GnuTLS website moves
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
17c76198 5/* Copyright (c) University of Cambridge 1995 - 2012 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
16Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
a5f239e4
PP
42/* needed to disable PKCS11 autoload unless requested */
43#if GNUTLS_VERSION_NUMBER >= 0x020c00
44# include <gnutls/pkcs11.h>
45#endif
059ec3d9 46
17c76198 47/* GnuTLS 2 vs 3
059ec3d9 48
17c76198
PP
49GnuTLS 3 only:
50 gnutls_global_set_audit_log_function()
059ec3d9 51
17c76198
PP
52Changes:
53 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
54*/
059ec3d9 55
17c76198 56/* Local static variables for GnuTLS */
059ec3d9 57
17c76198 58/* Values for verify_requirement */
059ec3d9 59
17c76198 60enum peer_verify_requirement { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
059ec3d9 61
17c76198
PP
62/* This holds most state for server or client; with this, we can set up an
63outbound TLS-enabled connection in an ACL callout, while not stomping all
64over the TLS variables available for expansion.
059ec3d9 65
17c76198
PP
66Some of these correspond to variables in globals.c; those variables will
67be set to point to content in one of these instances, as appropriate for
68the stage of the process lifetime.
059ec3d9 69
389ca47a 70Not handled here: global tls_channelbinding_b64.
17c76198 71*/
059ec3d9 72
17c76198
PP
73typedef struct exim_gnutls_state {
74 gnutls_session_t session;
75 gnutls_certificate_credentials_t x509_cred;
76 gnutls_priority_t priority_cache;
77 enum peer_verify_requirement verify_requirement;
78 int fd_in;
79 int fd_out;
80 BOOL peer_cert_verified;
81 BOOL trigger_sni_changes;
4fe99a6c 82 BOOL have_set_peerdn;
17c76198
PP
83 const struct host_item *host;
84 uschar *peerdn;
75fe387d 85 uschar *ciphersuite;
17c76198
PP
86 uschar *received_sni;
87
88 const uschar *tls_certificate;
89 const uschar *tls_privatekey;
90 const uschar *tls_sni; /* client send only, not received */
91 const uschar *tls_verify_certificates;
92 const uschar *tls_crl;
93 const uschar *tls_require_ciphers;
94 uschar *exp_tls_certificate;
95 uschar *exp_tls_privatekey;
96 uschar *exp_tls_sni;
97 uschar *exp_tls_verify_certificates;
98 uschar *exp_tls_crl;
99 uschar *exp_tls_require_ciphers;
100
389ca47a 101 tls_support *tlsp; /* set in tls_init() */
817d9f57 102
17c76198
PP
103 uschar *xfer_buffer;
104 int xfer_buffer_lwm;
105 int xfer_buffer_hwm;
106 int xfer_eof;
107 int xfer_error;
17c76198
PP
108} exim_gnutls_state_st;
109
110static const exim_gnutls_state_st exim_gnutls_state_init = {
4fe99a6c 111 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
75fe387d 112 NULL, NULL, NULL, NULL,
17c76198
PP
113 NULL, NULL, NULL, NULL, NULL, NULL,
114 NULL, NULL, NULL, NULL, NULL, NULL,
817d9f57 115 NULL,
17c76198 116 NULL, 0, 0, 0, 0,
17c76198 117};
83da1223 118
17c76198
PP
119/* Not only do we have our own APIs which don't pass around state, assuming
120it's held in globals, GnuTLS doesn't appear to let us register callback data
121for callbacks, or as part of the session, so we have to keep a "this is the
122context we're currently dealing with" pointer and rely upon being
123single-threaded to keep from processing data on an inbound TLS connection while
124talking to another TLS connection for an outbound check. This does mean that
125there's no way for heart-beats to be responded to, for the duration of the
126second connection. */
059ec3d9 127
17c76198 128static exim_gnutls_state_st state_server, state_client;
059ec3d9 129
17c76198
PP
130/* dh_params are initialised once within the lifetime of a process using TLS;
131if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
132don't want to repeat this. */
83da1223 133
17c76198 134static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 135
17c76198 136/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 137
17c76198 138static const int ssl_session_timeout = 200;
059ec3d9 139
17c76198 140static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 141
17c76198 142/* Guard library core initialisation */
83da1223 143
17c76198 144static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 145
059ec3d9 146
17c76198 147/* ------------------------------------------------------------------------ */
17c76198 148/* macros */
83da1223 149
17c76198 150#define MAX_HOST_LEN 255
83da1223 151
17c76198
PP
152/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
153the library logging; a value less than 0 disables the calls to set up logging
154callbacks. */
2c17bb02 155#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
17c76198 156#define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 157#endif
83da1223 158
2c17bb02 159#ifndef EXIM_CLIENT_DH_MIN_BITS
bba74fc6 160#define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 161#endif
83da1223 162
af3498d6
PP
163/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
164can ask for a bit-strength. Without that, we stick to the constant we had
165before, for now. */
2c17bb02 166#ifndef EXIM_SERVER_DH_BITS_PRE2_12
af3498d6 167#define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 168#endif
af3498d6 169
17c76198
PP
170#define exim_gnutls_err_check(Label) do { \
171 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
059ec3d9 172
17c76198 173#define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
83da1223 174
17c76198
PP
175#if GNUTLS_VERSION_NUMBER >= 0x020c00
176#define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
af3498d6
PP
177#define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
178#define HAVE_GNUTLS_RND
a5f239e4 179#define HAVE_GNUTLS_PKCS11
17c76198 180#endif
83da1223 181
af3498d6
PP
182
183
184
185/* ------------------------------------------------------------------------ */
186/* Callback declarations */
187
188#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
189static void exim_gnutls_logger_cb(int level, const char *message);
190#endif
191
192static int exim_sni_handling_cb(gnutls_session_t session);
193
194
195
196
17c76198
PP
197/* ------------------------------------------------------------------------ */
198/* Static functions */
059ec3d9
PH
199
200/*************************************************
201* Handle TLS error *
202*************************************************/
203
204/* Called from lots of places when errors occur before actually starting to do
205the TLS handshake, that is, while the session is still in clear. Always returns
206DEFER for a server and FAIL for a client so that most calls can use "return
207tls_error(...)" to do this processing and then give an appropriate return. A
208single function is used for both server and client, because it is called from
209some shared functions.
210
211Argument:
212 prefix text to include in the logged error
7199e1ee
TF
213 msg additional error string (may be NULL)
214 usually obtained from gnutls_strerror()
17c76198
PP
215 host NULL if setting up a server;
216 the connected host if setting up a client
059ec3d9
PH
217
218Returns: OK/DEFER/FAIL
219*/
220
221static int
17c76198 222tls_error(const uschar *prefix, const char *msg, const host_item *host)
059ec3d9 223{
17c76198
PP
224if (host)
225 {
226 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
227 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
228 return FAIL;
229 }
230else
059ec3d9 231 {
7199e1ee 232 uschar *conn_info = smtp_get_connection_info();
17c76198 233 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee
TF
234 conn_info += 5;
235 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
17c76198 236 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
059ec3d9
PH
237 return DEFER;
238 }
059ec3d9
PH
239}
240
241
242
17c76198 243
059ec3d9 244/*************************************************
17c76198 245* Deal with logging errors during I/O *
059ec3d9
PH
246*************************************************/
247
17c76198 248/* We have to get the identity of the peer from saved data.
059ec3d9 249
17c76198
PP
250Argument:
251 state the current GnuTLS exim state container
252 rc the GnuTLS error code, or 0 if it's a local error
253 when text identifying read or write
254 text local error text when ec is 0
059ec3d9 255
17c76198 256Returns: nothing
059ec3d9
PH
257*/
258
17c76198
PP
259static void
260record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 261{
17c76198 262const char *msg;
059ec3d9 263
17c76198
PP
264if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
265 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
266 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
267else
268 msg = gnutls_strerror(rc);
059ec3d9 269
17c76198
PP
270tls_error(when, msg, state->host);
271}
059ec3d9 272
059ec3d9 273
059ec3d9 274
059ec3d9 275
17c76198
PP
276/*************************************************
277* Set various Exim expansion vars *
278*************************************************/
059ec3d9 279
17c76198
PP
280/* We set various Exim global variables from the state, once a session has
281been established. With TLS callouts, may need to change this to stack
282variables, or just re-call it with the server state after client callout
283has finished.
059ec3d9 284
17c76198
PP
285Make sure anything set here is inset in tls_getc().
286
287Sets:
288 tls_active fd
289 tls_bits strength indicator
290 tls_certificate_verified bool indicator
291 tls_channelbinding_b64 for some SASL mechanisms
292 tls_cipher a string
293 tls_peerdn a string
294 tls_sni a (UTF-8) string
17c76198
PP
295
296Argument:
297 state the relevant exim_gnutls_state_st *
298*/
299
300static void
817d9f57 301extract_exim_vars_from_tls_state(exim_gnutls_state_st *state, BOOL is_server)
17c76198 302{
17c76198 303gnutls_cipher_algorithm_t cipher;
17c76198
PP
304#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
305int old_pool;
306int rc;
307gnutls_datum_t channel;
308#endif
309
817d9f57 310state->tlsp->active = state->fd_out;
17c76198
PP
311
312cipher = gnutls_cipher_get(state->session);
313/* returns size in "bytes" */
817d9f57 314state->tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 315
817d9f57 316state->tlsp->cipher = state->ciphersuite;
17c76198 317
817d9f57 318DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 319
817d9f57 320state->tlsp->certificate_verified = state->peer_cert_verified;
059ec3d9 321
17c76198
PP
322/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
323only available for use for authenticators while this TLS session is running. */
324
325tls_channelbinding_b64 = NULL;
326#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
327channel.data = NULL;
328channel.size = 0;
329rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
330if (rc) {
331 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
332} else {
333 old_pool = store_pool;
334 store_pool = POOL_PERM;
335 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
336 store_pool = old_pool;
337 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
338}
339#endif
340
817d9f57
JH
341state->tlsp->peerdn = state->peerdn;
342state->tlsp->sni = state->received_sni;
059ec3d9
PH
343}
344
345
346
17c76198 347
059ec3d9 348/*************************************************
575643cd 349* Setup up DH parameters *
059ec3d9
PH
350*************************************************/
351
575643cd 352/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
353be re-generated every so often, depending on security policy. What we do is to
354keep these parameters in a file in the spool directory. If the file does not
355exist, we generate them. This means that it is easy to cause a regeneration.
356
357The new file is written as a temporary file and renamed, so that an incomplete
358file is never present. If two processes both compute some new parameters, you
359waste a bit of effort, but it doesn't seem worth messing around with locking to
360prevent this.
361
059ec3d9
PH
362Returns: OK/DEFER/FAIL
363*/
364
365static int
17c76198 366init_server_dh(void)
059ec3d9 367{
17c76198
PP
368int fd, rc;
369unsigned int dh_bits;
b5aea5e1 370gnutls_datum m;
a799883d
PP
371uschar filename_buf[PATH_MAX];
372uschar *filename = NULL;
17c76198 373size_t sz;
a799883d
PP
374uschar *exp_tls_dhparam;
375BOOL use_file_in_spool = FALSE;
376BOOL use_fixed_file = FALSE;
17c76198 377host_item *host = NULL; /* dummy for macros */
059ec3d9 378
17c76198 379DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 380
17c76198
PP
381rc = gnutls_dh_params_init(&dh_server_params);
382exim_gnutls_err_check(US"gnutls_dh_params_init");
059ec3d9 383
a799883d
PP
384m.data = NULL;
385m.size = 0;
386
387if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
388 return DEFER;
389
390if (!exp_tls_dhparam)
391 {
392 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
393 m.data = US std_dh_prime_default();
394 m.size = Ustrlen(m.data);
395 }
396else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
397 use_file_in_spool = TRUE;
398else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
399 {
400 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
401 return OK;
402 }
403else if (exp_tls_dhparam[0] != '/')
404 {
405 m.data = US std_dh_prime_named(exp_tls_dhparam);
406 if (m.data == NULL)
407 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
408 m.size = Ustrlen(m.data);
409 }
410else
411 {
412 use_fixed_file = TRUE;
413 filename = exp_tls_dhparam;
414 }
415
416if (m.data)
417 {
418 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
419 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
420 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
421 return OK;
422 }
423
af3498d6
PP
424#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
425/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
426different filename and ensure we have sufficient bits. */
427dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
428if (!dh_bits)
429 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
af3498d6 430DEBUG(D_tls)
b34fc30c 431 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
432 dh_bits);
433#else
434dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
435DEBUG(D_tls)
436 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
437 dh_bits);
438#endif
059ec3d9 439
3375e053
PP
440/* Some clients have hard-coded limits. */
441if (dh_bits > tls_dh_max_bits)
442 {
443 DEBUG(D_tls)
444 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
445 tls_dh_max_bits);
446 dh_bits = tls_dh_max_bits;
447 }
448
a799883d
PP
449if (use_file_in_spool)
450 {
451 if (!string_format(filename_buf, sizeof(filename_buf),
452 "%s/gnutls-params-%d", spool_directory, dh_bits))
453 return tls_error(US"overlong filename", NULL, NULL);
454 filename = filename_buf;
455 }
059ec3d9 456
b5aea5e1 457/* Open the cache file for reading and if successful, read it and set up the
575643cd 458parameters. */
059ec3d9
PH
459
460fd = Uopen(filename, O_RDONLY, 0);
b5aea5e1 461if (fd >= 0)
059ec3d9 462 {
b5aea5e1 463 struct stat statbuf;
17c76198
PP
464 FILE *fp;
465 int saved_errno;
466
467 if (fstat(fd, &statbuf) < 0) /* EIO */
468 {
469 saved_errno = errno;
470 (void)close(fd);
471 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
472 }
473 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
474 {
475 (void)close(fd);
17c76198
PP
476 return tls_error(US"TLS cache not a file", NULL, NULL);
477 }
478 fp = fdopen(fd, "rb");
479 if (!fp)
480 {
481 saved_errno = errno;
482 (void)close(fd);
483 return tls_error(US"fdopen(TLS cache stat fd) failed",
484 strerror(saved_errno), NULL);
b5aea5e1 485 }
059ec3d9 486
b5aea5e1
PH
487 m.size = statbuf.st_size;
488 m.data = malloc(m.size);
489 if (m.data == NULL)
17c76198
PP
490 {
491 fclose(fp);
492 return tls_error(US"malloc failed", strerror(errno), NULL);
493 }
494 sz = fread(m.data, m.size, 1, fp);
495 if (!sz)
496 {
497 saved_errno = errno;
498 fclose(fp);
499 free(m.data);
500 return tls_error(US"fread failed", strerror(saved_errno), NULL);
501 }
502 fclose(fp);
b5aea5e1 503
17c76198 504 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 505 free(m.data);
17c76198
PP
506 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
507 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
508 }
509
510/* If the file does not exist, fall through to compute new data and cache it.
511If there was any other opening error, it is serious. */
512
182ad5cf
PH
513else if (errno == ENOENT)
514 {
17c76198 515 rc = -1;
182ad5cf 516 DEBUG(D_tls)
17c76198 517 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
518 }
519else
17c76198
PP
520 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
521 NULL, NULL);
b5aea5e1
PH
522
523/* If ret < 0, either the cache file does not exist, or the data it contains
524is not useful. One particular case of this is when upgrading from an older
525release of Exim in which the data was stored in a different format. We don't
526try to be clever and support both formats; we just regenerate new data in this
527case. */
528
17c76198 529if (rc < 0)
b5aea5e1 530 {
17c76198 531 uschar *temp_fn;
201f5254 532 unsigned int dh_bits_gen = dh_bits;
059ec3d9 533
17c76198
PP
534 if ((PATH_MAX - Ustrlen(filename)) < 10)
535 return tls_error(US"Filename too long to generate replacement",
536 CS filename, NULL);
059ec3d9 537
17c76198
PP
538 temp_fn = string_copy(US "%s.XXXXXXX");
539 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
059ec3d9 540 if (fd < 0)
17c76198 541 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
059ec3d9
PH
542 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
543
201f5254
PP
544 /* GnuTLS overshoots!
545 * If we ask for 2236, we might get 2237 or more.
546 * But there's no way to ask GnuTLS how many bits there really are.
547 * We can ask how many bits were used in a TLS session, but that's it!
548 * The prime itself is hidden behind too much abstraction.
549 * So we ask for less, and proceed on a wing and a prayer.
550 * First attempt, subtracted 3 for 2233 and got 2240.
551 */
cae6e576 552 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
553 {
554 dh_bits_gen = dh_bits - 10;
555 DEBUG(D_tls)
556 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
557 dh_bits_gen);
558 }
559
560 DEBUG(D_tls)
561 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
562 dh_bits_gen);
563 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
17c76198
PP
564 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
565
566 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
567 and I confirmed that a NULL call to get the size first is how the GnuTLS
568 sample apps handle this. */
569
570 sz = 0;
571 m.data = NULL;
572 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
573 m.data, &sz);
574 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
575 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
576 m.size = sz;
b5aea5e1
PH
577 m.data = malloc(m.size);
578 if (m.data == NULL)
17c76198 579 return tls_error(US"memory allocation failed", strerror(errno), NULL);
1f00591e 580 /* this will return a size 1 less than the allocation size above */
17c76198 581 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 582 m.data, &sz);
17c76198
PP
583 if (rc != GNUTLS_E_SUCCESS)
584 {
585 free(m.data);
586 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
587 }
1f00591e 588 m.size = sz; /* shrink by 1, probably */
059ec3d9 589
17c76198
PP
590 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
591 if (sz != m.size)
592 {
593 free(m.data);
594 return tls_error(US"TLS cache write D-H params failed",
595 strerror(errno), NULL);
596 }
b5aea5e1 597 free(m.data);
17c76198
PP
598 sz = write_to_fd_buf(fd, US"\n", 1);
599 if (sz != 1)
600 return tls_error(US"TLS cache write D-H params final newline failed",
601 strerror(errno), NULL);
602
603 rc = close(fd);
604 if (rc)
605 return tls_error(US"TLS cache write close() failed",
606 strerror(errno), NULL);
059ec3d9 607
17c76198
PP
608 if (Urename(temp_fn, filename) < 0)
609 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
610 temp_fn, filename), strerror(errno), NULL);
059ec3d9 611
17c76198 612 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
613 }
614
17c76198 615DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
616return OK;
617}
618
619
620
621
622/*************************************************
17c76198 623* Variables re-expanded post-SNI *
059ec3d9
PH
624*************************************************/
625
17c76198
PP
626/* Called from both server and client code, via tls_init(), and also from
627the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
628
629We can tell the two apart by state->received_sni being non-NULL in callback.
630
631The callback should not call us unless state->trigger_sni_changes is true,
632which we are responsible for setting on the first pass through.
059ec3d9
PH
633
634Arguments:
17c76198 635 state exim_gnutls_state_st *
059ec3d9
PH
636
637Returns: OK/DEFER/FAIL
638*/
639
640static int
17c76198 641tls_expand_session_files(exim_gnutls_state_st *state)
059ec3d9 642{
1365611d 643struct stat statbuf;
059ec3d9 644int rc;
17c76198
PP
645const host_item *host = state->host; /* macro should be reconsidered? */
646uschar *saved_tls_certificate = NULL;
647uschar *saved_tls_privatekey = NULL;
648uschar *saved_tls_verify_certificates = NULL;
649uschar *saved_tls_crl = NULL;
650int cert_count;
651
652/* We check for tls_sni *before* expansion. */
653if (!state->host)
654 {
655 if (!state->received_sni)
656 {
d9b2312b
JH
657 if (state->tls_certificate &&
658 (Ustrstr(state->tls_certificate, US"tls_sni") ||
659 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
660 Ustrstr(state->tls_certificate, US"tls_out_sni")
661 ))
17c76198
PP
662 {
663 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
664 state->trigger_sni_changes = TRUE;
665 }
666 }
667 else
668 {
1365611d 669 /* useful for debugging */
17c76198
PP
670 saved_tls_certificate = state->exp_tls_certificate;
671 saved_tls_privatekey = state->exp_tls_privatekey;
672 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
673 saved_tls_crl = state->exp_tls_crl;
674 }
675 }
059ec3d9 676
1365611d
PP
677rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
678exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
679
17c76198
PP
680/* remember: expand_check_tlsvar() is expand_check() but fiddling with
681state members, assuming consistent naming; and expand_check() returns
682false if expansion failed, unless expansion was forced to fail. */
059ec3d9 683
17c76198
PP
684/* check if we at least have a certificate, before doing expensive
685D-H generation. */
059ec3d9 686
17c76198
PP
687if (!expand_check_tlsvar(tls_certificate))
688 return DEFER;
059ec3d9 689
17c76198 690/* certificate is mandatory in server, optional in client */
059ec3d9 691
17c76198
PP
692if ((state->exp_tls_certificate == NULL) ||
693 (*state->exp_tls_certificate == '\0'))
694 {
695 if (state->host == NULL)
696 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
697 else
698 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
699 }
059ec3d9 700
17c76198 701if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
059ec3d9
PH
702 return DEFER;
703
17c76198
PP
704/* tls_privatekey is optional, defaulting to same file as certificate */
705
706if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 707 {
17c76198
PP
708 state->tls_privatekey = state->tls_certificate;
709 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 710 }
c91535f3 711
059ec3d9 712
17c76198 713if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
714 {
715 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
716 state->exp_tls_certificate, state->exp_tls_privatekey);
717
718 if (state->received_sni)
de365ded 719 {
17c76198
PP
720 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
721 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
722 {
b34fc30c 723 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
724 }
725 else
726 {
b34fc30c 727 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 728 }
8e669ac1 729 }
059ec3d9 730
1365611d
PP
731 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
732 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
733 GNUTLS_X509_FMT_PEM);
734 exim_gnutls_err_check(
735 string_sprintf("cert/key setup: cert=%s key=%s",
736 state->exp_tls_certificate, state->exp_tls_privatekey));
737 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
b34fc30c 738 } /* tls_certificate */
059ec3d9
PH
739
740/* Set the trusted CAs file if one is provided, and then add the CRL if one is
741provided. Experiment shows that, if the certificate file is empty, an unhelpful
742error message is provided. However, if we just refrain from setting anything up
743in that case, certificate verification fails, which seems to be the correct
744behaviour. */
745
17c76198 746if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 747 {
17c76198 748 if (!expand_check_tlsvar(tls_verify_certificates))
059ec3d9 749 return DEFER;
17c76198
PP
750 if (state->tls_crl && *state->tls_crl)
751 if (!expand_check_tlsvar(tls_crl))
752 return DEFER;
059ec3d9 753
1365611d
PP
754 if (!(state->exp_tls_verify_certificates &&
755 *state->exp_tls_verify_certificates))
b34fc30c
PP
756 {
757 DEBUG(D_tls)
1365611d
PP
758 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
759 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 760 return OK;
b34fc30c 761 }
1365611d 762 }
83e2f8a2
PP
763else
764 {
765 DEBUG(D_tls)
766 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
767 return OK;
768 }
17c76198 769
1365611d
PP
770if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
771 {
772 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
773 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
774 strerror(errno));
775 return DEFER;
776 }
17c76198 777
619b2b25
PP
778/* The test suite passes in /dev/null; we could check for that path explicitly,
779but who knows if someone has some weird FIFO which always dumps some certs, or
780other weirdness. The thing we really want to check is that it's not a
781directory, since while OpenSSL supports that, GnuTLS does not.
782So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
783if (S_ISDIR(statbuf.st_mode))
1365611d
PP
784 {
785 DEBUG(D_tls)
619b2b25
PP
786 debug_printf("verify certificates path is a dir: \"%s\"\n",
787 state->exp_tls_verify_certificates);
1365611d 788 log_write(0, LOG_MAIN|LOG_PANIC,
619b2b25 789 "tls_verify_certificates \"%s\" is a directory",
1365611d
PP
790 state->exp_tls_verify_certificates);
791 return DEFER;
792 }
059ec3d9 793
1365611d
PP
794DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
795 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 796
1365611d
PP
797if (statbuf.st_size == 0)
798 {
799 DEBUG(D_tls)
800 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
801 return OK;
802 }
059ec3d9 803
1365611d
PP
804cert_count = gnutls_certificate_set_x509_trust_file(state->x509_cred,
805 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
806if (cert_count < 0)
807 {
808 rc = cert_count;
809 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
810 }
811DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 812
5c8cda3a
PP
813if (state->tls_crl && *state->tls_crl &&
814 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 815 {
5c8cda3a
PP
816 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
817 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
818 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
819 if (cert_count < 0)
1365611d 820 {
5c8cda3a 821 rc = cert_count;
1365611d
PP
822 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
823 }
5c8cda3a 824 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 825 }
059ec3d9 826
059ec3d9
PH
827return OK;
828}
829
830
831
832
833/*************************************************
1365611d
PP
834* Set X.509 state variables *
835*************************************************/
836
837/* In GnuTLS, the registered cert/key are not replaced by a later
838set of a cert/key, so for SNI support we need a whole new x509_cred
839structure. Which means various other non-re-expanded pieces of state
840need to be re-set in the new struct, so the setting logic is pulled
841out to this.
842
843Arguments:
844 state exim_gnutls_state_st *
845
846Returns: OK/DEFER/FAIL
847*/
848
849static int
850tls_set_remaining_x509(exim_gnutls_state_st *state)
851{
852int rc;
853const host_item *host = state->host; /* macro should be reconsidered? */
854
855/* Create D-H parameters, or read them from the cache file. This function does
856its own SMTP error messaging. This only happens for the server, TLS D-H ignores
857client-side params. */
858
859if (!state->host)
860 {
861 if (!dh_server_params)
862 {
863 rc = init_server_dh();
864 if (rc != OK) return rc;
865 }
866 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
867 }
868
869/* Link the credentials to the session. */
870
871rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
872exim_gnutls_err_check(US"gnutls_credentials_set");
873
874return OK;
875}
876
877/*************************************************
17c76198 878* Initialize for GnuTLS *
059ec3d9
PH
879*************************************************/
880
17c76198
PP
881/* Called from both server and client code. In the case of a server, errors
882before actual TLS negotiation return DEFER.
059ec3d9
PH
883
884Arguments:
17c76198
PP
885 host connected host, if client; NULL if server
886 certificate certificate file
887 privatekey private key file
888 sni TLS SNI to send, sometimes when client; else NULL
889 cas CA certs file
890 crl CRL file
891 require_ciphers tls_require_ciphers setting
817d9f57 892 caller_state returned state-info structure
059ec3d9 893
17c76198 894Returns: OK/DEFER/FAIL
059ec3d9
PH
895*/
896
17c76198
PP
897static int
898tls_init(
899 const host_item *host,
900 const uschar *certificate,
901 const uschar *privatekey,
902 const uschar *sni,
903 const uschar *cas,
904 const uschar *crl,
905 const uschar *require_ciphers,
906 exim_gnutls_state_st **caller_state)
059ec3d9 907{
17c76198
PP
908exim_gnutls_state_st *state;
909int rc;
910size_t sz;
911const char *errpos;
912uschar *p;
913BOOL want_default_priorities;
914
915if (!exim_gnutls_base_init_done)
059ec3d9 916 {
17c76198
PP
917 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
918
a5f239e4
PP
919#ifdef HAVE_GNUTLS_PKCS11
920 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
921 which loads modules from a config file, which sounds good and may be wanted
922 by some sysadmin, but also means in common configurations that GNOME keyring
923 environment variables are used and so breaks for users calling mailq.
924 To prevent this, we init PKCS11 first, which is the documented approach. */
925 if (!gnutls_enable_pkcs11)
926 {
927 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
928 exim_gnutls_err_check(US"gnutls_pkcs11_init");
929 }
930#endif
931
17c76198
PP
932 rc = gnutls_global_init();
933 exim_gnutls_err_check(US"gnutls_global_init");
934
935#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
936 DEBUG(D_tls)
059ec3d9 937 {
17c76198
PP
938 gnutls_global_set_log_function(exim_gnutls_logger_cb);
939 /* arbitrarily chosen level; bump upto 9 for more */
940 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 941 }
17c76198
PP
942#endif
943
944 exim_gnutls_base_init_done = TRUE;
059ec3d9 945 }
059ec3d9 946
17c76198
PP
947if (host)
948 {
949 state = &state_client;
950 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 951 state->tlsp = &tls_out;
17c76198
PP
952 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
953 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
954 }
955else
956 {
957 state = &state_server;
958 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 959 state->tlsp = &tls_in;
17c76198
PP
960 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
961 rc = gnutls_init(&state->session, GNUTLS_SERVER);
962 }
963exim_gnutls_err_check(US"gnutls_init");
059ec3d9 964
17c76198 965state->host = host;
059ec3d9 966
17c76198
PP
967state->tls_certificate = certificate;
968state->tls_privatekey = privatekey;
5779e6aa 969state->tls_require_ciphers = require_ciphers;
17c76198
PP
970state->tls_sni = sni;
971state->tls_verify_certificates = cas;
972state->tls_crl = crl;
059ec3d9 973
17c76198
PP
974/* This handles the variables that might get re-expanded after TLS SNI;
975that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 976
17c76198
PP
977DEBUG(D_tls)
978 debug_printf("Expanding various TLS configuration options for session credentials.\n");
979rc = tls_expand_session_files(state);
980if (rc != OK) return rc;
059ec3d9 981
1365611d
PP
982/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
983requires a new structure afterwards. */
83da1223 984
1365611d
PP
985rc = tls_set_remaining_x509(state);
986if (rc != OK) return rc;
83da1223 987
17c76198
PP
988/* set SNI in client, only */
989if (host)
990 {
a5f239e4 991 if (!expand_check(state->tlsp->sni, US"tls_out_sni", &state->exp_tls_sni))
17c76198
PP
992 return DEFER;
993 if (state->exp_tls_sni && *state->exp_tls_sni)
994 {
995 DEBUG(D_tls)
996 debug_printf("Setting TLS client SNI to \"%s\"\n", state->exp_tls_sni);
997 sz = Ustrlen(state->exp_tls_sni);
998 rc = gnutls_server_name_set(state->session,
999 GNUTLS_NAME_DNS, state->exp_tls_sni, sz);
1000 exim_gnutls_err_check(US"gnutls_server_name_set");
1001 }
1002 }
1003else if (state->tls_sni)
1004 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1005 "have an SNI set for a client [%s]\n", state->tls_sni);
83da1223 1006
17c76198 1007/* This is the priority string support,
42bfef1e 1008http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1009and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1010This was backwards incompatible, but means Exim no longer needs to track
1011all algorithms and provide string forms for them. */
83da1223 1012
17c76198 1013want_default_priorities = TRUE;
83da1223 1014
17c76198 1015if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1016 {
17c76198
PP
1017 if (!expand_check_tlsvar(tls_require_ciphers))
1018 return DEFER;
1019 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1020 {
17c76198
PP
1021 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1022 state->exp_tls_require_ciphers);
1023
1024 rc = gnutls_priority_init(&state->priority_cache,
1025 CS state->exp_tls_require_ciphers, &errpos);
1026 want_default_priorities = FALSE;
1027 p = state->exp_tls_require_ciphers;
83da1223
PH
1028 }
1029 }
17c76198
PP
1030if (want_default_priorities)
1031 {
83e2f8a2
PP
1032 DEBUG(D_tls)
1033 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1034 exim_default_gnutls_priority);
17c76198
PP
1035 rc = gnutls_priority_init(&state->priority_cache,
1036 exim_default_gnutls_priority, &errpos);
1037 p = US exim_default_gnutls_priority;
1038 }
83da1223 1039
17c76198
PP
1040exim_gnutls_err_check(string_sprintf(
1041 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1042 p, errpos - CS p, errpos));
1043
1044rc = gnutls_priority_set(state->session, state->priority_cache);
1045exim_gnutls_err_check(US"gnutls_priority_set");
1046
1047gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1048
1049/* Reduce security in favour of increased compatibility, if the admin
1050decides to make that trade-off. */
1051if (gnutls_compat_mode)
83da1223 1052 {
17c76198
PP
1053#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1054 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1055 gnutls_session_enable_compatibility_mode(state->session);
1056#else
1057 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1058#endif
83da1223
PH
1059 }
1060
17c76198 1061*caller_state = state;
17c76198 1062return OK;
83da1223
PH
1063}
1064
1065
1066
1067
1068/*************************************************
17c76198 1069* Extract peer information *
059ec3d9
PH
1070*************************************************/
1071
17c76198 1072/* Called from both server and client code.
4fe99a6c
PP
1073Only this is allowed to set state->peerdn and state->have_set_peerdn
1074and we use that to detect double-calls.
059ec3d9 1075
75fe387d
PP
1076NOTE: the state blocks last while the TLS connection is up, which is fine
1077for logging in the server side, but for the client side, we log after teardown
1078in src/deliver.c. While the session is up, we can twist about states and
1079repoint tls_* globals, but those variables used for logging or other variable
1080expansion that happens _after_ delivery need to have a longer life-time.
1081
1082So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1083doing this more than once per generation of a state context. We set them in
1084the state context, and repoint tls_* to them. After the state goes away, the
1085tls_* copies of the pointers remain valid and client delivery logging is happy.
1086
1087tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1088don't apply.
1089
059ec3d9 1090Arguments:
17c76198 1091 state exim_gnutls_state_st *
059ec3d9 1092
17c76198 1093Returns: OK/DEFER/FAIL
059ec3d9
PH
1094*/
1095
17c76198
PP
1096static int
1097peer_status(exim_gnutls_state_st *state)
059ec3d9 1098{
75fe387d 1099uschar cipherbuf[256];
17c76198 1100const gnutls_datum *cert_list;
75fe387d 1101int old_pool, rc;
17c76198 1102unsigned int cert_list_size = 0;
4fe99a6c
PP
1103gnutls_protocol_t protocol;
1104gnutls_cipher_algorithm_t cipher;
1105gnutls_kx_algorithm_t kx;
1106gnutls_mac_algorithm_t mac;
17c76198
PP
1107gnutls_certificate_type_t ct;
1108gnutls_x509_crt_t crt;
4fe99a6c 1109uschar *p, *dn_buf;
17c76198 1110size_t sz;
059ec3d9 1111
4fe99a6c 1112if (state->have_set_peerdn)
17c76198 1113 return OK;
4fe99a6c 1114state->have_set_peerdn = TRUE;
059ec3d9 1115
4fe99a6c 1116state->peerdn = NULL;
059ec3d9 1117
4fe99a6c
PP
1118/* tls_cipher */
1119cipher = gnutls_cipher_get(state->session);
1120protocol = gnutls_protocol_get_version(state->session);
1121mac = gnutls_mac_get(state->session);
1122kx = gnutls_kx_get(state->session);
1123
75fe387d 1124string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1125 "%s:%s:%d",
1126 gnutls_protocol_get_name(protocol),
1127 gnutls_cipher_suite_get_name(kx, cipher, mac),
1128 (int) gnutls_cipher_get_key_size(cipher) * 8);
1129
1130/* I don't see a way that spaces could occur, in the current GnuTLS
1131code base, but it was a concern in the old code and perhaps older GnuTLS
1132releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1133for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1134 if (isspace(*p))
1135 *p = '-';
75fe387d
PP
1136old_pool = store_pool;
1137store_pool = POOL_PERM;
1138state->ciphersuite = string_copy(cipherbuf);
1139store_pool = old_pool;
817d9f57 1140state->tlsp->cipher = state->ciphersuite;
4fe99a6c
PP
1141
1142/* tls_peerdn */
17c76198 1143cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1144
17c76198
PP
1145if (cert_list == NULL || cert_list_size == 0)
1146 {
17c76198
PP
1147 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1148 cert_list, cert_list_size);
1149 if (state->verify_requirement == VERIFY_REQUIRED)
1150 return tls_error(US"certificate verification failed",
1151 "no certificate received from peer", state->host);
1152 return OK;
1153 }
059ec3d9 1154
17c76198
PP
1155ct = gnutls_certificate_type_get(state->session);
1156if (ct != GNUTLS_CRT_X509)
059ec3d9 1157 {
17c76198 1158 const char *ctn = gnutls_certificate_type_get_name(ct);
17c76198
PP
1159 DEBUG(D_tls)
1160 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1161 if (state->verify_requirement == VERIFY_REQUIRED)
1162 return tls_error(US"certificate verification not possible, unhandled type",
1163 ctn, state->host);
1164 return OK;
83da1223 1165 }
059ec3d9 1166
17c76198
PP
1167#define exim_gnutls_peer_err(Label) do { \
1168 if (rc != GNUTLS_E_SUCCESS) { \
1169 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1170 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1171 return OK; } } while (0)
1172
1173rc = gnutls_x509_crt_init(&crt);
1174exim_gnutls_peer_err(US"gnutls_x509_crt_init (crt)");
1175
1176rc = gnutls_x509_crt_import(crt, &cert_list[0], GNUTLS_X509_FMT_DER);
1177exim_gnutls_peer_err(US"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1178sz = 0;
1179rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1180if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1181 {
17c76198
PP
1182 exim_gnutls_peer_err(US"getting size for cert DN failed");
1183 return FAIL; /* should not happen */
059ec3d9 1184 }
17c76198
PP
1185dn_buf = store_get_perm(sz);
1186rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1187exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1188state->peerdn = dn_buf;
1189
1190return OK;
1191#undef exim_gnutls_peer_err
1192}
059ec3d9 1193
059ec3d9 1194
059ec3d9 1195
059ec3d9 1196
17c76198
PP
1197/*************************************************
1198* Verify peer certificate *
1199*************************************************/
059ec3d9 1200
17c76198
PP
1201/* Called from both server and client code.
1202*Should* be using a callback registered with
1203gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1204the peer information, but that's too new for some OSes.
059ec3d9 1205
17c76198
PP
1206Arguments:
1207 state exim_gnutls_state_st *
1208 error where to put an error message
059ec3d9 1209
17c76198
PP
1210Returns:
1211 FALSE if the session should be rejected
1212 TRUE if the cert is okay or we just don't care
1213*/
059ec3d9 1214
17c76198
PP
1215static BOOL
1216verify_certificate(exim_gnutls_state_st *state, const char **error)
1217{
1218int rc;
1219unsigned int verify;
1220
1221*error = NULL;
1222
1223rc = peer_status(state);
1224if (rc != OK)
e6060e2c 1225 {
17c76198
PP
1226 verify = GNUTLS_CERT_INVALID;
1227 *error = "not supplied";
1228 }
1229else
1230 {
1231 rc = gnutls_certificate_verify_peers2(state->session, &verify);
e6060e2c
NM
1232 }
1233
17c76198
PP
1234/* Handle the result of verification. INVALID seems to be set as well
1235as REVOKED, but leave the test for both. */
059ec3d9 1236
17c76198
PP
1237if ((rc < 0) || (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
1238 {
1239 state->peer_cert_verified = FALSE;
1240 if (*error == NULL)
1241 *error = ((verify & GNUTLS_CERT_REVOKED) != 0) ? "revoked" : "invalid";
059ec3d9 1242
17c76198
PP
1243 DEBUG(D_tls)
1244 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
4fe99a6c 1245 *error, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1246
17c76198
PP
1247 if (state->verify_requirement == VERIFY_REQUIRED)
1248 {
1249 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1250 return FALSE;
1251 }
1252 DEBUG(D_tls)
4789da3a 1253 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198
PP
1254 }
1255else
1256 {
1257 state->peer_cert_verified = TRUE;
4fe99a6c
PP
1258 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=%s\n",
1259 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1260 }
059ec3d9 1261
817d9f57 1262state->tlsp->peerdn = state->peerdn;
059ec3d9 1263
17c76198
PP
1264return TRUE;
1265}
059ec3d9 1266
17c76198
PP
1267
1268
1269
1270/* ------------------------------------------------------------------------ */
1271/* Callbacks */
1272
1273/* Logging function which can be registered with
1274 * gnutls_global_set_log_function()
1275 * gnutls_global_set_log_level() 0..9
1276 */
af3498d6 1277#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1278static void
17c76198 1279exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1280{
8c79eebf
PP
1281 size_t len = strlen(message);
1282 if (len < 1)
1283 {
1284 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1285 return;
1286 }
1287 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1288 message[len-1] == '\n' ? "" : "\n");
17c76198 1289}
af3498d6 1290#endif
059ec3d9 1291
059ec3d9 1292
17c76198
PP
1293/* Called after client hello, should handle SNI work.
1294This will always set tls_sni (state->received_sni) if available,
1295and may trigger presenting different certificates,
1296if state->trigger_sni_changes is TRUE.
059ec3d9 1297
17c76198
PP
1298Should be registered with
1299 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1300
17c76198
PP
1301"This callback must return 0 on success or a gnutls error code to terminate the
1302handshake.".
059ec3d9 1303
17c76198
PP
1304For inability to get SNI information, we return 0.
1305We only return non-zero if re-setup failed.
817d9f57 1306Only used for server-side TLS.
17c76198 1307*/
44bbabb5 1308
17c76198
PP
1309static int
1310exim_sni_handling_cb(gnutls_session_t session)
1311{
1312char sni_name[MAX_HOST_LEN];
1313size_t data_len = MAX_HOST_LEN;
817d9f57 1314exim_gnutls_state_st *state = &state_server;
17c76198
PP
1315unsigned int sni_type;
1316int rc, old_pool;
1317
1318rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1319if (rc != GNUTLS_E_SUCCESS)
1320 {
1321 DEBUG(D_tls) {
1322 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1323 debug_printf("TLS: no SNI presented in handshake.\n");
1324 else
1325 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1326 gnutls_strerror(rc), rc);
1327 };
1328 return 0;
1329 }
1330
17c76198
PP
1331if (sni_type != GNUTLS_NAME_DNS)
1332 {
1333 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1334 return 0;
1335 }
44bbabb5 1336
17c76198
PP
1337/* We now have a UTF-8 string in sni_name */
1338old_pool = store_pool;
1339store_pool = POOL_PERM;
1340state->received_sni = string_copyn(US sni_name, data_len);
1341store_pool = old_pool;
1342
1343/* We set this one now so that variable expansions below will work */
817d9f57 1344state->tlsp->sni = state->received_sni;
17c76198
PP
1345
1346DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1347 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1348
1349if (!state->trigger_sni_changes)
1350 return 0;
1351
1352rc = tls_expand_session_files(state);
1353if (rc != OK)
1354 {
1355 /* If the setup of certs/etc failed before handshake, TLS would not have
1356 been offered. The best we can do now is abort. */
1357 return GNUTLS_E_APPLICATION_ERROR_MIN;
1358 }
1359
1365611d
PP
1360rc = tls_set_remaining_x509(state);
1361if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1362
1363return 0;
059ec3d9
PH
1364}
1365
1366
1367
17c76198
PP
1368
1369/* ------------------------------------------------------------------------ */
1370/* Exported functions */
1371
1372
1373
1374
059ec3d9
PH
1375/*************************************************
1376* Start a TLS session in a server *
1377*************************************************/
1378
1379/* This is called when Exim is running as a server, after having received
1380the STARTTLS command. It must respond to that command, and then negotiate
1381a TLS session.
1382
1383Arguments:
83da1223 1384 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1385
1386Returns: OK on success
1387 DEFER for errors before the start of the negotiation
1388 FAIL for errors during the negotation; the server can't
1389 continue running.
1390*/
1391
1392int
17c76198 1393tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1394{
1395int rc;
7199e1ee 1396const char *error;
17c76198 1397exim_gnutls_state_st *state = NULL;
059ec3d9
PH
1398
1399/* Check for previous activation */
817d9f57 1400if (tls_in.active >= 0)
059ec3d9 1401 {
17c76198 1402 tls_error(US"STARTTLS received after TLS started", "", NULL);
059ec3d9
PH
1403 smtp_printf("554 Already in TLS\r\n");
1404 return FAIL;
1405 }
1406
1407/* Initialize the library. If it fails, it will already have logged the error
1408and sent an SMTP response. */
1409
17c76198 1410DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 1411
17c76198
PP
1412rc = tls_init(NULL, tls_certificate, tls_privatekey,
1413 NULL, tls_verify_certificates, tls_crl,
1414 require_ciphers, &state);
059ec3d9
PH
1415if (rc != OK) return rc;
1416
059ec3d9
PH
1417/* If this is a host for which certificate verification is mandatory or
1418optional, set up appropriately. */
1419
059ec3d9 1420if (verify_check_host(&tls_verify_hosts) == OK)
17c76198
PP
1421 {
1422 DEBUG(D_tls) debug_printf("TLS: a client certificate will be required.\n");
1423 state->verify_requirement = VERIFY_REQUIRED;
1424 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1425 }
059ec3d9 1426else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198
PP
1427 {
1428 DEBUG(D_tls) debug_printf("TLS: a client certificate will be requested but not required.\n");
1429 state->verify_requirement = VERIFY_OPTIONAL;
1430 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1431 }
1432else
1433 {
1434 DEBUG(D_tls) debug_printf("TLS: a client certificate will not be requested.\n");
1435 state->verify_requirement = VERIFY_NONE;
1436 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1437 }
059ec3d9 1438
17c76198
PP
1439/* Register SNI handling; always, even if not in tls_certificate, so that the
1440expansion variable $tls_sni is always available. */
059ec3d9 1441
17c76198
PP
1442gnutls_handshake_set_post_client_hello_function(state->session,
1443 exim_sni_handling_cb);
059ec3d9
PH
1444
1445/* Set context and tell client to go ahead, except in the case of TLS startup
1446on connection, where outputting anything now upsets the clients and tends to
1447make them disconnect. We need to have an explicit fflush() here, to force out
1448the response. Other smtp_printf() calls do not need it, because in non-TLS
1449mode, the fflush() happens when smtp_getc() is called. */
1450
817d9f57 1451if (!state->tlsp->on_connect)
059ec3d9
PH
1452 {
1453 smtp_printf("220 TLS go ahead\r\n");
817d9f57 1454 fflush(smtp_out); /*XXX JGH */
059ec3d9
PH
1455 }
1456
1457/* Now negotiate the TLS session. We put our own timer on it, since it seems
1458that the GnuTLS library doesn't. */
1459
17c76198
PP
1460gnutls_transport_set_ptr2(state->session,
1461 (gnutls_transport_ptr)fileno(smtp_in),
1462 (gnutls_transport_ptr)fileno(smtp_out));
1463state->fd_in = fileno(smtp_in);
1464state->fd_out = fileno(smtp_out);
059ec3d9
PH
1465
1466sigalrm_seen = FALSE;
1467if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198
PP
1468do
1469 {
1470 rc = gnutls_handshake(state->session);
619b2b25
PP
1471 } while ((rc == GNUTLS_E_AGAIN) ||
1472 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1473alarm(0);
1474
17c76198 1475if (rc != GNUTLS_E_SUCCESS)
059ec3d9 1476 {
17c76198
PP
1477 tls_error(US"gnutls_handshake",
1478 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
059ec3d9
PH
1479 /* It seems that, except in the case of a timeout, we have to close the
1480 connection right here; otherwise if the other end is running OpenSSL it hangs
1481 until the server times out. */
1482
1483 if (!sigalrm_seen)
1484 {
f1e894f3
PH
1485 (void)fclose(smtp_out);
1486 (void)fclose(smtp_in);
059ec3d9
PH
1487 }
1488
1489 return FAIL;
1490 }
1491
1492DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1493
17c76198
PP
1494/* Verify after the fact */
1495
1496if (state->verify_requirement != VERIFY_NONE)
059ec3d9 1497 {
17c76198
PP
1498 if (!verify_certificate(state, &error))
1499 {
1500 if (state->verify_requirement == VERIFY_OPTIONAL)
1501 {
1502 DEBUG(D_tls)
1503 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1504 error);
1505 }
1506 else
1507 {
1508 tls_error(US"certificate verification failed", error, NULL);
1509 return FAIL;
1510 }
1511 }
059ec3d9
PH
1512 }
1513
17c76198
PP
1514/* Figure out peer DN, and if authenticated, etc. */
1515
1516rc = peer_status(state);
1517if (rc != OK) return rc;
1518
1519/* Sets various Exim expansion variables; always safe within server */
1520
817d9f57 1521extract_exim_vars_from_tls_state(state, TRUE);
059ec3d9
PH
1522
1523/* TLS has been set up. Adjust the input functions to read via TLS,
1524and initialize appropriately. */
1525
17c76198 1526state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
1527
1528receive_getc = tls_getc;
1529receive_ungetc = tls_ungetc;
1530receive_feof = tls_feof;
1531receive_ferror = tls_ferror;
58eb016e 1532receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1533
059ec3d9
PH
1534return OK;
1535}
1536
1537
1538
1539
1540/*************************************************
1541* Start a TLS session in a client *
1542*************************************************/
1543
1544/* Called from the smtp transport after STARTTLS has been accepted.
1545
1546Arguments:
1547 fd the fd of the connection
1548 host connected host (for messages)
83da1223 1549 addr the first address (not used)
059ec3d9
PH
1550 certificate certificate file
1551 privatekey private key file
3f0945ff 1552 sni TLS SNI to send to remote host
059ec3d9
PH
1553 verify_certs file for certificate verify
1554 verify_crl CRL for verify
83da1223 1555 require_ciphers list of allowed ciphers or NULL
54c90be1 1556 dh_min_bits minimum number of bits acceptable in server's DH prime
059ec3d9
PH
1557 timeout startup timeout
1558
1559Returns: OK/DEFER/FAIL (because using common functions),
1560 but for a client, DEFER and FAIL have the same meaning
1561*/
1562
1563int
17c76198 1564tls_client_start(int fd, host_item *host,
f5d78688 1565 address_item *addr ARG_UNUSED,
17c76198
PP
1566 uschar *certificate, uschar *privatekey, uschar *sni,
1567 uschar *verify_certs, uschar *verify_crl,
f5d78688
JH
1568 uschar *require_ciphers,
1569#ifdef EXPERIMENTAL_OCSP
1570 uschar *require_ocsp ARG_UNUSED,
1571#endif
1572 int dh_min_bits, int timeout)
059ec3d9 1573{
059ec3d9 1574int rc;
17c76198
PP
1575const char *error;
1576exim_gnutls_state_st *state = NULL;
059ec3d9 1577
17c76198 1578DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 1579
17c76198
PP
1580rc = tls_init(host, certificate, privatekey,
1581 sni, verify_certs, verify_crl, require_ciphers, &state);
059ec3d9
PH
1582if (rc != OK) return rc;
1583
54c90be1
PP
1584if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1585 {
1586 DEBUG(D_tls)
1587 debug_printf("WARNING: tls_dh_min_bits far too low, clamping %d up to %d\n",
1588 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1589 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1590 }
1591
1592DEBUG(D_tls) debug_printf("Setting D-H prime minimum acceptable bits to %d\n",
1593 dh_min_bits);
1594gnutls_dh_set_prime_bits(state->session, dh_min_bits);
83da1223 1595
17c76198
PP
1596if (verify_certs == NULL)
1597 {
1598 DEBUG(D_tls) debug_printf("TLS: server certificate verification not required\n");
1599 state->verify_requirement = VERIFY_NONE;
1600 /* we still ask for it, to log it, etc */
1601 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1602 }
1603else
1604 {
1605 DEBUG(D_tls) debug_printf("TLS: server certificate verification required\n");
1606 state->verify_requirement = VERIFY_REQUIRED;
1607 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1608 }
059ec3d9 1609
17c76198
PP
1610gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)fd);
1611state->fd_in = fd;
1612state->fd_out = fd;
059ec3d9
PH
1613
1614/* There doesn't seem to be a built-in timeout on connection. */
1615
1616sigalrm_seen = FALSE;
1617alarm(timeout);
17c76198
PP
1618do
1619 {
1620 rc = gnutls_handshake(state->session);
619b2b25
PP
1621 } while ((rc == GNUTLS_E_AGAIN) ||
1622 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1623alarm(0);
1624
4fe99a6c
PP
1625if (rc != GNUTLS_E_SUCCESS)
1626 return tls_error(US"gnutls_handshake",
1627 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1628
17c76198 1629DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 1630
17c76198 1631/* Verify late */
059ec3d9 1632
17c76198
PP
1633if (state->verify_requirement != VERIFY_NONE &&
1634 !verify_certificate(state, &error))
1635 return tls_error(US"certificate verification failed", error, state->host);
059ec3d9 1636
17c76198 1637/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 1638
17c76198
PP
1639rc = peer_status(state);
1640if (rc != OK) return rc;
059ec3d9 1641
4fe99a6c 1642/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 1643
817d9f57 1644extract_exim_vars_from_tls_state(state, FALSE);
059ec3d9 1645
059ec3d9
PH
1646return OK;
1647}
1648
1649
1650
17c76198 1651
059ec3d9 1652/*************************************************
17c76198 1653* Close down a TLS session *
059ec3d9
PH
1654*************************************************/
1655
17c76198
PP
1656/* This is also called from within a delivery subprocess forked from the
1657daemon, to shut down the TLS library, without actually doing a shutdown (which
1658would tamper with the TLS session in the parent process).
059ec3d9 1659
17c76198
PP
1660Arguments: TRUE if gnutls_bye is to be called
1661Returns: nothing
059ec3d9
PH
1662*/
1663
17c76198 1664void
817d9f57 1665tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 1666{
817d9f57 1667exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 1668
389ca47a 1669if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
17c76198
PP
1670
1671if (shutdown)
1672 {
1673 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1674 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1675 }
1676
1677gnutls_deinit(state->session);
1678
389ca47a 1679state->tlsp->active = -1;
17c76198
PP
1680memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1681
1682if ((state_server.session == NULL) && (state_client.session == NULL))
1683 {
1684 gnutls_global_deinit();
1685 exim_gnutls_base_init_done = FALSE;
1686 }
7199e1ee 1687
059ec3d9
PH
1688}
1689
1690
1691
17c76198 1692
059ec3d9
PH
1693/*************************************************
1694* TLS version of getc *
1695*************************************************/
1696
1697/* This gets the next byte from the TLS input buffer. If the buffer is empty,
1698it refills the buffer via the GnuTLS reading function.
817d9f57 1699Only used by the server-side TLS.
059ec3d9 1700
17c76198
PP
1701This feeds DKIM and should be used for all message-body reads.
1702
059ec3d9
PH
1703Arguments: none
1704Returns: the next character or EOF
1705*/
1706
1707int
1708tls_getc(void)
1709{
817d9f57 1710exim_gnutls_state_st *state = &state_server;
17c76198 1711if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
059ec3d9 1712 {
17c76198 1713 ssize_t inbytes;
059ec3d9 1714
17c76198
PP
1715 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1716 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
1717
1718 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 1719 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
059ec3d9
PH
1720 ssl_xfer_buffer_size);
1721 alarm(0);
1722
1723 /* A zero-byte return appears to mean that the TLS session has been
1724 closed down, not that the socket itself has been closed down. Revert to
1725 non-TLS handling. */
1726
1727 if (inbytes == 0)
1728 {
1729 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1730
1731 receive_getc = smtp_getc;
1732 receive_ungetc = smtp_ungetc;
1733 receive_feof = smtp_feof;
1734 receive_ferror = smtp_ferror;
58eb016e 1735 receive_smtp_buffered = smtp_buffered;
059ec3d9 1736
17c76198
PP
1737 gnutls_deinit(state->session);
1738 state->session = NULL;
817d9f57
JH
1739 state->tlsp->active = -1;
1740 state->tlsp->bits = 0;
1741 state->tlsp->certificate_verified = FALSE;
1742 tls_channelbinding_b64 = NULL; /*XXX JGH */
1743 state->tlsp->cipher = NULL;
1744 state->tlsp->peerdn = NULL;
059ec3d9
PH
1745
1746 return smtp_getc();
1747 }
1748
1749 /* Handle genuine errors */
1750
1751 else if (inbytes < 0)
1752 {
17c76198
PP
1753 record_io_error(state, (int) inbytes, US"recv", NULL);
1754 state->xfer_error = 1;
059ec3d9
PH
1755 return EOF;
1756 }
80a47a2c 1757#ifndef DISABLE_DKIM
17c76198 1758 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
80a47a2c 1759#endif
17c76198
PP
1760 state->xfer_buffer_hwm = (int) inbytes;
1761 state->xfer_buffer_lwm = 0;
059ec3d9
PH
1762 }
1763
059ec3d9
PH
1764/* Something in the buffer; return next uschar */
1765
17c76198 1766return state->xfer_buffer[state->xfer_buffer_lwm++];
059ec3d9
PH
1767}
1768
1769
1770
17c76198 1771
059ec3d9
PH
1772/*************************************************
1773* Read bytes from TLS channel *
1774*************************************************/
1775
17c76198
PP
1776/* This does not feed DKIM, so if the caller uses this for reading message body,
1777then the caller must feed DKIM.
817d9f57 1778
059ec3d9
PH
1779Arguments:
1780 buff buffer of data
1781 len size of buffer
1782
1783Returns: the number of bytes read
1784 -1 after a failed read
1785*/
1786
1787int
817d9f57 1788tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 1789{
817d9f57 1790exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
17c76198 1791ssize_t inbytes;
059ec3d9 1792
17c76198
PP
1793if (len > INT_MAX)
1794 len = INT_MAX;
059ec3d9 1795
17c76198
PP
1796if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
1797 DEBUG(D_tls)
1798 debug_printf("*** PROBABLY A BUG *** " \
1799 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1800 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
1801
1802DEBUG(D_tls)
1803 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
1804 state->session, buff, len);
1805
1806inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
1807if (inbytes > 0) return inbytes;
1808if (inbytes == 0)
1809 {
1810 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1811 }
17c76198 1812else record_io_error(state, (int)inbytes, US"recv", NULL);
059ec3d9
PH
1813
1814return -1;
1815}
1816
1817
1818
17c76198 1819
059ec3d9
PH
1820/*************************************************
1821* Write bytes down TLS channel *
1822*************************************************/
1823
1824/*
1825Arguments:
817d9f57 1826 is_server channel specifier
059ec3d9
PH
1827 buff buffer of data
1828 len number of bytes
1829
1830Returns: the number of bytes after a successful write,
1831 -1 after a failed write
1832*/
1833
1834int
817d9f57 1835tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9 1836{
17c76198
PP
1837ssize_t outbytes;
1838size_t left = len;
817d9f57 1839exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 1840
17c76198 1841DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
059ec3d9
PH
1842while (left > 0)
1843 {
17c76198
PP
1844 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
1845 buff, left);
1846 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 1847
17c76198 1848 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
1849 if (outbytes < 0)
1850 {
17c76198 1851 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
1852 return -1;
1853 }
1854 if (outbytes == 0)
1855 {
17c76198 1856 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
1857 return -1;
1858 }
1859
1860 left -= outbytes;
1861 buff += outbytes;
1862 }
1863
17c76198
PP
1864if (len > INT_MAX)
1865 {
1866 DEBUG(D_tls)
1867 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
1868 len);
1869 len = INT_MAX;
1870 }
1871
1872return (int) len;
059ec3d9
PH
1873}
1874
1875
1876
17c76198 1877
059ec3d9 1878/*************************************************
17c76198 1879* Random number generation *
059ec3d9
PH
1880*************************************************/
1881
17c76198
PP
1882/* Pseudo-random number generation. The result is not expected to be
1883cryptographically strong but not so weak that someone will shoot themselves
1884in the foot using it as a nonce in input in some email header scheme or
1885whatever weirdness they'll twist this into. The result should handle fork()
1886and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 1887
17c76198
PP
1888Arguments:
1889 max range maximum
1890Returns a random number in range [0, max-1]
059ec3d9
PH
1891*/
1892
af3498d6 1893#ifdef HAVE_GNUTLS_RND
17c76198
PP
1894int
1895vaguely_random_number(int max)
059ec3d9 1896{
17c76198
PP
1897unsigned int r;
1898int i, needed_len;
1899uschar *p;
1900uschar smallbuf[sizeof(r)];
1901
1902if (max <= 1)
1903 return 0;
1904
1905needed_len = sizeof(r);
1906/* Don't take 8 times more entropy than needed if int is 8 octets and we were
1907 * asked for a number less than 10. */
1908for (r = max, i = 0; r; ++i)
1909 r >>= 1;
1910i = (i + 7) / 8;
1911if (i < needed_len)
1912 needed_len = i;
1913
1914i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
1915if (i < 0)
059ec3d9 1916 {
17c76198
PP
1917 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
1918 return vaguely_random_number_fallback(max);
1919 }
1920r = 0;
1921for (p = smallbuf; needed_len; --needed_len, ++p)
1922 {
1923 r *= 256;
1924 r += *p;
059ec3d9
PH
1925 }
1926
17c76198
PP
1927/* We don't particularly care about weighted results; if someone wants
1928 * smooth distribution and cares enough then they should submit a patch then. */
1929return r % max;
059ec3d9 1930}
af3498d6
PP
1931#else /* HAVE_GNUTLS_RND */
1932int
1933vaguely_random_number(int max)
1934{
1935 return vaguely_random_number_fallback(max);
1936}
1937#endif /* HAVE_GNUTLS_RND */
059ec3d9 1938
36f12725
NM
1939
1940
1941
1942/*************************************************
3375e053
PP
1943* Let tls_require_ciphers be checked at startup *
1944*************************************************/
1945
1946/* The tls_require_ciphers option, if set, must be something which the
1947library can parse.
1948
1949Returns: NULL on success, or error message
1950*/
1951
1952uschar *
1953tls_validate_require_cipher(void)
1954{
1955int rc;
1956uschar *expciphers = NULL;
1957gnutls_priority_t priority_cache;
1958const char *errpos;
1959
1960#define validate_check_rc(Label) do { \
1961 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
1962 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
1963#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
1964
1965if (exim_gnutls_base_init_done)
1966 log_write(0, LOG_MAIN|LOG_PANIC,
1967 "already initialised GnuTLS, Exim developer bug");
1968
a5f239e4
PP
1969#ifdef HAVE_GNUTLS_PKCS11
1970if (!gnutls_enable_pkcs11)
1971 {
1972 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1973 validate_check_rc(US"gnutls_pkcs11_init");
1974 }
1975#endif
3375e053
PP
1976rc = gnutls_global_init();
1977validate_check_rc(US"gnutls_global_init()");
1978exim_gnutls_base_init_done = TRUE;
1979
1980if (!(tls_require_ciphers && *tls_require_ciphers))
1981 return_deinit(NULL);
1982
1983if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
1984 return_deinit(US"failed to expand tls_require_ciphers");
1985
1986if (!(expciphers && *expciphers))
1987 return_deinit(NULL);
1988
1989DEBUG(D_tls)
1990 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
1991
1992rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
1993validate_check_rc(string_sprintf(
1994 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
1995 expciphers, errpos - CS expciphers, errpos));
1996
1997#undef return_deinit
1998#undef validate_check_rc
1999gnutls_global_deinit();
2000
2001return NULL;
2002}
2003
2004
2005
2006
2007/*************************************************
36f12725
NM
2008* Report the library versions. *
2009*************************************************/
2010
2011/* See a description in tls-openssl.c for an explanation of why this exists.
2012
2013Arguments: a FILE* to print the results to
2014Returns: nothing
2015*/
2016
2017void
2018tls_version_report(FILE *f)
2019{
754a0503
PP
2020fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2021 " Runtime: %s\n",
2022 LIBGNUTLS_VERSION,
2023 gnutls_check_version(NULL));
36f12725
NM
2024}
2025
059ec3d9 2026/* End of tls-gnu.c */