE;
059ec3d9
PH
2603}
2604
2605
2606
17c76198 2607
059ec3d9 2608/*************************************************
17c76198 2609* Close down a TLS session *
059ec3d9
PH
2610*************************************************/
2611
17c76198
PP
2612/* This is also called from within a delivery subprocess forked from the
2613daemon, to shut down the TLS library, without actually doing a shutdown (which
2614would tamper with the TLS session in the parent process).
059ec3d9 2615
dec766a1 2616Arguments:
74f1a423 2617 ct_ctx client context pointer, or NULL for the one global server context
dec766a1 2618 shutdown 1 if TLS close-alert is to be sent,
afdb5e9c 2619 2 if also response to be waited for
dec766a1 2620
17c76198 2621Returns: nothing
059ec3d9
PH
2622*/
2623
17c76198 2624void
74f1a423 2625tls_close(void * ct_ctx, int shutdown)
059ec3d9 2626{
74f1a423 2627exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
059ec3d9 2628
74f1a423 2629if (!state->tlsp || state->tlsp->active.sock < 0) return; /* TLS was not active */
17c76198
PP
2630
2631if (shutdown)
2632 {
dec766a1
WB
2633 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
2634 shutdown > 1 ? " (with response-wait)" : "");
2635
c2a1bba0 2636 ALARM(2);
dec766a1 2637 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
c2a1bba0 2638 ALARM_CLR(0);
17c76198
PP
2639 }
2640
2641gnutls_deinit(state->session);
ed62aae3
HSHR
2642gnutls_certificate_free_credentials(state->x509_cred);
2643
17c76198 2644
74f1a423
JH
2645state->tlsp->active.sock = -1;
2646state->tlsp->active.tls_ctx = NULL;
b808677c 2647if (state->xfer_buffer) store_free(state->xfer_buffer);
17c76198 2648memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
059ec3d9
PH
2649}
2650
2651
2652
17c76198 2653
0d81dabc
JH
2654static BOOL
2655tls_refill(unsigned lim)
2656{
2657exim_gnutls_state_st * state = &state_server;
2658ssize_t inbytes;
2659
2660DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2661 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2662
f1fed05b 2663sigalrm_seen = FALSE;
c2a1bba0 2664if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4896a319
AM
2665
2666do
2667 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2668 MIN(ssl_xfer_buffer_size, lim));
2669while (inbytes == GNUTLS_E_AGAIN);
2670
c2a1bba0 2671if (smtp_receive_timeout > 0) ALARM_CLR(0);
9723f966
JH
2672
2673if (had_command_timeout) /* set by signal handler */
2674 smtp_command_timeout_exit(); /* does not return */
2675if (had_command_sigterm)
2676 smtp_command_sigterm_exit();
2677if (had_data_timeout)
2678 smtp_data_timeout_exit();
2679if (had_data_sigint)
2680 smtp_data_sigint_exit();
2681
2682/* Timeouts do not get this far. A zero-byte return appears to mean that the
2683TLS session has been closed down, not that the socket itself has been closed
2684down. Revert to non-TLS handling. */
0d81dabc
JH
2685
2686if (sigalrm_seen)
2687 {
2688 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
8b77d27a 2689 state->xfer_error = TRUE;
0d81dabc
JH
2690 return FALSE;
2691 }
2692
2693else if (inbytes == 0)
2694 {
2695 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2696
2697 receive_getc = smtp_getc;
2698 receive_getbuf = smtp_getbuf;
2699 receive_get_cache = smtp_get_cache;
2700 receive_ungetc = smtp_ungetc;
2701 receive_feof = smtp_feof;
2702 receive_ferror = smtp_ferror;
2703 receive_smtp_buffered = smtp_buffered;
2704
2705 gnutls_deinit(state->session);
2706 gnutls_certificate_free_credentials(state->x509_cred);
2707
2708 state->session = NULL;
74f1a423
JH
2709 state->tlsp->active.sock = -1;
2710 state->tlsp->active.tls_ctx = NULL;
0d81dabc
JH
2711 state->tlsp->bits = 0;
2712 state->tlsp->certificate_verified = FALSE;
2713 tls_channelbinding_b64 = NULL;
2714 state->tlsp->cipher = NULL;
2715 state->tlsp->peercert = NULL;
2716 state->tlsp->peerdn = NULL;
2717
2718 return FALSE;
2719 }
2720
2721/* Handle genuine errors */
2722
2723else if (inbytes < 0)
2724 {
95f52235 2725 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
0d81dabc 2726 record_io_error(state, (int) inbytes, US"recv", NULL);
8b77d27a 2727 state->xfer_error = TRUE;
0d81dabc
JH
2728 return FALSE;
2729 }
2730#ifndef DISABLE_DKIM
2731dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2732#endif
2733state->xfer_buffer_hwm = (int) inbytes;
2734state->xfer_buffer_lwm = 0;
2735return TRUE;
2736}
2737
059ec3d9
PH
2738/*************************************************
2739* TLS version of getc *
2740*************************************************/
2741
2742/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2743it refills the buffer via the GnuTLS reading function.
817d9f57 2744Only used by the server-side TLS.
059ec3d9 2745
17c76198
PP
2746This feeds DKIM and should be used for all message-body reads.
2747
aded2255 2748Arguments: lim Maximum amount to read/buffer
059ec3d9
PH
2749Returns: the next character or EOF
2750*/
2751
2752int
bd8fbe36 2753tls_getc(unsigned lim)
059ec3d9 2754{
0d81dabc 2755exim_gnutls_state_st * state = &state_server;
059ec3d9 2756
0d81dabc
JH
2757if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2758 if (!tls_refill(lim))
2759 return state->xfer_error ? EOF : smtp_getc(lim);
ed62aae3 2760
0d81dabc 2761/* Something in the buffer; return next uschar */
059ec3d9 2762
0d81dabc
JH
2763return state->xfer_buffer[state->xfer_buffer_lwm++];
2764}
059ec3d9 2765
0d81dabc
JH
2766uschar *
2767tls_getbuf(unsigned * len)
2768{
2769exim_gnutls_state_st * state = &state_server;
2770unsigned size;
2771uschar * buf;
059ec3d9 2772
0d81dabc
JH
2773if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2774 if (!tls_refill(*len))
059ec3d9 2775 {
0d81dabc
JH
2776 if (!state->xfer_error) return smtp_getbuf(len);
2777 *len = 0;
2778 return NULL;
059ec3d9 2779 }
059ec3d9 2780
0d81dabc
JH
2781if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
2782 size = *len;
2783buf = &state->xfer_buffer[state->xfer_buffer_lwm];
2784state->xfer_buffer_lwm += size;
2785*len = size;
2786return buf;
059ec3d9
PH
2787}
2788
0d81dabc 2789
584e96c6
JH
2790void
2791tls_get_cache()
2792{
9960d1e5 2793#ifndef DISABLE_DKIM
584e96c6
JH
2794exim_gnutls_state_st * state = &state_server;
2795int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2796if (n > 0)
2797 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
584e96c6 2798#endif
9960d1e5 2799}
584e96c6 2800
059ec3d9 2801
925ac8e4
JH
2802BOOL
2803tls_could_read(void)
2804{
2805return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
2806 || gnutls_record_check_pending(state_server.session) > 0;
2807}
2808
2809
059ec3d9 2810
17c76198 2811
059ec3d9
PH
2812/*************************************************
2813* Read bytes from TLS channel *
2814*************************************************/
2815
17c76198
PP
2816/* This does not feed DKIM, so if the caller uses this for reading message body,
2817then the caller must feed DKIM.
817d9f57 2818
059ec3d9 2819Arguments:
74f1a423 2820 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
2821 buff buffer of data
2822 len size of buffer
2823
2824Returns: the number of bytes read
afdb5e9c 2825 -1 after a failed read, including EOF
059ec3d9
PH
2826*/
2827
2828int
74f1a423 2829tls_read(void * ct_ctx, uschar *buff, size_t len)
059ec3d9 2830{
74f1a423 2831exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
17c76198 2832ssize_t inbytes;
059ec3d9 2833
17c76198
PP
2834if (len > INT_MAX)
2835 len = INT_MAX;
059ec3d9 2836
17c76198
PP
2837if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2838 DEBUG(D_tls)
2839 debug_printf("*** PROBABLY A BUG *** " \
2840 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2841 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2842
2843DEBUG(D_tls)
2844 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2845 state->session, buff, len);
2846
4896a319
AM
2847do
2848 inbytes = gnutls_record_recv(state->session, buff, len);
2849while (inbytes == GNUTLS_E_AGAIN);
2850
059ec3d9
PH
2851if (inbytes > 0) return inbytes;
2852if (inbytes == 0)
2853 {
2854 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2855 }
5fd28bb8 2856else
4896a319 2857 {
95f52235 2858 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
4896a319
AM
2859 record_io_error(state, (int)inbytes, US"recv", NULL);
2860 }
059ec3d9
PH
2861
2862return -1;
2863}
2864
2865
2866
17c76198 2867
059ec3d9
PH
2868/*************************************************
2869* Write bytes down TLS channel *
2870*************************************************/
2871
2872/*
2873Arguments:
74f1a423 2874 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
2875 buff buffer of data
2876 len number of bytes
925ac8e4 2877 more more data expected soon
059ec3d9
PH
2878
2879Returns: the number of bytes after a successful write,
2880 -1 after a failed write
2881*/
2882
2883int
74f1a423 2884tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
059ec3d9 2885{
17c76198
PP
2886ssize_t outbytes;
2887size_t left = len;
74f1a423 2888exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
925ac8e4
JH
2889#ifdef SUPPORT_CORK
2890static BOOL corked = FALSE;
2891
2892if (more && !corked) gnutls_record_cork(state->session);
2893#endif
2894
2895DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
2896 buff, left, more ? ", more" : "");
059ec3d9 2897
059ec3d9
PH
2898while (left > 0)
2899 {
17c76198
PP
2900 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2901 buff, left);
4896a319
AM
2902
2903 do
2904 outbytes = gnutls_record_send(state->session, buff, left);
2905 while (outbytes == GNUTLS_E_AGAIN);
059ec3d9 2906
17c76198 2907 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
2908 if (outbytes < 0)
2909 {
1b76ad22 2910 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
17c76198 2911 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
2912 return -1;
2913 }
2914 if (outbytes == 0)
2915 {
17c76198 2916 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
2917 return -1;
2918 }
2919
2920 left -= outbytes;
2921 buff += outbytes;
2922 }
2923
17c76198
PP
2924if (len > INT_MAX)
2925 {
2926 DEBUG(D_tls)
2927 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2928 len);
2929 len = INT_MAX;
2930 }
2931
925ac8e4
JH
2932#ifdef SUPPORT_CORK
2933if (more != corked)
2934 {
2935 if (!more) (void) gnutls_record_uncork(state->session, 0);
2936 corked = more;
2937 }
2938#endif
2939
17c76198 2940return (int) len;
059ec3d9
PH
2941}
2942
2943
2944
17c76198 2945
059ec3d9 2946/*************************************************
17c76198 2947* Random number generation *
059ec3d9
PH
2948*************************************************/
2949
17c76198
PP
2950/* Pseudo-random number generation. The result is not expected to be
2951cryptographically strong but not so weak that someone will shoot themselves
2952in the foot using it as a nonce in input in some email header scheme or
2953whatever weirdness they'll twist this into. The result should handle fork()
2954and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 2955
17c76198
PP
2956Arguments:
2957 max range maximum
2958Returns a random number in range [0, max-1]
059ec3d9
PH
2959*/
2960
af3498d6 2961#ifdef HAVE_GNUTLS_RND
17c76198
PP
2962int
2963vaguely_random_number(int max)
059ec3d9 2964{
17c76198
PP
2965unsigned int r;
2966int i, needed_len;
17c76198
PP
2967uschar smallbuf[sizeof(r)];
2968
2969if (max <= 1)
2970 return 0;
2971
2972needed_len = sizeof(r);
2973/* Don't take 8 times more entropy than needed if int is 8 octets and we were
d7978c0f
JH
2974asked for a number less than 10. */
2975
17c76198
PP
2976for (r = max, i = 0; r; ++i)
2977 r >>= 1;
2978i = (i + 7) / 8;
2979if (i < needed_len)
2980 needed_len = i;
2981
2982i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2983if (i < 0)
059ec3d9 2984 {
17c76198
PP
2985 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2986 return vaguely_random_number_fallback(max);
2987 }
2988r = 0;
d7978c0f
JH
2989for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
2990 r = r * 256 + *p;
059ec3d9 2991
17c76198
PP
2992/* We don't particularly care about weighted results; if someone wants
2993 * smooth distribution and cares enough then they should submit a patch then. */
2994return r % max;
059ec3d9 2995}
af3498d6
PP
2996#else /* HAVE_GNUTLS_RND */
2997int
2998vaguely_random_number(int max)
2999{
3000 return vaguely_random_number_fallback(max);
3001}
3002#endif /* HAVE_GNUTLS_RND */
059ec3d9 3003
36f12725
NM
3004
3005
3006
3007/*************************************************
3375e053
PP
3008* Let tls_require_ciphers be checked at startup *
3009*************************************************/
3010
3011/* The tls_require_ciphers option, if set, must be something which the
3012library can parse.
3013
3014Returns: NULL on success, or error message
3015*/
3016
3017uschar *
3018tls_validate_require_cipher(void)
3019{
3020int rc;
3021uschar *expciphers = NULL;
3022gnutls_priority_t priority_cache;
3023const char *errpos;
cf0c6164 3024uschar * dummy_errstr;
3375e053
PP
3025
3026#define validate_check_rc(Label) do { \
3027 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
3028 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
3029#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
3030
3031if (exim_gnutls_base_init_done)
3032 log_write(0, LOG_MAIN|LOG_PANIC,
3033 "already initialised GnuTLS, Exim developer bug");
3034
a5f239e4 3035#ifdef HAVE_GNUTLS_PKCS11
2519e60d 3036if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
3037 {
3038 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
3039 validate_check_rc(US"gnutls_pkcs11_init");
3040 }
3041#endif
3375e053
PP
3042rc = gnutls_global_init();
3043validate_check_rc(US"gnutls_global_init()");
3044exim_gnutls_base_init_done = TRUE;
3045
3046if (!(tls_require_ciphers && *tls_require_ciphers))
3047 return_deinit(NULL);
3048
cf0c6164
JH
3049if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
3050 &dummy_errstr))
3375e053
PP
3051 return_deinit(US"failed to expand tls_require_ciphers");
3052
3053if (!(expciphers && *expciphers))
3054 return_deinit(NULL);
3055
3056DEBUG(D_tls)
3057 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
3058
3059rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
3060validate_check_rc(string_sprintf(
3061 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
3062 expciphers, errpos - CS expciphers, errpos));
3063
3064#undef return_deinit
3065#undef validate_check_rc
3066gnutls_global_deinit();
3067
3068return NULL;
3069}
3070
3071
3072
3073
3074/*************************************************
36f12725
NM
3075* Report the library versions. *
3076*************************************************/
3077
3078/* See a description in tls-openssl.c for an explanation of why this exists.
3079
3080Arguments: a FILE* to print the results to
3081Returns: nothing
3082*/
3083
3084void
3085tls_version_report(FILE *f)
3086{
754a0503
PP
3087fprintf(f, "Library version: GnuTLS: Compile: %s\n"
3088 " Runtime: %s\n",
3089 LIBGNUTLS_VERSION,
3090 gnutls_check_version(NULL));
36f12725
NM
3091}
3092
2b4a568d
JH
3093/* vi: aw ai sw=2
3094*/
059ec3d9 3095/* End of tls-gnu.c */