FAQ for GnuTLS
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
17c76198 5/* Copyright (c) University of Cambridge 1995 - 2012 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
16Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
059ec3d9 42
17c76198 43/* GnuTLS 2 vs 3
059ec3d9 44
17c76198
PP
45GnuTLS 3 only:
46 gnutls_global_set_audit_log_function()
059ec3d9 47
17c76198
PP
48Changes:
49 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
50*/
059ec3d9 51
17c76198 52/* Local static variables for GnuTLS */
059ec3d9 53
17c76198 54/* Values for verify_requirement */
059ec3d9 55
17c76198 56enum peer_verify_requirement { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
059ec3d9 57
17c76198
PP
58/* This holds most state for server or client; with this, we can set up an
59outbound TLS-enabled connection in an ACL callout, while not stomping all
60over the TLS variables available for expansion.
059ec3d9 61
17c76198
PP
62Some of these correspond to variables in globals.c; those variables will
63be set to point to content in one of these instances, as appropriate for
64the stage of the process lifetime.
059ec3d9 65
17c76198
PP
66Not handled here: globals tls_active, tls_bits, tls_cipher, tls_peerdn,
67tls_certificate_verified, tls_channelbinding_b64, tls_sni.
68*/
059ec3d9 69
17c76198
PP
70typedef struct exim_gnutls_state {
71 gnutls_session_t session;
72 gnutls_certificate_credentials_t x509_cred;
73 gnutls_priority_t priority_cache;
74 enum peer_verify_requirement verify_requirement;
75 int fd_in;
76 int fd_out;
77 BOOL peer_cert_verified;
78 BOOL trigger_sni_changes;
4fe99a6c 79 BOOL have_set_peerdn;
17c76198
PP
80 const struct host_item *host;
81 uschar *peerdn;
75fe387d 82 uschar *ciphersuite;
17c76198
PP
83 uschar *received_sni;
84
85 const uschar *tls_certificate;
86 const uschar *tls_privatekey;
87 const uschar *tls_sni; /* client send only, not received */
88 const uschar *tls_verify_certificates;
89 const uschar *tls_crl;
90 const uschar *tls_require_ciphers;
91 uschar *exp_tls_certificate;
92 uschar *exp_tls_privatekey;
93 uschar *exp_tls_sni;
94 uschar *exp_tls_verify_certificates;
95 uschar *exp_tls_crl;
96 uschar *exp_tls_require_ciphers;
97
98 uschar *xfer_buffer;
99 int xfer_buffer_lwm;
100 int xfer_buffer_hwm;
101 int xfer_eof;
102 int xfer_error;
17c76198
PP
103} exim_gnutls_state_st;
104
105static const exim_gnutls_state_st exim_gnutls_state_init = {
4fe99a6c 106 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
75fe387d 107 NULL, NULL, NULL, NULL,
17c76198
PP
108 NULL, NULL, NULL, NULL, NULL, NULL,
109 NULL, NULL, NULL, NULL, NULL, NULL,
110 NULL, 0, 0, 0, 0,
17c76198 111};
83da1223 112
17c76198
PP
113/* Not only do we have our own APIs which don't pass around state, assuming
114it's held in globals, GnuTLS doesn't appear to let us register callback data
115for callbacks, or as part of the session, so we have to keep a "this is the
116context we're currently dealing with" pointer and rely upon being
117single-threaded to keep from processing data on an inbound TLS connection while
118talking to another TLS connection for an outbound check. This does mean that
119there's no way for heart-beats to be responded to, for the duration of the
120second connection. */
059ec3d9 121
17c76198
PP
122static exim_gnutls_state_st state_server, state_client;
123static exim_gnutls_state_st *current_global_tls_state;
059ec3d9 124
17c76198
PP
125/* dh_params are initialised once within the lifetime of a process using TLS;
126if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
127don't want to repeat this. */
83da1223 128
17c76198 129static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 130
17c76198 131/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 132
17c76198 133static const int ssl_session_timeout = 200;
059ec3d9 134
17c76198 135static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 136
17c76198 137/* Guard library core initialisation */
83da1223 138
17c76198 139static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 140
059ec3d9 141
17c76198 142/* ------------------------------------------------------------------------ */
17c76198 143/* macros */
83da1223 144
17c76198 145#define MAX_HOST_LEN 255
83da1223 146
17c76198
PP
147/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
148the library logging; a value less than 0 disables the calls to set up logging
149callbacks. */
2c17bb02 150#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
17c76198 151#define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 152#endif
83da1223 153
2c17bb02 154#ifndef EXIM_CLIENT_DH_MIN_BITS
17c76198 155#define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 156#endif
83da1223 157
af3498d6
PP
158/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
159can ask for a bit-strength. Without that, we stick to the constant we had
160before, for now. */
2c17bb02 161#ifndef EXIM_SERVER_DH_BITS_PRE2_12
af3498d6 162#define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 163#endif
af3498d6 164
17c76198
PP
165#define exim_gnutls_err_check(Label) do { \
166 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
059ec3d9 167
17c76198 168#define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
83da1223 169
17c76198
PP
170#if GNUTLS_VERSION_NUMBER >= 0x020c00
171#define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
af3498d6
PP
172#define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
173#define HAVE_GNUTLS_RND
17c76198 174#endif
83da1223 175
af3498d6
PP
176
177
178
179/* ------------------------------------------------------------------------ */
180/* Callback declarations */
181
182#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
183static void exim_gnutls_logger_cb(int level, const char *message);
184#endif
185
186static int exim_sni_handling_cb(gnutls_session_t session);
187
188
189
190
17c76198
PP
191/* ------------------------------------------------------------------------ */
192/* Static functions */
059ec3d9
PH
193
194/*************************************************
195* Handle TLS error *
196*************************************************/
197
198/* Called from lots of places when errors occur before actually starting to do
199the TLS handshake, that is, while the session is still in clear. Always returns
200DEFER for a server and FAIL for a client so that most calls can use "return
201tls_error(...)" to do this processing and then give an appropriate return. A
202single function is used for both server and client, because it is called from
203some shared functions.
204
205Argument:
206 prefix text to include in the logged error
7199e1ee
TF
207 msg additional error string (may be NULL)
208 usually obtained from gnutls_strerror()
17c76198
PP
209 host NULL if setting up a server;
210 the connected host if setting up a client
059ec3d9
PH
211
212Returns: OK/DEFER/FAIL
213*/
214
215static int
17c76198 216tls_error(const uschar *prefix, const char *msg, const host_item *host)
059ec3d9 217{
17c76198
PP
218if (host)
219 {
220 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
221 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
222 return FAIL;
223 }
224else
059ec3d9 225 {
7199e1ee 226 uschar *conn_info = smtp_get_connection_info();
17c76198 227 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee
TF
228 conn_info += 5;
229 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
17c76198 230 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
059ec3d9
PH
231 return DEFER;
232 }
059ec3d9
PH
233}
234
235
236
17c76198 237
059ec3d9 238/*************************************************
17c76198 239* Deal with logging errors during I/O *
059ec3d9
PH
240*************************************************/
241
17c76198 242/* We have to get the identity of the peer from saved data.
059ec3d9 243
17c76198
PP
244Argument:
245 state the current GnuTLS exim state container
246 rc the GnuTLS error code, or 0 if it's a local error
247 when text identifying read or write
248 text local error text when ec is 0
059ec3d9 249
17c76198 250Returns: nothing
059ec3d9
PH
251*/
252
17c76198
PP
253static void
254record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 255{
17c76198 256const char *msg;
059ec3d9 257
17c76198
PP
258if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
259 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
260 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
261else
262 msg = gnutls_strerror(rc);
059ec3d9 263
17c76198
PP
264tls_error(when, msg, state->host);
265}
059ec3d9 266
059ec3d9 267
059ec3d9 268
059ec3d9 269
17c76198
PP
270/*************************************************
271* Set various Exim expansion vars *
272*************************************************/
059ec3d9 273
17c76198
PP
274/* We set various Exim global variables from the state, once a session has
275been established. With TLS callouts, may need to change this to stack
276variables, or just re-call it with the server state after client callout
277has finished.
059ec3d9 278
17c76198
PP
279Make sure anything set here is inset in tls_getc().
280
281Sets:
282 tls_active fd
283 tls_bits strength indicator
284 tls_certificate_verified bool indicator
285 tls_channelbinding_b64 for some SASL mechanisms
286 tls_cipher a string
287 tls_peerdn a string
288 tls_sni a (UTF-8) string
289Also:
290 current_global_tls_state for API limitations
291
292Argument:
293 state the relevant exim_gnutls_state_st *
294*/
295
296static void
297extract_exim_vars_from_tls_state(exim_gnutls_state_st *state)
298{
17c76198 299gnutls_cipher_algorithm_t cipher;
17c76198
PP
300#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
301int old_pool;
302int rc;
303gnutls_datum_t channel;
304#endif
305
306current_global_tls_state = state;
307
308tls_active = state->fd_out;
309
310cipher = gnutls_cipher_get(state->session);
311/* returns size in "bytes" */
312tls_bits = gnutls_cipher_get_key_size(cipher) * 8;
313
75fe387d 314tls_cipher = state->ciphersuite;
17c76198
PP
315
316DEBUG(D_tls) debug_printf("cipher: %s\n", tls_cipher);
317
318tls_certificate_verified = state->peer_cert_verified;
059ec3d9 319
17c76198
PP
320/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
321only available for use for authenticators while this TLS session is running. */
322
323tls_channelbinding_b64 = NULL;
324#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
325channel.data = NULL;
326channel.size = 0;
327rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
328if (rc) {
329 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
330} else {
331 old_pool = store_pool;
332 store_pool = POOL_PERM;
333 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
334 store_pool = old_pool;
335 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
336}
337#endif
338
339tls_peerdn = state->peerdn;
340
341tls_sni = state->received_sni;
059ec3d9
PH
342}
343
344
345
17c76198 346
059ec3d9 347/*************************************************
575643cd 348* Setup up DH parameters *
059ec3d9
PH
349*************************************************/
350
575643cd 351/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
352be re-generated every so often, depending on security policy. What we do is to
353keep these parameters in a file in the spool directory. If the file does not
354exist, we generate them. This means that it is easy to cause a regeneration.
355
356The new file is written as a temporary file and renamed, so that an incomplete
357file is never present. If two processes both compute some new parameters, you
358waste a bit of effort, but it doesn't seem worth messing around with locking to
359prevent this.
360
361Argument:
362 host NULL for server, server for client (for error handling)
363
364Returns: OK/DEFER/FAIL
365*/
366
367static int
17c76198 368init_server_dh(void)
059ec3d9 369{
17c76198
PP
370int fd, rc;
371unsigned int dh_bits;
b5aea5e1 372gnutls_datum m;
17c76198
PP
373uschar filename[PATH_MAX];
374size_t sz;
375host_item *host = NULL; /* dummy for macros */
059ec3d9 376
17c76198 377DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 378
17c76198
PP
379rc = gnutls_dh_params_init(&dh_server_params);
380exim_gnutls_err_check(US"gnutls_dh_params_init");
059ec3d9 381
af3498d6
PP
382#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
383/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
384different filename and ensure we have sufficient bits. */
385dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
386if (!dh_bits)
387 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
af3498d6 388DEBUG(D_tls)
b34fc30c 389 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
390 dh_bits);
391#else
392dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
393DEBUG(D_tls)
394 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
395 dh_bits);
396#endif
059ec3d9 397
3375e053
PP
398/* Some clients have hard-coded limits. */
399if (dh_bits > tls_dh_max_bits)
400 {
401 DEBUG(D_tls)
402 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
403 tls_dh_max_bits);
404 dh_bits = tls_dh_max_bits;
405 }
406
17c76198 407if (!string_format(filename, sizeof(filename),
af3498d6 408 "%s/gnutls-params-%d", spool_directory, dh_bits))
17c76198 409 return tls_error(US"overlong filename", NULL, NULL);
059ec3d9 410
b5aea5e1 411/* Open the cache file for reading and if successful, read it and set up the
575643cd 412parameters. */
059ec3d9
PH
413
414fd = Uopen(filename, O_RDONLY, 0);
b5aea5e1 415if (fd >= 0)
059ec3d9 416 {
b5aea5e1 417 struct stat statbuf;
17c76198
PP
418 FILE *fp;
419 int saved_errno;
420
421 if (fstat(fd, &statbuf) < 0) /* EIO */
422 {
423 saved_errno = errno;
424 (void)close(fd);
425 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
426 }
427 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
428 {
429 (void)close(fd);
17c76198
PP
430 return tls_error(US"TLS cache not a file", NULL, NULL);
431 }
432 fp = fdopen(fd, "rb");
433 if (!fp)
434 {
435 saved_errno = errno;
436 (void)close(fd);
437 return tls_error(US"fdopen(TLS cache stat fd) failed",
438 strerror(saved_errno), NULL);
b5aea5e1 439 }
059ec3d9 440
b5aea5e1
PH
441 m.size = statbuf.st_size;
442 m.data = malloc(m.size);
443 if (m.data == NULL)
17c76198
PP
444 {
445 fclose(fp);
446 return tls_error(US"malloc failed", strerror(errno), NULL);
447 }
448 sz = fread(m.data, m.size, 1, fp);
449 if (!sz)
450 {
451 saved_errno = errno;
452 fclose(fp);
453 free(m.data);
454 return tls_error(US"fread failed", strerror(saved_errno), NULL);
455 }
456 fclose(fp);
b5aea5e1 457
17c76198 458 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 459 free(m.data);
17c76198
PP
460 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
461 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
462 }
463
464/* If the file does not exist, fall through to compute new data and cache it.
465If there was any other opening error, it is serious. */
466
182ad5cf
PH
467else if (errno == ENOENT)
468 {
17c76198 469 rc = -1;
182ad5cf 470 DEBUG(D_tls)
17c76198 471 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
472 }
473else
17c76198
PP
474 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
475 NULL, NULL);
b5aea5e1
PH
476
477/* If ret < 0, either the cache file does not exist, or the data it contains
478is not useful. One particular case of this is when upgrading from an older
479release of Exim in which the data was stored in a different format. We don't
480try to be clever and support both formats; we just regenerate new data in this
481case. */
482
17c76198 483if (rc < 0)
b5aea5e1 484 {
17c76198 485 uschar *temp_fn;
059ec3d9 486
17c76198
PP
487 if ((PATH_MAX - Ustrlen(filename)) < 10)
488 return tls_error(US"Filename too long to generate replacement",
489 CS filename, NULL);
059ec3d9 490
17c76198
PP
491 temp_fn = string_copy(US "%s.XXXXXXX");
492 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
059ec3d9 493 if (fd < 0)
17c76198 494 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
059ec3d9
PH
495 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
496
17c76198
PP
497 DEBUG(D_tls) debug_printf("generating %d bits Diffie-Hellman key ...\n", dh_bits);
498 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits);
499 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
500
501 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
502 and I confirmed that a NULL call to get the size first is how the GnuTLS
503 sample apps handle this. */
504
505 sz = 0;
506 m.data = NULL;
507 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
508 m.data, &sz);
509 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
510 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
511 m.size = sz;
b5aea5e1
PH
512 m.data = malloc(m.size);
513 if (m.data == NULL)
17c76198 514 return tls_error(US"memory allocation failed", strerror(errno), NULL);
1f00591e 515 /* this will return a size 1 less than the allocation size above */
17c76198 516 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 517 m.data, &sz);
17c76198
PP
518 if (rc != GNUTLS_E_SUCCESS)
519 {
520 free(m.data);
521 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
522 }
1f00591e 523 m.size = sz; /* shrink by 1, probably */
059ec3d9 524
17c76198
PP
525 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
526 if (sz != m.size)
527 {
528 free(m.data);
529 return tls_error(US"TLS cache write D-H params failed",
530 strerror(errno), NULL);
531 }
b5aea5e1 532 free(m.data);
17c76198
PP
533 sz = write_to_fd_buf(fd, US"\n", 1);
534 if (sz != 1)
535 return tls_error(US"TLS cache write D-H params final newline failed",
536 strerror(errno), NULL);
537
538 rc = close(fd);
539 if (rc)
540 return tls_error(US"TLS cache write close() failed",
541 strerror(errno), NULL);
059ec3d9 542
17c76198
PP
543 if (Urename(temp_fn, filename) < 0)
544 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
545 temp_fn, filename), strerror(errno), NULL);
059ec3d9 546
17c76198 547 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
548 }
549
17c76198 550DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
551return OK;
552}
553
554
555
556
557/*************************************************
17c76198 558* Variables re-expanded post-SNI *
059ec3d9
PH
559*************************************************/
560
17c76198
PP
561/* Called from both server and client code, via tls_init(), and also from
562the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
563
564We can tell the two apart by state->received_sni being non-NULL in callback.
565
566The callback should not call us unless state->trigger_sni_changes is true,
567which we are responsible for setting on the first pass through.
059ec3d9
PH
568
569Arguments:
17c76198 570 state exim_gnutls_state_st *
059ec3d9
PH
571
572Returns: OK/DEFER/FAIL
573*/
574
575static int
17c76198 576tls_expand_session_files(exim_gnutls_state_st *state)
059ec3d9 577{
1365611d 578struct stat statbuf;
059ec3d9 579int rc;
17c76198
PP
580const host_item *host = state->host; /* macro should be reconsidered? */
581uschar *saved_tls_certificate = NULL;
582uschar *saved_tls_privatekey = NULL;
583uschar *saved_tls_verify_certificates = NULL;
584uschar *saved_tls_crl = NULL;
585int cert_count;
586
587/* We check for tls_sni *before* expansion. */
588if (!state->host)
589 {
590 if (!state->received_sni)
591 {
619b2b25 592 if (state->tls_certificate && Ustrstr(state->tls_certificate, US"tls_sni"))
17c76198
PP
593 {
594 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
595 state->trigger_sni_changes = TRUE;
596 }
597 }
598 else
599 {
1365611d 600 /* useful for debugging */
17c76198
PP
601 saved_tls_certificate = state->exp_tls_certificate;
602 saved_tls_privatekey = state->exp_tls_privatekey;
603 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
604 saved_tls_crl = state->exp_tls_crl;
605 }
606 }
059ec3d9 607
1365611d
PP
608rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
609exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
610
17c76198
PP
611/* remember: expand_check_tlsvar() is expand_check() but fiddling with
612state members, assuming consistent naming; and expand_check() returns
613false if expansion failed, unless expansion was forced to fail. */
059ec3d9 614
17c76198
PP
615/* check if we at least have a certificate, before doing expensive
616D-H generation. */
059ec3d9 617
17c76198
PP
618if (!expand_check_tlsvar(tls_certificate))
619 return DEFER;
059ec3d9 620
17c76198 621/* certificate is mandatory in server, optional in client */
059ec3d9 622
17c76198
PP
623if ((state->exp_tls_certificate == NULL) ||
624 (*state->exp_tls_certificate == '\0'))
625 {
626 if (state->host == NULL)
627 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
628 else
629 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
630 }
059ec3d9 631
17c76198 632if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
059ec3d9
PH
633 return DEFER;
634
17c76198
PP
635/* tls_privatekey is optional, defaulting to same file as certificate */
636
637if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 638 {
17c76198
PP
639 state->tls_privatekey = state->tls_certificate;
640 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 641 }
c91535f3 642
059ec3d9 643
17c76198 644if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
645 {
646 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
647 state->exp_tls_certificate, state->exp_tls_privatekey);
648
649 if (state->received_sni)
de365ded 650 {
17c76198
PP
651 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
652 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
653 {
b34fc30c 654 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
655 }
656 else
657 {
b34fc30c 658 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 659 }
8e669ac1 660 }
059ec3d9 661
1365611d
PP
662 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
663 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
664 GNUTLS_X509_FMT_PEM);
665 exim_gnutls_err_check(
666 string_sprintf("cert/key setup: cert=%s key=%s",
667 state->exp_tls_certificate, state->exp_tls_privatekey));
668 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
b34fc30c 669 } /* tls_certificate */
059ec3d9
PH
670
671/* Set the trusted CAs file if one is provided, and then add the CRL if one is
672provided. Experiment shows that, if the certificate file is empty, an unhelpful
673error message is provided. However, if we just refrain from setting anything up
674in that case, certificate verification fails, which seems to be the correct
675behaviour. */
676
17c76198 677if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 678 {
17c76198 679 if (!expand_check_tlsvar(tls_verify_certificates))
059ec3d9 680 return DEFER;
17c76198
PP
681 if (state->tls_crl && *state->tls_crl)
682 if (!expand_check_tlsvar(tls_crl))
683 return DEFER;
059ec3d9 684
1365611d
PP
685 if (!(state->exp_tls_verify_certificates &&
686 *state->exp_tls_verify_certificates))
b34fc30c
PP
687 {
688 DEBUG(D_tls)
1365611d
PP
689 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
690 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 691 return OK;
b34fc30c 692 }
1365611d 693 }
83e2f8a2
PP
694else
695 {
696 DEBUG(D_tls)
697 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
698 return OK;
699 }
17c76198 700
1365611d
PP
701if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
702 {
703 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
704 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
705 strerror(errno));
706 return DEFER;
707 }
17c76198 708
619b2b25
PP
709/* The test suite passes in /dev/null; we could check for that path explicitly,
710but who knows if someone has some weird FIFO which always dumps some certs, or
711other weirdness. The thing we really want to check is that it's not a
712directory, since while OpenSSL supports that, GnuTLS does not.
713So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
714if (S_ISDIR(statbuf.st_mode))
1365611d
PP
715 {
716 DEBUG(D_tls)
619b2b25
PP
717 debug_printf("verify certificates path is a dir: \"%s\"\n",
718 state->exp_tls_verify_certificates);
1365611d 719 log_write(0, LOG_MAIN|LOG_PANIC,
619b2b25 720 "tls_verify_certificates \"%s\" is a directory",
1365611d
PP
721 state->exp_tls_verify_certificates);
722 return DEFER;
723 }
059ec3d9 724
1365611d
PP
725DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
726 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 727
1365611d
PP
728if (statbuf.st_size == 0)
729 {
730 DEBUG(D_tls)
731 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
732 return OK;
733 }
059ec3d9 734
1365611d
PP
735cert_count = gnutls_certificate_set_x509_trust_file(state->x509_cred,
736 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
737if (cert_count < 0)
738 {
739 rc = cert_count;
740 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
741 }
742DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 743
5c8cda3a
PP
744if (state->tls_crl && *state->tls_crl &&
745 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 746 {
5c8cda3a
PP
747 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
748 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
749 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
750 if (cert_count < 0)
1365611d 751 {
5c8cda3a 752 rc = cert_count;
1365611d
PP
753 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
754 }
5c8cda3a 755 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 756 }
059ec3d9 757
059ec3d9
PH
758return OK;
759}
760
761
762
763
764/*************************************************
1365611d
PP
765* Set X.509 state variables *
766*************************************************/
767
768/* In GnuTLS, the registered cert/key are not replaced by a later
769set of a cert/key, so for SNI support we need a whole new x509_cred
770structure. Which means various other non-re-expanded pieces of state
771need to be re-set in the new struct, so the setting logic is pulled
772out to this.
773
774Arguments:
775 state exim_gnutls_state_st *
776
777Returns: OK/DEFER/FAIL
778*/
779
780static int
781tls_set_remaining_x509(exim_gnutls_state_st *state)
782{
783int rc;
784const host_item *host = state->host; /* macro should be reconsidered? */
785
786/* Create D-H parameters, or read them from the cache file. This function does
787its own SMTP error messaging. This only happens for the server, TLS D-H ignores
788client-side params. */
789
790if (!state->host)
791 {
792 if (!dh_server_params)
793 {
794 rc = init_server_dh();
795 if (rc != OK) return rc;
796 }
797 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
798 }
799
800/* Link the credentials to the session. */
801
802rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
803exim_gnutls_err_check(US"gnutls_credentials_set");
804
805return OK;
806}
807
808/*************************************************
17c76198 809* Initialize for GnuTLS *
059ec3d9
PH
810*************************************************/
811
17c76198
PP
812/* Called from both server and client code. In the case of a server, errors
813before actual TLS negotiation return DEFER.
059ec3d9
PH
814
815Arguments:
17c76198
PP
816 host connected host, if client; NULL if server
817 certificate certificate file
818 privatekey private key file
819 sni TLS SNI to send, sometimes when client; else NULL
820 cas CA certs file
821 crl CRL file
822 require_ciphers tls_require_ciphers setting
059ec3d9 823
17c76198 824Returns: OK/DEFER/FAIL
059ec3d9
PH
825*/
826
17c76198
PP
827static int
828tls_init(
829 const host_item *host,
830 const uschar *certificate,
831 const uschar *privatekey,
832 const uschar *sni,
833 const uschar *cas,
834 const uschar *crl,
835 const uschar *require_ciphers,
836 exim_gnutls_state_st **caller_state)
059ec3d9 837{
17c76198
PP
838exim_gnutls_state_st *state;
839int rc;
840size_t sz;
841const char *errpos;
842uschar *p;
843BOOL want_default_priorities;
844
845if (!exim_gnutls_base_init_done)
059ec3d9 846 {
17c76198
PP
847 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
848
849 rc = gnutls_global_init();
850 exim_gnutls_err_check(US"gnutls_global_init");
851
852#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
853 DEBUG(D_tls)
059ec3d9 854 {
17c76198
PP
855 gnutls_global_set_log_function(exim_gnutls_logger_cb);
856 /* arbitrarily chosen level; bump upto 9 for more */
857 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 858 }
17c76198
PP
859#endif
860
861 exim_gnutls_base_init_done = TRUE;
059ec3d9 862 }
059ec3d9 863
17c76198
PP
864if (host)
865 {
866 state = &state_client;
867 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
868 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
869 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
870 }
871else
872 {
873 state = &state_server;
874 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
875 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
876 rc = gnutls_init(&state->session, GNUTLS_SERVER);
877 }
878exim_gnutls_err_check(US"gnutls_init");
059ec3d9 879
17c76198 880state->host = host;
059ec3d9 881
17c76198
PP
882state->tls_certificate = certificate;
883state->tls_privatekey = privatekey;
5779e6aa 884state->tls_require_ciphers = require_ciphers;
17c76198
PP
885state->tls_sni = sni;
886state->tls_verify_certificates = cas;
887state->tls_crl = crl;
059ec3d9 888
17c76198
PP
889/* This handles the variables that might get re-expanded after TLS SNI;
890that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 891
17c76198
PP
892DEBUG(D_tls)
893 debug_printf("Expanding various TLS configuration options for session credentials.\n");
894rc = tls_expand_session_files(state);
895if (rc != OK) return rc;
059ec3d9 896
1365611d
PP
897/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
898requires a new structure afterwards. */
83da1223 899
1365611d
PP
900rc = tls_set_remaining_x509(state);
901if (rc != OK) return rc;
83da1223 902
17c76198
PP
903/* set SNI in client, only */
904if (host)
905 {
906 if (!expand_check_tlsvar(tls_sni))
907 return DEFER;
908 if (state->exp_tls_sni && *state->exp_tls_sni)
909 {
910 DEBUG(D_tls)
911 debug_printf("Setting TLS client SNI to \"%s\"\n", state->exp_tls_sni);
912 sz = Ustrlen(state->exp_tls_sni);
913 rc = gnutls_server_name_set(state->session,
914 GNUTLS_NAME_DNS, state->exp_tls_sni, sz);
915 exim_gnutls_err_check(US"gnutls_server_name_set");
916 }
917 }
918else if (state->tls_sni)
919 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
920 "have an SNI set for a client [%s]\n", state->tls_sni);
83da1223 921
17c76198
PP
922/* This is the priority string support,
923http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html
924and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
925This was backwards incompatible, but means Exim no longer needs to track
926all algorithms and provide string forms for them. */
83da1223 927
17c76198 928want_default_priorities = TRUE;
83da1223 929
17c76198 930if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 931 {
17c76198
PP
932 if (!expand_check_tlsvar(tls_require_ciphers))
933 return DEFER;
934 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 935 {
17c76198
PP
936 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
937 state->exp_tls_require_ciphers);
938
939 rc = gnutls_priority_init(&state->priority_cache,
940 CS state->exp_tls_require_ciphers, &errpos);
941 want_default_priorities = FALSE;
942 p = state->exp_tls_require_ciphers;
83da1223
PH
943 }
944 }
17c76198
PP
945if (want_default_priorities)
946 {
83e2f8a2
PP
947 DEBUG(D_tls)
948 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
949 exim_default_gnutls_priority);
17c76198
PP
950 rc = gnutls_priority_init(&state->priority_cache,
951 exim_default_gnutls_priority, &errpos);
952 p = US exim_default_gnutls_priority;
953 }
83da1223 954
17c76198
PP
955exim_gnutls_err_check(string_sprintf(
956 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
957 p, errpos - CS p, errpos));
958
959rc = gnutls_priority_set(state->session, state->priority_cache);
960exim_gnutls_err_check(US"gnutls_priority_set");
961
962gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
963
964/* Reduce security in favour of increased compatibility, if the admin
965decides to make that trade-off. */
966if (gnutls_compat_mode)
83da1223 967 {
17c76198
PP
968#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
969 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
970 gnutls_session_enable_compatibility_mode(state->session);
971#else
972 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
973#endif
83da1223
PH
974 }
975
17c76198
PP
976*caller_state = state;
977/* needs to happen before callbacks during handshake */
978current_global_tls_state = state;
979return OK;
83da1223
PH
980}
981
982
983
984
985/*************************************************
17c76198 986* Extract peer information *
059ec3d9
PH
987*************************************************/
988
17c76198 989/* Called from both server and client code.
4fe99a6c
PP
990Only this is allowed to set state->peerdn and state->have_set_peerdn
991and we use that to detect double-calls.
059ec3d9 992
75fe387d
PP
993NOTE: the state blocks last while the TLS connection is up, which is fine
994for logging in the server side, but for the client side, we log after teardown
995in src/deliver.c. While the session is up, we can twist about states and
996repoint tls_* globals, but those variables used for logging or other variable
997expansion that happens _after_ delivery need to have a longer life-time.
998
999So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1000doing this more than once per generation of a state context. We set them in
1001the state context, and repoint tls_* to them. After the state goes away, the
1002tls_* copies of the pointers remain valid and client delivery logging is happy.
1003
1004tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1005don't apply.
1006
059ec3d9 1007Arguments:
17c76198 1008 state exim_gnutls_state_st *
059ec3d9 1009
17c76198 1010Returns: OK/DEFER/FAIL
059ec3d9
PH
1011*/
1012
17c76198
PP
1013static int
1014peer_status(exim_gnutls_state_st *state)
059ec3d9 1015{
75fe387d 1016uschar cipherbuf[256];
17c76198 1017const gnutls_datum *cert_list;
75fe387d 1018int old_pool, rc;
17c76198 1019unsigned int cert_list_size = 0;
4fe99a6c
PP
1020gnutls_protocol_t protocol;
1021gnutls_cipher_algorithm_t cipher;
1022gnutls_kx_algorithm_t kx;
1023gnutls_mac_algorithm_t mac;
17c76198
PP
1024gnutls_certificate_type_t ct;
1025gnutls_x509_crt_t crt;
4fe99a6c 1026uschar *p, *dn_buf;
17c76198 1027size_t sz;
059ec3d9 1028
4fe99a6c 1029if (state->have_set_peerdn)
17c76198 1030 return OK;
4fe99a6c 1031state->have_set_peerdn = TRUE;
059ec3d9 1032
4fe99a6c 1033state->peerdn = NULL;
059ec3d9 1034
4fe99a6c
PP
1035/* tls_cipher */
1036cipher = gnutls_cipher_get(state->session);
1037protocol = gnutls_protocol_get_version(state->session);
1038mac = gnutls_mac_get(state->session);
1039kx = gnutls_kx_get(state->session);
1040
75fe387d 1041string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1042 "%s:%s:%d",
1043 gnutls_protocol_get_name(protocol),
1044 gnutls_cipher_suite_get_name(kx, cipher, mac),
1045 (int) gnutls_cipher_get_key_size(cipher) * 8);
1046
1047/* I don't see a way that spaces could occur, in the current GnuTLS
1048code base, but it was a concern in the old code and perhaps older GnuTLS
1049releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1050for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1051 if (isspace(*p))
1052 *p = '-';
75fe387d
PP
1053old_pool = store_pool;
1054store_pool = POOL_PERM;
1055state->ciphersuite = string_copy(cipherbuf);
1056store_pool = old_pool;
1057tls_cipher = state->ciphersuite;
4fe99a6c
PP
1058
1059/* tls_peerdn */
17c76198 1060cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1061
17c76198
PP
1062if (cert_list == NULL || cert_list_size == 0)
1063 {
17c76198
PP
1064 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1065 cert_list, cert_list_size);
1066 if (state->verify_requirement == VERIFY_REQUIRED)
1067 return tls_error(US"certificate verification failed",
1068 "no certificate received from peer", state->host);
1069 return OK;
1070 }
059ec3d9 1071
17c76198
PP
1072ct = gnutls_certificate_type_get(state->session);
1073if (ct != GNUTLS_CRT_X509)
059ec3d9 1074 {
17c76198 1075 const char *ctn = gnutls_certificate_type_get_name(ct);
17c76198
PP
1076 DEBUG(D_tls)
1077 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1078 if (state->verify_requirement == VERIFY_REQUIRED)
1079 return tls_error(US"certificate verification not possible, unhandled type",
1080 ctn, state->host);
1081 return OK;
83da1223 1082 }
059ec3d9 1083
17c76198
PP
1084#define exim_gnutls_peer_err(Label) do { \
1085 if (rc != GNUTLS_E_SUCCESS) { \
1086 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1087 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1088 return OK; } } while (0)
1089
1090rc = gnutls_x509_crt_init(&crt);
1091exim_gnutls_peer_err(US"gnutls_x509_crt_init (crt)");
1092
1093rc = gnutls_x509_crt_import(crt, &cert_list[0], GNUTLS_X509_FMT_DER);
1094exim_gnutls_peer_err(US"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1095sz = 0;
1096rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1097if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1098 {
17c76198
PP
1099 exim_gnutls_peer_err(US"getting size for cert DN failed");
1100 return FAIL; /* should not happen */
059ec3d9 1101 }
17c76198
PP
1102dn_buf = store_get_perm(sz);
1103rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1104exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1105state->peerdn = dn_buf;
1106
1107return OK;
1108#undef exim_gnutls_peer_err
1109}
059ec3d9 1110
059ec3d9 1111
059ec3d9 1112
059ec3d9 1113
17c76198
PP
1114/*************************************************
1115* Verify peer certificate *
1116*************************************************/
059ec3d9 1117
17c76198
PP
1118/* Called from both server and client code.
1119*Should* be using a callback registered with
1120gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1121the peer information, but that's too new for some OSes.
059ec3d9 1122
17c76198
PP
1123Arguments:
1124 state exim_gnutls_state_st *
1125 error where to put an error message
059ec3d9 1126
17c76198
PP
1127Returns:
1128 FALSE if the session should be rejected
1129 TRUE if the cert is okay or we just don't care
1130*/
059ec3d9 1131
17c76198
PP
1132static BOOL
1133verify_certificate(exim_gnutls_state_st *state, const char **error)
1134{
1135int rc;
1136unsigned int verify;
1137
1138*error = NULL;
1139
1140rc = peer_status(state);
1141if (rc != OK)
e6060e2c 1142 {
17c76198
PP
1143 verify = GNUTLS_CERT_INVALID;
1144 *error = "not supplied";
1145 }
1146else
1147 {
1148 rc = gnutls_certificate_verify_peers2(state->session, &verify);
e6060e2c
NM
1149 }
1150
17c76198
PP
1151/* Handle the result of verification. INVALID seems to be set as well
1152as REVOKED, but leave the test for both. */
059ec3d9 1153
17c76198
PP
1154if ((rc < 0) || (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
1155 {
1156 state->peer_cert_verified = FALSE;
1157 if (*error == NULL)
1158 *error = ((verify & GNUTLS_CERT_REVOKED) != 0) ? "revoked" : "invalid";
059ec3d9 1159
17c76198
PP
1160 DEBUG(D_tls)
1161 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
4fe99a6c 1162 *error, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1163
17c76198
PP
1164 if (state->verify_requirement == VERIFY_REQUIRED)
1165 {
1166 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1167 return FALSE;
1168 }
1169 DEBUG(D_tls)
1170 debug_printf("TLS verify failure overriden (host in tls_try_verify_hosts)\n");
1171 }
1172else
1173 {
1174 state->peer_cert_verified = TRUE;
4fe99a6c
PP
1175 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=%s\n",
1176 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1177 }
059ec3d9 1178
17c76198 1179tls_peerdn = state->peerdn;
059ec3d9 1180
17c76198
PP
1181return TRUE;
1182}
059ec3d9 1183
17c76198
PP
1184
1185
1186
1187/* ------------------------------------------------------------------------ */
1188/* Callbacks */
1189
1190/* Logging function which can be registered with
1191 * gnutls_global_set_log_function()
1192 * gnutls_global_set_log_level() 0..9
1193 */
af3498d6 1194#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1195static void
17c76198 1196exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1197{
8c79eebf
PP
1198 size_t len = strlen(message);
1199 if (len < 1)
1200 {
1201 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1202 return;
1203 }
1204 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1205 message[len-1] == '\n' ? "" : "\n");
17c76198 1206}
af3498d6 1207#endif
059ec3d9 1208
059ec3d9 1209
17c76198
PP
1210/* Called after client hello, should handle SNI work.
1211This will always set tls_sni (state->received_sni) if available,
1212and may trigger presenting different certificates,
1213if state->trigger_sni_changes is TRUE.
059ec3d9 1214
17c76198
PP
1215Should be registered with
1216 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1217
17c76198
PP
1218"This callback must return 0 on success or a gnutls error code to terminate the
1219handshake.".
059ec3d9 1220
17c76198
PP
1221For inability to get SNI information, we return 0.
1222We only return non-zero if re-setup failed.
1223*/
44bbabb5 1224
17c76198
PP
1225static int
1226exim_sni_handling_cb(gnutls_session_t session)
1227{
1228char sni_name[MAX_HOST_LEN];
1229size_t data_len = MAX_HOST_LEN;
1230exim_gnutls_state_st *state = current_global_tls_state;
1231unsigned int sni_type;
1232int rc, old_pool;
1233
1234rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1235if (rc != GNUTLS_E_SUCCESS)
1236 {
1237 DEBUG(D_tls) {
1238 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1239 debug_printf("TLS: no SNI presented in handshake.\n");
1240 else
1241 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1242 gnutls_strerror(rc), rc);
1243 };
1244 return 0;
1245 }
1246
17c76198
PP
1247if (sni_type != GNUTLS_NAME_DNS)
1248 {
1249 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1250 return 0;
1251 }
44bbabb5 1252
17c76198
PP
1253/* We now have a UTF-8 string in sni_name */
1254old_pool = store_pool;
1255store_pool = POOL_PERM;
1256state->received_sni = string_copyn(US sni_name, data_len);
1257store_pool = old_pool;
1258
1259/* We set this one now so that variable expansions below will work */
1260tls_sni = state->received_sni;
1261
1262DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1263 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1264
1265if (!state->trigger_sni_changes)
1266 return 0;
1267
1268rc = tls_expand_session_files(state);
1269if (rc != OK)
1270 {
1271 /* If the setup of certs/etc failed before handshake, TLS would not have
1272 been offered. The best we can do now is abort. */
1273 return GNUTLS_E_APPLICATION_ERROR_MIN;
1274 }
1275
1365611d
PP
1276rc = tls_set_remaining_x509(state);
1277if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1278
1279return 0;
059ec3d9
PH
1280}
1281
1282
1283
17c76198
PP
1284
1285/* ------------------------------------------------------------------------ */
1286/* Exported functions */
1287
1288
1289
1290
059ec3d9
PH
1291/*************************************************
1292* Start a TLS session in a server *
1293*************************************************/
1294
1295/* This is called when Exim is running as a server, after having received
1296the STARTTLS command. It must respond to that command, and then negotiate
1297a TLS session.
1298
1299Arguments:
83da1223 1300 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1301
1302Returns: OK on success
1303 DEFER for errors before the start of the negotiation
1304 FAIL for errors during the negotation; the server can't
1305 continue running.
1306*/
1307
1308int
17c76198 1309tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1310{
1311int rc;
7199e1ee 1312const char *error;
17c76198 1313exim_gnutls_state_st *state = NULL;
059ec3d9
PH
1314
1315/* Check for previous activation */
17c76198 1316/* nb: this will not be TLS callout safe, needs reworking as part of that. */
059ec3d9
PH
1317
1318if (tls_active >= 0)
1319 {
17c76198 1320 tls_error(US"STARTTLS received after TLS started", "", NULL);
059ec3d9
PH
1321 smtp_printf("554 Already in TLS\r\n");
1322 return FAIL;
1323 }
1324
1325/* Initialize the library. If it fails, it will already have logged the error
1326and sent an SMTP response. */
1327
17c76198 1328DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 1329
17c76198
PP
1330rc = tls_init(NULL, tls_certificate, tls_privatekey,
1331 NULL, tls_verify_certificates, tls_crl,
1332 require_ciphers, &state);
059ec3d9
PH
1333if (rc != OK) return rc;
1334
059ec3d9
PH
1335/* If this is a host for which certificate verification is mandatory or
1336optional, set up appropriately. */
1337
059ec3d9 1338if (verify_check_host(&tls_verify_hosts) == OK)
17c76198
PP
1339 {
1340 DEBUG(D_tls) debug_printf("TLS: a client certificate will be required.\n");
1341 state->verify_requirement = VERIFY_REQUIRED;
1342 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1343 }
059ec3d9 1344else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198
PP
1345 {
1346 DEBUG(D_tls) debug_printf("TLS: a client certificate will be requested but not required.\n");
1347 state->verify_requirement = VERIFY_OPTIONAL;
1348 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1349 }
1350else
1351 {
1352 DEBUG(D_tls) debug_printf("TLS: a client certificate will not be requested.\n");
1353 state->verify_requirement = VERIFY_NONE;
1354 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1355 }
059ec3d9 1356
17c76198
PP
1357/* Register SNI handling; always, even if not in tls_certificate, so that the
1358expansion variable $tls_sni is always available. */
059ec3d9 1359
17c76198
PP
1360gnutls_handshake_set_post_client_hello_function(state->session,
1361 exim_sni_handling_cb);
059ec3d9
PH
1362
1363/* Set context and tell client to go ahead, except in the case of TLS startup
1364on connection, where outputting anything now upsets the clients and tends to
1365make them disconnect. We need to have an explicit fflush() here, to force out
1366the response. Other smtp_printf() calls do not need it, because in non-TLS
1367mode, the fflush() happens when smtp_getc() is called. */
1368
1369if (!tls_on_connect)
1370 {
1371 smtp_printf("220 TLS go ahead\r\n");
1372 fflush(smtp_out);
1373 }
1374
1375/* Now negotiate the TLS session. We put our own timer on it, since it seems
1376that the GnuTLS library doesn't. */
1377
17c76198
PP
1378gnutls_transport_set_ptr2(state->session,
1379 (gnutls_transport_ptr)fileno(smtp_in),
1380 (gnutls_transport_ptr)fileno(smtp_out));
1381state->fd_in = fileno(smtp_in);
1382state->fd_out = fileno(smtp_out);
059ec3d9
PH
1383
1384sigalrm_seen = FALSE;
1385if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198
PP
1386do
1387 {
1388 rc = gnutls_handshake(state->session);
619b2b25
PP
1389 } while ((rc == GNUTLS_E_AGAIN) ||
1390 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1391alarm(0);
1392
17c76198 1393if (rc != GNUTLS_E_SUCCESS)
059ec3d9 1394 {
17c76198
PP
1395 tls_error(US"gnutls_handshake",
1396 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
059ec3d9
PH
1397 /* It seems that, except in the case of a timeout, we have to close the
1398 connection right here; otherwise if the other end is running OpenSSL it hangs
1399 until the server times out. */
1400
1401 if (!sigalrm_seen)
1402 {
f1e894f3
PH
1403 (void)fclose(smtp_out);
1404 (void)fclose(smtp_in);
059ec3d9
PH
1405 }
1406
1407 return FAIL;
1408 }
1409
1410DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1411
17c76198
PP
1412/* Verify after the fact */
1413
1414if (state->verify_requirement != VERIFY_NONE)
059ec3d9 1415 {
17c76198
PP
1416 if (!verify_certificate(state, &error))
1417 {
1418 if (state->verify_requirement == VERIFY_OPTIONAL)
1419 {
1420 DEBUG(D_tls)
1421 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1422 error);
1423 }
1424 else
1425 {
1426 tls_error(US"certificate verification failed", error, NULL);
1427 return FAIL;
1428 }
1429 }
059ec3d9
PH
1430 }
1431
17c76198
PP
1432/* Figure out peer DN, and if authenticated, etc. */
1433
1434rc = peer_status(state);
1435if (rc != OK) return rc;
1436
1437/* Sets various Exim expansion variables; always safe within server */
1438
1439extract_exim_vars_from_tls_state(state);
059ec3d9
PH
1440
1441/* TLS has been set up. Adjust the input functions to read via TLS,
1442and initialize appropriately. */
1443
17c76198 1444state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
1445
1446receive_getc = tls_getc;
1447receive_ungetc = tls_ungetc;
1448receive_feof = tls_feof;
1449receive_ferror = tls_ferror;
58eb016e 1450receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1451
059ec3d9
PH
1452return OK;
1453}
1454
1455
1456
1457
1458/*************************************************
1459* Start a TLS session in a client *
1460*************************************************/
1461
1462/* Called from the smtp transport after STARTTLS has been accepted.
1463
1464Arguments:
1465 fd the fd of the connection
1466 host connected host (for messages)
83da1223 1467 addr the first address (not used)
17c76198 1468 dhparam DH parameter file (ignored, we're a client)
059ec3d9
PH
1469 certificate certificate file
1470 privatekey private key file
3f0945ff 1471 sni TLS SNI to send to remote host
059ec3d9
PH
1472 verify_certs file for certificate verify
1473 verify_crl CRL for verify
83da1223 1474 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1475 timeout startup timeout
1476
1477Returns: OK/DEFER/FAIL (because using common functions),
1478 but for a client, DEFER and FAIL have the same meaning
1479*/
1480
1481int
17c76198
PP
1482tls_client_start(int fd, host_item *host,
1483 address_item *addr ARG_UNUSED, uschar *dhparam ARG_UNUSED,
1484 uschar *certificate, uschar *privatekey, uschar *sni,
1485 uschar *verify_certs, uschar *verify_crl,
1486 uschar *require_ciphers, int timeout)
059ec3d9 1487{
059ec3d9 1488int rc;
17c76198
PP
1489const char *error;
1490exim_gnutls_state_st *state = NULL;
059ec3d9 1491
17c76198 1492DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 1493
17c76198
PP
1494rc = tls_init(host, certificate, privatekey,
1495 sni, verify_certs, verify_crl, require_ciphers, &state);
059ec3d9
PH
1496if (rc != OK) return rc;
1497
17c76198 1498gnutls_dh_set_prime_bits(state->session, EXIM_CLIENT_DH_MIN_BITS);
83da1223 1499
17c76198
PP
1500if (verify_certs == NULL)
1501 {
1502 DEBUG(D_tls) debug_printf("TLS: server certificate verification not required\n");
1503 state->verify_requirement = VERIFY_NONE;
1504 /* we still ask for it, to log it, etc */
1505 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1506 }
1507else
1508 {
1509 DEBUG(D_tls) debug_printf("TLS: server certificate verification required\n");
1510 state->verify_requirement = VERIFY_REQUIRED;
1511 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1512 }
059ec3d9 1513
17c76198
PP
1514gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)fd);
1515state->fd_in = fd;
1516state->fd_out = fd;
059ec3d9
PH
1517
1518/* There doesn't seem to be a built-in timeout on connection. */
1519
1520sigalrm_seen = FALSE;
1521alarm(timeout);
17c76198
PP
1522do
1523 {
1524 rc = gnutls_handshake(state->session);
619b2b25
PP
1525 } while ((rc == GNUTLS_E_AGAIN) ||
1526 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1527alarm(0);
1528
4fe99a6c
PP
1529if (rc != GNUTLS_E_SUCCESS)
1530 return tls_error(US"gnutls_handshake",
1531 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1532
17c76198 1533DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 1534
17c76198 1535/* Verify late */
059ec3d9 1536
17c76198
PP
1537if (state->verify_requirement != VERIFY_NONE &&
1538 !verify_certificate(state, &error))
1539 return tls_error(US"certificate verification failed", error, state->host);
059ec3d9 1540
17c76198 1541/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 1542
17c76198
PP
1543rc = peer_status(state);
1544if (rc != OK) return rc;
059ec3d9 1545
4fe99a6c 1546/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 1547
17c76198 1548extract_exim_vars_from_tls_state(state);
059ec3d9 1549
059ec3d9
PH
1550return OK;
1551}
1552
1553
1554
17c76198 1555
059ec3d9 1556/*************************************************
17c76198 1557* Close down a TLS session *
059ec3d9
PH
1558*************************************************/
1559
17c76198
PP
1560/* This is also called from within a delivery subprocess forked from the
1561daemon, to shut down the TLS library, without actually doing a shutdown (which
1562would tamper with the TLS session in the parent process).
059ec3d9 1563
17c76198
PP
1564Arguments: TRUE if gnutls_bye is to be called
1565Returns: nothing
059ec3d9
PH
1566*/
1567
17c76198
PP
1568void
1569tls_close(BOOL shutdown)
059ec3d9 1570{
17c76198 1571exim_gnutls_state_st *state = current_global_tls_state;
059ec3d9 1572
17c76198
PP
1573if (tls_active < 0) return; /* TLS was not active */
1574
1575if (shutdown)
1576 {
1577 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1578 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1579 }
1580
1581gnutls_deinit(state->session);
1582
1583memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1584
1585if ((state_server.session == NULL) && (state_client.session == NULL))
1586 {
1587 gnutls_global_deinit();
1588 exim_gnutls_base_init_done = FALSE;
1589 }
7199e1ee 1590
17c76198 1591tls_active = -1;
059ec3d9
PH
1592}
1593
1594
1595
17c76198 1596
059ec3d9
PH
1597/*************************************************
1598* TLS version of getc *
1599*************************************************/
1600
1601/* This gets the next byte from the TLS input buffer. If the buffer is empty,
1602it refills the buffer via the GnuTLS reading function.
1603
17c76198
PP
1604This feeds DKIM and should be used for all message-body reads.
1605
059ec3d9
PH
1606Arguments: none
1607Returns: the next character or EOF
1608*/
1609
1610int
1611tls_getc(void)
1612{
17c76198
PP
1613exim_gnutls_state_st *state = current_global_tls_state;
1614if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
059ec3d9 1615 {
17c76198 1616 ssize_t inbytes;
059ec3d9 1617
17c76198
PP
1618 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1619 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
1620
1621 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 1622 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
059ec3d9
PH
1623 ssl_xfer_buffer_size);
1624 alarm(0);
1625
1626 /* A zero-byte return appears to mean that the TLS session has been
1627 closed down, not that the socket itself has been closed down. Revert to
1628 non-TLS handling. */
1629
1630 if (inbytes == 0)
1631 {
1632 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1633
1634 receive_getc = smtp_getc;
1635 receive_ungetc = smtp_ungetc;
1636 receive_feof = smtp_feof;
1637 receive_ferror = smtp_ferror;
58eb016e 1638 receive_smtp_buffered = smtp_buffered;
059ec3d9 1639
17c76198
PP
1640 gnutls_deinit(state->session);
1641 state->session = NULL;
059ec3d9 1642 tls_active = -1;
17c76198
PP
1643 tls_bits = 0;
1644 tls_certificate_verified = FALSE;
1645 tls_channelbinding_b64 = NULL;
059ec3d9
PH
1646 tls_cipher = NULL;
1647 tls_peerdn = NULL;
1648
1649 return smtp_getc();
1650 }
1651
1652 /* Handle genuine errors */
1653
1654 else if (inbytes < 0)
1655 {
17c76198
PP
1656 record_io_error(state, (int) inbytes, US"recv", NULL);
1657 state->xfer_error = 1;
059ec3d9
PH
1658 return EOF;
1659 }
80a47a2c 1660#ifndef DISABLE_DKIM
17c76198 1661 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
80a47a2c 1662#endif
17c76198
PP
1663 state->xfer_buffer_hwm = (int) inbytes;
1664 state->xfer_buffer_lwm = 0;
059ec3d9
PH
1665 }
1666
059ec3d9
PH
1667/* Something in the buffer; return next uschar */
1668
17c76198 1669return state->xfer_buffer[state->xfer_buffer_lwm++];
059ec3d9
PH
1670}
1671
1672
1673
17c76198 1674
059ec3d9
PH
1675/*************************************************
1676* Read bytes from TLS channel *
1677*************************************************/
1678
17c76198
PP
1679/* This does not feed DKIM, so if the caller uses this for reading message body,
1680then the caller must feed DKIM.
059ec3d9
PH
1681Arguments:
1682 buff buffer of data
1683 len size of buffer
1684
1685Returns: the number of bytes read
1686 -1 after a failed read
1687*/
1688
1689int
1690tls_read(uschar *buff, size_t len)
1691{
17c76198
PP
1692exim_gnutls_state_st *state = current_global_tls_state;
1693ssize_t inbytes;
059ec3d9 1694
17c76198
PP
1695if (len > INT_MAX)
1696 len = INT_MAX;
059ec3d9 1697
17c76198
PP
1698if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
1699 DEBUG(D_tls)
1700 debug_printf("*** PROBABLY A BUG *** " \
1701 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1702 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
1703
1704DEBUG(D_tls)
1705 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
1706 state->session, buff, len);
1707
1708inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
1709if (inbytes > 0) return inbytes;
1710if (inbytes == 0)
1711 {
1712 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1713 }
17c76198 1714else record_io_error(state, (int)inbytes, US"recv", NULL);
059ec3d9
PH
1715
1716return -1;
1717}
1718
1719
1720
17c76198 1721
059ec3d9
PH
1722/*************************************************
1723* Write bytes down TLS channel *
1724*************************************************/
1725
1726/*
1727Arguments:
1728 buff buffer of data
1729 len number of bytes
1730
1731Returns: the number of bytes after a successful write,
1732 -1 after a failed write
1733*/
1734
1735int
1736tls_write(const uschar *buff, size_t len)
1737{
17c76198
PP
1738ssize_t outbytes;
1739size_t left = len;
1740exim_gnutls_state_st *state = current_global_tls_state;
059ec3d9 1741
17c76198 1742DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
059ec3d9
PH
1743while (left > 0)
1744 {
17c76198
PP
1745 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
1746 buff, left);
1747 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 1748
17c76198 1749 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
1750 if (outbytes < 0)
1751 {
17c76198 1752 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
1753 return -1;
1754 }
1755 if (outbytes == 0)
1756 {
17c76198 1757 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
1758 return -1;
1759 }
1760
1761 left -= outbytes;
1762 buff += outbytes;
1763 }
1764
17c76198
PP
1765if (len > INT_MAX)
1766 {
1767 DEBUG(D_tls)
1768 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
1769 len);
1770 len = INT_MAX;
1771 }
1772
1773return (int) len;
059ec3d9
PH
1774}
1775
1776
1777
17c76198 1778
059ec3d9 1779/*************************************************
17c76198 1780* Random number generation *
059ec3d9
PH
1781*************************************************/
1782
17c76198
PP
1783/* Pseudo-random number generation. The result is not expected to be
1784cryptographically strong but not so weak that someone will shoot themselves
1785in the foot using it as a nonce in input in some email header scheme or
1786whatever weirdness they'll twist this into. The result should handle fork()
1787and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 1788
17c76198
PP
1789Arguments:
1790 max range maximum
1791Returns a random number in range [0, max-1]
059ec3d9
PH
1792*/
1793
af3498d6 1794#ifdef HAVE_GNUTLS_RND
17c76198
PP
1795int
1796vaguely_random_number(int max)
059ec3d9 1797{
17c76198
PP
1798unsigned int r;
1799int i, needed_len;
1800uschar *p;
1801uschar smallbuf[sizeof(r)];
1802
1803if (max <= 1)
1804 return 0;
1805
1806needed_len = sizeof(r);
1807/* Don't take 8 times more entropy than needed if int is 8 octets and we were
1808 * asked for a number less than 10. */
1809for (r = max, i = 0; r; ++i)
1810 r >>= 1;
1811i = (i + 7) / 8;
1812if (i < needed_len)
1813 needed_len = i;
1814
1815i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
1816if (i < 0)
059ec3d9 1817 {
17c76198
PP
1818 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
1819 return vaguely_random_number_fallback(max);
1820 }
1821r = 0;
1822for (p = smallbuf; needed_len; --needed_len, ++p)
1823 {
1824 r *= 256;
1825 r += *p;
059ec3d9
PH
1826 }
1827
17c76198
PP
1828/* We don't particularly care about weighted results; if someone wants
1829 * smooth distribution and cares enough then they should submit a patch then. */
1830return r % max;
059ec3d9 1831}
af3498d6
PP
1832#else /* HAVE_GNUTLS_RND */
1833int
1834vaguely_random_number(int max)
1835{
1836 return vaguely_random_number_fallback(max);
1837}
1838#endif /* HAVE_GNUTLS_RND */
059ec3d9 1839
36f12725
NM
1840
1841
1842
1843/*************************************************
3375e053
PP
1844* Let tls_require_ciphers be checked at startup *
1845*************************************************/
1846
1847/* The tls_require_ciphers option, if set, must be something which the
1848library can parse.
1849
1850Returns: NULL on success, or error message
1851*/
1852
1853uschar *
1854tls_validate_require_cipher(void)
1855{
1856int rc;
1857uschar *expciphers = NULL;
1858gnutls_priority_t priority_cache;
1859const char *errpos;
1860
1861#define validate_check_rc(Label) do { \
1862 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
1863 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
1864#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
1865
1866if (exim_gnutls_base_init_done)
1867 log_write(0, LOG_MAIN|LOG_PANIC,
1868 "already initialised GnuTLS, Exim developer bug");
1869
1870rc = gnutls_global_init();
1871validate_check_rc(US"gnutls_global_init()");
1872exim_gnutls_base_init_done = TRUE;
1873
1874if (!(tls_require_ciphers && *tls_require_ciphers))
1875 return_deinit(NULL);
1876
1877if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
1878 return_deinit(US"failed to expand tls_require_ciphers");
1879
1880if (!(expciphers && *expciphers))
1881 return_deinit(NULL);
1882
1883DEBUG(D_tls)
1884 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
1885
1886rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
1887validate_check_rc(string_sprintf(
1888 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
1889 expciphers, errpos - CS expciphers, errpos));
1890
1891#undef return_deinit
1892#undef validate_check_rc
1893gnutls_global_deinit();
1894
1895return NULL;
1896}
1897
1898
1899
1900
1901/*************************************************
36f12725
NM
1902* Report the library versions. *
1903*************************************************/
1904
1905/* See a description in tls-openssl.c for an explanation of why this exists.
1906
1907Arguments: a FILE* to print the results to
1908Returns: nothing
1909*/
1910
1911void
1912tls_version_report(FILE *f)
1913{
754a0503
PP
1914fprintf(f, "Library version: GnuTLS: Compile: %s\n"
1915 " Runtime: %s\n",
1916 LIBGNUTLS_VERSION,
1917 gnutls_check_version(NULL));
36f12725
NM
1918}
1919
059ec3d9 1920/* End of tls-gnu.c */