Dnssec observability: add variable $lookup_dnssec_authenticated
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
16Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
a5f239e4
PP
42/* needed to disable PKCS11 autoload unless requested */
43#if GNUTLS_VERSION_NUMBER >= 0x020c00
44# include <gnutls/pkcs11.h>
45#endif
059ec3d9 46
17c76198 47/* GnuTLS 2 vs 3
059ec3d9 48
17c76198
PP
49GnuTLS 3 only:
50 gnutls_global_set_audit_log_function()
059ec3d9 51
17c76198
PP
52Changes:
53 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
54*/
059ec3d9 55
17c76198 56/* Local static variables for GnuTLS */
059ec3d9 57
17c76198 58/* Values for verify_requirement */
059ec3d9 59
17c76198 60enum peer_verify_requirement { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
059ec3d9 61
17c76198
PP
62/* This holds most state for server or client; with this, we can set up an
63outbound TLS-enabled connection in an ACL callout, while not stomping all
64over the TLS variables available for expansion.
059ec3d9 65
17c76198
PP
66Some of these correspond to variables in globals.c; those variables will
67be set to point to content in one of these instances, as appropriate for
68the stage of the process lifetime.
059ec3d9 69
389ca47a 70Not handled here: global tls_channelbinding_b64.
17c76198 71*/
059ec3d9 72
17c76198
PP
73typedef struct exim_gnutls_state {
74 gnutls_session_t session;
75 gnutls_certificate_credentials_t x509_cred;
76 gnutls_priority_t priority_cache;
77 enum peer_verify_requirement verify_requirement;
78 int fd_in;
79 int fd_out;
80 BOOL peer_cert_verified;
81 BOOL trigger_sni_changes;
4fe99a6c 82 BOOL have_set_peerdn;
17c76198
PP
83 const struct host_item *host;
84 uschar *peerdn;
75fe387d 85 uschar *ciphersuite;
17c76198
PP
86 uschar *received_sni;
87
88 const uschar *tls_certificate;
89 const uschar *tls_privatekey;
90 const uschar *tls_sni; /* client send only, not received */
91 const uschar *tls_verify_certificates;
92 const uschar *tls_crl;
93 const uschar *tls_require_ciphers;
94 uschar *exp_tls_certificate;
95 uschar *exp_tls_privatekey;
96 uschar *exp_tls_sni;
97 uschar *exp_tls_verify_certificates;
98 uschar *exp_tls_crl;
99 uschar *exp_tls_require_ciphers;
100
389ca47a 101 tls_support *tlsp; /* set in tls_init() */
817d9f57 102
17c76198
PP
103 uschar *xfer_buffer;
104 int xfer_buffer_lwm;
105 int xfer_buffer_hwm;
106 int xfer_eof;
107 int xfer_error;
17c76198
PP
108} exim_gnutls_state_st;
109
110static const exim_gnutls_state_st exim_gnutls_state_init = {
4fe99a6c 111 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
75fe387d 112 NULL, NULL, NULL, NULL,
17c76198
PP
113 NULL, NULL, NULL, NULL, NULL, NULL,
114 NULL, NULL, NULL, NULL, NULL, NULL,
817d9f57 115 NULL,
17c76198 116 NULL, 0, 0, 0, 0,
17c76198 117};
83da1223 118
17c76198
PP
119/* Not only do we have our own APIs which don't pass around state, assuming
120it's held in globals, GnuTLS doesn't appear to let us register callback data
121for callbacks, or as part of the session, so we have to keep a "this is the
122context we're currently dealing with" pointer and rely upon being
123single-threaded to keep from processing data on an inbound TLS connection while
124talking to another TLS connection for an outbound check. This does mean that
125there's no way for heart-beats to be responded to, for the duration of the
126second connection. */
059ec3d9 127
17c76198 128static exim_gnutls_state_st state_server, state_client;
059ec3d9 129
17c76198
PP
130/* dh_params are initialised once within the lifetime of a process using TLS;
131if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
132don't want to repeat this. */
83da1223 133
17c76198 134static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 135
17c76198 136/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 137
17c76198 138static const int ssl_session_timeout = 200;
059ec3d9 139
17c76198 140static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 141
17c76198 142/* Guard library core initialisation */
83da1223 143
17c76198 144static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 145
059ec3d9 146
17c76198 147/* ------------------------------------------------------------------------ */
17c76198 148/* macros */
83da1223 149
17c76198 150#define MAX_HOST_LEN 255
83da1223 151
17c76198
PP
152/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
153the library logging; a value less than 0 disables the calls to set up logging
154callbacks. */
2c17bb02 155#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
17c76198 156#define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 157#endif
83da1223 158
2c17bb02 159#ifndef EXIM_CLIENT_DH_MIN_BITS
bba74fc6 160#define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 161#endif
83da1223 162
af3498d6
PP
163/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
164can ask for a bit-strength. Without that, we stick to the constant we had
165before, for now. */
2c17bb02 166#ifndef EXIM_SERVER_DH_BITS_PRE2_12
af3498d6 167#define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 168#endif
af3498d6 169
17c76198
PP
170#define exim_gnutls_err_check(Label) do { \
171 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
059ec3d9 172
17c76198 173#define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
83da1223 174
17c76198
PP
175#if GNUTLS_VERSION_NUMBER >= 0x020c00
176#define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
af3498d6
PP
177#define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
178#define HAVE_GNUTLS_RND
2519e60d
TL
179/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
180 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
181 * isn't available sometimes, so this needs to become a conditional
182 * compilation; the sanest way to deal with this being a problem on
183 * older OSes is to block it in the Local/Makefile with this compiler
184 * definition */
185#ifndef AVOID_GNUTLS_PKCS11
a5f239e4 186#define HAVE_GNUTLS_PKCS11
2519e60d 187#endif /* AVOID_GNUTLS_PKCS11 */
17c76198 188#endif
83da1223 189
af3498d6
PP
190
191
192
193/* ------------------------------------------------------------------------ */
194/* Callback declarations */
195
196#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
197static void exim_gnutls_logger_cb(int level, const char *message);
198#endif
199
200static int exim_sni_handling_cb(gnutls_session_t session);
201
202
203
204
17c76198
PP
205/* ------------------------------------------------------------------------ */
206/* Static functions */
059ec3d9
PH
207
208/*************************************************
209* Handle TLS error *
210*************************************************/
211
212/* Called from lots of places when errors occur before actually starting to do
213the TLS handshake, that is, while the session is still in clear. Always returns
214DEFER for a server and FAIL for a client so that most calls can use "return
215tls_error(...)" to do this processing and then give an appropriate return. A
216single function is used for both server and client, because it is called from
217some shared functions.
218
219Argument:
220 prefix text to include in the logged error
7199e1ee
TF
221 msg additional error string (may be NULL)
222 usually obtained from gnutls_strerror()
17c76198
PP
223 host NULL if setting up a server;
224 the connected host if setting up a client
059ec3d9
PH
225
226Returns: OK/DEFER/FAIL
227*/
228
229static int
17c76198 230tls_error(const uschar *prefix, const char *msg, const host_item *host)
059ec3d9 231{
17c76198
PP
232if (host)
233 {
234 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
235 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
236 return FAIL;
237 }
238else
059ec3d9 239 {
7199e1ee 240 uschar *conn_info = smtp_get_connection_info();
17c76198 241 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee
TF
242 conn_info += 5;
243 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
17c76198 244 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
059ec3d9
PH
245 return DEFER;
246 }
059ec3d9
PH
247}
248
249
250
17c76198 251
059ec3d9 252/*************************************************
17c76198 253* Deal with logging errors during I/O *
059ec3d9
PH
254*************************************************/
255
17c76198 256/* We have to get the identity of the peer from saved data.
059ec3d9 257
17c76198
PP
258Argument:
259 state the current GnuTLS exim state container
260 rc the GnuTLS error code, or 0 if it's a local error
261 when text identifying read or write
262 text local error text when ec is 0
059ec3d9 263
17c76198 264Returns: nothing
059ec3d9
PH
265*/
266
17c76198
PP
267static void
268record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 269{
17c76198 270const char *msg;
059ec3d9 271
17c76198
PP
272if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
273 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
274 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
275else
276 msg = gnutls_strerror(rc);
059ec3d9 277
17c76198
PP
278tls_error(when, msg, state->host);
279}
059ec3d9 280
059ec3d9 281
059ec3d9 282
059ec3d9 283
17c76198
PP
284/*************************************************
285* Set various Exim expansion vars *
286*************************************************/
059ec3d9 287
17c76198
PP
288/* We set various Exim global variables from the state, once a session has
289been established. With TLS callouts, may need to change this to stack
290variables, or just re-call it with the server state after client callout
291has finished.
059ec3d9 292
17c76198
PP
293Make sure anything set here is inset in tls_getc().
294
295Sets:
296 tls_active fd
297 tls_bits strength indicator
298 tls_certificate_verified bool indicator
299 tls_channelbinding_b64 for some SASL mechanisms
300 tls_cipher a string
301 tls_peerdn a string
302 tls_sni a (UTF-8) string
17c76198
PP
303
304Argument:
305 state the relevant exim_gnutls_state_st *
306*/
307
308static void
817d9f57 309extract_exim_vars_from_tls_state(exim_gnutls_state_st *state, BOOL is_server)
17c76198 310{
17c76198 311gnutls_cipher_algorithm_t cipher;
17c76198
PP
312#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
313int old_pool;
314int rc;
315gnutls_datum_t channel;
316#endif
317
817d9f57 318state->tlsp->active = state->fd_out;
17c76198
PP
319
320cipher = gnutls_cipher_get(state->session);
321/* returns size in "bytes" */
817d9f57 322state->tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 323
817d9f57 324state->tlsp->cipher = state->ciphersuite;
17c76198 325
817d9f57 326DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 327
817d9f57 328state->tlsp->certificate_verified = state->peer_cert_verified;
059ec3d9 329
17c76198
PP
330/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
331only available for use for authenticators while this TLS session is running. */
332
333tls_channelbinding_b64 = NULL;
334#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
335channel.data = NULL;
336channel.size = 0;
337rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
338if (rc) {
339 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
340} else {
341 old_pool = store_pool;
342 store_pool = POOL_PERM;
343 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
344 store_pool = old_pool;
345 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
346}
347#endif
348
817d9f57
JH
349state->tlsp->peerdn = state->peerdn;
350state->tlsp->sni = state->received_sni;
059ec3d9
PH
351}
352
353
354
17c76198 355
059ec3d9 356/*************************************************
575643cd 357* Setup up DH parameters *
059ec3d9
PH
358*************************************************/
359
575643cd 360/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
361be re-generated every so often, depending on security policy. What we do is to
362keep these parameters in a file in the spool directory. If the file does not
363exist, we generate them. This means that it is easy to cause a regeneration.
364
365The new file is written as a temporary file and renamed, so that an incomplete
366file is never present. If two processes both compute some new parameters, you
367waste a bit of effort, but it doesn't seem worth messing around with locking to
368prevent this.
369
059ec3d9
PH
370Returns: OK/DEFER/FAIL
371*/
372
373static int
17c76198 374init_server_dh(void)
059ec3d9 375{
17c76198
PP
376int fd, rc;
377unsigned int dh_bits;
b5aea5e1 378gnutls_datum m;
a799883d
PP
379uschar filename_buf[PATH_MAX];
380uschar *filename = NULL;
17c76198 381size_t sz;
a799883d
PP
382uschar *exp_tls_dhparam;
383BOOL use_file_in_spool = FALSE;
384BOOL use_fixed_file = FALSE;
17c76198 385host_item *host = NULL; /* dummy for macros */
059ec3d9 386
17c76198 387DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 388
17c76198
PP
389rc = gnutls_dh_params_init(&dh_server_params);
390exim_gnutls_err_check(US"gnutls_dh_params_init");
059ec3d9 391
a799883d
PP
392m.data = NULL;
393m.size = 0;
394
395if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
396 return DEFER;
397
398if (!exp_tls_dhparam)
399 {
400 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
401 m.data = US std_dh_prime_default();
402 m.size = Ustrlen(m.data);
403 }
404else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
405 use_file_in_spool = TRUE;
406else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
407 {
408 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
409 return OK;
410 }
411else if (exp_tls_dhparam[0] != '/')
412 {
413 m.data = US std_dh_prime_named(exp_tls_dhparam);
414 if (m.data == NULL)
415 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
416 m.size = Ustrlen(m.data);
417 }
418else
419 {
420 use_fixed_file = TRUE;
421 filename = exp_tls_dhparam;
422 }
423
424if (m.data)
425 {
426 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
427 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
428 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
429 return OK;
430 }
431
af3498d6
PP
432#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
433/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
434different filename and ensure we have sufficient bits. */
435dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
436if (!dh_bits)
437 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
af3498d6 438DEBUG(D_tls)
b34fc30c 439 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
440 dh_bits);
441#else
442dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
443DEBUG(D_tls)
444 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
445 dh_bits);
446#endif
059ec3d9 447
3375e053
PP
448/* Some clients have hard-coded limits. */
449if (dh_bits > tls_dh_max_bits)
450 {
451 DEBUG(D_tls)
452 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
453 tls_dh_max_bits);
454 dh_bits = tls_dh_max_bits;
455 }
456
a799883d
PP
457if (use_file_in_spool)
458 {
459 if (!string_format(filename_buf, sizeof(filename_buf),
460 "%s/gnutls-params-%d", spool_directory, dh_bits))
461 return tls_error(US"overlong filename", NULL, NULL);
462 filename = filename_buf;
463 }
059ec3d9 464
b5aea5e1 465/* Open the cache file for reading and if successful, read it and set up the
575643cd 466parameters. */
059ec3d9
PH
467
468fd = Uopen(filename, O_RDONLY, 0);
b5aea5e1 469if (fd >= 0)
059ec3d9 470 {
b5aea5e1 471 struct stat statbuf;
17c76198
PP
472 FILE *fp;
473 int saved_errno;
474
475 if (fstat(fd, &statbuf) < 0) /* EIO */
476 {
477 saved_errno = errno;
478 (void)close(fd);
479 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
480 }
481 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
482 {
483 (void)close(fd);
17c76198
PP
484 return tls_error(US"TLS cache not a file", NULL, NULL);
485 }
486 fp = fdopen(fd, "rb");
487 if (!fp)
488 {
489 saved_errno = errno;
490 (void)close(fd);
491 return tls_error(US"fdopen(TLS cache stat fd) failed",
492 strerror(saved_errno), NULL);
b5aea5e1 493 }
059ec3d9 494
b5aea5e1
PH
495 m.size = statbuf.st_size;
496 m.data = malloc(m.size);
497 if (m.data == NULL)
17c76198
PP
498 {
499 fclose(fp);
500 return tls_error(US"malloc failed", strerror(errno), NULL);
501 }
502 sz = fread(m.data, m.size, 1, fp);
503 if (!sz)
504 {
505 saved_errno = errno;
506 fclose(fp);
507 free(m.data);
508 return tls_error(US"fread failed", strerror(saved_errno), NULL);
509 }
510 fclose(fp);
b5aea5e1 511
17c76198 512 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 513 free(m.data);
17c76198
PP
514 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
515 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
516 }
517
518/* If the file does not exist, fall through to compute new data and cache it.
519If there was any other opening error, it is serious. */
520
182ad5cf
PH
521else if (errno == ENOENT)
522 {
17c76198 523 rc = -1;
182ad5cf 524 DEBUG(D_tls)
17c76198 525 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
526 }
527else
17c76198
PP
528 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
529 NULL, NULL);
b5aea5e1
PH
530
531/* If ret < 0, either the cache file does not exist, or the data it contains
532is not useful. One particular case of this is when upgrading from an older
533release of Exim in which the data was stored in a different format. We don't
534try to be clever and support both formats; we just regenerate new data in this
535case. */
536
17c76198 537if (rc < 0)
b5aea5e1 538 {
17c76198 539 uschar *temp_fn;
201f5254 540 unsigned int dh_bits_gen = dh_bits;
059ec3d9 541
17c76198
PP
542 if ((PATH_MAX - Ustrlen(filename)) < 10)
543 return tls_error(US"Filename too long to generate replacement",
544 CS filename, NULL);
059ec3d9 545
17c76198
PP
546 temp_fn = string_copy(US "%s.XXXXXXX");
547 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
059ec3d9 548 if (fd < 0)
17c76198 549 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
059ec3d9
PH
550 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
551
201f5254
PP
552 /* GnuTLS overshoots!
553 * If we ask for 2236, we might get 2237 or more.
554 * But there's no way to ask GnuTLS how many bits there really are.
555 * We can ask how many bits were used in a TLS session, but that's it!
556 * The prime itself is hidden behind too much abstraction.
557 * So we ask for less, and proceed on a wing and a prayer.
558 * First attempt, subtracted 3 for 2233 and got 2240.
559 */
cae6e576 560 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
561 {
562 dh_bits_gen = dh_bits - 10;
563 DEBUG(D_tls)
564 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
565 dh_bits_gen);
566 }
567
568 DEBUG(D_tls)
569 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
570 dh_bits_gen);
571 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
17c76198
PP
572 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
573
574 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
575 and I confirmed that a NULL call to get the size first is how the GnuTLS
576 sample apps handle this. */
577
578 sz = 0;
579 m.data = NULL;
580 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
581 m.data, &sz);
582 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
583 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
584 m.size = sz;
b5aea5e1
PH
585 m.data = malloc(m.size);
586 if (m.data == NULL)
17c76198 587 return tls_error(US"memory allocation failed", strerror(errno), NULL);
1f00591e 588 /* this will return a size 1 less than the allocation size above */
17c76198 589 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 590 m.data, &sz);
17c76198
PP
591 if (rc != GNUTLS_E_SUCCESS)
592 {
593 free(m.data);
594 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
595 }
1f00591e 596 m.size = sz; /* shrink by 1, probably */
059ec3d9 597
17c76198
PP
598 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
599 if (sz != m.size)
600 {
601 free(m.data);
602 return tls_error(US"TLS cache write D-H params failed",
603 strerror(errno), NULL);
604 }
b5aea5e1 605 free(m.data);
17c76198
PP
606 sz = write_to_fd_buf(fd, US"\n", 1);
607 if (sz != 1)
608 return tls_error(US"TLS cache write D-H params final newline failed",
609 strerror(errno), NULL);
610
611 rc = close(fd);
612 if (rc)
613 return tls_error(US"TLS cache write close() failed",
614 strerror(errno), NULL);
059ec3d9 615
17c76198
PP
616 if (Urename(temp_fn, filename) < 0)
617 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
618 temp_fn, filename), strerror(errno), NULL);
059ec3d9 619
17c76198 620 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
621 }
622
17c76198 623DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
624return OK;
625}
626
627
628
629
630/*************************************************
17c76198 631* Variables re-expanded post-SNI *
059ec3d9
PH
632*************************************************/
633
17c76198
PP
634/* Called from both server and client code, via tls_init(), and also from
635the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
636
637We can tell the two apart by state->received_sni being non-NULL in callback.
638
639The callback should not call us unless state->trigger_sni_changes is true,
640which we are responsible for setting on the first pass through.
059ec3d9
PH
641
642Arguments:
17c76198 643 state exim_gnutls_state_st *
059ec3d9
PH
644
645Returns: OK/DEFER/FAIL
646*/
647
648static int
17c76198 649tls_expand_session_files(exim_gnutls_state_st *state)
059ec3d9 650{
1365611d 651struct stat statbuf;
059ec3d9 652int rc;
17c76198
PP
653const host_item *host = state->host; /* macro should be reconsidered? */
654uschar *saved_tls_certificate = NULL;
655uschar *saved_tls_privatekey = NULL;
656uschar *saved_tls_verify_certificates = NULL;
657uschar *saved_tls_crl = NULL;
658int cert_count;
659
660/* We check for tls_sni *before* expansion. */
661if (!state->host)
662 {
663 if (!state->received_sni)
664 {
d9b2312b
JH
665 if (state->tls_certificate &&
666 (Ustrstr(state->tls_certificate, US"tls_sni") ||
667 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
668 Ustrstr(state->tls_certificate, US"tls_out_sni")
669 ))
17c76198
PP
670 {
671 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
672 state->trigger_sni_changes = TRUE;
673 }
674 }
675 else
676 {
1365611d 677 /* useful for debugging */
17c76198
PP
678 saved_tls_certificate = state->exp_tls_certificate;
679 saved_tls_privatekey = state->exp_tls_privatekey;
680 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
681 saved_tls_crl = state->exp_tls_crl;
682 }
683 }
059ec3d9 684
1365611d
PP
685rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
686exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
687
17c76198
PP
688/* remember: expand_check_tlsvar() is expand_check() but fiddling with
689state members, assuming consistent naming; and expand_check() returns
690false if expansion failed, unless expansion was forced to fail. */
059ec3d9 691
17c76198
PP
692/* check if we at least have a certificate, before doing expensive
693D-H generation. */
059ec3d9 694
17c76198
PP
695if (!expand_check_tlsvar(tls_certificate))
696 return DEFER;
059ec3d9 697
17c76198 698/* certificate is mandatory in server, optional in client */
059ec3d9 699
17c76198
PP
700if ((state->exp_tls_certificate == NULL) ||
701 (*state->exp_tls_certificate == '\0'))
702 {
703 if (state->host == NULL)
704 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
705 else
706 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
707 }
059ec3d9 708
17c76198 709if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
059ec3d9
PH
710 return DEFER;
711
17c76198
PP
712/* tls_privatekey is optional, defaulting to same file as certificate */
713
714if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 715 {
17c76198
PP
716 state->tls_privatekey = state->tls_certificate;
717 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 718 }
c91535f3 719
059ec3d9 720
17c76198 721if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
722 {
723 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
724 state->exp_tls_certificate, state->exp_tls_privatekey);
725
726 if (state->received_sni)
de365ded 727 {
17c76198
PP
728 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
729 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
730 {
b34fc30c 731 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
732 }
733 else
734 {
b34fc30c 735 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 736 }
8e669ac1 737 }
059ec3d9 738
1365611d
PP
739 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
740 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
741 GNUTLS_X509_FMT_PEM);
742 exim_gnutls_err_check(
743 string_sprintf("cert/key setup: cert=%s key=%s",
744 state->exp_tls_certificate, state->exp_tls_privatekey));
745 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
b34fc30c 746 } /* tls_certificate */
059ec3d9
PH
747
748/* Set the trusted CAs file if one is provided, and then add the CRL if one is
749provided. Experiment shows that, if the certificate file is empty, an unhelpful
750error message is provided. However, if we just refrain from setting anything up
751in that case, certificate verification fails, which seems to be the correct
752behaviour. */
753
17c76198 754if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 755 {
17c76198 756 if (!expand_check_tlsvar(tls_verify_certificates))
059ec3d9 757 return DEFER;
17c76198
PP
758 if (state->tls_crl && *state->tls_crl)
759 if (!expand_check_tlsvar(tls_crl))
760 return DEFER;
059ec3d9 761
1365611d
PP
762 if (!(state->exp_tls_verify_certificates &&
763 *state->exp_tls_verify_certificates))
b34fc30c
PP
764 {
765 DEBUG(D_tls)
1365611d
PP
766 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
767 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 768 return OK;
b34fc30c 769 }
1365611d 770 }
83e2f8a2
PP
771else
772 {
773 DEBUG(D_tls)
774 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
775 return OK;
776 }
17c76198 777
1365611d
PP
778if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
779 {
780 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
781 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
782 strerror(errno));
783 return DEFER;
784 }
17c76198 785
619b2b25
PP
786/* The test suite passes in /dev/null; we could check for that path explicitly,
787but who knows if someone has some weird FIFO which always dumps some certs, or
788other weirdness. The thing we really want to check is that it's not a
789directory, since while OpenSSL supports that, GnuTLS does not.
790So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
791if (S_ISDIR(statbuf.st_mode))
1365611d
PP
792 {
793 DEBUG(D_tls)
619b2b25
PP
794 debug_printf("verify certificates path is a dir: \"%s\"\n",
795 state->exp_tls_verify_certificates);
1365611d 796 log_write(0, LOG_MAIN|LOG_PANIC,
619b2b25 797 "tls_verify_certificates \"%s\" is a directory",
1365611d
PP
798 state->exp_tls_verify_certificates);
799 return DEFER;
800 }
059ec3d9 801
1365611d
PP
802DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
803 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 804
1365611d
PP
805if (statbuf.st_size == 0)
806 {
807 DEBUG(D_tls)
808 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
809 return OK;
810 }
059ec3d9 811
1365611d
PP
812cert_count = gnutls_certificate_set_x509_trust_file(state->x509_cred,
813 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
814if (cert_count < 0)
815 {
816 rc = cert_count;
817 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
818 }
819DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 820
5c8cda3a
PP
821if (state->tls_crl && *state->tls_crl &&
822 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 823 {
5c8cda3a
PP
824 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
825 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
826 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
827 if (cert_count < 0)
1365611d 828 {
5c8cda3a 829 rc = cert_count;
1365611d
PP
830 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
831 }
5c8cda3a 832 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 833 }
059ec3d9 834
059ec3d9
PH
835return OK;
836}
837
838
839
840
841/*************************************************
1365611d
PP
842* Set X.509 state variables *
843*************************************************/
844
845/* In GnuTLS, the registered cert/key are not replaced by a later
846set of a cert/key, so for SNI support we need a whole new x509_cred
847structure. Which means various other non-re-expanded pieces of state
848need to be re-set in the new struct, so the setting logic is pulled
849out to this.
850
851Arguments:
852 state exim_gnutls_state_st *
853
854Returns: OK/DEFER/FAIL
855*/
856
857static int
858tls_set_remaining_x509(exim_gnutls_state_st *state)
859{
860int rc;
861const host_item *host = state->host; /* macro should be reconsidered? */
862
863/* Create D-H parameters, or read them from the cache file. This function does
864its own SMTP error messaging. This only happens for the server, TLS D-H ignores
865client-side params. */
866
867if (!state->host)
868 {
869 if (!dh_server_params)
870 {
871 rc = init_server_dh();
872 if (rc != OK) return rc;
873 }
874 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
875 }
876
877/* Link the credentials to the session. */
878
879rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
880exim_gnutls_err_check(US"gnutls_credentials_set");
881
882return OK;
883}
884
885/*************************************************
17c76198 886* Initialize for GnuTLS *
059ec3d9
PH
887*************************************************/
888
17c76198
PP
889/* Called from both server and client code. In the case of a server, errors
890before actual TLS negotiation return DEFER.
059ec3d9
PH
891
892Arguments:
17c76198
PP
893 host connected host, if client; NULL if server
894 certificate certificate file
895 privatekey private key file
896 sni TLS SNI to send, sometimes when client; else NULL
897 cas CA certs file
898 crl CRL file
899 require_ciphers tls_require_ciphers setting
817d9f57 900 caller_state returned state-info structure
059ec3d9 901
17c76198 902Returns: OK/DEFER/FAIL
059ec3d9
PH
903*/
904
17c76198
PP
905static int
906tls_init(
907 const host_item *host,
908 const uschar *certificate,
909 const uschar *privatekey,
910 const uschar *sni,
911 const uschar *cas,
912 const uschar *crl,
913 const uschar *require_ciphers,
914 exim_gnutls_state_st **caller_state)
059ec3d9 915{
17c76198
PP
916exim_gnutls_state_st *state;
917int rc;
918size_t sz;
919const char *errpos;
920uschar *p;
921BOOL want_default_priorities;
922
923if (!exim_gnutls_base_init_done)
059ec3d9 924 {
17c76198
PP
925 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
926
a5f239e4
PP
927#ifdef HAVE_GNUTLS_PKCS11
928 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
929 which loads modules from a config file, which sounds good and may be wanted
930 by some sysadmin, but also means in common configurations that GNOME keyring
931 environment variables are used and so breaks for users calling mailq.
932 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 933 if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
934 {
935 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
936 exim_gnutls_err_check(US"gnutls_pkcs11_init");
937 }
938#endif
939
17c76198
PP
940 rc = gnutls_global_init();
941 exim_gnutls_err_check(US"gnutls_global_init");
942
943#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
944 DEBUG(D_tls)
059ec3d9 945 {
17c76198
PP
946 gnutls_global_set_log_function(exim_gnutls_logger_cb);
947 /* arbitrarily chosen level; bump upto 9 for more */
948 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 949 }
17c76198
PP
950#endif
951
952 exim_gnutls_base_init_done = TRUE;
059ec3d9 953 }
059ec3d9 954
17c76198
PP
955if (host)
956 {
957 state = &state_client;
958 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 959 state->tlsp = &tls_out;
17c76198
PP
960 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
961 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
962 }
963else
964 {
965 state = &state_server;
966 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 967 state->tlsp = &tls_in;
17c76198
PP
968 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
969 rc = gnutls_init(&state->session, GNUTLS_SERVER);
970 }
971exim_gnutls_err_check(US"gnutls_init");
059ec3d9 972
17c76198 973state->host = host;
059ec3d9 974
17c76198
PP
975state->tls_certificate = certificate;
976state->tls_privatekey = privatekey;
5779e6aa 977state->tls_require_ciphers = require_ciphers;
17c76198
PP
978state->tls_sni = sni;
979state->tls_verify_certificates = cas;
980state->tls_crl = crl;
059ec3d9 981
17c76198
PP
982/* This handles the variables that might get re-expanded after TLS SNI;
983that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 984
17c76198
PP
985DEBUG(D_tls)
986 debug_printf("Expanding various TLS configuration options for session credentials.\n");
987rc = tls_expand_session_files(state);
988if (rc != OK) return rc;
059ec3d9 989
1365611d
PP
990/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
991requires a new structure afterwards. */
83da1223 992
1365611d
PP
993rc = tls_set_remaining_x509(state);
994if (rc != OK) return rc;
83da1223 995
17c76198
PP
996/* set SNI in client, only */
997if (host)
998 {
a5f239e4 999 if (!expand_check(state->tlsp->sni, US"tls_out_sni", &state->exp_tls_sni))
17c76198
PP
1000 return DEFER;
1001 if (state->exp_tls_sni && *state->exp_tls_sni)
1002 {
1003 DEBUG(D_tls)
1004 debug_printf("Setting TLS client SNI to \"%s\"\n", state->exp_tls_sni);
1005 sz = Ustrlen(state->exp_tls_sni);
1006 rc = gnutls_server_name_set(state->session,
1007 GNUTLS_NAME_DNS, state->exp_tls_sni, sz);
1008 exim_gnutls_err_check(US"gnutls_server_name_set");
1009 }
1010 }
1011else if (state->tls_sni)
1012 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1013 "have an SNI set for a client [%s]\n", state->tls_sni);
83da1223 1014
17c76198 1015/* This is the priority string support,
42bfef1e 1016http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1017and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1018This was backwards incompatible, but means Exim no longer needs to track
1019all algorithms and provide string forms for them. */
83da1223 1020
17c76198 1021want_default_priorities = TRUE;
83da1223 1022
17c76198 1023if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1024 {
17c76198
PP
1025 if (!expand_check_tlsvar(tls_require_ciphers))
1026 return DEFER;
1027 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1028 {
17c76198
PP
1029 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1030 state->exp_tls_require_ciphers);
1031
1032 rc = gnutls_priority_init(&state->priority_cache,
1033 CS state->exp_tls_require_ciphers, &errpos);
1034 want_default_priorities = FALSE;
1035 p = state->exp_tls_require_ciphers;
83da1223
PH
1036 }
1037 }
17c76198
PP
1038if (want_default_priorities)
1039 {
83e2f8a2
PP
1040 DEBUG(D_tls)
1041 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1042 exim_default_gnutls_priority);
17c76198
PP
1043 rc = gnutls_priority_init(&state->priority_cache,
1044 exim_default_gnutls_priority, &errpos);
1045 p = US exim_default_gnutls_priority;
1046 }
83da1223 1047
17c76198
PP
1048exim_gnutls_err_check(string_sprintf(
1049 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1050 p, errpos - CS p, errpos));
1051
1052rc = gnutls_priority_set(state->session, state->priority_cache);
1053exim_gnutls_err_check(US"gnutls_priority_set");
1054
1055gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1056
1057/* Reduce security in favour of increased compatibility, if the admin
1058decides to make that trade-off. */
1059if (gnutls_compat_mode)
83da1223 1060 {
17c76198
PP
1061#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1062 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1063 gnutls_session_enable_compatibility_mode(state->session);
1064#else
1065 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1066#endif
83da1223
PH
1067 }
1068
17c76198 1069*caller_state = state;
17c76198 1070return OK;
83da1223
PH
1071}
1072
1073
1074
1075
1076/*************************************************
17c76198 1077* Extract peer information *
059ec3d9
PH
1078*************************************************/
1079
17c76198 1080/* Called from both server and client code.
4fe99a6c
PP
1081Only this is allowed to set state->peerdn and state->have_set_peerdn
1082and we use that to detect double-calls.
059ec3d9 1083
75fe387d
PP
1084NOTE: the state blocks last while the TLS connection is up, which is fine
1085for logging in the server side, but for the client side, we log after teardown
1086in src/deliver.c. While the session is up, we can twist about states and
1087repoint tls_* globals, but those variables used for logging or other variable
1088expansion that happens _after_ delivery need to have a longer life-time.
1089
1090So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1091doing this more than once per generation of a state context. We set them in
1092the state context, and repoint tls_* to them. After the state goes away, the
1093tls_* copies of the pointers remain valid and client delivery logging is happy.
1094
1095tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1096don't apply.
1097
059ec3d9 1098Arguments:
17c76198 1099 state exim_gnutls_state_st *
059ec3d9 1100
17c76198 1101Returns: OK/DEFER/FAIL
059ec3d9
PH
1102*/
1103
17c76198
PP
1104static int
1105peer_status(exim_gnutls_state_st *state)
059ec3d9 1106{
75fe387d 1107uschar cipherbuf[256];
17c76198 1108const gnutls_datum *cert_list;
75fe387d 1109int old_pool, rc;
17c76198 1110unsigned int cert_list_size = 0;
4fe99a6c
PP
1111gnutls_protocol_t protocol;
1112gnutls_cipher_algorithm_t cipher;
1113gnutls_kx_algorithm_t kx;
1114gnutls_mac_algorithm_t mac;
17c76198
PP
1115gnutls_certificate_type_t ct;
1116gnutls_x509_crt_t crt;
4fe99a6c 1117uschar *p, *dn_buf;
17c76198 1118size_t sz;
059ec3d9 1119
4fe99a6c 1120if (state->have_set_peerdn)
17c76198 1121 return OK;
4fe99a6c 1122state->have_set_peerdn = TRUE;
059ec3d9 1123
4fe99a6c 1124state->peerdn = NULL;
059ec3d9 1125
4fe99a6c
PP
1126/* tls_cipher */
1127cipher = gnutls_cipher_get(state->session);
1128protocol = gnutls_protocol_get_version(state->session);
1129mac = gnutls_mac_get(state->session);
1130kx = gnutls_kx_get(state->session);
1131
75fe387d 1132string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1133 "%s:%s:%d",
1134 gnutls_protocol_get_name(protocol),
1135 gnutls_cipher_suite_get_name(kx, cipher, mac),
1136 (int) gnutls_cipher_get_key_size(cipher) * 8);
1137
1138/* I don't see a way that spaces could occur, in the current GnuTLS
1139code base, but it was a concern in the old code and perhaps older GnuTLS
1140releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1141for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1142 if (isspace(*p))
1143 *p = '-';
75fe387d
PP
1144old_pool = store_pool;
1145store_pool = POOL_PERM;
1146state->ciphersuite = string_copy(cipherbuf);
1147store_pool = old_pool;
817d9f57 1148state->tlsp->cipher = state->ciphersuite;
4fe99a6c
PP
1149
1150/* tls_peerdn */
17c76198 1151cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1152
17c76198
PP
1153if (cert_list == NULL || cert_list_size == 0)
1154 {
17c76198
PP
1155 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1156 cert_list, cert_list_size);
1157 if (state->verify_requirement == VERIFY_REQUIRED)
1158 return tls_error(US"certificate verification failed",
1159 "no certificate received from peer", state->host);
1160 return OK;
1161 }
059ec3d9 1162
17c76198
PP
1163ct = gnutls_certificate_type_get(state->session);
1164if (ct != GNUTLS_CRT_X509)
059ec3d9 1165 {
17c76198 1166 const char *ctn = gnutls_certificate_type_get_name(ct);
17c76198
PP
1167 DEBUG(D_tls)
1168 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1169 if (state->verify_requirement == VERIFY_REQUIRED)
1170 return tls_error(US"certificate verification not possible, unhandled type",
1171 ctn, state->host);
1172 return OK;
83da1223 1173 }
059ec3d9 1174
17c76198
PP
1175#define exim_gnutls_peer_err(Label) do { \
1176 if (rc != GNUTLS_E_SUCCESS) { \
1177 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1178 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1179 return OK; } } while (0)
1180
1181rc = gnutls_x509_crt_init(&crt);
1182exim_gnutls_peer_err(US"gnutls_x509_crt_init (crt)");
1183
1184rc = gnutls_x509_crt_import(crt, &cert_list[0], GNUTLS_X509_FMT_DER);
1185exim_gnutls_peer_err(US"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1186sz = 0;
1187rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1188if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1189 {
17c76198
PP
1190 exim_gnutls_peer_err(US"getting size for cert DN failed");
1191 return FAIL; /* should not happen */
059ec3d9 1192 }
17c76198
PP
1193dn_buf = store_get_perm(sz);
1194rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1195exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1196state->peerdn = dn_buf;
1197
1198return OK;
1199#undef exim_gnutls_peer_err
1200}
059ec3d9 1201
059ec3d9 1202
059ec3d9 1203
059ec3d9 1204
17c76198
PP
1205/*************************************************
1206* Verify peer certificate *
1207*************************************************/
059ec3d9 1208
17c76198
PP
1209/* Called from both server and client code.
1210*Should* be using a callback registered with
1211gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1212the peer information, but that's too new for some OSes.
059ec3d9 1213
17c76198
PP
1214Arguments:
1215 state exim_gnutls_state_st *
1216 error where to put an error message
059ec3d9 1217
17c76198
PP
1218Returns:
1219 FALSE if the session should be rejected
1220 TRUE if the cert is okay or we just don't care
1221*/
059ec3d9 1222
17c76198
PP
1223static BOOL
1224verify_certificate(exim_gnutls_state_st *state, const char **error)
1225{
1226int rc;
1227unsigned int verify;
1228
1229*error = NULL;
1230
0a92f87f 1231if ((rc = peer_status(state)) != OK)
e6060e2c 1232 {
17c76198 1233 verify = GNUTLS_CERT_INVALID;
0a92f87f 1234 *error = "certificate not supplied";
17c76198
PP
1235 }
1236else
17c76198 1237 rc = gnutls_certificate_verify_peers2(state->session, &verify);
e6060e2c 1238
17c76198
PP
1239/* Handle the result of verification. INVALID seems to be set as well
1240as REVOKED, but leave the test for both. */
059ec3d9 1241
0a92f87f 1242if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
17c76198
PP
1243 {
1244 state->peer_cert_verified = FALSE;
0a92f87f
JH
1245 if (!*error)
1246 *error = verify & GNUTLS_CERT_REVOKED
1247 ? "certificate revoked" : "certificate invalid";
059ec3d9 1248
17c76198
PP
1249 DEBUG(D_tls)
1250 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
4fe99a6c 1251 *error, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1252
17c76198
PP
1253 if (state->verify_requirement == VERIFY_REQUIRED)
1254 {
1255 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1256 return FALSE;
1257 }
1258 DEBUG(D_tls)
4789da3a 1259 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198
PP
1260 }
1261else
1262 {
1263 state->peer_cert_verified = TRUE;
4fe99a6c
PP
1264 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=%s\n",
1265 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1266 }
059ec3d9 1267
817d9f57 1268state->tlsp->peerdn = state->peerdn;
059ec3d9 1269
17c76198
PP
1270return TRUE;
1271}
059ec3d9 1272
17c76198
PP
1273
1274
1275
1276/* ------------------------------------------------------------------------ */
1277/* Callbacks */
1278
1279/* Logging function which can be registered with
1280 * gnutls_global_set_log_function()
1281 * gnutls_global_set_log_level() 0..9
1282 */
af3498d6 1283#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1284static void
17c76198 1285exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1286{
8c79eebf
PP
1287 size_t len = strlen(message);
1288 if (len < 1)
1289 {
1290 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1291 return;
1292 }
1293 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1294 message[len-1] == '\n' ? "" : "\n");
17c76198 1295}
af3498d6 1296#endif
059ec3d9 1297
059ec3d9 1298
17c76198
PP
1299/* Called after client hello, should handle SNI work.
1300This will always set tls_sni (state->received_sni) if available,
1301and may trigger presenting different certificates,
1302if state->trigger_sni_changes is TRUE.
059ec3d9 1303
17c76198
PP
1304Should be registered with
1305 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1306
17c76198
PP
1307"This callback must return 0 on success or a gnutls error code to terminate the
1308handshake.".
059ec3d9 1309
17c76198
PP
1310For inability to get SNI information, we return 0.
1311We only return non-zero if re-setup failed.
817d9f57 1312Only used for server-side TLS.
17c76198 1313*/
44bbabb5 1314
17c76198
PP
1315static int
1316exim_sni_handling_cb(gnutls_session_t session)
1317{
1318char sni_name[MAX_HOST_LEN];
1319size_t data_len = MAX_HOST_LEN;
817d9f57 1320exim_gnutls_state_st *state = &state_server;
17c76198
PP
1321unsigned int sni_type;
1322int rc, old_pool;
1323
1324rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1325if (rc != GNUTLS_E_SUCCESS)
1326 {
1327 DEBUG(D_tls) {
1328 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1329 debug_printf("TLS: no SNI presented in handshake.\n");
1330 else
1331 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1332 gnutls_strerror(rc), rc);
1333 };
1334 return 0;
1335 }
1336
17c76198
PP
1337if (sni_type != GNUTLS_NAME_DNS)
1338 {
1339 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1340 return 0;
1341 }
44bbabb5 1342
17c76198
PP
1343/* We now have a UTF-8 string in sni_name */
1344old_pool = store_pool;
1345store_pool = POOL_PERM;
1346state->received_sni = string_copyn(US sni_name, data_len);
1347store_pool = old_pool;
1348
1349/* We set this one now so that variable expansions below will work */
817d9f57 1350state->tlsp->sni = state->received_sni;
17c76198
PP
1351
1352DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1353 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1354
1355if (!state->trigger_sni_changes)
1356 return 0;
1357
1358rc = tls_expand_session_files(state);
1359if (rc != OK)
1360 {
1361 /* If the setup of certs/etc failed before handshake, TLS would not have
1362 been offered. The best we can do now is abort. */
1363 return GNUTLS_E_APPLICATION_ERROR_MIN;
1364 }
1365
1365611d
PP
1366rc = tls_set_remaining_x509(state);
1367if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1368
1369return 0;
059ec3d9
PH
1370}
1371
1372
1373
17c76198
PP
1374
1375/* ------------------------------------------------------------------------ */
1376/* Exported functions */
1377
1378
1379
1380
059ec3d9
PH
1381/*************************************************
1382* Start a TLS session in a server *
1383*************************************************/
1384
1385/* This is called when Exim is running as a server, after having received
1386the STARTTLS command. It must respond to that command, and then negotiate
1387a TLS session.
1388
1389Arguments:
83da1223 1390 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1391
1392Returns: OK on success
1393 DEFER for errors before the start of the negotiation
1394 FAIL for errors during the negotation; the server can't
1395 continue running.
1396*/
1397
1398int
17c76198 1399tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1400{
1401int rc;
7199e1ee 1402const char *error;
17c76198 1403exim_gnutls_state_st *state = NULL;
059ec3d9
PH
1404
1405/* Check for previous activation */
817d9f57 1406if (tls_in.active >= 0)
059ec3d9 1407 {
17c76198 1408 tls_error(US"STARTTLS received after TLS started", "", NULL);
059ec3d9
PH
1409 smtp_printf("554 Already in TLS\r\n");
1410 return FAIL;
1411 }
1412
1413/* Initialize the library. If it fails, it will already have logged the error
1414and sent an SMTP response. */
1415
17c76198 1416DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 1417
17c76198
PP
1418rc = tls_init(NULL, tls_certificate, tls_privatekey,
1419 NULL, tls_verify_certificates, tls_crl,
1420 require_ciphers, &state);
059ec3d9
PH
1421if (rc != OK) return rc;
1422
059ec3d9
PH
1423/* If this is a host for which certificate verification is mandatory or
1424optional, set up appropriately. */
1425
059ec3d9 1426if (verify_check_host(&tls_verify_hosts) == OK)
17c76198
PP
1427 {
1428 DEBUG(D_tls) debug_printf("TLS: a client certificate will be required.\n");
1429 state->verify_requirement = VERIFY_REQUIRED;
1430 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1431 }
059ec3d9 1432else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198
PP
1433 {
1434 DEBUG(D_tls) debug_printf("TLS: a client certificate will be requested but not required.\n");
1435 state->verify_requirement = VERIFY_OPTIONAL;
1436 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1437 }
1438else
1439 {
1440 DEBUG(D_tls) debug_printf("TLS: a client certificate will not be requested.\n");
1441 state->verify_requirement = VERIFY_NONE;
1442 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1443 }
059ec3d9 1444
17c76198
PP
1445/* Register SNI handling; always, even if not in tls_certificate, so that the
1446expansion variable $tls_sni is always available. */
059ec3d9 1447
17c76198
PP
1448gnutls_handshake_set_post_client_hello_function(state->session,
1449 exim_sni_handling_cb);
059ec3d9
PH
1450
1451/* Set context and tell client to go ahead, except in the case of TLS startup
1452on connection, where outputting anything now upsets the clients and tends to
1453make them disconnect. We need to have an explicit fflush() here, to force out
1454the response. Other smtp_printf() calls do not need it, because in non-TLS
1455mode, the fflush() happens when smtp_getc() is called. */
1456
817d9f57 1457if (!state->tlsp->on_connect)
059ec3d9
PH
1458 {
1459 smtp_printf("220 TLS go ahead\r\n");
817d9f57 1460 fflush(smtp_out); /*XXX JGH */
059ec3d9
PH
1461 }
1462
1463/* Now negotiate the TLS session. We put our own timer on it, since it seems
1464that the GnuTLS library doesn't. */
1465
17c76198
PP
1466gnutls_transport_set_ptr2(state->session,
1467 (gnutls_transport_ptr)fileno(smtp_in),
1468 (gnutls_transport_ptr)fileno(smtp_out));
1469state->fd_in = fileno(smtp_in);
1470state->fd_out = fileno(smtp_out);
059ec3d9
PH
1471
1472sigalrm_seen = FALSE;
1473if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198
PP
1474do
1475 {
1476 rc = gnutls_handshake(state->session);
619b2b25
PP
1477 } while ((rc == GNUTLS_E_AGAIN) ||
1478 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1479alarm(0);
1480
17c76198 1481if (rc != GNUTLS_E_SUCCESS)
059ec3d9 1482 {
17c76198
PP
1483 tls_error(US"gnutls_handshake",
1484 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
059ec3d9
PH
1485 /* It seems that, except in the case of a timeout, we have to close the
1486 connection right here; otherwise if the other end is running OpenSSL it hangs
1487 until the server times out. */
1488
1489 if (!sigalrm_seen)
1490 {
f1e894f3
PH
1491 (void)fclose(smtp_out);
1492 (void)fclose(smtp_in);
059ec3d9
PH
1493 }
1494
1495 return FAIL;
1496 }
1497
1498DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1499
17c76198
PP
1500/* Verify after the fact */
1501
1502if (state->verify_requirement != VERIFY_NONE)
059ec3d9 1503 {
17c76198
PP
1504 if (!verify_certificate(state, &error))
1505 {
1506 if (state->verify_requirement == VERIFY_OPTIONAL)
1507 {
1508 DEBUG(D_tls)
1509 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1510 error);
1511 }
1512 else
1513 {
1514 tls_error(US"certificate verification failed", error, NULL);
1515 return FAIL;
1516 }
1517 }
059ec3d9
PH
1518 }
1519
17c76198
PP
1520/* Figure out peer DN, and if authenticated, etc. */
1521
1522rc = peer_status(state);
1523if (rc != OK) return rc;
1524
1525/* Sets various Exim expansion variables; always safe within server */
1526
817d9f57 1527extract_exim_vars_from_tls_state(state, TRUE);
059ec3d9
PH
1528
1529/* TLS has been set up. Adjust the input functions to read via TLS,
1530and initialize appropriately. */
1531
17c76198 1532state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
1533
1534receive_getc = tls_getc;
1535receive_ungetc = tls_ungetc;
1536receive_feof = tls_feof;
1537receive_ferror = tls_ferror;
58eb016e 1538receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1539
059ec3d9
PH
1540return OK;
1541}
1542
1543
1544
1545
1546/*************************************************
1547* Start a TLS session in a client *
1548*************************************************/
1549
1550/* Called from the smtp transport after STARTTLS has been accepted.
1551
1552Arguments:
1553 fd the fd of the connection
1554 host connected host (for messages)
83da1223 1555 addr the first address (not used)
059ec3d9
PH
1556 certificate certificate file
1557 privatekey private key file
3f0945ff 1558 sni TLS SNI to send to remote host
059ec3d9
PH
1559 verify_certs file for certificate verify
1560 verify_crl CRL for verify
83da1223 1561 require_ciphers list of allowed ciphers or NULL
54c90be1 1562 dh_min_bits minimum number of bits acceptable in server's DH prime
059ec3d9 1563 timeout startup timeout
a63be306
WB
1564 verify_hosts mandatory client verification
1565 try_verify_hosts optional client verification
059ec3d9
PH
1566
1567Returns: OK/DEFER/FAIL (because using common functions),
1568 but for a client, DEFER and FAIL have the same meaning
1569*/
1570
1571int
17c76198 1572tls_client_start(int fd, host_item *host,
f5d78688 1573 address_item *addr ARG_UNUSED,
17c76198
PP
1574 uschar *certificate, uschar *privatekey, uschar *sni,
1575 uschar *verify_certs, uschar *verify_crl,
f5d78688
JH
1576 uschar *require_ciphers,
1577#ifdef EXPERIMENTAL_OCSP
1578 uschar *require_ocsp ARG_UNUSED,
1579#endif
a63be306
WB
1580 int dh_min_bits, int timeout,
1581 uschar *verify_hosts, uschar *try_verify_hosts)
059ec3d9 1582{
059ec3d9 1583int rc;
17c76198
PP
1584const char *error;
1585exim_gnutls_state_st *state = NULL;
059ec3d9 1586
17c76198 1587DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 1588
17c76198
PP
1589rc = tls_init(host, certificate, privatekey,
1590 sni, verify_certs, verify_crl, require_ciphers, &state);
059ec3d9
PH
1591if (rc != OK) return rc;
1592
54c90be1
PP
1593if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1594 {
1595 DEBUG(D_tls)
1596 debug_printf("WARNING: tls_dh_min_bits far too low, clamping %d up to %d\n",
1597 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1598 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1599 }
1600
1601DEBUG(D_tls) debug_printf("Setting D-H prime minimum acceptable bits to %d\n",
1602 dh_min_bits);
1603gnutls_dh_set_prime_bits(state->session, dh_min_bits);
83da1223 1604
52f93eed
WB
1605/* stick to the old behaviour for compatibility if tls_verify_certificates is
1606 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1607 the specified host patterns if one of them is defined */
1608if (((state->exp_tls_verify_certificates != NULL) && (verify_hosts == NULL) && (try_verify_hosts == NULL)) ||
1609 (verify_check_host(&verify_hosts) == OK))
17c76198 1610 {
52f93eed
WB
1611 DEBUG(D_tls) debug_printf("TLS: server certificate verification required.\n");
1612 state->verify_requirement = VERIFY_REQUIRED;
1613 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1614 }
1615else if (verify_check_host(&try_verify_hosts) == OK)
1616 {
1617 DEBUG(D_tls) debug_printf("TLS: server certificate verification optional.\n");
1618 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
1619 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1620 }
1621else
1622 {
52f93eed
WB
1623 DEBUG(D_tls) debug_printf("TLS: server certificate verification not required.\n");
1624 state->verify_requirement = VERIFY_NONE;
1625 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 1626 }
059ec3d9 1627
17c76198
PP
1628gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)fd);
1629state->fd_in = fd;
1630state->fd_out = fd;
059ec3d9
PH
1631
1632/* There doesn't seem to be a built-in timeout on connection. */
1633
1634sigalrm_seen = FALSE;
1635alarm(timeout);
17c76198
PP
1636do
1637 {
1638 rc = gnutls_handshake(state->session);
619b2b25
PP
1639 } while ((rc == GNUTLS_E_AGAIN) ||
1640 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1641alarm(0);
1642
4fe99a6c
PP
1643if (rc != GNUTLS_E_SUCCESS)
1644 return tls_error(US"gnutls_handshake",
1645 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1646
17c76198 1647DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 1648
17c76198 1649/* Verify late */
059ec3d9 1650
17c76198
PP
1651if (state->verify_requirement != VERIFY_NONE &&
1652 !verify_certificate(state, &error))
1653 return tls_error(US"certificate verification failed", error, state->host);
059ec3d9 1654
17c76198 1655/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 1656
17c76198
PP
1657rc = peer_status(state);
1658if (rc != OK) return rc;
059ec3d9 1659
4fe99a6c 1660/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 1661
817d9f57 1662extract_exim_vars_from_tls_state(state, FALSE);
059ec3d9 1663
059ec3d9
PH
1664return OK;
1665}
1666
1667
1668
17c76198 1669
059ec3d9 1670/*************************************************
17c76198 1671* Close down a TLS session *
059ec3d9
PH
1672*************************************************/
1673
17c76198
PP
1674/* This is also called from within a delivery subprocess forked from the
1675daemon, to shut down the TLS library, without actually doing a shutdown (which
1676would tamper with the TLS session in the parent process).
059ec3d9 1677
17c76198
PP
1678Arguments: TRUE if gnutls_bye is to be called
1679Returns: nothing
059ec3d9
PH
1680*/
1681
17c76198 1682void
817d9f57 1683tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 1684{
817d9f57 1685exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 1686
389ca47a 1687if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
17c76198
PP
1688
1689if (shutdown)
1690 {
1691 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1692 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1693 }
1694
1695gnutls_deinit(state->session);
1696
389ca47a 1697state->tlsp->active = -1;
17c76198
PP
1698memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1699
1700if ((state_server.session == NULL) && (state_client.session == NULL))
1701 {
1702 gnutls_global_deinit();
1703 exim_gnutls_base_init_done = FALSE;
1704 }
7199e1ee 1705
059ec3d9
PH
1706}
1707
1708
1709
17c76198 1710
059ec3d9
PH
1711/*************************************************
1712* TLS version of getc *
1713*************************************************/
1714
1715/* This gets the next byte from the TLS input buffer. If the buffer is empty,
1716it refills the buffer via the GnuTLS reading function.
817d9f57 1717Only used by the server-side TLS.
059ec3d9 1718
17c76198
PP
1719This feeds DKIM and should be used for all message-body reads.
1720
059ec3d9
PH
1721Arguments: none
1722Returns: the next character or EOF
1723*/
1724
1725int
1726tls_getc(void)
1727{
817d9f57 1728exim_gnutls_state_st *state = &state_server;
17c76198 1729if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
059ec3d9 1730 {
17c76198 1731 ssize_t inbytes;
059ec3d9 1732
17c76198
PP
1733 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1734 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
1735
1736 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 1737 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
059ec3d9
PH
1738 ssl_xfer_buffer_size);
1739 alarm(0);
1740
1741 /* A zero-byte return appears to mean that the TLS session has been
1742 closed down, not that the socket itself has been closed down. Revert to
1743 non-TLS handling. */
1744
1745 if (inbytes == 0)
1746 {
1747 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1748
1749 receive_getc = smtp_getc;
1750 receive_ungetc = smtp_ungetc;
1751 receive_feof = smtp_feof;
1752 receive_ferror = smtp_ferror;
58eb016e 1753 receive_smtp_buffered = smtp_buffered;
059ec3d9 1754
17c76198
PP
1755 gnutls_deinit(state->session);
1756 state->session = NULL;
817d9f57
JH
1757 state->tlsp->active = -1;
1758 state->tlsp->bits = 0;
1759 state->tlsp->certificate_verified = FALSE;
1760 tls_channelbinding_b64 = NULL; /*XXX JGH */
1761 state->tlsp->cipher = NULL;
1762 state->tlsp->peerdn = NULL;
059ec3d9
PH
1763
1764 return smtp_getc();
1765 }
1766
1767 /* Handle genuine errors */
1768
1769 else if (inbytes < 0)
1770 {
17c76198
PP
1771 record_io_error(state, (int) inbytes, US"recv", NULL);
1772 state->xfer_error = 1;
059ec3d9
PH
1773 return EOF;
1774 }
80a47a2c 1775#ifndef DISABLE_DKIM
17c76198 1776 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
80a47a2c 1777#endif
17c76198
PP
1778 state->xfer_buffer_hwm = (int) inbytes;
1779 state->xfer_buffer_lwm = 0;
059ec3d9
PH
1780 }
1781
059ec3d9
PH
1782/* Something in the buffer; return next uschar */
1783
17c76198 1784return state->xfer_buffer[state->xfer_buffer_lwm++];
059ec3d9
PH
1785}
1786
1787
1788
17c76198 1789
059ec3d9
PH
1790/*************************************************
1791* Read bytes from TLS channel *
1792*************************************************/
1793
17c76198
PP
1794/* This does not feed DKIM, so if the caller uses this for reading message body,
1795then the caller must feed DKIM.
817d9f57 1796
059ec3d9
PH
1797Arguments:
1798 buff buffer of data
1799 len size of buffer
1800
1801Returns: the number of bytes read
1802 -1 after a failed read
1803*/
1804
1805int
817d9f57 1806tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 1807{
817d9f57 1808exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
17c76198 1809ssize_t inbytes;
059ec3d9 1810
17c76198
PP
1811if (len > INT_MAX)
1812 len = INT_MAX;
059ec3d9 1813
17c76198
PP
1814if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
1815 DEBUG(D_tls)
1816 debug_printf("*** PROBABLY A BUG *** " \
1817 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1818 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
1819
1820DEBUG(D_tls)
1821 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
1822 state->session, buff, len);
1823
1824inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
1825if (inbytes > 0) return inbytes;
1826if (inbytes == 0)
1827 {
1828 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1829 }
17c76198 1830else record_io_error(state, (int)inbytes, US"recv", NULL);
059ec3d9
PH
1831
1832return -1;
1833}
1834
1835
1836
17c76198 1837
059ec3d9
PH
1838/*************************************************
1839* Write bytes down TLS channel *
1840*************************************************/
1841
1842/*
1843Arguments:
817d9f57 1844 is_server channel specifier
059ec3d9
PH
1845 buff buffer of data
1846 len number of bytes
1847
1848Returns: the number of bytes after a successful write,
1849 -1 after a failed write
1850*/
1851
1852int
817d9f57 1853tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9 1854{
17c76198
PP
1855ssize_t outbytes;
1856size_t left = len;
817d9f57 1857exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 1858
17c76198 1859DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
059ec3d9
PH
1860while (left > 0)
1861 {
17c76198
PP
1862 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
1863 buff, left);
1864 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 1865
17c76198 1866 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
1867 if (outbytes < 0)
1868 {
17c76198 1869 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
1870 return -1;
1871 }
1872 if (outbytes == 0)
1873 {
17c76198 1874 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
1875 return -1;
1876 }
1877
1878 left -= outbytes;
1879 buff += outbytes;
1880 }
1881
17c76198
PP
1882if (len > INT_MAX)
1883 {
1884 DEBUG(D_tls)
1885 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
1886 len);
1887 len = INT_MAX;
1888 }
1889
1890return (int) len;
059ec3d9
PH
1891}
1892
1893
1894
17c76198 1895
059ec3d9 1896/*************************************************
17c76198 1897* Random number generation *
059ec3d9
PH
1898*************************************************/
1899
17c76198
PP
1900/* Pseudo-random number generation. The result is not expected to be
1901cryptographically strong but not so weak that someone will shoot themselves
1902in the foot using it as a nonce in input in some email header scheme or
1903whatever weirdness they'll twist this into. The result should handle fork()
1904and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 1905
17c76198
PP
1906Arguments:
1907 max range maximum
1908Returns a random number in range [0, max-1]
059ec3d9
PH
1909*/
1910
af3498d6 1911#ifdef HAVE_GNUTLS_RND
17c76198
PP
1912int
1913vaguely_random_number(int max)
059ec3d9 1914{
17c76198
PP
1915unsigned int r;
1916int i, needed_len;
1917uschar *p;
1918uschar smallbuf[sizeof(r)];
1919
1920if (max <= 1)
1921 return 0;
1922
1923needed_len = sizeof(r);
1924/* Don't take 8 times more entropy than needed if int is 8 octets and we were
1925 * asked for a number less than 10. */
1926for (r = max, i = 0; r; ++i)
1927 r >>= 1;
1928i = (i + 7) / 8;
1929if (i < needed_len)
1930 needed_len = i;
1931
1932i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
1933if (i < 0)
059ec3d9 1934 {
17c76198
PP
1935 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
1936 return vaguely_random_number_fallback(max);
1937 }
1938r = 0;
1939for (p = smallbuf; needed_len; --needed_len, ++p)
1940 {
1941 r *= 256;
1942 r += *p;
059ec3d9
PH
1943 }
1944
17c76198
PP
1945/* We don't particularly care about weighted results; if someone wants
1946 * smooth distribution and cares enough then they should submit a patch then. */
1947return r % max;
059ec3d9 1948}
af3498d6
PP
1949#else /* HAVE_GNUTLS_RND */
1950int
1951vaguely_random_number(int max)
1952{
1953 return vaguely_random_number_fallback(max);
1954}
1955#endif /* HAVE_GNUTLS_RND */
059ec3d9 1956
36f12725
NM
1957
1958
1959
1960/*************************************************
3375e053
PP
1961* Let tls_require_ciphers be checked at startup *
1962*************************************************/
1963
1964/* The tls_require_ciphers option, if set, must be something which the
1965library can parse.
1966
1967Returns: NULL on success, or error message
1968*/
1969
1970uschar *
1971tls_validate_require_cipher(void)
1972{
1973int rc;
1974uschar *expciphers = NULL;
1975gnutls_priority_t priority_cache;
1976const char *errpos;
1977
1978#define validate_check_rc(Label) do { \
1979 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
1980 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
1981#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
1982
1983if (exim_gnutls_base_init_done)
1984 log_write(0, LOG_MAIN|LOG_PANIC,
1985 "already initialised GnuTLS, Exim developer bug");
1986
a5f239e4 1987#ifdef HAVE_GNUTLS_PKCS11
2519e60d 1988if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
1989 {
1990 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1991 validate_check_rc(US"gnutls_pkcs11_init");
1992 }
1993#endif
3375e053
PP
1994rc = gnutls_global_init();
1995validate_check_rc(US"gnutls_global_init()");
1996exim_gnutls_base_init_done = TRUE;
1997
1998if (!(tls_require_ciphers && *tls_require_ciphers))
1999 return_deinit(NULL);
2000
2001if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2002 return_deinit(US"failed to expand tls_require_ciphers");
2003
2004if (!(expciphers && *expciphers))
2005 return_deinit(NULL);
2006
2007DEBUG(D_tls)
2008 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2009
2010rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2011validate_check_rc(string_sprintf(
2012 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2013 expciphers, errpos - CS expciphers, errpos));
2014
2015#undef return_deinit
2016#undef validate_check_rc
2017gnutls_global_deinit();
2018
2019return NULL;
2020}
2021
2022
2023
2024
2025/*************************************************
36f12725
NM
2026* Report the library versions. *
2027*************************************************/
2028
2029/* See a description in tls-openssl.c for an explanation of why this exists.
2030
2031Arguments: a FILE* to print the results to
2032Returns: nothing
2033*/
2034
2035void
2036tls_version_report(FILE *f)
2037{
754a0503
PP
2038fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2039 " Runtime: %s\n",
2040 LIBGNUTLS_VERSION,
2041 gnutls_check_version(NULL));
36f12725
NM
2042}
2043
059ec3d9 2044/* End of tls-gnu.c */