GnuTLS control constants exposed to Makefile.
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
17c76198 5/* Copyright (c) University of Cambridge 1995 - 2012 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
16Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
059ec3d9 42
17c76198 43/* GnuTLS 2 vs 3
059ec3d9 44
17c76198
PP
45GnuTLS 3 only:
46 gnutls_global_set_audit_log_function()
059ec3d9 47
17c76198
PP
48Changes:
49 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
50*/
059ec3d9 51
17c76198 52/* Local static variables for GnuTLS */
059ec3d9 53
17c76198 54/* Values for verify_requirement */
059ec3d9 55
17c76198 56enum peer_verify_requirement { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
059ec3d9 57
17c76198
PP
58/* This holds most state for server or client; with this, we can set up an
59outbound TLS-enabled connection in an ACL callout, while not stomping all
60over the TLS variables available for expansion.
059ec3d9 61
17c76198
PP
62Some of these correspond to variables in globals.c; those variables will
63be set to point to content in one of these instances, as appropriate for
64the stage of the process lifetime.
059ec3d9 65
17c76198
PP
66Not handled here: globals tls_active, tls_bits, tls_cipher, tls_peerdn,
67tls_certificate_verified, tls_channelbinding_b64, tls_sni.
68*/
059ec3d9 69
17c76198
PP
70typedef struct exim_gnutls_state {
71 gnutls_session_t session;
72 gnutls_certificate_credentials_t x509_cred;
73 gnutls_priority_t priority_cache;
74 enum peer_verify_requirement verify_requirement;
75 int fd_in;
76 int fd_out;
77 BOOL peer_cert_verified;
78 BOOL trigger_sni_changes;
79 const struct host_item *host;
80 uschar *peerdn;
81 uschar *received_sni;
82
83 const uschar *tls_certificate;
84 const uschar *tls_privatekey;
85 const uschar *tls_sni; /* client send only, not received */
86 const uschar *tls_verify_certificates;
87 const uschar *tls_crl;
88 const uschar *tls_require_ciphers;
89 uschar *exp_tls_certificate;
90 uschar *exp_tls_privatekey;
91 uschar *exp_tls_sni;
92 uschar *exp_tls_verify_certificates;
93 uschar *exp_tls_crl;
94 uschar *exp_tls_require_ciphers;
95
96 uschar *xfer_buffer;
97 int xfer_buffer_lwm;
98 int xfer_buffer_hwm;
99 int xfer_eof;
100 int xfer_error;
101
102 uschar cipherbuf[256];
103} exim_gnutls_state_st;
104
105static const exim_gnutls_state_st exim_gnutls_state_init = {
106 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE,
107 NULL, NULL, NULL,
108 NULL, NULL, NULL, NULL, NULL, NULL,
109 NULL, NULL, NULL, NULL, NULL, NULL,
110 NULL, 0, 0, 0, 0,
111 ""
112};
83da1223 113
17c76198
PP
114/* Not only do we have our own APIs which don't pass around state, assuming
115it's held in globals, GnuTLS doesn't appear to let us register callback data
116for callbacks, or as part of the session, so we have to keep a "this is the
117context we're currently dealing with" pointer and rely upon being
118single-threaded to keep from processing data on an inbound TLS connection while
119talking to another TLS connection for an outbound check. This does mean that
120there's no way for heart-beats to be responded to, for the duration of the
121second connection. */
059ec3d9 122
17c76198
PP
123static exim_gnutls_state_st state_server, state_client;
124static exim_gnutls_state_st *current_global_tls_state;
059ec3d9 125
17c76198
PP
126/* dh_params are initialised once within the lifetime of a process using TLS;
127if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
128don't want to repeat this. */
83da1223 129
17c76198 130static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 131
17c76198 132/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 133
17c76198 134static const int ssl_session_timeout = 200;
059ec3d9 135
17c76198 136static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 137
17c76198 138/* Guard library core initialisation */
83da1223 139
17c76198 140static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 141
059ec3d9 142
17c76198 143/* ------------------------------------------------------------------------ */
17c76198 144/* macros */
83da1223 145
17c76198 146#define MAX_HOST_LEN 255
83da1223 147
17c76198
PP
148/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
149the library logging; a value less than 0 disables the calls to set up logging
150callbacks. */
2c17bb02 151#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
17c76198 152#define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 153#endif
83da1223 154
2c17bb02 155#ifndef EXIM_CLIENT_DH_MIN_BITS
17c76198 156#define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 157#endif
83da1223 158
af3498d6
PP
159/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
160can ask for a bit-strength. Without that, we stick to the constant we had
161before, for now. */
2c17bb02 162#ifndef EXIM_SERVER_DH_BITS_PRE2_12
af3498d6 163#define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 164#endif
af3498d6 165
17c76198
PP
166#define exim_gnutls_err_check(Label) do { \
167 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
059ec3d9 168
17c76198 169#define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
83da1223 170
17c76198
PP
171#if GNUTLS_VERSION_NUMBER >= 0x020c00
172#define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
af3498d6
PP
173#define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
174#define HAVE_GNUTLS_RND
17c76198 175#endif
83da1223 176
af3498d6
PP
177
178
179
180/* ------------------------------------------------------------------------ */
181/* Callback declarations */
182
183#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
184static void exim_gnutls_logger_cb(int level, const char *message);
185#endif
186
187static int exim_sni_handling_cb(gnutls_session_t session);
188
189
190
191
17c76198
PP
192/* ------------------------------------------------------------------------ */
193/* Static functions */
059ec3d9
PH
194
195/*************************************************
196* Handle TLS error *
197*************************************************/
198
199/* Called from lots of places when errors occur before actually starting to do
200the TLS handshake, that is, while the session is still in clear. Always returns
201DEFER for a server and FAIL for a client so that most calls can use "return
202tls_error(...)" to do this processing and then give an appropriate return. A
203single function is used for both server and client, because it is called from
204some shared functions.
205
206Argument:
207 prefix text to include in the logged error
7199e1ee
TF
208 msg additional error string (may be NULL)
209 usually obtained from gnutls_strerror()
17c76198
PP
210 host NULL if setting up a server;
211 the connected host if setting up a client
059ec3d9
PH
212
213Returns: OK/DEFER/FAIL
214*/
215
216static int
17c76198 217tls_error(const uschar *prefix, const char *msg, const host_item *host)
059ec3d9 218{
17c76198
PP
219if (host)
220 {
221 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
222 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
223 return FAIL;
224 }
225else
059ec3d9 226 {
7199e1ee 227 uschar *conn_info = smtp_get_connection_info();
17c76198 228 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee
TF
229 conn_info += 5;
230 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
17c76198 231 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
059ec3d9
PH
232 return DEFER;
233 }
059ec3d9
PH
234}
235
236
237
17c76198 238
059ec3d9 239/*************************************************
17c76198 240* Deal with logging errors during I/O *
059ec3d9
PH
241*************************************************/
242
17c76198 243/* We have to get the identity of the peer from saved data.
059ec3d9 244
17c76198
PP
245Argument:
246 state the current GnuTLS exim state container
247 rc the GnuTLS error code, or 0 if it's a local error
248 when text identifying read or write
249 text local error text when ec is 0
059ec3d9 250
17c76198 251Returns: nothing
059ec3d9
PH
252*/
253
17c76198
PP
254static void
255record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 256{
17c76198 257const char *msg;
059ec3d9 258
17c76198
PP
259if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
260 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
261 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
262else
263 msg = gnutls_strerror(rc);
059ec3d9 264
17c76198
PP
265tls_error(when, msg, state->host);
266}
059ec3d9 267
059ec3d9 268
059ec3d9 269
059ec3d9 270
17c76198
PP
271/*************************************************
272* Set various Exim expansion vars *
273*************************************************/
059ec3d9 274
17c76198
PP
275/* We set various Exim global variables from the state, once a session has
276been established. With TLS callouts, may need to change this to stack
277variables, or just re-call it with the server state after client callout
278has finished.
059ec3d9 279
17c76198
PP
280Make sure anything set here is inset in tls_getc().
281
282Sets:
283 tls_active fd
284 tls_bits strength indicator
285 tls_certificate_verified bool indicator
286 tls_channelbinding_b64 for some SASL mechanisms
287 tls_cipher a string
288 tls_peerdn a string
289 tls_sni a (UTF-8) string
290Also:
291 current_global_tls_state for API limitations
292
293Argument:
294 state the relevant exim_gnutls_state_st *
295*/
296
297static void
298extract_exim_vars_from_tls_state(exim_gnutls_state_st *state)
299{
300gnutls_protocol_t protocol;
301gnutls_cipher_algorithm_t cipher;
302gnutls_kx_algorithm_t kx;
303gnutls_mac_algorithm_t mac;
304uschar *p;
305#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
306int old_pool;
307int rc;
308gnutls_datum_t channel;
309#endif
310
311current_global_tls_state = state;
312
313tls_active = state->fd_out;
314
315cipher = gnutls_cipher_get(state->session);
316/* returns size in "bytes" */
317tls_bits = gnutls_cipher_get_key_size(cipher) * 8;
318
319if (!*state->cipherbuf)
059ec3d9 320 {
17c76198
PP
321 protocol = gnutls_protocol_get_version(state->session);
322 mac = gnutls_mac_get(state->session);
323 kx = gnutls_kx_get(state->session);
324
325 string_format(state->cipherbuf, sizeof(state->cipherbuf),
326 "%s:%s:%u",
327 gnutls_protocol_get_name(protocol),
328 gnutls_cipher_suite_get_name(kx, cipher, mac),
329 tls_bits);
330
331 /* I don't see a way that spaces could occur, in the current GnuTLS
332 code base, but it was a concern in the old code and perhaps older GnuTLS
333 releases did return "TLS 1.0"; play it safe, just in case. */
334 for (p = state->cipherbuf; *p != '\0'; ++p)
335 if (isspace(*p))
336 *p = '-';
059ec3d9 337 }
17c76198
PP
338tls_cipher = state->cipherbuf;
339
340DEBUG(D_tls) debug_printf("cipher: %s\n", tls_cipher);
341
342tls_certificate_verified = state->peer_cert_verified;
059ec3d9 343
17c76198
PP
344/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
345only available for use for authenticators while this TLS session is running. */
346
347tls_channelbinding_b64 = NULL;
348#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
349channel.data = NULL;
350channel.size = 0;
351rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
352if (rc) {
353 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
354} else {
355 old_pool = store_pool;
356 store_pool = POOL_PERM;
357 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
358 store_pool = old_pool;
359 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
360}
361#endif
362
363tls_peerdn = state->peerdn;
364
365tls_sni = state->received_sni;
059ec3d9
PH
366}
367
368
369
17c76198 370
059ec3d9 371/*************************************************
575643cd 372* Setup up DH parameters *
059ec3d9
PH
373*************************************************/
374
575643cd 375/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
376be re-generated every so often, depending on security policy. What we do is to
377keep these parameters in a file in the spool directory. If the file does not
378exist, we generate them. This means that it is easy to cause a regeneration.
379
380The new file is written as a temporary file and renamed, so that an incomplete
381file is never present. If two processes both compute some new parameters, you
382waste a bit of effort, but it doesn't seem worth messing around with locking to
383prevent this.
384
385Argument:
386 host NULL for server, server for client (for error handling)
387
388Returns: OK/DEFER/FAIL
389*/
390
391static int
17c76198 392init_server_dh(void)
059ec3d9 393{
17c76198
PP
394int fd, rc;
395unsigned int dh_bits;
b5aea5e1 396gnutls_datum m;
17c76198
PP
397uschar filename[PATH_MAX];
398size_t sz;
399host_item *host = NULL; /* dummy for macros */
059ec3d9 400
17c76198 401DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 402
17c76198
PP
403rc = gnutls_dh_params_init(&dh_server_params);
404exim_gnutls_err_check(US"gnutls_dh_params_init");
059ec3d9 405
af3498d6
PP
406#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
407/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
408different filename and ensure we have sufficient bits. */
409dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
410if (!dh_bits)
411 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
af3498d6 412DEBUG(D_tls)
b34fc30c 413 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
414 dh_bits);
415#else
416dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
417DEBUG(D_tls)
418 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
419 dh_bits);
420#endif
059ec3d9 421
17c76198 422if (!string_format(filename, sizeof(filename),
af3498d6 423 "%s/gnutls-params-%d", spool_directory, dh_bits))
17c76198 424 return tls_error(US"overlong filename", NULL, NULL);
059ec3d9 425
b5aea5e1 426/* Open the cache file for reading and if successful, read it and set up the
575643cd 427parameters. */
059ec3d9
PH
428
429fd = Uopen(filename, O_RDONLY, 0);
b5aea5e1 430if (fd >= 0)
059ec3d9 431 {
b5aea5e1 432 struct stat statbuf;
17c76198
PP
433 FILE *fp;
434 int saved_errno;
435
436 if (fstat(fd, &statbuf) < 0) /* EIO */
437 {
438 saved_errno = errno;
439 (void)close(fd);
440 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
441 }
442 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
443 {
444 (void)close(fd);
17c76198
PP
445 return tls_error(US"TLS cache not a file", NULL, NULL);
446 }
447 fp = fdopen(fd, "rb");
448 if (!fp)
449 {
450 saved_errno = errno;
451 (void)close(fd);
452 return tls_error(US"fdopen(TLS cache stat fd) failed",
453 strerror(saved_errno), NULL);
b5aea5e1 454 }
059ec3d9 455
b5aea5e1
PH
456 m.size = statbuf.st_size;
457 m.data = malloc(m.size);
458 if (m.data == NULL)
17c76198
PP
459 {
460 fclose(fp);
461 return tls_error(US"malloc failed", strerror(errno), NULL);
462 }
463 sz = fread(m.data, m.size, 1, fp);
464 if (!sz)
465 {
466 saved_errno = errno;
467 fclose(fp);
468 free(m.data);
469 return tls_error(US"fread failed", strerror(saved_errno), NULL);
470 }
471 fclose(fp);
b5aea5e1 472
17c76198 473 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 474 free(m.data);
17c76198
PP
475 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
476 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
477 }
478
479/* If the file does not exist, fall through to compute new data and cache it.
480If there was any other opening error, it is serious. */
481
182ad5cf
PH
482else if (errno == ENOENT)
483 {
17c76198 484 rc = -1;
182ad5cf 485 DEBUG(D_tls)
17c76198 486 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
487 }
488else
17c76198
PP
489 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
490 NULL, NULL);
b5aea5e1
PH
491
492/* If ret < 0, either the cache file does not exist, or the data it contains
493is not useful. One particular case of this is when upgrading from an older
494release of Exim in which the data was stored in a different format. We don't
495try to be clever and support both formats; we just regenerate new data in this
496case. */
497
17c76198 498if (rc < 0)
b5aea5e1 499 {
17c76198 500 uschar *temp_fn;
059ec3d9 501
17c76198
PP
502 if ((PATH_MAX - Ustrlen(filename)) < 10)
503 return tls_error(US"Filename too long to generate replacement",
504 CS filename, NULL);
059ec3d9 505
17c76198
PP
506 temp_fn = string_copy(US "%s.XXXXXXX");
507 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
059ec3d9 508 if (fd < 0)
17c76198 509 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
059ec3d9
PH
510 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
511
17c76198
PP
512 DEBUG(D_tls) debug_printf("generating %d bits Diffie-Hellman key ...\n", dh_bits);
513 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits);
514 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
515
516 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
517 and I confirmed that a NULL call to get the size first is how the GnuTLS
518 sample apps handle this. */
519
520 sz = 0;
521 m.data = NULL;
522 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
523 m.data, &sz);
524 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
525 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
526 m.size = sz;
b5aea5e1
PH
527 m.data = malloc(m.size);
528 if (m.data == NULL)
17c76198
PP
529 return tls_error(US"memory allocation failed", strerror(errno), NULL);
530 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
531 m.data, &sz);
532 if (rc != GNUTLS_E_SUCCESS)
533 {
534 free(m.data);
535 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
536 }
059ec3d9 537
17c76198
PP
538 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
539 if (sz != m.size)
540 {
541 free(m.data);
542 return tls_error(US"TLS cache write D-H params failed",
543 strerror(errno), NULL);
544 }
b5aea5e1 545 free(m.data);
17c76198
PP
546 sz = write_to_fd_buf(fd, US"\n", 1);
547 if (sz != 1)
548 return tls_error(US"TLS cache write D-H params final newline failed",
549 strerror(errno), NULL);
550
551 rc = close(fd);
552 if (rc)
553 return tls_error(US"TLS cache write close() failed",
554 strerror(errno), NULL);
059ec3d9 555
17c76198
PP
556 if (Urename(temp_fn, filename) < 0)
557 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
558 temp_fn, filename), strerror(errno), NULL);
059ec3d9 559
17c76198 560 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
561 }
562
17c76198 563DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
564return OK;
565}
566
567
568
569
570/*************************************************
17c76198 571* Variables re-expanded post-SNI *
059ec3d9
PH
572*************************************************/
573
17c76198
PP
574/* Called from both server and client code, via tls_init(), and also from
575the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
576
577We can tell the two apart by state->received_sni being non-NULL in callback.
578
579The callback should not call us unless state->trigger_sni_changes is true,
580which we are responsible for setting on the first pass through.
059ec3d9
PH
581
582Arguments:
17c76198 583 state exim_gnutls_state_st *
059ec3d9
PH
584
585Returns: OK/DEFER/FAIL
586*/
587
588static int
17c76198 589tls_expand_session_files(exim_gnutls_state_st *state)
059ec3d9 590{
1365611d 591struct stat statbuf;
059ec3d9 592int rc;
17c76198
PP
593const host_item *host = state->host; /* macro should be reconsidered? */
594uschar *saved_tls_certificate = NULL;
595uschar *saved_tls_privatekey = NULL;
596uschar *saved_tls_verify_certificates = NULL;
597uschar *saved_tls_crl = NULL;
598int cert_count;
599
600/* We check for tls_sni *before* expansion. */
601if (!state->host)
602 {
603 if (!state->received_sni)
604 {
605 if (Ustrstr(state->tls_certificate, US"tls_sni"))
606 {
607 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
608 state->trigger_sni_changes = TRUE;
609 }
610 }
611 else
612 {
1365611d 613 /* useful for debugging */
17c76198
PP
614 saved_tls_certificate = state->exp_tls_certificate;
615 saved_tls_privatekey = state->exp_tls_privatekey;
616 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
617 saved_tls_crl = state->exp_tls_crl;
618 }
619 }
059ec3d9 620
1365611d
PP
621rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
622exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
623
17c76198
PP
624/* remember: expand_check_tlsvar() is expand_check() but fiddling with
625state members, assuming consistent naming; and expand_check() returns
626false if expansion failed, unless expansion was forced to fail. */
059ec3d9 627
17c76198
PP
628/* check if we at least have a certificate, before doing expensive
629D-H generation. */
059ec3d9 630
17c76198
PP
631if (!expand_check_tlsvar(tls_certificate))
632 return DEFER;
059ec3d9 633
17c76198 634/* certificate is mandatory in server, optional in client */
059ec3d9 635
17c76198
PP
636if ((state->exp_tls_certificate == NULL) ||
637 (*state->exp_tls_certificate == '\0'))
638 {
639 if (state->host == NULL)
640 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
641 else
642 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
643 }
059ec3d9 644
17c76198 645if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
059ec3d9
PH
646 return DEFER;
647
17c76198
PP
648/* tls_privatekey is optional, defaulting to same file as certificate */
649
650if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 651 {
17c76198
PP
652 state->tls_privatekey = state->tls_certificate;
653 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 654 }
c91535f3 655
059ec3d9 656
17c76198 657if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
658 {
659 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
660 state->exp_tls_certificate, state->exp_tls_privatekey);
661
662 if (state->received_sni)
de365ded 663 {
17c76198
PP
664 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
665 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
666 {
b34fc30c 667 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
668 }
669 else
670 {
b34fc30c 671 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 672 }
8e669ac1 673 }
059ec3d9 674
1365611d
PP
675 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
676 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
677 GNUTLS_X509_FMT_PEM);
678 exim_gnutls_err_check(
679 string_sprintf("cert/key setup: cert=%s key=%s",
680 state->exp_tls_certificate, state->exp_tls_privatekey));
681 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
b34fc30c 682 } /* tls_certificate */
059ec3d9
PH
683
684/* Set the trusted CAs file if one is provided, and then add the CRL if one is
685provided. Experiment shows that, if the certificate file is empty, an unhelpful
686error message is provided. However, if we just refrain from setting anything up
687in that case, certificate verification fails, which seems to be the correct
688behaviour. */
689
17c76198 690if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 691 {
17c76198 692 if (!expand_check_tlsvar(tls_verify_certificates))
059ec3d9 693 return DEFER;
17c76198
PP
694 if (state->tls_crl && *state->tls_crl)
695 if (!expand_check_tlsvar(tls_crl))
696 return DEFER;
059ec3d9 697
1365611d
PP
698 if (!(state->exp_tls_verify_certificates &&
699 *state->exp_tls_verify_certificates))
b34fc30c
PP
700 {
701 DEBUG(D_tls)
1365611d
PP
702 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
703 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 704 return OK;
b34fc30c 705 }
1365611d 706 }
83e2f8a2
PP
707else
708 {
709 DEBUG(D_tls)
710 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
711 return OK;
712 }
17c76198 713
1365611d
PP
714if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
715 {
716 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
717 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
718 strerror(errno));
719 return DEFER;
720 }
17c76198 721
1365611d
PP
722if (!S_ISREG(statbuf.st_mode))
723 {
724 DEBUG(D_tls)
725 debug_printf("verify certificates path is not a file: \"%s\"\n%s\n",
726 state->exp_tls_verify_certificates,
727 S_ISDIR(statbuf.st_mode)
728 ? " it's a directory, that's OpenSSL, this is GnuTLS"
729 : " (not a directory either)");
730 log_write(0, LOG_MAIN|LOG_PANIC,
731 "tls_verify_certificates \"%s\" is not a file",
732 state->exp_tls_verify_certificates);
733 return DEFER;
734 }
059ec3d9 735
1365611d
PP
736DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
737 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 738
1365611d
PP
739if (statbuf.st_size == 0)
740 {
741 DEBUG(D_tls)
742 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
743 return OK;
744 }
059ec3d9 745
1365611d
PP
746cert_count = gnutls_certificate_set_x509_trust_file(state->x509_cred,
747 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
748if (cert_count < 0)
749 {
750 rc = cert_count;
751 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
752 }
753DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 754
1365611d
PP
755if (state->tls_crl && *state->tls_crl)
756 {
757 if (state->exp_tls_crl && *state->exp_tls_crl)
758 {
759 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
760 rc = gnutls_certificate_set_x509_crl_file(state->x509_cred,
761 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
762 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
763 }
764 }
059ec3d9 765
059ec3d9
PH
766return OK;
767}
768
769
770
771
772/*************************************************
1365611d
PP
773* Set X.509 state variables *
774*************************************************/
775
776/* In GnuTLS, the registered cert/key are not replaced by a later
777set of a cert/key, so for SNI support we need a whole new x509_cred
778structure. Which means various other non-re-expanded pieces of state
779need to be re-set in the new struct, so the setting logic is pulled
780out to this.
781
782Arguments:
783 state exim_gnutls_state_st *
784
785Returns: OK/DEFER/FAIL
786*/
787
788static int
789tls_set_remaining_x509(exim_gnutls_state_st *state)
790{
791int rc;
792const host_item *host = state->host; /* macro should be reconsidered? */
793
794/* Create D-H parameters, or read them from the cache file. This function does
795its own SMTP error messaging. This only happens for the server, TLS D-H ignores
796client-side params. */
797
798if (!state->host)
799 {
800 if (!dh_server_params)
801 {
802 rc = init_server_dh();
803 if (rc != OK) return rc;
804 }
805 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
806 }
807
808/* Link the credentials to the session. */
809
810rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
811exim_gnutls_err_check(US"gnutls_credentials_set");
812
813return OK;
814}
815
816/*************************************************
17c76198 817* Initialize for GnuTLS *
059ec3d9
PH
818*************************************************/
819
17c76198
PP
820/* Called from both server and client code. In the case of a server, errors
821before actual TLS negotiation return DEFER.
059ec3d9
PH
822
823Arguments:
17c76198
PP
824 host connected host, if client; NULL if server
825 certificate certificate file
826 privatekey private key file
827 sni TLS SNI to send, sometimes when client; else NULL
828 cas CA certs file
829 crl CRL file
830 require_ciphers tls_require_ciphers setting
059ec3d9 831
17c76198 832Returns: OK/DEFER/FAIL
059ec3d9
PH
833*/
834
17c76198
PP
835static int
836tls_init(
837 const host_item *host,
838 const uschar *certificate,
839 const uschar *privatekey,
840 const uschar *sni,
841 const uschar *cas,
842 const uschar *crl,
843 const uschar *require_ciphers,
844 exim_gnutls_state_st **caller_state)
059ec3d9 845{
17c76198
PP
846exim_gnutls_state_st *state;
847int rc;
848size_t sz;
849const char *errpos;
850uschar *p;
851BOOL want_default_priorities;
852
853if (!exim_gnutls_base_init_done)
059ec3d9 854 {
17c76198
PP
855 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
856
857 rc = gnutls_global_init();
858 exim_gnutls_err_check(US"gnutls_global_init");
859
860#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
861 DEBUG(D_tls)
059ec3d9 862 {
17c76198
PP
863 gnutls_global_set_log_function(exim_gnutls_logger_cb);
864 /* arbitrarily chosen level; bump upto 9 for more */
865 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 866 }
17c76198
PP
867#endif
868
869 exim_gnutls_base_init_done = TRUE;
059ec3d9 870 }
059ec3d9 871
17c76198
PP
872if (host)
873 {
874 state = &state_client;
875 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
876 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
877 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
878 }
879else
880 {
881 state = &state_server;
882 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
883 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
884 rc = gnutls_init(&state->session, GNUTLS_SERVER);
885 }
886exim_gnutls_err_check(US"gnutls_init");
059ec3d9 887
17c76198 888state->host = host;
059ec3d9 889
17c76198
PP
890state->tls_certificate = certificate;
891state->tls_privatekey = privatekey;
892state->tls_sni = sni;
893state->tls_verify_certificates = cas;
894state->tls_crl = crl;
059ec3d9 895
17c76198
PP
896/* This handles the variables that might get re-expanded after TLS SNI;
897that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 898
17c76198
PP
899DEBUG(D_tls)
900 debug_printf("Expanding various TLS configuration options for session credentials.\n");
901rc = tls_expand_session_files(state);
902if (rc != OK) return rc;
059ec3d9 903
1365611d
PP
904/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
905requires a new structure afterwards. */
83da1223 906
1365611d
PP
907rc = tls_set_remaining_x509(state);
908if (rc != OK) return rc;
83da1223 909
17c76198
PP
910/* set SNI in client, only */
911if (host)
912 {
913 if (!expand_check_tlsvar(tls_sni))
914 return DEFER;
915 if (state->exp_tls_sni && *state->exp_tls_sni)
916 {
917 DEBUG(D_tls)
918 debug_printf("Setting TLS client SNI to \"%s\"\n", state->exp_tls_sni);
919 sz = Ustrlen(state->exp_tls_sni);
920 rc = gnutls_server_name_set(state->session,
921 GNUTLS_NAME_DNS, state->exp_tls_sni, sz);
922 exim_gnutls_err_check(US"gnutls_server_name_set");
923 }
924 }
925else if (state->tls_sni)
926 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
927 "have an SNI set for a client [%s]\n", state->tls_sni);
83da1223 928
17c76198
PP
929/* This is the priority string support,
930http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html
931and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
932This was backwards incompatible, but means Exim no longer needs to track
933all algorithms and provide string forms for them. */
83da1223 934
17c76198 935want_default_priorities = TRUE;
83da1223 936
17c76198 937if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 938 {
17c76198
PP
939 if (!expand_check_tlsvar(tls_require_ciphers))
940 return DEFER;
941 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 942 {
17c76198
PP
943 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
944 state->exp_tls_require_ciphers);
945
946 rc = gnutls_priority_init(&state->priority_cache,
947 CS state->exp_tls_require_ciphers, &errpos);
948 want_default_priorities = FALSE;
949 p = state->exp_tls_require_ciphers;
83da1223
PH
950 }
951 }
17c76198
PP
952if (want_default_priorities)
953 {
83e2f8a2
PP
954 DEBUG(D_tls)
955 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
956 exim_default_gnutls_priority);
17c76198
PP
957 rc = gnutls_priority_init(&state->priority_cache,
958 exim_default_gnutls_priority, &errpos);
959 p = US exim_default_gnutls_priority;
960 }
83da1223 961
17c76198
PP
962exim_gnutls_err_check(string_sprintf(
963 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
964 p, errpos - CS p, errpos));
965
966rc = gnutls_priority_set(state->session, state->priority_cache);
967exim_gnutls_err_check(US"gnutls_priority_set");
968
969gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
970
971/* Reduce security in favour of increased compatibility, if the admin
972decides to make that trade-off. */
973if (gnutls_compat_mode)
83da1223 974 {
17c76198
PP
975#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
976 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
977 gnutls_session_enable_compatibility_mode(state->session);
978#else
979 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
980#endif
83da1223
PH
981 }
982
17c76198
PP
983*caller_state = state;
984/* needs to happen before callbacks during handshake */
985current_global_tls_state = state;
986return OK;
83da1223
PH
987}
988
989
990
991
992/*************************************************
17c76198 993* Extract peer information *
059ec3d9
PH
994*************************************************/
995
17c76198
PP
996/* Called from both server and client code.
997Only this is allowed to set state->peerdn and we use that to detect double-calls.
059ec3d9
PH
998
999Arguments:
17c76198 1000 state exim_gnutls_state_st *
059ec3d9 1001
17c76198 1002Returns: OK/DEFER/FAIL
059ec3d9
PH
1003*/
1004
17c76198
PP
1005static int
1006peer_status(exim_gnutls_state_st *state)
059ec3d9 1007{
17c76198
PP
1008const gnutls_datum *cert_list;
1009int rc;
1010unsigned int cert_list_size = 0;
1011gnutls_certificate_type_t ct;
1012gnutls_x509_crt_t crt;
1013uschar *dn_buf;
1014size_t sz;
059ec3d9 1015
17c76198
PP
1016if (state->peerdn)
1017 return OK;
059ec3d9 1018
17c76198 1019state->peerdn = US"unknown";
059ec3d9 1020
17c76198 1021cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1022
17c76198
PP
1023if (cert_list == NULL || cert_list_size == 0)
1024 {
1025 state->peerdn = US"unknown (no certificate)";
1026 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1027 cert_list, cert_list_size);
1028 if (state->verify_requirement == VERIFY_REQUIRED)
1029 return tls_error(US"certificate verification failed",
1030 "no certificate received from peer", state->host);
1031 return OK;
1032 }
059ec3d9 1033
17c76198
PP
1034ct = gnutls_certificate_type_get(state->session);
1035if (ct != GNUTLS_CRT_X509)
059ec3d9 1036 {
17c76198
PP
1037 const char *ctn = gnutls_certificate_type_get_name(ct);
1038 state->peerdn = string_sprintf("unknown (type %s)", ctn);
1039 DEBUG(D_tls)
1040 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1041 if (state->verify_requirement == VERIFY_REQUIRED)
1042 return tls_error(US"certificate verification not possible, unhandled type",
1043 ctn, state->host);
1044 return OK;
83da1223 1045 }
059ec3d9 1046
17c76198
PP
1047#define exim_gnutls_peer_err(Label) do { \
1048 if (rc != GNUTLS_E_SUCCESS) { \
1049 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1050 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1051 return OK; } } while (0)
1052
1053rc = gnutls_x509_crt_init(&crt);
1054exim_gnutls_peer_err(US"gnutls_x509_crt_init (crt)");
1055
1056rc = gnutls_x509_crt_import(crt, &cert_list[0], GNUTLS_X509_FMT_DER);
1057exim_gnutls_peer_err(US"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1058sz = 0;
1059rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1060if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1061 {
17c76198
PP
1062 exim_gnutls_peer_err(US"getting size for cert DN failed");
1063 return FAIL; /* should not happen */
059ec3d9 1064 }
17c76198
PP
1065dn_buf = store_get_perm(sz);
1066rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1067exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1068state->peerdn = dn_buf;
1069
1070return OK;
1071#undef exim_gnutls_peer_err
1072}
059ec3d9 1073
059ec3d9 1074
059ec3d9 1075
059ec3d9 1076
17c76198
PP
1077/*************************************************
1078* Verify peer certificate *
1079*************************************************/
059ec3d9 1080
17c76198
PP
1081/* Called from both server and client code.
1082*Should* be using a callback registered with
1083gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1084the peer information, but that's too new for some OSes.
059ec3d9 1085
17c76198
PP
1086Arguments:
1087 state exim_gnutls_state_st *
1088 error where to put an error message
059ec3d9 1089
17c76198
PP
1090Returns:
1091 FALSE if the session should be rejected
1092 TRUE if the cert is okay or we just don't care
1093*/
059ec3d9 1094
17c76198
PP
1095static BOOL
1096verify_certificate(exim_gnutls_state_st *state, const char **error)
1097{
1098int rc;
1099unsigned int verify;
1100
1101*error = NULL;
1102
1103rc = peer_status(state);
1104if (rc != OK)
e6060e2c 1105 {
17c76198
PP
1106 verify = GNUTLS_CERT_INVALID;
1107 *error = "not supplied";
1108 }
1109else
1110 {
1111 rc = gnutls_certificate_verify_peers2(state->session, &verify);
e6060e2c
NM
1112 }
1113
17c76198
PP
1114/* Handle the result of verification. INVALID seems to be set as well
1115as REVOKED, but leave the test for both. */
059ec3d9 1116
17c76198
PP
1117if ((rc < 0) || (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
1118 {
1119 state->peer_cert_verified = FALSE;
1120 if (*error == NULL)
1121 *error = ((verify & GNUTLS_CERT_REVOKED) != 0) ? "revoked" : "invalid";
059ec3d9 1122
17c76198
PP
1123 DEBUG(D_tls)
1124 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
1125 *error, state->peerdn);
059ec3d9 1126
17c76198
PP
1127 if (state->verify_requirement == VERIFY_REQUIRED)
1128 {
1129 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1130 return FALSE;
1131 }
1132 DEBUG(D_tls)
1133 debug_printf("TLS verify failure overriden (host in tls_try_verify_hosts)\n");
1134 }
1135else
1136 {
1137 state->peer_cert_verified = TRUE;
1138 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=%s\n", state->peerdn);
1139 }
059ec3d9 1140
17c76198 1141tls_peerdn = state->peerdn;
059ec3d9 1142
17c76198
PP
1143return TRUE;
1144}
059ec3d9 1145
17c76198
PP
1146
1147
1148
1149/* ------------------------------------------------------------------------ */
1150/* Callbacks */
1151
1152/* Logging function which can be registered with
1153 * gnutls_global_set_log_function()
1154 * gnutls_global_set_log_level() 0..9
1155 */
af3498d6 1156#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1157static void
17c76198 1158exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1159{
17c76198
PP
1160 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s\n", level, message);
1161}
af3498d6 1162#endif
059ec3d9 1163
059ec3d9 1164
17c76198
PP
1165/* Called after client hello, should handle SNI work.
1166This will always set tls_sni (state->received_sni) if available,
1167and may trigger presenting different certificates,
1168if state->trigger_sni_changes is TRUE.
059ec3d9 1169
17c76198
PP
1170Should be registered with
1171 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1172
17c76198
PP
1173"This callback must return 0 on success or a gnutls error code to terminate the
1174handshake.".
059ec3d9 1175
17c76198
PP
1176For inability to get SNI information, we return 0.
1177We only return non-zero if re-setup failed.
1178*/
44bbabb5 1179
17c76198
PP
1180static int
1181exim_sni_handling_cb(gnutls_session_t session)
1182{
1183char sni_name[MAX_HOST_LEN];
1184size_t data_len = MAX_HOST_LEN;
1185exim_gnutls_state_st *state = current_global_tls_state;
1186unsigned int sni_type;
1187int rc, old_pool;
1188
1189rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1190if (rc != GNUTLS_E_SUCCESS)
1191 {
1192 DEBUG(D_tls) {
1193 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1194 debug_printf("TLS: no SNI presented in handshake.\n");
1195 else
1196 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1197 gnutls_strerror(rc), rc);
1198 };
1199 return 0;
1200 }
1201
17c76198
PP
1202if (sni_type != GNUTLS_NAME_DNS)
1203 {
1204 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1205 return 0;
1206 }
44bbabb5 1207
17c76198
PP
1208/* We now have a UTF-8 string in sni_name */
1209old_pool = store_pool;
1210store_pool = POOL_PERM;
1211state->received_sni = string_copyn(US sni_name, data_len);
1212store_pool = old_pool;
1213
1214/* We set this one now so that variable expansions below will work */
1215tls_sni = state->received_sni;
1216
1217DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1218 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1219
1220if (!state->trigger_sni_changes)
1221 return 0;
1222
1223rc = tls_expand_session_files(state);
1224if (rc != OK)
1225 {
1226 /* If the setup of certs/etc failed before handshake, TLS would not have
1227 been offered. The best we can do now is abort. */
1228 return GNUTLS_E_APPLICATION_ERROR_MIN;
1229 }
1230
1365611d
PP
1231rc = tls_set_remaining_x509(state);
1232if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1233
1234return 0;
059ec3d9
PH
1235}
1236
1237
1238
17c76198
PP
1239
1240/* ------------------------------------------------------------------------ */
1241/* Exported functions */
1242
1243
1244
1245
059ec3d9
PH
1246/*************************************************
1247* Start a TLS session in a server *
1248*************************************************/
1249
1250/* This is called when Exim is running as a server, after having received
1251the STARTTLS command. It must respond to that command, and then negotiate
1252a TLS session.
1253
1254Arguments:
83da1223 1255 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1256
1257Returns: OK on success
1258 DEFER for errors before the start of the negotiation
1259 FAIL for errors during the negotation; the server can't
1260 continue running.
1261*/
1262
1263int
17c76198 1264tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1265{
1266int rc;
7199e1ee 1267const char *error;
17c76198 1268exim_gnutls_state_st *state = NULL;
059ec3d9
PH
1269
1270/* Check for previous activation */
17c76198 1271/* nb: this will not be TLS callout safe, needs reworking as part of that. */
059ec3d9
PH
1272
1273if (tls_active >= 0)
1274 {
17c76198 1275 tls_error(US"STARTTLS received after TLS started", "", NULL);
059ec3d9
PH
1276 smtp_printf("554 Already in TLS\r\n");
1277 return FAIL;
1278 }
1279
1280/* Initialize the library. If it fails, it will already have logged the error
1281and sent an SMTP response. */
1282
17c76198 1283DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 1284
17c76198
PP
1285rc = tls_init(NULL, tls_certificate, tls_privatekey,
1286 NULL, tls_verify_certificates, tls_crl,
1287 require_ciphers, &state);
059ec3d9
PH
1288if (rc != OK) return rc;
1289
059ec3d9
PH
1290/* If this is a host for which certificate verification is mandatory or
1291optional, set up appropriately. */
1292
059ec3d9 1293if (verify_check_host(&tls_verify_hosts) == OK)
17c76198
PP
1294 {
1295 DEBUG(D_tls) debug_printf("TLS: a client certificate will be required.\n");
1296 state->verify_requirement = VERIFY_REQUIRED;
1297 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1298 }
059ec3d9 1299else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198
PP
1300 {
1301 DEBUG(D_tls) debug_printf("TLS: a client certificate will be requested but not required.\n");
1302 state->verify_requirement = VERIFY_OPTIONAL;
1303 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1304 }
1305else
1306 {
1307 DEBUG(D_tls) debug_printf("TLS: a client certificate will not be requested.\n");
1308 state->verify_requirement = VERIFY_NONE;
1309 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1310 }
059ec3d9 1311
17c76198
PP
1312/* Register SNI handling; always, even if not in tls_certificate, so that the
1313expansion variable $tls_sni is always available. */
059ec3d9 1314
17c76198
PP
1315gnutls_handshake_set_post_client_hello_function(state->session,
1316 exim_sni_handling_cb);
059ec3d9
PH
1317
1318/* Set context and tell client to go ahead, except in the case of TLS startup
1319on connection, where outputting anything now upsets the clients and tends to
1320make them disconnect. We need to have an explicit fflush() here, to force out
1321the response. Other smtp_printf() calls do not need it, because in non-TLS
1322mode, the fflush() happens when smtp_getc() is called. */
1323
1324if (!tls_on_connect)
1325 {
1326 smtp_printf("220 TLS go ahead\r\n");
1327 fflush(smtp_out);
1328 }
1329
1330/* Now negotiate the TLS session. We put our own timer on it, since it seems
1331that the GnuTLS library doesn't. */
1332
17c76198
PP
1333gnutls_transport_set_ptr2(state->session,
1334 (gnutls_transport_ptr)fileno(smtp_in),
1335 (gnutls_transport_ptr)fileno(smtp_out));
1336state->fd_in = fileno(smtp_in);
1337state->fd_out = fileno(smtp_out);
059ec3d9
PH
1338
1339sigalrm_seen = FALSE;
1340if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198
PP
1341do
1342 {
1343 rc = gnutls_handshake(state->session);
1344 } while ((rc == GNUTLS_E_AGAIN) || (rc == GNUTLS_E_INTERRUPTED));
059ec3d9
PH
1345alarm(0);
1346
17c76198 1347if (rc != GNUTLS_E_SUCCESS)
059ec3d9 1348 {
17c76198
PP
1349 tls_error(US"gnutls_handshake",
1350 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
059ec3d9
PH
1351 /* It seems that, except in the case of a timeout, we have to close the
1352 connection right here; otherwise if the other end is running OpenSSL it hangs
1353 until the server times out. */
1354
1355 if (!sigalrm_seen)
1356 {
f1e894f3
PH
1357 (void)fclose(smtp_out);
1358 (void)fclose(smtp_in);
059ec3d9
PH
1359 }
1360
1361 return FAIL;
1362 }
1363
1364DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1365
17c76198
PP
1366/* Verify after the fact */
1367
1368if (state->verify_requirement != VERIFY_NONE)
059ec3d9 1369 {
17c76198
PP
1370 if (!verify_certificate(state, &error))
1371 {
1372 if (state->verify_requirement == VERIFY_OPTIONAL)
1373 {
1374 DEBUG(D_tls)
1375 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1376 error);
1377 }
1378 else
1379 {
1380 tls_error(US"certificate verification failed", error, NULL);
1381 return FAIL;
1382 }
1383 }
059ec3d9
PH
1384 }
1385
17c76198
PP
1386/* Figure out peer DN, and if authenticated, etc. */
1387
1388rc = peer_status(state);
1389if (rc != OK) return rc;
1390
1391/* Sets various Exim expansion variables; always safe within server */
1392
1393extract_exim_vars_from_tls_state(state);
059ec3d9
PH
1394
1395/* TLS has been set up. Adjust the input functions to read via TLS,
1396and initialize appropriately. */
1397
17c76198 1398state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
1399
1400receive_getc = tls_getc;
1401receive_ungetc = tls_ungetc;
1402receive_feof = tls_feof;
1403receive_ferror = tls_ferror;
58eb016e 1404receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1405
059ec3d9
PH
1406return OK;
1407}
1408
1409
1410
1411
1412/*************************************************
1413* Start a TLS session in a client *
1414*************************************************/
1415
1416/* Called from the smtp transport after STARTTLS has been accepted.
1417
1418Arguments:
1419 fd the fd of the connection
1420 host connected host (for messages)
83da1223 1421 addr the first address (not used)
17c76198 1422 dhparam DH parameter file (ignored, we're a client)
059ec3d9
PH
1423 certificate certificate file
1424 privatekey private key file
3f0945ff 1425 sni TLS SNI to send to remote host
059ec3d9
PH
1426 verify_certs file for certificate verify
1427 verify_crl CRL for verify
83da1223 1428 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1429 timeout startup timeout
1430
1431Returns: OK/DEFER/FAIL (because using common functions),
1432 but for a client, DEFER and FAIL have the same meaning
1433*/
1434
1435int
17c76198
PP
1436tls_client_start(int fd, host_item *host,
1437 address_item *addr ARG_UNUSED, uschar *dhparam ARG_UNUSED,
1438 uschar *certificate, uschar *privatekey, uschar *sni,
1439 uschar *verify_certs, uschar *verify_crl,
1440 uschar *require_ciphers, int timeout)
059ec3d9 1441{
059ec3d9 1442int rc;
17c76198
PP
1443const char *error;
1444exim_gnutls_state_st *state = NULL;
059ec3d9 1445
17c76198 1446DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 1447
17c76198
PP
1448rc = tls_init(host, certificate, privatekey,
1449 sni, verify_certs, verify_crl, require_ciphers, &state);
059ec3d9
PH
1450if (rc != OK) return rc;
1451
17c76198 1452gnutls_dh_set_prime_bits(state->session, EXIM_CLIENT_DH_MIN_BITS);
83da1223 1453
17c76198
PP
1454if (verify_certs == NULL)
1455 {
1456 DEBUG(D_tls) debug_printf("TLS: server certificate verification not required\n");
1457 state->verify_requirement = VERIFY_NONE;
1458 /* we still ask for it, to log it, etc */
1459 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1460 }
1461else
1462 {
1463 DEBUG(D_tls) debug_printf("TLS: server certificate verification required\n");
1464 state->verify_requirement = VERIFY_REQUIRED;
1465 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1466 }
059ec3d9 1467
17c76198
PP
1468gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)fd);
1469state->fd_in = fd;
1470state->fd_out = fd;
059ec3d9
PH
1471
1472/* There doesn't seem to be a built-in timeout on connection. */
1473
1474sigalrm_seen = FALSE;
1475alarm(timeout);
17c76198
PP
1476do
1477 {
1478 rc = gnutls_handshake(state->session);
1479 } while ((rc == GNUTLS_E_AGAIN) || (rc == GNUTLS_E_INTERRUPTED));
059ec3d9
PH
1480alarm(0);
1481
17c76198 1482DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 1483
17c76198 1484/* Verify late */
059ec3d9 1485
17c76198
PP
1486if (state->verify_requirement != VERIFY_NONE &&
1487 !verify_certificate(state, &error))
1488 return tls_error(US"certificate verification failed", error, state->host);
059ec3d9 1489
17c76198 1490/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 1491
17c76198
PP
1492rc = peer_status(state);
1493if (rc != OK) return rc;
059ec3d9 1494
17c76198 1495/* Sets various Exim expansion variables; always safe within server */
059ec3d9 1496
17c76198 1497extract_exim_vars_from_tls_state(state);
059ec3d9 1498
059ec3d9
PH
1499return OK;
1500}
1501
1502
1503
17c76198 1504
059ec3d9 1505/*************************************************
17c76198 1506* Close down a TLS session *
059ec3d9
PH
1507*************************************************/
1508
17c76198
PP
1509/* This is also called from within a delivery subprocess forked from the
1510daemon, to shut down the TLS library, without actually doing a shutdown (which
1511would tamper with the TLS session in the parent process).
059ec3d9 1512
17c76198
PP
1513Arguments: TRUE if gnutls_bye is to be called
1514Returns: nothing
059ec3d9
PH
1515*/
1516
17c76198
PP
1517void
1518tls_close(BOOL shutdown)
059ec3d9 1519{
17c76198 1520exim_gnutls_state_st *state = current_global_tls_state;
059ec3d9 1521
17c76198
PP
1522if (tls_active < 0) return; /* TLS was not active */
1523
1524if (shutdown)
1525 {
1526 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1527 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1528 }
1529
1530gnutls_deinit(state->session);
1531
1532memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1533
1534if ((state_server.session == NULL) && (state_client.session == NULL))
1535 {
1536 gnutls_global_deinit();
1537 exim_gnutls_base_init_done = FALSE;
1538 }
7199e1ee 1539
17c76198 1540tls_active = -1;
059ec3d9
PH
1541}
1542
1543
1544
17c76198 1545
059ec3d9
PH
1546/*************************************************
1547* TLS version of getc *
1548*************************************************/
1549
1550/* This gets the next byte from the TLS input buffer. If the buffer is empty,
1551it refills the buffer via the GnuTLS reading function.
1552
17c76198
PP
1553This feeds DKIM and should be used for all message-body reads.
1554
059ec3d9
PH
1555Arguments: none
1556Returns: the next character or EOF
1557*/
1558
1559int
1560tls_getc(void)
1561{
17c76198
PP
1562exim_gnutls_state_st *state = current_global_tls_state;
1563if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
059ec3d9 1564 {
17c76198 1565 ssize_t inbytes;
059ec3d9 1566
17c76198
PP
1567 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1568 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
1569
1570 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 1571 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
059ec3d9
PH
1572 ssl_xfer_buffer_size);
1573 alarm(0);
1574
1575 /* A zero-byte return appears to mean that the TLS session has been
1576 closed down, not that the socket itself has been closed down. Revert to
1577 non-TLS handling. */
1578
1579 if (inbytes == 0)
1580 {
1581 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1582
1583 receive_getc = smtp_getc;
1584 receive_ungetc = smtp_ungetc;
1585 receive_feof = smtp_feof;
1586 receive_ferror = smtp_ferror;
58eb016e 1587 receive_smtp_buffered = smtp_buffered;
059ec3d9 1588
17c76198
PP
1589 gnutls_deinit(state->session);
1590 state->session = NULL;
059ec3d9 1591 tls_active = -1;
17c76198
PP
1592 tls_bits = 0;
1593 tls_certificate_verified = FALSE;
1594 tls_channelbinding_b64 = NULL;
059ec3d9
PH
1595 tls_cipher = NULL;
1596 tls_peerdn = NULL;
1597
1598 return smtp_getc();
1599 }
1600
1601 /* Handle genuine errors */
1602
1603 else if (inbytes < 0)
1604 {
17c76198
PP
1605 record_io_error(state, (int) inbytes, US"recv", NULL);
1606 state->xfer_error = 1;
059ec3d9
PH
1607 return EOF;
1608 }
80a47a2c 1609#ifndef DISABLE_DKIM
17c76198 1610 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
80a47a2c 1611#endif
17c76198
PP
1612 state->xfer_buffer_hwm = (int) inbytes;
1613 state->xfer_buffer_lwm = 0;
059ec3d9
PH
1614 }
1615
059ec3d9
PH
1616/* Something in the buffer; return next uschar */
1617
17c76198 1618return state->xfer_buffer[state->xfer_buffer_lwm++];
059ec3d9
PH
1619}
1620
1621
1622
17c76198 1623
059ec3d9
PH
1624/*************************************************
1625* Read bytes from TLS channel *
1626*************************************************/
1627
17c76198
PP
1628/* This does not feed DKIM, so if the caller uses this for reading message body,
1629then the caller must feed DKIM.
059ec3d9
PH
1630Arguments:
1631 buff buffer of data
1632 len size of buffer
1633
1634Returns: the number of bytes read
1635 -1 after a failed read
1636*/
1637
1638int
1639tls_read(uschar *buff, size_t len)
1640{
17c76198
PP
1641exim_gnutls_state_st *state = current_global_tls_state;
1642ssize_t inbytes;
059ec3d9 1643
17c76198
PP
1644if (len > INT_MAX)
1645 len = INT_MAX;
059ec3d9 1646
17c76198
PP
1647if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
1648 DEBUG(D_tls)
1649 debug_printf("*** PROBABLY A BUG *** " \
1650 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1651 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
1652
1653DEBUG(D_tls)
1654 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
1655 state->session, buff, len);
1656
1657inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
1658if (inbytes > 0) return inbytes;
1659if (inbytes == 0)
1660 {
1661 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1662 }
17c76198 1663else record_io_error(state, (int)inbytes, US"recv", NULL);
059ec3d9
PH
1664
1665return -1;
1666}
1667
1668
1669
17c76198 1670
059ec3d9
PH
1671/*************************************************
1672* Write bytes down TLS channel *
1673*************************************************/
1674
1675/*
1676Arguments:
1677 buff buffer of data
1678 len number of bytes
1679
1680Returns: the number of bytes after a successful write,
1681 -1 after a failed write
1682*/
1683
1684int
1685tls_write(const uschar *buff, size_t len)
1686{
17c76198
PP
1687ssize_t outbytes;
1688size_t left = len;
1689exim_gnutls_state_st *state = current_global_tls_state;
059ec3d9 1690
17c76198 1691DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
059ec3d9
PH
1692while (left > 0)
1693 {
17c76198
PP
1694 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
1695 buff, left);
1696 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 1697
17c76198 1698 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
1699 if (outbytes < 0)
1700 {
17c76198 1701 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
1702 return -1;
1703 }
1704 if (outbytes == 0)
1705 {
17c76198 1706 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
1707 return -1;
1708 }
1709
1710 left -= outbytes;
1711 buff += outbytes;
1712 }
1713
17c76198
PP
1714if (len > INT_MAX)
1715 {
1716 DEBUG(D_tls)
1717 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
1718 len);
1719 len = INT_MAX;
1720 }
1721
1722return (int) len;
059ec3d9
PH
1723}
1724
1725
1726
17c76198 1727
059ec3d9 1728/*************************************************
17c76198 1729* Random number generation *
059ec3d9
PH
1730*************************************************/
1731
17c76198
PP
1732/* Pseudo-random number generation. The result is not expected to be
1733cryptographically strong but not so weak that someone will shoot themselves
1734in the foot using it as a nonce in input in some email header scheme or
1735whatever weirdness they'll twist this into. The result should handle fork()
1736and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 1737
17c76198
PP
1738Arguments:
1739 max range maximum
1740Returns a random number in range [0, max-1]
059ec3d9
PH
1741*/
1742
af3498d6 1743#ifdef HAVE_GNUTLS_RND
17c76198
PP
1744int
1745vaguely_random_number(int max)
059ec3d9 1746{
17c76198
PP
1747unsigned int r;
1748int i, needed_len;
1749uschar *p;
1750uschar smallbuf[sizeof(r)];
1751
1752if (max <= 1)
1753 return 0;
1754
1755needed_len = sizeof(r);
1756/* Don't take 8 times more entropy than needed if int is 8 octets and we were
1757 * asked for a number less than 10. */
1758for (r = max, i = 0; r; ++i)
1759 r >>= 1;
1760i = (i + 7) / 8;
1761if (i < needed_len)
1762 needed_len = i;
1763
1764i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
1765if (i < 0)
059ec3d9 1766 {
17c76198
PP
1767 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
1768 return vaguely_random_number_fallback(max);
1769 }
1770r = 0;
1771for (p = smallbuf; needed_len; --needed_len, ++p)
1772 {
1773 r *= 256;
1774 r += *p;
059ec3d9
PH
1775 }
1776
17c76198
PP
1777/* We don't particularly care about weighted results; if someone wants
1778 * smooth distribution and cares enough then they should submit a patch then. */
1779return r % max;
059ec3d9 1780}
af3498d6
PP
1781#else /* HAVE_GNUTLS_RND */
1782int
1783vaguely_random_number(int max)
1784{
1785 return vaguely_random_number_fallback(max);
1786}
1787#endif /* HAVE_GNUTLS_RND */
059ec3d9 1788
36f12725
NM
1789
1790
1791
1792/*************************************************
1793* Report the library versions. *
1794*************************************************/
1795
1796/* See a description in tls-openssl.c for an explanation of why this exists.
1797
1798Arguments: a FILE* to print the results to
1799Returns: nothing
1800*/
1801
1802void
1803tls_version_report(FILE *f)
1804{
754a0503
PP
1805fprintf(f, "Library version: GnuTLS: Compile: %s\n"
1806 " Runtime: %s\n",
1807 LIBGNUTLS_VERSION,
1808 gnutls_check_version(NULL));
36f12725
NM
1809}
1810
059ec3d9 1811/* End of tls-gnu.c */