Guard TLS SNI callback define better.
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
17c76198 5/* Copyright (c) University of Cambridge 1995 - 2012 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
16Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
059ec3d9 42
17c76198 43/* GnuTLS 2 vs 3
059ec3d9 44
17c76198
PP
45GnuTLS 3 only:
46 gnutls_global_set_audit_log_function()
059ec3d9 47
17c76198
PP
48Changes:
49 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
50*/
059ec3d9 51
17c76198 52/* Local static variables for GnuTLS */
059ec3d9 53
17c76198 54/* Values for verify_requirement */
059ec3d9 55
17c76198 56enum peer_verify_requirement { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
059ec3d9 57
17c76198
PP
58/* This holds most state for server or client; with this, we can set up an
59outbound TLS-enabled connection in an ACL callout, while not stomping all
60over the TLS variables available for expansion.
059ec3d9 61
17c76198
PP
62Some of these correspond to variables in globals.c; those variables will
63be set to point to content in one of these instances, as appropriate for
64the stage of the process lifetime.
059ec3d9 65
17c76198
PP
66Not handled here: globals tls_active, tls_bits, tls_cipher, tls_peerdn,
67tls_certificate_verified, tls_channelbinding_b64, tls_sni.
68*/
059ec3d9 69
17c76198
PP
70typedef struct exim_gnutls_state {
71 gnutls_session_t session;
72 gnutls_certificate_credentials_t x509_cred;
73 gnutls_priority_t priority_cache;
74 enum peer_verify_requirement verify_requirement;
75 int fd_in;
76 int fd_out;
77 BOOL peer_cert_verified;
78 BOOL trigger_sni_changes;
4fe99a6c 79 BOOL have_set_peerdn;
17c76198
PP
80 const struct host_item *host;
81 uschar *peerdn;
75fe387d 82 uschar *ciphersuite;
17c76198
PP
83 uschar *received_sni;
84
85 const uschar *tls_certificate;
86 const uschar *tls_privatekey;
87 const uschar *tls_sni; /* client send only, not received */
88 const uschar *tls_verify_certificates;
89 const uschar *tls_crl;
90 const uschar *tls_require_ciphers;
91 uschar *exp_tls_certificate;
92 uschar *exp_tls_privatekey;
93 uschar *exp_tls_sni;
94 uschar *exp_tls_verify_certificates;
95 uschar *exp_tls_crl;
96 uschar *exp_tls_require_ciphers;
97
98 uschar *xfer_buffer;
99 int xfer_buffer_lwm;
100 int xfer_buffer_hwm;
101 int xfer_eof;
102 int xfer_error;
17c76198
PP
103} exim_gnutls_state_st;
104
105static const exim_gnutls_state_st exim_gnutls_state_init = {
4fe99a6c 106 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
75fe387d 107 NULL, NULL, NULL, NULL,
17c76198
PP
108 NULL, NULL, NULL, NULL, NULL, NULL,
109 NULL, NULL, NULL, NULL, NULL, NULL,
110 NULL, 0, 0, 0, 0,
17c76198 111};
83da1223 112
17c76198
PP
113/* Not only do we have our own APIs which don't pass around state, assuming
114it's held in globals, GnuTLS doesn't appear to let us register callback data
115for callbacks, or as part of the session, so we have to keep a "this is the
116context we're currently dealing with" pointer and rely upon being
117single-threaded to keep from processing data on an inbound TLS connection while
118talking to another TLS connection for an outbound check. This does mean that
119there's no way for heart-beats to be responded to, for the duration of the
120second connection. */
059ec3d9 121
17c76198
PP
122static exim_gnutls_state_st state_server, state_client;
123static exim_gnutls_state_st *current_global_tls_state;
059ec3d9 124
17c76198
PP
125/* dh_params are initialised once within the lifetime of a process using TLS;
126if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
127don't want to repeat this. */
83da1223 128
17c76198 129static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 130
17c76198 131/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 132
17c76198 133static const int ssl_session_timeout = 200;
059ec3d9 134
17c76198 135static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 136
17c76198 137/* Guard library core initialisation */
83da1223 138
17c76198 139static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 140
059ec3d9 141
17c76198 142/* ------------------------------------------------------------------------ */
17c76198 143/* macros */
83da1223 144
17c76198 145#define MAX_HOST_LEN 255
83da1223 146
17c76198
PP
147/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
148the library logging; a value less than 0 disables the calls to set up logging
149callbacks. */
2c17bb02 150#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
17c76198 151#define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 152#endif
83da1223 153
2c17bb02 154#ifndef EXIM_CLIENT_DH_MIN_BITS
17c76198 155#define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 156#endif
83da1223 157
af3498d6
PP
158/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
159can ask for a bit-strength. Without that, we stick to the constant we had
160before, for now. */
2c17bb02 161#ifndef EXIM_SERVER_DH_BITS_PRE2_12
af3498d6 162#define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 163#endif
af3498d6 164
17c76198
PP
165#define exim_gnutls_err_check(Label) do { \
166 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
059ec3d9 167
17c76198 168#define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
83da1223 169
17c76198
PP
170#if GNUTLS_VERSION_NUMBER >= 0x020c00
171#define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
af3498d6
PP
172#define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
173#define HAVE_GNUTLS_RND
17c76198 174#endif
83da1223 175
af3498d6
PP
176
177
178
179/* ------------------------------------------------------------------------ */
180/* Callback declarations */
181
182#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
183static void exim_gnutls_logger_cb(int level, const char *message);
184#endif
185
186static int exim_sni_handling_cb(gnutls_session_t session);
187
188
189
190
17c76198
PP
191/* ------------------------------------------------------------------------ */
192/* Static functions */
059ec3d9
PH
193
194/*************************************************
195* Handle TLS error *
196*************************************************/
197
198/* Called from lots of places when errors occur before actually starting to do
199the TLS handshake, that is, while the session is still in clear. Always returns
200DEFER for a server and FAIL for a client so that most calls can use "return
201tls_error(...)" to do this processing and then give an appropriate return. A
202single function is used for both server and client, because it is called from
203some shared functions.
204
205Argument:
206 prefix text to include in the logged error
7199e1ee
TF
207 msg additional error string (may be NULL)
208 usually obtained from gnutls_strerror()
17c76198
PP
209 host NULL if setting up a server;
210 the connected host if setting up a client
059ec3d9
PH
211
212Returns: OK/DEFER/FAIL
213*/
214
215static int
17c76198 216tls_error(const uschar *prefix, const char *msg, const host_item *host)
059ec3d9 217{
17c76198
PP
218if (host)
219 {
220 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
221 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
222 return FAIL;
223 }
224else
059ec3d9 225 {
7199e1ee 226 uschar *conn_info = smtp_get_connection_info();
17c76198 227 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee
TF
228 conn_info += 5;
229 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
17c76198 230 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
059ec3d9
PH
231 return DEFER;
232 }
059ec3d9
PH
233}
234
235
236
17c76198 237
059ec3d9 238/*************************************************
17c76198 239* Deal with logging errors during I/O *
059ec3d9
PH
240*************************************************/
241
17c76198 242/* We have to get the identity of the peer from saved data.
059ec3d9 243
17c76198
PP
244Argument:
245 state the current GnuTLS exim state container
246 rc the GnuTLS error code, or 0 if it's a local error
247 when text identifying read or write
248 text local error text when ec is 0
059ec3d9 249
17c76198 250Returns: nothing
059ec3d9
PH
251*/
252
17c76198
PP
253static void
254record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 255{
17c76198 256const char *msg;
059ec3d9 257
17c76198
PP
258if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
259 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
260 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
261else
262 msg = gnutls_strerror(rc);
059ec3d9 263
17c76198
PP
264tls_error(when, msg, state->host);
265}
059ec3d9 266
059ec3d9 267
059ec3d9 268
059ec3d9 269
17c76198
PP
270/*************************************************
271* Set various Exim expansion vars *
272*************************************************/
059ec3d9 273
17c76198
PP
274/* We set various Exim global variables from the state, once a session has
275been established. With TLS callouts, may need to change this to stack
276variables, or just re-call it with the server state after client callout
277has finished.
059ec3d9 278
17c76198
PP
279Make sure anything set here is inset in tls_getc().
280
281Sets:
282 tls_active fd
283 tls_bits strength indicator
284 tls_certificate_verified bool indicator
285 tls_channelbinding_b64 for some SASL mechanisms
286 tls_cipher a string
287 tls_peerdn a string
288 tls_sni a (UTF-8) string
289Also:
290 current_global_tls_state for API limitations
291
292Argument:
293 state the relevant exim_gnutls_state_st *
294*/
295
296static void
297extract_exim_vars_from_tls_state(exim_gnutls_state_st *state)
298{
17c76198 299gnutls_cipher_algorithm_t cipher;
17c76198
PP
300#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
301int old_pool;
302int rc;
303gnutls_datum_t channel;
304#endif
305
306current_global_tls_state = state;
307
308tls_active = state->fd_out;
309
310cipher = gnutls_cipher_get(state->session);
311/* returns size in "bytes" */
312tls_bits = gnutls_cipher_get_key_size(cipher) * 8;
313
75fe387d 314tls_cipher = state->ciphersuite;
17c76198
PP
315
316DEBUG(D_tls) debug_printf("cipher: %s\n", tls_cipher);
317
318tls_certificate_verified = state->peer_cert_verified;
059ec3d9 319
17c76198
PP
320/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
321only available for use for authenticators while this TLS session is running. */
322
323tls_channelbinding_b64 = NULL;
324#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
325channel.data = NULL;
326channel.size = 0;
327rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
328if (rc) {
329 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
330} else {
331 old_pool = store_pool;
332 store_pool = POOL_PERM;
333 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
334 store_pool = old_pool;
335 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
336}
337#endif
338
339tls_peerdn = state->peerdn;
340
341tls_sni = state->received_sni;
059ec3d9
PH
342}
343
344
345
17c76198 346
059ec3d9 347/*************************************************
575643cd 348* Setup up DH parameters *
059ec3d9
PH
349*************************************************/
350
575643cd 351/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
352be re-generated every so often, depending on security policy. What we do is to
353keep these parameters in a file in the spool directory. If the file does not
354exist, we generate them. This means that it is easy to cause a regeneration.
355
356The new file is written as a temporary file and renamed, so that an incomplete
357file is never present. If two processes both compute some new parameters, you
358waste a bit of effort, but it doesn't seem worth messing around with locking to
359prevent this.
360
361Argument:
362 host NULL for server, server for client (for error handling)
363
364Returns: OK/DEFER/FAIL
365*/
366
367static int
17c76198 368init_server_dh(void)
059ec3d9 369{
17c76198
PP
370int fd, rc;
371unsigned int dh_bits;
b5aea5e1 372gnutls_datum m;
17c76198
PP
373uschar filename[PATH_MAX];
374size_t sz;
375host_item *host = NULL; /* dummy for macros */
059ec3d9 376
17c76198 377DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 378
17c76198
PP
379rc = gnutls_dh_params_init(&dh_server_params);
380exim_gnutls_err_check(US"gnutls_dh_params_init");
059ec3d9 381
af3498d6
PP
382#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
383/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
384different filename and ensure we have sufficient bits. */
385dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
386if (!dh_bits)
387 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
af3498d6 388DEBUG(D_tls)
b34fc30c 389 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
390 dh_bits);
391#else
392dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
393DEBUG(D_tls)
394 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
395 dh_bits);
396#endif
059ec3d9 397
17c76198 398if (!string_format(filename, sizeof(filename),
af3498d6 399 "%s/gnutls-params-%d", spool_directory, dh_bits))
17c76198 400 return tls_error(US"overlong filename", NULL, NULL);
059ec3d9 401
b5aea5e1 402/* Open the cache file for reading and if successful, read it and set up the
575643cd 403parameters. */
059ec3d9
PH
404
405fd = Uopen(filename, O_RDONLY, 0);
b5aea5e1 406if (fd >= 0)
059ec3d9 407 {
b5aea5e1 408 struct stat statbuf;
17c76198
PP
409 FILE *fp;
410 int saved_errno;
411
412 if (fstat(fd, &statbuf) < 0) /* EIO */
413 {
414 saved_errno = errno;
415 (void)close(fd);
416 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
417 }
418 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
419 {
420 (void)close(fd);
17c76198
PP
421 return tls_error(US"TLS cache not a file", NULL, NULL);
422 }
423 fp = fdopen(fd, "rb");
424 if (!fp)
425 {
426 saved_errno = errno;
427 (void)close(fd);
428 return tls_error(US"fdopen(TLS cache stat fd) failed",
429 strerror(saved_errno), NULL);
b5aea5e1 430 }
059ec3d9 431
b5aea5e1
PH
432 m.size = statbuf.st_size;
433 m.data = malloc(m.size);
434 if (m.data == NULL)
17c76198
PP
435 {
436 fclose(fp);
437 return tls_error(US"malloc failed", strerror(errno), NULL);
438 }
439 sz = fread(m.data, m.size, 1, fp);
440 if (!sz)
441 {
442 saved_errno = errno;
443 fclose(fp);
444 free(m.data);
445 return tls_error(US"fread failed", strerror(saved_errno), NULL);
446 }
447 fclose(fp);
b5aea5e1 448
17c76198 449 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 450 free(m.data);
17c76198
PP
451 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
452 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
453 }
454
455/* If the file does not exist, fall through to compute new data and cache it.
456If there was any other opening error, it is serious. */
457
182ad5cf
PH
458else if (errno == ENOENT)
459 {
17c76198 460 rc = -1;
182ad5cf 461 DEBUG(D_tls)
17c76198 462 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
463 }
464else
17c76198
PP
465 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
466 NULL, NULL);
b5aea5e1
PH
467
468/* If ret < 0, either the cache file does not exist, or the data it contains
469is not useful. One particular case of this is when upgrading from an older
470release of Exim in which the data was stored in a different format. We don't
471try to be clever and support both formats; we just regenerate new data in this
472case. */
473
17c76198 474if (rc < 0)
b5aea5e1 475 {
17c76198 476 uschar *temp_fn;
059ec3d9 477
17c76198
PP
478 if ((PATH_MAX - Ustrlen(filename)) < 10)
479 return tls_error(US"Filename too long to generate replacement",
480 CS filename, NULL);
059ec3d9 481
17c76198
PP
482 temp_fn = string_copy(US "%s.XXXXXXX");
483 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
059ec3d9 484 if (fd < 0)
17c76198 485 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
059ec3d9
PH
486 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
487
17c76198
PP
488 DEBUG(D_tls) debug_printf("generating %d bits Diffie-Hellman key ...\n", dh_bits);
489 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits);
490 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
491
492 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
493 and I confirmed that a NULL call to get the size first is how the GnuTLS
494 sample apps handle this. */
495
496 sz = 0;
497 m.data = NULL;
498 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
499 m.data, &sz);
500 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
501 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
502 m.size = sz;
b5aea5e1
PH
503 m.data = malloc(m.size);
504 if (m.data == NULL)
17c76198
PP
505 return tls_error(US"memory allocation failed", strerror(errno), NULL);
506 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
507 m.data, &sz);
508 if (rc != GNUTLS_E_SUCCESS)
509 {
510 free(m.data);
511 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
512 }
059ec3d9 513
17c76198
PP
514 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
515 if (sz != m.size)
516 {
517 free(m.data);
518 return tls_error(US"TLS cache write D-H params failed",
519 strerror(errno), NULL);
520 }
b5aea5e1 521 free(m.data);
17c76198
PP
522 sz = write_to_fd_buf(fd, US"\n", 1);
523 if (sz != 1)
524 return tls_error(US"TLS cache write D-H params final newline failed",
525 strerror(errno), NULL);
526
527 rc = close(fd);
528 if (rc)
529 return tls_error(US"TLS cache write close() failed",
530 strerror(errno), NULL);
059ec3d9 531
17c76198
PP
532 if (Urename(temp_fn, filename) < 0)
533 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
534 temp_fn, filename), strerror(errno), NULL);
059ec3d9 535
17c76198 536 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
537 }
538
17c76198 539DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
540return OK;
541}
542
543
544
545
546/*************************************************
17c76198 547* Variables re-expanded post-SNI *
059ec3d9
PH
548*************************************************/
549
17c76198
PP
550/* Called from both server and client code, via tls_init(), and also from
551the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
552
553We can tell the two apart by state->received_sni being non-NULL in callback.
554
555The callback should not call us unless state->trigger_sni_changes is true,
556which we are responsible for setting on the first pass through.
059ec3d9
PH
557
558Arguments:
17c76198 559 state exim_gnutls_state_st *
059ec3d9
PH
560
561Returns: OK/DEFER/FAIL
562*/
563
564static int
17c76198 565tls_expand_session_files(exim_gnutls_state_st *state)
059ec3d9 566{
1365611d 567struct stat statbuf;
059ec3d9 568int rc;
17c76198
PP
569const host_item *host = state->host; /* macro should be reconsidered? */
570uschar *saved_tls_certificate = NULL;
571uschar *saved_tls_privatekey = NULL;
572uschar *saved_tls_verify_certificates = NULL;
573uschar *saved_tls_crl = NULL;
574int cert_count;
575
576/* We check for tls_sni *before* expansion. */
577if (!state->host)
578 {
579 if (!state->received_sni)
580 {
619b2b25 581 if (state->tls_certificate && Ustrstr(state->tls_certificate, US"tls_sni"))
17c76198
PP
582 {
583 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
584 state->trigger_sni_changes = TRUE;
585 }
586 }
587 else
588 {
1365611d 589 /* useful for debugging */
17c76198
PP
590 saved_tls_certificate = state->exp_tls_certificate;
591 saved_tls_privatekey = state->exp_tls_privatekey;
592 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
593 saved_tls_crl = state->exp_tls_crl;
594 }
595 }
059ec3d9 596
1365611d
PP
597rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
598exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
599
17c76198
PP
600/* remember: expand_check_tlsvar() is expand_check() but fiddling with
601state members, assuming consistent naming; and expand_check() returns
602false if expansion failed, unless expansion was forced to fail. */
059ec3d9 603
17c76198
PP
604/* check if we at least have a certificate, before doing expensive
605D-H generation. */
059ec3d9 606
17c76198
PP
607if (!expand_check_tlsvar(tls_certificate))
608 return DEFER;
059ec3d9 609
17c76198 610/* certificate is mandatory in server, optional in client */
059ec3d9 611
17c76198
PP
612if ((state->exp_tls_certificate == NULL) ||
613 (*state->exp_tls_certificate == '\0'))
614 {
615 if (state->host == NULL)
616 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
617 else
618 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
619 }
059ec3d9 620
17c76198 621if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
059ec3d9
PH
622 return DEFER;
623
17c76198
PP
624/* tls_privatekey is optional, defaulting to same file as certificate */
625
626if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 627 {
17c76198
PP
628 state->tls_privatekey = state->tls_certificate;
629 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 630 }
c91535f3 631
059ec3d9 632
17c76198 633if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
634 {
635 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
636 state->exp_tls_certificate, state->exp_tls_privatekey);
637
638 if (state->received_sni)
de365ded 639 {
17c76198
PP
640 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
641 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
642 {
b34fc30c 643 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
644 }
645 else
646 {
b34fc30c 647 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 648 }
8e669ac1 649 }
059ec3d9 650
1365611d
PP
651 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
652 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
653 GNUTLS_X509_FMT_PEM);
654 exim_gnutls_err_check(
655 string_sprintf("cert/key setup: cert=%s key=%s",
656 state->exp_tls_certificate, state->exp_tls_privatekey));
657 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
b34fc30c 658 } /* tls_certificate */
059ec3d9
PH
659
660/* Set the trusted CAs file if one is provided, and then add the CRL if one is
661provided. Experiment shows that, if the certificate file is empty, an unhelpful
662error message is provided. However, if we just refrain from setting anything up
663in that case, certificate verification fails, which seems to be the correct
664behaviour. */
665
17c76198 666if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 667 {
17c76198 668 if (!expand_check_tlsvar(tls_verify_certificates))
059ec3d9 669 return DEFER;
17c76198
PP
670 if (state->tls_crl && *state->tls_crl)
671 if (!expand_check_tlsvar(tls_crl))
672 return DEFER;
059ec3d9 673
1365611d
PP
674 if (!(state->exp_tls_verify_certificates &&
675 *state->exp_tls_verify_certificates))
b34fc30c
PP
676 {
677 DEBUG(D_tls)
1365611d
PP
678 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
679 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 680 return OK;
b34fc30c 681 }
1365611d 682 }
83e2f8a2
PP
683else
684 {
685 DEBUG(D_tls)
686 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
687 return OK;
688 }
17c76198 689
1365611d
PP
690if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
691 {
692 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
693 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
694 strerror(errno));
695 return DEFER;
696 }
17c76198 697
619b2b25
PP
698/* The test suite passes in /dev/null; we could check for that path explicitly,
699but who knows if someone has some weird FIFO which always dumps some certs, or
700other weirdness. The thing we really want to check is that it's not a
701directory, since while OpenSSL supports that, GnuTLS does not.
702So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
703if (S_ISDIR(statbuf.st_mode))
1365611d
PP
704 {
705 DEBUG(D_tls)
619b2b25
PP
706 debug_printf("verify certificates path is a dir: \"%s\"\n",
707 state->exp_tls_verify_certificates);
1365611d 708 log_write(0, LOG_MAIN|LOG_PANIC,
619b2b25 709 "tls_verify_certificates \"%s\" is a directory",
1365611d
PP
710 state->exp_tls_verify_certificates);
711 return DEFER;
712 }
059ec3d9 713
1365611d
PP
714DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
715 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 716
1365611d
PP
717if (statbuf.st_size == 0)
718 {
719 DEBUG(D_tls)
720 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
721 return OK;
722 }
059ec3d9 723
1365611d
PP
724cert_count = gnutls_certificate_set_x509_trust_file(state->x509_cred,
725 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
726if (cert_count < 0)
727 {
728 rc = cert_count;
729 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
730 }
731DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 732
5c8cda3a
PP
733if (state->tls_crl && *state->tls_crl &&
734 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 735 {
5c8cda3a
PP
736 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
737 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
738 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
739 if (cert_count < 0)
1365611d 740 {
5c8cda3a 741 rc = cert_count;
1365611d
PP
742 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
743 }
5c8cda3a 744 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 745 }
059ec3d9 746
059ec3d9
PH
747return OK;
748}
749
750
751
752
753/*************************************************
1365611d
PP
754* Set X.509 state variables *
755*************************************************/
756
757/* In GnuTLS, the registered cert/key are not replaced by a later
758set of a cert/key, so for SNI support we need a whole new x509_cred
759structure. Which means various other non-re-expanded pieces of state
760need to be re-set in the new struct, so the setting logic is pulled
761out to this.
762
763Arguments:
764 state exim_gnutls_state_st *
765
766Returns: OK/DEFER/FAIL
767*/
768
769static int
770tls_set_remaining_x509(exim_gnutls_state_st *state)
771{
772int rc;
773const host_item *host = state->host; /* macro should be reconsidered? */
774
775/* Create D-H parameters, or read them from the cache file. This function does
776its own SMTP error messaging. This only happens for the server, TLS D-H ignores
777client-side params. */
778
779if (!state->host)
780 {
781 if (!dh_server_params)
782 {
783 rc = init_server_dh();
784 if (rc != OK) return rc;
785 }
786 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
787 }
788
789/* Link the credentials to the session. */
790
791rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
792exim_gnutls_err_check(US"gnutls_credentials_set");
793
794return OK;
795}
796
797/*************************************************
17c76198 798* Initialize for GnuTLS *
059ec3d9
PH
799*************************************************/
800
17c76198
PP
801/* Called from both server and client code. In the case of a server, errors
802before actual TLS negotiation return DEFER.
059ec3d9
PH
803
804Arguments:
17c76198
PP
805 host connected host, if client; NULL if server
806 certificate certificate file
807 privatekey private key file
808 sni TLS SNI to send, sometimes when client; else NULL
809 cas CA certs file
810 crl CRL file
811 require_ciphers tls_require_ciphers setting
059ec3d9 812
17c76198 813Returns: OK/DEFER/FAIL
059ec3d9
PH
814*/
815
17c76198
PP
816static int
817tls_init(
818 const host_item *host,
819 const uschar *certificate,
820 const uschar *privatekey,
821 const uschar *sni,
822 const uschar *cas,
823 const uschar *crl,
824 const uschar *require_ciphers,
825 exim_gnutls_state_st **caller_state)
059ec3d9 826{
17c76198
PP
827exim_gnutls_state_st *state;
828int rc;
829size_t sz;
830const char *errpos;
831uschar *p;
832BOOL want_default_priorities;
833
834if (!exim_gnutls_base_init_done)
059ec3d9 835 {
17c76198
PP
836 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
837
838 rc = gnutls_global_init();
839 exim_gnutls_err_check(US"gnutls_global_init");
840
841#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
842 DEBUG(D_tls)
059ec3d9 843 {
17c76198
PP
844 gnutls_global_set_log_function(exim_gnutls_logger_cb);
845 /* arbitrarily chosen level; bump upto 9 for more */
846 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 847 }
17c76198
PP
848#endif
849
850 exim_gnutls_base_init_done = TRUE;
059ec3d9 851 }
059ec3d9 852
17c76198
PP
853if (host)
854 {
855 state = &state_client;
856 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
857 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
858 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
859 }
860else
861 {
862 state = &state_server;
863 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
864 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
865 rc = gnutls_init(&state->session, GNUTLS_SERVER);
866 }
867exim_gnutls_err_check(US"gnutls_init");
059ec3d9 868
17c76198 869state->host = host;
059ec3d9 870
17c76198
PP
871state->tls_certificate = certificate;
872state->tls_privatekey = privatekey;
5779e6aa 873state->tls_require_ciphers = require_ciphers;
17c76198
PP
874state->tls_sni = sni;
875state->tls_verify_certificates = cas;
876state->tls_crl = crl;
059ec3d9 877
17c76198
PP
878/* This handles the variables that might get re-expanded after TLS SNI;
879that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 880
17c76198
PP
881DEBUG(D_tls)
882 debug_printf("Expanding various TLS configuration options for session credentials.\n");
883rc = tls_expand_session_files(state);
884if (rc != OK) return rc;
059ec3d9 885
1365611d
PP
886/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
887requires a new structure afterwards. */
83da1223 888
1365611d
PP
889rc = tls_set_remaining_x509(state);
890if (rc != OK) return rc;
83da1223 891
17c76198
PP
892/* set SNI in client, only */
893if (host)
894 {
895 if (!expand_check_tlsvar(tls_sni))
896 return DEFER;
897 if (state->exp_tls_sni && *state->exp_tls_sni)
898 {
899 DEBUG(D_tls)
900 debug_printf("Setting TLS client SNI to \"%s\"\n", state->exp_tls_sni);
901 sz = Ustrlen(state->exp_tls_sni);
902 rc = gnutls_server_name_set(state->session,
903 GNUTLS_NAME_DNS, state->exp_tls_sni, sz);
904 exim_gnutls_err_check(US"gnutls_server_name_set");
905 }
906 }
907else if (state->tls_sni)
908 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
909 "have an SNI set for a client [%s]\n", state->tls_sni);
83da1223 910
17c76198
PP
911/* This is the priority string support,
912http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html
913and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
914This was backwards incompatible, but means Exim no longer needs to track
915all algorithms and provide string forms for them. */
83da1223 916
17c76198 917want_default_priorities = TRUE;
83da1223 918
17c76198 919if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 920 {
17c76198
PP
921 if (!expand_check_tlsvar(tls_require_ciphers))
922 return DEFER;
923 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 924 {
17c76198
PP
925 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
926 state->exp_tls_require_ciphers);
927
928 rc = gnutls_priority_init(&state->priority_cache,
929 CS state->exp_tls_require_ciphers, &errpos);
930 want_default_priorities = FALSE;
931 p = state->exp_tls_require_ciphers;
83da1223
PH
932 }
933 }
17c76198
PP
934if (want_default_priorities)
935 {
83e2f8a2
PP
936 DEBUG(D_tls)
937 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
938 exim_default_gnutls_priority);
17c76198
PP
939 rc = gnutls_priority_init(&state->priority_cache,
940 exim_default_gnutls_priority, &errpos);
941 p = US exim_default_gnutls_priority;
942 }
83da1223 943
17c76198
PP
944exim_gnutls_err_check(string_sprintf(
945 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
946 p, errpos - CS p, errpos));
947
948rc = gnutls_priority_set(state->session, state->priority_cache);
949exim_gnutls_err_check(US"gnutls_priority_set");
950
951gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
952
953/* Reduce security in favour of increased compatibility, if the admin
954decides to make that trade-off. */
955if (gnutls_compat_mode)
83da1223 956 {
17c76198
PP
957#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
958 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
959 gnutls_session_enable_compatibility_mode(state->session);
960#else
961 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
962#endif
83da1223
PH
963 }
964
17c76198
PP
965*caller_state = state;
966/* needs to happen before callbacks during handshake */
967current_global_tls_state = state;
968return OK;
83da1223
PH
969}
970
971
972
973
974/*************************************************
17c76198 975* Extract peer information *
059ec3d9
PH
976*************************************************/
977
17c76198 978/* Called from both server and client code.
4fe99a6c
PP
979Only this is allowed to set state->peerdn and state->have_set_peerdn
980and we use that to detect double-calls.
059ec3d9 981
75fe387d
PP
982NOTE: the state blocks last while the TLS connection is up, which is fine
983for logging in the server side, but for the client side, we log after teardown
984in src/deliver.c. While the session is up, we can twist about states and
985repoint tls_* globals, but those variables used for logging or other variable
986expansion that happens _after_ delivery need to have a longer life-time.
987
988So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
989doing this more than once per generation of a state context. We set them in
990the state context, and repoint tls_* to them. After the state goes away, the
991tls_* copies of the pointers remain valid and client delivery logging is happy.
992
993tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
994don't apply.
995
059ec3d9 996Arguments:
17c76198 997 state exim_gnutls_state_st *
059ec3d9 998
17c76198 999Returns: OK/DEFER/FAIL
059ec3d9
PH
1000*/
1001
17c76198
PP
1002static int
1003peer_status(exim_gnutls_state_st *state)
059ec3d9 1004{
75fe387d 1005uschar cipherbuf[256];
17c76198 1006const gnutls_datum *cert_list;
75fe387d 1007int old_pool, rc;
17c76198 1008unsigned int cert_list_size = 0;
4fe99a6c
PP
1009gnutls_protocol_t protocol;
1010gnutls_cipher_algorithm_t cipher;
1011gnutls_kx_algorithm_t kx;
1012gnutls_mac_algorithm_t mac;
17c76198
PP
1013gnutls_certificate_type_t ct;
1014gnutls_x509_crt_t crt;
4fe99a6c 1015uschar *p, *dn_buf;
17c76198 1016size_t sz;
059ec3d9 1017
4fe99a6c 1018if (state->have_set_peerdn)
17c76198 1019 return OK;
4fe99a6c 1020state->have_set_peerdn = TRUE;
059ec3d9 1021
4fe99a6c 1022state->peerdn = NULL;
059ec3d9 1023
4fe99a6c
PP
1024/* tls_cipher */
1025cipher = gnutls_cipher_get(state->session);
1026protocol = gnutls_protocol_get_version(state->session);
1027mac = gnutls_mac_get(state->session);
1028kx = gnutls_kx_get(state->session);
1029
75fe387d 1030string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1031 "%s:%s:%d",
1032 gnutls_protocol_get_name(protocol),
1033 gnutls_cipher_suite_get_name(kx, cipher, mac),
1034 (int) gnutls_cipher_get_key_size(cipher) * 8);
1035
1036/* I don't see a way that spaces could occur, in the current GnuTLS
1037code base, but it was a concern in the old code and perhaps older GnuTLS
1038releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1039for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1040 if (isspace(*p))
1041 *p = '-';
75fe387d
PP
1042old_pool = store_pool;
1043store_pool = POOL_PERM;
1044state->ciphersuite = string_copy(cipherbuf);
1045store_pool = old_pool;
1046tls_cipher = state->ciphersuite;
4fe99a6c
PP
1047
1048/* tls_peerdn */
17c76198 1049cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1050
17c76198
PP
1051if (cert_list == NULL || cert_list_size == 0)
1052 {
17c76198
PP
1053 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1054 cert_list, cert_list_size);
1055 if (state->verify_requirement == VERIFY_REQUIRED)
1056 return tls_error(US"certificate verification failed",
1057 "no certificate received from peer", state->host);
1058 return OK;
1059 }
059ec3d9 1060
17c76198
PP
1061ct = gnutls_certificate_type_get(state->session);
1062if (ct != GNUTLS_CRT_X509)
059ec3d9 1063 {
17c76198 1064 const char *ctn = gnutls_certificate_type_get_name(ct);
17c76198
PP
1065 DEBUG(D_tls)
1066 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1067 if (state->verify_requirement == VERIFY_REQUIRED)
1068 return tls_error(US"certificate verification not possible, unhandled type",
1069 ctn, state->host);
1070 return OK;
83da1223 1071 }
059ec3d9 1072
17c76198
PP
1073#define exim_gnutls_peer_err(Label) do { \
1074 if (rc != GNUTLS_E_SUCCESS) { \
1075 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1076 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1077 return OK; } } while (0)
1078
1079rc = gnutls_x509_crt_init(&crt);
1080exim_gnutls_peer_err(US"gnutls_x509_crt_init (crt)");
1081
1082rc = gnutls_x509_crt_import(crt, &cert_list[0], GNUTLS_X509_FMT_DER);
1083exim_gnutls_peer_err(US"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1084sz = 0;
1085rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1086if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1087 {
17c76198
PP
1088 exim_gnutls_peer_err(US"getting size for cert DN failed");
1089 return FAIL; /* should not happen */
059ec3d9 1090 }
17c76198
PP
1091dn_buf = store_get_perm(sz);
1092rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1093exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1094state->peerdn = dn_buf;
1095
1096return OK;
1097#undef exim_gnutls_peer_err
1098}
059ec3d9 1099
059ec3d9 1100
059ec3d9 1101
059ec3d9 1102
17c76198
PP
1103/*************************************************
1104* Verify peer certificate *
1105*************************************************/
059ec3d9 1106
17c76198
PP
1107/* Called from both server and client code.
1108*Should* be using a callback registered with
1109gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1110the peer information, but that's too new for some OSes.
059ec3d9 1111
17c76198
PP
1112Arguments:
1113 state exim_gnutls_state_st *
1114 error where to put an error message
059ec3d9 1115
17c76198
PP
1116Returns:
1117 FALSE if the session should be rejected
1118 TRUE if the cert is okay or we just don't care
1119*/
059ec3d9 1120
17c76198
PP
1121static BOOL
1122verify_certificate(exim_gnutls_state_st *state, const char **error)
1123{
1124int rc;
1125unsigned int verify;
1126
1127*error = NULL;
1128
1129rc = peer_status(state);
1130if (rc != OK)
e6060e2c 1131 {
17c76198
PP
1132 verify = GNUTLS_CERT_INVALID;
1133 *error = "not supplied";
1134 }
1135else
1136 {
1137 rc = gnutls_certificate_verify_peers2(state->session, &verify);
e6060e2c
NM
1138 }
1139
17c76198
PP
1140/* Handle the result of verification. INVALID seems to be set as well
1141as REVOKED, but leave the test for both. */
059ec3d9 1142
17c76198
PP
1143if ((rc < 0) || (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
1144 {
1145 state->peer_cert_verified = FALSE;
1146 if (*error == NULL)
1147 *error = ((verify & GNUTLS_CERT_REVOKED) != 0) ? "revoked" : "invalid";
059ec3d9 1148
17c76198
PP
1149 DEBUG(D_tls)
1150 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
4fe99a6c 1151 *error, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1152
17c76198
PP
1153 if (state->verify_requirement == VERIFY_REQUIRED)
1154 {
1155 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1156 return FALSE;
1157 }
1158 DEBUG(D_tls)
1159 debug_printf("TLS verify failure overriden (host in tls_try_verify_hosts)\n");
1160 }
1161else
1162 {
1163 state->peer_cert_verified = TRUE;
4fe99a6c
PP
1164 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=%s\n",
1165 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1166 }
059ec3d9 1167
17c76198 1168tls_peerdn = state->peerdn;
059ec3d9 1169
17c76198
PP
1170return TRUE;
1171}
059ec3d9 1172
17c76198
PP
1173
1174
1175
1176/* ------------------------------------------------------------------------ */
1177/* Callbacks */
1178
1179/* Logging function which can be registered with
1180 * gnutls_global_set_log_function()
1181 * gnutls_global_set_log_level() 0..9
1182 */
af3498d6 1183#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1184static void
17c76198 1185exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1186{
8c79eebf
PP
1187 size_t len = strlen(message);
1188 if (len < 1)
1189 {
1190 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1191 return;
1192 }
1193 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1194 message[len-1] == '\n' ? "" : "\n");
17c76198 1195}
af3498d6 1196#endif
059ec3d9 1197
059ec3d9 1198
17c76198
PP
1199/* Called after client hello, should handle SNI work.
1200This will always set tls_sni (state->received_sni) if available,
1201and may trigger presenting different certificates,
1202if state->trigger_sni_changes is TRUE.
059ec3d9 1203
17c76198
PP
1204Should be registered with
1205 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1206
17c76198
PP
1207"This callback must return 0 on success or a gnutls error code to terminate the
1208handshake.".
059ec3d9 1209
17c76198
PP
1210For inability to get SNI information, we return 0.
1211We only return non-zero if re-setup failed.
1212*/
44bbabb5 1213
17c76198
PP
1214static int
1215exim_sni_handling_cb(gnutls_session_t session)
1216{
1217char sni_name[MAX_HOST_LEN];
1218size_t data_len = MAX_HOST_LEN;
1219exim_gnutls_state_st *state = current_global_tls_state;
1220unsigned int sni_type;
1221int rc, old_pool;
1222
1223rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1224if (rc != GNUTLS_E_SUCCESS)
1225 {
1226 DEBUG(D_tls) {
1227 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1228 debug_printf("TLS: no SNI presented in handshake.\n");
1229 else
1230 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1231 gnutls_strerror(rc), rc);
1232 };
1233 return 0;
1234 }
1235
17c76198
PP
1236if (sni_type != GNUTLS_NAME_DNS)
1237 {
1238 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1239 return 0;
1240 }
44bbabb5 1241
17c76198
PP
1242/* We now have a UTF-8 string in sni_name */
1243old_pool = store_pool;
1244store_pool = POOL_PERM;
1245state->received_sni = string_copyn(US sni_name, data_len);
1246store_pool = old_pool;
1247
1248/* We set this one now so that variable expansions below will work */
1249tls_sni = state->received_sni;
1250
1251DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1252 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1253
1254if (!state->trigger_sni_changes)
1255 return 0;
1256
1257rc = tls_expand_session_files(state);
1258if (rc != OK)
1259 {
1260 /* If the setup of certs/etc failed before handshake, TLS would not have
1261 been offered. The best we can do now is abort. */
1262 return GNUTLS_E_APPLICATION_ERROR_MIN;
1263 }
1264
1365611d
PP
1265rc = tls_set_remaining_x509(state);
1266if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1267
1268return 0;
059ec3d9
PH
1269}
1270
1271
1272
17c76198
PP
1273
1274/* ------------------------------------------------------------------------ */
1275/* Exported functions */
1276
1277
1278
1279
059ec3d9
PH
1280/*************************************************
1281* Start a TLS session in a server *
1282*************************************************/
1283
1284/* This is called when Exim is running as a server, after having received
1285the STARTTLS command. It must respond to that command, and then negotiate
1286a TLS session.
1287
1288Arguments:
83da1223 1289 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1290
1291Returns: OK on success
1292 DEFER for errors before the start of the negotiation
1293 FAIL for errors during the negotation; the server can't
1294 continue running.
1295*/
1296
1297int
17c76198 1298tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1299{
1300int rc;
7199e1ee 1301const char *error;
17c76198 1302exim_gnutls_state_st *state = NULL;
059ec3d9
PH
1303
1304/* Check for previous activation */
17c76198 1305/* nb: this will not be TLS callout safe, needs reworking as part of that. */
059ec3d9
PH
1306
1307if (tls_active >= 0)
1308 {
17c76198 1309 tls_error(US"STARTTLS received after TLS started", "", NULL);
059ec3d9
PH
1310 smtp_printf("554 Already in TLS\r\n");
1311 return FAIL;
1312 }
1313
1314/* Initialize the library. If it fails, it will already have logged the error
1315and sent an SMTP response. */
1316
17c76198 1317DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 1318
17c76198
PP
1319rc = tls_init(NULL, tls_certificate, tls_privatekey,
1320 NULL, tls_verify_certificates, tls_crl,
1321 require_ciphers, &state);
059ec3d9
PH
1322if (rc != OK) return rc;
1323
059ec3d9
PH
1324/* If this is a host for which certificate verification is mandatory or
1325optional, set up appropriately. */
1326
059ec3d9 1327if (verify_check_host(&tls_verify_hosts) == OK)
17c76198
PP
1328 {
1329 DEBUG(D_tls) debug_printf("TLS: a client certificate will be required.\n");
1330 state->verify_requirement = VERIFY_REQUIRED;
1331 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1332 }
059ec3d9 1333else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198
PP
1334 {
1335 DEBUG(D_tls) debug_printf("TLS: a client certificate will be requested but not required.\n");
1336 state->verify_requirement = VERIFY_OPTIONAL;
1337 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1338 }
1339else
1340 {
1341 DEBUG(D_tls) debug_printf("TLS: a client certificate will not be requested.\n");
1342 state->verify_requirement = VERIFY_NONE;
1343 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1344 }
059ec3d9 1345
17c76198
PP
1346/* Register SNI handling; always, even if not in tls_certificate, so that the
1347expansion variable $tls_sni is always available. */
059ec3d9 1348
17c76198
PP
1349gnutls_handshake_set_post_client_hello_function(state->session,
1350 exim_sni_handling_cb);
059ec3d9
PH
1351
1352/* Set context and tell client to go ahead, except in the case of TLS startup
1353on connection, where outputting anything now upsets the clients and tends to
1354make them disconnect. We need to have an explicit fflush() here, to force out
1355the response. Other smtp_printf() calls do not need it, because in non-TLS
1356mode, the fflush() happens when smtp_getc() is called. */
1357
1358if (!tls_on_connect)
1359 {
1360 smtp_printf("220 TLS go ahead\r\n");
1361 fflush(smtp_out);
1362 }
1363
1364/* Now negotiate the TLS session. We put our own timer on it, since it seems
1365that the GnuTLS library doesn't. */
1366
17c76198
PP
1367gnutls_transport_set_ptr2(state->session,
1368 (gnutls_transport_ptr)fileno(smtp_in),
1369 (gnutls_transport_ptr)fileno(smtp_out));
1370state->fd_in = fileno(smtp_in);
1371state->fd_out = fileno(smtp_out);
059ec3d9
PH
1372
1373sigalrm_seen = FALSE;
1374if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198
PP
1375do
1376 {
1377 rc = gnutls_handshake(state->session);
619b2b25
PP
1378 } while ((rc == GNUTLS_E_AGAIN) ||
1379 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1380alarm(0);
1381
17c76198 1382if (rc != GNUTLS_E_SUCCESS)
059ec3d9 1383 {
17c76198
PP
1384 tls_error(US"gnutls_handshake",
1385 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
059ec3d9
PH
1386 /* It seems that, except in the case of a timeout, we have to close the
1387 connection right here; otherwise if the other end is running OpenSSL it hangs
1388 until the server times out. */
1389
1390 if (!sigalrm_seen)
1391 {
f1e894f3
PH
1392 (void)fclose(smtp_out);
1393 (void)fclose(smtp_in);
059ec3d9
PH
1394 }
1395
1396 return FAIL;
1397 }
1398
1399DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1400
17c76198
PP
1401/* Verify after the fact */
1402
1403if (state->verify_requirement != VERIFY_NONE)
059ec3d9 1404 {
17c76198
PP
1405 if (!verify_certificate(state, &error))
1406 {
1407 if (state->verify_requirement == VERIFY_OPTIONAL)
1408 {
1409 DEBUG(D_tls)
1410 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1411 error);
1412 }
1413 else
1414 {
1415 tls_error(US"certificate verification failed", error, NULL);
1416 return FAIL;
1417 }
1418 }
059ec3d9
PH
1419 }
1420
17c76198
PP
1421/* Figure out peer DN, and if authenticated, etc. */
1422
1423rc = peer_status(state);
1424if (rc != OK) return rc;
1425
1426/* Sets various Exim expansion variables; always safe within server */
1427
1428extract_exim_vars_from_tls_state(state);
059ec3d9
PH
1429
1430/* TLS has been set up. Adjust the input functions to read via TLS,
1431and initialize appropriately. */
1432
17c76198 1433state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
1434
1435receive_getc = tls_getc;
1436receive_ungetc = tls_ungetc;
1437receive_feof = tls_feof;
1438receive_ferror = tls_ferror;
58eb016e 1439receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1440
059ec3d9
PH
1441return OK;
1442}
1443
1444
1445
1446
1447/*************************************************
1448* Start a TLS session in a client *
1449*************************************************/
1450
1451/* Called from the smtp transport after STARTTLS has been accepted.
1452
1453Arguments:
1454 fd the fd of the connection
1455 host connected host (for messages)
83da1223 1456 addr the first address (not used)
17c76198 1457 dhparam DH parameter file (ignored, we're a client)
059ec3d9
PH
1458 certificate certificate file
1459 privatekey private key file
3f0945ff 1460 sni TLS SNI to send to remote host
059ec3d9
PH
1461 verify_certs file for certificate verify
1462 verify_crl CRL for verify
83da1223 1463 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1464 timeout startup timeout
1465
1466Returns: OK/DEFER/FAIL (because using common functions),
1467 but for a client, DEFER and FAIL have the same meaning
1468*/
1469
1470int
17c76198
PP
1471tls_client_start(int fd, host_item *host,
1472 address_item *addr ARG_UNUSED, uschar *dhparam ARG_UNUSED,
1473 uschar *certificate, uschar *privatekey, uschar *sni,
1474 uschar *verify_certs, uschar *verify_crl,
1475 uschar *require_ciphers, int timeout)
059ec3d9 1476{
059ec3d9 1477int rc;
17c76198
PP
1478const char *error;
1479exim_gnutls_state_st *state = NULL;
059ec3d9 1480
17c76198 1481DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 1482
17c76198
PP
1483rc = tls_init(host, certificate, privatekey,
1484 sni, verify_certs, verify_crl, require_ciphers, &state);
059ec3d9
PH
1485if (rc != OK) return rc;
1486
17c76198 1487gnutls_dh_set_prime_bits(state->session, EXIM_CLIENT_DH_MIN_BITS);
83da1223 1488
17c76198
PP
1489if (verify_certs == NULL)
1490 {
1491 DEBUG(D_tls) debug_printf("TLS: server certificate verification not required\n");
1492 state->verify_requirement = VERIFY_NONE;
1493 /* we still ask for it, to log it, etc */
1494 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1495 }
1496else
1497 {
1498 DEBUG(D_tls) debug_printf("TLS: server certificate verification required\n");
1499 state->verify_requirement = VERIFY_REQUIRED;
1500 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1501 }
059ec3d9 1502
17c76198
PP
1503gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)fd);
1504state->fd_in = fd;
1505state->fd_out = fd;
059ec3d9
PH
1506
1507/* There doesn't seem to be a built-in timeout on connection. */
1508
1509sigalrm_seen = FALSE;
1510alarm(timeout);
17c76198
PP
1511do
1512 {
1513 rc = gnutls_handshake(state->session);
619b2b25
PP
1514 } while ((rc == GNUTLS_E_AGAIN) ||
1515 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1516alarm(0);
1517
4fe99a6c
PP
1518if (rc != GNUTLS_E_SUCCESS)
1519 return tls_error(US"gnutls_handshake",
1520 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1521
17c76198 1522DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 1523
17c76198 1524/* Verify late */
059ec3d9 1525
17c76198
PP
1526if (state->verify_requirement != VERIFY_NONE &&
1527 !verify_certificate(state, &error))
1528 return tls_error(US"certificate verification failed", error, state->host);
059ec3d9 1529
17c76198 1530/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 1531
17c76198
PP
1532rc = peer_status(state);
1533if (rc != OK) return rc;
059ec3d9 1534
4fe99a6c 1535/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 1536
17c76198 1537extract_exim_vars_from_tls_state(state);
059ec3d9 1538
059ec3d9
PH
1539return OK;
1540}
1541
1542
1543
17c76198 1544
059ec3d9 1545/*************************************************
17c76198 1546* Close down a TLS session *
059ec3d9
PH
1547*************************************************/
1548
17c76198
PP
1549/* This is also called from within a delivery subprocess forked from the
1550daemon, to shut down the TLS library, without actually doing a shutdown (which
1551would tamper with the TLS session in the parent process).
059ec3d9 1552
17c76198
PP
1553Arguments: TRUE if gnutls_bye is to be called
1554Returns: nothing
059ec3d9
PH
1555*/
1556
17c76198
PP
1557void
1558tls_close(BOOL shutdown)
059ec3d9 1559{
17c76198 1560exim_gnutls_state_st *state = current_global_tls_state;
059ec3d9 1561
17c76198
PP
1562if (tls_active < 0) return; /* TLS was not active */
1563
1564if (shutdown)
1565 {
1566 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1567 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1568 }
1569
1570gnutls_deinit(state->session);
1571
1572memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1573
1574if ((state_server.session == NULL) && (state_client.session == NULL))
1575 {
1576 gnutls_global_deinit();
1577 exim_gnutls_base_init_done = FALSE;
1578 }
7199e1ee 1579
17c76198 1580tls_active = -1;
059ec3d9
PH
1581}
1582
1583
1584
17c76198 1585
059ec3d9
PH
1586/*************************************************
1587* TLS version of getc *
1588*************************************************/
1589
1590/* This gets the next byte from the TLS input buffer. If the buffer is empty,
1591it refills the buffer via the GnuTLS reading function.
1592
17c76198
PP
1593This feeds DKIM and should be used for all message-body reads.
1594
059ec3d9
PH
1595Arguments: none
1596Returns: the next character or EOF
1597*/
1598
1599int
1600tls_getc(void)
1601{
17c76198
PP
1602exim_gnutls_state_st *state = current_global_tls_state;
1603if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
059ec3d9 1604 {
17c76198 1605 ssize_t inbytes;
059ec3d9 1606
17c76198
PP
1607 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1608 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
1609
1610 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 1611 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
059ec3d9
PH
1612 ssl_xfer_buffer_size);
1613 alarm(0);
1614
1615 /* A zero-byte return appears to mean that the TLS session has been
1616 closed down, not that the socket itself has been closed down. Revert to
1617 non-TLS handling. */
1618
1619 if (inbytes == 0)
1620 {
1621 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1622
1623 receive_getc = smtp_getc;
1624 receive_ungetc = smtp_ungetc;
1625 receive_feof = smtp_feof;
1626 receive_ferror = smtp_ferror;
58eb016e 1627 receive_smtp_buffered = smtp_buffered;
059ec3d9 1628
17c76198
PP
1629 gnutls_deinit(state->session);
1630 state->session = NULL;
059ec3d9 1631 tls_active = -1;
17c76198
PP
1632 tls_bits = 0;
1633 tls_certificate_verified = FALSE;
1634 tls_channelbinding_b64 = NULL;
059ec3d9
PH
1635 tls_cipher = NULL;
1636 tls_peerdn = NULL;
1637
1638 return smtp_getc();
1639 }
1640
1641 /* Handle genuine errors */
1642
1643 else if (inbytes < 0)
1644 {
17c76198
PP
1645 record_io_error(state, (int) inbytes, US"recv", NULL);
1646 state->xfer_error = 1;
059ec3d9
PH
1647 return EOF;
1648 }
80a47a2c 1649#ifndef DISABLE_DKIM
17c76198 1650 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
80a47a2c 1651#endif
17c76198
PP
1652 state->xfer_buffer_hwm = (int) inbytes;
1653 state->xfer_buffer_lwm = 0;
059ec3d9
PH
1654 }
1655
059ec3d9
PH
1656/* Something in the buffer; return next uschar */
1657
17c76198 1658return state->xfer_buffer[state->xfer_buffer_lwm++];
059ec3d9
PH
1659}
1660
1661
1662
17c76198 1663
059ec3d9
PH
1664/*************************************************
1665* Read bytes from TLS channel *
1666*************************************************/
1667
17c76198
PP
1668/* This does not feed DKIM, so if the caller uses this for reading message body,
1669then the caller must feed DKIM.
059ec3d9
PH
1670Arguments:
1671 buff buffer of data
1672 len size of buffer
1673
1674Returns: the number of bytes read
1675 -1 after a failed read
1676*/
1677
1678int
1679tls_read(uschar *buff, size_t len)
1680{
17c76198
PP
1681exim_gnutls_state_st *state = current_global_tls_state;
1682ssize_t inbytes;
059ec3d9 1683
17c76198
PP
1684if (len > INT_MAX)
1685 len = INT_MAX;
059ec3d9 1686
17c76198
PP
1687if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
1688 DEBUG(D_tls)
1689 debug_printf("*** PROBABLY A BUG *** " \
1690 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1691 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
1692
1693DEBUG(D_tls)
1694 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
1695 state->session, buff, len);
1696
1697inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
1698if (inbytes > 0) return inbytes;
1699if (inbytes == 0)
1700 {
1701 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1702 }
17c76198 1703else record_io_error(state, (int)inbytes, US"recv", NULL);
059ec3d9
PH
1704
1705return -1;
1706}
1707
1708
1709
17c76198 1710
059ec3d9
PH
1711/*************************************************
1712* Write bytes down TLS channel *
1713*************************************************/
1714
1715/*
1716Arguments:
1717 buff buffer of data
1718 len number of bytes
1719
1720Returns: the number of bytes after a successful write,
1721 -1 after a failed write
1722*/
1723
1724int
1725tls_write(const uschar *buff, size_t len)
1726{
17c76198
PP
1727ssize_t outbytes;
1728size_t left = len;
1729exim_gnutls_state_st *state = current_global_tls_state;
059ec3d9 1730
17c76198 1731DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
059ec3d9
PH
1732while (left > 0)
1733 {
17c76198
PP
1734 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
1735 buff, left);
1736 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 1737
17c76198 1738 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
1739 if (outbytes < 0)
1740 {
17c76198 1741 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
1742 return -1;
1743 }
1744 if (outbytes == 0)
1745 {
17c76198 1746 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
1747 return -1;
1748 }
1749
1750 left -= outbytes;
1751 buff += outbytes;
1752 }
1753
17c76198
PP
1754if (len > INT_MAX)
1755 {
1756 DEBUG(D_tls)
1757 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
1758 len);
1759 len = INT_MAX;
1760 }
1761
1762return (int) len;
059ec3d9
PH
1763}
1764
1765
1766
17c76198 1767
059ec3d9 1768/*************************************************
17c76198 1769* Random number generation *
059ec3d9
PH
1770*************************************************/
1771
17c76198
PP
1772/* Pseudo-random number generation. The result is not expected to be
1773cryptographically strong but not so weak that someone will shoot themselves
1774in the foot using it as a nonce in input in some email header scheme or
1775whatever weirdness they'll twist this into. The result should handle fork()
1776and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 1777
17c76198
PP
1778Arguments:
1779 max range maximum
1780Returns a random number in range [0, max-1]
059ec3d9
PH
1781*/
1782
af3498d6 1783#ifdef HAVE_GNUTLS_RND
17c76198
PP
1784int
1785vaguely_random_number(int max)
059ec3d9 1786{
17c76198
PP
1787unsigned int r;
1788int i, needed_len;
1789uschar *p;
1790uschar smallbuf[sizeof(r)];
1791
1792if (max <= 1)
1793 return 0;
1794
1795needed_len = sizeof(r);
1796/* Don't take 8 times more entropy than needed if int is 8 octets and we were
1797 * asked for a number less than 10. */
1798for (r = max, i = 0; r; ++i)
1799 r >>= 1;
1800i = (i + 7) / 8;
1801if (i < needed_len)
1802 needed_len = i;
1803
1804i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
1805if (i < 0)
059ec3d9 1806 {
17c76198
PP
1807 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
1808 return vaguely_random_number_fallback(max);
1809 }
1810r = 0;
1811for (p = smallbuf; needed_len; --needed_len, ++p)
1812 {
1813 r *= 256;
1814 r += *p;
059ec3d9
PH
1815 }
1816
17c76198
PP
1817/* We don't particularly care about weighted results; if someone wants
1818 * smooth distribution and cares enough then they should submit a patch then. */
1819return r % max;
059ec3d9 1820}
af3498d6
PP
1821#else /* HAVE_GNUTLS_RND */
1822int
1823vaguely_random_number(int max)
1824{
1825 return vaguely_random_number_fallback(max);
1826}
1827#endif /* HAVE_GNUTLS_RND */
059ec3d9 1828
36f12725
NM
1829
1830
1831
1832/*************************************************
1833* Report the library versions. *
1834*************************************************/
1835
1836/* See a description in tls-openssl.c for an explanation of why this exists.
1837
1838Arguments: a FILE* to print the results to
1839Returns: nothing
1840*/
1841
1842void
1843tls_version_report(FILE *f)
1844{
754a0503
PP
1845fprintf(f, "Library version: GnuTLS: Compile: %s\n"
1846 " Runtime: %s\n",
1847 LIBGNUTLS_VERSION,
1848 gnutls_check_version(NULL));
36f12725
NM
1849}
1850
059ec3d9 1851/* End of tls-gnu.c */