TLS: Increase RSA keysize of autogen selfsign cert
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
6aa6fc9c 16Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17c76198 17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
184384c3 42
a5f239e4
PP
43/* needed to disable PKCS11 autoload unless requested */
44#if GNUTLS_VERSION_NUMBER >= 0x020c00
45# include <gnutls/pkcs11.h>
76075bb5 46# define SUPPORT_PARAM_TO_PK_BITS
a5f239e4 47#endif
7e07527a
JH
48#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50# define DISABLE_OCSP
51#endif
0cbf2b82 52#if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
774ef2d7 53# warning "GnuTLS library version too old; tls:cert event unsupported"
0cbf2b82 54# define DISABLE_EVENT
a7538db1 55#endif
a7fec7a7
JH
56#if GNUTLS_VERSION_NUMBER >= 0x030306
57# define SUPPORT_CA_DIR
58#else
59# undef SUPPORT_CA_DIR
60#endif
11a04b5a 61#if GNUTLS_VERSION_NUMBER >= 0x030014
cb1d7830
JH
62# define SUPPORT_SYSDEFAULT_CABUNDLE
63#endif
184384c3
JH
64#if GNUTLS_VERSION_NUMBER >= 0x030104
65# define GNUTLS_CERT_VFY_STATUS_PRINT
66#endif
925ac8e4
JH
67#if GNUTLS_VERSION_NUMBER >= 0x030109
68# define SUPPORT_CORK
69#endif
47195144
JH
70#if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
71# define SUPPORT_SRV_OCSP_STACK
72#endif
c0635b6d
JH
73
74#ifdef SUPPORT_DANE
75# if GNUTLS_VERSION_NUMBER >= 0x030000
76# define DANESSL_USAGE_DANE_TA 2
77# define DANESSL_USAGE_DANE_EE 3
78# else
79# error GnuTLS version too early for DANE
80# endif
81# if GNUTLS_VERSION_NUMBER < 0x999999
82# define GNUTLS_BROKEN_DANE_VALIDATION
83# endif
899b8bbc 84#endif
7e07527a 85
f2de3a33 86#ifndef DISABLE_OCSP
2b4a568d
JH
87# include <gnutls/ocsp.h>
88#endif
899b8bbc
JH
89#ifdef SUPPORT_DANE
90# include <gnutls/dane.h>
91#endif
059ec3d9 92
17c76198 93/* GnuTLS 2 vs 3
059ec3d9 94
17c76198
PP
95GnuTLS 3 only:
96 gnutls_global_set_audit_log_function()
059ec3d9 97
17c76198
PP
98Changes:
99 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
100*/
059ec3d9 101
17c76198 102/* Local static variables for GnuTLS */
059ec3d9 103
17c76198 104/* Values for verify_requirement */
059ec3d9 105
e51c7be2 106enum peer_verify_requirement
899b8bbc 107 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
059ec3d9 108
17c76198
PP
109/* This holds most state for server or client; with this, we can set up an
110outbound TLS-enabled connection in an ACL callout, while not stomping all
111over the TLS variables available for expansion.
059ec3d9 112
17c76198
PP
113Some of these correspond to variables in globals.c; those variables will
114be set to point to content in one of these instances, as appropriate for
115the stage of the process lifetime.
059ec3d9 116
389ca47a 117Not handled here: global tls_channelbinding_b64.
17c76198 118*/
059ec3d9 119
17c76198 120typedef struct exim_gnutls_state {
9d1c15ef 121 gnutls_session_t session;
17c76198 122 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 123 gnutls_priority_t priority_cache;
17c76198 124 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
125 int fd_in;
126 int fd_out;
127 BOOL peer_cert_verified;
899b8bbc 128 BOOL peer_dane_verified;
9d1c15ef
JH
129 BOOL trigger_sni_changes;
130 BOOL have_set_peerdn;
5fd28bb8 131 const struct host_item *host; /* NULL if server */
afdb5e9c 132 gnutls_x509_crt_t peercert;
9d1c15ef
JH
133 uschar *peerdn;
134 uschar *ciphersuite;
135 uschar *received_sni;
17c76198
PP
136
137 const uschar *tls_certificate;
138 const uschar *tls_privatekey;
139 const uschar *tls_sni; /* client send only, not received */
140 const uschar *tls_verify_certificates;
141 const uschar *tls_crl;
142 const uschar *tls_require_ciphers;
e51c7be2 143
17c76198
PP
144 uschar *exp_tls_certificate;
145 uschar *exp_tls_privatekey;
17c76198
PP
146 uschar *exp_tls_verify_certificates;
147 uschar *exp_tls_crl;
148 uschar *exp_tls_require_ciphers;
55414b25 149 const uschar *exp_tls_verify_cert_hostnames;
0cbf2b82 150#ifndef DISABLE_EVENT
a7538db1
JH
151 uschar *event_action;
152#endif
899b8bbc
JH
153#ifdef SUPPORT_DANE
154 char * const * dane_data;
155 const int * dane_data_len;
156#endif
17c76198 157
389ca47a 158 tls_support *tlsp; /* set in tls_init() */
817d9f57 159
17c76198
PP
160 uschar *xfer_buffer;
161 int xfer_buffer_lwm;
162 int xfer_buffer_hwm;
8b77d27a
JH
163 BOOL xfer_eof; /*XXX never gets set! */
164 BOOL xfer_error;
17c76198
PP
165} exim_gnutls_state_st;
166
167static const exim_gnutls_state_st exim_gnutls_state_init = {
f2ed27cf
JH
168 .session = NULL,
169 .x509_cred = NULL,
170 .priority_cache = NULL,
171 .verify_requirement = VERIFY_NONE,
172 .fd_in = -1,
173 .fd_out = -1,
174 .peer_cert_verified = FALSE,
899b8bbc 175 .peer_dane_verified = FALSE,
f2ed27cf
JH
176 .trigger_sni_changes =FALSE,
177 .have_set_peerdn = FALSE,
178 .host = NULL,
179 .peercert = NULL,
180 .peerdn = NULL,
181 .ciphersuite = NULL,
182 .received_sni = NULL,
183
184 .tls_certificate = NULL,
185 .tls_privatekey = NULL,
186 .tls_sni = NULL,
187 .tls_verify_certificates = NULL,
188 .tls_crl = NULL,
189 .tls_require_ciphers =NULL,
190
191 .exp_tls_certificate = NULL,
192 .exp_tls_privatekey = NULL,
193 .exp_tls_verify_certificates = NULL,
194 .exp_tls_crl = NULL,
195 .exp_tls_require_ciphers = NULL,
f2ed27cf 196 .exp_tls_verify_cert_hostnames = NULL,
0cbf2b82 197#ifndef DISABLE_EVENT
f2ed27cf 198 .event_action = NULL,
a7538db1 199#endif
f2ed27cf
JH
200 .tlsp = NULL,
201
202 .xfer_buffer = NULL,
203 .xfer_buffer_lwm = 0,
204 .xfer_buffer_hwm = 0,
8b77d27a
JH
205 .xfer_eof = FALSE,
206 .xfer_error = FALSE,
17c76198 207};
83da1223 208
17c76198
PP
209/* Not only do we have our own APIs which don't pass around state, assuming
210it's held in globals, GnuTLS doesn't appear to let us register callback data
211for callbacks, or as part of the session, so we have to keep a "this is the
212context we're currently dealing with" pointer and rely upon being
213single-threaded to keep from processing data on an inbound TLS connection while
214talking to another TLS connection for an outbound check. This does mean that
215there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
216second connection.
217XXX But see gnutls_session_get_ptr()
218*/
059ec3d9 219
74f1a423 220static exim_gnutls_state_st state_server;
059ec3d9 221
17c76198
PP
222/* dh_params are initialised once within the lifetime of a process using TLS;
223if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
224don't want to repeat this. */
83da1223 225
17c76198 226static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 227
17c76198 228/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 229
17c76198 230static const int ssl_session_timeout = 200;
059ec3d9 231
17c76198 232static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 233
17c76198 234/* Guard library core initialisation */
83da1223 235
17c76198 236static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 237
4fb7df6d 238#ifndef DISABLE_OCSP
9196d5bf 239static BOOL gnutls_buggy_ocsp = FALSE;
4fb7df6d 240#endif
9196d5bf 241
059ec3d9 242
17c76198 243/* ------------------------------------------------------------------------ */
17c76198 244/* macros */
83da1223 245
17c76198 246#define MAX_HOST_LEN 255
83da1223 247
17c76198
PP
248/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
249the library logging; a value less than 0 disables the calls to set up logging
ef9da2ee
JH
250callbacks. Possibly GNuTLS also looks for an environment variable
251"GNUTLS_DEBUG_LEVEL". */
2c17bb02 252#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
a7538db1 253# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 254#endif
83da1223 255
2c17bb02 256#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 257# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 258#endif
83da1223 259
af3498d6
PP
260/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
261can ask for a bit-strength. Without that, we stick to the constant we had
262before, for now. */
2c17bb02 263#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 264# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 265#endif
af3498d6 266
47195144
JH
267#define exim_gnutls_err_check(rc, Label) do { \
268 if ((rc) != GNUTLS_E_SUCCESS) \
48224640 269 return tls_error((Label), US gnutls_strerror(rc), host, errstr); \
cf0c6164 270 } while (0)
059ec3d9 271
cf0c6164
JH
272#define expand_check_tlsvar(Varname, errstr) \
273 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
83da1223 274
17c76198 275#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
276# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
277# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
278# define HAVE_GNUTLS_RND
2519e60d
TL
279/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
280 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
281 * isn't available sometimes, so this needs to become a conditional
282 * compilation; the sanest way to deal with this being a problem on
283 * older OSes is to block it in the Local/Makefile with this compiler
284 * definition */
e51c7be2
JH
285# ifndef AVOID_GNUTLS_PKCS11
286# define HAVE_GNUTLS_PKCS11
287# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 288#endif
83da1223 289
af3498d6
PP
290
291
292
293/* ------------------------------------------------------------------------ */
294/* Callback declarations */
295
296#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
297static void exim_gnutls_logger_cb(int level, const char *message);
298#endif
299
300static int exim_sni_handling_cb(gnutls_session_t session);
301
f2de3a33 302#ifndef DISABLE_OCSP
44662487
JH
303static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
304 gnutls_datum_t * ocsp_response);
305#endif
af3498d6
PP
306
307
308
17c76198
PP
309/* ------------------------------------------------------------------------ */
310/* Static functions */
059ec3d9
PH
311
312/*************************************************
313* Handle TLS error *
314*************************************************/
315
316/* Called from lots of places when errors occur before actually starting to do
317the TLS handshake, that is, while the session is still in clear. Always returns
318DEFER for a server and FAIL for a client so that most calls can use "return
319tls_error(...)" to do this processing and then give an appropriate return. A
320single function is used for both server and client, because it is called from
321some shared functions.
322
323Argument:
324 prefix text to include in the logged error
7199e1ee
TF
325 msg additional error string (may be NULL)
326 usually obtained from gnutls_strerror()
17c76198
PP
327 host NULL if setting up a server;
328 the connected host if setting up a client
cf0c6164 329 errstr pointer to returned error string
059ec3d9
PH
330
331Returns: OK/DEFER/FAIL
332*/
333
334static int
48224640 335tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
cf0c6164 336 uschar ** errstr)
059ec3d9 337{
cf0c6164 338if (errstr)
48224640 339 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
cf0c6164 340return host ? FAIL : DEFER;
059ec3d9
PH
341}
342
343
344
17c76198 345
059ec3d9 346/*************************************************
17c76198 347* Deal with logging errors during I/O *
059ec3d9
PH
348*************************************************/
349
17c76198 350/* We have to get the identity of the peer from saved data.
059ec3d9 351
17c76198
PP
352Argument:
353 state the current GnuTLS exim state container
354 rc the GnuTLS error code, or 0 if it's a local error
355 when text identifying read or write
356 text local error text when ec is 0
059ec3d9 357
17c76198 358Returns: nothing
059ec3d9
PH
359*/
360
17c76198
PP
361static void
362record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 363{
48224640 364const uschar * msg;
cf0c6164 365uschar * errstr;
059ec3d9 366
17c76198 367if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
48224640 368 msg = string_sprintf("%s: %s", US gnutls_strerror(rc),
17c76198
PP
369 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
370else
48224640 371 msg = US gnutls_strerror(rc);
059ec3d9 372
cf0c6164
JH
373(void) tls_error(when, msg, state->host, &errstr);
374
375if (state->host)
376 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
377 state->host->name, state->host->address, errstr);
378else
379 {
380 uschar * conn_info = smtp_get_connection_info();
381 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
382 /* I'd like to get separated H= here, but too hard for now */
383 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
384 }
17c76198 385}
059ec3d9 386
059ec3d9 387
059ec3d9 388
059ec3d9 389
17c76198
PP
390/*************************************************
391* Set various Exim expansion vars *
392*************************************************/
059ec3d9 393
e51c7be2
JH
394#define exim_gnutls_cert_err(Label) \
395 do \
396 { \
397 if (rc != GNUTLS_E_SUCCESS) \
398 { \
399 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
400 (Label), gnutls_strerror(rc)); \
401 return rc; \
402 } \
403 } while (0)
9d1c15ef
JH
404
405static int
27f19eb4 406import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
9d1c15ef
JH
407{
408int rc;
409
410rc = gnutls_x509_crt_init(crtp);
411exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
412
413rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
414exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
415
416return rc;
417}
418
419#undef exim_gnutls_cert_err
420
421
17c76198
PP
422/* We set various Exim global variables from the state, once a session has
423been established. With TLS callouts, may need to change this to stack
424variables, or just re-call it with the server state after client callout
425has finished.
059ec3d9 426
9d1c15ef 427Make sure anything set here is unset in tls_getc().
17c76198
PP
428
429Sets:
430 tls_active fd
431 tls_bits strength indicator
432 tls_certificate_verified bool indicator
433 tls_channelbinding_b64 for some SASL mechanisms
434 tls_cipher a string
9d1c15ef 435 tls_peercert pointer to library internal
17c76198
PP
436 tls_peerdn a string
437 tls_sni a (UTF-8) string
9d1c15ef 438 tls_ourcert pointer to library internal
17c76198
PP
439
440Argument:
441 state the relevant exim_gnutls_state_st *
442*/
443
444static void
9d1c15ef 445extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 446{
17c76198 447gnutls_cipher_algorithm_t cipher;
17c76198
PP
448#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
449int old_pool;
450int rc;
451gnutls_datum_t channel;
452#endif
9d1c15ef 453tls_support * tlsp = state->tlsp;
17c76198 454
74f1a423
JH
455tlsp->active.sock = state->fd_out;
456tlsp->active.tls_ctx = state;
17c76198
PP
457
458cipher = gnutls_cipher_get(state->session);
459/* returns size in "bytes" */
9d1c15ef 460tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 461
9d1c15ef 462tlsp->cipher = state->ciphersuite;
17c76198 463
817d9f57 464DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 465
9d1c15ef 466tlsp->certificate_verified = state->peer_cert_verified;
899b8bbc
JH
467#ifdef SUPPORT_DANE
468tlsp->dane_verified = state->peer_dane_verified;
469#endif
059ec3d9 470
17c76198
PP
471/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
472only available for use for authenticators while this TLS session is running. */
473
474tls_channelbinding_b64 = NULL;
475#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
476channel.data = NULL;
477channel.size = 0;
478rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
479if (rc) {
480 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
481} else {
482 old_pool = store_pool;
483 store_pool = POOL_PERM;
f4d091fb 484 tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
17c76198
PP
485 store_pool = old_pool;
486 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
487}
488#endif
489
9d1c15ef
JH
490/* peercert is set in peer_status() */
491tlsp->peerdn = state->peerdn;
492tlsp->sni = state->received_sni;
493
494/* record our certificate */
495 {
27f19eb4 496 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
9d1c15ef
JH
497 gnutls_x509_crt_t crt;
498
499 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
500 }
059ec3d9
PH
501}
502
503
504
17c76198 505
059ec3d9 506/*************************************************
575643cd 507* Setup up DH parameters *
059ec3d9
PH
508*************************************************/
509
575643cd 510/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
511be re-generated every so often, depending on security policy. What we do is to
512keep these parameters in a file in the spool directory. If the file does not
513exist, we generate them. This means that it is easy to cause a regeneration.
514
515The new file is written as a temporary file and renamed, so that an incomplete
516file is never present. If two processes both compute some new parameters, you
517waste a bit of effort, but it doesn't seem worth messing around with locking to
518prevent this.
519
059ec3d9
PH
520Returns: OK/DEFER/FAIL
521*/
522
523static int
cf0c6164 524init_server_dh(uschar ** errstr)
059ec3d9 525{
17c76198
PP
526int fd, rc;
527unsigned int dh_bits;
27f19eb4 528gnutls_datum_t m;
a799883d
PP
529uschar filename_buf[PATH_MAX];
530uschar *filename = NULL;
17c76198 531size_t sz;
a799883d
PP
532uschar *exp_tls_dhparam;
533BOOL use_file_in_spool = FALSE;
534BOOL use_fixed_file = FALSE;
17c76198 535host_item *host = NULL; /* dummy for macros */
059ec3d9 536
17c76198 537DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 538
17c76198 539rc = gnutls_dh_params_init(&dh_server_params);
47195144 540exim_gnutls_err_check(rc, US"gnutls_dh_params_init");
059ec3d9 541
a799883d
PP
542m.data = NULL;
543m.size = 0;
544
cf0c6164 545if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
a799883d
PP
546 return DEFER;
547
548if (!exp_tls_dhparam)
549 {
550 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
551 m.data = US std_dh_prime_default();
552 m.size = Ustrlen(m.data);
553 }
554else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
555 use_file_in_spool = TRUE;
556else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
557 {
558 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
559 return OK;
560 }
561else if (exp_tls_dhparam[0] != '/')
562 {
f5d25c2b 563 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
48224640 564 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
a799883d
PP
565 m.size = Ustrlen(m.data);
566 }
567else
568 {
569 use_fixed_file = TRUE;
570 filename = exp_tls_dhparam;
571 }
572
573if (m.data)
574 {
575 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
47195144 576 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
a799883d
PP
577 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
578 return OK;
579 }
580
af3498d6
PP
581#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
582/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
583different filename and ensure we have sufficient bits. */
584dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
585if (!dh_bits)
cf0c6164 586 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
af3498d6 587DEBUG(D_tls)
b34fc30c 588 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
589 dh_bits);
590#else
591dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
592DEBUG(D_tls)
593 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
594 dh_bits);
595#endif
059ec3d9 596
3375e053
PP
597/* Some clients have hard-coded limits. */
598if (dh_bits > tls_dh_max_bits)
599 {
600 DEBUG(D_tls)
601 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
602 tls_dh_max_bits);
603 dh_bits = tls_dh_max_bits;
604 }
605
a799883d
PP
606if (use_file_in_spool)
607 {
608 if (!string_format(filename_buf, sizeof(filename_buf),
609 "%s/gnutls-params-%d", spool_directory, dh_bits))
cf0c6164 610 return tls_error(US"overlong filename", NULL, NULL, errstr);
a799883d
PP
611 filename = filename_buf;
612 }
059ec3d9 613
b5aea5e1 614/* Open the cache file for reading and if successful, read it and set up the
575643cd 615parameters. */
059ec3d9 616
f5d25c2b 617if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
059ec3d9 618 {
b5aea5e1 619 struct stat statbuf;
17c76198
PP
620 FILE *fp;
621 int saved_errno;
622
623 if (fstat(fd, &statbuf) < 0) /* EIO */
624 {
625 saved_errno = errno;
626 (void)close(fd);
48224640 627 return tls_error(US"TLS cache stat failed", US strerror(saved_errno), NULL, errstr);
17c76198
PP
628 }
629 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
630 {
631 (void)close(fd);
cf0c6164 632 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
17c76198 633 }
40c90bca 634 if (!(fp = fdopen(fd, "rb")))
17c76198
PP
635 {
636 saved_errno = errno;
637 (void)close(fd);
638 return tls_error(US"fdopen(TLS cache stat fd) failed",
48224640 639 US strerror(saved_errno), NULL, errstr);
b5aea5e1 640 }
059ec3d9 641
b5aea5e1 642 m.size = statbuf.st_size;
40c90bca 643 if (!(m.data = malloc(m.size)))
17c76198
PP
644 {
645 fclose(fp);
48224640 646 return tls_error(US"malloc failed", US strerror(errno), NULL, errstr);
17c76198 647 }
40c90bca 648 if (!(sz = fread(m.data, m.size, 1, fp)))
17c76198
PP
649 {
650 saved_errno = errno;
651 fclose(fp);
652 free(m.data);
48224640 653 return tls_error(US"fread failed", US strerror(saved_errno), NULL, errstr);
17c76198
PP
654 }
655 fclose(fp);
b5aea5e1 656
17c76198 657 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 658 free(m.data);
47195144 659 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
17c76198 660 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
661 }
662
663/* If the file does not exist, fall through to compute new data and cache it.
664If there was any other opening error, it is serious. */
665
182ad5cf
PH
666else if (errno == ENOENT)
667 {
17c76198 668 rc = -1;
182ad5cf 669 DEBUG(D_tls)
17c76198 670 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
671 }
672else
17c76198 673 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
cf0c6164 674 NULL, NULL, errstr);
b5aea5e1
PH
675
676/* If ret < 0, either the cache file does not exist, or the data it contains
677is not useful. One particular case of this is when upgrading from an older
678release of Exim in which the data was stored in a different format. We don't
679try to be clever and support both formats; we just regenerate new data in this
680case. */
681
17c76198 682if (rc < 0)
b5aea5e1 683 {
17c76198 684 uschar *temp_fn;
201f5254 685 unsigned int dh_bits_gen = dh_bits;
059ec3d9 686
17c76198
PP
687 if ((PATH_MAX - Ustrlen(filename)) < 10)
688 return tls_error(US"Filename too long to generate replacement",
48224640 689 filename, NULL, errstr);
059ec3d9 690
48224640 691 temp_fn = string_copy(US"%s.XXXXXXX");
f5d25c2b 692 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
48224640 693 return tls_error(US"Unable to open temp file", US strerror(errno), NULL, errstr);
059ec3d9
PH
694 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
695
201f5254
PP
696 /* GnuTLS overshoots!
697 * If we ask for 2236, we might get 2237 or more.
698 * But there's no way to ask GnuTLS how many bits there really are.
699 * We can ask how many bits were used in a TLS session, but that's it!
700 * The prime itself is hidden behind too much abstraction.
701 * So we ask for less, and proceed on a wing and a prayer.
702 * First attempt, subtracted 3 for 2233 and got 2240.
703 */
cae6e576 704 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
705 {
706 dh_bits_gen = dh_bits - 10;
707 DEBUG(D_tls)
708 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
709 dh_bits_gen);
710 }
711
712 DEBUG(D_tls)
713 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
714 dh_bits_gen);
715 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
47195144 716 exim_gnutls_err_check(rc, US"gnutls_dh_params_generate2");
17c76198
PP
717
718 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
719 and I confirmed that a NULL call to get the size first is how the GnuTLS
720 sample apps handle this. */
721
722 sz = 0;
723 m.data = NULL;
724 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
725 m.data, &sz);
726 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
47195144 727 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3(NULL) sizing");
17c76198 728 m.size = sz;
40c90bca 729 if (!(m.data = malloc(m.size)))
48224640 730 return tls_error(US"memory allocation failed", US strerror(errno), NULL, errstr);
40c90bca 731
1f00591e 732 /* this will return a size 1 less than the allocation size above */
17c76198 733 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 734 m.data, &sz);
17c76198
PP
735 if (rc != GNUTLS_E_SUCCESS)
736 {
737 free(m.data);
47195144 738 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3() real");
17c76198 739 }
1f00591e 740 m.size = sz; /* shrink by 1, probably */
059ec3d9 741
f5d25c2b 742 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
17c76198
PP
743 {
744 free(m.data);
745 return tls_error(US"TLS cache write D-H params failed",
48224640 746 US strerror(errno), NULL, errstr);
17c76198 747 }
b5aea5e1 748 free(m.data);
f5d25c2b 749 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
17c76198 750 return tls_error(US"TLS cache write D-H params final newline failed",
48224640 751 US strerror(errno), NULL, errstr);
17c76198 752
f5d25c2b 753 if ((rc = close(fd)))
48224640 754 return tls_error(US"TLS cache write close() failed", US strerror(errno), NULL, errstr);
059ec3d9 755
17c76198
PP
756 if (Urename(temp_fn, filename) < 0)
757 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
48224640 758 temp_fn, filename), US strerror(errno), NULL, errstr);
059ec3d9 759
17c76198 760 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
761 }
762
17c76198 763DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
764return OK;
765}
766
767
768
769
23bb6982
JH
770/* Create and install a selfsigned certificate, for use in server mode */
771
772static int
cf0c6164 773tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
23bb6982
JH
774{
775gnutls_x509_crt_t cert = NULL;
776time_t now;
777gnutls_x509_privkey_t pkey = NULL;
778const uschar * where;
779int rc;
780
781where = US"initialising pkey";
782if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
783
784where = US"initialising cert";
785if ((rc = gnutls_x509_crt_init(&cert))) goto err;
786
787where = US"generating pkey";
788if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
76075bb5 789#ifdef SUPPORT_PARAM_TO_PK_BITS
6aac3239 790 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
76075bb5 791#else
6aac3239 792 2048,
76075bb5
JH
793#endif
794 0)))
23bb6982
JH
795 goto err;
796
797where = US"configuring cert";
1613fd68 798now = 1;
23bb6982
JH
799if ( (rc = gnutls_x509_crt_set_version(cert, 3))
800 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
801 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
802 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
803 || (rc = gnutls_x509_crt_set_key(cert, pkey))
804
805 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
806 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
807 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
808 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
809 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
810 GNUTLS_OID_X520_COMMON_NAME, 0,
811 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
812 )
813 goto err;
814
815where = US"signing cert";
816if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
817
818where = US"installing selfsign cert";
819 /* Since: 2.4.0 */
820if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
821 goto err;
822
823rc = OK;
824
825out:
826 if (cert) gnutls_x509_crt_deinit(cert);
827 if (pkey) gnutls_x509_privkey_deinit(pkey);
828 return rc;
829
830err:
48224640 831 rc = tls_error(where, US gnutls_strerror(rc), NULL, errstr);
23bb6982
JH
832 goto out;
833}
834
835
836
837
47195144
JH
838/* Add certificate and key, from files.
839
840Return:
841 Zero or negative: good. Negate value for certificate index if < 0.
842 Greater than zero: FAIL or DEFER code.
843*/
844
ba86e143
JH
845static int
846tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
847 uschar * certfile, uschar * keyfile, uschar ** errstr)
848{
849int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
850 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
47195144
JH
851if (rc < 0)
852 return tls_error(
853 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
48224640 854 US gnutls_strerror(rc), host, errstr);
47195144 855return -rc;
ba86e143
JH
856}
857
858
059ec3d9 859/*************************************************
17c76198 860* Variables re-expanded post-SNI *
059ec3d9
PH
861*************************************************/
862
17c76198
PP
863/* Called from both server and client code, via tls_init(), and also from
864the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
865
866We can tell the two apart by state->received_sni being non-NULL in callback.
867
868The callback should not call us unless state->trigger_sni_changes is true,
869which we are responsible for setting on the first pass through.
059ec3d9
PH
870
871Arguments:
17c76198 872 state exim_gnutls_state_st *
cf0c6164 873 errstr error string pointer
059ec3d9
PH
874
875Returns: OK/DEFER/FAIL
876*/
877
878static int
ba86e143 879tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
059ec3d9 880{
1365611d 881struct stat statbuf;
059ec3d9 882int rc;
17c76198
PP
883const host_item *host = state->host; /* macro should be reconsidered? */
884uschar *saved_tls_certificate = NULL;
885uschar *saved_tls_privatekey = NULL;
886uschar *saved_tls_verify_certificates = NULL;
887uschar *saved_tls_crl = NULL;
888int cert_count;
889
890/* We check for tls_sni *before* expansion. */
2b4a568d 891if (!host) /* server */
17c76198
PP
892 if (!state->received_sni)
893 {
ba86e143
JH
894 if ( state->tls_certificate
895 && ( Ustrstr(state->tls_certificate, US"tls_sni")
896 || Ustrstr(state->tls_certificate, US"tls_in_sni")
897 || Ustrstr(state->tls_certificate, US"tls_out_sni")
898 ) )
17c76198
PP
899 {
900 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
901 state->trigger_sni_changes = TRUE;
902 }
903 }
904 else
905 {
1365611d 906 /* useful for debugging */
17c76198
PP
907 saved_tls_certificate = state->exp_tls_certificate;
908 saved_tls_privatekey = state->exp_tls_privatekey;
909 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
910 saved_tls_crl = state->exp_tls_crl;
911 }
059ec3d9 912
1365611d 913rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
47195144
JH
914exim_gnutls_err_check(rc, US"gnutls_certificate_allocate_credentials");
915
916#ifdef SUPPORT_SRV_OCSP_STACK
917gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
918#endif
1365611d 919
17c76198
PP
920/* remember: expand_check_tlsvar() is expand_check() but fiddling with
921state members, assuming consistent naming; and expand_check() returns
922false if expansion failed, unless expansion was forced to fail. */
059ec3d9 923
17c76198
PP
924/* check if we at least have a certificate, before doing expensive
925D-H generation. */
059ec3d9 926
cf0c6164 927if (!expand_check_tlsvar(tls_certificate, errstr))
17c76198 928 return DEFER;
059ec3d9 929
17c76198 930/* certificate is mandatory in server, optional in client */
059ec3d9 931
23bb6982
JH
932if ( !state->exp_tls_certificate
933 || !*state->exp_tls_certificate
934 )
2b4a568d 935 if (!host)
cf0c6164 936 return tls_install_selfsign(state, errstr);
17c76198
PP
937 else
938 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
059ec3d9 939
cf0c6164 940if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
059ec3d9
PH
941 return DEFER;
942
17c76198
PP
943/* tls_privatekey is optional, defaulting to same file as certificate */
944
945if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 946 {
17c76198
PP
947 state->tls_privatekey = state->tls_certificate;
948 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 949 }
c91535f3 950
059ec3d9 951
17c76198 952if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
953 {
954 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
955 state->exp_tls_certificate, state->exp_tls_privatekey);
956
957 if (state->received_sni)
23bb6982
JH
958 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
959 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
960 )
17c76198 961 {
b34fc30c 962 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
963 }
964 else
965 {
b34fc30c 966 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 967 }
059ec3d9 968
ba86e143
JH
969 if (!host) /* server */
970 {
971 const uschar * clist = state->exp_tls_certificate;
972 const uschar * klist = state->exp_tls_privatekey;
47195144
JH
973 const uschar * olist;
974 int csep = 0, ksep = 0, osep = 0, cnt = 0;
975 uschar * cfile, * kfile, * ofile;
976
977#ifndef DISABLE_OCSP
978 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
979 return DEFER;
980 olist = ofile;
981#endif
ba86e143
JH
982
983 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
47195144 984
ba86e143
JH
985 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
986 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
47195144 987 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
ba86e143
JH
988 return rc;
989 else
47195144
JH
990 {
991 int gnutls_cert_index = -rc;
ba86e143 992 DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile);
47195144
JH
993
994 /* Set the OCSP stapling server info */
995
996#ifndef DISABLE_OCSP
997 if (tls_ocsp_file)
998 if (gnutls_buggy_ocsp)
999 {
1000 DEBUG(D_tls)
1001 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1002 }
1003 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1004 {
1005 /* Use the full callback method for stapling just to get
1006 observability. More efficient would be to read the file once only,
1007 if it never changed (due to SNI). Would need restart on file update,
1008 or watch datestamp. */
1009
1010# ifdef SUPPORT_SRV_OCSP_STACK
1011 rc = gnutls_certificate_set_ocsp_status_request_function2(
1012 state->x509_cred, gnutls_cert_index,
1013 server_ocsp_stapling_cb, ofile);
1014
1015 exim_gnutls_err_check(rc,
1016 US"gnutls_certificate_set_ocsp_status_request_function2");
1017# else
1018 if (cnt++ > 0)
1019 {
1020 DEBUG(D_tls)
1021 debug_printf("oops; multiple OCSP files not supported\n");
1022 break;
1023 }
1024 gnutls_certificate_set_ocsp_status_request_function(
1025 state->x509_cred, server_ocsp_stapling_cb, ofile);
1026# endif
1027
1028 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile);
1029 }
1030 else
1031 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1032#endif
1033 }
ba86e143
JH
1034 }
1035 else
1036 {
47195144 1037 if (0 < (rc = tls_add_certfile(state, host,
ba86e143
JH
1038 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1039 return rc;
1040 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1041 }
1042
b34fc30c 1043 } /* tls_certificate */
059ec3d9 1044
2b4a568d 1045
059ec3d9
PH
1046/* Set the trusted CAs file if one is provided, and then add the CRL if one is
1047provided. Experiment shows that, if the certificate file is empty, an unhelpful
1048error message is provided. However, if we just refrain from setting anything up
1049in that case, certificate verification fails, which seems to be the correct
1050behaviour. */
1051
610ff438 1052if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 1053 {
cf0c6164 1054 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
059ec3d9 1055 return DEFER;
610ff438
JH
1056#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1057 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1058 state->exp_tls_verify_certificates = NULL;
1059#endif
17c76198 1060 if (state->tls_crl && *state->tls_crl)
cf0c6164 1061 if (!expand_check_tlsvar(tls_crl, errstr))
17c76198 1062 return DEFER;
059ec3d9 1063
1365611d
PP
1064 if (!(state->exp_tls_verify_certificates &&
1065 *state->exp_tls_verify_certificates))
b34fc30c
PP
1066 {
1067 DEBUG(D_tls)
1365611d
PP
1068 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1069 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 1070 return OK;
b34fc30c 1071 }
1365611d 1072 }
83e2f8a2
PP
1073else
1074 {
1075 DEBUG(D_tls)
1076 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1077 return OK;
1078 }
17c76198 1079
cb1d7830
JH
1080#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1081if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1082 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1083else
1084#endif
1365611d 1085 {
cb1d7830
JH
1086 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1087 {
1088 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1089 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1090 strerror(errno));
1091 return DEFER;
1092 }
17c76198 1093
a7fec7a7 1094#ifndef SUPPORT_CA_DIR
cb1d7830
JH
1095 /* The test suite passes in /dev/null; we could check for that path explicitly,
1096 but who knows if someone has some weird FIFO which always dumps some certs, or
1097 other weirdness. The thing we really want to check is that it's not a
1098 directory, since while OpenSSL supports that, GnuTLS does not.
60f914bc 1099 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
cb1d7830
JH
1100 if (S_ISDIR(statbuf.st_mode))
1101 {
1102 DEBUG(D_tls)
1103 debug_printf("verify certificates path is a dir: \"%s\"\n",
1104 state->exp_tls_verify_certificates);
1105 log_write(0, LOG_MAIN|LOG_PANIC,
1106 "tls_verify_certificates \"%s\" is a directory",
1107 state->exp_tls_verify_certificates);
1108 return DEFER;
1109 }
a7fec7a7 1110#endif
059ec3d9 1111
cb1d7830
JH
1112 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1113 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 1114
cb1d7830
JH
1115 if (statbuf.st_size == 0)
1116 {
1117 DEBUG(D_tls)
1118 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1119 return OK;
1120 }
059ec3d9 1121
cb1d7830 1122 cert_count =
a7fec7a7
JH
1123
1124#ifdef SUPPORT_CA_DIR
cb1d7830
JH
1125 (statbuf.st_mode & S_IFMT) == S_IFDIR
1126 ?
1127 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1128 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1129 :
a7fec7a7 1130#endif
cb1d7830
JH
1131 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1132 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1133 }
a7fec7a7 1134
1365611d
PP
1135if (cert_count < 0)
1136 {
1137 rc = cert_count;
47195144 1138 exim_gnutls_err_check(rc, US"setting certificate trust");
1365611d
PP
1139 }
1140DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 1141
5c8cda3a
PP
1142if (state->tls_crl && *state->tls_crl &&
1143 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 1144 {
5c8cda3a
PP
1145 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1146 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1147 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1148 if (cert_count < 0)
1365611d 1149 {
5c8cda3a 1150 rc = cert_count;
47195144 1151 exim_gnutls_err_check(rc, US"gnutls_certificate_set_x509_crl_file");
1365611d 1152 }
5c8cda3a 1153 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 1154 }
059ec3d9 1155
059ec3d9
PH
1156return OK;
1157}
1158
1159
1160
1161
1162/*************************************************
1365611d
PP
1163* Set X.509 state variables *
1164*************************************************/
1165
1166/* In GnuTLS, the registered cert/key are not replaced by a later
1167set of a cert/key, so for SNI support we need a whole new x509_cred
1168structure. Which means various other non-re-expanded pieces of state
1169need to be re-set in the new struct, so the setting logic is pulled
1170out to this.
1171
1172Arguments:
1173 state exim_gnutls_state_st *
cf0c6164 1174 errstr error string pointer
1365611d
PP
1175
1176Returns: OK/DEFER/FAIL
1177*/
1178
1179static int
cf0c6164 1180tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1365611d
PP
1181{
1182int rc;
1183const host_item *host = state->host; /* macro should be reconsidered? */
1184
1185/* Create D-H parameters, or read them from the cache file. This function does
1186its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1187client-side params. */
1188
1189if (!state->host)
1190 {
1191 if (!dh_server_params)
1192 {
cf0c6164 1193 rc = init_server_dh(errstr);
1365611d
PP
1194 if (rc != OK) return rc;
1195 }
1196 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1197 }
1198
1199/* Link the credentials to the session. */
1200
1201rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
47195144 1202exim_gnutls_err_check(rc, US"gnutls_credentials_set");
1365611d
PP
1203
1204return OK;
1205}
1206
1207/*************************************************
17c76198 1208* Initialize for GnuTLS *
059ec3d9
PH
1209*************************************************/
1210
9196d5bf 1211
4fb7df6d
JH
1212#ifndef DISABLE_OCSP
1213
9196d5bf
JH
1214static BOOL
1215tls_is_buggy_ocsp(void)
1216{
1217const uschar * s;
1218uschar maj, mid, mic;
1219
1220s = CUS gnutls_check_version(NULL);
1221maj = atoi(CCS s);
1222if (maj == 3)
1223 {
1224 while (*s && *s != '.') s++;
1225 mid = atoi(CCS ++s);
1226 if (mid <= 2)
1227 return TRUE;
1228 else if (mid >= 5)
1229 return FALSE;
1230 else
1231 {
1232 while (*s && *s != '.') s++;
1233 mic = atoi(CCS ++s);
1234 return mic <= (mid == 3 ? 16 : 3);
1235 }
1236 }
1237return FALSE;
1238}
1239
4fb7df6d 1240#endif
9196d5bf
JH
1241
1242
17c76198
PP
1243/* Called from both server and client code. In the case of a server, errors
1244before actual TLS negotiation return DEFER.
059ec3d9
PH
1245
1246Arguments:
17c76198
PP
1247 host connected host, if client; NULL if server
1248 certificate certificate file
1249 privatekey private key file
1250 sni TLS SNI to send, sometimes when client; else NULL
1251 cas CA certs file
1252 crl CRL file
1253 require_ciphers tls_require_ciphers setting
817d9f57 1254 caller_state returned state-info structure
cf0c6164 1255 errstr error string pointer
059ec3d9 1256
17c76198 1257Returns: OK/DEFER/FAIL
059ec3d9
PH
1258*/
1259
17c76198
PP
1260static int
1261tls_init(
1262 const host_item *host,
1263 const uschar *certificate,
1264 const uschar *privatekey,
1265 const uschar *sni,
1266 const uschar *cas,
1267 const uschar *crl,
1268 const uschar *require_ciphers,
cf0c6164 1269 exim_gnutls_state_st **caller_state,
74f1a423 1270 tls_support * tlsp,
cf0c6164 1271 uschar ** errstr)
059ec3d9 1272{
17c76198
PP
1273exim_gnutls_state_st *state;
1274int rc;
1275size_t sz;
1276const char *errpos;
1277uschar *p;
1278BOOL want_default_priorities;
1279
1280if (!exim_gnutls_base_init_done)
059ec3d9 1281 {
17c76198
PP
1282 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1283
a5f239e4
PP
1284#ifdef HAVE_GNUTLS_PKCS11
1285 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1286 which loads modules from a config file, which sounds good and may be wanted
1287 by some sysadmin, but also means in common configurations that GNOME keyring
1288 environment variables are used and so breaks for users calling mailq.
1289 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1290 if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
1291 {
1292 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
47195144 1293 exim_gnutls_err_check(rc, US"gnutls_pkcs11_init");
a5f239e4
PP
1294 }
1295#endif
1296
17c76198 1297 rc = gnutls_global_init();
47195144 1298 exim_gnutls_err_check(rc, US"gnutls_global_init");
17c76198
PP
1299
1300#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1301 DEBUG(D_tls)
059ec3d9 1302 {
17c76198
PP
1303 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1304 /* arbitrarily chosen level; bump upto 9 for more */
1305 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1306 }
17c76198
PP
1307#endif
1308
4fb7df6d
JH
1309#ifndef DISABLE_OCSP
1310 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
9196d5bf 1311 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
4fb7df6d 1312#endif
9196d5bf 1313
17c76198 1314 exim_gnutls_base_init_done = TRUE;
059ec3d9 1315 }
059ec3d9 1316
17c76198
PP
1317if (host)
1318 {
74f1a423
JH
1319 /* For client-side sessions we allocate a context. This lets us run
1320 several in parallel. */
1321 int old_pool = store_pool;
1322 store_pool = POOL_PERM;
1323 state = store_get(sizeof(exim_gnutls_state_st));
1324 store_pool = old_pool;
1325
17c76198 1326 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1327 state->tlsp = tlsp;
17c76198
PP
1328 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1329 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1330 }
1331else
1332 {
1333 state = &state_server;
1334 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1335 state->tlsp = tlsp;
17c76198
PP
1336 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1337 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1338 }
47195144 1339exim_gnutls_err_check(rc, US"gnutls_init");
059ec3d9 1340
17c76198 1341state->host = host;
059ec3d9 1342
17c76198
PP
1343state->tls_certificate = certificate;
1344state->tls_privatekey = privatekey;
5779e6aa 1345state->tls_require_ciphers = require_ciphers;
17c76198
PP
1346state->tls_sni = sni;
1347state->tls_verify_certificates = cas;
1348state->tls_crl = crl;
059ec3d9 1349
17c76198
PP
1350/* This handles the variables that might get re-expanded after TLS SNI;
1351that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1352
17c76198
PP
1353DEBUG(D_tls)
1354 debug_printf("Expanding various TLS configuration options for session credentials.\n");
cf0c6164 1355if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
059ec3d9 1356
1365611d
PP
1357/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1358requires a new structure afterwards. */
83da1223 1359
cf0c6164 1360if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
83da1223 1361
17c76198
PP
1362/* set SNI in client, only */
1363if (host)
1364 {
cf0c6164 1365 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
17c76198 1366 return DEFER;
0df4ab80 1367 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1368 {
1369 DEBUG(D_tls)
0df4ab80
JH
1370 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1371 sz = Ustrlen(state->tlsp->sni);
17c76198 1372 rc = gnutls_server_name_set(state->session,
0df4ab80 1373 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
47195144 1374 exim_gnutls_err_check(rc, US"gnutls_server_name_set");
17c76198
PP
1375 }
1376 }
1377else if (state->tls_sni)
1378 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
ba86e143 1379 "have an SNI set for a server [%s]\n", state->tls_sni);
83da1223 1380
17c76198 1381/* This is the priority string support,
42bfef1e 1382http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1383and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1384This was backwards incompatible, but means Exim no longer needs to track
1385all algorithms and provide string forms for them. */
83da1223 1386
17c76198 1387want_default_priorities = TRUE;
83da1223 1388
17c76198 1389if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1390 {
cf0c6164 1391 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
17c76198
PP
1392 return DEFER;
1393 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1394 {
17c76198
PP
1395 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1396 state->exp_tls_require_ciphers);
1397
1398 rc = gnutls_priority_init(&state->priority_cache,
1399 CS state->exp_tls_require_ciphers, &errpos);
1400 want_default_priorities = FALSE;
1401 p = state->exp_tls_require_ciphers;
83da1223
PH
1402 }
1403 }
17c76198
PP
1404if (want_default_priorities)
1405 {
83e2f8a2
PP
1406 DEBUG(D_tls)
1407 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1408 exim_default_gnutls_priority);
17c76198
PP
1409 rc = gnutls_priority_init(&state->priority_cache,
1410 exim_default_gnutls_priority, &errpos);
1411 p = US exim_default_gnutls_priority;
1412 }
83da1223 1413
47195144 1414exim_gnutls_err_check(rc, string_sprintf(
17c76198
PP
1415 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1416 p, errpos - CS p, errpos));
1417
1418rc = gnutls_priority_set(state->session, state->priority_cache);
47195144 1419exim_gnutls_err_check(rc, US"gnutls_priority_set");
17c76198
PP
1420
1421gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1422
1423/* Reduce security in favour of increased compatibility, if the admin
1424decides to make that trade-off. */
1425if (gnutls_compat_mode)
83da1223 1426 {
17c76198
PP
1427#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1428 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1429 gnutls_session_enable_compatibility_mode(state->session);
1430#else
1431 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1432#endif
83da1223
PH
1433 }
1434
17c76198 1435*caller_state = state;
17c76198 1436return OK;
83da1223
PH
1437}
1438
1439
1440
83da1223 1441/*************************************************
17c76198 1442* Extract peer information *
059ec3d9
PH
1443*************************************************/
1444
17c76198 1445/* Called from both server and client code.
4fe99a6c
PP
1446Only this is allowed to set state->peerdn and state->have_set_peerdn
1447and we use that to detect double-calls.
059ec3d9 1448
75fe387d
PP
1449NOTE: the state blocks last while the TLS connection is up, which is fine
1450for logging in the server side, but for the client side, we log after teardown
1451in src/deliver.c. While the session is up, we can twist about states and
1452repoint tls_* globals, but those variables used for logging or other variable
1453expansion that happens _after_ delivery need to have a longer life-time.
1454
1455So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1456doing this more than once per generation of a state context. We set them in
1457the state context, and repoint tls_* to them. After the state goes away, the
1458tls_* copies of the pointers remain valid and client delivery logging is happy.
1459
1460tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1461don't apply.
1462
059ec3d9 1463Arguments:
17c76198 1464 state exim_gnutls_state_st *
cf0c6164 1465 errstr pointer to error string
059ec3d9 1466
17c76198 1467Returns: OK/DEFER/FAIL
059ec3d9
PH
1468*/
1469
17c76198 1470static int
cf0c6164 1471peer_status(exim_gnutls_state_st *state, uschar ** errstr)
059ec3d9 1472{
75fe387d 1473uschar cipherbuf[256];
27f19eb4 1474const gnutls_datum_t *cert_list;
75fe387d 1475int old_pool, rc;
17c76198 1476unsigned int cert_list_size = 0;
4fe99a6c
PP
1477gnutls_protocol_t protocol;
1478gnutls_cipher_algorithm_t cipher;
1479gnutls_kx_algorithm_t kx;
1480gnutls_mac_algorithm_t mac;
17c76198
PP
1481gnutls_certificate_type_t ct;
1482gnutls_x509_crt_t crt;
4fe99a6c 1483uschar *p, *dn_buf;
17c76198 1484size_t sz;
059ec3d9 1485
4fe99a6c 1486if (state->have_set_peerdn)
17c76198 1487 return OK;
4fe99a6c 1488state->have_set_peerdn = TRUE;
059ec3d9 1489
4fe99a6c 1490state->peerdn = NULL;
059ec3d9 1491
4fe99a6c
PP
1492/* tls_cipher */
1493cipher = gnutls_cipher_get(state->session);
1494protocol = gnutls_protocol_get_version(state->session);
1495mac = gnutls_mac_get(state->session);
1496kx = gnutls_kx_get(state->session);
1497
75fe387d 1498string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1499 "%s:%s:%d",
1500 gnutls_protocol_get_name(protocol),
1501 gnutls_cipher_suite_get_name(kx, cipher, mac),
1502 (int) gnutls_cipher_get_key_size(cipher) * 8);
1503
1504/* I don't see a way that spaces could occur, in the current GnuTLS
1505code base, but it was a concern in the old code and perhaps older GnuTLS
1506releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1507for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1508 if (isspace(*p))
1509 *p = '-';
75fe387d
PP
1510old_pool = store_pool;
1511store_pool = POOL_PERM;
1512state->ciphersuite = string_copy(cipherbuf);
1513store_pool = old_pool;
817d9f57 1514state->tlsp->cipher = state->ciphersuite;
4fe99a6c
PP
1515
1516/* tls_peerdn */
17c76198 1517cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1518
17c76198
PP
1519if (cert_list == NULL || cert_list_size == 0)
1520 {
17c76198
PP
1521 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1522 cert_list, cert_list_size);
e51c7be2 1523 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1524 return tls_error(US"certificate verification failed",
48224640 1525 US"no certificate received from peer", state->host, errstr);
17c76198
PP
1526 return OK;
1527 }
059ec3d9 1528
17c76198
PP
1529ct = gnutls_certificate_type_get(state->session);
1530if (ct != GNUTLS_CRT_X509)
059ec3d9 1531 {
48224640 1532 const uschar *ctn = US gnutls_certificate_type_get_name(ct);
17c76198
PP
1533 DEBUG(D_tls)
1534 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1535 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1536 return tls_error(US"certificate verification not possible, unhandled type",
cf0c6164 1537 ctn, state->host, errstr);
17c76198 1538 return OK;
83da1223 1539 }
059ec3d9 1540
e51c7be2
JH
1541#define exim_gnutls_peer_err(Label) \
1542 do { \
1543 if (rc != GNUTLS_E_SUCCESS) \
1544 { \
1545 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1546 (Label), gnutls_strerror(rc)); \
1547 if (state->verify_requirement >= VERIFY_REQUIRED) \
48224640 1548 return tls_error((Label), US gnutls_strerror(rc), state->host, errstr); \
e51c7be2
JH
1549 return OK; \
1550 } \
1551 } while (0)
17c76198 1552
9d1c15ef
JH
1553rc = import_cert(&cert_list[0], &crt);
1554exim_gnutls_peer_err(US"cert 0");
1555
1556state->tlsp->peercert = state->peercert = crt;
17c76198 1557
17c76198
PP
1558sz = 0;
1559rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1560if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1561 {
17c76198
PP
1562 exim_gnutls_peer_err(US"getting size for cert DN failed");
1563 return FAIL; /* should not happen */
059ec3d9 1564 }
17c76198
PP
1565dn_buf = store_get_perm(sz);
1566rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1567exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1568
17c76198
PP
1569state->peerdn = dn_buf;
1570
1571return OK;
1572#undef exim_gnutls_peer_err
1573}
059ec3d9 1574
059ec3d9 1575
059ec3d9 1576
059ec3d9 1577
17c76198
PP
1578/*************************************************
1579* Verify peer certificate *
1580*************************************************/
059ec3d9 1581
17c76198
PP
1582/* Called from both server and client code.
1583*Should* be using a callback registered with
1584gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1585the peer information, but that's too new for some OSes.
059ec3d9 1586
17c76198 1587Arguments:
899b8bbc
JH
1588 state exim_gnutls_state_st *
1589 errstr where to put an error message
059ec3d9 1590
17c76198
PP
1591Returns:
1592 FALSE if the session should be rejected
1593 TRUE if the cert is okay or we just don't care
1594*/
059ec3d9 1595
17c76198 1596static BOOL
28646fa9 1597verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
17c76198
PP
1598{
1599int rc;
899b8bbc
JH
1600uint verify;
1601
1602if (state->verify_requirement == VERIFY_NONE)
1603 return TRUE;
17c76198 1604
8008accd 1605DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
cf0c6164 1606*errstr = NULL;
17c76198 1607
cf0c6164 1608if ((rc = peer_status(state, errstr)) != OK)
e6060e2c 1609 {
17c76198 1610 verify = GNUTLS_CERT_INVALID;
cf0c6164 1611 *errstr = US"certificate not supplied";
17c76198
PP
1612 }
1613else
899b8bbc
JH
1614
1615 {
1616#ifdef SUPPORT_DANE
1617 if (state->verify_requirement == VERIFY_DANE && state->host)
1618 {
1619 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1620 including talking to a DNS resolver. But we want to do that bit ourselves
1621 as the testsuite intercepts and fakes its own DNS environment. */
1622
1623 dane_state_t s;
1624 dane_query_t r;
899b8bbc 1625 uint lsize;
94c13285
JH
1626 const gnutls_datum_t * certlist =
1627 gnutls_certificate_get_peers(state->session, &lsize);
1628 int usage = tls_out.tlsa_usage;
1629
1630# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1631 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1632 dane-verification separately so that we know which selector verified;
570cb1bd 1633 then we know whether to do name-verification (needed for TA but not EE). */
94c13285
JH
1634
1635 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
bd5b3f3c 1636 { /* a mixed-usage bundle */
94c13285
JH
1637 int i, j, nrec;
1638 const char ** dd;
1639 int * ddl;
1640
1641 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1642 nrec++;
1643
1644 dd = store_get(nrec * sizeof(uschar *));
1645 ddl = store_get(nrec * sizeof(int));
1646 nrec--;
1647
1648 if ((rc = dane_state_init(&s, 0)))
1649 goto tlsa_prob;
1650
1651 for (usage = DANESSL_USAGE_DANE_EE;
1652 usage >= DANESSL_USAGE_DANE_TA; usage--)
1653 { /* take records with this usage */
1654 for (j = i = 0; i < nrec; i++)
1655 if (state->dane_data[i][0] == usage)
1656 {
1657 dd[j] = state->dane_data[i];
1658 ddl[j++] = state->dane_data_len[i];
1659 }
1660 if (j)
1661 {
1662 dd[j] = NULL;
1663 ddl[j] = 0;
1664
1665 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1666 goto tlsa_prob;
1667
1668 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1669 gnutls_certificate_type_get(state->session),
1670 r, 0,
1671 usage == DANESSL_USAGE_DANE_EE
1672 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1673 &verify)))
1674 {
1675 DEBUG(D_tls)
1676 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1677 }
1678 else if (verify == 0) /* verification passed */
1679 {
1680 usage = 1 << usage;
1681 break;
1682 }
1683 }
1684 }
899b8bbc 1685
94c13285
JH
1686 if (rc) goto tlsa_prob;
1687 }
1688 else
1689# endif
899b8bbc 1690 {
94c13285
JH
1691 if ( (rc = dane_state_init(&s, 0))
1692 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1693 1, 0))
1694 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1695 gnutls_certificate_type_get(state->session),
5ec37a55 1696 r, 0,
94c13285
JH
1697# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1698 usage == (1 << DANESSL_USAGE_DANE_EE)
1699 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1700# else
1701 0,
1702# endif
1703 &verify))
1704 )
1705 goto tlsa_prob;
899b8bbc 1706 }
94c13285
JH
1707
1708 if (verify != 0) /* verification failed */
899b8bbc
JH
1709 {
1710 gnutls_datum_t str;
1711 (void) dane_verification_status_print(verify, &str, 0);
1712 *errstr = US str.data; /* don't bother to free */
1713 goto badcert;
1714 }
28646fa9 1715
94c13285
JH
1716# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1717 /* If a TA-mode TLSA record was used for verification we must additionally
570cb1bd 1718 verify the cert name (but not the CA chain). For EE-mode, skip it. */
28646fa9 1719
94c13285
JH
1720 if (usage & (1 << DANESSL_USAGE_DANE_EE))
1721# endif
28646fa9 1722 {
570cb1bd 1723 state->peer_dane_verified = state->peer_cert_verified = TRUE;
28646fa9
JH
1724 goto goodcert;
1725 }
570cb1bd
JH
1726# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1727 /* Assume that the name on the A-record is the one that should be matching
1728 the cert. An alternate view is that the domain part of the email address
1729 is also permissible. */
1730
1731 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1732 CS state->host->name))
1733 {
1734 state->peer_dane_verified = state->peer_cert_verified = TRUE;
1735 goto goodcert;
1736 }
1737# endif
899b8bbc 1738 }
570cb1bd 1739#endif /*SUPPORT_DANE*/
899b8bbc 1740
17c76198 1741 rc = gnutls_certificate_verify_peers2(state->session, &verify);
899b8bbc 1742 }
e6060e2c 1743
899b8bbc 1744/* Handle the result of verification. INVALID is set if any others are. */
059ec3d9 1745
28646fa9 1746if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
17c76198
PP
1747 {
1748 state->peer_cert_verified = FALSE;
cf0c6164 1749 if (!*errstr)
184384c3
JH
1750 {
1751#ifdef GNUTLS_CERT_VFY_STATUS_PRINT
1752 DEBUG(D_tls)
1753 {
1754 gnutls_datum_t txt;
1755
1756 if (gnutls_certificate_verification_status_print(verify,
1757 gnutls_certificate_type_get(state->session), &txt, 0)
1758 == GNUTLS_E_SUCCESS)
1759 {
1760 debug_printf("%s\n", txt.data);
1761 gnutls_free(txt.data);
1762 }
1763 }
1764#endif
cf0c6164
JH
1765 *errstr = verify & GNUTLS_CERT_REVOKED
1766 ? US"certificate revoked" : US"certificate invalid";
184384c3 1767 }
059ec3d9 1768
17c76198 1769 DEBUG(D_tls)
e51c7be2 1770 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
cf0c6164 1771 *errstr, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1772
e51c7be2 1773 if (state->verify_requirement >= VERIFY_REQUIRED)
899b8bbc 1774 goto badcert;
17c76198 1775 DEBUG(D_tls)
4789da3a 1776 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 1777 }
e51c7be2 1778
17c76198
PP
1779else
1780 {
5fd28bb8
JH
1781 /* Client side, check the server's certificate name versus the name on the
1782 A-record for the connection we made. What to do for server side - what name
1783 to use for client? We document that there is no such checking for server
1784 side. */
1785
1786 if ( state->exp_tls_verify_cert_hostnames
1787 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1788 CS state->exp_tls_verify_cert_hostnames)
1789 )
e51c7be2 1790 {
5fd28bb8
JH
1791 DEBUG(D_tls)
1792 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1793 if (state->verify_requirement >= VERIFY_REQUIRED)
1794 goto badcert;
1795 return TRUE;
e51c7be2 1796 }
5fd28bb8 1797
17c76198 1798 state->peer_cert_verified = TRUE;
e51c7be2 1799 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 1800 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1801 }
059ec3d9 1802
28646fa9
JH
1803goodcert:
1804 state->tlsp->peerdn = state->peerdn;
1805 return TRUE;
899b8bbc 1806
b83314e3 1807#ifdef SUPPORT_DANE
94c13285 1808tlsa_prob:
624f33df
JH
1809 *errstr = string_sprintf("TLSA record problem: %s",
1810 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
b83314e3
JH
1811#endif
1812
899b8bbc
JH
1813badcert:
1814 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1815 return FALSE;
17c76198 1816}
059ec3d9 1817
17c76198
PP
1818
1819
1820
1821/* ------------------------------------------------------------------------ */
1822/* Callbacks */
1823
1824/* Logging function which can be registered with
1825 * gnutls_global_set_log_function()
1826 * gnutls_global_set_log_level() 0..9
1827 */
af3498d6 1828#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1829static void
17c76198 1830exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1831{
8c79eebf
PP
1832 size_t len = strlen(message);
1833 if (len < 1)
1834 {
1835 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1836 return;
1837 }
1838 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1839 message[len-1] == '\n' ? "" : "\n");
17c76198 1840}
af3498d6 1841#endif
059ec3d9 1842
059ec3d9 1843
17c76198
PP
1844/* Called after client hello, should handle SNI work.
1845This will always set tls_sni (state->received_sni) if available,
1846and may trigger presenting different certificates,
1847if state->trigger_sni_changes is TRUE.
059ec3d9 1848
17c76198
PP
1849Should be registered with
1850 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1851
17c76198
PP
1852"This callback must return 0 on success or a gnutls error code to terminate the
1853handshake.".
059ec3d9 1854
17c76198
PP
1855For inability to get SNI information, we return 0.
1856We only return non-zero if re-setup failed.
817d9f57 1857Only used for server-side TLS.
17c76198 1858*/
44bbabb5 1859
17c76198
PP
1860static int
1861exim_sni_handling_cb(gnutls_session_t session)
1862{
1863char sni_name[MAX_HOST_LEN];
1864size_t data_len = MAX_HOST_LEN;
817d9f57 1865exim_gnutls_state_st *state = &state_server;
17c76198
PP
1866unsigned int sni_type;
1867int rc, old_pool;
cf0c6164 1868uschar * dummy_errstr;
17c76198
PP
1869
1870rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1871if (rc != GNUTLS_E_SUCCESS)
1872 {
1873 DEBUG(D_tls) {
1874 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1875 debug_printf("TLS: no SNI presented in handshake.\n");
1876 else
1877 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1878 gnutls_strerror(rc), rc);
cf0c6164 1879 }
b34fc30c
PP
1880 return 0;
1881 }
1882
17c76198
PP
1883if (sni_type != GNUTLS_NAME_DNS)
1884 {
1885 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1886 return 0;
1887 }
44bbabb5 1888
17c76198
PP
1889/* We now have a UTF-8 string in sni_name */
1890old_pool = store_pool;
1891store_pool = POOL_PERM;
1892state->received_sni = string_copyn(US sni_name, data_len);
1893store_pool = old_pool;
1894
1895/* We set this one now so that variable expansions below will work */
817d9f57 1896state->tlsp->sni = state->received_sni;
17c76198
PP
1897
1898DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1899 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1900
1901if (!state->trigger_sni_changes)
1902 return 0;
1903
cf0c6164 1904if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
17c76198
PP
1905 {
1906 /* If the setup of certs/etc failed before handshake, TLS would not have
1907 been offered. The best we can do now is abort. */
1908 return GNUTLS_E_APPLICATION_ERROR_MIN;
1909 }
1910
cf0c6164 1911rc = tls_set_remaining_x509(state, &dummy_errstr);
1365611d
PP
1912if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1913
1914return 0;
059ec3d9
PH
1915}
1916
1917
1918
f2de3a33 1919#ifndef DISABLE_OCSP
44662487
JH
1920
1921static int
1922server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1923 gnutls_datum_t * ocsp_response)
1924{
1925int ret;
47195144 1926DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
44662487 1927
44662487
JH
1928if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1929 {
1930 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
5903c6ff 1931 CS ptr);
018058b2 1932 tls_in.ocsp = OCSP_NOT_RESP;
44662487
JH
1933 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1934 }
1935
018058b2 1936tls_in.ocsp = OCSP_VFY_NOT_TRIED;
44662487
JH
1937return 0;
1938}
1939
1940#endif
1941
1942
0cbf2b82 1943#ifndef DISABLE_EVENT
a7538db1
JH
1944/*
1945We use this callback to get observability and detail-level control
723fe533
JH
1946for an exim TLS connection (either direction), raising a tls:cert event
1947for each cert in the chain presented by the peer. Any event
a7538db1
JH
1948can deny verification.
1949
1950Return 0 for the handshake to continue or non-zero to terminate.
1951*/
1952
1953static int
723fe533 1954verify_cb(gnutls_session_t session)
a7538db1 1955{
27f19eb4 1956const gnutls_datum_t * cert_list;
a7538db1
JH
1957unsigned int cert_list_size = 0;
1958gnutls_x509_crt_t crt;
1959int rc;
b30275b8 1960uschar * yield;
a7538db1
JH
1961exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1962
bd5b3f3c 1963if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
a7538db1
JH
1964 while (cert_list_size--)
1965 {
bd5b3f3c 1966 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
a7538db1
JH
1967 {
1968 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1969 cert_list_size, gnutls_strerror(rc));
1970 break;
1971 }
1972
1973 state->tlsp->peercert = crt;
b30275b8
JH
1974 if ((yield = event_raise(state->event_action,
1975 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
1976 {
1977 log_write(0, LOG_MAIN,
b30275b8
JH
1978 "SSL verify denied by event-action: depth=%d: %s",
1979 cert_list_size, yield);
a7538db1
JH
1980 return 1; /* reject */
1981 }
1982 state->tlsp->peercert = NULL;
1983 }
1984
1985return 0;
1986}
1987
1988#endif
44662487
JH
1989
1990
17c76198
PP
1991
1992/* ------------------------------------------------------------------------ */
1993/* Exported functions */
1994
1995
1996
1997
059ec3d9
PH
1998/*************************************************
1999* Start a TLS session in a server *
2000*************************************************/
2001
2002/* This is called when Exim is running as a server, after having received
2003the STARTTLS command. It must respond to that command, and then negotiate
2004a TLS session.
2005
2006Arguments:
83da1223 2007 require_ciphers list of allowed ciphers or NULL
cf0c6164 2008 errstr pointer to error string
059ec3d9
PH
2009
2010Returns: OK on success
2011 DEFER for errors before the start of the negotiation
4c04137d 2012 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
2013 continue running.
2014*/
2015
2016int
cf0c6164 2017tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
2018{
2019int rc;
cf0c6164 2020exim_gnutls_state_st * state = NULL;
059ec3d9
PH
2021
2022/* Check for previous activation */
74f1a423 2023if (tls_in.active.sock >= 0)
059ec3d9 2024 {
48224640 2025 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
925ac8e4 2026 smtp_printf("554 Already in TLS\r\n", FALSE);
059ec3d9
PH
2027 return FAIL;
2028 }
2029
2030/* Initialize the library. If it fails, it will already have logged the error
2031and sent an SMTP response. */
2032
17c76198 2033DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 2034
cf0c6164 2035if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
17c76198 2036 NULL, tls_verify_certificates, tls_crl,
74f1a423 2037 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
059ec3d9 2038
059ec3d9
PH
2039/* If this is a host for which certificate verification is mandatory or
2040optional, set up appropriately. */
2041
059ec3d9 2042if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 2043 {
e51c7be2
JH
2044 DEBUG(D_tls)
2045 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
2046 state->verify_requirement = VERIFY_REQUIRED;
2047 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2048 }
059ec3d9 2049else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 2050 {
e51c7be2
JH
2051 DEBUG(D_tls)
2052 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
2053 state->verify_requirement = VERIFY_OPTIONAL;
2054 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2055 }
2056else
2057 {
e51c7be2
JH
2058 DEBUG(D_tls)
2059 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
2060 state->verify_requirement = VERIFY_NONE;
2061 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2062 }
059ec3d9 2063
0cbf2b82 2064#ifndef DISABLE_EVENT
723fe533
JH
2065if (event_action)
2066 {
2067 state->event_action = event_action;
2068 gnutls_session_set_ptr(state->session, state);
2069 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2070 }
2071#endif
2072
17c76198
PP
2073/* Register SNI handling; always, even if not in tls_certificate, so that the
2074expansion variable $tls_sni is always available. */
059ec3d9 2075
17c76198
PP
2076gnutls_handshake_set_post_client_hello_function(state->session,
2077 exim_sni_handling_cb);
059ec3d9
PH
2078
2079/* Set context and tell client to go ahead, except in the case of TLS startup
2080on connection, where outputting anything now upsets the clients and tends to
2081make them disconnect. We need to have an explicit fflush() here, to force out
2082the response. Other smtp_printf() calls do not need it, because in non-TLS
2083mode, the fflush() happens when smtp_getc() is called. */
2084
817d9f57 2085if (!state->tlsp->on_connect)
059ec3d9 2086 {
925ac8e4 2087 smtp_printf("220 TLS go ahead\r\n", FALSE);
9d1c15ef 2088 fflush(smtp_out);
059ec3d9
PH
2089 }
2090
2091/* Now negotiate the TLS session. We put our own timer on it, since it seems
8008accd
JH
2092that the GnuTLS library doesn't.
2093From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2094to set (and clear down afterwards) up a pull-timeout callback function that does
2095a select, so we're no better off unless avoiding signals becomes an issue. */
059ec3d9 2096
17c76198 2097gnutls_transport_set_ptr2(state->session,
27f19eb4
JH
2098 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2099 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
17c76198
PP
2100state->fd_in = fileno(smtp_in);
2101state->fd_out = fileno(smtp_out);
059ec3d9
PH
2102
2103sigalrm_seen = FALSE;
c2a1bba0 2104if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
17c76198 2105do
17c76198 2106 rc = gnutls_handshake(state->session);
157a7880 2107while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2108ALARM_CLR(0);
059ec3d9 2109
17c76198 2110if (rc != GNUTLS_E_SUCCESS)
059ec3d9 2111 {
059ec3d9
PH
2112 /* It seems that, except in the case of a timeout, we have to close the
2113 connection right here; otherwise if the other end is running OpenSSL it hangs
2114 until the server times out. */
2115
60d10ce7 2116 if (sigalrm_seen)
ad7fc6eb 2117 {
48224640 2118 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
ad7fc6eb
JH
2119 gnutls_db_remove_session(state->session);
2120 }
60d10ce7 2121 else
059ec3d9 2122 {
48224640 2123 tls_error(US"gnutls_handshake", US gnutls_strerror(rc), NULL, errstr);
f5d25c2b 2124 (void) gnutls_alert_send_appropriate(state->session, rc);
ad7fc6eb 2125 gnutls_deinit(state->session);
ed62aae3 2126 gnutls_certificate_free_credentials(state->x509_cred);
60d10ce7 2127 millisleep(500);
ad7fc6eb 2128 shutdown(state->fd_out, SHUT_WR);
60d10ce7 2129 for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--; /* drain skt */
f1e894f3
PH
2130 (void)fclose(smtp_out);
2131 (void)fclose(smtp_in);
60d10ce7 2132 smtp_out = smtp_in = NULL;
059ec3d9
PH
2133 }
2134
2135 return FAIL;
2136 }
2137
2138DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2139
17c76198
PP
2140/* Verify after the fact */
2141
899b8bbc 2142if (!verify_certificate(state, errstr))
059ec3d9 2143 {
9d1c15ef 2144 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 2145 {
cf0c6164 2146 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
9d1c15ef 2147 return FAIL;
17c76198 2148 }
9d1c15ef
JH
2149 DEBUG(D_tls)
2150 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
cf0c6164 2151 *errstr);
059ec3d9
PH
2152 }
2153
17c76198
PP
2154/* Figure out peer DN, and if authenticated, etc. */
2155
cf0c6164 2156if ((rc = peer_status(state, NULL)) != OK) return rc;
17c76198
PP
2157
2158/* Sets various Exim expansion variables; always safe within server */
2159
9d1c15ef 2160extract_exim_vars_from_tls_state(state);
059ec3d9
PH
2161
2162/* TLS has been set up. Adjust the input functions to read via TLS,
2163and initialize appropriately. */
2164
17c76198 2165state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
2166
2167receive_getc = tls_getc;
0d81dabc 2168receive_getbuf = tls_getbuf;
584e96c6 2169receive_get_cache = tls_get_cache;
059ec3d9
PH
2170receive_ungetc = tls_ungetc;
2171receive_feof = tls_feof;
2172receive_ferror = tls_ferror;
58eb016e 2173receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2174
059ec3d9
PH
2175return OK;
2176}
2177
2178
2179
2180
aa2a70ba
JH
2181static void
2182tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2183 smtp_transport_options_block * ob)
2184{
3fb3231c 2185if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 2186 {
4af0d74a 2187 state->exp_tls_verify_cert_hostnames =
8c5d388a 2188#ifdef SUPPORT_I18N
4af0d74a
JH
2189 string_domain_utf8_to_alabel(host->name, NULL);
2190#else
2191 host->name;
2192#endif
aa2a70ba
JH
2193 DEBUG(D_tls)
2194 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2195 state->exp_tls_verify_cert_hostnames);
2196 }
2197}
aa2a70ba
JH
2198
2199
899b8bbc
JH
2200
2201
2202#ifdef SUPPORT_DANE
2203/* Given our list of RRs from the TLSA lookup, build a lookup block in
2204GnuTLS-DANE's preferred format. Hang it on the state str for later
2205use in DANE verification.
2206
2207We point at the dnsa data not copy it, so it must remain valid until
2208after verification is done.*/
2209
3674140c 2210static BOOL
899b8bbc
JH
2211dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2212{
2213dns_record * rr;
2214dns_scan dnss;
2215int i;
2216const char ** dane_data;
2217int * dane_data_len;
2218
2219for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 1;
2220 rr;
2221 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2222 ) if (rr->type == T_TLSA) i++;
2223
2224dane_data = store_get(i * sizeof(uschar *));
2225dane_data_len = store_get(i * sizeof(int));
2226
2227for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 0;
2228 rr;
2229 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1b76ad22 2230 ) if (rr->type == T_TLSA && rr->size > 3)
899b8bbc
JH
2231 {
2232 const uschar * p = rr->data;
3674140c
JH
2233 uint8_t usage = p[0], sel = p[1], type = p[2];
2234
2235 DEBUG(D_tls)
2236 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2237
94c13285
JH
2238 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2239 || (sel != 0 && sel != 1)
2240 )
2241 continue;
3674140c
JH
2242 switch(type)
2243 {
2244 case 0: /* Full: cannot check at present */
2245 break;
2246 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2247 break;
2248 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2249 break;
2250 default: continue;
2251 }
899b8bbc
JH
2252
2253 tls_out.tlsa_usage |= 1<<usage;
48224640 2254 dane_data[i] = CS p;
899b8bbc
JH
2255 dane_data_len[i++] = rr->size;
2256 }
3674140c
JH
2257
2258if (!i) return FALSE;
2259
899b8bbc
JH
2260dane_data[i] = NULL;
2261dane_data_len[i] = 0;
2262
2263state->dane_data = (char * const *)dane_data;
2264state->dane_data_len = dane_data_len;
3674140c 2265return TRUE;
899b8bbc
JH
2266}
2267#endif
2268
2269
2270
059ec3d9
PH
2271/*************************************************
2272* Start a TLS session in a client *
2273*************************************************/
2274
2275/* Called from the smtp transport after STARTTLS has been accepted.
2276
2277Arguments:
2278 fd the fd of the connection
afdb5e9c 2279 host connected host (for messages and option-tests)
83da1223 2280 addr the first address (not used)
a7538db1 2281 tb transport (always smtp)
899b8bbc
JH
2282 tlsa_dnsa non-NULL, either request or require dane for this host, and
2283 a TLSA record found. Therefore, dane verify required.
2284 Which implies cert must be requested and supplied, dane
2285 verify must pass, and cert verify irrelevant (incl.
2286 hostnames), and (caller handled) require_tls
74f1a423 2287 tlsp record details of channel configuration
cf0c6164
JH
2288 errstr error string pointer
2289
74f1a423 2290Returns: Pointer to TLS session context, or NULL on error
059ec3d9
PH
2291*/
2292
74f1a423 2293void *
17c76198 2294tls_client_start(int fd, host_item *host,
f5d78688 2295 address_item *addr ARG_UNUSED,
cf0c6164 2296 transport_instance * tb,
c0635b6d 2297#ifdef SUPPORT_DANE
899b8bbc 2298 dns_answer * tlsa_dnsa,
0e66b3b6 2299#endif
74f1a423 2300 tls_support * tlsp, uschar ** errstr)
059ec3d9 2301{
afdb5e9c
JH
2302smtp_transport_options_block *ob = tb
2303 ? (smtp_transport_options_block *)tb->options_block
2304 : &smtp_transport_option_defaults;
059ec3d9 2305int rc;
899b8bbc 2306exim_gnutls_state_st * state = NULL;
5ec37a55 2307uschar *cipher_list = NULL;
74f1a423 2308
f2de3a33 2309#ifndef DISABLE_OCSP
5130845b 2310BOOL require_ocsp =
3fb3231c 2311 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
44662487 2312BOOL request_ocsp = require_ocsp ? TRUE
3fb3231c 2313 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2b4a568d 2314#endif
059ec3d9 2315
17c76198 2316DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 2317
5ec37a55 2318#ifdef SUPPORT_DANE
cf260049 2319if (tlsa_dnsa && ob->dane_require_tls_ciphers)
5ec37a55
PP
2320 {
2321 /* not using expand_check_tlsvar because not yet in state */
2322 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2323 &cipher_list, errstr))
74f1a423 2324 return NULL;
cf260049
JH
2325 cipher_list = cipher_list && *cipher_list
2326 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
5ec37a55
PP
2327 }
2328#endif
2329
2330if (!cipher_list)
2331 cipher_list = ob->tls_require_ciphers;
2332
74f1a423 2333if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
65867078 2334 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
74f1a423
JH
2335 cipher_list, &state, tlsp, errstr) != OK)
2336 return NULL;
059ec3d9 2337
54c90be1 2338 {
65867078
JH
2339 int dh_min_bits = ob->tls_dh_min_bits;
2340 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2341 {
2342 DEBUG(D_tls)
2343 debug_printf("WARNING: tls_dh_min_bits far too low,"
2344 " clamping %d up to %d\n",
2345 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2346 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2347 }
54c90be1 2348
65867078
JH
2349 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2350 " acceptable bits to %d\n",
2351 dh_min_bits);
2352 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2353 }
83da1223 2354
94431adb 2355/* Stick to the old behaviour for compatibility if tls_verify_certificates is
2b4a568d
JH
2356set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2357the specified host patterns if one of them is defined */
2358
899b8bbc 2359#ifdef SUPPORT_DANE
3674140c 2360if (tlsa_dnsa && dane_tlsa_load(state, tlsa_dnsa))
899b8bbc
JH
2361 {
2362 DEBUG(D_tls)
2363 debug_printf("TLS: server certificate DANE required.\n");
2364 state->verify_requirement = VERIFY_DANE;
2365 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
899b8bbc
JH
2366 }
2367else
2368#endif
2369 if ( ( state->exp_tls_verify_certificates
2370 && !ob->tls_verify_hosts
2371 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2372 )
3fb3231c 2373 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
899b8bbc 2374 )
17c76198 2375 {
aa2a70ba 2376 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
2377 DEBUG(D_tls)
2378 debug_printf("TLS: server certificate verification required.\n");
2379 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
2380 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2381 }
3fb3231c 2382else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
52f93eed 2383 {
aa2a70ba 2384 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
2385 DEBUG(D_tls)
2386 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 2387 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
2388 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2389 }
2390else
2391 {
e51c7be2
JH
2392 DEBUG(D_tls)
2393 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
2394 state->verify_requirement = VERIFY_NONE;
2395 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 2396 }
059ec3d9 2397
f2de3a33
JH
2398#ifndef DISABLE_OCSP
2399 /* supported since GnuTLS 3.1.3 */
44662487 2400if (request_ocsp)
9d1c15ef
JH
2401 {
2402 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
2403 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2404 NULL, 0, NULL)) != OK)
74f1a423 2405 {
48224640 2406 tls_error(US"cert-status-req", US gnutls_strerror(rc), state->host, errstr);
74f1a423
JH
2407 return NULL;
2408 }
2409 tlsp->ocsp = OCSP_NOT_RESP;
9d1c15ef 2410 }
2b4a568d
JH
2411#endif
2412
0cbf2b82 2413#ifndef DISABLE_EVENT
afdb5e9c 2414if (tb && tb->event_action)
a7538db1 2415 {
774ef2d7 2416 state->event_action = tb->event_action;
a7538db1 2417 gnutls_session_set_ptr(state->session, state);
723fe533 2418 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
2419 }
2420#endif
2421
27f19eb4 2422gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
17c76198
PP
2423state->fd_in = fd;
2424state->fd_out = fd;
059ec3d9 2425
9d1c15ef 2426DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
2427/* There doesn't seem to be a built-in timeout on connection. */
2428
2429sigalrm_seen = FALSE;
c2a1bba0 2430ALARM(ob->command_timeout);
17c76198 2431do
17c76198 2432 rc = gnutls_handshake(state->session);
f1fed05b 2433while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2434ALARM_CLR(0);
059ec3d9 2435
4fe99a6c 2436if (rc != GNUTLS_E_SUCCESS)
74f1a423 2437 {
60d10ce7
JH
2438 if (sigalrm_seen)
2439 {
2440 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
48224640 2441 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
60d10ce7
JH
2442 }
2443 else
48224640 2444 tls_error(US"gnutls_handshake", US gnutls_strerror(rc), state->host, errstr);
74f1a423
JH
2445 return NULL;
2446 }
4fe99a6c 2447
17c76198 2448DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 2449
17c76198 2450/* Verify late */
059ec3d9 2451
899b8bbc 2452if (!verify_certificate(state, errstr))
74f1a423
JH
2453 {
2454 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
2455 return NULL;
2456 }
059ec3d9 2457
f2de3a33 2458#ifndef DISABLE_OCSP
2b4a568d
JH
2459if (require_ocsp)
2460 {
2461 DEBUG(D_tls)
2462 {
2463 gnutls_datum_t stapling;
2464 gnutls_ocsp_resp_t resp;
2465 gnutls_datum_t printed;
2466 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2467 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2468 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2469 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2470 )
2471 {
65867078 2472 debug_printf("%.4096s", printed.data);
2b4a568d
JH
2473 gnutls_free(printed.data);
2474 }
2475 else
48224640 2476 (void) tls_error(US"ocsp decode", US gnutls_strerror(rc), state->host, errstr);
2b4a568d
JH
2477 }
2478
2b4a568d 2479 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2 2480 {
74f1a423
JH
2481 tlsp->ocsp = OCSP_FAILED;
2482 tls_error(US"certificate status check failed", NULL, state->host, errstr);
2483 return NULL;
018058b2 2484 }
2b4a568d 2485 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
74f1a423 2486 tlsp->ocsp = OCSP_VFIED;
2b4a568d
JH
2487 }
2488#endif
2489
17c76198 2490/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 2491
74f1a423
JH
2492if (peer_status(state, errstr) != OK)
2493 return NULL;
059ec3d9 2494
4fe99a6c 2495/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 2496
9d1c15ef 2497extract_exim_vars_from_tls_state(state);
059ec3d9 2498
74f1a423 2499return state;
059ec3d9
PH
2500}
2501
2502
2503
17c76198 2504
059ec3d9 2505/*************************************************
17c76198 2506* Close down a TLS session *
059ec3d9
PH
2507*************************************************/
2508
17c76198
PP
2509/* This is also called from within a delivery subprocess forked from the
2510daemon, to shut down the TLS library, without actually doing a shutdown (which
2511would tamper with the TLS session in the parent process).
059ec3d9 2512
dec766a1 2513Arguments:
74f1a423 2514 ct_ctx client context pointer, or NULL for the one global server context
dec766a1 2515 shutdown 1 if TLS close-alert is to be sent,
afdb5e9c 2516 2 if also response to be waited for
dec766a1 2517
17c76198 2518Returns: nothing
059ec3d9
PH
2519*/
2520
17c76198 2521void
74f1a423 2522tls_close(void * ct_ctx, int shutdown)
059ec3d9 2523{
74f1a423 2524exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
059ec3d9 2525
74f1a423 2526if (!state->tlsp || state->tlsp->active.sock < 0) return; /* TLS was not active */
17c76198
PP
2527
2528if (shutdown)
2529 {
dec766a1
WB
2530 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
2531 shutdown > 1 ? " (with response-wait)" : "");
2532
c2a1bba0 2533 ALARM(2);
dec766a1 2534 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
c2a1bba0 2535 ALARM_CLR(0);
17c76198
PP
2536 }
2537
2538gnutls_deinit(state->session);
ed62aae3
HSHR
2539gnutls_certificate_free_credentials(state->x509_cred);
2540
17c76198 2541
74f1a423
JH
2542state->tlsp->active.sock = -1;
2543state->tlsp->active.tls_ctx = NULL;
b808677c 2544if (state->xfer_buffer) store_free(state->xfer_buffer);
17c76198 2545memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
059ec3d9
PH
2546}
2547
2548
2549
17c76198 2550
0d81dabc
JH
2551static BOOL
2552tls_refill(unsigned lim)
2553{
2554exim_gnutls_state_st * state = &state_server;
2555ssize_t inbytes;
2556
2557DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2558 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2559
f1fed05b 2560sigalrm_seen = FALSE;
c2a1bba0 2561if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
0d81dabc
JH
2562inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2563 MIN(ssl_xfer_buffer_size, lim));
c2a1bba0 2564if (smtp_receive_timeout > 0) ALARM_CLR(0);
9723f966
JH
2565
2566if (had_command_timeout) /* set by signal handler */
2567 smtp_command_timeout_exit(); /* does not return */
2568if (had_command_sigterm)
2569 smtp_command_sigterm_exit();
2570if (had_data_timeout)
2571 smtp_data_timeout_exit();
2572if (had_data_sigint)
2573 smtp_data_sigint_exit();
2574
2575/* Timeouts do not get this far. A zero-byte return appears to mean that the
2576TLS session has been closed down, not that the socket itself has been closed
2577down. Revert to non-TLS handling. */
0d81dabc
JH
2578
2579if (sigalrm_seen)
2580 {
2581 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
8b77d27a 2582 state->xfer_error = TRUE;
0d81dabc
JH
2583 return FALSE;
2584 }
2585
2586else if (inbytes == 0)
2587 {
2588 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2589
2590 receive_getc = smtp_getc;
2591 receive_getbuf = smtp_getbuf;
2592 receive_get_cache = smtp_get_cache;
2593 receive_ungetc = smtp_ungetc;
2594 receive_feof = smtp_feof;
2595 receive_ferror = smtp_ferror;
2596 receive_smtp_buffered = smtp_buffered;
2597
2598 gnutls_deinit(state->session);
2599 gnutls_certificate_free_credentials(state->x509_cred);
2600
2601 state->session = NULL;
74f1a423
JH
2602 state->tlsp->active.sock = -1;
2603 state->tlsp->active.tls_ctx = NULL;
0d81dabc
JH
2604 state->tlsp->bits = 0;
2605 state->tlsp->certificate_verified = FALSE;
2606 tls_channelbinding_b64 = NULL;
2607 state->tlsp->cipher = NULL;
2608 state->tlsp->peercert = NULL;
2609 state->tlsp->peerdn = NULL;
2610
2611 return FALSE;
2612 }
2613
2614/* Handle genuine errors */
2615
2616else if (inbytes < 0)
2617 {
5fd28bb8 2618debug_printf("%s: err from gnutls_record_recv(\n", __FUNCTION__);
0d81dabc 2619 record_io_error(state, (int) inbytes, US"recv", NULL);
8b77d27a 2620 state->xfer_error = TRUE;
0d81dabc
JH
2621 return FALSE;
2622 }
2623#ifndef DISABLE_DKIM
2624dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2625#endif
2626state->xfer_buffer_hwm = (int) inbytes;
2627state->xfer_buffer_lwm = 0;
2628return TRUE;
2629}
2630
059ec3d9
PH
2631/*************************************************
2632* TLS version of getc *
2633*************************************************/
2634
2635/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2636it refills the buffer via the GnuTLS reading function.
817d9f57 2637Only used by the server-side TLS.
059ec3d9 2638
17c76198
PP
2639This feeds DKIM and should be used for all message-body reads.
2640
bd8fbe36 2641Arguments: lim Maximum amount to read/bufffer
059ec3d9
PH
2642Returns: the next character or EOF
2643*/
2644
2645int
bd8fbe36 2646tls_getc(unsigned lim)
059ec3d9 2647{
0d81dabc 2648exim_gnutls_state_st * state = &state_server;
059ec3d9 2649
0d81dabc
JH
2650if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2651 if (!tls_refill(lim))
2652 return state->xfer_error ? EOF : smtp_getc(lim);
ed62aae3 2653
0d81dabc 2654/* Something in the buffer; return next uschar */
059ec3d9 2655
0d81dabc
JH
2656return state->xfer_buffer[state->xfer_buffer_lwm++];
2657}
059ec3d9 2658
0d81dabc
JH
2659uschar *
2660tls_getbuf(unsigned * len)
2661{
2662exim_gnutls_state_st * state = &state_server;
2663unsigned size;
2664uschar * buf;
059ec3d9 2665
0d81dabc
JH
2666if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2667 if (!tls_refill(*len))
059ec3d9 2668 {
0d81dabc
JH
2669 if (!state->xfer_error) return smtp_getbuf(len);
2670 *len = 0;
2671 return NULL;
059ec3d9 2672 }
059ec3d9 2673
0d81dabc
JH
2674if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
2675 size = *len;
2676buf = &state->xfer_buffer[state->xfer_buffer_lwm];
2677state->xfer_buffer_lwm += size;
2678*len = size;
2679return buf;
059ec3d9
PH
2680}
2681
0d81dabc 2682
584e96c6
JH
2683void
2684tls_get_cache()
2685{
9960d1e5 2686#ifndef DISABLE_DKIM
584e96c6
JH
2687exim_gnutls_state_st * state = &state_server;
2688int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2689if (n > 0)
2690 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
584e96c6 2691#endif
9960d1e5 2692}
584e96c6 2693
059ec3d9 2694
925ac8e4
JH
2695BOOL
2696tls_could_read(void)
2697{
2698return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
2699 || gnutls_record_check_pending(state_server.session) > 0;
2700}
2701
2702
059ec3d9 2703
17c76198 2704
059ec3d9
PH
2705/*************************************************
2706* Read bytes from TLS channel *
2707*************************************************/
2708
17c76198
PP
2709/* This does not feed DKIM, so if the caller uses this for reading message body,
2710then the caller must feed DKIM.
817d9f57 2711
059ec3d9 2712Arguments:
74f1a423 2713 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
2714 buff buffer of data
2715 len size of buffer
2716
2717Returns: the number of bytes read
afdb5e9c 2718 -1 after a failed read, including EOF
059ec3d9
PH
2719*/
2720
2721int
74f1a423 2722tls_read(void * ct_ctx, uschar *buff, size_t len)
059ec3d9 2723{
74f1a423 2724exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
17c76198 2725ssize_t inbytes;
059ec3d9 2726
17c76198
PP
2727if (len > INT_MAX)
2728 len = INT_MAX;
059ec3d9 2729
17c76198
PP
2730if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2731 DEBUG(D_tls)
2732 debug_printf("*** PROBABLY A BUG *** " \
2733 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2734 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2735
2736DEBUG(D_tls)
2737 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2738 state->session, buff, len);
2739
2740inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
2741if (inbytes > 0) return inbytes;
2742if (inbytes == 0)
2743 {
2744 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2745 }
5fd28bb8
JH
2746else
2747{
2748debug_printf("%s: err from gnutls_record_recv(\n", __FUNCTION__);
2749record_io_error(state, (int)inbytes, US"recv", NULL);
2750}
059ec3d9
PH
2751
2752return -1;
2753}
2754
2755
2756
17c76198 2757
059ec3d9
PH
2758/*************************************************
2759* Write bytes down TLS channel *
2760*************************************************/
2761
2762/*
2763Arguments:
74f1a423 2764 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
2765 buff buffer of data
2766 len number of bytes
925ac8e4 2767 more more data expected soon
059ec3d9
PH
2768
2769Returns: the number of bytes after a successful write,
2770 -1 after a failed write
2771*/
2772
2773int
74f1a423 2774tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
059ec3d9 2775{
17c76198
PP
2776ssize_t outbytes;
2777size_t left = len;
74f1a423 2778exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
925ac8e4
JH
2779#ifdef SUPPORT_CORK
2780static BOOL corked = FALSE;
2781
2782if (more && !corked) gnutls_record_cork(state->session);
2783#endif
2784
2785DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
2786 buff, left, more ? ", more" : "");
059ec3d9 2787
059ec3d9
PH
2788while (left > 0)
2789 {
17c76198
PP
2790 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2791 buff, left);
2792 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 2793
17c76198 2794 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
2795 if (outbytes < 0)
2796 {
1b76ad22 2797 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
17c76198 2798 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
2799 return -1;
2800 }
2801 if (outbytes == 0)
2802 {
17c76198 2803 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
2804 return -1;
2805 }
2806
2807 left -= outbytes;
2808 buff += outbytes;
2809 }
2810
17c76198
PP
2811if (len > INT_MAX)
2812 {
2813 DEBUG(D_tls)
2814 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2815 len);
2816 len = INT_MAX;
2817 }
2818
925ac8e4
JH
2819#ifdef SUPPORT_CORK
2820if (more != corked)
2821 {
2822 if (!more) (void) gnutls_record_uncork(state->session, 0);
2823 corked = more;
2824 }
2825#endif
2826
17c76198 2827return (int) len;
059ec3d9
PH
2828}
2829
2830
2831
17c76198 2832
059ec3d9 2833/*************************************************
17c76198 2834* Random number generation *
059ec3d9
PH
2835*************************************************/
2836
17c76198
PP
2837/* Pseudo-random number generation. The result is not expected to be
2838cryptographically strong but not so weak that someone will shoot themselves
2839in the foot using it as a nonce in input in some email header scheme or
2840whatever weirdness they'll twist this into. The result should handle fork()
2841and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 2842
17c76198
PP
2843Arguments:
2844 max range maximum
2845Returns a random number in range [0, max-1]
059ec3d9
PH
2846*/
2847
af3498d6 2848#ifdef HAVE_GNUTLS_RND
17c76198
PP
2849int
2850vaguely_random_number(int max)
059ec3d9 2851{
17c76198
PP
2852unsigned int r;
2853int i, needed_len;
2854uschar *p;
2855uschar smallbuf[sizeof(r)];
2856
2857if (max <= 1)
2858 return 0;
2859
2860needed_len = sizeof(r);
2861/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2862 * asked for a number less than 10. */
2863for (r = max, i = 0; r; ++i)
2864 r >>= 1;
2865i = (i + 7) / 8;
2866if (i < needed_len)
2867 needed_len = i;
2868
2869i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2870if (i < 0)
059ec3d9 2871 {
17c76198
PP
2872 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2873 return vaguely_random_number_fallback(max);
2874 }
2875r = 0;
2876for (p = smallbuf; needed_len; --needed_len, ++p)
2877 {
2878 r *= 256;
2879 r += *p;
059ec3d9
PH
2880 }
2881
17c76198
PP
2882/* We don't particularly care about weighted results; if someone wants
2883 * smooth distribution and cares enough then they should submit a patch then. */
2884return r % max;
059ec3d9 2885}
af3498d6
PP
2886#else /* HAVE_GNUTLS_RND */
2887int
2888vaguely_random_number(int max)
2889{
2890 return vaguely_random_number_fallback(max);
2891}
2892#endif /* HAVE_GNUTLS_RND */
059ec3d9 2893
36f12725
NM
2894
2895
2896
2897/*************************************************
3375e053
PP
2898* Let tls_require_ciphers be checked at startup *
2899*************************************************/
2900
2901/* The tls_require_ciphers option, if set, must be something which the
2902library can parse.
2903
2904Returns: NULL on success, or error message
2905*/
2906
2907uschar *
2908tls_validate_require_cipher(void)
2909{
2910int rc;
2911uschar *expciphers = NULL;
2912gnutls_priority_t priority_cache;
2913const char *errpos;
cf0c6164 2914uschar * dummy_errstr;
3375e053
PP
2915
2916#define validate_check_rc(Label) do { \
2917 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2918 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2919#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2920
2921if (exim_gnutls_base_init_done)
2922 log_write(0, LOG_MAIN|LOG_PANIC,
2923 "already initialised GnuTLS, Exim developer bug");
2924
a5f239e4 2925#ifdef HAVE_GNUTLS_PKCS11
2519e60d 2926if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
2927 {
2928 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2929 validate_check_rc(US"gnutls_pkcs11_init");
2930 }
2931#endif
3375e053
PP
2932rc = gnutls_global_init();
2933validate_check_rc(US"gnutls_global_init()");
2934exim_gnutls_base_init_done = TRUE;
2935
2936if (!(tls_require_ciphers && *tls_require_ciphers))
2937 return_deinit(NULL);
2938
cf0c6164
JH
2939if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
2940 &dummy_errstr))
3375e053
PP
2941 return_deinit(US"failed to expand tls_require_ciphers");
2942
2943if (!(expciphers && *expciphers))
2944 return_deinit(NULL);
2945
2946DEBUG(D_tls)
2947 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2948
2949rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2950validate_check_rc(string_sprintf(
2951 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2952 expciphers, errpos - CS expciphers, errpos));
2953
2954#undef return_deinit
2955#undef validate_check_rc
2956gnutls_global_deinit();
2957
2958return NULL;
2959}
2960
2961
2962
2963
2964/*************************************************
36f12725
NM
2965* Report the library versions. *
2966*************************************************/
2967
2968/* See a description in tls-openssl.c for an explanation of why this exists.
2969
2970Arguments: a FILE* to print the results to
2971Returns: nothing
2972*/
2973
2974void
2975tls_version_report(FILE *f)
2976{
754a0503
PP
2977fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2978 " Runtime: %s\n",
2979 LIBGNUTLS_VERSION,
2980 gnutls_check_version(NULL));
36f12725
NM
2981}
2982
2b4a568d
JH
2983/* vi: aw ai sw=2
2984*/
059ec3d9 2985/* End of tls-gnu.c */