GnuTLS debug callback: check for existing \n
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
17c76198 5/* Copyright (c) University of Cambridge 1995 - 2012 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
16Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
059ec3d9 42
17c76198 43/* GnuTLS 2 vs 3
059ec3d9 44
17c76198
PP
45GnuTLS 3 only:
46 gnutls_global_set_audit_log_function()
059ec3d9 47
17c76198
PP
48Changes:
49 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
50*/
059ec3d9 51
17c76198 52/* Local static variables for GnuTLS */
059ec3d9 53
17c76198 54/* Values for verify_requirement */
059ec3d9 55
17c76198 56enum peer_verify_requirement { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
059ec3d9 57
17c76198
PP
58/* This holds most state for server or client; with this, we can set up an
59outbound TLS-enabled connection in an ACL callout, while not stomping all
60over the TLS variables available for expansion.
059ec3d9 61
17c76198
PP
62Some of these correspond to variables in globals.c; those variables will
63be set to point to content in one of these instances, as appropriate for
64the stage of the process lifetime.
059ec3d9 65
17c76198
PP
66Not handled here: globals tls_active, tls_bits, tls_cipher, tls_peerdn,
67tls_certificate_verified, tls_channelbinding_b64, tls_sni.
68*/
059ec3d9 69
17c76198
PP
70typedef struct exim_gnutls_state {
71 gnutls_session_t session;
72 gnutls_certificate_credentials_t x509_cred;
73 gnutls_priority_t priority_cache;
74 enum peer_verify_requirement verify_requirement;
75 int fd_in;
76 int fd_out;
77 BOOL peer_cert_verified;
78 BOOL trigger_sni_changes;
4fe99a6c 79 BOOL have_set_peerdn;
17c76198
PP
80 const struct host_item *host;
81 uschar *peerdn;
75fe387d 82 uschar *ciphersuite;
17c76198
PP
83 uschar *received_sni;
84
85 const uschar *tls_certificate;
86 const uschar *tls_privatekey;
87 const uschar *tls_sni; /* client send only, not received */
88 const uschar *tls_verify_certificates;
89 const uschar *tls_crl;
90 const uschar *tls_require_ciphers;
91 uschar *exp_tls_certificate;
92 uschar *exp_tls_privatekey;
93 uschar *exp_tls_sni;
94 uschar *exp_tls_verify_certificates;
95 uschar *exp_tls_crl;
96 uschar *exp_tls_require_ciphers;
97
98 uschar *xfer_buffer;
99 int xfer_buffer_lwm;
100 int xfer_buffer_hwm;
101 int xfer_eof;
102 int xfer_error;
17c76198
PP
103} exim_gnutls_state_st;
104
105static const exim_gnutls_state_st exim_gnutls_state_init = {
4fe99a6c 106 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
75fe387d 107 NULL, NULL, NULL, NULL,
17c76198
PP
108 NULL, NULL, NULL, NULL, NULL, NULL,
109 NULL, NULL, NULL, NULL, NULL, NULL,
110 NULL, 0, 0, 0, 0,
17c76198 111};
83da1223 112
17c76198
PP
113/* Not only do we have our own APIs which don't pass around state, assuming
114it's held in globals, GnuTLS doesn't appear to let us register callback data
115for callbacks, or as part of the session, so we have to keep a "this is the
116context we're currently dealing with" pointer and rely upon being
117single-threaded to keep from processing data on an inbound TLS connection while
118talking to another TLS connection for an outbound check. This does mean that
119there's no way for heart-beats to be responded to, for the duration of the
120second connection. */
059ec3d9 121
17c76198
PP
122static exim_gnutls_state_st state_server, state_client;
123static exim_gnutls_state_st *current_global_tls_state;
059ec3d9 124
17c76198
PP
125/* dh_params are initialised once within the lifetime of a process using TLS;
126if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
127don't want to repeat this. */
83da1223 128
17c76198 129static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 130
17c76198 131/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 132
17c76198 133static const int ssl_session_timeout = 200;
059ec3d9 134
17c76198 135static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 136
17c76198 137/* Guard library core initialisation */
83da1223 138
17c76198 139static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 140
059ec3d9 141
17c76198 142/* ------------------------------------------------------------------------ */
17c76198 143/* macros */
83da1223 144
17c76198 145#define MAX_HOST_LEN 255
83da1223 146
17c76198
PP
147/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
148the library logging; a value less than 0 disables the calls to set up logging
149callbacks. */
2c17bb02 150#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
17c76198 151#define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 152#endif
83da1223 153
2c17bb02 154#ifndef EXIM_CLIENT_DH_MIN_BITS
17c76198 155#define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 156#endif
83da1223 157
af3498d6
PP
158/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
159can ask for a bit-strength. Without that, we stick to the constant we had
160before, for now. */
2c17bb02 161#ifndef EXIM_SERVER_DH_BITS_PRE2_12
af3498d6 162#define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 163#endif
af3498d6 164
17c76198
PP
165#define exim_gnutls_err_check(Label) do { \
166 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
059ec3d9 167
17c76198 168#define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
83da1223 169
17c76198
PP
170#if GNUTLS_VERSION_NUMBER >= 0x020c00
171#define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
af3498d6
PP
172#define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
173#define HAVE_GNUTLS_RND
17c76198 174#endif
83da1223 175
af3498d6
PP
176
177
178
179/* ------------------------------------------------------------------------ */
180/* Callback declarations */
181
182#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
183static void exim_gnutls_logger_cb(int level, const char *message);
184#endif
185
186static int exim_sni_handling_cb(gnutls_session_t session);
187
188
189
190
17c76198
PP
191/* ------------------------------------------------------------------------ */
192/* Static functions */
059ec3d9
PH
193
194/*************************************************
195* Handle TLS error *
196*************************************************/
197
198/* Called from lots of places when errors occur before actually starting to do
199the TLS handshake, that is, while the session is still in clear. Always returns
200DEFER for a server and FAIL for a client so that most calls can use "return
201tls_error(...)" to do this processing and then give an appropriate return. A
202single function is used for both server and client, because it is called from
203some shared functions.
204
205Argument:
206 prefix text to include in the logged error
7199e1ee
TF
207 msg additional error string (may be NULL)
208 usually obtained from gnutls_strerror()
17c76198
PP
209 host NULL if setting up a server;
210 the connected host if setting up a client
059ec3d9
PH
211
212Returns: OK/DEFER/FAIL
213*/
214
215static int
17c76198 216tls_error(const uschar *prefix, const char *msg, const host_item *host)
059ec3d9 217{
17c76198
PP
218if (host)
219 {
220 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s)%s%s",
221 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
222 return FAIL;
223 }
224else
059ec3d9 225 {
7199e1ee 226 uschar *conn_info = smtp_get_connection_info();
17c76198 227 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee
TF
228 conn_info += 5;
229 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
17c76198 230 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
059ec3d9
PH
231 return DEFER;
232 }
059ec3d9
PH
233}
234
235
236
17c76198 237
059ec3d9 238/*************************************************
17c76198 239* Deal with logging errors during I/O *
059ec3d9
PH
240*************************************************/
241
17c76198 242/* We have to get the identity of the peer from saved data.
059ec3d9 243
17c76198
PP
244Argument:
245 state the current GnuTLS exim state container
246 rc the GnuTLS error code, or 0 if it's a local error
247 when text identifying read or write
248 text local error text when ec is 0
059ec3d9 249
17c76198 250Returns: nothing
059ec3d9
PH
251*/
252
17c76198
PP
253static void
254record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 255{
17c76198 256const char *msg;
059ec3d9 257
17c76198
PP
258if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
259 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
260 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
261else
262 msg = gnutls_strerror(rc);
059ec3d9 263
17c76198
PP
264tls_error(when, msg, state->host);
265}
059ec3d9 266
059ec3d9 267
059ec3d9 268
059ec3d9 269
17c76198
PP
270/*************************************************
271* Set various Exim expansion vars *
272*************************************************/
059ec3d9 273
17c76198
PP
274/* We set various Exim global variables from the state, once a session has
275been established. With TLS callouts, may need to change this to stack
276variables, or just re-call it with the server state after client callout
277has finished.
059ec3d9 278
17c76198
PP
279Make sure anything set here is inset in tls_getc().
280
281Sets:
282 tls_active fd
283 tls_bits strength indicator
284 tls_certificate_verified bool indicator
285 tls_channelbinding_b64 for some SASL mechanisms
286 tls_cipher a string
287 tls_peerdn a string
288 tls_sni a (UTF-8) string
289Also:
290 current_global_tls_state for API limitations
291
292Argument:
293 state the relevant exim_gnutls_state_st *
294*/
295
296static void
297extract_exim_vars_from_tls_state(exim_gnutls_state_st *state)
298{
17c76198 299gnutls_cipher_algorithm_t cipher;
17c76198
PP
300#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
301int old_pool;
302int rc;
303gnutls_datum_t channel;
304#endif
305
306current_global_tls_state = state;
307
308tls_active = state->fd_out;
309
310cipher = gnutls_cipher_get(state->session);
311/* returns size in "bytes" */
312tls_bits = gnutls_cipher_get_key_size(cipher) * 8;
313
75fe387d 314tls_cipher = state->ciphersuite;
17c76198
PP
315
316DEBUG(D_tls) debug_printf("cipher: %s\n", tls_cipher);
317
318tls_certificate_verified = state->peer_cert_verified;
059ec3d9 319
17c76198
PP
320/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
321only available for use for authenticators while this TLS session is running. */
322
323tls_channelbinding_b64 = NULL;
324#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
325channel.data = NULL;
326channel.size = 0;
327rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
328if (rc) {
329 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
330} else {
331 old_pool = store_pool;
332 store_pool = POOL_PERM;
333 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
334 store_pool = old_pool;
335 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
336}
337#endif
338
339tls_peerdn = state->peerdn;
340
341tls_sni = state->received_sni;
059ec3d9
PH
342}
343
344
345
17c76198 346
059ec3d9 347/*************************************************
575643cd 348* Setup up DH parameters *
059ec3d9
PH
349*************************************************/
350
575643cd 351/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
352be re-generated every so often, depending on security policy. What we do is to
353keep these parameters in a file in the spool directory. If the file does not
354exist, we generate them. This means that it is easy to cause a regeneration.
355
356The new file is written as a temporary file and renamed, so that an incomplete
357file is never present. If two processes both compute some new parameters, you
358waste a bit of effort, but it doesn't seem worth messing around with locking to
359prevent this.
360
361Argument:
362 host NULL for server, server for client (for error handling)
363
364Returns: OK/DEFER/FAIL
365*/
366
367static int
17c76198 368init_server_dh(void)
059ec3d9 369{
17c76198
PP
370int fd, rc;
371unsigned int dh_bits;
b5aea5e1 372gnutls_datum m;
17c76198
PP
373uschar filename[PATH_MAX];
374size_t sz;
375host_item *host = NULL; /* dummy for macros */
059ec3d9 376
17c76198 377DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 378
17c76198
PP
379rc = gnutls_dh_params_init(&dh_server_params);
380exim_gnutls_err_check(US"gnutls_dh_params_init");
059ec3d9 381
af3498d6
PP
382#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
383/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
384different filename and ensure we have sufficient bits. */
385dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
386if (!dh_bits)
387 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
af3498d6 388DEBUG(D_tls)
b34fc30c 389 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
390 dh_bits);
391#else
392dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
393DEBUG(D_tls)
394 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
395 dh_bits);
396#endif
059ec3d9 397
17c76198 398if (!string_format(filename, sizeof(filename),
af3498d6 399 "%s/gnutls-params-%d", spool_directory, dh_bits))
17c76198 400 return tls_error(US"overlong filename", NULL, NULL);
059ec3d9 401
b5aea5e1 402/* Open the cache file for reading and if successful, read it and set up the
575643cd 403parameters. */
059ec3d9
PH
404
405fd = Uopen(filename, O_RDONLY, 0);
b5aea5e1 406if (fd >= 0)
059ec3d9 407 {
b5aea5e1 408 struct stat statbuf;
17c76198
PP
409 FILE *fp;
410 int saved_errno;
411
412 if (fstat(fd, &statbuf) < 0) /* EIO */
413 {
414 saved_errno = errno;
415 (void)close(fd);
416 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
417 }
418 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
419 {
420 (void)close(fd);
17c76198
PP
421 return tls_error(US"TLS cache not a file", NULL, NULL);
422 }
423 fp = fdopen(fd, "rb");
424 if (!fp)
425 {
426 saved_errno = errno;
427 (void)close(fd);
428 return tls_error(US"fdopen(TLS cache stat fd) failed",
429 strerror(saved_errno), NULL);
b5aea5e1 430 }
059ec3d9 431
b5aea5e1
PH
432 m.size = statbuf.st_size;
433 m.data = malloc(m.size);
434 if (m.data == NULL)
17c76198
PP
435 {
436 fclose(fp);
437 return tls_error(US"malloc failed", strerror(errno), NULL);
438 }
439 sz = fread(m.data, m.size, 1, fp);
440 if (!sz)
441 {
442 saved_errno = errno;
443 fclose(fp);
444 free(m.data);
445 return tls_error(US"fread failed", strerror(saved_errno), NULL);
446 }
447 fclose(fp);
b5aea5e1 448
17c76198 449 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 450 free(m.data);
17c76198
PP
451 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
452 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
453 }
454
455/* If the file does not exist, fall through to compute new data and cache it.
456If there was any other opening error, it is serious. */
457
182ad5cf
PH
458else if (errno == ENOENT)
459 {
17c76198 460 rc = -1;
182ad5cf 461 DEBUG(D_tls)
17c76198 462 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
463 }
464else
17c76198
PP
465 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
466 NULL, NULL);
b5aea5e1
PH
467
468/* If ret < 0, either the cache file does not exist, or the data it contains
469is not useful. One particular case of this is when upgrading from an older
470release of Exim in which the data was stored in a different format. We don't
471try to be clever and support both formats; we just regenerate new data in this
472case. */
473
17c76198 474if (rc < 0)
b5aea5e1 475 {
17c76198 476 uschar *temp_fn;
059ec3d9 477
17c76198
PP
478 if ((PATH_MAX - Ustrlen(filename)) < 10)
479 return tls_error(US"Filename too long to generate replacement",
480 CS filename, NULL);
059ec3d9 481
17c76198
PP
482 temp_fn = string_copy(US "%s.XXXXXXX");
483 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
059ec3d9 484 if (fd < 0)
17c76198 485 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
059ec3d9
PH
486 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
487
17c76198
PP
488 DEBUG(D_tls) debug_printf("generating %d bits Diffie-Hellman key ...\n", dh_bits);
489 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits);
490 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
491
492 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
493 and I confirmed that a NULL call to get the size first is how the GnuTLS
494 sample apps handle this. */
495
496 sz = 0;
497 m.data = NULL;
498 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
499 m.data, &sz);
500 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
501 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
502 m.size = sz;
b5aea5e1
PH
503 m.data = malloc(m.size);
504 if (m.data == NULL)
17c76198
PP
505 return tls_error(US"memory allocation failed", strerror(errno), NULL);
506 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
507 m.data, &sz);
508 if (rc != GNUTLS_E_SUCCESS)
509 {
510 free(m.data);
511 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
512 }
059ec3d9 513
17c76198
PP
514 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
515 if (sz != m.size)
516 {
517 free(m.data);
518 return tls_error(US"TLS cache write D-H params failed",
519 strerror(errno), NULL);
520 }
b5aea5e1 521 free(m.data);
17c76198
PP
522 sz = write_to_fd_buf(fd, US"\n", 1);
523 if (sz != 1)
524 return tls_error(US"TLS cache write D-H params final newline failed",
525 strerror(errno), NULL);
526
527 rc = close(fd);
528 if (rc)
529 return tls_error(US"TLS cache write close() failed",
530 strerror(errno), NULL);
059ec3d9 531
17c76198
PP
532 if (Urename(temp_fn, filename) < 0)
533 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
534 temp_fn, filename), strerror(errno), NULL);
059ec3d9 535
17c76198 536 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
537 }
538
17c76198 539DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
540return OK;
541}
542
543
544
545
546/*************************************************
17c76198 547* Variables re-expanded post-SNI *
059ec3d9
PH
548*************************************************/
549
17c76198
PP
550/* Called from both server and client code, via tls_init(), and also from
551the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
552
553We can tell the two apart by state->received_sni being non-NULL in callback.
554
555The callback should not call us unless state->trigger_sni_changes is true,
556which we are responsible for setting on the first pass through.
059ec3d9
PH
557
558Arguments:
17c76198 559 state exim_gnutls_state_st *
059ec3d9
PH
560
561Returns: OK/DEFER/FAIL
562*/
563
564static int
17c76198 565tls_expand_session_files(exim_gnutls_state_st *state)
059ec3d9 566{
1365611d 567struct stat statbuf;
059ec3d9 568int rc;
17c76198
PP
569const host_item *host = state->host; /* macro should be reconsidered? */
570uschar *saved_tls_certificate = NULL;
571uschar *saved_tls_privatekey = NULL;
572uschar *saved_tls_verify_certificates = NULL;
573uschar *saved_tls_crl = NULL;
574int cert_count;
575
576/* We check for tls_sni *before* expansion. */
577if (!state->host)
578 {
579 if (!state->received_sni)
580 {
619b2b25 581 if (state->tls_certificate && Ustrstr(state->tls_certificate, US"tls_sni"))
17c76198
PP
582 {
583 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
584 state->trigger_sni_changes = TRUE;
585 }
586 }
587 else
588 {
1365611d 589 /* useful for debugging */
17c76198
PP
590 saved_tls_certificate = state->exp_tls_certificate;
591 saved_tls_privatekey = state->exp_tls_privatekey;
592 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
593 saved_tls_crl = state->exp_tls_crl;
594 }
595 }
059ec3d9 596
1365611d
PP
597rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
598exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
599
17c76198
PP
600/* remember: expand_check_tlsvar() is expand_check() but fiddling with
601state members, assuming consistent naming; and expand_check() returns
602false if expansion failed, unless expansion was forced to fail. */
059ec3d9 603
17c76198
PP
604/* check if we at least have a certificate, before doing expensive
605D-H generation. */
059ec3d9 606
17c76198
PP
607if (!expand_check_tlsvar(tls_certificate))
608 return DEFER;
059ec3d9 609
17c76198 610/* certificate is mandatory in server, optional in client */
059ec3d9 611
17c76198
PP
612if ((state->exp_tls_certificate == NULL) ||
613 (*state->exp_tls_certificate == '\0'))
614 {
615 if (state->host == NULL)
616 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
617 else
618 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
619 }
059ec3d9 620
17c76198 621if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
059ec3d9
PH
622 return DEFER;
623
17c76198
PP
624/* tls_privatekey is optional, defaulting to same file as certificate */
625
626if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 627 {
17c76198
PP
628 state->tls_privatekey = state->tls_certificate;
629 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 630 }
c91535f3 631
059ec3d9 632
17c76198 633if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
634 {
635 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
636 state->exp_tls_certificate, state->exp_tls_privatekey);
637
638 if (state->received_sni)
de365ded 639 {
17c76198
PP
640 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
641 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
642 {
b34fc30c 643 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
644 }
645 else
646 {
b34fc30c 647 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 648 }
8e669ac1 649 }
059ec3d9 650
1365611d
PP
651 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
652 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
653 GNUTLS_X509_FMT_PEM);
654 exim_gnutls_err_check(
655 string_sprintf("cert/key setup: cert=%s key=%s",
656 state->exp_tls_certificate, state->exp_tls_privatekey));
657 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
b34fc30c 658 } /* tls_certificate */
059ec3d9
PH
659
660/* Set the trusted CAs file if one is provided, and then add the CRL if one is
661provided. Experiment shows that, if the certificate file is empty, an unhelpful
662error message is provided. However, if we just refrain from setting anything up
663in that case, certificate verification fails, which seems to be the correct
664behaviour. */
665
17c76198 666if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 667 {
17c76198 668 if (!expand_check_tlsvar(tls_verify_certificates))
059ec3d9 669 return DEFER;
17c76198
PP
670 if (state->tls_crl && *state->tls_crl)
671 if (!expand_check_tlsvar(tls_crl))
672 return DEFER;
059ec3d9 673
1365611d
PP
674 if (!(state->exp_tls_verify_certificates &&
675 *state->exp_tls_verify_certificates))
b34fc30c
PP
676 {
677 DEBUG(D_tls)
1365611d
PP
678 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
679 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 680 return OK;
b34fc30c 681 }
1365611d 682 }
83e2f8a2
PP
683else
684 {
685 DEBUG(D_tls)
686 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
687 return OK;
688 }
17c76198 689
1365611d
PP
690if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
691 {
692 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
693 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
694 strerror(errno));
695 return DEFER;
696 }
17c76198 697
619b2b25
PP
698/* The test suite passes in /dev/null; we could check for that path explicitly,
699but who knows if someone has some weird FIFO which always dumps some certs, or
700other weirdness. The thing we really want to check is that it's not a
701directory, since while OpenSSL supports that, GnuTLS does not.
702So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
703if (S_ISDIR(statbuf.st_mode))
1365611d
PP
704 {
705 DEBUG(D_tls)
619b2b25
PP
706 debug_printf("verify certificates path is a dir: \"%s\"\n",
707 state->exp_tls_verify_certificates);
1365611d 708 log_write(0, LOG_MAIN|LOG_PANIC,
619b2b25 709 "tls_verify_certificates \"%s\" is a directory",
1365611d
PP
710 state->exp_tls_verify_certificates);
711 return DEFER;
712 }
059ec3d9 713
1365611d
PP
714DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
715 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 716
1365611d
PP
717if (statbuf.st_size == 0)
718 {
719 DEBUG(D_tls)
720 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
721 return OK;
722 }
059ec3d9 723
1365611d
PP
724cert_count = gnutls_certificate_set_x509_trust_file(state->x509_cred,
725 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
726if (cert_count < 0)
727 {
728 rc = cert_count;
729 exim_gnutls_err_check(US"gnutls_certificate_set_x509_trust_file");
730 }
731DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 732
5c8cda3a
PP
733if (state->tls_crl && *state->tls_crl &&
734 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 735 {
5c8cda3a
PP
736 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
737 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
738 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
739 if (cert_count < 0)
1365611d 740 {
5c8cda3a 741 rc = cert_count;
1365611d
PP
742 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
743 }
5c8cda3a 744 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 745 }
059ec3d9 746
059ec3d9
PH
747return OK;
748}
749
750
751
752
753/*************************************************
1365611d
PP
754* Set X.509 state variables *
755*************************************************/
756
757/* In GnuTLS, the registered cert/key are not replaced by a later
758set of a cert/key, so for SNI support we need a whole new x509_cred
759structure. Which means various other non-re-expanded pieces of state
760need to be re-set in the new struct, so the setting logic is pulled
761out to this.
762
763Arguments:
764 state exim_gnutls_state_st *
765
766Returns: OK/DEFER/FAIL
767*/
768
769static int
770tls_set_remaining_x509(exim_gnutls_state_st *state)
771{
772int rc;
773const host_item *host = state->host; /* macro should be reconsidered? */
774
775/* Create D-H parameters, or read them from the cache file. This function does
776its own SMTP error messaging. This only happens for the server, TLS D-H ignores
777client-side params. */
778
779if (!state->host)
780 {
781 if (!dh_server_params)
782 {
783 rc = init_server_dh();
784 if (rc != OK) return rc;
785 }
786 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
787 }
788
789/* Link the credentials to the session. */
790
791rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
792exim_gnutls_err_check(US"gnutls_credentials_set");
793
794return OK;
795}
796
797/*************************************************
17c76198 798* Initialize for GnuTLS *
059ec3d9
PH
799*************************************************/
800
17c76198
PP
801/* Called from both server and client code. In the case of a server, errors
802before actual TLS negotiation return DEFER.
059ec3d9
PH
803
804Arguments:
17c76198
PP
805 host connected host, if client; NULL if server
806 certificate certificate file
807 privatekey private key file
808 sni TLS SNI to send, sometimes when client; else NULL
809 cas CA certs file
810 crl CRL file
811 require_ciphers tls_require_ciphers setting
059ec3d9 812
17c76198 813Returns: OK/DEFER/FAIL
059ec3d9
PH
814*/
815
17c76198
PP
816static int
817tls_init(
818 const host_item *host,
819 const uschar *certificate,
820 const uschar *privatekey,
821 const uschar *sni,
822 const uschar *cas,
823 const uschar *crl,
824 const uschar *require_ciphers,
825 exim_gnutls_state_st **caller_state)
059ec3d9 826{
17c76198
PP
827exim_gnutls_state_st *state;
828int rc;
829size_t sz;
830const char *errpos;
831uschar *p;
832BOOL want_default_priorities;
833
834if (!exim_gnutls_base_init_done)
059ec3d9 835 {
17c76198
PP
836 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
837
838 rc = gnutls_global_init();
839 exim_gnutls_err_check(US"gnutls_global_init");
840
841#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
842 DEBUG(D_tls)
059ec3d9 843 {
17c76198
PP
844 gnutls_global_set_log_function(exim_gnutls_logger_cb);
845 /* arbitrarily chosen level; bump upto 9 for more */
846 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 847 }
17c76198
PP
848#endif
849
850 exim_gnutls_base_init_done = TRUE;
059ec3d9 851 }
059ec3d9 852
17c76198
PP
853if (host)
854 {
855 state = &state_client;
856 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
857 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
858 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
859 }
860else
861 {
862 state = &state_server;
863 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
864 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
865 rc = gnutls_init(&state->session, GNUTLS_SERVER);
866 }
867exim_gnutls_err_check(US"gnutls_init");
059ec3d9 868
17c76198 869state->host = host;
059ec3d9 870
17c76198
PP
871state->tls_certificate = certificate;
872state->tls_privatekey = privatekey;
873state->tls_sni = sni;
874state->tls_verify_certificates = cas;
875state->tls_crl = crl;
059ec3d9 876
17c76198
PP
877/* This handles the variables that might get re-expanded after TLS SNI;
878that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 879
17c76198
PP
880DEBUG(D_tls)
881 debug_printf("Expanding various TLS configuration options for session credentials.\n");
882rc = tls_expand_session_files(state);
883if (rc != OK) return rc;
059ec3d9 884
1365611d
PP
885/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
886requires a new structure afterwards. */
83da1223 887
1365611d
PP
888rc = tls_set_remaining_x509(state);
889if (rc != OK) return rc;
83da1223 890
17c76198
PP
891/* set SNI in client, only */
892if (host)
893 {
894 if (!expand_check_tlsvar(tls_sni))
895 return DEFER;
896 if (state->exp_tls_sni && *state->exp_tls_sni)
897 {
898 DEBUG(D_tls)
899 debug_printf("Setting TLS client SNI to \"%s\"\n", state->exp_tls_sni);
900 sz = Ustrlen(state->exp_tls_sni);
901 rc = gnutls_server_name_set(state->session,
902 GNUTLS_NAME_DNS, state->exp_tls_sni, sz);
903 exim_gnutls_err_check(US"gnutls_server_name_set");
904 }
905 }
906else if (state->tls_sni)
907 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
908 "have an SNI set for a client [%s]\n", state->tls_sni);
83da1223 909
17c76198
PP
910/* This is the priority string support,
911http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html
912and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
913This was backwards incompatible, but means Exim no longer needs to track
914all algorithms and provide string forms for them. */
83da1223 915
17c76198 916want_default_priorities = TRUE;
83da1223 917
17c76198 918if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 919 {
17c76198
PP
920 if (!expand_check_tlsvar(tls_require_ciphers))
921 return DEFER;
922 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 923 {
17c76198
PP
924 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
925 state->exp_tls_require_ciphers);
926
927 rc = gnutls_priority_init(&state->priority_cache,
928 CS state->exp_tls_require_ciphers, &errpos);
929 want_default_priorities = FALSE;
930 p = state->exp_tls_require_ciphers;
83da1223
PH
931 }
932 }
17c76198
PP
933if (want_default_priorities)
934 {
83e2f8a2
PP
935 DEBUG(D_tls)
936 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
937 exim_default_gnutls_priority);
17c76198
PP
938 rc = gnutls_priority_init(&state->priority_cache,
939 exim_default_gnutls_priority, &errpos);
940 p = US exim_default_gnutls_priority;
941 }
83da1223 942
17c76198
PP
943exim_gnutls_err_check(string_sprintf(
944 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
945 p, errpos - CS p, errpos));
946
947rc = gnutls_priority_set(state->session, state->priority_cache);
948exim_gnutls_err_check(US"gnutls_priority_set");
949
950gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
951
952/* Reduce security in favour of increased compatibility, if the admin
953decides to make that trade-off. */
954if (gnutls_compat_mode)
83da1223 955 {
17c76198
PP
956#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
957 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
958 gnutls_session_enable_compatibility_mode(state->session);
959#else
960 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
961#endif
83da1223
PH
962 }
963
17c76198
PP
964*caller_state = state;
965/* needs to happen before callbacks during handshake */
966current_global_tls_state = state;
967return OK;
83da1223
PH
968}
969
970
971
972
973/*************************************************
17c76198 974* Extract peer information *
059ec3d9
PH
975*************************************************/
976
17c76198 977/* Called from both server and client code.
4fe99a6c
PP
978Only this is allowed to set state->peerdn and state->have_set_peerdn
979and we use that to detect double-calls.
059ec3d9 980
75fe387d
PP
981NOTE: the state blocks last while the TLS connection is up, which is fine
982for logging in the server side, but for the client side, we log after teardown
983in src/deliver.c. While the session is up, we can twist about states and
984repoint tls_* globals, but those variables used for logging or other variable
985expansion that happens _after_ delivery need to have a longer life-time.
986
987So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
988doing this more than once per generation of a state context. We set them in
989the state context, and repoint tls_* to them. After the state goes away, the
990tls_* copies of the pointers remain valid and client delivery logging is happy.
991
992tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
993don't apply.
994
059ec3d9 995Arguments:
17c76198 996 state exim_gnutls_state_st *
059ec3d9 997
17c76198 998Returns: OK/DEFER/FAIL
059ec3d9
PH
999*/
1000
17c76198
PP
1001static int
1002peer_status(exim_gnutls_state_st *state)
059ec3d9 1003{
75fe387d 1004uschar cipherbuf[256];
17c76198 1005const gnutls_datum *cert_list;
75fe387d 1006int old_pool, rc;
17c76198 1007unsigned int cert_list_size = 0;
4fe99a6c
PP
1008gnutls_protocol_t protocol;
1009gnutls_cipher_algorithm_t cipher;
1010gnutls_kx_algorithm_t kx;
1011gnutls_mac_algorithm_t mac;
17c76198
PP
1012gnutls_certificate_type_t ct;
1013gnutls_x509_crt_t crt;
4fe99a6c 1014uschar *p, *dn_buf;
17c76198 1015size_t sz;
059ec3d9 1016
4fe99a6c 1017if (state->have_set_peerdn)
17c76198 1018 return OK;
4fe99a6c 1019state->have_set_peerdn = TRUE;
059ec3d9 1020
4fe99a6c 1021state->peerdn = NULL;
059ec3d9 1022
4fe99a6c
PP
1023/* tls_cipher */
1024cipher = gnutls_cipher_get(state->session);
1025protocol = gnutls_protocol_get_version(state->session);
1026mac = gnutls_mac_get(state->session);
1027kx = gnutls_kx_get(state->session);
1028
75fe387d 1029string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1030 "%s:%s:%d",
1031 gnutls_protocol_get_name(protocol),
1032 gnutls_cipher_suite_get_name(kx, cipher, mac),
1033 (int) gnutls_cipher_get_key_size(cipher) * 8);
1034
1035/* I don't see a way that spaces could occur, in the current GnuTLS
1036code base, but it was a concern in the old code and perhaps older GnuTLS
1037releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1038for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1039 if (isspace(*p))
1040 *p = '-';
75fe387d
PP
1041old_pool = store_pool;
1042store_pool = POOL_PERM;
1043state->ciphersuite = string_copy(cipherbuf);
1044store_pool = old_pool;
1045tls_cipher = state->ciphersuite;
4fe99a6c
PP
1046
1047/* tls_peerdn */
17c76198 1048cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1049
17c76198
PP
1050if (cert_list == NULL || cert_list_size == 0)
1051 {
17c76198
PP
1052 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1053 cert_list, cert_list_size);
1054 if (state->verify_requirement == VERIFY_REQUIRED)
1055 return tls_error(US"certificate verification failed",
1056 "no certificate received from peer", state->host);
1057 return OK;
1058 }
059ec3d9 1059
17c76198
PP
1060ct = gnutls_certificate_type_get(state->session);
1061if (ct != GNUTLS_CRT_X509)
059ec3d9 1062 {
17c76198 1063 const char *ctn = gnutls_certificate_type_get_name(ct);
17c76198
PP
1064 DEBUG(D_tls)
1065 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
1066 if (state->verify_requirement == VERIFY_REQUIRED)
1067 return tls_error(US"certificate verification not possible, unhandled type",
1068 ctn, state->host);
1069 return OK;
83da1223 1070 }
059ec3d9 1071
17c76198
PP
1072#define exim_gnutls_peer_err(Label) do { \
1073 if (rc != GNUTLS_E_SUCCESS) { \
1074 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", (Label), gnutls_strerror(rc)); \
1075 if (state->verify_requirement == VERIFY_REQUIRED) { return tls_error((Label), gnutls_strerror(rc), state->host); } \
1076 return OK; } } while (0)
1077
1078rc = gnutls_x509_crt_init(&crt);
1079exim_gnutls_peer_err(US"gnutls_x509_crt_init (crt)");
1080
1081rc = gnutls_x509_crt_import(crt, &cert_list[0], GNUTLS_X509_FMT_DER);
1082exim_gnutls_peer_err(US"failed to import certificate [gnutls_x509_crt_import(cert 0)]");
1083sz = 0;
1084rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1085if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1086 {
17c76198
PP
1087 exim_gnutls_peer_err(US"getting size for cert DN failed");
1088 return FAIL; /* should not happen */
059ec3d9 1089 }
17c76198
PP
1090dn_buf = store_get_perm(sz);
1091rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1092exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
1093state->peerdn = dn_buf;
1094
1095return OK;
1096#undef exim_gnutls_peer_err
1097}
059ec3d9 1098
059ec3d9 1099
059ec3d9 1100
059ec3d9 1101
17c76198
PP
1102/*************************************************
1103* Verify peer certificate *
1104*************************************************/
059ec3d9 1105
17c76198
PP
1106/* Called from both server and client code.
1107*Should* be using a callback registered with
1108gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1109the peer information, but that's too new for some OSes.
059ec3d9 1110
17c76198
PP
1111Arguments:
1112 state exim_gnutls_state_st *
1113 error where to put an error message
059ec3d9 1114
17c76198
PP
1115Returns:
1116 FALSE if the session should be rejected
1117 TRUE if the cert is okay or we just don't care
1118*/
059ec3d9 1119
17c76198
PP
1120static BOOL
1121verify_certificate(exim_gnutls_state_st *state, const char **error)
1122{
1123int rc;
1124unsigned int verify;
1125
1126*error = NULL;
1127
1128rc = peer_status(state);
1129if (rc != OK)
e6060e2c 1130 {
17c76198
PP
1131 verify = GNUTLS_CERT_INVALID;
1132 *error = "not supplied";
1133 }
1134else
1135 {
1136 rc = gnutls_certificate_verify_peers2(state->session, &verify);
e6060e2c
NM
1137 }
1138
17c76198
PP
1139/* Handle the result of verification. INVALID seems to be set as well
1140as REVOKED, but leave the test for both. */
059ec3d9 1141
17c76198
PP
1142if ((rc < 0) || (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
1143 {
1144 state->peer_cert_verified = FALSE;
1145 if (*error == NULL)
1146 *error = ((verify & GNUTLS_CERT_REVOKED) != 0) ? "revoked" : "invalid";
059ec3d9 1147
17c76198
PP
1148 DEBUG(D_tls)
1149 debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",
4fe99a6c 1150 *error, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1151
17c76198
PP
1152 if (state->verify_requirement == VERIFY_REQUIRED)
1153 {
1154 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1155 return FALSE;
1156 }
1157 DEBUG(D_tls)
1158 debug_printf("TLS verify failure overriden (host in tls_try_verify_hosts)\n");
1159 }
1160else
1161 {
1162 state->peer_cert_verified = TRUE;
4fe99a6c
PP
1163 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=%s\n",
1164 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1165 }
059ec3d9 1166
17c76198 1167tls_peerdn = state->peerdn;
059ec3d9 1168
17c76198
PP
1169return TRUE;
1170}
059ec3d9 1171
17c76198
PP
1172
1173
1174
1175/* ------------------------------------------------------------------------ */
1176/* Callbacks */
1177
1178/* Logging function which can be registered with
1179 * gnutls_global_set_log_function()
1180 * gnutls_global_set_log_level() 0..9
1181 */
af3498d6 1182#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1183static void
17c76198 1184exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1185{
8c79eebf
PP
1186 size_t len = strlen(message);
1187 if (len < 1)
1188 {
1189 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1190 return;
1191 }
1192 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1193 message[len-1] == '\n' ? "" : "\n");
17c76198 1194}
af3498d6 1195#endif
059ec3d9 1196
059ec3d9 1197
17c76198
PP
1198/* Called after client hello, should handle SNI work.
1199This will always set tls_sni (state->received_sni) if available,
1200and may trigger presenting different certificates,
1201if state->trigger_sni_changes is TRUE.
059ec3d9 1202
17c76198
PP
1203Should be registered with
1204 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1205
17c76198
PP
1206"This callback must return 0 on success or a gnutls error code to terminate the
1207handshake.".
059ec3d9 1208
17c76198
PP
1209For inability to get SNI information, we return 0.
1210We only return non-zero if re-setup failed.
1211*/
44bbabb5 1212
17c76198
PP
1213static int
1214exim_sni_handling_cb(gnutls_session_t session)
1215{
1216char sni_name[MAX_HOST_LEN];
1217size_t data_len = MAX_HOST_LEN;
1218exim_gnutls_state_st *state = current_global_tls_state;
1219unsigned int sni_type;
1220int rc, old_pool;
1221
1222rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1223if (rc != GNUTLS_E_SUCCESS)
1224 {
1225 DEBUG(D_tls) {
1226 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1227 debug_printf("TLS: no SNI presented in handshake.\n");
1228 else
1229 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1230 gnutls_strerror(rc), rc);
1231 };
1232 return 0;
1233 }
1234
17c76198
PP
1235if (sni_type != GNUTLS_NAME_DNS)
1236 {
1237 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1238 return 0;
1239 }
44bbabb5 1240
17c76198
PP
1241/* We now have a UTF-8 string in sni_name */
1242old_pool = store_pool;
1243store_pool = POOL_PERM;
1244state->received_sni = string_copyn(US sni_name, data_len);
1245store_pool = old_pool;
1246
1247/* We set this one now so that variable expansions below will work */
1248tls_sni = state->received_sni;
1249
1250DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1251 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1252
1253if (!state->trigger_sni_changes)
1254 return 0;
1255
1256rc = tls_expand_session_files(state);
1257if (rc != OK)
1258 {
1259 /* If the setup of certs/etc failed before handshake, TLS would not have
1260 been offered. The best we can do now is abort. */
1261 return GNUTLS_E_APPLICATION_ERROR_MIN;
1262 }
1263
1365611d
PP
1264rc = tls_set_remaining_x509(state);
1265if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1266
1267return 0;
059ec3d9
PH
1268}
1269
1270
1271
17c76198
PP
1272
1273/* ------------------------------------------------------------------------ */
1274/* Exported functions */
1275
1276
1277
1278
059ec3d9
PH
1279/*************************************************
1280* Start a TLS session in a server *
1281*************************************************/
1282
1283/* This is called when Exim is running as a server, after having received
1284the STARTTLS command. It must respond to that command, and then negotiate
1285a TLS session.
1286
1287Arguments:
83da1223 1288 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1289
1290Returns: OK on success
1291 DEFER for errors before the start of the negotiation
1292 FAIL for errors during the negotation; the server can't
1293 continue running.
1294*/
1295
1296int
17c76198 1297tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1298{
1299int rc;
7199e1ee 1300const char *error;
17c76198 1301exim_gnutls_state_st *state = NULL;
059ec3d9
PH
1302
1303/* Check for previous activation */
17c76198 1304/* nb: this will not be TLS callout safe, needs reworking as part of that. */
059ec3d9
PH
1305
1306if (tls_active >= 0)
1307 {
17c76198 1308 tls_error(US"STARTTLS received after TLS started", "", NULL);
059ec3d9
PH
1309 smtp_printf("554 Already in TLS\r\n");
1310 return FAIL;
1311 }
1312
1313/* Initialize the library. If it fails, it will already have logged the error
1314and sent an SMTP response. */
1315
17c76198 1316DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 1317
17c76198
PP
1318rc = tls_init(NULL, tls_certificate, tls_privatekey,
1319 NULL, tls_verify_certificates, tls_crl,
1320 require_ciphers, &state);
059ec3d9
PH
1321if (rc != OK) return rc;
1322
059ec3d9
PH
1323/* If this is a host for which certificate verification is mandatory or
1324optional, set up appropriately. */
1325
059ec3d9 1326if (verify_check_host(&tls_verify_hosts) == OK)
17c76198
PP
1327 {
1328 DEBUG(D_tls) debug_printf("TLS: a client certificate will be required.\n");
1329 state->verify_requirement = VERIFY_REQUIRED;
1330 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1331 }
059ec3d9 1332else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198
PP
1333 {
1334 DEBUG(D_tls) debug_printf("TLS: a client certificate will be requested but not required.\n");
1335 state->verify_requirement = VERIFY_OPTIONAL;
1336 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1337 }
1338else
1339 {
1340 DEBUG(D_tls) debug_printf("TLS: a client certificate will not be requested.\n");
1341 state->verify_requirement = VERIFY_NONE;
1342 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1343 }
059ec3d9 1344
17c76198
PP
1345/* Register SNI handling; always, even if not in tls_certificate, so that the
1346expansion variable $tls_sni is always available. */
059ec3d9 1347
17c76198
PP
1348gnutls_handshake_set_post_client_hello_function(state->session,
1349 exim_sni_handling_cb);
059ec3d9
PH
1350
1351/* Set context and tell client to go ahead, except in the case of TLS startup
1352on connection, where outputting anything now upsets the clients and tends to
1353make them disconnect. We need to have an explicit fflush() here, to force out
1354the response. Other smtp_printf() calls do not need it, because in non-TLS
1355mode, the fflush() happens when smtp_getc() is called. */
1356
1357if (!tls_on_connect)
1358 {
1359 smtp_printf("220 TLS go ahead\r\n");
1360 fflush(smtp_out);
1361 }
1362
1363/* Now negotiate the TLS session. We put our own timer on it, since it seems
1364that the GnuTLS library doesn't. */
1365
17c76198
PP
1366gnutls_transport_set_ptr2(state->session,
1367 (gnutls_transport_ptr)fileno(smtp_in),
1368 (gnutls_transport_ptr)fileno(smtp_out));
1369state->fd_in = fileno(smtp_in);
1370state->fd_out = fileno(smtp_out);
059ec3d9
PH
1371
1372sigalrm_seen = FALSE;
1373if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198
PP
1374do
1375 {
1376 rc = gnutls_handshake(state->session);
619b2b25
PP
1377 } while ((rc == GNUTLS_E_AGAIN) ||
1378 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1379alarm(0);
1380
17c76198 1381if (rc != GNUTLS_E_SUCCESS)
059ec3d9 1382 {
17c76198
PP
1383 tls_error(US"gnutls_handshake",
1384 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
059ec3d9
PH
1385 /* It seems that, except in the case of a timeout, we have to close the
1386 connection right here; otherwise if the other end is running OpenSSL it hangs
1387 until the server times out. */
1388
1389 if (!sigalrm_seen)
1390 {
f1e894f3
PH
1391 (void)fclose(smtp_out);
1392 (void)fclose(smtp_in);
059ec3d9
PH
1393 }
1394
1395 return FAIL;
1396 }
1397
1398DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1399
17c76198
PP
1400/* Verify after the fact */
1401
1402if (state->verify_requirement != VERIFY_NONE)
059ec3d9 1403 {
17c76198
PP
1404 if (!verify_certificate(state, &error))
1405 {
1406 if (state->verify_requirement == VERIFY_OPTIONAL)
1407 {
1408 DEBUG(D_tls)
1409 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1410 error);
1411 }
1412 else
1413 {
1414 tls_error(US"certificate verification failed", error, NULL);
1415 return FAIL;
1416 }
1417 }
059ec3d9
PH
1418 }
1419
17c76198
PP
1420/* Figure out peer DN, and if authenticated, etc. */
1421
1422rc = peer_status(state);
1423if (rc != OK) return rc;
1424
1425/* Sets various Exim expansion variables; always safe within server */
1426
1427extract_exim_vars_from_tls_state(state);
059ec3d9
PH
1428
1429/* TLS has been set up. Adjust the input functions to read via TLS,
1430and initialize appropriately. */
1431
17c76198 1432state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
1433
1434receive_getc = tls_getc;
1435receive_ungetc = tls_ungetc;
1436receive_feof = tls_feof;
1437receive_ferror = tls_ferror;
58eb016e 1438receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1439
059ec3d9
PH
1440return OK;
1441}
1442
1443
1444
1445
1446/*************************************************
1447* Start a TLS session in a client *
1448*************************************************/
1449
1450/* Called from the smtp transport after STARTTLS has been accepted.
1451
1452Arguments:
1453 fd the fd of the connection
1454 host connected host (for messages)
83da1223 1455 addr the first address (not used)
17c76198 1456 dhparam DH parameter file (ignored, we're a client)
059ec3d9
PH
1457 certificate certificate file
1458 privatekey private key file
3f0945ff 1459 sni TLS SNI to send to remote host
059ec3d9
PH
1460 verify_certs file for certificate verify
1461 verify_crl CRL for verify
83da1223 1462 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1463 timeout startup timeout
1464
1465Returns: OK/DEFER/FAIL (because using common functions),
1466 but for a client, DEFER and FAIL have the same meaning
1467*/
1468
1469int
17c76198
PP
1470tls_client_start(int fd, host_item *host,
1471 address_item *addr ARG_UNUSED, uschar *dhparam ARG_UNUSED,
1472 uschar *certificate, uschar *privatekey, uschar *sni,
1473 uschar *verify_certs, uschar *verify_crl,
1474 uschar *require_ciphers, int timeout)
059ec3d9 1475{
059ec3d9 1476int rc;
17c76198
PP
1477const char *error;
1478exim_gnutls_state_st *state = NULL;
059ec3d9 1479
17c76198 1480DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 1481
17c76198
PP
1482rc = tls_init(host, certificate, privatekey,
1483 sni, verify_certs, verify_crl, require_ciphers, &state);
059ec3d9
PH
1484if (rc != OK) return rc;
1485
17c76198 1486gnutls_dh_set_prime_bits(state->session, EXIM_CLIENT_DH_MIN_BITS);
83da1223 1487
17c76198
PP
1488if (verify_certs == NULL)
1489 {
1490 DEBUG(D_tls) debug_printf("TLS: server certificate verification not required\n");
1491 state->verify_requirement = VERIFY_NONE;
1492 /* we still ask for it, to log it, etc */
1493 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1494 }
1495else
1496 {
1497 DEBUG(D_tls) debug_printf("TLS: server certificate verification required\n");
1498 state->verify_requirement = VERIFY_REQUIRED;
1499 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1500 }
059ec3d9 1501
17c76198
PP
1502gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)fd);
1503state->fd_in = fd;
1504state->fd_out = fd;
059ec3d9
PH
1505
1506/* There doesn't seem to be a built-in timeout on connection. */
1507
1508sigalrm_seen = FALSE;
1509alarm(timeout);
17c76198
PP
1510do
1511 {
1512 rc = gnutls_handshake(state->session);
619b2b25
PP
1513 } while ((rc == GNUTLS_E_AGAIN) ||
1514 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1515alarm(0);
1516
4fe99a6c
PP
1517if (rc != GNUTLS_E_SUCCESS)
1518 return tls_error(US"gnutls_handshake",
1519 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1520
17c76198 1521DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 1522
17c76198 1523/* Verify late */
059ec3d9 1524
17c76198
PP
1525if (state->verify_requirement != VERIFY_NONE &&
1526 !verify_certificate(state, &error))
1527 return tls_error(US"certificate verification failed", error, state->host);
059ec3d9 1528
17c76198 1529/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 1530
17c76198
PP
1531rc = peer_status(state);
1532if (rc != OK) return rc;
059ec3d9 1533
4fe99a6c 1534/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 1535
17c76198 1536extract_exim_vars_from_tls_state(state);
059ec3d9 1537
059ec3d9
PH
1538return OK;
1539}
1540
1541
1542
17c76198 1543
059ec3d9 1544/*************************************************
17c76198 1545* Close down a TLS session *
059ec3d9
PH
1546*************************************************/
1547
17c76198
PP
1548/* This is also called from within a delivery subprocess forked from the
1549daemon, to shut down the TLS library, without actually doing a shutdown (which
1550would tamper with the TLS session in the parent process).
059ec3d9 1551
17c76198
PP
1552Arguments: TRUE if gnutls_bye is to be called
1553Returns: nothing
059ec3d9
PH
1554*/
1555
17c76198
PP
1556void
1557tls_close(BOOL shutdown)
059ec3d9 1558{
17c76198 1559exim_gnutls_state_st *state = current_global_tls_state;
059ec3d9 1560
17c76198
PP
1561if (tls_active < 0) return; /* TLS was not active */
1562
1563if (shutdown)
1564 {
1565 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
1566 gnutls_bye(state->session, GNUTLS_SHUT_WR);
1567 }
1568
1569gnutls_deinit(state->session);
1570
1571memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
1572
1573if ((state_server.session == NULL) && (state_client.session == NULL))
1574 {
1575 gnutls_global_deinit();
1576 exim_gnutls_base_init_done = FALSE;
1577 }
7199e1ee 1578
17c76198 1579tls_active = -1;
059ec3d9
PH
1580}
1581
1582
1583
17c76198 1584
059ec3d9
PH
1585/*************************************************
1586* TLS version of getc *
1587*************************************************/
1588
1589/* This gets the next byte from the TLS input buffer. If the buffer is empty,
1590it refills the buffer via the GnuTLS reading function.
1591
17c76198
PP
1592This feeds DKIM and should be used for all message-body reads.
1593
059ec3d9
PH
1594Arguments: none
1595Returns: the next character or EOF
1596*/
1597
1598int
1599tls_getc(void)
1600{
17c76198
PP
1601exim_gnutls_state_st *state = current_global_tls_state;
1602if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
059ec3d9 1603 {
17c76198 1604 ssize_t inbytes;
059ec3d9 1605
17c76198
PP
1606 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
1607 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
1608
1609 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 1610 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
059ec3d9
PH
1611 ssl_xfer_buffer_size);
1612 alarm(0);
1613
1614 /* A zero-byte return appears to mean that the TLS session has been
1615 closed down, not that the socket itself has been closed down. Revert to
1616 non-TLS handling. */
1617
1618 if (inbytes == 0)
1619 {
1620 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1621
1622 receive_getc = smtp_getc;
1623 receive_ungetc = smtp_ungetc;
1624 receive_feof = smtp_feof;
1625 receive_ferror = smtp_ferror;
58eb016e 1626 receive_smtp_buffered = smtp_buffered;
059ec3d9 1627
17c76198
PP
1628 gnutls_deinit(state->session);
1629 state->session = NULL;
059ec3d9 1630 tls_active = -1;
17c76198
PP
1631 tls_bits = 0;
1632 tls_certificate_verified = FALSE;
1633 tls_channelbinding_b64 = NULL;
059ec3d9
PH
1634 tls_cipher = NULL;
1635 tls_peerdn = NULL;
1636
1637 return smtp_getc();
1638 }
1639
1640 /* Handle genuine errors */
1641
1642 else if (inbytes < 0)
1643 {
17c76198
PP
1644 record_io_error(state, (int) inbytes, US"recv", NULL);
1645 state->xfer_error = 1;
059ec3d9
PH
1646 return EOF;
1647 }
80a47a2c 1648#ifndef DISABLE_DKIM
17c76198 1649 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
80a47a2c 1650#endif
17c76198
PP
1651 state->xfer_buffer_hwm = (int) inbytes;
1652 state->xfer_buffer_lwm = 0;
059ec3d9
PH
1653 }
1654
059ec3d9
PH
1655/* Something in the buffer; return next uschar */
1656
17c76198 1657return state->xfer_buffer[state->xfer_buffer_lwm++];
059ec3d9
PH
1658}
1659
1660
1661
17c76198 1662
059ec3d9
PH
1663/*************************************************
1664* Read bytes from TLS channel *
1665*************************************************/
1666
17c76198
PP
1667/* This does not feed DKIM, so if the caller uses this for reading message body,
1668then the caller must feed DKIM.
059ec3d9
PH
1669Arguments:
1670 buff buffer of data
1671 len size of buffer
1672
1673Returns: the number of bytes read
1674 -1 after a failed read
1675*/
1676
1677int
1678tls_read(uschar *buff, size_t len)
1679{
17c76198
PP
1680exim_gnutls_state_st *state = current_global_tls_state;
1681ssize_t inbytes;
059ec3d9 1682
17c76198
PP
1683if (len > INT_MAX)
1684 len = INT_MAX;
059ec3d9 1685
17c76198
PP
1686if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
1687 DEBUG(D_tls)
1688 debug_printf("*** PROBABLY A BUG *** " \
1689 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
1690 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
1691
1692DEBUG(D_tls)
1693 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
1694 state->session, buff, len);
1695
1696inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
1697if (inbytes > 0) return inbytes;
1698if (inbytes == 0)
1699 {
1700 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
1701 }
17c76198 1702else record_io_error(state, (int)inbytes, US"recv", NULL);
059ec3d9
PH
1703
1704return -1;
1705}
1706
1707
1708
17c76198 1709
059ec3d9
PH
1710/*************************************************
1711* Write bytes down TLS channel *
1712*************************************************/
1713
1714/*
1715Arguments:
1716 buff buffer of data
1717 len number of bytes
1718
1719Returns: the number of bytes after a successful write,
1720 -1 after a failed write
1721*/
1722
1723int
1724tls_write(const uschar *buff, size_t len)
1725{
17c76198
PP
1726ssize_t outbytes;
1727size_t left = len;
1728exim_gnutls_state_st *state = current_global_tls_state;
059ec3d9 1729
17c76198 1730DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
059ec3d9
PH
1731while (left > 0)
1732 {
17c76198
PP
1733 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
1734 buff, left);
1735 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 1736
17c76198 1737 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
1738 if (outbytes < 0)
1739 {
17c76198 1740 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
1741 return -1;
1742 }
1743 if (outbytes == 0)
1744 {
17c76198 1745 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
1746 return -1;
1747 }
1748
1749 left -= outbytes;
1750 buff += outbytes;
1751 }
1752
17c76198
PP
1753if (len > INT_MAX)
1754 {
1755 DEBUG(D_tls)
1756 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
1757 len);
1758 len = INT_MAX;
1759 }
1760
1761return (int) len;
059ec3d9
PH
1762}
1763
1764
1765
17c76198 1766
059ec3d9 1767/*************************************************
17c76198 1768* Random number generation *
059ec3d9
PH
1769*************************************************/
1770
17c76198
PP
1771/* Pseudo-random number generation. The result is not expected to be
1772cryptographically strong but not so weak that someone will shoot themselves
1773in the foot using it as a nonce in input in some email header scheme or
1774whatever weirdness they'll twist this into. The result should handle fork()
1775and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 1776
17c76198
PP
1777Arguments:
1778 max range maximum
1779Returns a random number in range [0, max-1]
059ec3d9
PH
1780*/
1781
af3498d6 1782#ifdef HAVE_GNUTLS_RND
17c76198
PP
1783int
1784vaguely_random_number(int max)
059ec3d9 1785{
17c76198
PP
1786unsigned int r;
1787int i, needed_len;
1788uschar *p;
1789uschar smallbuf[sizeof(r)];
1790
1791if (max <= 1)
1792 return 0;
1793
1794needed_len = sizeof(r);
1795/* Don't take 8 times more entropy than needed if int is 8 octets and we were
1796 * asked for a number less than 10. */
1797for (r = max, i = 0; r; ++i)
1798 r >>= 1;
1799i = (i + 7) / 8;
1800if (i < needed_len)
1801 needed_len = i;
1802
1803i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
1804if (i < 0)
059ec3d9 1805 {
17c76198
PP
1806 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
1807 return vaguely_random_number_fallback(max);
1808 }
1809r = 0;
1810for (p = smallbuf; needed_len; --needed_len, ++p)
1811 {
1812 r *= 256;
1813 r += *p;
059ec3d9
PH
1814 }
1815
17c76198
PP
1816/* We don't particularly care about weighted results; if someone wants
1817 * smooth distribution and cares enough then they should submit a patch then. */
1818return r % max;
059ec3d9 1819}
af3498d6
PP
1820#else /* HAVE_GNUTLS_RND */
1821int
1822vaguely_random_number(int max)
1823{
1824 return vaguely_random_number_fallback(max);
1825}
1826#endif /* HAVE_GNUTLS_RND */
059ec3d9 1827
36f12725
NM
1828
1829
1830
1831/*************************************************
1832* Report the library versions. *
1833*************************************************/
1834
1835/* See a description in tls-openssl.c for an explanation of why this exists.
1836
1837Arguments: a FILE* to print the results to
1838Returns: nothing
1839*/
1840
1841void
1842tls_version_report(FILE *f)
1843{
754a0503
PP
1844fprintf(f, "Library version: GnuTLS: Compile: %s\n"
1845 " Runtime: %s\n",
1846 LIBGNUTLS_VERSION,
1847 gnutls_check_version(NULL));
36f12725
NM
1848}
1849
059ec3d9 1850/* End of tls-gnu.c */