GnuTLS: repeat lowlevel read and write operations while they request retry
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
6aa6fc9c 16Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17c76198 17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
184384c3 42
a5f239e4
PP
43/* needed to disable PKCS11 autoload unless requested */
44#if GNUTLS_VERSION_NUMBER >= 0x020c00
45# include <gnutls/pkcs11.h>
76075bb5 46# define SUPPORT_PARAM_TO_PK_BITS
a5f239e4 47#endif
7e07527a
JH
48#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50# define DISABLE_OCSP
51#endif
0cbf2b82 52#if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
774ef2d7 53# warning "GnuTLS library version too old; tls:cert event unsupported"
0cbf2b82 54# define DISABLE_EVENT
a7538db1 55#endif
a7fec7a7
JH
56#if GNUTLS_VERSION_NUMBER >= 0x030306
57# define SUPPORT_CA_DIR
58#else
59# undef SUPPORT_CA_DIR
60#endif
11a04b5a 61#if GNUTLS_VERSION_NUMBER >= 0x030014
cb1d7830
JH
62# define SUPPORT_SYSDEFAULT_CABUNDLE
63#endif
184384c3
JH
64#if GNUTLS_VERSION_NUMBER >= 0x030104
65# define GNUTLS_CERT_VFY_STATUS_PRINT
66#endif
925ac8e4
JH
67#if GNUTLS_VERSION_NUMBER >= 0x030109
68# define SUPPORT_CORK
69#endif
47195144
JH
70#if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
71# define SUPPORT_SRV_OCSP_STACK
72#endif
c0635b6d
JH
73
74#ifdef SUPPORT_DANE
75# if GNUTLS_VERSION_NUMBER >= 0x030000
76# define DANESSL_USAGE_DANE_TA 2
77# define DANESSL_USAGE_DANE_EE 3
78# else
79# error GnuTLS version too early for DANE
80# endif
81# if GNUTLS_VERSION_NUMBER < 0x999999
82# define GNUTLS_BROKEN_DANE_VALIDATION
83# endif
899b8bbc 84#endif
7e07527a 85
f2de3a33 86#ifndef DISABLE_OCSP
2b4a568d
JH
87# include <gnutls/ocsp.h>
88#endif
899b8bbc
JH
89#ifdef SUPPORT_DANE
90# include <gnutls/dane.h>
91#endif
059ec3d9 92
17c76198 93/* GnuTLS 2 vs 3
059ec3d9 94
17c76198
PP
95GnuTLS 3 only:
96 gnutls_global_set_audit_log_function()
059ec3d9 97
17c76198
PP
98Changes:
99 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
100*/
059ec3d9 101
17c76198 102/* Local static variables for GnuTLS */
059ec3d9 103
17c76198 104/* Values for verify_requirement */
059ec3d9 105
e51c7be2 106enum peer_verify_requirement
899b8bbc 107 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
059ec3d9 108
17c76198
PP
109/* This holds most state for server or client; with this, we can set up an
110outbound TLS-enabled connection in an ACL callout, while not stomping all
111over the TLS variables available for expansion.
059ec3d9 112
17c76198
PP
113Some of these correspond to variables in globals.c; those variables will
114be set to point to content in one of these instances, as appropriate for
115the stage of the process lifetime.
059ec3d9 116
389ca47a 117Not handled here: global tls_channelbinding_b64.
17c76198 118*/
059ec3d9 119
17c76198 120typedef struct exim_gnutls_state {
9d1c15ef 121 gnutls_session_t session;
17c76198 122 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 123 gnutls_priority_t priority_cache;
17c76198 124 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
125 int fd_in;
126 int fd_out;
127 BOOL peer_cert_verified;
899b8bbc 128 BOOL peer_dane_verified;
9d1c15ef
JH
129 BOOL trigger_sni_changes;
130 BOOL have_set_peerdn;
5fd28bb8 131 const struct host_item *host; /* NULL if server */
afdb5e9c 132 gnutls_x509_crt_t peercert;
9d1c15ef
JH
133 uschar *peerdn;
134 uschar *ciphersuite;
135 uschar *received_sni;
17c76198
PP
136
137 const uschar *tls_certificate;
138 const uschar *tls_privatekey;
139 const uschar *tls_sni; /* client send only, not received */
140 const uschar *tls_verify_certificates;
141 const uschar *tls_crl;
142 const uschar *tls_require_ciphers;
e51c7be2 143
17c76198
PP
144 uschar *exp_tls_certificate;
145 uschar *exp_tls_privatekey;
17c76198
PP
146 uschar *exp_tls_verify_certificates;
147 uschar *exp_tls_crl;
148 uschar *exp_tls_require_ciphers;
55414b25 149 const uschar *exp_tls_verify_cert_hostnames;
0cbf2b82 150#ifndef DISABLE_EVENT
a7538db1
JH
151 uschar *event_action;
152#endif
899b8bbc
JH
153#ifdef SUPPORT_DANE
154 char * const * dane_data;
155 const int * dane_data_len;
156#endif
17c76198 157
389ca47a 158 tls_support *tlsp; /* set in tls_init() */
817d9f57 159
17c76198
PP
160 uschar *xfer_buffer;
161 int xfer_buffer_lwm;
162 int xfer_buffer_hwm;
8b77d27a
JH
163 BOOL xfer_eof; /*XXX never gets set! */
164 BOOL xfer_error;
17c76198
PP
165} exim_gnutls_state_st;
166
167static const exim_gnutls_state_st exim_gnutls_state_init = {
f2ed27cf
JH
168 .session = NULL,
169 .x509_cred = NULL,
170 .priority_cache = NULL,
171 .verify_requirement = VERIFY_NONE,
172 .fd_in = -1,
173 .fd_out = -1,
174 .peer_cert_verified = FALSE,
899b8bbc 175 .peer_dane_verified = FALSE,
f2ed27cf
JH
176 .trigger_sni_changes =FALSE,
177 .have_set_peerdn = FALSE,
178 .host = NULL,
179 .peercert = NULL,
180 .peerdn = NULL,
181 .ciphersuite = NULL,
182 .received_sni = NULL,
183
184 .tls_certificate = NULL,
185 .tls_privatekey = NULL,
186 .tls_sni = NULL,
187 .tls_verify_certificates = NULL,
188 .tls_crl = NULL,
189 .tls_require_ciphers =NULL,
190
191 .exp_tls_certificate = NULL,
192 .exp_tls_privatekey = NULL,
193 .exp_tls_verify_certificates = NULL,
194 .exp_tls_crl = NULL,
195 .exp_tls_require_ciphers = NULL,
f2ed27cf 196 .exp_tls_verify_cert_hostnames = NULL,
0cbf2b82 197#ifndef DISABLE_EVENT
f2ed27cf 198 .event_action = NULL,
a7538db1 199#endif
f2ed27cf
JH
200 .tlsp = NULL,
201
202 .xfer_buffer = NULL,
203 .xfer_buffer_lwm = 0,
204 .xfer_buffer_hwm = 0,
8b77d27a
JH
205 .xfer_eof = FALSE,
206 .xfer_error = FALSE,
17c76198 207};
83da1223 208
17c76198
PP
209/* Not only do we have our own APIs which don't pass around state, assuming
210it's held in globals, GnuTLS doesn't appear to let us register callback data
211for callbacks, or as part of the session, so we have to keep a "this is the
212context we're currently dealing with" pointer and rely upon being
213single-threaded to keep from processing data on an inbound TLS connection while
214talking to another TLS connection for an outbound check. This does mean that
215there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
216second connection.
217XXX But see gnutls_session_get_ptr()
218*/
059ec3d9 219
74f1a423 220static exim_gnutls_state_st state_server;
059ec3d9 221
17c76198
PP
222/* dh_params are initialised once within the lifetime of a process using TLS;
223if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
224don't want to repeat this. */
83da1223 225
17c76198 226static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 227
17c76198 228/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 229
17c76198 230static const int ssl_session_timeout = 200;
059ec3d9 231
17c76198 232static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 233
17c76198 234/* Guard library core initialisation */
83da1223 235
17c76198 236static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 237
4fb7df6d 238#ifndef DISABLE_OCSP
9196d5bf 239static BOOL gnutls_buggy_ocsp = FALSE;
4fb7df6d 240#endif
9196d5bf 241
059ec3d9 242
17c76198 243/* ------------------------------------------------------------------------ */
17c76198 244/* macros */
83da1223 245
17c76198 246#define MAX_HOST_LEN 255
83da1223 247
17c76198
PP
248/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
249the library logging; a value less than 0 disables the calls to set up logging
ef9da2ee
JH
250callbacks. Possibly GNuTLS also looks for an environment variable
251"GNUTLS_DEBUG_LEVEL". */
2c17bb02 252#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
a7538db1 253# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 254#endif
83da1223 255
2c17bb02 256#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 257# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 258#endif
83da1223 259
af3498d6
PP
260/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
261can ask for a bit-strength. Without that, we stick to the constant we had
262before, for now. */
2c17bb02 263#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 264# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 265#endif
af3498d6 266
47195144
JH
267#define exim_gnutls_err_check(rc, Label) do { \
268 if ((rc) != GNUTLS_E_SUCCESS) \
48224640 269 return tls_error((Label), US gnutls_strerror(rc), host, errstr); \
cf0c6164 270 } while (0)
059ec3d9 271
cf0c6164
JH
272#define expand_check_tlsvar(Varname, errstr) \
273 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
83da1223 274
17c76198 275#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
276# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
277# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
278# define HAVE_GNUTLS_RND
2519e60d
TL
279/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
280 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
281 * isn't available sometimes, so this needs to become a conditional
282 * compilation; the sanest way to deal with this being a problem on
283 * older OSes is to block it in the Local/Makefile with this compiler
284 * definition */
e51c7be2
JH
285# ifndef AVOID_GNUTLS_PKCS11
286# define HAVE_GNUTLS_PKCS11
287# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 288#endif
83da1223 289
af3498d6
PP
290
291
292
293/* ------------------------------------------------------------------------ */
294/* Callback declarations */
295
296#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
297static void exim_gnutls_logger_cb(int level, const char *message);
298#endif
299
300static int exim_sni_handling_cb(gnutls_session_t session);
301
f2de3a33 302#ifndef DISABLE_OCSP
44662487
JH
303static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
304 gnutls_datum_t * ocsp_response);
305#endif
af3498d6
PP
306
307
308
17c76198
PP
309/* ------------------------------------------------------------------------ */
310/* Static functions */
059ec3d9
PH
311
312/*************************************************
313* Handle TLS error *
314*************************************************/
315
316/* Called from lots of places when errors occur before actually starting to do
317the TLS handshake, that is, while the session is still in clear. Always returns
318DEFER for a server and FAIL for a client so that most calls can use "return
319tls_error(...)" to do this processing and then give an appropriate return. A
320single function is used for both server and client, because it is called from
321some shared functions.
322
323Argument:
324 prefix text to include in the logged error
7199e1ee
TF
325 msg additional error string (may be NULL)
326 usually obtained from gnutls_strerror()
17c76198
PP
327 host NULL if setting up a server;
328 the connected host if setting up a client
cf0c6164 329 errstr pointer to returned error string
059ec3d9
PH
330
331Returns: OK/DEFER/FAIL
332*/
333
334static int
48224640 335tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
cf0c6164 336 uschar ** errstr)
059ec3d9 337{
cf0c6164 338if (errstr)
48224640 339 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
cf0c6164 340return host ? FAIL : DEFER;
059ec3d9
PH
341}
342
343
344
17c76198 345
059ec3d9 346/*************************************************
17c76198 347* Deal with logging errors during I/O *
059ec3d9
PH
348*************************************************/
349
17c76198 350/* We have to get the identity of the peer from saved data.
059ec3d9 351
17c76198
PP
352Argument:
353 state the current GnuTLS exim state container
354 rc the GnuTLS error code, or 0 if it's a local error
355 when text identifying read or write
356 text local error text when ec is 0
059ec3d9 357
17c76198 358Returns: nothing
059ec3d9
PH
359*/
360
17c76198
PP
361static void
362record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 363{
48224640 364const uschar * msg;
cf0c6164 365uschar * errstr;
059ec3d9 366
17c76198 367if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
48224640 368 msg = string_sprintf("%s: %s", US gnutls_strerror(rc),
17c76198
PP
369 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
370else
48224640 371 msg = US gnutls_strerror(rc);
059ec3d9 372
cf0c6164
JH
373(void) tls_error(when, msg, state->host, &errstr);
374
375if (state->host)
376 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
377 state->host->name, state->host->address, errstr);
378else
379 {
380 uschar * conn_info = smtp_get_connection_info();
381 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
382 /* I'd like to get separated H= here, but too hard for now */
383 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
384 }
17c76198 385}
059ec3d9 386
059ec3d9 387
059ec3d9 388
059ec3d9 389
17c76198
PP
390/*************************************************
391* Set various Exim expansion vars *
392*************************************************/
059ec3d9 393
e51c7be2
JH
394#define exim_gnutls_cert_err(Label) \
395 do \
396 { \
397 if (rc != GNUTLS_E_SUCCESS) \
398 { \
399 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
400 (Label), gnutls_strerror(rc)); \
401 return rc; \
402 } \
403 } while (0)
9d1c15ef
JH
404
405static int
27f19eb4 406import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
9d1c15ef
JH
407{
408int rc;
409
410rc = gnutls_x509_crt_init(crtp);
411exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
412
413rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
414exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
415
416return rc;
417}
418
419#undef exim_gnutls_cert_err
420
421
17c76198
PP
422/* We set various Exim global variables from the state, once a session has
423been established. With TLS callouts, may need to change this to stack
424variables, or just re-call it with the server state after client callout
425has finished.
059ec3d9 426
9d1c15ef 427Make sure anything set here is unset in tls_getc().
17c76198
PP
428
429Sets:
430 tls_active fd
431 tls_bits strength indicator
432 tls_certificate_verified bool indicator
433 tls_channelbinding_b64 for some SASL mechanisms
434 tls_cipher a string
9d1c15ef 435 tls_peercert pointer to library internal
17c76198
PP
436 tls_peerdn a string
437 tls_sni a (UTF-8) string
9d1c15ef 438 tls_ourcert pointer to library internal
17c76198
PP
439
440Argument:
441 state the relevant exim_gnutls_state_st *
442*/
443
444static void
9d1c15ef 445extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 446{
17c76198 447gnutls_cipher_algorithm_t cipher;
17c76198
PP
448#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
449int old_pool;
450int rc;
451gnutls_datum_t channel;
452#endif
9d1c15ef 453tls_support * tlsp = state->tlsp;
17c76198 454
74f1a423
JH
455tlsp->active.sock = state->fd_out;
456tlsp->active.tls_ctx = state;
17c76198
PP
457
458cipher = gnutls_cipher_get(state->session);
459/* returns size in "bytes" */
9d1c15ef 460tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 461
9d1c15ef 462tlsp->cipher = state->ciphersuite;
17c76198 463
817d9f57 464DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 465
9d1c15ef 466tlsp->certificate_verified = state->peer_cert_verified;
899b8bbc
JH
467#ifdef SUPPORT_DANE
468tlsp->dane_verified = state->peer_dane_verified;
469#endif
059ec3d9 470
17c76198
PP
471/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
472only available for use for authenticators while this TLS session is running. */
473
474tls_channelbinding_b64 = NULL;
475#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
476channel.data = NULL;
477channel.size = 0;
478rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
479if (rc) {
480 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
481} else {
482 old_pool = store_pool;
483 store_pool = POOL_PERM;
f4d091fb 484 tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
17c76198
PP
485 store_pool = old_pool;
486 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
487}
488#endif
489
9d1c15ef
JH
490/* peercert is set in peer_status() */
491tlsp->peerdn = state->peerdn;
492tlsp->sni = state->received_sni;
493
494/* record our certificate */
495 {
27f19eb4 496 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
9d1c15ef
JH
497 gnutls_x509_crt_t crt;
498
499 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
500 }
059ec3d9
PH
501}
502
503
504
17c76198 505
059ec3d9 506/*************************************************
575643cd 507* Setup up DH parameters *
059ec3d9
PH
508*************************************************/
509
575643cd 510/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
511be re-generated every so often, depending on security policy. What we do is to
512keep these parameters in a file in the spool directory. If the file does not
513exist, we generate them. This means that it is easy to cause a regeneration.
514
515The new file is written as a temporary file and renamed, so that an incomplete
516file is never present. If two processes both compute some new parameters, you
517waste a bit of effort, but it doesn't seem worth messing around with locking to
518prevent this.
519
059ec3d9
PH
520Returns: OK/DEFER/FAIL
521*/
522
523static int
cf0c6164 524init_server_dh(uschar ** errstr)
059ec3d9 525{
17c76198
PP
526int fd, rc;
527unsigned int dh_bits;
27f19eb4 528gnutls_datum_t m;
a799883d
PP
529uschar filename_buf[PATH_MAX];
530uschar *filename = NULL;
17c76198 531size_t sz;
a799883d
PP
532uschar *exp_tls_dhparam;
533BOOL use_file_in_spool = FALSE;
534BOOL use_fixed_file = FALSE;
17c76198 535host_item *host = NULL; /* dummy for macros */
059ec3d9 536
17c76198 537DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 538
17c76198 539rc = gnutls_dh_params_init(&dh_server_params);
47195144 540exim_gnutls_err_check(rc, US"gnutls_dh_params_init");
059ec3d9 541
a799883d
PP
542m.data = NULL;
543m.size = 0;
544
cf0c6164 545if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
a799883d
PP
546 return DEFER;
547
548if (!exp_tls_dhparam)
549 {
550 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
551 m.data = US std_dh_prime_default();
552 m.size = Ustrlen(m.data);
553 }
554else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
555 use_file_in_spool = TRUE;
556else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
557 {
558 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
559 return OK;
560 }
561else if (exp_tls_dhparam[0] != '/')
562 {
f5d25c2b 563 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
48224640 564 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
a799883d
PP
565 m.size = Ustrlen(m.data);
566 }
567else
568 {
569 use_fixed_file = TRUE;
570 filename = exp_tls_dhparam;
571 }
572
573if (m.data)
574 {
575 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
47195144 576 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
a799883d
PP
577 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
578 return OK;
579 }
580
af3498d6
PP
581#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
582/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
583different filename and ensure we have sufficient bits. */
584dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
585if (!dh_bits)
cf0c6164 586 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
af3498d6 587DEBUG(D_tls)
b34fc30c 588 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
589 dh_bits);
590#else
591dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
592DEBUG(D_tls)
593 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
594 dh_bits);
595#endif
059ec3d9 596
3375e053
PP
597/* Some clients have hard-coded limits. */
598if (dh_bits > tls_dh_max_bits)
599 {
600 DEBUG(D_tls)
601 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
602 tls_dh_max_bits);
603 dh_bits = tls_dh_max_bits;
604 }
605
a799883d
PP
606if (use_file_in_spool)
607 {
608 if (!string_format(filename_buf, sizeof(filename_buf),
609 "%s/gnutls-params-%d", spool_directory, dh_bits))
cf0c6164 610 return tls_error(US"overlong filename", NULL, NULL, errstr);
a799883d
PP
611 filename = filename_buf;
612 }
059ec3d9 613
b5aea5e1 614/* Open the cache file for reading and if successful, read it and set up the
575643cd 615parameters. */
059ec3d9 616
f5d25c2b 617if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
059ec3d9 618 {
b5aea5e1 619 struct stat statbuf;
17c76198
PP
620 FILE *fp;
621 int saved_errno;
622
623 if (fstat(fd, &statbuf) < 0) /* EIO */
624 {
625 saved_errno = errno;
626 (void)close(fd);
48224640 627 return tls_error(US"TLS cache stat failed", US strerror(saved_errno), NULL, errstr);
17c76198
PP
628 }
629 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
630 {
631 (void)close(fd);
cf0c6164 632 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
17c76198 633 }
40c90bca 634 if (!(fp = fdopen(fd, "rb")))
17c76198
PP
635 {
636 saved_errno = errno;
637 (void)close(fd);
638 return tls_error(US"fdopen(TLS cache stat fd) failed",
48224640 639 US strerror(saved_errno), NULL, errstr);
b5aea5e1 640 }
059ec3d9 641
b5aea5e1 642 m.size = statbuf.st_size;
40c90bca 643 if (!(m.data = malloc(m.size)))
17c76198
PP
644 {
645 fclose(fp);
48224640 646 return tls_error(US"malloc failed", US strerror(errno), NULL, errstr);
17c76198 647 }
40c90bca 648 if (!(sz = fread(m.data, m.size, 1, fp)))
17c76198
PP
649 {
650 saved_errno = errno;
651 fclose(fp);
652 free(m.data);
48224640 653 return tls_error(US"fread failed", US strerror(saved_errno), NULL, errstr);
17c76198
PP
654 }
655 fclose(fp);
b5aea5e1 656
17c76198 657 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 658 free(m.data);
47195144 659 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
17c76198 660 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
661 }
662
663/* If the file does not exist, fall through to compute new data and cache it.
664If there was any other opening error, it is serious. */
665
182ad5cf
PH
666else if (errno == ENOENT)
667 {
17c76198 668 rc = -1;
182ad5cf 669 DEBUG(D_tls)
17c76198 670 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
671 }
672else
17c76198 673 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
cf0c6164 674 NULL, NULL, errstr);
b5aea5e1
PH
675
676/* If ret < 0, either the cache file does not exist, or the data it contains
677is not useful. One particular case of this is when upgrading from an older
678release of Exim in which the data was stored in a different format. We don't
679try to be clever and support both formats; we just regenerate new data in this
680case. */
681
17c76198 682if (rc < 0)
b5aea5e1 683 {
17c76198 684 uschar *temp_fn;
201f5254 685 unsigned int dh_bits_gen = dh_bits;
059ec3d9 686
17c76198
PP
687 if ((PATH_MAX - Ustrlen(filename)) < 10)
688 return tls_error(US"Filename too long to generate replacement",
48224640 689 filename, NULL, errstr);
059ec3d9 690
48224640 691 temp_fn = string_copy(US"%s.XXXXXXX");
f5d25c2b 692 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
48224640 693 return tls_error(US"Unable to open temp file", US strerror(errno), NULL, errstr);
059ec3d9
PH
694 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
695
201f5254
PP
696 /* GnuTLS overshoots!
697 * If we ask for 2236, we might get 2237 or more.
698 * But there's no way to ask GnuTLS how many bits there really are.
699 * We can ask how many bits were used in a TLS session, but that's it!
700 * The prime itself is hidden behind too much abstraction.
701 * So we ask for less, and proceed on a wing and a prayer.
702 * First attempt, subtracted 3 for 2233 and got 2240.
703 */
cae6e576 704 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
705 {
706 dh_bits_gen = dh_bits - 10;
707 DEBUG(D_tls)
708 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
709 dh_bits_gen);
710 }
711
712 DEBUG(D_tls)
713 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
714 dh_bits_gen);
715 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
47195144 716 exim_gnutls_err_check(rc, US"gnutls_dh_params_generate2");
17c76198
PP
717
718 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
719 and I confirmed that a NULL call to get the size first is how the GnuTLS
720 sample apps handle this. */
721
722 sz = 0;
723 m.data = NULL;
724 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
725 m.data, &sz);
726 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
47195144 727 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3(NULL) sizing");
17c76198 728 m.size = sz;
40c90bca 729 if (!(m.data = malloc(m.size)))
48224640 730 return tls_error(US"memory allocation failed", US strerror(errno), NULL, errstr);
40c90bca 731
1f00591e 732 /* this will return a size 1 less than the allocation size above */
17c76198 733 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 734 m.data, &sz);
17c76198
PP
735 if (rc != GNUTLS_E_SUCCESS)
736 {
737 free(m.data);
47195144 738 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3() real");
17c76198 739 }
1f00591e 740 m.size = sz; /* shrink by 1, probably */
059ec3d9 741
f5d25c2b 742 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
17c76198
PP
743 {
744 free(m.data);
745 return tls_error(US"TLS cache write D-H params failed",
48224640 746 US strerror(errno), NULL, errstr);
17c76198 747 }
b5aea5e1 748 free(m.data);
f5d25c2b 749 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
17c76198 750 return tls_error(US"TLS cache write D-H params final newline failed",
48224640 751 US strerror(errno), NULL, errstr);
17c76198 752
f5d25c2b 753 if ((rc = close(fd)))
48224640 754 return tls_error(US"TLS cache write close() failed", US strerror(errno), NULL, errstr);
059ec3d9 755
17c76198
PP
756 if (Urename(temp_fn, filename) < 0)
757 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
48224640 758 temp_fn, filename), US strerror(errno), NULL, errstr);
059ec3d9 759
17c76198 760 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
761 }
762
17c76198 763DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
764return OK;
765}
766
767
768
769
23bb6982
JH
770/* Create and install a selfsigned certificate, for use in server mode */
771
772static int
cf0c6164 773tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
23bb6982
JH
774{
775gnutls_x509_crt_t cert = NULL;
776time_t now;
777gnutls_x509_privkey_t pkey = NULL;
778const uschar * where;
779int rc;
780
781where = US"initialising pkey";
782if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
783
784where = US"initialising cert";
785if ((rc = gnutls_x509_crt_init(&cert))) goto err;
786
787where = US"generating pkey";
788if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
76075bb5 789#ifdef SUPPORT_PARAM_TO_PK_BITS
4312da48
JH
790# ifndef GNUTLS_SEC_PARAM_MEDIUM
791# define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
792# endif
6aac3239 793 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
76075bb5 794#else
6aac3239 795 2048,
76075bb5
JH
796#endif
797 0)))
23bb6982
JH
798 goto err;
799
800where = US"configuring cert";
1613fd68 801now = 1;
23bb6982
JH
802if ( (rc = gnutls_x509_crt_set_version(cert, 3))
803 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
804 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
805 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
806 || (rc = gnutls_x509_crt_set_key(cert, pkey))
807
808 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
809 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
810 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
811 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
812 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
813 GNUTLS_OID_X520_COMMON_NAME, 0,
814 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
815 )
816 goto err;
817
818where = US"signing cert";
819if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
820
821where = US"installing selfsign cert";
822 /* Since: 2.4.0 */
823if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
824 goto err;
825
826rc = OK;
827
828out:
829 if (cert) gnutls_x509_crt_deinit(cert);
830 if (pkey) gnutls_x509_privkey_deinit(pkey);
831 return rc;
832
833err:
48224640 834 rc = tls_error(where, US gnutls_strerror(rc), NULL, errstr);
23bb6982
JH
835 goto out;
836}
837
838
839
840
47195144
JH
841/* Add certificate and key, from files.
842
843Return:
844 Zero or negative: good. Negate value for certificate index if < 0.
845 Greater than zero: FAIL or DEFER code.
846*/
847
ba86e143
JH
848static int
849tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
850 uschar * certfile, uschar * keyfile, uschar ** errstr)
851{
852int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
853 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
47195144
JH
854if (rc < 0)
855 return tls_error(
856 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
48224640 857 US gnutls_strerror(rc), host, errstr);
47195144 858return -rc;
ba86e143
JH
859}
860
861
059ec3d9 862/*************************************************
17c76198 863* Variables re-expanded post-SNI *
059ec3d9
PH
864*************************************************/
865
17c76198
PP
866/* Called from both server and client code, via tls_init(), and also from
867the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
868
869We can tell the two apart by state->received_sni being non-NULL in callback.
870
871The callback should not call us unless state->trigger_sni_changes is true,
872which we are responsible for setting on the first pass through.
059ec3d9
PH
873
874Arguments:
17c76198 875 state exim_gnutls_state_st *
cf0c6164 876 errstr error string pointer
059ec3d9
PH
877
878Returns: OK/DEFER/FAIL
879*/
880
881static int
ba86e143 882tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
059ec3d9 883{
1365611d 884struct stat statbuf;
059ec3d9 885int rc;
17c76198
PP
886const host_item *host = state->host; /* macro should be reconsidered? */
887uschar *saved_tls_certificate = NULL;
888uschar *saved_tls_privatekey = NULL;
889uschar *saved_tls_verify_certificates = NULL;
890uschar *saved_tls_crl = NULL;
891int cert_count;
892
893/* We check for tls_sni *before* expansion. */
2b4a568d 894if (!host) /* server */
17c76198
PP
895 if (!state->received_sni)
896 {
ba86e143
JH
897 if ( state->tls_certificate
898 && ( Ustrstr(state->tls_certificate, US"tls_sni")
899 || Ustrstr(state->tls_certificate, US"tls_in_sni")
900 || Ustrstr(state->tls_certificate, US"tls_out_sni")
901 ) )
17c76198
PP
902 {
903 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
904 state->trigger_sni_changes = TRUE;
905 }
906 }
907 else
908 {
1365611d 909 /* useful for debugging */
17c76198
PP
910 saved_tls_certificate = state->exp_tls_certificate;
911 saved_tls_privatekey = state->exp_tls_privatekey;
912 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
913 saved_tls_crl = state->exp_tls_crl;
914 }
059ec3d9 915
1365611d 916rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
47195144
JH
917exim_gnutls_err_check(rc, US"gnutls_certificate_allocate_credentials");
918
919#ifdef SUPPORT_SRV_OCSP_STACK
920gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
921#endif
1365611d 922
17c76198
PP
923/* remember: expand_check_tlsvar() is expand_check() but fiddling with
924state members, assuming consistent naming; and expand_check() returns
925false if expansion failed, unless expansion was forced to fail. */
059ec3d9 926
17c76198
PP
927/* check if we at least have a certificate, before doing expensive
928D-H generation. */
059ec3d9 929
cf0c6164 930if (!expand_check_tlsvar(tls_certificate, errstr))
17c76198 931 return DEFER;
059ec3d9 932
17c76198 933/* certificate is mandatory in server, optional in client */
059ec3d9 934
23bb6982
JH
935if ( !state->exp_tls_certificate
936 || !*state->exp_tls_certificate
937 )
2b4a568d 938 if (!host)
cf0c6164 939 return tls_install_selfsign(state, errstr);
17c76198
PP
940 else
941 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
059ec3d9 942
cf0c6164 943if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
059ec3d9
PH
944 return DEFER;
945
17c76198
PP
946/* tls_privatekey is optional, defaulting to same file as certificate */
947
948if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 949 {
17c76198
PP
950 state->tls_privatekey = state->tls_certificate;
951 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 952 }
c91535f3 953
059ec3d9 954
17c76198 955if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
956 {
957 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
958 state->exp_tls_certificate, state->exp_tls_privatekey);
959
960 if (state->received_sni)
23bb6982
JH
961 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
962 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
963 )
17c76198 964 {
b34fc30c 965 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
966 }
967 else
968 {
b34fc30c 969 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 970 }
059ec3d9 971
ba86e143
JH
972 if (!host) /* server */
973 {
974 const uschar * clist = state->exp_tls_certificate;
975 const uschar * klist = state->exp_tls_privatekey;
47195144
JH
976 const uschar * olist;
977 int csep = 0, ksep = 0, osep = 0, cnt = 0;
978 uschar * cfile, * kfile, * ofile;
979
980#ifndef DISABLE_OCSP
981 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
982 return DEFER;
983 olist = ofile;
984#endif
ba86e143
JH
985
986 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
47195144 987
ba86e143
JH
988 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
989 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
47195144 990 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
ba86e143
JH
991 return rc;
992 else
47195144
JH
993 {
994 int gnutls_cert_index = -rc;
ba86e143 995 DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile);
47195144
JH
996
997 /* Set the OCSP stapling server info */
998
999#ifndef DISABLE_OCSP
1000 if (tls_ocsp_file)
1001 if (gnutls_buggy_ocsp)
1002 {
1003 DEBUG(D_tls)
1004 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1005 }
1006 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1007 {
1008 /* Use the full callback method for stapling just to get
1009 observability. More efficient would be to read the file once only,
1010 if it never changed (due to SNI). Would need restart on file update,
1011 or watch datestamp. */
1012
1013# ifdef SUPPORT_SRV_OCSP_STACK
1014 rc = gnutls_certificate_set_ocsp_status_request_function2(
1015 state->x509_cred, gnutls_cert_index,
1016 server_ocsp_stapling_cb, ofile);
1017
1018 exim_gnutls_err_check(rc,
1019 US"gnutls_certificate_set_ocsp_status_request_function2");
1020# else
1021 if (cnt++ > 0)
1022 {
1023 DEBUG(D_tls)
1024 debug_printf("oops; multiple OCSP files not supported\n");
1025 break;
1026 }
1027 gnutls_certificate_set_ocsp_status_request_function(
1028 state->x509_cred, server_ocsp_stapling_cb, ofile);
1029# endif
1030
1031 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile);
1032 }
1033 else
1034 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1035#endif
1036 }
ba86e143
JH
1037 }
1038 else
1039 {
47195144 1040 if (0 < (rc = tls_add_certfile(state, host,
ba86e143
JH
1041 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1042 return rc;
1043 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1044 }
1045
b34fc30c 1046 } /* tls_certificate */
059ec3d9 1047
2b4a568d 1048
059ec3d9
PH
1049/* Set the trusted CAs file if one is provided, and then add the CRL if one is
1050provided. Experiment shows that, if the certificate file is empty, an unhelpful
1051error message is provided. However, if we just refrain from setting anything up
1052in that case, certificate verification fails, which seems to be the correct
1053behaviour. */
1054
610ff438 1055if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 1056 {
cf0c6164 1057 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
059ec3d9 1058 return DEFER;
610ff438
JH
1059#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1060 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1061 state->exp_tls_verify_certificates = NULL;
1062#endif
17c76198 1063 if (state->tls_crl && *state->tls_crl)
cf0c6164 1064 if (!expand_check_tlsvar(tls_crl, errstr))
17c76198 1065 return DEFER;
059ec3d9 1066
1365611d
PP
1067 if (!(state->exp_tls_verify_certificates &&
1068 *state->exp_tls_verify_certificates))
b34fc30c
PP
1069 {
1070 DEBUG(D_tls)
1365611d
PP
1071 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1072 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 1073 return OK;
b34fc30c 1074 }
1365611d 1075 }
83e2f8a2
PP
1076else
1077 {
1078 DEBUG(D_tls)
1079 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1080 return OK;
1081 }
17c76198 1082
cb1d7830
JH
1083#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1084if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1085 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1086else
1087#endif
1365611d 1088 {
cb1d7830
JH
1089 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1090 {
1091 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1092 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1093 strerror(errno));
1094 return DEFER;
1095 }
17c76198 1096
a7fec7a7 1097#ifndef SUPPORT_CA_DIR
cb1d7830
JH
1098 /* The test suite passes in /dev/null; we could check for that path explicitly,
1099 but who knows if someone has some weird FIFO which always dumps some certs, or
1100 other weirdness. The thing we really want to check is that it's not a
1101 directory, since while OpenSSL supports that, GnuTLS does not.
60f914bc 1102 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
cb1d7830
JH
1103 if (S_ISDIR(statbuf.st_mode))
1104 {
1105 DEBUG(D_tls)
1106 debug_printf("verify certificates path is a dir: \"%s\"\n",
1107 state->exp_tls_verify_certificates);
1108 log_write(0, LOG_MAIN|LOG_PANIC,
1109 "tls_verify_certificates \"%s\" is a directory",
1110 state->exp_tls_verify_certificates);
1111 return DEFER;
1112 }
a7fec7a7 1113#endif
059ec3d9 1114
cb1d7830
JH
1115 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1116 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 1117
cb1d7830
JH
1118 if (statbuf.st_size == 0)
1119 {
1120 DEBUG(D_tls)
1121 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1122 return OK;
1123 }
059ec3d9 1124
cb1d7830 1125 cert_count =
a7fec7a7
JH
1126
1127#ifdef SUPPORT_CA_DIR
cb1d7830
JH
1128 (statbuf.st_mode & S_IFMT) == S_IFDIR
1129 ?
1130 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1131 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1132 :
a7fec7a7 1133#endif
cb1d7830
JH
1134 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1135 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1136 }
a7fec7a7 1137
1365611d
PP
1138if (cert_count < 0)
1139 {
1140 rc = cert_count;
47195144 1141 exim_gnutls_err_check(rc, US"setting certificate trust");
1365611d
PP
1142 }
1143DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 1144
5c8cda3a
PP
1145if (state->tls_crl && *state->tls_crl &&
1146 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 1147 {
5c8cda3a
PP
1148 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1149 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1150 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1151 if (cert_count < 0)
1365611d 1152 {
5c8cda3a 1153 rc = cert_count;
47195144 1154 exim_gnutls_err_check(rc, US"gnutls_certificate_set_x509_crl_file");
1365611d 1155 }
5c8cda3a 1156 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 1157 }
059ec3d9 1158
059ec3d9
PH
1159return OK;
1160}
1161
1162
1163
1164
1165/*************************************************
1365611d
PP
1166* Set X.509 state variables *
1167*************************************************/
1168
1169/* In GnuTLS, the registered cert/key are not replaced by a later
1170set of a cert/key, so for SNI support we need a whole new x509_cred
1171structure. Which means various other non-re-expanded pieces of state
1172need to be re-set in the new struct, so the setting logic is pulled
1173out to this.
1174
1175Arguments:
1176 state exim_gnutls_state_st *
cf0c6164 1177 errstr error string pointer
1365611d
PP
1178
1179Returns: OK/DEFER/FAIL
1180*/
1181
1182static int
cf0c6164 1183tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1365611d
PP
1184{
1185int rc;
1186const host_item *host = state->host; /* macro should be reconsidered? */
1187
1188/* Create D-H parameters, or read them from the cache file. This function does
1189its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1190client-side params. */
1191
1192if (!state->host)
1193 {
1194 if (!dh_server_params)
1195 {
cf0c6164 1196 rc = init_server_dh(errstr);
1365611d
PP
1197 if (rc != OK) return rc;
1198 }
1199 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1200 }
1201
1202/* Link the credentials to the session. */
1203
1204rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
47195144 1205exim_gnutls_err_check(rc, US"gnutls_credentials_set");
1365611d
PP
1206
1207return OK;
1208}
1209
1210/*************************************************
17c76198 1211* Initialize for GnuTLS *
059ec3d9
PH
1212*************************************************/
1213
9196d5bf 1214
4fb7df6d
JH
1215#ifndef DISABLE_OCSP
1216
9196d5bf
JH
1217static BOOL
1218tls_is_buggy_ocsp(void)
1219{
1220const uschar * s;
1221uschar maj, mid, mic;
1222
1223s = CUS gnutls_check_version(NULL);
1224maj = atoi(CCS s);
1225if (maj == 3)
1226 {
1227 while (*s && *s != '.') s++;
1228 mid = atoi(CCS ++s);
1229 if (mid <= 2)
1230 return TRUE;
1231 else if (mid >= 5)
1232 return FALSE;
1233 else
1234 {
1235 while (*s && *s != '.') s++;
1236 mic = atoi(CCS ++s);
1237 return mic <= (mid == 3 ? 16 : 3);
1238 }
1239 }
1240return FALSE;
1241}
1242
4fb7df6d 1243#endif
9196d5bf
JH
1244
1245
17c76198
PP
1246/* Called from both server and client code. In the case of a server, errors
1247before actual TLS negotiation return DEFER.
059ec3d9
PH
1248
1249Arguments:
17c76198
PP
1250 host connected host, if client; NULL if server
1251 certificate certificate file
1252 privatekey private key file
1253 sni TLS SNI to send, sometimes when client; else NULL
1254 cas CA certs file
1255 crl CRL file
1256 require_ciphers tls_require_ciphers setting
817d9f57 1257 caller_state returned state-info structure
cf0c6164 1258 errstr error string pointer
059ec3d9 1259
17c76198 1260Returns: OK/DEFER/FAIL
059ec3d9
PH
1261*/
1262
17c76198
PP
1263static int
1264tls_init(
1265 const host_item *host,
1266 const uschar *certificate,
1267 const uschar *privatekey,
1268 const uschar *sni,
1269 const uschar *cas,
1270 const uschar *crl,
1271 const uschar *require_ciphers,
cf0c6164 1272 exim_gnutls_state_st **caller_state,
74f1a423 1273 tls_support * tlsp,
cf0c6164 1274 uschar ** errstr)
059ec3d9 1275{
17c76198
PP
1276exim_gnutls_state_st *state;
1277int rc;
1278size_t sz;
1279const char *errpos;
1280uschar *p;
1281BOOL want_default_priorities;
1282
1283if (!exim_gnutls_base_init_done)
059ec3d9 1284 {
17c76198
PP
1285 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1286
a5f239e4
PP
1287#ifdef HAVE_GNUTLS_PKCS11
1288 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1289 which loads modules from a config file, which sounds good and may be wanted
1290 by some sysadmin, but also means in common configurations that GNOME keyring
1291 environment variables are used and so breaks for users calling mailq.
1292 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1293 if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
1294 {
1295 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
47195144 1296 exim_gnutls_err_check(rc, US"gnutls_pkcs11_init");
a5f239e4
PP
1297 }
1298#endif
1299
17c76198 1300 rc = gnutls_global_init();
47195144 1301 exim_gnutls_err_check(rc, US"gnutls_global_init");
17c76198
PP
1302
1303#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1304 DEBUG(D_tls)
059ec3d9 1305 {
17c76198 1306 gnutls_global_set_log_function(exim_gnutls_logger_cb);
aded2255 1307 /* arbitrarily chosen level; bump up to 9 for more */
17c76198 1308 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1309 }
17c76198
PP
1310#endif
1311
4fb7df6d
JH
1312#ifndef DISABLE_OCSP
1313 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
9196d5bf 1314 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
4fb7df6d 1315#endif
9196d5bf 1316
17c76198 1317 exim_gnutls_base_init_done = TRUE;
059ec3d9 1318 }
059ec3d9 1319
17c76198
PP
1320if (host)
1321 {
74f1a423
JH
1322 /* For client-side sessions we allocate a context. This lets us run
1323 several in parallel. */
1324 int old_pool = store_pool;
1325 store_pool = POOL_PERM;
1326 state = store_get(sizeof(exim_gnutls_state_st));
1327 store_pool = old_pool;
1328
17c76198 1329 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1330 state->tlsp = tlsp;
17c76198
PP
1331 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1332 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1333 }
1334else
1335 {
1336 state = &state_server;
1337 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1338 state->tlsp = tlsp;
17c76198
PP
1339 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1340 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1341 }
47195144 1342exim_gnutls_err_check(rc, US"gnutls_init");
059ec3d9 1343
17c76198 1344state->host = host;
059ec3d9 1345
17c76198
PP
1346state->tls_certificate = certificate;
1347state->tls_privatekey = privatekey;
5779e6aa 1348state->tls_require_ciphers = require_ciphers;
17c76198
PP
1349state->tls_sni = sni;
1350state->tls_verify_certificates = cas;
1351state->tls_crl = crl;
059ec3d9 1352
17c76198
PP
1353/* This handles the variables that might get re-expanded after TLS SNI;
1354that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1355
17c76198
PP
1356DEBUG(D_tls)
1357 debug_printf("Expanding various TLS configuration options for session credentials.\n");
cf0c6164 1358if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
059ec3d9 1359
1365611d
PP
1360/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1361requires a new structure afterwards. */
83da1223 1362
cf0c6164 1363if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
83da1223 1364
17c76198
PP
1365/* set SNI in client, only */
1366if (host)
1367 {
cf0c6164 1368 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
17c76198 1369 return DEFER;
0df4ab80 1370 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1371 {
1372 DEBUG(D_tls)
0df4ab80
JH
1373 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1374 sz = Ustrlen(state->tlsp->sni);
17c76198 1375 rc = gnutls_server_name_set(state->session,
0df4ab80 1376 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
47195144 1377 exim_gnutls_err_check(rc, US"gnutls_server_name_set");
17c76198
PP
1378 }
1379 }
1380else if (state->tls_sni)
1381 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
ba86e143 1382 "have an SNI set for a server [%s]\n", state->tls_sni);
83da1223 1383
17c76198 1384/* This is the priority string support,
42bfef1e 1385http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1386and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1387This was backwards incompatible, but means Exim no longer needs to track
1388all algorithms and provide string forms for them. */
83da1223 1389
17c76198 1390want_default_priorities = TRUE;
83da1223 1391
17c76198 1392if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1393 {
cf0c6164 1394 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
17c76198
PP
1395 return DEFER;
1396 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1397 {
17c76198
PP
1398 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1399 state->exp_tls_require_ciphers);
1400
1401 rc = gnutls_priority_init(&state->priority_cache,
1402 CS state->exp_tls_require_ciphers, &errpos);
1403 want_default_priorities = FALSE;
1404 p = state->exp_tls_require_ciphers;
83da1223
PH
1405 }
1406 }
17c76198
PP
1407if (want_default_priorities)
1408 {
83e2f8a2
PP
1409 DEBUG(D_tls)
1410 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1411 exim_default_gnutls_priority);
17c76198
PP
1412 rc = gnutls_priority_init(&state->priority_cache,
1413 exim_default_gnutls_priority, &errpos);
1414 p = US exim_default_gnutls_priority;
1415 }
83da1223 1416
47195144 1417exim_gnutls_err_check(rc, string_sprintf(
17c76198
PP
1418 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1419 p, errpos - CS p, errpos));
1420
1421rc = gnutls_priority_set(state->session, state->priority_cache);
47195144 1422exim_gnutls_err_check(rc, US"gnutls_priority_set");
17c76198
PP
1423
1424gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1425
1426/* Reduce security in favour of increased compatibility, if the admin
1427decides to make that trade-off. */
1428if (gnutls_compat_mode)
83da1223 1429 {
17c76198
PP
1430#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1431 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1432 gnutls_session_enable_compatibility_mode(state->session);
1433#else
1434 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1435#endif
83da1223
PH
1436 }
1437
17c76198 1438*caller_state = state;
17c76198 1439return OK;
83da1223
PH
1440}
1441
1442
1443
83da1223 1444/*************************************************
17c76198 1445* Extract peer information *
059ec3d9
PH
1446*************************************************/
1447
17c76198 1448/* Called from both server and client code.
4fe99a6c
PP
1449Only this is allowed to set state->peerdn and state->have_set_peerdn
1450and we use that to detect double-calls.
059ec3d9 1451
75fe387d
PP
1452NOTE: the state blocks last while the TLS connection is up, which is fine
1453for logging in the server side, but for the client side, we log after teardown
1454in src/deliver.c. While the session is up, we can twist about states and
1455repoint tls_* globals, but those variables used for logging or other variable
1456expansion that happens _after_ delivery need to have a longer life-time.
1457
1458So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1459doing this more than once per generation of a state context. We set them in
1460the state context, and repoint tls_* to them. After the state goes away, the
1461tls_* copies of the pointers remain valid and client delivery logging is happy.
1462
1463tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1464don't apply.
1465
059ec3d9 1466Arguments:
17c76198 1467 state exim_gnutls_state_st *
cf0c6164 1468 errstr pointer to error string
059ec3d9 1469
17c76198 1470Returns: OK/DEFER/FAIL
059ec3d9
PH
1471*/
1472
17c76198 1473static int
cf0c6164 1474peer_status(exim_gnutls_state_st *state, uschar ** errstr)
059ec3d9 1475{
75fe387d 1476uschar cipherbuf[256];
27f19eb4 1477const gnutls_datum_t *cert_list;
75fe387d 1478int old_pool, rc;
17c76198 1479unsigned int cert_list_size = 0;
4fe99a6c
PP
1480gnutls_protocol_t protocol;
1481gnutls_cipher_algorithm_t cipher;
1482gnutls_kx_algorithm_t kx;
1483gnutls_mac_algorithm_t mac;
17c76198
PP
1484gnutls_certificate_type_t ct;
1485gnutls_x509_crt_t crt;
4fe99a6c 1486uschar *p, *dn_buf;
17c76198 1487size_t sz;
059ec3d9 1488
4fe99a6c 1489if (state->have_set_peerdn)
17c76198 1490 return OK;
4fe99a6c 1491state->have_set_peerdn = TRUE;
059ec3d9 1492
4fe99a6c 1493state->peerdn = NULL;
059ec3d9 1494
4fe99a6c
PP
1495/* tls_cipher */
1496cipher = gnutls_cipher_get(state->session);
1497protocol = gnutls_protocol_get_version(state->session);
1498mac = gnutls_mac_get(state->session);
1499kx = gnutls_kx_get(state->session);
1500
75fe387d 1501string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1502 "%s:%s:%d",
1503 gnutls_protocol_get_name(protocol),
1504 gnutls_cipher_suite_get_name(kx, cipher, mac),
1505 (int) gnutls_cipher_get_key_size(cipher) * 8);
1506
1507/* I don't see a way that spaces could occur, in the current GnuTLS
1508code base, but it was a concern in the old code and perhaps older GnuTLS
1509releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1510for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1511 if (isspace(*p))
1512 *p = '-';
75fe387d
PP
1513old_pool = store_pool;
1514store_pool = POOL_PERM;
1515state->ciphersuite = string_copy(cipherbuf);
1516store_pool = old_pool;
817d9f57 1517state->tlsp->cipher = state->ciphersuite;
4fe99a6c
PP
1518
1519/* tls_peerdn */
17c76198 1520cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1521
17c76198
PP
1522if (cert_list == NULL || cert_list_size == 0)
1523 {
17c76198
PP
1524 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1525 cert_list, cert_list_size);
e51c7be2 1526 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1527 return tls_error(US"certificate verification failed",
48224640 1528 US"no certificate received from peer", state->host, errstr);
17c76198
PP
1529 return OK;
1530 }
059ec3d9 1531
17c76198
PP
1532ct = gnutls_certificate_type_get(state->session);
1533if (ct != GNUTLS_CRT_X509)
059ec3d9 1534 {
48224640 1535 const uschar *ctn = US gnutls_certificate_type_get_name(ct);
17c76198
PP
1536 DEBUG(D_tls)
1537 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1538 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1539 return tls_error(US"certificate verification not possible, unhandled type",
cf0c6164 1540 ctn, state->host, errstr);
17c76198 1541 return OK;
83da1223 1542 }
059ec3d9 1543
e51c7be2
JH
1544#define exim_gnutls_peer_err(Label) \
1545 do { \
1546 if (rc != GNUTLS_E_SUCCESS) \
1547 { \
1548 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1549 (Label), gnutls_strerror(rc)); \
1550 if (state->verify_requirement >= VERIFY_REQUIRED) \
48224640 1551 return tls_error((Label), US gnutls_strerror(rc), state->host, errstr); \
e51c7be2
JH
1552 return OK; \
1553 } \
1554 } while (0)
17c76198 1555
9d1c15ef
JH
1556rc = import_cert(&cert_list[0], &crt);
1557exim_gnutls_peer_err(US"cert 0");
1558
1559state->tlsp->peercert = state->peercert = crt;
17c76198 1560
17c76198
PP
1561sz = 0;
1562rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1563if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1564 {
17c76198
PP
1565 exim_gnutls_peer_err(US"getting size for cert DN failed");
1566 return FAIL; /* should not happen */
059ec3d9 1567 }
17c76198
PP
1568dn_buf = store_get_perm(sz);
1569rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1570exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1571
17c76198
PP
1572state->peerdn = dn_buf;
1573
1574return OK;
1575#undef exim_gnutls_peer_err
1576}
059ec3d9 1577
059ec3d9 1578
059ec3d9 1579
059ec3d9 1580
17c76198
PP
1581/*************************************************
1582* Verify peer certificate *
1583*************************************************/
059ec3d9 1584
17c76198
PP
1585/* Called from both server and client code.
1586*Should* be using a callback registered with
1587gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1588the peer information, but that's too new for some OSes.
059ec3d9 1589
17c76198 1590Arguments:
899b8bbc
JH
1591 state exim_gnutls_state_st *
1592 errstr where to put an error message
059ec3d9 1593
17c76198
PP
1594Returns:
1595 FALSE if the session should be rejected
1596 TRUE if the cert is okay or we just don't care
1597*/
059ec3d9 1598
17c76198 1599static BOOL
28646fa9 1600verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
17c76198
PP
1601{
1602int rc;
899b8bbc
JH
1603uint verify;
1604
1605if (state->verify_requirement == VERIFY_NONE)
1606 return TRUE;
17c76198 1607
8008accd 1608DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
cf0c6164 1609*errstr = NULL;
17c76198 1610
cf0c6164 1611if ((rc = peer_status(state, errstr)) != OK)
e6060e2c 1612 {
17c76198 1613 verify = GNUTLS_CERT_INVALID;
cf0c6164 1614 *errstr = US"certificate not supplied";
17c76198
PP
1615 }
1616else
899b8bbc
JH
1617
1618 {
1619#ifdef SUPPORT_DANE
1620 if (state->verify_requirement == VERIFY_DANE && state->host)
1621 {
1622 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1623 including talking to a DNS resolver. But we want to do that bit ourselves
1624 as the testsuite intercepts and fakes its own DNS environment. */
1625
1626 dane_state_t s;
1627 dane_query_t r;
899b8bbc 1628 uint lsize;
94c13285
JH
1629 const gnutls_datum_t * certlist =
1630 gnutls_certificate_get_peers(state->session, &lsize);
1631 int usage = tls_out.tlsa_usage;
1632
1633# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1634 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1635 dane-verification separately so that we know which selector verified;
570cb1bd 1636 then we know whether to do name-verification (needed for TA but not EE). */
94c13285
JH
1637
1638 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
bd5b3f3c 1639 { /* a mixed-usage bundle */
94c13285
JH
1640 int i, j, nrec;
1641 const char ** dd;
1642 int * ddl;
1643
1644 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1645 nrec++;
1646
1647 dd = store_get(nrec * sizeof(uschar *));
1648 ddl = store_get(nrec * sizeof(int));
1649 nrec--;
1650
1651 if ((rc = dane_state_init(&s, 0)))
1652 goto tlsa_prob;
1653
1654 for (usage = DANESSL_USAGE_DANE_EE;
1655 usage >= DANESSL_USAGE_DANE_TA; usage--)
1656 { /* take records with this usage */
1657 for (j = i = 0; i < nrec; i++)
1658 if (state->dane_data[i][0] == usage)
1659 {
1660 dd[j] = state->dane_data[i];
1661 ddl[j++] = state->dane_data_len[i];
1662 }
1663 if (j)
1664 {
1665 dd[j] = NULL;
1666 ddl[j] = 0;
1667
1668 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1669 goto tlsa_prob;
1670
1671 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1672 gnutls_certificate_type_get(state->session),
1673 r, 0,
1674 usage == DANESSL_USAGE_DANE_EE
1675 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1676 &verify)))
1677 {
1678 DEBUG(D_tls)
1679 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1680 }
1681 else if (verify == 0) /* verification passed */
1682 {
1683 usage = 1 << usage;
1684 break;
1685 }
1686 }
1687 }
899b8bbc 1688
94c13285
JH
1689 if (rc) goto tlsa_prob;
1690 }
1691 else
1692# endif
899b8bbc 1693 {
94c13285
JH
1694 if ( (rc = dane_state_init(&s, 0))
1695 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1696 1, 0))
1697 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1698 gnutls_certificate_type_get(state->session),
5ec37a55 1699 r, 0,
94c13285
JH
1700# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1701 usage == (1 << DANESSL_USAGE_DANE_EE)
1702 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1703# else
1704 0,
1705# endif
1706 &verify))
1707 )
1708 goto tlsa_prob;
899b8bbc 1709 }
94c13285
JH
1710
1711 if (verify != 0) /* verification failed */
899b8bbc
JH
1712 {
1713 gnutls_datum_t str;
1714 (void) dane_verification_status_print(verify, &str, 0);
1715 *errstr = US str.data; /* don't bother to free */
1716 goto badcert;
1717 }
28646fa9 1718
94c13285
JH
1719# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1720 /* If a TA-mode TLSA record was used for verification we must additionally
570cb1bd 1721 verify the cert name (but not the CA chain). For EE-mode, skip it. */
28646fa9 1722
94c13285
JH
1723 if (usage & (1 << DANESSL_USAGE_DANE_EE))
1724# endif
28646fa9 1725 {
570cb1bd 1726 state->peer_dane_verified = state->peer_cert_verified = TRUE;
28646fa9
JH
1727 goto goodcert;
1728 }
570cb1bd
JH
1729# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1730 /* Assume that the name on the A-record is the one that should be matching
1731 the cert. An alternate view is that the domain part of the email address
1732 is also permissible. */
1733
1734 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1735 CS state->host->name))
1736 {
1737 state->peer_dane_verified = state->peer_cert_verified = TRUE;
1738 goto goodcert;
1739 }
1740# endif
899b8bbc 1741 }
570cb1bd 1742#endif /*SUPPORT_DANE*/
899b8bbc 1743
17c76198 1744 rc = gnutls_certificate_verify_peers2(state->session, &verify);
899b8bbc 1745 }
e6060e2c 1746
899b8bbc 1747/* Handle the result of verification. INVALID is set if any others are. */
059ec3d9 1748
28646fa9 1749if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
17c76198
PP
1750 {
1751 state->peer_cert_verified = FALSE;
cf0c6164 1752 if (!*errstr)
184384c3
JH
1753 {
1754#ifdef GNUTLS_CERT_VFY_STATUS_PRINT
1755 DEBUG(D_tls)
1756 {
1757 gnutls_datum_t txt;
1758
1759 if (gnutls_certificate_verification_status_print(verify,
1760 gnutls_certificate_type_get(state->session), &txt, 0)
1761 == GNUTLS_E_SUCCESS)
1762 {
1763 debug_printf("%s\n", txt.data);
1764 gnutls_free(txt.data);
1765 }
1766 }
1767#endif
cf0c6164
JH
1768 *errstr = verify & GNUTLS_CERT_REVOKED
1769 ? US"certificate revoked" : US"certificate invalid";
184384c3 1770 }
059ec3d9 1771
17c76198 1772 DEBUG(D_tls)
e51c7be2 1773 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
cf0c6164 1774 *errstr, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1775
e51c7be2 1776 if (state->verify_requirement >= VERIFY_REQUIRED)
899b8bbc 1777 goto badcert;
17c76198 1778 DEBUG(D_tls)
4789da3a 1779 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 1780 }
e51c7be2 1781
17c76198
PP
1782else
1783 {
5fd28bb8
JH
1784 /* Client side, check the server's certificate name versus the name on the
1785 A-record for the connection we made. What to do for server side - what name
1786 to use for client? We document that there is no such checking for server
1787 side. */
1788
1789 if ( state->exp_tls_verify_cert_hostnames
1790 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1791 CS state->exp_tls_verify_cert_hostnames)
1792 )
e51c7be2 1793 {
5fd28bb8
JH
1794 DEBUG(D_tls)
1795 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1796 if (state->verify_requirement >= VERIFY_REQUIRED)
1797 goto badcert;
1798 return TRUE;
e51c7be2 1799 }
5fd28bb8 1800
17c76198 1801 state->peer_cert_verified = TRUE;
e51c7be2 1802 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 1803 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1804 }
059ec3d9 1805
28646fa9
JH
1806goodcert:
1807 state->tlsp->peerdn = state->peerdn;
1808 return TRUE;
899b8bbc 1809
b83314e3 1810#ifdef SUPPORT_DANE
94c13285 1811tlsa_prob:
624f33df
JH
1812 *errstr = string_sprintf("TLSA record problem: %s",
1813 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
b83314e3
JH
1814#endif
1815
899b8bbc
JH
1816badcert:
1817 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1818 return FALSE;
17c76198 1819}
059ec3d9 1820
17c76198
PP
1821
1822
1823
1824/* ------------------------------------------------------------------------ */
1825/* Callbacks */
1826
1827/* Logging function which can be registered with
1828 * gnutls_global_set_log_function()
1829 * gnutls_global_set_log_level() 0..9
1830 */
af3498d6 1831#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1832static void
17c76198 1833exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1834{
8c79eebf
PP
1835 size_t len = strlen(message);
1836 if (len < 1)
1837 {
1838 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1839 return;
1840 }
1841 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1842 message[len-1] == '\n' ? "" : "\n");
17c76198 1843}
af3498d6 1844#endif
059ec3d9 1845
059ec3d9 1846
17c76198
PP
1847/* Called after client hello, should handle SNI work.
1848This will always set tls_sni (state->received_sni) if available,
1849and may trigger presenting different certificates,
1850if state->trigger_sni_changes is TRUE.
059ec3d9 1851
17c76198
PP
1852Should be registered with
1853 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1854
17c76198
PP
1855"This callback must return 0 on success or a gnutls error code to terminate the
1856handshake.".
059ec3d9 1857
17c76198
PP
1858For inability to get SNI information, we return 0.
1859We only return non-zero if re-setup failed.
817d9f57 1860Only used for server-side TLS.
17c76198 1861*/
44bbabb5 1862
17c76198
PP
1863static int
1864exim_sni_handling_cb(gnutls_session_t session)
1865{
1866char sni_name[MAX_HOST_LEN];
1867size_t data_len = MAX_HOST_LEN;
817d9f57 1868exim_gnutls_state_st *state = &state_server;
17c76198
PP
1869unsigned int sni_type;
1870int rc, old_pool;
cf0c6164 1871uschar * dummy_errstr;
17c76198
PP
1872
1873rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1874if (rc != GNUTLS_E_SUCCESS)
1875 {
1876 DEBUG(D_tls) {
1877 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1878 debug_printf("TLS: no SNI presented in handshake.\n");
1879 else
1880 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1881 gnutls_strerror(rc), rc);
cf0c6164 1882 }
b34fc30c
PP
1883 return 0;
1884 }
1885
17c76198
PP
1886if (sni_type != GNUTLS_NAME_DNS)
1887 {
1888 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1889 return 0;
1890 }
44bbabb5 1891
17c76198
PP
1892/* We now have a UTF-8 string in sni_name */
1893old_pool = store_pool;
1894store_pool = POOL_PERM;
1895state->received_sni = string_copyn(US sni_name, data_len);
1896store_pool = old_pool;
1897
1898/* We set this one now so that variable expansions below will work */
817d9f57 1899state->tlsp->sni = state->received_sni;
17c76198
PP
1900
1901DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1902 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1903
1904if (!state->trigger_sni_changes)
1905 return 0;
1906
cf0c6164 1907if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
17c76198
PP
1908 {
1909 /* If the setup of certs/etc failed before handshake, TLS would not have
1910 been offered. The best we can do now is abort. */
1911 return GNUTLS_E_APPLICATION_ERROR_MIN;
1912 }
1913
cf0c6164 1914rc = tls_set_remaining_x509(state, &dummy_errstr);
1365611d
PP
1915if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1916
1917return 0;
059ec3d9
PH
1918}
1919
1920
1921
f2de3a33 1922#ifndef DISABLE_OCSP
44662487
JH
1923
1924static int
1925server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1926 gnutls_datum_t * ocsp_response)
1927{
1928int ret;
47195144 1929DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
44662487 1930
44662487
JH
1931if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1932 {
1933 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
5903c6ff 1934 CS ptr);
018058b2 1935 tls_in.ocsp = OCSP_NOT_RESP;
44662487
JH
1936 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1937 }
1938
018058b2 1939tls_in.ocsp = OCSP_VFY_NOT_TRIED;
44662487
JH
1940return 0;
1941}
1942
1943#endif
1944
1945
0cbf2b82 1946#ifndef DISABLE_EVENT
a7538db1
JH
1947/*
1948We use this callback to get observability and detail-level control
723fe533
JH
1949for an exim TLS connection (either direction), raising a tls:cert event
1950for each cert in the chain presented by the peer. Any event
a7538db1
JH
1951can deny verification.
1952
1953Return 0 for the handshake to continue or non-zero to terminate.
1954*/
1955
1956static int
723fe533 1957verify_cb(gnutls_session_t session)
a7538db1 1958{
27f19eb4 1959const gnutls_datum_t * cert_list;
a7538db1
JH
1960unsigned int cert_list_size = 0;
1961gnutls_x509_crt_t crt;
1962int rc;
b30275b8 1963uschar * yield;
a7538db1
JH
1964exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1965
bd5b3f3c 1966if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
a7538db1
JH
1967 while (cert_list_size--)
1968 {
bd5b3f3c 1969 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
a7538db1
JH
1970 {
1971 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1972 cert_list_size, gnutls_strerror(rc));
1973 break;
1974 }
1975
1976 state->tlsp->peercert = crt;
b30275b8
JH
1977 if ((yield = event_raise(state->event_action,
1978 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
1979 {
1980 log_write(0, LOG_MAIN,
b30275b8
JH
1981 "SSL verify denied by event-action: depth=%d: %s",
1982 cert_list_size, yield);
a7538db1
JH
1983 return 1; /* reject */
1984 }
1985 state->tlsp->peercert = NULL;
1986 }
1987
1988return 0;
1989}
1990
1991#endif
44662487
JH
1992
1993
17c76198
PP
1994
1995/* ------------------------------------------------------------------------ */
1996/* Exported functions */
1997
1998
1999
2000
059ec3d9
PH
2001/*************************************************
2002* Start a TLS session in a server *
2003*************************************************/
2004
2005/* This is called when Exim is running as a server, after having received
2006the STARTTLS command. It must respond to that command, and then negotiate
2007a TLS session.
2008
2009Arguments:
83da1223 2010 require_ciphers list of allowed ciphers or NULL
cf0c6164 2011 errstr pointer to error string
059ec3d9
PH
2012
2013Returns: OK on success
2014 DEFER for errors before the start of the negotiation
4c04137d 2015 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
2016 continue running.
2017*/
2018
2019int
cf0c6164 2020tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
2021{
2022int rc;
cf0c6164 2023exim_gnutls_state_st * state = NULL;
059ec3d9
PH
2024
2025/* Check for previous activation */
74f1a423 2026if (tls_in.active.sock >= 0)
059ec3d9 2027 {
48224640 2028 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
925ac8e4 2029 smtp_printf("554 Already in TLS\r\n", FALSE);
059ec3d9
PH
2030 return FAIL;
2031 }
2032
2033/* Initialize the library. If it fails, it will already have logged the error
2034and sent an SMTP response. */
2035
17c76198 2036DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 2037
cf0c6164 2038if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
17c76198 2039 NULL, tls_verify_certificates, tls_crl,
74f1a423 2040 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
059ec3d9 2041
059ec3d9
PH
2042/* If this is a host for which certificate verification is mandatory or
2043optional, set up appropriately. */
2044
059ec3d9 2045if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 2046 {
e51c7be2
JH
2047 DEBUG(D_tls)
2048 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
2049 state->verify_requirement = VERIFY_REQUIRED;
2050 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2051 }
059ec3d9 2052else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 2053 {
e51c7be2
JH
2054 DEBUG(D_tls)
2055 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
2056 state->verify_requirement = VERIFY_OPTIONAL;
2057 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2058 }
2059else
2060 {
e51c7be2
JH
2061 DEBUG(D_tls)
2062 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
2063 state->verify_requirement = VERIFY_NONE;
2064 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2065 }
059ec3d9 2066
0cbf2b82 2067#ifndef DISABLE_EVENT
723fe533
JH
2068if (event_action)
2069 {
2070 state->event_action = event_action;
2071 gnutls_session_set_ptr(state->session, state);
2072 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2073 }
2074#endif
2075
17c76198
PP
2076/* Register SNI handling; always, even if not in tls_certificate, so that the
2077expansion variable $tls_sni is always available. */
059ec3d9 2078
17c76198
PP
2079gnutls_handshake_set_post_client_hello_function(state->session,
2080 exim_sni_handling_cb);
059ec3d9
PH
2081
2082/* Set context and tell client to go ahead, except in the case of TLS startup
2083on connection, where outputting anything now upsets the clients and tends to
2084make them disconnect. We need to have an explicit fflush() here, to force out
2085the response. Other smtp_printf() calls do not need it, because in non-TLS
2086mode, the fflush() happens when smtp_getc() is called. */
2087
817d9f57 2088if (!state->tlsp->on_connect)
059ec3d9 2089 {
925ac8e4 2090 smtp_printf("220 TLS go ahead\r\n", FALSE);
9d1c15ef 2091 fflush(smtp_out);
059ec3d9
PH
2092 }
2093
2094/* Now negotiate the TLS session. We put our own timer on it, since it seems
8008accd
JH
2095that the GnuTLS library doesn't.
2096From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2097to set (and clear down afterwards) up a pull-timeout callback function that does
2098a select, so we're no better off unless avoiding signals becomes an issue. */
059ec3d9 2099
17c76198 2100gnutls_transport_set_ptr2(state->session,
27f19eb4
JH
2101 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2102 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
17c76198
PP
2103state->fd_in = fileno(smtp_in);
2104state->fd_out = fileno(smtp_out);
059ec3d9
PH
2105
2106sigalrm_seen = FALSE;
c2a1bba0 2107if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
17c76198 2108do
17c76198 2109 rc = gnutls_handshake(state->session);
157a7880 2110while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2111ALARM_CLR(0);
059ec3d9 2112
17c76198 2113if (rc != GNUTLS_E_SUCCESS)
059ec3d9 2114 {
059ec3d9
PH
2115 /* It seems that, except in the case of a timeout, we have to close the
2116 connection right here; otherwise if the other end is running OpenSSL it hangs
2117 until the server times out. */
2118
60d10ce7 2119 if (sigalrm_seen)
ad7fc6eb 2120 {
48224640 2121 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
ad7fc6eb
JH
2122 gnutls_db_remove_session(state->session);
2123 }
60d10ce7 2124 else
059ec3d9 2125 {
48224640 2126 tls_error(US"gnutls_handshake", US gnutls_strerror(rc), NULL, errstr);
f5d25c2b 2127 (void) gnutls_alert_send_appropriate(state->session, rc);
ad7fc6eb 2128 gnutls_deinit(state->session);
ed62aae3 2129 gnutls_certificate_free_credentials(state->x509_cred);
60d10ce7 2130 millisleep(500);
ad7fc6eb 2131 shutdown(state->fd_out, SHUT_WR);
60d10ce7 2132 for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--; /* drain skt */
f1e894f3
PH
2133 (void)fclose(smtp_out);
2134 (void)fclose(smtp_in);
60d10ce7 2135 smtp_out = smtp_in = NULL;
059ec3d9
PH
2136 }
2137
2138 return FAIL;
2139 }
2140
2141DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2142
17c76198
PP
2143/* Verify after the fact */
2144
899b8bbc 2145if (!verify_certificate(state, errstr))
059ec3d9 2146 {
9d1c15ef 2147 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 2148 {
cf0c6164 2149 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
9d1c15ef 2150 return FAIL;
17c76198 2151 }
9d1c15ef
JH
2152 DEBUG(D_tls)
2153 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
cf0c6164 2154 *errstr);
059ec3d9
PH
2155 }
2156
17c76198
PP
2157/* Figure out peer DN, and if authenticated, etc. */
2158
cf0c6164 2159if ((rc = peer_status(state, NULL)) != OK) return rc;
17c76198
PP
2160
2161/* Sets various Exim expansion variables; always safe within server */
2162
9d1c15ef 2163extract_exim_vars_from_tls_state(state);
059ec3d9
PH
2164
2165/* TLS has been set up. Adjust the input functions to read via TLS,
2166and initialize appropriately. */
2167
17c76198 2168state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
2169
2170receive_getc = tls_getc;
0d81dabc 2171receive_getbuf = tls_getbuf;
584e96c6 2172receive_get_cache = tls_get_cache;
059ec3d9
PH
2173receive_ungetc = tls_ungetc;
2174receive_feof = tls_feof;
2175receive_ferror = tls_ferror;
58eb016e 2176receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2177
059ec3d9
PH
2178return OK;
2179}
2180
2181
2182
2183
aa2a70ba
JH
2184static void
2185tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2186 smtp_transport_options_block * ob)
2187{
3fb3231c 2188if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 2189 {
4af0d74a 2190 state->exp_tls_verify_cert_hostnames =
8c5d388a 2191#ifdef SUPPORT_I18N
4af0d74a
JH
2192 string_domain_utf8_to_alabel(host->name, NULL);
2193#else
2194 host->name;
2195#endif
aa2a70ba
JH
2196 DEBUG(D_tls)
2197 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2198 state->exp_tls_verify_cert_hostnames);
2199 }
2200}
aa2a70ba
JH
2201
2202
899b8bbc
JH
2203
2204
2205#ifdef SUPPORT_DANE
2206/* Given our list of RRs from the TLSA lookup, build a lookup block in
2207GnuTLS-DANE's preferred format. Hang it on the state str for later
2208use in DANE verification.
2209
2210We point at the dnsa data not copy it, so it must remain valid until
2211after verification is done.*/
2212
3674140c 2213static BOOL
899b8bbc
JH
2214dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2215{
2216dns_record * rr;
2217dns_scan dnss;
2218int i;
2219const char ** dane_data;
2220int * dane_data_len;
2221
2222for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 1;
2223 rr;
2224 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2225 ) if (rr->type == T_TLSA) i++;
2226
2227dane_data = store_get(i * sizeof(uschar *));
2228dane_data_len = store_get(i * sizeof(int));
2229
2230for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 0;
2231 rr;
2232 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1b76ad22 2233 ) if (rr->type == T_TLSA && rr->size > 3)
899b8bbc
JH
2234 {
2235 const uschar * p = rr->data;
3674140c
JH
2236 uint8_t usage = p[0], sel = p[1], type = p[2];
2237
2238 DEBUG(D_tls)
2239 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2240
94c13285
JH
2241 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2242 || (sel != 0 && sel != 1)
2243 )
2244 continue;
3674140c
JH
2245 switch(type)
2246 {
2247 case 0: /* Full: cannot check at present */
2248 break;
2249 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2250 break;
2251 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2252 break;
2253 default: continue;
2254 }
899b8bbc
JH
2255
2256 tls_out.tlsa_usage |= 1<<usage;
48224640 2257 dane_data[i] = CS p;
899b8bbc
JH
2258 dane_data_len[i++] = rr->size;
2259 }
3674140c
JH
2260
2261if (!i) return FALSE;
2262
899b8bbc
JH
2263dane_data[i] = NULL;
2264dane_data_len[i] = 0;
2265
2266state->dane_data = (char * const *)dane_data;
2267state->dane_data_len = dane_data_len;
3674140c 2268return TRUE;
899b8bbc
JH
2269}
2270#endif
2271
2272
2273
059ec3d9
PH
2274/*************************************************
2275* Start a TLS session in a client *
2276*************************************************/
2277
2278/* Called from the smtp transport after STARTTLS has been accepted.
2279
2280Arguments:
2281 fd the fd of the connection
afdb5e9c 2282 host connected host (for messages and option-tests)
83da1223 2283 addr the first address (not used)
a7538db1 2284 tb transport (always smtp)
899b8bbc
JH
2285 tlsa_dnsa non-NULL, either request or require dane for this host, and
2286 a TLSA record found. Therefore, dane verify required.
2287 Which implies cert must be requested and supplied, dane
2288 verify must pass, and cert verify irrelevant (incl.
2289 hostnames), and (caller handled) require_tls
74f1a423 2290 tlsp record details of channel configuration
cf0c6164
JH
2291 errstr error string pointer
2292
74f1a423 2293Returns: Pointer to TLS session context, or NULL on error
059ec3d9
PH
2294*/
2295
74f1a423 2296void *
17c76198 2297tls_client_start(int fd, host_item *host,
f5d78688 2298 address_item *addr ARG_UNUSED,
cf0c6164 2299 transport_instance * tb,
c0635b6d 2300#ifdef SUPPORT_DANE
899b8bbc 2301 dns_answer * tlsa_dnsa,
0e66b3b6 2302#endif
74f1a423 2303 tls_support * tlsp, uschar ** errstr)
059ec3d9 2304{
afdb5e9c
JH
2305smtp_transport_options_block *ob = tb
2306 ? (smtp_transport_options_block *)tb->options_block
2307 : &smtp_transport_option_defaults;
059ec3d9 2308int rc;
899b8bbc 2309exim_gnutls_state_st * state = NULL;
5ec37a55 2310uschar *cipher_list = NULL;
74f1a423 2311
f2de3a33 2312#ifndef DISABLE_OCSP
5130845b 2313BOOL require_ocsp =
3fb3231c 2314 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
44662487 2315BOOL request_ocsp = require_ocsp ? TRUE
3fb3231c 2316 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2b4a568d 2317#endif
059ec3d9 2318
17c76198 2319DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 2320
5ec37a55 2321#ifdef SUPPORT_DANE
cf260049 2322if (tlsa_dnsa && ob->dane_require_tls_ciphers)
5ec37a55
PP
2323 {
2324 /* not using expand_check_tlsvar because not yet in state */
2325 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2326 &cipher_list, errstr))
74f1a423 2327 return NULL;
cf260049
JH
2328 cipher_list = cipher_list && *cipher_list
2329 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
5ec37a55
PP
2330 }
2331#endif
2332
2333if (!cipher_list)
2334 cipher_list = ob->tls_require_ciphers;
2335
74f1a423 2336if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
65867078 2337 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
74f1a423
JH
2338 cipher_list, &state, tlsp, errstr) != OK)
2339 return NULL;
059ec3d9 2340
54c90be1 2341 {
65867078
JH
2342 int dh_min_bits = ob->tls_dh_min_bits;
2343 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2344 {
2345 DEBUG(D_tls)
2346 debug_printf("WARNING: tls_dh_min_bits far too low,"
2347 " clamping %d up to %d\n",
2348 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2349 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2350 }
54c90be1 2351
65867078
JH
2352 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2353 " acceptable bits to %d\n",
2354 dh_min_bits);
2355 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2356 }
83da1223 2357
94431adb 2358/* Stick to the old behaviour for compatibility if tls_verify_certificates is
2b4a568d
JH
2359set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2360the specified host patterns if one of them is defined */
2361
899b8bbc 2362#ifdef SUPPORT_DANE
3674140c 2363if (tlsa_dnsa && dane_tlsa_load(state, tlsa_dnsa))
899b8bbc
JH
2364 {
2365 DEBUG(D_tls)
2366 debug_printf("TLS: server certificate DANE required.\n");
2367 state->verify_requirement = VERIFY_DANE;
2368 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
899b8bbc
JH
2369 }
2370else
2371#endif
2372 if ( ( state->exp_tls_verify_certificates
2373 && !ob->tls_verify_hosts
2374 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2375 )
3fb3231c 2376 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
899b8bbc 2377 )
17c76198 2378 {
aa2a70ba 2379 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
2380 DEBUG(D_tls)
2381 debug_printf("TLS: server certificate verification required.\n");
2382 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
2383 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2384 }
3fb3231c 2385else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
52f93eed 2386 {
aa2a70ba 2387 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
2388 DEBUG(D_tls)
2389 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 2390 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
2391 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2392 }
2393else
2394 {
e51c7be2
JH
2395 DEBUG(D_tls)
2396 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
2397 state->verify_requirement = VERIFY_NONE;
2398 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 2399 }
059ec3d9 2400
f2de3a33
JH
2401#ifndef DISABLE_OCSP
2402 /* supported since GnuTLS 3.1.3 */
44662487 2403if (request_ocsp)
9d1c15ef
JH
2404 {
2405 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
2406 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2407 NULL, 0, NULL)) != OK)
74f1a423 2408 {
48224640 2409 tls_error(US"cert-status-req", US gnutls_strerror(rc), state->host, errstr);
74f1a423
JH
2410 return NULL;
2411 }
2412 tlsp->ocsp = OCSP_NOT_RESP;
9d1c15ef 2413 }
2b4a568d
JH
2414#endif
2415
0cbf2b82 2416#ifndef DISABLE_EVENT
afdb5e9c 2417if (tb && tb->event_action)
a7538db1 2418 {
774ef2d7 2419 state->event_action = tb->event_action;
a7538db1 2420 gnutls_session_set_ptr(state->session, state);
723fe533 2421 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
2422 }
2423#endif
2424
27f19eb4 2425gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
17c76198
PP
2426state->fd_in = fd;
2427state->fd_out = fd;
059ec3d9 2428
9d1c15ef 2429DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
2430/* There doesn't seem to be a built-in timeout on connection. */
2431
2432sigalrm_seen = FALSE;
c2a1bba0 2433ALARM(ob->command_timeout);
17c76198 2434do
17c76198 2435 rc = gnutls_handshake(state->session);
f1fed05b 2436while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2437ALARM_CLR(0);
059ec3d9 2438
4fe99a6c 2439if (rc != GNUTLS_E_SUCCESS)
74f1a423 2440 {
60d10ce7
JH
2441 if (sigalrm_seen)
2442 {
2443 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
48224640 2444 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
60d10ce7
JH
2445 }
2446 else
48224640 2447 tls_error(US"gnutls_handshake", US gnutls_strerror(rc), state->host, errstr);
74f1a423
JH
2448 return NULL;
2449 }
4fe99a6c 2450
17c76198 2451DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 2452
17c76198 2453/* Verify late */
059ec3d9 2454
899b8bbc 2455if (!verify_certificate(state, errstr))
74f1a423
JH
2456 {
2457 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
2458 return NULL;
2459 }
059ec3d9 2460
f2de3a33 2461#ifndef DISABLE_OCSP
2b4a568d
JH
2462if (require_ocsp)
2463 {
2464 DEBUG(D_tls)
2465 {
2466 gnutls_datum_t stapling;
2467 gnutls_ocsp_resp_t resp;
2468 gnutls_datum_t printed;
2469 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2470 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2471 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2472 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2473 )
2474 {
65867078 2475 debug_printf("%.4096s", printed.data);
2b4a568d
JH
2476 gnutls_free(printed.data);
2477 }
2478 else
48224640 2479 (void) tls_error(US"ocsp decode", US gnutls_strerror(rc), state->host, errstr);
2b4a568d
JH
2480 }
2481
2b4a568d 2482 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2 2483 {
74f1a423
JH
2484 tlsp->ocsp = OCSP_FAILED;
2485 tls_error(US"certificate status check failed", NULL, state->host, errstr);
2486 return NULL;
018058b2 2487 }
2b4a568d 2488 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
74f1a423 2489 tlsp->ocsp = OCSP_VFIED;
2b4a568d
JH
2490 }
2491#endif
2492
17c76198 2493/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 2494
74f1a423
JH
2495if (peer_status(state, errstr) != OK)
2496 return NULL;
059ec3d9 2497
4fe99a6c 2498/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 2499
9d1c15ef 2500extract_exim_vars_from_tls_state(state);
059ec3d9 2501
74f1a423 2502return state;
059ec3d9
PH
2503}
2504
2505
2506
17c76198 2507
059ec3d9 2508/*************************************************
17c76198 2509* Close down a TLS session *
059ec3d9
PH
2510*************************************************/
2511
17c76198
PP
2512/* This is also called from within a delivery subprocess forked from the
2513daemon, to shut down the TLS library, without actually doing a shutdown (which
2514would tamper with the TLS session in the parent process).
059ec3d9 2515
dec766a1 2516Arguments:
74f1a423 2517 ct_ctx client context pointer, or NULL for the one global server context
dec766a1 2518 shutdown 1 if TLS close-alert is to be sent,
afdb5e9c 2519 2 if also response to be waited for
dec766a1 2520
17c76198 2521Returns: nothing
059ec3d9
PH
2522*/
2523
17c76198 2524void
74f1a423 2525tls_close(void * ct_ctx, int shutdown)
059ec3d9 2526{
74f1a423 2527exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
059ec3d9 2528
74f1a423 2529if (!state->tlsp || state->tlsp->active.sock < 0) return; /* TLS was not active */
17c76198
PP
2530
2531if (shutdown)
2532 {
dec766a1
WB
2533 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
2534 shutdown > 1 ? " (with response-wait)" : "");
2535
c2a1bba0 2536 ALARM(2);
dec766a1 2537 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
c2a1bba0 2538 ALARM_CLR(0);
17c76198
PP
2539 }
2540
2541gnutls_deinit(state->session);
ed62aae3
HSHR
2542gnutls_certificate_free_credentials(state->x509_cred);
2543
17c76198 2544
74f1a423
JH
2545state->tlsp->active.sock = -1;
2546state->tlsp->active.tls_ctx = NULL;
b808677c 2547if (state->xfer_buffer) store_free(state->xfer_buffer);
17c76198 2548memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
059ec3d9
PH
2549}
2550
2551
2552
17c76198 2553
0d81dabc
JH
2554static BOOL
2555tls_refill(unsigned lim)
2556{
2557exim_gnutls_state_st * state = &state_server;
2558ssize_t inbytes;
2559
2560DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2561 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2562
f1fed05b 2563sigalrm_seen = FALSE;
c2a1bba0 2564if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4896a319
AM
2565
2566do
2567 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2568 MIN(ssl_xfer_buffer_size, lim));
2569while (inbytes == GNUTLS_E_AGAIN);
2570
c2a1bba0 2571if (smtp_receive_timeout > 0) ALARM_CLR(0);
9723f966
JH
2572
2573if (had_command_timeout) /* set by signal handler */
2574 smtp_command_timeout_exit(); /* does not return */
2575if (had_command_sigterm)
2576 smtp_command_sigterm_exit();
2577if (had_data_timeout)
2578 smtp_data_timeout_exit();
2579if (had_data_sigint)
2580 smtp_data_sigint_exit();
2581
2582/* Timeouts do not get this far. A zero-byte return appears to mean that the
2583TLS session has been closed down, not that the socket itself has been closed
2584down. Revert to non-TLS handling. */
0d81dabc
JH
2585
2586if (sigalrm_seen)
2587 {
2588 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
8b77d27a 2589 state->xfer_error = TRUE;
0d81dabc
JH
2590 return FALSE;
2591 }
2592
2593else if (inbytes == 0)
2594 {
2595 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2596
2597 receive_getc = smtp_getc;
2598 receive_getbuf = smtp_getbuf;
2599 receive_get_cache = smtp_get_cache;
2600 receive_ungetc = smtp_ungetc;
2601 receive_feof = smtp_feof;
2602 receive_ferror = smtp_ferror;
2603 receive_smtp_buffered = smtp_buffered;
2604
2605 gnutls_deinit(state->session);
2606 gnutls_certificate_free_credentials(state->x509_cred);
2607
2608 state->session = NULL;
74f1a423
JH
2609 state->tlsp->active.sock = -1;
2610 state->tlsp->active.tls_ctx = NULL;
0d81dabc
JH
2611 state->tlsp->bits = 0;
2612 state->tlsp->certificate_verified = FALSE;
2613 tls_channelbinding_b64 = NULL;
2614 state->tlsp->cipher = NULL;
2615 state->tlsp->peercert = NULL;
2616 state->tlsp->peerdn = NULL;
2617
2618 return FALSE;
2619 }
2620
2621/* Handle genuine errors */
2622
2623else if (inbytes < 0)
2624 {
4896a319 2625 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv(\n", __FUNCTION__);
0d81dabc 2626 record_io_error(state, (int) inbytes, US"recv", NULL);
8b77d27a 2627 state->xfer_error = TRUE;
0d81dabc
JH
2628 return FALSE;
2629 }
2630#ifndef DISABLE_DKIM
2631dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2632#endif
2633state->xfer_buffer_hwm = (int) inbytes;
2634state->xfer_buffer_lwm = 0;
2635return TRUE;
2636}
2637
059ec3d9
PH
2638/*************************************************
2639* TLS version of getc *
2640*************************************************/
2641
2642/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2643it refills the buffer via the GnuTLS reading function.
817d9f57 2644Only used by the server-side TLS.
059ec3d9 2645
17c76198
PP
2646This feeds DKIM and should be used for all message-body reads.
2647
aded2255 2648Arguments: lim Maximum amount to read/buffer
059ec3d9
PH
2649Returns: the next character or EOF
2650*/
2651
2652int
bd8fbe36 2653tls_getc(unsigned lim)
059ec3d9 2654{
0d81dabc 2655exim_gnutls_state_st * state = &state_server;
059ec3d9 2656
0d81dabc
JH
2657if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2658 if (!tls_refill(lim))
2659 return state->xfer_error ? EOF : smtp_getc(lim);
ed62aae3 2660
0d81dabc 2661/* Something in the buffer; return next uschar */
059ec3d9 2662
0d81dabc
JH
2663return state->xfer_buffer[state->xfer_buffer_lwm++];
2664}
059ec3d9 2665
0d81dabc
JH
2666uschar *
2667tls_getbuf(unsigned * len)
2668{
2669exim_gnutls_state_st * state = &state_server;
2670unsigned size;
2671uschar * buf;
059ec3d9 2672
0d81dabc
JH
2673if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2674 if (!tls_refill(*len))
059ec3d9 2675 {
0d81dabc
JH
2676 if (!state->xfer_error) return smtp_getbuf(len);
2677 *len = 0;
2678 return NULL;
059ec3d9 2679 }
059ec3d9 2680
0d81dabc
JH
2681if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
2682 size = *len;
2683buf = &state->xfer_buffer[state->xfer_buffer_lwm];
2684state->xfer_buffer_lwm += size;
2685*len = size;
2686return buf;
059ec3d9
PH
2687}
2688
0d81dabc 2689
584e96c6
JH
2690void
2691tls_get_cache()
2692{
9960d1e5 2693#ifndef DISABLE_DKIM
584e96c6
JH
2694exim_gnutls_state_st * state = &state_server;
2695int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2696if (n > 0)
2697 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
584e96c6 2698#endif
9960d1e5 2699}
584e96c6 2700
059ec3d9 2701
925ac8e4
JH
2702BOOL
2703tls_could_read(void)
2704{
2705return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
2706 || gnutls_record_check_pending(state_server.session) > 0;
2707}
2708
2709
059ec3d9 2710
17c76198 2711
059ec3d9
PH
2712/*************************************************
2713* Read bytes from TLS channel *
2714*************************************************/
2715
17c76198
PP
2716/* This does not feed DKIM, so if the caller uses this for reading message body,
2717then the caller must feed DKIM.
817d9f57 2718
059ec3d9 2719Arguments:
74f1a423 2720 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
2721 buff buffer of data
2722 len size of buffer
2723
2724Returns: the number of bytes read
afdb5e9c 2725 -1 after a failed read, including EOF
059ec3d9
PH
2726*/
2727
2728int
74f1a423 2729tls_read(void * ct_ctx, uschar *buff, size_t len)
059ec3d9 2730{
74f1a423 2731exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
17c76198 2732ssize_t inbytes;
059ec3d9 2733
17c76198
PP
2734if (len > INT_MAX)
2735 len = INT_MAX;
059ec3d9 2736
17c76198
PP
2737if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2738 DEBUG(D_tls)
2739 debug_printf("*** PROBABLY A BUG *** " \
2740 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2741 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2742
2743DEBUG(D_tls)
2744 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2745 state->session, buff, len);
2746
4896a319
AM
2747do
2748 inbytes = gnutls_record_recv(state->session, buff, len);
2749while (inbytes == GNUTLS_E_AGAIN);
2750
059ec3d9
PH
2751if (inbytes > 0) return inbytes;
2752if (inbytes == 0)
2753 {
2754 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2755 }
5fd28bb8 2756else
4896a319
AM
2757 {
2758 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv(\n", __FUNCTION__);
2759 record_io_error(state, (int)inbytes, US"recv", NULL);
2760 }
059ec3d9
PH
2761
2762return -1;
2763}
2764
2765
2766
17c76198 2767
059ec3d9
PH
2768/*************************************************
2769* Write bytes down TLS channel *
2770*************************************************/
2771
2772/*
2773Arguments:
74f1a423 2774 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
2775 buff buffer of data
2776 len number of bytes
925ac8e4 2777 more more data expected soon
059ec3d9
PH
2778
2779Returns: the number of bytes after a successful write,
2780 -1 after a failed write
2781*/
2782
2783int
74f1a423 2784tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
059ec3d9 2785{
17c76198
PP
2786ssize_t outbytes;
2787size_t left = len;
74f1a423 2788exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
925ac8e4
JH
2789#ifdef SUPPORT_CORK
2790static BOOL corked = FALSE;
2791
2792if (more && !corked) gnutls_record_cork(state->session);
2793#endif
2794
2795DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
2796 buff, left, more ? ", more" : "");
059ec3d9 2797
059ec3d9
PH
2798while (left > 0)
2799 {
17c76198
PP
2800 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2801 buff, left);
4896a319
AM
2802
2803 do
2804 outbytes = gnutls_record_send(state->session, buff, left);
2805 while (outbytes == GNUTLS_E_AGAIN);
059ec3d9 2806
17c76198 2807 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
2808 if (outbytes < 0)
2809 {
1b76ad22 2810 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
17c76198 2811 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
2812 return -1;
2813 }
2814 if (outbytes == 0)
2815 {
17c76198 2816 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
2817 return -1;
2818 }
2819
2820 left -= outbytes;
2821 buff += outbytes;
2822 }
2823
17c76198
PP
2824if (len > INT_MAX)
2825 {
2826 DEBUG(D_tls)
2827 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2828 len);
2829 len = INT_MAX;
2830 }
2831
925ac8e4
JH
2832#ifdef SUPPORT_CORK
2833if (more != corked)
2834 {
2835 if (!more) (void) gnutls_record_uncork(state->session, 0);
2836 corked = more;
2837 }
2838#endif
2839
17c76198 2840return (int) len;
059ec3d9
PH
2841}
2842
2843
2844
17c76198 2845
059ec3d9 2846/*************************************************
17c76198 2847* Random number generation *
059ec3d9
PH
2848*************************************************/
2849
17c76198
PP
2850/* Pseudo-random number generation. The result is not expected to be
2851cryptographically strong but not so weak that someone will shoot themselves
2852in the foot using it as a nonce in input in some email header scheme or
2853whatever weirdness they'll twist this into. The result should handle fork()
2854and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 2855
17c76198
PP
2856Arguments:
2857 max range maximum
2858Returns a random number in range [0, max-1]
059ec3d9
PH
2859*/
2860
af3498d6 2861#ifdef HAVE_GNUTLS_RND
17c76198
PP
2862int
2863vaguely_random_number(int max)
059ec3d9 2864{
17c76198
PP
2865unsigned int r;
2866int i, needed_len;
2867uschar *p;
2868uschar smallbuf[sizeof(r)];
2869
2870if (max <= 1)
2871 return 0;
2872
2873needed_len = sizeof(r);
2874/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2875 * asked for a number less than 10. */
2876for (r = max, i = 0; r; ++i)
2877 r >>= 1;
2878i = (i + 7) / 8;
2879if (i < needed_len)
2880 needed_len = i;
2881
2882i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2883if (i < 0)
059ec3d9 2884 {
17c76198
PP
2885 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2886 return vaguely_random_number_fallback(max);
2887 }
2888r = 0;
2889for (p = smallbuf; needed_len; --needed_len, ++p)
2890 {
2891 r *= 256;
2892 r += *p;
059ec3d9
PH
2893 }
2894
17c76198
PP
2895/* We don't particularly care about weighted results; if someone wants
2896 * smooth distribution and cares enough then they should submit a patch then. */
2897return r % max;
059ec3d9 2898}
af3498d6
PP
2899#else /* HAVE_GNUTLS_RND */
2900int
2901vaguely_random_number(int max)
2902{
2903 return vaguely_random_number_fallback(max);
2904}
2905#endif /* HAVE_GNUTLS_RND */
059ec3d9 2906
36f12725
NM
2907
2908
2909
2910/*************************************************
3375e053
PP
2911* Let tls_require_ciphers be checked at startup *
2912*************************************************/
2913
2914/* The tls_require_ciphers option, if set, must be something which the
2915library can parse.
2916
2917Returns: NULL on success, or error message
2918*/
2919
2920uschar *
2921tls_validate_require_cipher(void)
2922{
2923int rc;
2924uschar *expciphers = NULL;
2925gnutls_priority_t priority_cache;
2926const char *errpos;
cf0c6164 2927uschar * dummy_errstr;
3375e053
PP
2928
2929#define validate_check_rc(Label) do { \
2930 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2931 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2932#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2933
2934if (exim_gnutls_base_init_done)
2935 log_write(0, LOG_MAIN|LOG_PANIC,
2936 "already initialised GnuTLS, Exim developer bug");
2937
a5f239e4 2938#ifdef HAVE_GNUTLS_PKCS11
2519e60d 2939if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
2940 {
2941 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2942 validate_check_rc(US"gnutls_pkcs11_init");
2943 }
2944#endif
3375e053
PP
2945rc = gnutls_global_init();
2946validate_check_rc(US"gnutls_global_init()");
2947exim_gnutls_base_init_done = TRUE;
2948
2949if (!(tls_require_ciphers && *tls_require_ciphers))
2950 return_deinit(NULL);
2951
cf0c6164
JH
2952if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
2953 &dummy_errstr))
3375e053
PP
2954 return_deinit(US"failed to expand tls_require_ciphers");
2955
2956if (!(expciphers && *expciphers))
2957 return_deinit(NULL);
2958
2959DEBUG(D_tls)
2960 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2961
2962rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2963validate_check_rc(string_sprintf(
2964 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2965 expciphers, errpos - CS expciphers, errpos));
2966
2967#undef return_deinit
2968#undef validate_check_rc
2969gnutls_global_deinit();
2970
2971return NULL;
2972}
2973
2974
2975
2976
2977/*************************************************
36f12725
NM
2978* Report the library versions. *
2979*************************************************/
2980
2981/* See a description in tls-openssl.c for an explanation of why this exists.
2982
2983Arguments: a FILE* to print the results to
2984Returns: nothing
2985*/
2986
2987void
2988tls_version_report(FILE *f)
2989{
754a0503
PP
2990fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2991 " Runtime: %s\n",
2992 LIBGNUTLS_VERSION,
2993 gnutls_check_version(NULL));
36f12725
NM
2994}
2995
2b4a568d
JH
2996/* vi: aw ai sw=2
2997*/
059ec3d9 2998/* End of tls-gnu.c */