TLS: variables $tls_(in,out)_tlsver
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
6aa6fc9c 16Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17c76198 17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
184384c3 42
a5f239e4
PP
43/* needed to disable PKCS11 autoload unless requested */
44#if GNUTLS_VERSION_NUMBER >= 0x020c00
45# include <gnutls/pkcs11.h>
76075bb5 46# define SUPPORT_PARAM_TO_PK_BITS
a5f239e4 47#endif
7e07527a
JH
48#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50# define DISABLE_OCSP
51#endif
0cbf2b82 52#if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
774ef2d7 53# warning "GnuTLS library version too old; tls:cert event unsupported"
0cbf2b82 54# define DISABLE_EVENT
a7538db1 55#endif
a7fec7a7
JH
56#if GNUTLS_VERSION_NUMBER >= 0x030306
57# define SUPPORT_CA_DIR
58#else
59# undef SUPPORT_CA_DIR
60#endif
11a04b5a 61#if GNUTLS_VERSION_NUMBER >= 0x030014
cb1d7830
JH
62# define SUPPORT_SYSDEFAULT_CABUNDLE
63#endif
184384c3
JH
64#if GNUTLS_VERSION_NUMBER >= 0x030104
65# define GNUTLS_CERT_VFY_STATUS_PRINT
66#endif
925ac8e4
JH
67#if GNUTLS_VERSION_NUMBER >= 0x030109
68# define SUPPORT_CORK
69#endif
f20cfa4a
JH
70#if GNUTLS_VERSION_NUMBER >= 0x03010a
71# define SUPPORT_GNUTLS_SESS_DESC
72#endif
4d2a62a3
JH
73#if GNUTLS_VERSION_NUMBER >= 0x030300
74# define GNUTLS_AUTO_GLOBAL_INIT
9f707b89 75# define GNUTLS_AUTO_PKCS11_MANUAL
4d2a62a3 76#endif
f20cfa4a
JH
77#if GNUTLS_VERSION_NUMBER >= 0x030500
78# define SUPPORT_GNUTLS_KEYLOG
79#endif
47195144
JH
80#if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
81# define SUPPORT_SRV_OCSP_STACK
82#endif
49132a3b
JH
83#if GNUTLS_VERSION_NUMBER >= 0x030600
84# define GNUTLS_AUTO_DHPARAMS
85#endif
be427508 86#if GNUTLS_VERSION_NUMBER >= 0x030603
e326959e 87# define EXIM_HAVE_TLS1_3
be427508 88# define SUPPORT_GNUTLS_EXT_RAW_PARSE
e326959e 89# define GNUTLS_OCSP_STATUS_REQUEST_GET2
be427508 90#endif
c0635b6d
JH
91
92#ifdef SUPPORT_DANE
93# if GNUTLS_VERSION_NUMBER >= 0x030000
94# define DANESSL_USAGE_DANE_TA 2
95# define DANESSL_USAGE_DANE_EE 3
96# else
97# error GnuTLS version too early for DANE
98# endif
99# if GNUTLS_VERSION_NUMBER < 0x999999
100# define GNUTLS_BROKEN_DANE_VALIDATION
101# endif
899b8bbc 102#endif
7e07527a 103
43e2db44
JH
104#ifdef EXPERIMENTAL_TLS_RESUME
105# if GNUTLS_VERSION_NUMBER < 0x030603
106# error GNUTLS version too early for session-resumption
107# endif
108#endif
109
f2de3a33 110#ifndef DISABLE_OCSP
2b4a568d
JH
111# include <gnutls/ocsp.h>
112#endif
899b8bbc
JH
113#ifdef SUPPORT_DANE
114# include <gnutls/dane.h>
115#endif
059ec3d9 116
f1be21cf
JH
117#include "tls-cipher-stdname.c"
118
119
b10c87b3
JH
120#ifdef MACRO_PREDEF
121void
122options_tls(void)
123{
124# ifdef EXPERIMENTAL_TLS_RESUME
125builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
126# endif
e326959e
JH
127# ifdef EXIM_HAVE_TLS1_3
128builtin_macro_create(US"_HAVE_TLS1_3");
129# endif
b10c87b3
JH
130}
131#else
132
133
17c76198 134/* GnuTLS 2 vs 3
059ec3d9 135
17c76198
PP
136GnuTLS 3 only:
137 gnutls_global_set_audit_log_function()
059ec3d9 138
17c76198
PP
139Changes:
140 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
141*/
059ec3d9 142
17c76198 143/* Local static variables for GnuTLS */
059ec3d9 144
17c76198 145/* Values for verify_requirement */
059ec3d9 146
e51c7be2 147enum peer_verify_requirement
899b8bbc 148 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
059ec3d9 149
17c76198
PP
150/* This holds most state for server or client; with this, we can set up an
151outbound TLS-enabled connection in an ACL callout, while not stomping all
152over the TLS variables available for expansion.
059ec3d9 153
17c76198
PP
154Some of these correspond to variables in globals.c; those variables will
155be set to point to content in one of these instances, as appropriate for
156the stage of the process lifetime.
059ec3d9 157
389ca47a 158Not handled here: global tls_channelbinding_b64.
17c76198 159*/
059ec3d9 160
17c76198 161typedef struct exim_gnutls_state {
9d1c15ef 162 gnutls_session_t session;
17c76198 163 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 164 gnutls_priority_t priority_cache;
17c76198 165 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
166 int fd_in;
167 int fd_out;
168 BOOL peer_cert_verified;
899b8bbc 169 BOOL peer_dane_verified;
9d1c15ef
JH
170 BOOL trigger_sni_changes;
171 BOOL have_set_peerdn;
5fd28bb8 172 const struct host_item *host; /* NULL if server */
afdb5e9c 173 gnutls_x509_crt_t peercert;
9d1c15ef
JH
174 uschar *peerdn;
175 uschar *ciphersuite;
176 uschar *received_sni;
17c76198
PP
177
178 const uschar *tls_certificate;
179 const uschar *tls_privatekey;
180 const uschar *tls_sni; /* client send only, not received */
181 const uschar *tls_verify_certificates;
182 const uschar *tls_crl;
183 const uschar *tls_require_ciphers;
e51c7be2 184
17c76198
PP
185 uschar *exp_tls_certificate;
186 uschar *exp_tls_privatekey;
17c76198
PP
187 uschar *exp_tls_verify_certificates;
188 uschar *exp_tls_crl;
189 uschar *exp_tls_require_ciphers;
55414b25 190 const uschar *exp_tls_verify_cert_hostnames;
0cbf2b82 191#ifndef DISABLE_EVENT
a7538db1
JH
192 uschar *event_action;
193#endif
899b8bbc
JH
194#ifdef SUPPORT_DANE
195 char * const * dane_data;
196 const int * dane_data_len;
197#endif
17c76198 198
389ca47a 199 tls_support *tlsp; /* set in tls_init() */
817d9f57 200
17c76198
PP
201 uschar *xfer_buffer;
202 int xfer_buffer_lwm;
203 int xfer_buffer_hwm;
8b77d27a
JH
204 BOOL xfer_eof; /*XXX never gets set! */
205 BOOL xfer_error;
17c76198
PP
206} exim_gnutls_state_st;
207
208static const exim_gnutls_state_st exim_gnutls_state_init = {
b10c87b3 209 /* all elements not explicitly intialised here get 0/NULL/FALSE */
f2ed27cf
JH
210 .fd_in = -1,
211 .fd_out = -1,
17c76198 212};
83da1223 213
17c76198
PP
214/* Not only do we have our own APIs which don't pass around state, assuming
215it's held in globals, GnuTLS doesn't appear to let us register callback data
216for callbacks, or as part of the session, so we have to keep a "this is the
217context we're currently dealing with" pointer and rely upon being
218single-threaded to keep from processing data on an inbound TLS connection while
219talking to another TLS connection for an outbound check. This does mean that
220there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
221second connection.
222XXX But see gnutls_session_get_ptr()
223*/
059ec3d9 224
74f1a423 225static exim_gnutls_state_st state_server;
059ec3d9 226
49132a3b 227#ifndef GNUTLS_AUTO_DHPARAMS
17c76198
PP
228/* dh_params are initialised once within the lifetime of a process using TLS;
229if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
230don't want to repeat this. */
83da1223 231
17c76198 232static gnutls_dh_params_t dh_server_params = NULL;
49132a3b 233#endif
059ec3d9 234
dea4b568 235static int ssl_session_timeout = 7200; /* Two hours */
059ec3d9 236
fc243e94 237static const uschar * const exim_default_gnutls_priority = US"NORMAL";
83da1223 238
17c76198 239/* Guard library core initialisation */
83da1223 240
17c76198 241static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 242
4fb7df6d 243#ifndef DISABLE_OCSP
9196d5bf 244static BOOL gnutls_buggy_ocsp = FALSE;
e5489333 245static BOOL exim_testharness_disable_ocsp_validity_check = FALSE;
4fb7df6d 246#endif
9196d5bf 247
b10c87b3
JH
248#ifdef EXPERIMENTAL_TLS_RESUME
249static gnutls_datum_t server_sessticket_key;
250#endif
059ec3d9 251
17c76198 252/* ------------------------------------------------------------------------ */
17c76198 253/* macros */
83da1223 254
17c76198 255#define MAX_HOST_LEN 255
83da1223 256
17c76198
PP
257/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
258the library logging; a value less than 0 disables the calls to set up logging
dc6d1769
JH
259callbacks. GNuTLS also looks for an environment variable - except not for
260setuid binaries, making it useless - "GNUTLS_DEBUG_LEVEL".
261Allegedly the testscript line "GNUTLS_DEBUG_LEVEL=9 sudo exim ..." would work,
262but the env var must be added to /etc/sudoers too. */
2c17bb02 263#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
b1a4f234 264# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 265#endif
83da1223 266
2c17bb02 267#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 268# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 269#endif
83da1223 270
af3498d6
PP
271/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
272can ask for a bit-strength. Without that, we stick to the constant we had
273before, for now. */
2c17bb02 274#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 275# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 276#endif
af3498d6 277
cf0c6164
JH
278#define expand_check_tlsvar(Varname, errstr) \
279 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
83da1223 280
17c76198 281#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
282# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
283# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
284# define HAVE_GNUTLS_RND
2519e60d
TL
285/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
286 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
287 * isn't available sometimes, so this needs to become a conditional
288 * compilation; the sanest way to deal with this being a problem on
289 * older OSes is to block it in the Local/Makefile with this compiler
290 * definition */
e51c7be2
JH
291# ifndef AVOID_GNUTLS_PKCS11
292# define HAVE_GNUTLS_PKCS11
293# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 294#endif
83da1223 295
af3498d6
PP
296
297
298
299/* ------------------------------------------------------------------------ */
300/* Callback declarations */
301
302#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
303static void exim_gnutls_logger_cb(int level, const char *message);
304#endif
305
306static int exim_sni_handling_cb(gnutls_session_t session);
307
e5489333
JH
308#ifdef EXPERIMENTAL_TLS_RESUME
309static int
310tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
311 unsigned incoming, const gnutls_datum_t * msg);
312#endif
af3498d6
PP
313
314
b10c87b3
JH
315/* Daemon one-time initialisation */
316void
317tls_daemon_init(void)
318{
319#ifdef EXPERIMENTAL_TLS_RESUME
320/* We are dependent on the GnuTLS implementation of the Session Ticket
321encryption; both the strength and the key rotation period. We hope that
322the strength at least matches that of the ciphersuite (but GnuTLS does not
323document this). */
324
325static BOOL once = FALSE;
326if (once) return;
327once = TRUE;
328gnutls_session_ticket_key_generate(&server_sessticket_key); /* >= 2.10.0 */
329if (f.running_in_test_harness) ssl_session_timeout = 6;
330#endif
331}
332
17c76198
PP
333/* ------------------------------------------------------------------------ */
334/* Static functions */
059ec3d9
PH
335
336/*************************************************
337* Handle TLS error *
338*************************************************/
339
340/* Called from lots of places when errors occur before actually starting to do
341the TLS handshake, that is, while the session is still in clear. Always returns
342DEFER for a server and FAIL for a client so that most calls can use "return
343tls_error(...)" to do this processing and then give an appropriate return. A
344single function is used for both server and client, because it is called from
345some shared functions.
346
347Argument:
348 prefix text to include in the logged error
7199e1ee
TF
349 msg additional error string (may be NULL)
350 usually obtained from gnutls_strerror()
17c76198
PP
351 host NULL if setting up a server;
352 the connected host if setting up a client
cf0c6164 353 errstr pointer to returned error string
059ec3d9
PH
354
355Returns: OK/DEFER/FAIL
356*/
357
358static int
48224640 359tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
cf0c6164 360 uschar ** errstr)
059ec3d9 361{
cf0c6164 362if (errstr)
48224640 363 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
cf0c6164 364return host ? FAIL : DEFER;
059ec3d9
PH
365}
366
367
452a164f
JH
368static int
369tls_error_gnu(const uschar *prefix, int err, const host_item *host,
370 uschar ** errstr)
371{
372return tls_error(prefix, US gnutls_strerror(err), host, errstr);
373}
374
375static int
376tls_error_sys(const uschar *prefix, int err, const host_item *host,
377 uschar ** errstr)
378{
379return tls_error(prefix, US strerror(err), host, errstr);
380}
059ec3d9 381
17c76198 382
059ec3d9 383/*************************************************
17c76198 384* Deal with logging errors during I/O *
059ec3d9
PH
385*************************************************/
386
17c76198 387/* We have to get the identity of the peer from saved data.
059ec3d9 388
17c76198
PP
389Argument:
390 state the current GnuTLS exim state container
391 rc the GnuTLS error code, or 0 if it's a local error
392 when text identifying read or write
95f52235 393 text local error text when rc is 0
059ec3d9 394
17c76198 395Returns: nothing
059ec3d9
PH
396*/
397
17c76198
PP
398static void
399record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 400{
48224640 401const uschar * msg;
cf0c6164 402uschar * errstr;
059ec3d9 403
17c76198 404if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
95f52235 405 msg = string_sprintf("A TLS fatal alert has been received: %s",
17c76198
PP
406 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
407else
48224640 408 msg = US gnutls_strerror(rc);
059ec3d9 409
cf0c6164
JH
410(void) tls_error(when, msg, state->host, &errstr);
411
412if (state->host)
413 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
414 state->host->name, state->host->address, errstr);
415else
416 {
417 uschar * conn_info = smtp_get_connection_info();
418 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
419 /* I'd like to get separated H= here, but too hard for now */
420 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
421 }
17c76198 422}
059ec3d9 423
059ec3d9 424
059ec3d9 425
059ec3d9 426
17c76198
PP
427/*************************************************
428* Set various Exim expansion vars *
429*************************************************/
059ec3d9 430
e51c7be2
JH
431#define exim_gnutls_cert_err(Label) \
432 do \
433 { \
434 if (rc != GNUTLS_E_SUCCESS) \
435 { \
436 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
437 (Label), gnutls_strerror(rc)); \
438 return rc; \
439 } \
440 } while (0)
9d1c15ef
JH
441
442static int
27f19eb4 443import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
9d1c15ef
JH
444{
445int rc;
446
447rc = gnutls_x509_crt_init(crtp);
448exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
449
450rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
451exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
452
453return rc;
454}
455
456#undef exim_gnutls_cert_err
457
458
17c76198
PP
459/* We set various Exim global variables from the state, once a session has
460been established. With TLS callouts, may need to change this to stack
461variables, or just re-call it with the server state after client callout
462has finished.
059ec3d9 463
9d1c15ef 464Make sure anything set here is unset in tls_getc().
17c76198
PP
465
466Sets:
467 tls_active fd
468 tls_bits strength indicator
469 tls_certificate_verified bool indicator
470 tls_channelbinding_b64 for some SASL mechanisms
5b195d6b 471 tls_ver a string
17c76198 472 tls_cipher a string
9d1c15ef 473 tls_peercert pointer to library internal
17c76198
PP
474 tls_peerdn a string
475 tls_sni a (UTF-8) string
9d1c15ef 476 tls_ourcert pointer to library internal
17c76198
PP
477
478Argument:
479 state the relevant exim_gnutls_state_st *
480*/
481
482static void
9d1c15ef 483extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 484{
17c76198
PP
485#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
486int old_pool;
487int rc;
488gnutls_datum_t channel;
489#endif
9d1c15ef 490tls_support * tlsp = state->tlsp;
17c76198 491
74f1a423
JH
492tlsp->active.sock = state->fd_out;
493tlsp->active.tls_ctx = state;
17c76198 494
817d9f57 495DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 496
9d1c15ef 497tlsp->certificate_verified = state->peer_cert_verified;
899b8bbc
JH
498#ifdef SUPPORT_DANE
499tlsp->dane_verified = state->peer_dane_verified;
500#endif
059ec3d9 501
17c76198
PP
502/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
503only available for use for authenticators while this TLS session is running. */
504
505tls_channelbinding_b64 = NULL;
506#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
507channel.data = NULL;
508channel.size = 0;
1f20760b
JH
509if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
510 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
511else
512 {
17c76198
PP
513 old_pool = store_pool;
514 store_pool = POOL_PERM;
1f20760b 515 tls_channelbinding_b64 = b64encode(CUS channel.data, (int)channel.size);
17c76198
PP
516 store_pool = old_pool;
517 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
1f20760b 518 }
17c76198
PP
519#endif
520
9d1c15ef
JH
521/* peercert is set in peer_status() */
522tlsp->peerdn = state->peerdn;
523tlsp->sni = state->received_sni;
524
525/* record our certificate */
526 {
27f19eb4 527 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
9d1c15ef
JH
528 gnutls_x509_crt_t crt;
529
530 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
531 }
059ec3d9
PH
532}
533
534
535
17c76198 536
49132a3b 537#ifndef GNUTLS_AUTO_DHPARAMS
059ec3d9 538/*************************************************
575643cd 539* Setup up DH parameters *
059ec3d9
PH
540*************************************************/
541
575643cd 542/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
543be re-generated every so often, depending on security policy. What we do is to
544keep these parameters in a file in the spool directory. If the file does not
545exist, we generate them. This means that it is easy to cause a regeneration.
546
547The new file is written as a temporary file and renamed, so that an incomplete
548file is never present. If two processes both compute some new parameters, you
549waste a bit of effort, but it doesn't seem worth messing around with locking to
550prevent this.
551
059ec3d9
PH
552Returns: OK/DEFER/FAIL
553*/
554
555static int
cf0c6164 556init_server_dh(uschar ** errstr)
059ec3d9 557{
17c76198
PP
558int fd, rc;
559unsigned int dh_bits;
49132a3b 560gnutls_datum_t m = {.data = NULL, .size = 0};
a799883d
PP
561uschar filename_buf[PATH_MAX];
562uschar *filename = NULL;
17c76198 563size_t sz;
a799883d
PP
564uschar *exp_tls_dhparam;
565BOOL use_file_in_spool = FALSE;
17c76198 566host_item *host = NULL; /* dummy for macros */
059ec3d9 567
17c76198 568DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 569
452a164f
JH
570if ((rc = gnutls_dh_params_init(&dh_server_params)))
571 return tls_error_gnu(US"gnutls_dh_params_init", rc, host, errstr);
059ec3d9 572
cf0c6164 573if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
a799883d
PP
574 return DEFER;
575
576if (!exp_tls_dhparam)
577 {
578 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
579 m.data = US std_dh_prime_default();
580 m.size = Ustrlen(m.data);
581 }
582else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
583 use_file_in_spool = TRUE;
584else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
585 {
586 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
587 return OK;
588 }
589else if (exp_tls_dhparam[0] != '/')
590 {
f5d25c2b 591 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
48224640 592 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
a799883d
PP
593 m.size = Ustrlen(m.data);
594 }
595else
a799883d 596 filename = exp_tls_dhparam;
a799883d
PP
597
598if (m.data)
599 {
452a164f
JH
600 if ((rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM)))
601 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
a799883d
PP
602 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
603 return OK;
604 }
605
af3498d6
PP
606#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
607/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198 608different filename and ensure we have sufficient bits. */
452a164f
JH
609
610if (!(dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL)))
cf0c6164 611 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
af3498d6 612DEBUG(D_tls)
b34fc30c 613 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
614 dh_bits);
615#else
616dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
617DEBUG(D_tls)
618 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
619 dh_bits);
620#endif
059ec3d9 621
3375e053
PP
622/* Some clients have hard-coded limits. */
623if (dh_bits > tls_dh_max_bits)
624 {
625 DEBUG(D_tls)
626 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
627 tls_dh_max_bits);
628 dh_bits = tls_dh_max_bits;
629 }
630
a799883d
PP
631if (use_file_in_spool)
632 {
633 if (!string_format(filename_buf, sizeof(filename_buf),
634 "%s/gnutls-params-%d", spool_directory, dh_bits))
cf0c6164 635 return tls_error(US"overlong filename", NULL, NULL, errstr);
a799883d
PP
636 filename = filename_buf;
637 }
059ec3d9 638
b5aea5e1 639/* Open the cache file for reading and if successful, read it and set up the
575643cd 640parameters. */
059ec3d9 641
f5d25c2b 642if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
059ec3d9 643 {
b5aea5e1 644 struct stat statbuf;
17c76198
PP
645 FILE *fp;
646 int saved_errno;
647
648 if (fstat(fd, &statbuf) < 0) /* EIO */
649 {
650 saved_errno = errno;
651 (void)close(fd);
452a164f 652 return tls_error_sys(US"TLS cache stat failed", saved_errno, NULL, errstr);
17c76198
PP
653 }
654 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
655 {
656 (void)close(fd);
cf0c6164 657 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
17c76198 658 }
40c90bca 659 if (!(fp = fdopen(fd, "rb")))
17c76198
PP
660 {
661 saved_errno = errno;
662 (void)close(fd);
452a164f
JH
663 return tls_error_sys(US"fdopen(TLS cache stat fd) failed",
664 saved_errno, NULL, errstr);
b5aea5e1 665 }
059ec3d9 666
b5aea5e1 667 m.size = statbuf.st_size;
f3ebb786 668 if (!(m.data = store_malloc(m.size)))
17c76198
PP
669 {
670 fclose(fp);
452a164f 671 return tls_error_sys(US"malloc failed", errno, NULL, errstr);
17c76198 672 }
40c90bca 673 if (!(sz = fread(m.data, m.size, 1, fp)))
17c76198
PP
674 {
675 saved_errno = errno;
676 fclose(fp);
f3ebb786 677 store_free(m.data);
452a164f 678 return tls_error_sys(US"fread failed", saved_errno, NULL, errstr);
17c76198
PP
679 }
680 fclose(fp);
b5aea5e1 681
17c76198 682 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
f3ebb786 683 store_free(m.data);
452a164f
JH
684 if (rc)
685 return tls_error_gnu(US"gnutls_dh_params_import_pkcs3", rc, host, errstr);
17c76198 686 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
687 }
688
689/* If the file does not exist, fall through to compute new data and cache it.
690If there was any other opening error, it is serious. */
691
182ad5cf
PH
692else if (errno == ENOENT)
693 {
17c76198 694 rc = -1;
182ad5cf 695 DEBUG(D_tls)
17c76198 696 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
697 }
698else
17c76198 699 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
cf0c6164 700 NULL, NULL, errstr);
b5aea5e1
PH
701
702/* If ret < 0, either the cache file does not exist, or the data it contains
703is not useful. One particular case of this is when upgrading from an older
704release of Exim in which the data was stored in a different format. We don't
705try to be clever and support both formats; we just regenerate new data in this
706case. */
707
17c76198 708if (rc < 0)
b5aea5e1 709 {
17c76198 710 uschar *temp_fn;
201f5254 711 unsigned int dh_bits_gen = dh_bits;
059ec3d9 712
17c76198
PP
713 if ((PATH_MAX - Ustrlen(filename)) < 10)
714 return tls_error(US"Filename too long to generate replacement",
48224640 715 filename, NULL, errstr);
059ec3d9 716
48224640 717 temp_fn = string_copy(US"%s.XXXXXXX");
f5d25c2b 718 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
452a164f 719 return tls_error_sys(US"Unable to open temp file", errno, NULL, errstr);
b66fecb4 720 (void)exim_chown(temp_fn, exim_uid, exim_gid); /* Probably not necessary */
059ec3d9 721
49132a3b
JH
722 /* GnuTLS overshoots! If we ask for 2236, we might get 2237 or more. But
723 there's no way to ask GnuTLS how many bits there really are. We can ask
724 how many bits were used in a TLS session, but that's it! The prime itself
725 is hidden behind too much abstraction. So we ask for less, and proceed on
726 a wing and a prayer. First attempt, subtracted 3 for 2233 and got 2240. */
727
cae6e576 728 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
729 {
730 dh_bits_gen = dh_bits - 10;
731 DEBUG(D_tls)
732 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
733 dh_bits_gen);
734 }
735
736 DEBUG(D_tls)
737 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
738 dh_bits_gen);
452a164f
JH
739 if ((rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen)))
740 return tls_error_gnu(US"gnutls_dh_params_generate2", rc, host, errstr);
17c76198
PP
741
742 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
743 and I confirmed that a NULL call to get the size first is how the GnuTLS
744 sample apps handle this. */
745
746 sz = 0;
747 m.data = NULL;
452a164f
JH
748 if ( (rc = gnutls_dh_params_export_pkcs3(dh_server_params,
749 GNUTLS_X509_FMT_PEM, m.data, &sz))
750 && rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
751 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3(NULL) sizing",
752 rc, host, errstr);
17c76198 753 m.size = sz;
f3ebb786 754 if (!(m.data = store_malloc(m.size)))
452a164f 755 return tls_error_sys(US"memory allocation failed", errno, NULL, errstr);
40c90bca 756
1f00591e 757 /* this will return a size 1 less than the allocation size above */
452a164f
JH
758 if ((rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
759 m.data, &sz)))
17c76198 760 {
f3ebb786 761 store_free(m.data);
452a164f 762 return tls_error_gnu(US"gnutls_dh_params_export_pkcs3() real", rc, host, errstr);
17c76198 763 }
1f00591e 764 m.size = sz; /* shrink by 1, probably */
059ec3d9 765
f5d25c2b 766 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
17c76198 767 {
f3ebb786 768 store_free(m.data);
452a164f
JH
769 return tls_error_sys(US"TLS cache write D-H params failed",
770 errno, NULL, errstr);
17c76198 771 }
f3ebb786 772 store_free(m.data);
f5d25c2b 773 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
452a164f
JH
774 return tls_error_sys(US"TLS cache write D-H params final newline failed",
775 errno, NULL, errstr);
17c76198 776
f5d25c2b 777 if ((rc = close(fd)))
452a164f 778 return tls_error_sys(US"TLS cache write close() failed", errno, NULL, errstr);
059ec3d9 779
17c76198 780 if (Urename(temp_fn, filename) < 0)
452a164f
JH
781 return tls_error_sys(string_sprintf("failed to rename \"%s\" as \"%s\"",
782 temp_fn, filename), errno, NULL, errstr);
059ec3d9 783
17c76198 784 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
785 }
786
17c76198 787DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
788return OK;
789}
49132a3b 790#endif
059ec3d9
PH
791
792
793
794
23bb6982
JH
795/* Create and install a selfsigned certificate, for use in server mode */
796
797static int
cf0c6164 798tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
23bb6982
JH
799{
800gnutls_x509_crt_t cert = NULL;
801time_t now;
802gnutls_x509_privkey_t pkey = NULL;
803const uschar * where;
804int rc;
805
806where = US"initialising pkey";
807if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
808
809where = US"initialising cert";
810if ((rc = gnutls_x509_crt_init(&cert))) goto err;
811
812where = US"generating pkey";
813if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
76075bb5 814#ifdef SUPPORT_PARAM_TO_PK_BITS
4312da48
JH
815# ifndef GNUTLS_SEC_PARAM_MEDIUM
816# define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
817# endif
6aac3239 818 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
76075bb5 819#else
6aac3239 820 2048,
76075bb5
JH
821#endif
822 0)))
23bb6982
JH
823 goto err;
824
825where = US"configuring cert";
1613fd68 826now = 1;
23bb6982
JH
827if ( (rc = gnutls_x509_crt_set_version(cert, 3))
828 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
829 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
830 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
831 || (rc = gnutls_x509_crt_set_key(cert, pkey))
832
833 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
834 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
835 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
836 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
837 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
838 GNUTLS_OID_X520_COMMON_NAME, 0,
839 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
840 )
841 goto err;
842
843where = US"signing cert";
844if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
845
846where = US"installing selfsign cert";
847 /* Since: 2.4.0 */
848if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
849 goto err;
850
851rc = OK;
852
853out:
854 if (cert) gnutls_x509_crt_deinit(cert);
855 if (pkey) gnutls_x509_privkey_deinit(pkey);
856 return rc;
857
858err:
452a164f 859 rc = tls_error_gnu(where, rc, NULL, errstr);
23bb6982
JH
860 goto out;
861}
862
863
864
865
47195144
JH
866/* Add certificate and key, from files.
867
868Return:
869 Zero or negative: good. Negate value for certificate index if < 0.
870 Greater than zero: FAIL or DEFER code.
871*/
872
ba86e143
JH
873static int
874tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
875 uschar * certfile, uschar * keyfile, uschar ** errstr)
876{
877int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
878 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
47195144 879if (rc < 0)
452a164f 880 return tls_error_gnu(
47195144 881 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
452a164f 882 rc, host, errstr);
47195144 883return -rc;
ba86e143
JH
884}
885
886
d896cef5
JH
887#if !defined(DISABLE_OCSP) && !defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
888/* Load an OCSP proof from file for sending by the server. Called
889on getting a status-request handshake message, for earlier versions
890of GnuTLS. */
891
892static int
893server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
894 gnutls_datum_t * ocsp_response)
895{
896int ret;
897DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
898
899if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
900 {
901 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
902 CS ptr);
903 tls_in.ocsp = OCSP_NOT_RESP;
904 return GNUTLS_E_NO_CERTIFICATE_STATUS;
905 }
906
907tls_in.ocsp = OCSP_VFY_NOT_TRIED;
908return 0;
909}
910#endif
911
912
be427508 913#ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
e5489333
JH
914/* Make a note that we saw a status-request */
915static int
916tls_server_clienthello_ext(void * ctx, unsigned tls_id,
917 const unsigned char *data, unsigned size)
918{
919/* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
920if (tls_id == 5) /* status_request */
921 {
e326959e 922 DEBUG(D_tls) debug_printf("Seen status_request extension from client\n");
e5489333
JH
923 tls_in.ocsp = OCSP_NOT_RESP;
924 }
925return 0;
926}
927
928/* Callback for client-hello, on server, if we think we might serve stapled-OCSP */
929static int
930tls_server_clienthello_cb(gnutls_session_t session, unsigned int htype,
931 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
932{
933/* Call fn for each extension seen. 3.6.3 onwards */
934return gnutls_ext_raw_parse(NULL, tls_server_clienthello_ext, msg,
935 GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
936}
e326959e
JH
937
938
939/* Make a note that we saw a status-response */
940static int
941tls_server_servercerts_ext(void * ctx, unsigned tls_id,
942 const unsigned char *data, unsigned size)
943{
944/* debug_printf("%s %u\n", __FUNCTION__, tls_id); */
945/* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
946if (FALSE && tls_id == 5) /* status_request */
947 {
948 DEBUG(D_tls) debug_printf("Seen status_request extension\n");
949 tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
950 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
951 }
952return 0;
953}
954
955/* Callback for certificates packet, on server, if we think we might serve stapled-OCSP */
956static int
957tls_server_servercerts_cb(gnutls_session_t session, unsigned int htype,
958 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
959{
960/* Call fn for each extension seen. 3.6.3 onwards */
961#ifdef notdef
962/*XXX crashes */
963return gnutls_ext_raw_parse(NULL, tls_server_servercerts_ext, msg, 0);
964#endif
965}
be427508 966#endif
e5489333 967
e326959e
JH
968/*XXX in tls1.3 the cert-status travel as an extension next to the cert, in the
969 "Handshake Protocol: Certificate" record.
970So we need to spot the Certificate handshake message, parse it and spot any status_request extension(s)
971
972This is different to tls1.2 - where it is a separate record (wireshake term) / handshake message (gnutls term).
973*/
974
727a5d25 975#if defined(EXPERIMENTAL_TLS_RESUME) || defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
e5489333
JH
976/* Callback for certificate-status, on server. We sent stapled OCSP. */
977static int
978tls_server_certstatus_cb(gnutls_session_t session, unsigned int htype,
979 unsigned when, unsigned int incoming, const gnutls_datum_t * msg)
980{
e326959e 981DEBUG(D_tls) debug_printf("Sending certificate-status\n"); /*XXX we get this for tls1.2 but not for 1.3 */
e5489333
JH
982#ifdef SUPPORT_SRV_OCSP_STACK
983tls_in.ocsp = exim_testharness_disable_ocsp_validity_check
984 ? OCSP_VFY_NOT_TRIED : OCSP_VFIED; /* We know that GnuTLS verifies responses */
985#else
986tls_in.ocsp = OCSP_VFY_NOT_TRIED;
987#endif
988return 0;
989}
990
991/* Callback for handshake messages, on server */
992static int
993tls_server_hook_cb(gnutls_session_t sess, u_int htype, unsigned when,
994 unsigned incoming, const gnutls_datum_t * msg)
995{
e326959e 996/* debug_printf("%s: htype %u\n", __FUNCTION__, htype); */
e5489333
JH
997switch (htype)
998 {
727a5d25 999# ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
e5489333
JH
1000 case GNUTLS_HANDSHAKE_CLIENT_HELLO:
1001 return tls_server_clienthello_cb(sess, htype, when, incoming, msg);
e326959e
JH
1002 case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
1003 return tls_server_servercerts_cb(sess, htype, when, incoming, msg);
727a5d25 1004# endif
e5489333
JH
1005 case GNUTLS_HANDSHAKE_CERTIFICATE_STATUS:
1006 return tls_server_certstatus_cb(sess, htype, when, incoming, msg);
727a5d25 1007# ifdef EXPERIMENTAL_TLS_RESUME
e5489333
JH
1008 case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET:
1009 return tls_server_ticket_cb(sess, htype, when, incoming, msg);
727a5d25 1010# endif
e5489333
JH
1011 default:
1012 return 0;
1013 }
1014}
727a5d25 1015#endif
e5489333
JH
1016
1017
727a5d25 1018#if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
e5489333
JH
1019static void
1020tls_server_testharness_ocsp_fiddle(void)
1021{
1022extern char ** environ;
1023if (environ) for (uschar ** p = USS environ; *p; p++)
1024 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1025 {
1026 DEBUG(D_tls) debug_printf("Permitting known bad OCSP response\n");
1027 exim_testharness_disable_ocsp_validity_check = TRUE;
1028 }
1029}
727a5d25 1030#endif
e5489333 1031
059ec3d9 1032/*************************************************
17c76198 1033* Variables re-expanded post-SNI *
059ec3d9
PH
1034*************************************************/
1035
17c76198
PP
1036/* Called from both server and client code, via tls_init(), and also from
1037the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
1038
1039We can tell the two apart by state->received_sni being non-NULL in callback.
1040
1041The callback should not call us unless state->trigger_sni_changes is true,
1042which we are responsible for setting on the first pass through.
059ec3d9
PH
1043
1044Arguments:
17c76198 1045 state exim_gnutls_state_st *
cf0c6164 1046 errstr error string pointer
059ec3d9
PH
1047
1048Returns: OK/DEFER/FAIL
1049*/
1050
1051static int
ba86e143 1052tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
059ec3d9 1053{
1365611d 1054struct stat statbuf;
059ec3d9 1055int rc;
17c76198
PP
1056const host_item *host = state->host; /* macro should be reconsidered? */
1057uschar *saved_tls_certificate = NULL;
1058uschar *saved_tls_privatekey = NULL;
1059uschar *saved_tls_verify_certificates = NULL;
1060uschar *saved_tls_crl = NULL;
1061int cert_count;
1062
1063/* We check for tls_sni *before* expansion. */
2b4a568d 1064if (!host) /* server */
17c76198
PP
1065 if (!state->received_sni)
1066 {
ba86e143
JH
1067 if ( state->tls_certificate
1068 && ( Ustrstr(state->tls_certificate, US"tls_sni")
1069 || Ustrstr(state->tls_certificate, US"tls_in_sni")
1070 || Ustrstr(state->tls_certificate, US"tls_out_sni")
1071 ) )
17c76198
PP
1072 {
1073 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
1074 state->trigger_sni_changes = TRUE;
1075 }
1076 }
1077 else
1078 {
1365611d 1079 /* useful for debugging */
17c76198
PP
1080 saved_tls_certificate = state->exp_tls_certificate;
1081 saved_tls_privatekey = state->exp_tls_privatekey;
1082 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
1083 saved_tls_crl = state->exp_tls_crl;
1084 }
059ec3d9 1085
452a164f
JH
1086if ((rc = gnutls_certificate_allocate_credentials(&state->x509_cred)))
1087 return tls_error_gnu(US"gnutls_certificate_allocate_credentials",
1088 rc, host, errstr);
47195144
JH
1089
1090#ifdef SUPPORT_SRV_OCSP_STACK
1091gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
e326959e
JH
1092
1093# if !defined(DISABLE_OCSP) && defined(SUPPORT_GNUTLS_EXT_RAW_PARSE)
1094if (!host && tls_ocsp_file)
1095 {
1096 if (f.running_in_test_harness)
1097 tls_server_testharness_ocsp_fiddle();
1098
1099 if (exim_testharness_disable_ocsp_validity_check)
1100 gnutls_certificate_set_flags(state->x509_cred,
1101 GNUTLS_CERTIFICATE_API_V2 | GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
1102 }
1103# endif
47195144 1104#endif
1365611d 1105
17c76198
PP
1106/* remember: expand_check_tlsvar() is expand_check() but fiddling with
1107state members, assuming consistent naming; and expand_check() returns
1108false if expansion failed, unless expansion was forced to fail. */
059ec3d9 1109
17c76198
PP
1110/* check if we at least have a certificate, before doing expensive
1111D-H generation. */
059ec3d9 1112
cf0c6164 1113if (!expand_check_tlsvar(tls_certificate, errstr))
17c76198 1114 return DEFER;
059ec3d9 1115
17c76198 1116/* certificate is mandatory in server, optional in client */
059ec3d9 1117
23bb6982
JH
1118if ( !state->exp_tls_certificate
1119 || !*state->exp_tls_certificate
1120 )
2b4a568d 1121 if (!host)
cf0c6164 1122 return tls_install_selfsign(state, errstr);
17c76198
PP
1123 else
1124 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
059ec3d9 1125
cf0c6164 1126if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
059ec3d9
PH
1127 return DEFER;
1128
17c76198
PP
1129/* tls_privatekey is optional, defaulting to same file as certificate */
1130
e326959e 1131if (!state->tls_privatekey || !*state->tls_privatekey)
059ec3d9 1132 {
17c76198
PP
1133 state->tls_privatekey = state->tls_certificate;
1134 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 1135 }
c91535f3 1136
059ec3d9 1137
17c76198 1138if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
1139 {
1140 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
1141 state->exp_tls_certificate, state->exp_tls_privatekey);
1142
1143 if (state->received_sni)
23bb6982
JH
1144 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
1145 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
1146 )
17c76198 1147 {
b34fc30c 1148 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
1149 }
1150 else
1151 {
b34fc30c 1152 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 1153 }
059ec3d9 1154
ba86e143
JH
1155 if (!host) /* server */
1156 {
1157 const uschar * clist = state->exp_tls_certificate;
1158 const uschar * klist = state->exp_tls_privatekey;
47195144
JH
1159 const uschar * olist;
1160 int csep = 0, ksep = 0, osep = 0, cnt = 0;
1161 uschar * cfile, * kfile, * ofile;
47195144 1162#ifndef DISABLE_OCSP
e326959e
JH
1163# ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
1164 gnutls_x509_crt_fmt_t ocsp_fmt = GNUTLS_X509_FMT_DER;
1165# endif
1166
47195144
JH
1167 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
1168 return DEFER;
1169 olist = ofile;
1170#endif
ba86e143
JH
1171
1172 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
47195144 1173
ba86e143
JH
1174 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
1175 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
47195144 1176 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
ba86e143
JH
1177 return rc;
1178 else
47195144
JH
1179 {
1180 int gnutls_cert_index = -rc;
e326959e
JH
1181 DEBUG(D_tls) debug_printf("TLS: cert/key %d %s registered\n",
1182 gnutls_cert_index, cfile);
47195144
JH
1183
1184#ifndef DISABLE_OCSP
1185 if (tls_ocsp_file)
e5489333 1186 {
e326959e 1187 /* Set the OCSP stapling server info */
47195144
JH
1188 if (gnutls_buggy_ocsp)
1189 {
1190 DEBUG(D_tls)
1191 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1192 }
1193 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1194 {
e326959e
JH
1195 DEBUG(D_tls) debug_printf("OCSP response file %d = %s\n",
1196 gnutls_cert_index, ofile);
be427508 1197# ifdef SUPPORT_GNUTLS_EXT_RAW_PARSE
e326959e 1198 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
47195144 1199 {
e326959e
JH
1200 ocsp_fmt = GNUTLS_X509_FMT_PEM;
1201 ofile += 4;
1202 }
1203 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1204 {
1205 ocsp_fmt = GNUTLS_X509_FMT_DER;
1206 ofile += 4;
1207 }
e5489333 1208
e326959e
JH
1209 if ((rc = gnutls_certificate_set_ocsp_status_request_file2(
1210 state->x509_cred, CCS ofile, gnutls_cert_index,
1211 ocsp_fmt)) < 0)
1212 return tls_error_gnu(
1213 US"gnutls_certificate_set_ocsp_status_request_file2",
1214 rc, host, errstr);
1215 DEBUG(D_tls)
1216 debug_printf(" %d response%s loaded\n", rc, rc>1 ? "s":"");
e5489333 1217
e326959e
JH
1218 /* Arrange callbacks for OCSP request observability */
1219
1220 gnutls_handshake_set_hook_function(state->session,
1221 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
1222
1223# else
1224# if defined(SUPPORT_SRV_OCSP_STACK)
be427508
JH
1225 if ((rc = gnutls_certificate_set_ocsp_status_request_function2(
1226 state->x509_cred, gnutls_cert_index,
1227 server_ocsp_stapling_cb, ofile)))
1228 return tls_error_gnu(
1229 US"gnutls_certificate_set_ocsp_status_request_function2",
1230 rc, host, errstr);
1231 else
e326959e 1232# endif
e5489333
JH
1233 {
1234 if (cnt++ > 0)
1235 {
1236 DEBUG(D_tls)
1237 debug_printf("oops; multiple OCSP files not supported\n");
1238 break;
1239 }
d896cef5
JH
1240 gnutls_certificate_set_ocsp_status_request_function(
1241 state->x509_cred, server_ocsp_stapling_cb, ofile);
e5489333 1242 }
e326959e 1243# endif /* SUPPORT_GNUTLS_EXT_RAW_PARSE */
47195144
JH
1244 }
1245 else
1246 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
e5489333 1247 }
fd71e7b8 1248#endif /* DISABLE_OCSP */
47195144 1249 }
ba86e143 1250 }
e5489333 1251 else /* client */
ba86e143 1252 {
47195144 1253 if (0 < (rc = tls_add_certfile(state, host,
ba86e143
JH
1254 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1255 return rc;
1256 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1257 }
1258
b34fc30c 1259 } /* tls_certificate */
059ec3d9 1260
2b4a568d 1261
059ec3d9
PH
1262/* Set the trusted CAs file if one is provided, and then add the CRL if one is
1263provided. Experiment shows that, if the certificate file is empty, an unhelpful
1264error message is provided. However, if we just refrain from setting anything up
1265in that case, certificate verification fails, which seems to be the correct
1266behaviour. */
1267
610ff438 1268if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 1269 {
cf0c6164 1270 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
059ec3d9 1271 return DEFER;
610ff438
JH
1272#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1273 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1274 state->exp_tls_verify_certificates = NULL;
1275#endif
17c76198 1276 if (state->tls_crl && *state->tls_crl)
cf0c6164 1277 if (!expand_check_tlsvar(tls_crl, errstr))
17c76198 1278 return DEFER;
059ec3d9 1279
1365611d
PP
1280 if (!(state->exp_tls_verify_certificates &&
1281 *state->exp_tls_verify_certificates))
b34fc30c
PP
1282 {
1283 DEBUG(D_tls)
1365611d
PP
1284 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1285 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 1286 return OK;
b34fc30c 1287 }
1365611d 1288 }
83e2f8a2
PP
1289else
1290 {
1291 DEBUG(D_tls)
1292 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1293 return OK;
1294 }
17c76198 1295
cb1d7830
JH
1296#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1297if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1298 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1299else
1300#endif
1365611d 1301 {
cb1d7830
JH
1302 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1303 {
d896cef5 1304 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat '%s' "
cb1d7830
JH
1305 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1306 strerror(errno));
1307 return DEFER;
1308 }
17c76198 1309
a7fec7a7 1310#ifndef SUPPORT_CA_DIR
cb1d7830
JH
1311 /* The test suite passes in /dev/null; we could check for that path explicitly,
1312 but who knows if someone has some weird FIFO which always dumps some certs, or
1313 other weirdness. The thing we really want to check is that it's not a
1314 directory, since while OpenSSL supports that, GnuTLS does not.
60f914bc 1315 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
cb1d7830
JH
1316 if (S_ISDIR(statbuf.st_mode))
1317 {
1318 DEBUG(D_tls)
1319 debug_printf("verify certificates path is a dir: \"%s\"\n",
1320 state->exp_tls_verify_certificates);
1321 log_write(0, LOG_MAIN|LOG_PANIC,
1322 "tls_verify_certificates \"%s\" is a directory",
1323 state->exp_tls_verify_certificates);
1324 return DEFER;
1325 }
a7fec7a7 1326#endif
059ec3d9 1327
cb1d7830
JH
1328 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1329 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 1330
cb1d7830
JH
1331 if (statbuf.st_size == 0)
1332 {
1333 DEBUG(D_tls)
1334 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1335 return OK;
1336 }
059ec3d9 1337
cb1d7830 1338 cert_count =
a7fec7a7
JH
1339
1340#ifdef SUPPORT_CA_DIR
cb1d7830
JH
1341 (statbuf.st_mode & S_IFMT) == S_IFDIR
1342 ?
1343 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1344 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1345 :
a7fec7a7 1346#endif
cb1d7830
JH
1347 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1348 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
12d95aa6
JH
1349
1350#ifdef SUPPORT_CA_DIR
1351 /* Mimic the behaviour with OpenSSL of not advertising a usable-cert list
1352 when using the directory-of-certs config model. */
1353
1354 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1355 gnutls_certificate_send_x509_rdn_sequence(state->session, 1);
1356#endif
cb1d7830 1357 }
a7fec7a7 1358
1365611d 1359if (cert_count < 0)
452a164f
JH
1360 return tls_error_gnu(US"setting certificate trust", cert_count, host, errstr);
1361DEBUG(D_tls)
1362 debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 1363
5c8cda3a
PP
1364if (state->tls_crl && *state->tls_crl &&
1365 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 1366 {
5c8cda3a 1367 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
452a164f
JH
1368 if ((cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1369 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM)) < 0)
1370 return tls_error_gnu(US"gnutls_certificate_set_x509_crl_file",
1371 cert_count, host, errstr);
1372
5c8cda3a 1373 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 1374 }
059ec3d9 1375
059ec3d9
PH
1376return OK;
1377}
1378
1379
1380
1381
1382/*************************************************
1365611d
PP
1383* Set X.509 state variables *
1384*************************************************/
1385
1386/* In GnuTLS, the registered cert/key are not replaced by a later
1387set of a cert/key, so for SNI support we need a whole new x509_cred
1388structure. Which means various other non-re-expanded pieces of state
1389need to be re-set in the new struct, so the setting logic is pulled
1390out to this.
1391
1392Arguments:
1393 state exim_gnutls_state_st *
cf0c6164 1394 errstr error string pointer
1365611d
PP
1395
1396Returns: OK/DEFER/FAIL
1397*/
1398
1399static int
cf0c6164 1400tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1365611d
PP
1401{
1402int rc;
1403const host_item *host = state->host; /* macro should be reconsidered? */
1404
49132a3b 1405#ifndef GNUTLS_AUTO_DHPARAMS
1365611d
PP
1406/* Create D-H parameters, or read them from the cache file. This function does
1407its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1408client-side params. */
1409
1410if (!state->host)
1411 {
1412 if (!dh_server_params)
452a164f 1413 if ((rc = init_server_dh(errstr)) != OK) return rc;
49132a3b
JH
1414
1415 /* Unnecessary & discouraged with 3.6.0 or later */
1365611d
PP
1416 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1417 }
49132a3b 1418#endif
1365611d
PP
1419
1420/* Link the credentials to the session. */
1421
452a164f
JH
1422if ((rc = gnutls_credentials_set(state->session,
1423 GNUTLS_CRD_CERTIFICATE, state->x509_cred)))
1424 return tls_error_gnu(US"gnutls_credentials_set", rc, host, errstr);
1365611d
PP
1425
1426return OK;
1427}
1428
1429/*************************************************
17c76198 1430* Initialize for GnuTLS *
059ec3d9
PH
1431*************************************************/
1432
9196d5bf 1433
4fb7df6d
JH
1434#ifndef DISABLE_OCSP
1435
9196d5bf
JH
1436static BOOL
1437tls_is_buggy_ocsp(void)
1438{
1439const uschar * s;
1440uschar maj, mid, mic;
1441
1442s = CUS gnutls_check_version(NULL);
1443maj = atoi(CCS s);
1444if (maj == 3)
1445 {
1446 while (*s && *s != '.') s++;
1447 mid = atoi(CCS ++s);
1448 if (mid <= 2)
1449 return TRUE;
1450 else if (mid >= 5)
1451 return FALSE;
1452 else
1453 {
1454 while (*s && *s != '.') s++;
1455 mic = atoi(CCS ++s);
1456 return mic <= (mid == 3 ? 16 : 3);
1457 }
1458 }
1459return FALSE;
1460}
1461
4fb7df6d 1462#endif
9196d5bf
JH
1463
1464
17c76198
PP
1465/* Called from both server and client code. In the case of a server, errors
1466before actual TLS negotiation return DEFER.
059ec3d9
PH
1467
1468Arguments:
17c76198
PP
1469 host connected host, if client; NULL if server
1470 certificate certificate file
1471 privatekey private key file
1472 sni TLS SNI to send, sometimes when client; else NULL
1473 cas CA certs file
1474 crl CRL file
1475 require_ciphers tls_require_ciphers setting
817d9f57 1476 caller_state returned state-info structure
cf0c6164 1477 errstr error string pointer
059ec3d9 1478
17c76198 1479Returns: OK/DEFER/FAIL
059ec3d9
PH
1480*/
1481
17c76198
PP
1482static int
1483tls_init(
1484 const host_item *host,
1485 const uschar *certificate,
1486 const uschar *privatekey,
1487 const uschar *sni,
1488 const uschar *cas,
1489 const uschar *crl,
1490 const uschar *require_ciphers,
cf0c6164 1491 exim_gnutls_state_st **caller_state,
74f1a423 1492 tls_support * tlsp,
cf0c6164 1493 uschar ** errstr)
059ec3d9 1494{
00c0dd4e 1495exim_gnutls_state_st * state;
17c76198
PP
1496int rc;
1497size_t sz;
00c0dd4e
JH
1498const char * errpos;
1499const uschar * p;
17c76198
PP
1500
1501if (!exim_gnutls_base_init_done)
059ec3d9 1502 {
17c76198
PP
1503 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1504
9f707b89 1505#if defined(HAVE_GNUTLS_PKCS11) && !defined(GNUTLS_AUTO_PKCS11_MANUAL)
a5f239e4
PP
1506 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1507 which loads modules from a config file, which sounds good and may be wanted
1508 by some sysadmin, but also means in common configurations that GNOME keyring
1509 environment variables are used and so breaks for users calling mailq.
1510 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1511 if (!gnutls_allow_auto_pkcs11)
452a164f
JH
1512 if ((rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL)))
1513 return tls_error_gnu(US"gnutls_pkcs11_init", rc, host, errstr);
a5f239e4
PP
1514#endif
1515
4d2a62a3 1516#ifndef GNUTLS_AUTO_GLOBAL_INIT
452a164f
JH
1517 if ((rc = gnutls_global_init()))
1518 return tls_error_gnu(US"gnutls_global_init", rc, host, errstr);
4d2a62a3 1519#endif
17c76198
PP
1520
1521#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1522 DEBUG(D_tls)
059ec3d9 1523 {
17c76198 1524 gnutls_global_set_log_function(exim_gnutls_logger_cb);
aded2255 1525 /* arbitrarily chosen level; bump up to 9 for more */
17c76198 1526 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1527 }
17c76198
PP
1528#endif
1529
4fb7df6d
JH
1530#ifndef DISABLE_OCSP
1531 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
9196d5bf 1532 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
4fb7df6d 1533#endif
9196d5bf 1534
17c76198 1535 exim_gnutls_base_init_done = TRUE;
059ec3d9 1536 }
059ec3d9 1537
17c76198
PP
1538if (host)
1539 {
74f1a423
JH
1540 /* For client-side sessions we allocate a context. This lets us run
1541 several in parallel. */
1542 int old_pool = store_pool;
1543 store_pool = POOL_PERM;
f3ebb786 1544 state = store_get(sizeof(exim_gnutls_state_st), FALSE);
74f1a423
JH
1545 store_pool = old_pool;
1546
17c76198 1547 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1548 state->tlsp = tlsp;
17c76198
PP
1549 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1550 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1551 }
1552else
1553 {
1554 state = &state_server;
1555 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1556 state->tlsp = tlsp;
17c76198
PP
1557 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1558 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1559 }
452a164f
JH
1560if (rc)
1561 return tls_error_gnu(US"gnutls_init", rc, host, errstr);
059ec3d9 1562
17c76198 1563state->host = host;
059ec3d9 1564
17c76198
PP
1565state->tls_certificate = certificate;
1566state->tls_privatekey = privatekey;
5779e6aa 1567state->tls_require_ciphers = require_ciphers;
17c76198
PP
1568state->tls_sni = sni;
1569state->tls_verify_certificates = cas;
1570state->tls_crl = crl;
059ec3d9 1571
17c76198
PP
1572/* This handles the variables that might get re-expanded after TLS SNI;
1573that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1574
17c76198
PP
1575DEBUG(D_tls)
1576 debug_printf("Expanding various TLS configuration options for session credentials.\n");
cf0c6164 1577if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
059ec3d9 1578
1365611d
PP
1579/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1580requires a new structure afterwards. */
83da1223 1581
cf0c6164 1582if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
83da1223 1583
17c76198
PP
1584/* set SNI in client, only */
1585if (host)
1586 {
cf0c6164 1587 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
17c76198 1588 return DEFER;
0df4ab80 1589 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1590 {
1591 DEBUG(D_tls)
0df4ab80
JH
1592 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1593 sz = Ustrlen(state->tlsp->sni);
452a164f
JH
1594 if ((rc = gnutls_server_name_set(state->session,
1595 GNUTLS_NAME_DNS, state->tlsp->sni, sz)))
1596 return tls_error_gnu(US"gnutls_server_name_set", rc, host, errstr);
17c76198
PP
1597 }
1598 }
1599else if (state->tls_sni)
1600 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
ba86e143 1601 "have an SNI set for a server [%s]\n", state->tls_sni);
83da1223 1602
17c76198 1603/* This is the priority string support,
42bfef1e 1604http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1605and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1606This was backwards incompatible, but means Exim no longer needs to track
1607all algorithms and provide string forms for them. */
83da1223 1608
fc243e94 1609p = NULL;
17c76198 1610if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1611 {
cf0c6164 1612 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
17c76198
PP
1613 return DEFER;
1614 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1615 {
17c76198 1616 p = state->exp_tls_require_ciphers;
fc243e94 1617 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
83da1223
PH
1618 }
1619 }
fc243e94 1620if (!p)
17c76198 1621 {
fc243e94 1622 p = exim_default_gnutls_priority;
83e2f8a2 1623 DEBUG(D_tls)
fc243e94 1624 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
17c76198 1625 }
83da1223 1626
452a164f
JH
1627if ((rc = gnutls_priority_init(&state->priority_cache, CCS p, &errpos)))
1628 return tls_error_gnu(string_sprintf(
1629 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1630 p, errpos - CS p, errpos),
1631 rc, host, errstr);
17c76198 1632
452a164f
JH
1633if ((rc = gnutls_priority_set(state->session, state->priority_cache)))
1634 return tls_error_gnu(US"gnutls_priority_set", rc, host, errstr);
17c76198 1635
b10c87b3
JH
1636/* This also sets the server ticket expiration time to the same, and
1637the STEK rotation time to 3x. */
1638
17c76198
PP
1639gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1640
1641/* Reduce security in favour of increased compatibility, if the admin
1642decides to make that trade-off. */
1643if (gnutls_compat_mode)
83da1223 1644 {
17c76198
PP
1645#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1646 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1647 gnutls_session_enable_compatibility_mode(state->session);
1648#else
1649 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1650#endif
83da1223
PH
1651 }
1652
17c76198 1653*caller_state = state;
17c76198 1654return OK;
83da1223
PH
1655}
1656
1657
1658
83da1223 1659/*************************************************
17c76198 1660* Extract peer information *
059ec3d9
PH
1661*************************************************/
1662
f1be21cf
JH
1663static const uschar *
1664cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
1665 gnutls_mac_algorithm_t mac)
1666{
1667uschar cs_id[2];
1668gnutls_kx_algorithm_t kx_i;
1669gnutls_cipher_algorithm_t cipher_i;
1670gnutls_mac_algorithm_t mac_i;
1671
1672for (size_t i = 0;
1673 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
1674 i++)
1675 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
1676 return cipher_stdname(cs_id[0], cs_id[1]);
1677return NULL;
1678}
1679
1680
1681
17c76198 1682/* Called from both server and client code.
4fe99a6c
PP
1683Only this is allowed to set state->peerdn and state->have_set_peerdn
1684and we use that to detect double-calls.
059ec3d9 1685
75fe387d
PP
1686NOTE: the state blocks last while the TLS connection is up, which is fine
1687for logging in the server side, but for the client side, we log after teardown
1688in src/deliver.c. While the session is up, we can twist about states and
1689repoint tls_* globals, but those variables used for logging or other variable
1690expansion that happens _after_ delivery need to have a longer life-time.
1691
1692So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1693doing this more than once per generation of a state context. We set them in
1694the state context, and repoint tls_* to them. After the state goes away, the
1695tls_* copies of the pointers remain valid and client delivery logging is happy.
1696
1697tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1698don't apply.
1699
059ec3d9 1700Arguments:
17c76198 1701 state exim_gnutls_state_st *
cf0c6164 1702 errstr pointer to error string
059ec3d9 1703
17c76198 1704Returns: OK/DEFER/FAIL
059ec3d9
PH
1705*/
1706
17c76198 1707static int
b10c87b3 1708peer_status(exim_gnutls_state_st * state, uschar ** errstr)
059ec3d9 1709{
b10c87b3
JH
1710gnutls_session_t session = state->session;
1711const gnutls_datum_t * cert_list;
75fe387d 1712int old_pool, rc;
17c76198 1713unsigned int cert_list_size = 0;
4fe99a6c
PP
1714gnutls_protocol_t protocol;
1715gnutls_cipher_algorithm_t cipher;
1716gnutls_kx_algorithm_t kx;
1717gnutls_mac_algorithm_t mac;
17c76198
PP
1718gnutls_certificate_type_t ct;
1719gnutls_x509_crt_t crt;
b10c87b3 1720uschar * dn_buf;
17c76198 1721size_t sz;
059ec3d9 1722
4fe99a6c 1723if (state->have_set_peerdn)
17c76198 1724 return OK;
4fe99a6c 1725state->have_set_peerdn = TRUE;
059ec3d9 1726
4fe99a6c 1727state->peerdn = NULL;
059ec3d9 1728
4fe99a6c 1729/* tls_cipher */
b10c87b3
JH
1730cipher = gnutls_cipher_get(session);
1731protocol = gnutls_protocol_get_version(session);
1732mac = gnutls_mac_get(session);
b9c6f63c
JH
1733kx =
1734#ifdef GNUTLS_TLS1_3
1735 protocol >= GNUTLS_TLS1_3 ? 0 :
1736#endif
b10c87b3 1737 gnutls_kx_get(session);
4fe99a6c 1738
75fe387d 1739old_pool = store_pool;
f1be21cf 1740 {
b10c87b3 1741 tls_support * tlsp = state->tlsp;
f1be21cf 1742 store_pool = POOL_PERM;
d9acfc1c
JH
1743
1744#ifdef SUPPORT_GNUTLS_SESS_DESC
1745 {
1746 gstring * g = NULL;
b10c87b3 1747 uschar * s = US gnutls_session_get_desc(session), c;
d9acfc1c
JH
1748
1749 /* Nikos M suggests we use this by preference. It returns like:
1750 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
1751
1752 For partial back-compat, put a colon after the TLS version, replace the
1753 )-( grouping with __, replace in-group - with _ and append the :keysize. */
1754
1755 /* debug_printf("peer_status: gnutls_session_get_desc %s\n", s); */
1756
1757 for (s++; (c = *s) && c != ')'; s++) g = string_catn(g, s, 1);
5b195d6b 1758 tlsp->ver = string_copyn(g->s, g->ptr);
d9acfc1c
JH
1759 g = string_catn(g, US":", 1);
1760 if (*s) s++; /* now on _ between groups */
1761 while ((c = *s))
1762 {
1763 for (*++s && ++s; (c = *s) && c != ')'; s++) g = string_catn(g, c == '-' ? US"_" : s, 1);
1764 /* now on ) closing group */
1765 if ((c = *s) && *++s == '-') g = string_catn(g, US"__", 2);
1766 /* now on _ between groups */
1767 }
1768 g = string_catn(g, US":", 1);
1769 g = string_cat(g, string_sprintf("%d", (int) gnutls_cipher_get_key_size(cipher) * 8));
1770 state->ciphersuite = string_from_gstring(g);
1771 }
1772#else
f1be21cf
JH
1773 state->ciphersuite = string_sprintf("%s:%s:%d",
1774 gnutls_protocol_get_name(protocol),
1775 gnutls_cipher_suite_get_name(kx, cipher, mac),
1776 (int) gnutls_cipher_get_key_size(cipher) * 8);
1777
1778 /* I don't see a way that spaces could occur, in the current GnuTLS
1779 code base, but it was a concern in the old code and perhaps older GnuTLS
1780 releases did return "TLS 1.0"; play it safe, just in case. */
1781
1782 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
5b195d6b
JH
1783 tlsp->ver = string_copyn(state->ciphersuite,
1784 Ustrchr(state->ciphersuite, ':') - state->ciphersuite);
d9acfc1c
JH
1785#endif
1786
1787/* debug_printf("peer_status: ciphersuite %s\n", state->ciphersuite); */
1788
b10c87b3
JH
1789 tlsp->cipher = state->ciphersuite;
1790 tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
f1be21cf 1791
b10c87b3 1792 tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
f1be21cf 1793 }
75fe387d 1794store_pool = old_pool;
4fe99a6c
PP
1795
1796/* tls_peerdn */
b10c87b3 1797cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
83da1223 1798
f1be21cf 1799if (!cert_list || cert_list_size == 0)
17c76198 1800 {
17c76198
PP
1801 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1802 cert_list, cert_list_size);
e51c7be2 1803 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1804 return tls_error(US"certificate verification failed",
48224640 1805 US"no certificate received from peer", state->host, errstr);
17c76198
PP
1806 return OK;
1807 }
059ec3d9 1808
b10c87b3 1809if ((ct = gnutls_certificate_type_get(session)) != GNUTLS_CRT_X509)
059ec3d9 1810 {
95f52235 1811 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
17c76198
PP
1812 DEBUG(D_tls)
1813 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1814 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1815 return tls_error(US"certificate verification not possible, unhandled type",
cf0c6164 1816 ctn, state->host, errstr);
17c76198 1817 return OK;
83da1223 1818 }
059ec3d9 1819
e51c7be2
JH
1820#define exim_gnutls_peer_err(Label) \
1821 do { \
1822 if (rc != GNUTLS_E_SUCCESS) \
1823 { \
1824 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1825 (Label), gnutls_strerror(rc)); \
1826 if (state->verify_requirement >= VERIFY_REQUIRED) \
452a164f 1827 return tls_error_gnu((Label), rc, state->host, errstr); \
e51c7be2
JH
1828 return OK; \
1829 } \
1830 } while (0)
17c76198 1831
9d1c15ef
JH
1832rc = import_cert(&cert_list[0], &crt);
1833exim_gnutls_peer_err(US"cert 0");
1834
1835state->tlsp->peercert = state->peercert = crt;
17c76198 1836
17c76198
PP
1837sz = 0;
1838rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1839if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1840 {
17c76198
PP
1841 exim_gnutls_peer_err(US"getting size for cert DN failed");
1842 return FAIL; /* should not happen */
059ec3d9 1843 }
f3ebb786 1844dn_buf = store_get_perm(sz, TRUE); /* tainted */
17c76198
PP
1845rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1846exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1847
17c76198
PP
1848state->peerdn = dn_buf;
1849
1850return OK;
1851#undef exim_gnutls_peer_err
1852}
059ec3d9 1853
059ec3d9 1854
059ec3d9 1855
059ec3d9 1856
17c76198
PP
1857/*************************************************
1858* Verify peer certificate *
1859*************************************************/
059ec3d9 1860
17c76198
PP
1861/* Called from both server and client code.
1862*Should* be using a callback registered with
1863gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1864the peer information, but that's too new for some OSes.
059ec3d9 1865
17c76198 1866Arguments:
899b8bbc
JH
1867 state exim_gnutls_state_st *
1868 errstr where to put an error message
059ec3d9 1869
17c76198
PP
1870Returns:
1871 FALSE if the session should be rejected
1872 TRUE if the cert is okay or we just don't care
1873*/
059ec3d9 1874
17c76198 1875static BOOL
28646fa9 1876verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
17c76198
PP
1877{
1878int rc;
899b8bbc
JH
1879uint verify;
1880
8008accd 1881DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
cf0c6164 1882*errstr = NULL;
b10c87b3 1883rc = peer_status(state, errstr);
17c76198 1884
b10c87b3
JH
1885if (state->verify_requirement == VERIFY_NONE)
1886 return TRUE;
1887
1888if (rc != OK || !state->peerdn)
e6060e2c 1889 {
17c76198 1890 verify = GNUTLS_CERT_INVALID;
cf0c6164 1891 *errstr = US"certificate not supplied";
17c76198
PP
1892 }
1893else
899b8bbc
JH
1894
1895 {
1896#ifdef SUPPORT_DANE
1897 if (state->verify_requirement == VERIFY_DANE && state->host)
1898 {
1899 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1900 including talking to a DNS resolver. But we want to do that bit ourselves
1901 as the testsuite intercepts and fakes its own DNS environment. */
1902
1903 dane_state_t s;
1904 dane_query_t r;
899b8bbc 1905 uint lsize;
94c13285
JH
1906 const gnutls_datum_t * certlist =
1907 gnutls_certificate_get_peers(state->session, &lsize);
1908 int usage = tls_out.tlsa_usage;
1909
1910# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1911 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1912 dane-verification separately so that we know which selector verified;
570cb1bd 1913 then we know whether to do name-verification (needed for TA but not EE). */
94c13285
JH
1914
1915 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
bd5b3f3c 1916 { /* a mixed-usage bundle */
94c13285
JH
1917 int i, j, nrec;
1918 const char ** dd;
1919 int * ddl;
1920
1921 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1922 nrec++;
1923
f3ebb786
JH
1924 dd = store_get(nrec * sizeof(uschar *), FALSE);
1925 ddl = store_get(nrec * sizeof(int), FALSE);
94c13285
JH
1926 nrec--;
1927
1928 if ((rc = dane_state_init(&s, 0)))
1929 goto tlsa_prob;
1930
1931 for (usage = DANESSL_USAGE_DANE_EE;
1932 usage >= DANESSL_USAGE_DANE_TA; usage--)
1933 { /* take records with this usage */
1934 for (j = i = 0; i < nrec; i++)
1935 if (state->dane_data[i][0] == usage)
1936 {
1937 dd[j] = state->dane_data[i];
1938 ddl[j++] = state->dane_data_len[i];
1939 }
1940 if (j)
1941 {
1942 dd[j] = NULL;
1943 ddl[j] = 0;
1944
1945 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1946 goto tlsa_prob;
1947
1948 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1949 gnutls_certificate_type_get(state->session),
1950 r, 0,
1951 usage == DANESSL_USAGE_DANE_EE
1952 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1953 &verify)))
1954 {
1955 DEBUG(D_tls)
1956 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1957 }
1958 else if (verify == 0) /* verification passed */
1959 {
1960 usage = 1 << usage;
1961 break;
1962 }
1963 }
1964 }
899b8bbc 1965
94c13285
JH
1966 if (rc) goto tlsa_prob;
1967 }
1968 else
1969# endif
899b8bbc 1970 {
94c13285
JH
1971 if ( (rc = dane_state_init(&s, 0))
1972 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1973 1, 0))
1974 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1975 gnutls_certificate_type_get(state->session),
5ec37a55 1976 r, 0,
94c13285
JH
1977# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1978 usage == (1 << DANESSL_USAGE_DANE_EE)
1979 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1980# else
1981 0,
1982# endif
1983 &verify))
1984 )
1985 goto tlsa_prob;
899b8bbc 1986 }
94c13285
JH
1987
1988 if (verify != 0) /* verification failed */
899b8bbc
JH
1989 {
1990 gnutls_datum_t str;
1991 (void) dane_verification_status_print(verify, &str, 0);
1992 *errstr = US str.data; /* don't bother to free */
1993 goto badcert;
1994 }
28646fa9 1995
94c13285
JH
1996# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1997 /* If a TA-mode TLSA record was used for verification we must additionally
570cb1bd 1998 verify the cert name (but not the CA chain). For EE-mode, skip it. */
28646fa9 1999
94c13285
JH
2000 if (usage & (1 << DANESSL_USAGE_DANE_EE))
2001# endif
28646fa9 2002 {
570cb1bd 2003 state->peer_dane_verified = state->peer_cert_verified = TRUE;
28646fa9
JH
2004 goto goodcert;
2005 }
570cb1bd
JH
2006# ifdef GNUTLS_BROKEN_DANE_VALIDATION
2007 /* Assume that the name on the A-record is the one that should be matching
2008 the cert. An alternate view is that the domain part of the email address
2009 is also permissible. */
2010
2011 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2012 CS state->host->name))
2013 {
2014 state->peer_dane_verified = state->peer_cert_verified = TRUE;
2015 goto goodcert;
2016 }
2017# endif
899b8bbc 2018 }
570cb1bd 2019#endif /*SUPPORT_DANE*/
899b8bbc 2020
17c76198 2021 rc = gnutls_certificate_verify_peers2(state->session, &verify);
899b8bbc 2022 }
e6060e2c 2023
899b8bbc 2024/* Handle the result of verification. INVALID is set if any others are. */
059ec3d9 2025
28646fa9 2026if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
17c76198
PP
2027 {
2028 state->peer_cert_verified = FALSE;
cf0c6164 2029 if (!*errstr)
184384c3
JH
2030 {
2031#ifdef GNUTLS_CERT_VFY_STATUS_PRINT
2032 DEBUG(D_tls)
2033 {
2034 gnutls_datum_t txt;
2035
2036 if (gnutls_certificate_verification_status_print(verify,
2037 gnutls_certificate_type_get(state->session), &txt, 0)
2038 == GNUTLS_E_SUCCESS)
2039 {
2040 debug_printf("%s\n", txt.data);
2041 gnutls_free(txt.data);
2042 }
2043 }
2044#endif
cf0c6164
JH
2045 *errstr = verify & GNUTLS_CERT_REVOKED
2046 ? US"certificate revoked" : US"certificate invalid";
184384c3 2047 }
059ec3d9 2048
17c76198 2049 DEBUG(D_tls)
e51c7be2 2050 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
cf0c6164 2051 *errstr, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 2052
e51c7be2 2053 if (state->verify_requirement >= VERIFY_REQUIRED)
899b8bbc 2054 goto badcert;
17c76198 2055 DEBUG(D_tls)
4789da3a 2056 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 2057 }
e51c7be2 2058
17c76198
PP
2059else
2060 {
5fd28bb8
JH
2061 /* Client side, check the server's certificate name versus the name on the
2062 A-record for the connection we made. What to do for server side - what name
2063 to use for client? We document that there is no such checking for server
2064 side. */
2065
2066 if ( state->exp_tls_verify_cert_hostnames
2067 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
2068 CS state->exp_tls_verify_cert_hostnames)
2069 )
e51c7be2 2070 {
5fd28bb8
JH
2071 DEBUG(D_tls)
2072 debug_printf("TLS certificate verification failed: cert name mismatch\n");
2073 if (state->verify_requirement >= VERIFY_REQUIRED)
2074 goto badcert;
2075 return TRUE;
e51c7be2 2076 }
5fd28bb8 2077
17c76198 2078 state->peer_cert_verified = TRUE;
e51c7be2 2079 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 2080 state->peerdn ? state->peerdn : US"<unset>");
17c76198 2081 }
059ec3d9 2082
28646fa9
JH
2083goodcert:
2084 state->tlsp->peerdn = state->peerdn;
2085 return TRUE;
899b8bbc 2086
b83314e3 2087#ifdef SUPPORT_DANE
94c13285 2088tlsa_prob:
624f33df
JH
2089 *errstr = string_sprintf("TLSA record problem: %s",
2090 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
b83314e3
JH
2091#endif
2092
899b8bbc
JH
2093badcert:
2094 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
2095 return FALSE;
17c76198 2096}
059ec3d9 2097
17c76198
PP
2098
2099
2100
2101/* ------------------------------------------------------------------------ */
2102/* Callbacks */
2103
2104/* Logging function which can be registered with
2105 * gnutls_global_set_log_function()
2106 * gnutls_global_set_log_level() 0..9
2107 */
af3498d6 2108#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 2109static void
17c76198 2110exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 2111{
8c79eebf
PP
2112 size_t len = strlen(message);
2113 if (len < 1)
2114 {
2115 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
2116 return;
2117 }
2118 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
2119 message[len-1] == '\n' ? "" : "\n");
17c76198 2120}
af3498d6 2121#endif
059ec3d9 2122
059ec3d9 2123
17c76198
PP
2124/* Called after client hello, should handle SNI work.
2125This will always set tls_sni (state->received_sni) if available,
2126and may trigger presenting different certificates,
2127if state->trigger_sni_changes is TRUE.
059ec3d9 2128
17c76198
PP
2129Should be registered with
2130 gnutls_handshake_set_post_client_hello_function()
059ec3d9 2131
17c76198
PP
2132"This callback must return 0 on success or a gnutls error code to terminate the
2133handshake.".
059ec3d9 2134
17c76198
PP
2135For inability to get SNI information, we return 0.
2136We only return non-zero if re-setup failed.
817d9f57 2137Only used for server-side TLS.
17c76198 2138*/
44bbabb5 2139
17c76198
PP
2140static int
2141exim_sni_handling_cb(gnutls_session_t session)
2142{
2143char sni_name[MAX_HOST_LEN];
2144size_t data_len = MAX_HOST_LEN;
817d9f57 2145exim_gnutls_state_st *state = &state_server;
17c76198
PP
2146unsigned int sni_type;
2147int rc, old_pool;
cf0c6164 2148uschar * dummy_errstr;
17c76198
PP
2149
2150rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
2151if (rc != GNUTLS_E_SUCCESS)
2152 {
8775d84f 2153 DEBUG(D_tls)
b34fc30c
PP
2154 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
2155 debug_printf("TLS: no SNI presented in handshake.\n");
2156 else
2157 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
2158 gnutls_strerror(rc), rc);
b34fc30c
PP
2159 return 0;
2160 }
2161
17c76198
PP
2162if (sni_type != GNUTLS_NAME_DNS)
2163 {
2164 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
2165 return 0;
2166 }
44bbabb5 2167
17c76198
PP
2168/* We now have a UTF-8 string in sni_name */
2169old_pool = store_pool;
2170store_pool = POOL_PERM;
89a80675 2171state->received_sni = string_copy_taint(US sni_name, TRUE);
17c76198
PP
2172store_pool = old_pool;
2173
2174/* We set this one now so that variable expansions below will work */
817d9f57 2175state->tlsp->sni = state->received_sni;
17c76198
PP
2176
2177DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
2178 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
2179
2180if (!state->trigger_sni_changes)
2181 return 0;
2182
cf0c6164 2183if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
17c76198
PP
2184 {
2185 /* If the setup of certs/etc failed before handshake, TLS would not have
2186 been offered. The best we can do now is abort. */
2187 return GNUTLS_E_APPLICATION_ERROR_MIN;
2188 }
2189
cf0c6164 2190rc = tls_set_remaining_x509(state, &dummy_errstr);
1365611d
PP
2191if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
2192
2193return 0;
059ec3d9
PH
2194}
2195
2196
2197
0cbf2b82 2198#ifndef DISABLE_EVENT
a7538db1
JH
2199/*
2200We use this callback to get observability and detail-level control
723fe533
JH
2201for an exim TLS connection (either direction), raising a tls:cert event
2202for each cert in the chain presented by the peer. Any event
a7538db1
JH
2203can deny verification.
2204
2205Return 0 for the handshake to continue or non-zero to terminate.
2206*/
2207
2208static int
723fe533 2209verify_cb(gnutls_session_t session)
a7538db1 2210{
27f19eb4 2211const gnutls_datum_t * cert_list;
a7538db1
JH
2212unsigned int cert_list_size = 0;
2213gnutls_x509_crt_t crt;
2214int rc;
b30275b8 2215uschar * yield;
a7538db1
JH
2216exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
2217
bd5b3f3c 2218if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
a7538db1
JH
2219 while (cert_list_size--)
2220 {
bd5b3f3c 2221 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
a7538db1
JH
2222 {
2223 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
2224 cert_list_size, gnutls_strerror(rc));
2225 break;
2226 }
2227
2228 state->tlsp->peercert = crt;
b30275b8
JH
2229 if ((yield = event_raise(state->event_action,
2230 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
2231 {
2232 log_write(0, LOG_MAIN,
b30275b8
JH
2233 "SSL verify denied by event-action: depth=%d: %s",
2234 cert_list_size, yield);
a7538db1
JH
2235 return 1; /* reject */
2236 }
2237 state->tlsp->peercert = NULL;
2238 }
2239
2240return 0;
2241}
2242
2243#endif
44662487
JH
2244
2245
f20cfa4a
JH
2246static gstring *
2247ddump(gnutls_datum_t * d)
2248{
2249gstring * g = string_get((d->size+1) * 2);
2250uschar * s = d->data;
2251for (unsigned i = d->size; i > 0; i--, s++)
2252 {
2253 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2254 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2255 }
2256return g;
2257}
17c76198 2258
dc6d1769
JH
2259static void
2260post_handshake_debug(exim_gnutls_state_st * state)
2261{
dc6d1769
JH
2262#ifdef SUPPORT_GNUTLS_SESS_DESC
2263debug_printf("%s\n", gnutls_session_get_desc(state->session));
2264#endif
2265#ifdef SUPPORT_GNUTLS_KEYLOG
e326959e
JH
2266
2267# ifdef EXIM_HAVE_TLS1_3
dc6d1769 2268if (gnutls_protocol_get_version(state->session) < GNUTLS_TLS1_3)
a8af957d
JH
2269#else
2270if (TRUE)
2271#endif
dc6d1769
JH
2272 {
2273 gnutls_datum_t c, s;
2274 gstring * gc, * gs;
2275 /* we only want the client random and the master secret */
2276 gnutls_session_get_random(state->session, &c, &s);
2277 gnutls_session_get_master_secret(state->session, &s);
2278 gc = ddump(&c);
2279 gs = ddump(&s);
2280 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2281 }
2282else
2283 debug_printf("To get keying info for TLS1.3 is hard:\n"
2284 " set environment variable SSLKEYLOGFILE to a filename writable by uid exim\n"
2285 " add SSLKEYLOGFILE to keep_environment in the exim config\n"
2286 " run exim as root\n"
e326959e
JH
2287 " if using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers\n"
2288 " (works for TLS1.2 also, and saves cut-paste into file)\n");
dc6d1769
JH
2289#endif
2290}
2291
b10c87b3
JH
2292
2293#ifdef EXPERIMENTAL_TLS_RESUME
2294static int
2295tls_server_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2296 unsigned incoming, const gnutls_datum_t * msg)
2297{
2298DEBUG(D_tls) debug_printf("newticket cb\n");
2299tls_in.resumption |= RESUME_CLIENT_REQUESTED;
2300return 0;
2301}
2302
2303static void
2304tls_server_resume_prehandshake(exim_gnutls_state_st * state)
2305{
2306/* Should the server offer session resumption? */
2307tls_in.resumption = RESUME_SUPPORTED;
2308if (verify_check_host(&tls_resumption_hosts) == OK)
2309 {
2310 int rc;
2311 /* GnuTLS appears to not do ticket overlap, but does emit a fresh ticket when
2312 an offered resumption is unacceptable. We lose one resumption per ticket
2313 lifetime, and sessions cannot be indefinitely re-used. There seems to be no
2314 way (3.6.7) of changing the default number of 2 TLS1.3 tickets issued, but at
2315 least they go out in a single packet. */
2316
2317 if (!(rc = gnutls_session_ticket_enable_server(state->session,
2318 &server_sessticket_key)))
2319 tls_in.resumption |= RESUME_SERVER_TICKET;
2320 else
2321 DEBUG(D_tls)
2322 debug_printf("enabling session tickets: %s\n", US gnutls_strerror(rc));
2323
2324 /* Try to tell if we see a ticket request */
2325 gnutls_handshake_set_hook_function(state->session,
e5489333 2326 GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST, tls_server_hook_cb);
b10c87b3
JH
2327 }
2328}
2329
2330static void
2331tls_server_resume_posthandshake(exim_gnutls_state_st * state)
2332{
2333if (gnutls_session_resumption_requested(state->session))
2334 {
2335 /* This tells us the client sent a full ticket. We use a
2336 callback on session-ticket request, elsewhere, to tell
2337 if a client asked for a ticket. */
2338
2339 tls_in.resumption |= RESUME_CLIENT_SUGGESTED;
2340 DEBUG(D_tls) debug_printf("client requested resumption\n");
2341 }
2342if (gnutls_session_is_resumed(state->session))
2343 {
2344 tls_in.resumption |= RESUME_USED;
2345 DEBUG(D_tls) debug_printf("Session resumed\n");
2346 }
2347}
2348#endif
17c76198
PP
2349/* ------------------------------------------------------------------------ */
2350/* Exported functions */
2351
2352
2353
2354
059ec3d9
PH
2355/*************************************************
2356* Start a TLS session in a server *
2357*************************************************/
2358
2359/* This is called when Exim is running as a server, after having received
2360the STARTTLS command. It must respond to that command, and then negotiate
2361a TLS session.
2362
2363Arguments:
83da1223 2364 require_ciphers list of allowed ciphers or NULL
cf0c6164 2365 errstr pointer to error string
059ec3d9
PH
2366
2367Returns: OK on success
2368 DEFER for errors before the start of the negotiation
4c04137d 2369 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
2370 continue running.
2371*/
2372
2373int
cf0c6164 2374tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
2375{
2376int rc;
cf0c6164 2377exim_gnutls_state_st * state = NULL;
059ec3d9
PH
2378
2379/* Check for previous activation */
74f1a423 2380if (tls_in.active.sock >= 0)
059ec3d9 2381 {
48224640 2382 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
925ac8e4 2383 smtp_printf("554 Already in TLS\r\n", FALSE);
059ec3d9
PH
2384 return FAIL;
2385 }
2386
2387/* Initialize the library. If it fails, it will already have logged the error
2388and sent an SMTP response. */
2389
17c76198 2390DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 2391
d85cdeb5
JH
2392 {
2393#ifdef MEASURE_TIMING
2394 struct timeval t0;
2395 gettimeofday(&t0, NULL);
2396#endif
2397
2398 if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
2399 NULL, tls_verify_certificates, tls_crl,
2400 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
2401
2402#ifdef MEASURE_TIMING
2403 report_time_since(&t0, US"server tls_init (delta)");
2404#endif
2405 }
059ec3d9 2406
b10c87b3
JH
2407#ifdef EXPERIMENTAL_TLS_RESUME
2408tls_server_resume_prehandshake(state);
2409#endif
2410
059ec3d9
PH
2411/* If this is a host for which certificate verification is mandatory or
2412optional, set up appropriately. */
2413
059ec3d9 2414if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 2415 {
e51c7be2
JH
2416 DEBUG(D_tls)
2417 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
2418 state->verify_requirement = VERIFY_REQUIRED;
2419 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2420 }
059ec3d9 2421else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 2422 {
e51c7be2
JH
2423 DEBUG(D_tls)
2424 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
2425 state->verify_requirement = VERIFY_OPTIONAL;
2426 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2427 }
2428else
2429 {
e51c7be2
JH
2430 DEBUG(D_tls)
2431 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
2432 state->verify_requirement = VERIFY_NONE;
2433 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2434 }
059ec3d9 2435
0cbf2b82 2436#ifndef DISABLE_EVENT
723fe533
JH
2437if (event_action)
2438 {
2439 state->event_action = event_action;
2440 gnutls_session_set_ptr(state->session, state);
2441 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2442 }
2443#endif
2444
17c76198
PP
2445/* Register SNI handling; always, even if not in tls_certificate, so that the
2446expansion variable $tls_sni is always available. */
059ec3d9 2447
17c76198
PP
2448gnutls_handshake_set_post_client_hello_function(state->session,
2449 exim_sni_handling_cb);
059ec3d9
PH
2450
2451/* Set context and tell client to go ahead, except in the case of TLS startup
2452on connection, where outputting anything now upsets the clients and tends to
2453make them disconnect. We need to have an explicit fflush() here, to force out
2454the response. Other smtp_printf() calls do not need it, because in non-TLS
2455mode, the fflush() happens when smtp_getc() is called. */
2456
817d9f57 2457if (!state->tlsp->on_connect)
059ec3d9 2458 {
925ac8e4 2459 smtp_printf("220 TLS go ahead\r\n", FALSE);
9d1c15ef 2460 fflush(smtp_out);
059ec3d9
PH
2461 }
2462
2463/* Now negotiate the TLS session. We put our own timer on it, since it seems
8008accd
JH
2464that the GnuTLS library doesn't.
2465From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2466to set (and clear down afterwards) up a pull-timeout callback function that does
2467a select, so we're no better off unless avoiding signals becomes an issue. */
059ec3d9 2468
17c76198 2469gnutls_transport_set_ptr2(state->session,
27f19eb4
JH
2470 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2471 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
17c76198
PP
2472state->fd_in = fileno(smtp_in);
2473state->fd_out = fileno(smtp_out);
059ec3d9
PH
2474
2475sigalrm_seen = FALSE;
c2a1bba0 2476if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
17c76198 2477do
17c76198 2478 rc = gnutls_handshake(state->session);
157a7880 2479while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2480ALARM_CLR(0);
059ec3d9 2481
17c76198 2482if (rc != GNUTLS_E_SUCCESS)
059ec3d9 2483 {
059ec3d9
PH
2484 /* It seems that, except in the case of a timeout, we have to close the
2485 connection right here; otherwise if the other end is running OpenSSL it hangs
2486 until the server times out. */
2487
60d10ce7 2488 if (sigalrm_seen)
ad7fc6eb 2489 {
48224640 2490 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
ad7fc6eb
JH
2491 gnutls_db_remove_session(state->session);
2492 }
60d10ce7 2493 else
059ec3d9 2494 {
452a164f 2495 tls_error_gnu(US"gnutls_handshake", rc, NULL, errstr);
f5d25c2b 2496 (void) gnutls_alert_send_appropriate(state->session, rc);
ad7fc6eb 2497 gnutls_deinit(state->session);
ed62aae3 2498 gnutls_certificate_free_credentials(state->x509_cred);
60d10ce7 2499 millisleep(500);
ad7fc6eb 2500 shutdown(state->fd_out, SHUT_WR);
d7978c0f 2501 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
f1e894f3
PH
2502 (void)fclose(smtp_out);
2503 (void)fclose(smtp_in);
60d10ce7 2504 smtp_out = smtp_in = NULL;
059ec3d9
PH
2505 }
2506
2507 return FAIL;
2508 }
2509
b10c87b3
JH
2510#ifdef EXPERIMENTAL_TLS_RESUME
2511tls_server_resume_posthandshake(state);
2512#endif
2513
dc6d1769 2514DEBUG(D_tls) post_handshake_debug(state);
059ec3d9 2515
17c76198
PP
2516/* Verify after the fact */
2517
899b8bbc 2518if (!verify_certificate(state, errstr))
059ec3d9 2519 {
9d1c15ef 2520 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 2521 {
cf0c6164 2522 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
9d1c15ef 2523 return FAIL;
17c76198 2524 }
9d1c15ef
JH
2525 DEBUG(D_tls)
2526 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
cf0c6164 2527 *errstr);
059ec3d9
PH
2528 }
2529
17c76198
PP
2530/* Sets various Exim expansion variables; always safe within server */
2531
9d1c15ef 2532extract_exim_vars_from_tls_state(state);
059ec3d9
PH
2533
2534/* TLS has been set up. Adjust the input functions to read via TLS,
2535and initialize appropriately. */
2536
17c76198 2537state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
2538
2539receive_getc = tls_getc;
0d81dabc 2540receive_getbuf = tls_getbuf;
584e96c6 2541receive_get_cache = tls_get_cache;
059ec3d9
PH
2542receive_ungetc = tls_ungetc;
2543receive_feof = tls_feof;
2544receive_ferror = tls_ferror;
58eb016e 2545receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2546
059ec3d9
PH
2547return OK;
2548}
2549
2550
2551
2552
aa2a70ba
JH
2553static void
2554tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2555 smtp_transport_options_block * ob)
2556{
3fb3231c 2557if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 2558 {
4af0d74a 2559 state->exp_tls_verify_cert_hostnames =
8c5d388a 2560#ifdef SUPPORT_I18N
4af0d74a
JH
2561 string_domain_utf8_to_alabel(host->name, NULL);
2562#else
2563 host->name;
2564#endif
aa2a70ba
JH
2565 DEBUG(D_tls)
2566 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2567 state->exp_tls_verify_cert_hostnames);
2568 }
2569}
aa2a70ba
JH
2570
2571
899b8bbc
JH
2572
2573
2574#ifdef SUPPORT_DANE
2575/* Given our list of RRs from the TLSA lookup, build a lookup block in
2576GnuTLS-DANE's preferred format. Hang it on the state str for later
2577use in DANE verification.
2578
2579We point at the dnsa data not copy it, so it must remain valid until
2580after verification is done.*/
2581
3674140c 2582static BOOL
899b8bbc
JH
2583dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2584{
899b8bbc
JH
2585dns_scan dnss;
2586int i;
2587const char ** dane_data;
2588int * dane_data_len;
2589
d7978c0f
JH
2590i = 1;
2591for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
899b8bbc
JH
2592 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2593 ) if (rr->type == T_TLSA) i++;
2594
f3ebb786
JH
2595dane_data = store_get(i * sizeof(uschar *), FALSE);
2596dane_data_len = store_get(i * sizeof(int), FALSE);
899b8bbc 2597
d7978c0f
JH
2598i = 0;
2599for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
899b8bbc 2600 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1b76ad22 2601 ) if (rr->type == T_TLSA && rr->size > 3)
899b8bbc
JH
2602 {
2603 const uschar * p = rr->data;
f3ebb786 2604/*XXX need somehow to mark rr and its data as tainted. Doues this mean copying it? */
3674140c
JH
2605 uint8_t usage = p[0], sel = p[1], type = p[2];
2606
2607 DEBUG(D_tls)
2608 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2609
94c13285
JH
2610 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2611 || (sel != 0 && sel != 1)
2612 )
2613 continue;
3674140c
JH
2614 switch(type)
2615 {
2616 case 0: /* Full: cannot check at present */
2617 break;
2618 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2619 break;
2620 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2621 break;
2622 default: continue;
2623 }
899b8bbc
JH
2624
2625 tls_out.tlsa_usage |= 1<<usage;
48224640 2626 dane_data[i] = CS p;
899b8bbc
JH
2627 dane_data_len[i++] = rr->size;
2628 }
3674140c
JH
2629
2630if (!i) return FALSE;
2631
899b8bbc
JH
2632dane_data[i] = NULL;
2633dane_data_len[i] = 0;
2634
2635state->dane_data = (char * const *)dane_data;
2636state->dane_data_len = dane_data_len;
3674140c 2637return TRUE;
899b8bbc
JH
2638}
2639#endif
2640
2641
2642
b10c87b3
JH
2643#ifdef EXPERIMENTAL_TLS_RESUME
2644/* On the client, get any stashed session for the given IP from hints db
2645and apply it to the ssl-connection for attempted resumption. Although
2646there is a gnutls_session_ticket_enable_client() interface it is
2647documented as unnecessary (as of 3.6.7) as "session tickets are emabled
2648by deafult". There seems to be no way to disable them, so even hosts not
2649enabled by the transport option will be sent a ticket request. We will
2650however avoid storing and retrieving session information. */
2651
2652static void
2653tls_retrieve_session(tls_support * tlsp, gnutls_session_t session,
2654 host_item * host, smtp_transport_options_block * ob)
2655{
2656tlsp->resumption = RESUME_SUPPORTED;
2657if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
2658 {
2659 dbdata_tls_session * dt;
2660 int len, rc;
2661 open_db dbblock, * dbm_file;
2662
2663 DEBUG(D_tls)
2664 debug_printf("check for resumable session for %s\n", host->address);
2665 tlsp->host_resumable = TRUE;
2666 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2667 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
2668 {
dea4b568
JH
2669 /* Key for the db is the IP. We'd like to filter the retrieved session
2670 for ticket advisory expiry, but 3.6.1 seems to give no access to that */
2671
b10c87b3
JH
2672 if ((dt = dbfn_read_with_length(dbm_file, host->address, &len)))
2673 if (!(rc = gnutls_session_set_data(session,
2674 CUS dt->session, (size_t)len - sizeof(dbdata_tls_session))))
2675 {
2676 DEBUG(D_tls) debug_printf("good session\n");
2677 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2678 }
2679 else DEBUG(D_tls) debug_printf("setting session resumption data: %s\n",
2680 US gnutls_strerror(rc));
2681 dbfn_close(dbm_file);
2682 }
2683 }
2684}
2685
2686
2687static void
2688tls_save_session(tls_support * tlsp, gnutls_session_t session, const host_item * host)
2689{
2690/* TLS 1.2 - we get both the callback and the direct posthandshake call,
2691but this flag is not set until the second. TLS 1.3 it's the other way about.
2692Keep both calls as the session data cannot be extracted before handshake
2693completes. */
2694
2695if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_SESSION_TICKET)
2696 {
2697 gnutls_datum_t tkt;
2698 int rc;
2699
2700 DEBUG(D_tls) debug_printf("server offered session ticket\n");
2701 tlsp->ticket_received = TRUE;
2702 tlsp->resumption |= RESUME_SERVER_TICKET;
2703
2704 if (tlsp->host_resumable)
2705 if (!(rc = gnutls_session_get_data2(session, &tkt)))
2706 {
2707 open_db dbblock, * dbm_file;
2708 int dlen = sizeof(dbdata_tls_session) + tkt.size;
f3ebb786 2709 dbdata_tls_session * dt = store_get(dlen, TRUE);
b10c87b3
JH
2710
2711 DEBUG(D_tls) debug_printf("session data size %u\n", (unsigned)tkt.size);
2712 memcpy(dt->session, tkt.data, tkt.size);
2713 gnutls_free(tkt.data);
2714
2715 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
2716 {
2717 /* key for the db is the IP */
2718 dbfn_delete(dbm_file, host->address);
2719 dbfn_write(dbm_file, host->address, dt, dlen);
2720 dbfn_close(dbm_file);
2721
2722 DEBUG(D_tls)
2723 debug_printf("wrote session db (len %u)\n", (unsigned)dlen);
2724 }
2725 }
2726 else DEBUG(D_tls)
2727 debug_printf("extract session data: %s\n", US gnutls_strerror(rc));
2728 }
2729}
2730
2731
2732/* With a TLS1.3 session, the ticket(s) are not seen until
2733the first data read is attempted. And there's often two of them.
2734Pick them up with this callback. We are also called for 1.2
2735but we do nothing.
2736*/
2737static int
2738tls_client_ticket_cb(gnutls_session_t sess, u_int htype, unsigned when,
2739 unsigned incoming, const gnutls_datum_t * msg)
2740{
2741exim_gnutls_state_st * state = gnutls_session_get_ptr(sess);
2742tls_support * tlsp = state->tlsp;
2743
2744DEBUG(D_tls) debug_printf("newticket cb\n");
2745
2746if (!tlsp->ticket_received)
2747 tls_save_session(tlsp, sess, state->host);
2748return 0;
2749}
2750
2751
2752static void
2753tls_client_resume_prehandshake(exim_gnutls_state_st * state,
2754 tls_support * tlsp, host_item * host,
2755 smtp_transport_options_block * ob)
2756{
2757gnutls_session_set_ptr(state->session, state);
2758gnutls_handshake_set_hook_function(state->session,
2759 GNUTLS_HANDSHAKE_NEW_SESSION_TICKET, GNUTLS_HOOK_POST, tls_client_ticket_cb);
2760
2761tls_retrieve_session(tlsp, state->session, host, ob);
2762}
2763
2764static void
2765tls_client_resume_posthandshake(exim_gnutls_state_st * state,
2766 tls_support * tlsp, host_item * host)
2767{
2768if (gnutls_session_is_resumed(state->session))
2769 {
2770 DEBUG(D_tls) debug_printf("Session resumed\n");
2771 tlsp->resumption |= RESUME_USED;
2772 }
2773
2774tls_save_session(tlsp, state->session, host);
2775}
2776#endif /* EXPERIMENTAL_TLS_RESUME */
2777
2778
059ec3d9
PH
2779/*************************************************
2780* Start a TLS session in a client *
2781*************************************************/
2782
2783/* Called from the smtp transport after STARTTLS has been accepted.
2784
2785Arguments:
c05bdbd6
JH
2786 cctx connection context
2787 conn_args connection details
2788 cookie datum for randomness (not used)
2789 tlsp record details of channel configuration here; must be non-NULL
2790 errstr error string pointer
2791
2792Returns: TRUE for success with TLS session context set in smtp context,
2793 FALSE on error
059ec3d9
PH
2794*/
2795
c05bdbd6
JH
2796BOOL
2797tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2798 void * cookie ARG_UNUSED,
2799 tls_support * tlsp, uschar ** errstr)
059ec3d9 2800{
c05bdbd6
JH
2801host_item * host = conn_args->host; /* for msgs and option-tests */
2802transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
2803smtp_transport_options_block * ob = tb
afdb5e9c
JH
2804 ? (smtp_transport_options_block *)tb->options_block
2805 : &smtp_transport_option_defaults;
059ec3d9 2806int rc;
899b8bbc 2807exim_gnutls_state_st * state = NULL;
c05bdbd6 2808uschar * cipher_list = NULL;
74f1a423 2809
f2de3a33 2810#ifndef DISABLE_OCSP
5130845b 2811BOOL require_ocsp =
3fb3231c 2812 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
44662487 2813BOOL request_ocsp = require_ocsp ? TRUE
3fb3231c 2814 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2b4a568d 2815#endif
059ec3d9 2816
c05bdbd6 2817DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
059ec3d9 2818
5ec37a55 2819#ifdef SUPPORT_DANE
c05bdbd6
JH
2820/* If dane is flagged, have either request or require dane for this host, and
2821a TLSA record found. Therefore, dane verify required. Which implies cert must
2822be requested and supplied, dane verify must pass, and cert verify irrelevant
2823(incl. hostnames), and (caller handled) require_tls */
2824
2825if (conn_args->dane && ob->dane_require_tls_ciphers)
5ec37a55
PP
2826 {
2827 /* not using expand_check_tlsvar because not yet in state */
2828 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2829 &cipher_list, errstr))
c05bdbd6 2830 return FALSE;
cf260049
JH
2831 cipher_list = cipher_list && *cipher_list
2832 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
5ec37a55
PP
2833 }
2834#endif
2835
2836if (!cipher_list)
2837 cipher_list = ob->tls_require_ciphers;
2838
d85cdeb5
JH
2839 {
2840#ifdef MEASURE_TIMING
2841 struct timeval t0;
2842 gettimeofday(&t0, NULL);
2843#endif
2844
2845 if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2846 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
2847 cipher_list, &state, tlsp, errstr) != OK)
2848 return FALSE;
2849
2850#ifdef MEASURE_TIMING
2851 report_time_since(&t0, US"client tls_init (delta)");
2852#endif
2853 }
059ec3d9 2854
54c90be1 2855 {
65867078
JH
2856 int dh_min_bits = ob->tls_dh_min_bits;
2857 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2858 {
2859 DEBUG(D_tls)
2860 debug_printf("WARNING: tls_dh_min_bits far too low,"
2861 " clamping %d up to %d\n",
2862 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2863 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2864 }
54c90be1 2865
65867078
JH
2866 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2867 " acceptable bits to %d\n",
2868 dh_min_bits);
2869 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2870 }
83da1223 2871
94431adb 2872/* Stick to the old behaviour for compatibility if tls_verify_certificates is
2b4a568d
JH
2873set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2874the specified host patterns if one of them is defined */
2875
899b8bbc 2876#ifdef SUPPORT_DANE
c05bdbd6 2877if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
899b8bbc
JH
2878 {
2879 DEBUG(D_tls)
2880 debug_printf("TLS: server certificate DANE required.\n");
2881 state->verify_requirement = VERIFY_DANE;
2882 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
899b8bbc
JH
2883 }
2884else
2885#endif
2886 if ( ( state->exp_tls_verify_certificates
2887 && !ob->tls_verify_hosts
2888 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2889 )
3fb3231c 2890 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
899b8bbc 2891 )
17c76198 2892 {
aa2a70ba 2893 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
2894 DEBUG(D_tls)
2895 debug_printf("TLS: server certificate verification required.\n");
2896 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
2897 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2898 }
3fb3231c 2899else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
52f93eed 2900 {
aa2a70ba 2901 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
2902 DEBUG(D_tls)
2903 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 2904 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
2905 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2906 }
2907else
2908 {
e51c7be2
JH
2909 DEBUG(D_tls)
2910 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
2911 state->verify_requirement = VERIFY_NONE;
2912 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 2913 }
059ec3d9 2914
f2de3a33
JH
2915#ifndef DISABLE_OCSP
2916 /* supported since GnuTLS 3.1.3 */
44662487 2917if (request_ocsp)
9d1c15ef
JH
2918 {
2919 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
2920 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2921 NULL, 0, NULL)) != OK)
74f1a423 2922 {
452a164f 2923 tls_error_gnu(US"cert-status-req", rc, state->host, errstr);
c05bdbd6 2924 return FALSE;
74f1a423
JH
2925 }
2926 tlsp->ocsp = OCSP_NOT_RESP;
9d1c15ef 2927 }
2b4a568d
JH
2928#endif
2929
b10c87b3
JH
2930#ifdef EXPERIMENTAL_TLS_RESUME
2931tls_client_resume_prehandshake(state, tlsp, host, ob);
2932#endif
2933
0cbf2b82 2934#ifndef DISABLE_EVENT
afdb5e9c 2935if (tb && tb->event_action)
a7538db1 2936 {
774ef2d7 2937 state->event_action = tb->event_action;
a7538db1 2938 gnutls_session_set_ptr(state->session, state);
723fe533 2939 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
2940 }
2941#endif
2942
c05bdbd6
JH
2943gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
2944state->fd_in = cctx->sock;
2945state->fd_out = cctx->sock;
059ec3d9 2946
9d1c15ef 2947DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
2948/* There doesn't seem to be a built-in timeout on connection. */
2949
2950sigalrm_seen = FALSE;
c2a1bba0 2951ALARM(ob->command_timeout);
17c76198 2952do
17c76198 2953 rc = gnutls_handshake(state->session);
f1fed05b 2954while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2955ALARM_CLR(0);
059ec3d9 2956
4fe99a6c 2957if (rc != GNUTLS_E_SUCCESS)
74f1a423 2958 {
60d10ce7
JH
2959 if (sigalrm_seen)
2960 {
2961 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
48224640 2962 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
60d10ce7
JH
2963 }
2964 else
452a164f 2965 tls_error_gnu(US"gnutls_handshake", rc, state->host, errstr);
c05bdbd6 2966 return FALSE;
74f1a423 2967 }
4fe99a6c 2968
dc6d1769 2969DEBUG(D_tls) post_handshake_debug(state);
059ec3d9 2970
17c76198 2971/* Verify late */
059ec3d9 2972
899b8bbc 2973if (!verify_certificate(state, errstr))
74f1a423
JH
2974 {
2975 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
c05bdbd6 2976 return FALSE;
74f1a423 2977 }
059ec3d9 2978
f2de3a33 2979#ifndef DISABLE_OCSP
7a501c87 2980if (request_ocsp)
2b4a568d
JH
2981 {
2982 DEBUG(D_tls)
2983 {
2984 gnutls_datum_t stapling;
2985 gnutls_ocsp_resp_t resp;
2986 gnutls_datum_t printed;
e326959e
JH
2987 unsigned idx = 0;
2988
2989 for (;
2990# ifdef GNUTLS_OCSP_STATUS_REQUEST_GET2
2991 (rc = gnutls_ocsp_status_request_get2(state->session, idx, &stapling)) == 0;
2992#else
2993 (rc = gnutls_ocsp_status_request_get(state->session, &stapling)) == 0;
2994#endif
2995 idx++)
2996 if ( (rc= gnutls_ocsp_resp_init(&resp)) == 0
2997 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2998 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_COMPACT, &printed)) == 0
2999 )
3000 {
3001 debug_printf("%.4096s", printed.data);
3002 gnutls_free(printed.data);
3003 }
3004 else
3005 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
3006 if (idx == 0 && rc)
452a164f 3007 (void) tls_error_gnu(US"ocsp decode", rc, state->host, errstr);
2b4a568d
JH
3008 }
3009
2b4a568d 3010 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2 3011 {
74f1a423
JH
3012 tlsp->ocsp = OCSP_FAILED;
3013 tls_error(US"certificate status check failed", NULL, state->host, errstr);
7a501c87
JH
3014 if (require_ocsp)
3015 return FALSE;
3016 }
3017 else
3018 {
3019 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
3020 tlsp->ocsp = OCSP_VFIED;
018058b2 3021 }
2b4a568d
JH
3022 }
3023#endif
3024
b10c87b3
JH
3025#ifdef EXPERIMENTAL_TLS_RESUME
3026tls_client_resume_posthandshake(state, tlsp, host);
3027#endif
059ec3d9 3028
4fe99a6c 3029/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 3030
9d1c15ef 3031extract_exim_vars_from_tls_state(state);
059ec3d9 3032
c05bdbd6
JH
3033cctx->tls_ctx = state;
3034return TRUE;
059ec3d9
PH
3035}
3036
3037
3038
17c76198 3039
059ec3d9 3040/*************************************************
17c76198 3041* Close down a TLS session *
059ec3d9
PH
3042*************************************************/
3043
17c76198
PP
3044/* This is also called from within a delivery subprocess forked from the
3045daemon, to shut down the TLS library, without actually doing a shutdown (which
3046would tamper with the TLS session in the parent process).
059ec3d9 3047
dec766a1 3048Arguments:
74f1a423 3049 ct_ctx client context pointer, or NULL for the one global server context
dec766a1 3050 shutdown 1 if TLS close-alert is to be sent,
afdb5e9c 3051 2 if also response to be waited for
dec766a1 3052
17c76198 3053Returns: nothing
059ec3d9
PH
3054*/
3055
17c76198 3056void
74f1a423 3057tls_close(void * ct_ctx, int shutdown)
059ec3d9 3058{
74f1a423 3059exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
bd231acd 3060tls_support * tlsp = state->tlsp;
059ec3d9 3061
bd231acd 3062if (!tlsp || tlsp->active.sock < 0) return; /* TLS was not active */
17c76198
PP
3063
3064if (shutdown)
3065 {
dec766a1
WB
3066 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3067 shutdown > 1 ? " (with response-wait)" : "");
3068
c2a1bba0 3069 ALARM(2);
dec766a1 3070 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
c2a1bba0 3071 ALARM_CLR(0);
17c76198
PP
3072 }
3073
bd231acd
JH
3074if (!ct_ctx) /* server */
3075 {
3076 receive_getc = smtp_getc;
3077 receive_getbuf = smtp_getbuf;
3078 receive_get_cache = smtp_get_cache;
3079 receive_ungetc = smtp_ungetc;
3080 receive_feof = smtp_feof;
3081 receive_ferror = smtp_ferror;
3082 receive_smtp_buffered = smtp_buffered;
3083 }
3084
17c76198 3085gnutls_deinit(state->session);
ed62aae3
HSHR
3086gnutls_certificate_free_credentials(state->x509_cred);
3087
bd231acd
JH
3088tlsp->active.sock = -1;
3089tlsp->active.tls_ctx = NULL;
3090/* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3091tls_channelbinding_b64 = NULL;
3092
17c76198 3093
b808677c 3094if (state->xfer_buffer) store_free(state->xfer_buffer);
17c76198 3095memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
059ec3d9
PH
3096}
3097
3098
3099
17c76198 3100
0d81dabc
JH
3101static BOOL
3102tls_refill(unsigned lim)
3103{
3104exim_gnutls_state_st * state = &state_server;
3105ssize_t inbytes;
3106
3107DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
3108 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
3109
f1fed05b 3110sigalrm_seen = FALSE;
c2a1bba0 3111if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4896a319
AM
3112
3113do
3114 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
3115 MIN(ssl_xfer_buffer_size, lim));
3116while (inbytes == GNUTLS_E_AGAIN);
3117
c2a1bba0 3118if (smtp_receive_timeout > 0) ALARM_CLR(0);
9723f966
JH
3119
3120if (had_command_timeout) /* set by signal handler */
3121 smtp_command_timeout_exit(); /* does not return */
3122if (had_command_sigterm)
3123 smtp_command_sigterm_exit();
3124if (had_data_timeout)
3125 smtp_data_timeout_exit();
3126if (had_data_sigint)
3127 smtp_data_sigint_exit();
3128
3129/* Timeouts do not get this far. A zero-byte return appears to mean that the
3130TLS session has been closed down, not that the socket itself has been closed
3131down. Revert to non-TLS handling. */
0d81dabc
JH
3132
3133if (sigalrm_seen)
3134 {
3135 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
8b77d27a 3136 state->xfer_error = TRUE;
0d81dabc
JH
3137 return FALSE;
3138 }
3139
3140else if (inbytes == 0)
3141 {
3142 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
bd231acd 3143 tls_close(NULL, TLS_NO_SHUTDOWN);
0d81dabc
JH
3144 return FALSE;
3145 }
3146
3147/* Handle genuine errors */
3148
3149else if (inbytes < 0)
3150 {
95f52235 3151 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
0d81dabc 3152 record_io_error(state, (int) inbytes, US"recv", NULL);
8b77d27a 3153 state->xfer_error = TRUE;
0d81dabc
JH
3154 return FALSE;
3155 }
3156#ifndef DISABLE_DKIM
3157dkim_exim_verify_feed(state->xfer_buffer, inbytes);
3158#endif
3159state->xfer_buffer_hwm = (int) inbytes;
3160state->xfer_buffer_lwm = 0;
3161return TRUE;
3162}
3163
059ec3d9
PH
3164/*************************************************
3165* TLS version of getc *
3166*************************************************/
3167
3168/* This gets the next byte from the TLS input buffer. If the buffer is empty,
3169it refills the buffer via the GnuTLS reading function.
817d9f57 3170Only used by the server-side TLS.
059ec3d9 3171
17c76198
PP
3172This feeds DKIM and should be used for all message-body reads.
3173
aded2255 3174Arguments: lim Maximum amount to read/buffer
059ec3d9
PH
3175Returns: the next character or EOF
3176*/
3177
3178int
bd8fbe36 3179tls_getc(unsigned lim)
059ec3d9 3180{
0d81dabc 3181exim_gnutls_state_st * state = &state_server;
059ec3d9 3182
0d81dabc
JH
3183if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3184 if (!tls_refill(lim))
3185 return state->xfer_error ? EOF : smtp_getc(lim);
ed62aae3 3186
0d81dabc 3187/* Something in the buffer; return next uschar */
059ec3d9 3188
0d81dabc
JH
3189return state->xfer_buffer[state->xfer_buffer_lwm++];
3190}
059ec3d9 3191
0d81dabc
JH
3192uschar *
3193tls_getbuf(unsigned * len)
3194{
3195exim_gnutls_state_st * state = &state_server;
3196unsigned size;
3197uschar * buf;
059ec3d9 3198
0d81dabc
JH
3199if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
3200 if (!tls_refill(*len))
059ec3d9 3201 {
0d81dabc
JH
3202 if (!state->xfer_error) return smtp_getbuf(len);
3203 *len = 0;
3204 return NULL;
059ec3d9 3205 }
059ec3d9 3206
0d81dabc
JH
3207if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
3208 size = *len;
3209buf = &state->xfer_buffer[state->xfer_buffer_lwm];
3210state->xfer_buffer_lwm += size;
3211*len = size;
3212return buf;
059ec3d9
PH
3213}
3214
0d81dabc 3215
584e96c6
JH
3216void
3217tls_get_cache()
3218{
9960d1e5 3219#ifndef DISABLE_DKIM
584e96c6
JH
3220exim_gnutls_state_st * state = &state_server;
3221int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
3222if (n > 0)
3223 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
584e96c6 3224#endif
9960d1e5 3225}
584e96c6 3226
059ec3d9 3227
925ac8e4
JH
3228BOOL
3229tls_could_read(void)
3230{
3231return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
3232 || gnutls_record_check_pending(state_server.session) > 0;
3233}
3234
3235
059ec3d9 3236
17c76198 3237
059ec3d9
PH
3238/*************************************************
3239* Read bytes from TLS channel *
3240*************************************************/
3241
17c76198
PP
3242/* This does not feed DKIM, so if the caller uses this for reading message body,
3243then the caller must feed DKIM.
817d9f57 3244
059ec3d9 3245Arguments:
74f1a423 3246 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
3247 buff buffer of data
3248 len size of buffer
3249
3250Returns: the number of bytes read
afdb5e9c 3251 -1 after a failed read, including EOF
059ec3d9
PH
3252*/
3253
3254int
74f1a423 3255tls_read(void * ct_ctx, uschar *buff, size_t len)
059ec3d9 3256{
74f1a423 3257exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
17c76198 3258ssize_t inbytes;
059ec3d9 3259
17c76198
PP
3260if (len > INT_MAX)
3261 len = INT_MAX;
059ec3d9 3262
17c76198
PP
3263if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
3264 DEBUG(D_tls)
3265 debug_printf("*** PROBABLY A BUG *** " \
3266 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
3267 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
3268
3269DEBUG(D_tls)
3270 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
3271 state->session, buff, len);
3272
4896a319
AM
3273do
3274 inbytes = gnutls_record_recv(state->session, buff, len);
3275while (inbytes == GNUTLS_E_AGAIN);
3276
059ec3d9
PH
3277if (inbytes > 0) return inbytes;
3278if (inbytes == 0)
3279 {
3280 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
3281 }
5fd28bb8 3282else
4896a319 3283 {
95f52235 3284 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
4896a319
AM
3285 record_io_error(state, (int)inbytes, US"recv", NULL);
3286 }
059ec3d9
PH
3287
3288return -1;
3289}
3290
3291
3292
17c76198 3293
059ec3d9
PH
3294/*************************************************
3295* Write bytes down TLS channel *
3296*************************************************/
3297
3298/*
3299Arguments:
74f1a423 3300 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
3301 buff buffer of data
3302 len number of bytes
925ac8e4 3303 more more data expected soon
059ec3d9
PH
3304
3305Returns: the number of bytes after a successful write,
3306 -1 after a failed write
3307*/
3308
3309int
74f1a423 3310tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
059ec3d9 3311{
17c76198
PP
3312ssize_t outbytes;
3313size_t left = len;
74f1a423 3314exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
925ac8e4
JH
3315#ifdef SUPPORT_CORK
3316static BOOL corked = FALSE;
3317
3318if (more && !corked) gnutls_record_cork(state->session);
3319#endif
3320
3321DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
3322 buff, left, more ? ", more" : "");
059ec3d9 3323
059ec3d9
PH
3324while (left > 0)
3325 {
17c76198
PP
3326 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
3327 buff, left);
4896a319
AM
3328
3329 do
3330 outbytes = gnutls_record_send(state->session, buff, left);
3331 while (outbytes == GNUTLS_E_AGAIN);
059ec3d9 3332
17c76198 3333 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
3334 if (outbytes < 0)
3335 {
1b76ad22 3336 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
17c76198 3337 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
3338 return -1;
3339 }
3340 if (outbytes == 0)
3341 {
17c76198 3342 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
3343 return -1;