GnuTLS: avoid using OCSP on buggy library versions. Bug 1664
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
16Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
a5f239e4
PP
42/* needed to disable PKCS11 autoload unless requested */
43#if GNUTLS_VERSION_NUMBER >= 0x020c00
44# include <gnutls/pkcs11.h>
45#endif
7e07527a
JH
46#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
47# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
48# define DISABLE_OCSP
49#endif
774ef2d7
JH
50#if GNUTLS_VERSION_NUMBER < 0x020a00 && defined(EXPERIMENTAL_EVENT)
51# warning "GnuTLS library version too old; tls:cert event unsupported"
52# undef EXPERIMENTAL_EVENT
a7538db1 53#endif
a7fec7a7
JH
54#if GNUTLS_VERSION_NUMBER >= 0x030306
55# define SUPPORT_CA_DIR
56#else
57# undef SUPPORT_CA_DIR
58#endif
cb1d7830
JH
59#if GNUTLS_VERSION_NUMBER >= 0x030314
60# define SUPPORT_SYSDEFAULT_CABUNDLE
61#endif
7e07527a 62
f2de3a33 63#ifndef DISABLE_OCSP
2b4a568d
JH
64# include <gnutls/ocsp.h>
65#endif
059ec3d9 66
17c76198 67/* GnuTLS 2 vs 3
059ec3d9 68
17c76198
PP
69GnuTLS 3 only:
70 gnutls_global_set_audit_log_function()
059ec3d9 71
17c76198
PP
72Changes:
73 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
74*/
059ec3d9 75
17c76198 76/* Local static variables for GnuTLS */
059ec3d9 77
17c76198 78/* Values for verify_requirement */
059ec3d9 79
e51c7be2 80enum peer_verify_requirement
aa2a70ba 81 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
059ec3d9 82
17c76198
PP
83/* This holds most state for server or client; with this, we can set up an
84outbound TLS-enabled connection in an ACL callout, while not stomping all
85over the TLS variables available for expansion.
059ec3d9 86
17c76198
PP
87Some of these correspond to variables in globals.c; those variables will
88be set to point to content in one of these instances, as appropriate for
89the stage of the process lifetime.
059ec3d9 90
389ca47a 91Not handled here: global tls_channelbinding_b64.
17c76198 92*/
059ec3d9 93
17c76198 94typedef struct exim_gnutls_state {
9d1c15ef 95 gnutls_session_t session;
17c76198 96 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 97 gnutls_priority_t priority_cache;
17c76198 98 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
99 int fd_in;
100 int fd_out;
101 BOOL peer_cert_verified;
102 BOOL trigger_sni_changes;
103 BOOL have_set_peerdn;
17c76198 104 const struct host_item *host;
9d1c15ef
JH
105 gnutls_x509_crt_t peercert;
106 uschar *peerdn;
107 uschar *ciphersuite;
108 uschar *received_sni;
17c76198
PP
109
110 const uschar *tls_certificate;
111 const uschar *tls_privatekey;
112 const uschar *tls_sni; /* client send only, not received */
113 const uschar *tls_verify_certificates;
114 const uschar *tls_crl;
115 const uschar *tls_require_ciphers;
e51c7be2 116
17c76198
PP
117 uschar *exp_tls_certificate;
118 uschar *exp_tls_privatekey;
17c76198
PP
119 uschar *exp_tls_verify_certificates;
120 uschar *exp_tls_crl;
121 uschar *exp_tls_require_ciphers;
44662487 122 uschar *exp_tls_ocsp_file;
55414b25 123 const uschar *exp_tls_verify_cert_hostnames;
774ef2d7 124#ifdef EXPERIMENTAL_EVENT
a7538db1
JH
125 uschar *event_action;
126#endif
17c76198 127
389ca47a 128 tls_support *tlsp; /* set in tls_init() */
817d9f57 129
17c76198
PP
130 uschar *xfer_buffer;
131 int xfer_buffer_lwm;
132 int xfer_buffer_hwm;
133 int xfer_eof;
134 int xfer_error;
17c76198
PP
135} exim_gnutls_state_st;
136
137static const exim_gnutls_state_st exim_gnutls_state_init = {
4fe99a6c 138 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
75fe387d 139 NULL, NULL, NULL, NULL,
17c76198 140 NULL, NULL, NULL, NULL, NULL, NULL,
44662487 141 NULL, NULL, NULL, NULL, NULL, NULL, NULL,
01a4a5c5 142 NULL,
774ef2d7 143#ifdef EXPERIMENTAL_EVENT
a7538db1
JH
144 NULL,
145#endif
817d9f57 146 NULL,
17c76198 147 NULL, 0, 0, 0, 0,
17c76198 148};
83da1223 149
17c76198
PP
150/* Not only do we have our own APIs which don't pass around state, assuming
151it's held in globals, GnuTLS doesn't appear to let us register callback data
152for callbacks, or as part of the session, so we have to keep a "this is the
153context we're currently dealing with" pointer and rely upon being
154single-threaded to keep from processing data on an inbound TLS connection while
155talking to another TLS connection for an outbound check. This does mean that
156there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
157second connection.
158XXX But see gnutls_session_get_ptr()
159*/
059ec3d9 160
17c76198 161static exim_gnutls_state_st state_server, state_client;
059ec3d9 162
17c76198
PP
163/* dh_params are initialised once within the lifetime of a process using TLS;
164if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
165don't want to repeat this. */
83da1223 166
17c76198 167static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 168
17c76198 169/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 170
17c76198 171static const int ssl_session_timeout = 200;
059ec3d9 172
17c76198 173static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 174
17c76198 175/* Guard library core initialisation */
83da1223 176
17c76198 177static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 178
9196d5bf
JH
179static BOOL gnutls_buggy_ocsp = FALSE;
180
059ec3d9 181
17c76198 182/* ------------------------------------------------------------------------ */
17c76198 183/* macros */
83da1223 184
17c76198 185#define MAX_HOST_LEN 255
83da1223 186
17c76198
PP
187/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
188the library logging; a value less than 0 disables the calls to set up logging
189callbacks. */
2c17bb02 190#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
a7538db1 191# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 192#endif
83da1223 193
2c17bb02 194#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 195# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 196#endif
83da1223 197
af3498d6
PP
198/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
199can ask for a bit-strength. Without that, we stick to the constant we had
200before, for now. */
2c17bb02 201#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 202# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 203#endif
af3498d6 204
17c76198
PP
205#define exim_gnutls_err_check(Label) do { \
206 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
059ec3d9 207
17c76198 208#define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
83da1223 209
17c76198 210#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
211# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
212# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
213# define HAVE_GNUTLS_RND
2519e60d
TL
214/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
215 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
216 * isn't available sometimes, so this needs to become a conditional
217 * compilation; the sanest way to deal with this being a problem on
218 * older OSes is to block it in the Local/Makefile with this compiler
219 * definition */
e51c7be2
JH
220# ifndef AVOID_GNUTLS_PKCS11
221# define HAVE_GNUTLS_PKCS11
222# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 223#endif
83da1223 224
af3498d6
PP
225
226
227
228/* ------------------------------------------------------------------------ */
229/* Callback declarations */
230
231#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
232static void exim_gnutls_logger_cb(int level, const char *message);
233#endif
234
235static int exim_sni_handling_cb(gnutls_session_t session);
236
f2de3a33 237#ifndef DISABLE_OCSP
44662487
JH
238static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
239 gnutls_datum_t * ocsp_response);
240#endif
af3498d6
PP
241
242
243
17c76198
PP
244/* ------------------------------------------------------------------------ */
245/* Static functions */
059ec3d9
PH
246
247/*************************************************
248* Handle TLS error *
249*************************************************/
250
251/* Called from lots of places when errors occur before actually starting to do
252the TLS handshake, that is, while the session is still in clear. Always returns
253DEFER for a server and FAIL for a client so that most calls can use "return
254tls_error(...)" to do this processing and then give an appropriate return. A
255single function is used for both server and client, because it is called from
256some shared functions.
257
258Argument:
259 prefix text to include in the logged error
7199e1ee
TF
260 msg additional error string (may be NULL)
261 usually obtained from gnutls_strerror()
17c76198
PP
262 host NULL if setting up a server;
263 the connected host if setting up a client
059ec3d9
PH
264
265Returns: OK/DEFER/FAIL
266*/
267
268static int
17c76198 269tls_error(const uschar *prefix, const char *msg, const host_item *host)
059ec3d9 270{
17c76198
PP
271if (host)
272 {
c562fd30 273 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s)%s%s",
17c76198
PP
274 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
275 return FAIL;
276 }
277else
059ec3d9 278 {
7199e1ee 279 uschar *conn_info = smtp_get_connection_info();
17c76198 280 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee 281 conn_info += 5;
c562fd30 282 /* I'd like to get separated H= here, but too hard for now */
7199e1ee 283 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
17c76198 284 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
059ec3d9
PH
285 return DEFER;
286 }
059ec3d9
PH
287}
288
289
290
17c76198 291
059ec3d9 292/*************************************************
17c76198 293* Deal with logging errors during I/O *
059ec3d9
PH
294*************************************************/
295
17c76198 296/* We have to get the identity of the peer from saved data.
059ec3d9 297
17c76198
PP
298Argument:
299 state the current GnuTLS exim state container
300 rc the GnuTLS error code, or 0 if it's a local error
301 when text identifying read or write
302 text local error text when ec is 0
059ec3d9 303
17c76198 304Returns: nothing
059ec3d9
PH
305*/
306
17c76198
PP
307static void
308record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 309{
17c76198 310const char *msg;
059ec3d9 311
17c76198
PP
312if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
313 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
314 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
315else
316 msg = gnutls_strerror(rc);
059ec3d9 317
17c76198
PP
318tls_error(when, msg, state->host);
319}
059ec3d9 320
059ec3d9 321
059ec3d9 322
059ec3d9 323
17c76198
PP
324/*************************************************
325* Set various Exim expansion vars *
326*************************************************/
059ec3d9 327
e51c7be2
JH
328#define exim_gnutls_cert_err(Label) \
329 do \
330 { \
331 if (rc != GNUTLS_E_SUCCESS) \
332 { \
333 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
334 (Label), gnutls_strerror(rc)); \
335 return rc; \
336 } \
337 } while (0)
9d1c15ef
JH
338
339static int
340import_cert(const gnutls_datum * cert, gnutls_x509_crt_t * crtp)
341{
342int rc;
343
344rc = gnutls_x509_crt_init(crtp);
345exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
346
347rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
348exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
349
350return rc;
351}
352
353#undef exim_gnutls_cert_err
354
355
17c76198
PP
356/* We set various Exim global variables from the state, once a session has
357been established. With TLS callouts, may need to change this to stack
358variables, or just re-call it with the server state after client callout
359has finished.
059ec3d9 360
9d1c15ef 361Make sure anything set here is unset in tls_getc().
17c76198
PP
362
363Sets:
364 tls_active fd
365 tls_bits strength indicator
366 tls_certificate_verified bool indicator
367 tls_channelbinding_b64 for some SASL mechanisms
368 tls_cipher a string
9d1c15ef 369 tls_peercert pointer to library internal
17c76198
PP
370 tls_peerdn a string
371 tls_sni a (UTF-8) string
9d1c15ef 372 tls_ourcert pointer to library internal
17c76198
PP
373
374Argument:
375 state the relevant exim_gnutls_state_st *
376*/
377
378static void
9d1c15ef 379extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 380{
17c76198 381gnutls_cipher_algorithm_t cipher;
17c76198
PP
382#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
383int old_pool;
384int rc;
385gnutls_datum_t channel;
386#endif
9d1c15ef 387tls_support * tlsp = state->tlsp;
17c76198 388
9d1c15ef 389tlsp->active = state->fd_out;
17c76198
PP
390
391cipher = gnutls_cipher_get(state->session);
392/* returns size in "bytes" */
9d1c15ef 393tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 394
9d1c15ef 395tlsp->cipher = state->ciphersuite;
17c76198 396
817d9f57 397DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 398
9d1c15ef 399tlsp->certificate_verified = state->peer_cert_verified;
059ec3d9 400
17c76198
PP
401/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
402only available for use for authenticators while this TLS session is running. */
403
404tls_channelbinding_b64 = NULL;
405#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
406channel.data = NULL;
407channel.size = 0;
408rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
409if (rc) {
410 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
411} else {
412 old_pool = store_pool;
413 store_pool = POOL_PERM;
414 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
415 store_pool = old_pool;
416 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
417}
418#endif
419
9d1c15ef
JH
420/* peercert is set in peer_status() */
421tlsp->peerdn = state->peerdn;
422tlsp->sni = state->received_sni;
423
424/* record our certificate */
425 {
426 const gnutls_datum * cert = gnutls_certificate_get_ours(state->session);
427 gnutls_x509_crt_t crt;
428
429 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
430 }
059ec3d9
PH
431}
432
433
434
17c76198 435
059ec3d9 436/*************************************************
575643cd 437* Setup up DH parameters *
059ec3d9
PH
438*************************************************/
439
575643cd 440/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
441be re-generated every so often, depending on security policy. What we do is to
442keep these parameters in a file in the spool directory. If the file does not
443exist, we generate them. This means that it is easy to cause a regeneration.
444
445The new file is written as a temporary file and renamed, so that an incomplete
446file is never present. If two processes both compute some new parameters, you
447waste a bit of effort, but it doesn't seem worth messing around with locking to
448prevent this.
449
059ec3d9
PH
450Returns: OK/DEFER/FAIL
451*/
452
453static int
17c76198 454init_server_dh(void)
059ec3d9 455{
17c76198
PP
456int fd, rc;
457unsigned int dh_bits;
b5aea5e1 458gnutls_datum m;
a799883d
PP
459uschar filename_buf[PATH_MAX];
460uschar *filename = NULL;
17c76198 461size_t sz;
a799883d
PP
462uschar *exp_tls_dhparam;
463BOOL use_file_in_spool = FALSE;
464BOOL use_fixed_file = FALSE;
17c76198 465host_item *host = NULL; /* dummy for macros */
059ec3d9 466
17c76198 467DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 468
17c76198
PP
469rc = gnutls_dh_params_init(&dh_server_params);
470exim_gnutls_err_check(US"gnutls_dh_params_init");
059ec3d9 471
a799883d
PP
472m.data = NULL;
473m.size = 0;
474
475if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
476 return DEFER;
477
478if (!exp_tls_dhparam)
479 {
480 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
481 m.data = US std_dh_prime_default();
482 m.size = Ustrlen(m.data);
483 }
484else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
485 use_file_in_spool = TRUE;
486else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
487 {
488 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
489 return OK;
490 }
491else if (exp_tls_dhparam[0] != '/')
492 {
493 m.data = US std_dh_prime_named(exp_tls_dhparam);
494 if (m.data == NULL)
495 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
496 m.size = Ustrlen(m.data);
497 }
498else
499 {
500 use_fixed_file = TRUE;
501 filename = exp_tls_dhparam;
502 }
503
504if (m.data)
505 {
506 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
507 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
508 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
509 return OK;
510 }
511
af3498d6
PP
512#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
513/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
514different filename and ensure we have sufficient bits. */
515dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
516if (!dh_bits)
517 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
af3498d6 518DEBUG(D_tls)
b34fc30c 519 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
520 dh_bits);
521#else
522dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
523DEBUG(D_tls)
524 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
525 dh_bits);
526#endif
059ec3d9 527
3375e053
PP
528/* Some clients have hard-coded limits. */
529if (dh_bits > tls_dh_max_bits)
530 {
531 DEBUG(D_tls)
532 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
533 tls_dh_max_bits);
534 dh_bits = tls_dh_max_bits;
535 }
536
a799883d
PP
537if (use_file_in_spool)
538 {
539 if (!string_format(filename_buf, sizeof(filename_buf),
540 "%s/gnutls-params-%d", spool_directory, dh_bits))
541 return tls_error(US"overlong filename", NULL, NULL);
542 filename = filename_buf;
543 }
059ec3d9 544
b5aea5e1 545/* Open the cache file for reading and if successful, read it and set up the
575643cd 546parameters. */
059ec3d9
PH
547
548fd = Uopen(filename, O_RDONLY, 0);
b5aea5e1 549if (fd >= 0)
059ec3d9 550 {
b5aea5e1 551 struct stat statbuf;
17c76198
PP
552 FILE *fp;
553 int saved_errno;
554
555 if (fstat(fd, &statbuf) < 0) /* EIO */
556 {
557 saved_errno = errno;
558 (void)close(fd);
559 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
560 }
561 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
562 {
563 (void)close(fd);
17c76198
PP
564 return tls_error(US"TLS cache not a file", NULL, NULL);
565 }
566 fp = fdopen(fd, "rb");
567 if (!fp)
568 {
569 saved_errno = errno;
570 (void)close(fd);
571 return tls_error(US"fdopen(TLS cache stat fd) failed",
572 strerror(saved_errno), NULL);
b5aea5e1 573 }
059ec3d9 574
b5aea5e1
PH
575 m.size = statbuf.st_size;
576 m.data = malloc(m.size);
577 if (m.data == NULL)
17c76198
PP
578 {
579 fclose(fp);
580 return tls_error(US"malloc failed", strerror(errno), NULL);
581 }
582 sz = fread(m.data, m.size, 1, fp);
583 if (!sz)
584 {
585 saved_errno = errno;
586 fclose(fp);
587 free(m.data);
588 return tls_error(US"fread failed", strerror(saved_errno), NULL);
589 }
590 fclose(fp);
b5aea5e1 591
17c76198 592 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 593 free(m.data);
17c76198
PP
594 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
595 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
596 }
597
598/* If the file does not exist, fall through to compute new data and cache it.
599If there was any other opening error, it is serious. */
600
182ad5cf
PH
601else if (errno == ENOENT)
602 {
17c76198 603 rc = -1;
182ad5cf 604 DEBUG(D_tls)
17c76198 605 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
606 }
607else
17c76198
PP
608 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
609 NULL, NULL);
b5aea5e1
PH
610
611/* If ret < 0, either the cache file does not exist, or the data it contains
612is not useful. One particular case of this is when upgrading from an older
613release of Exim in which the data was stored in a different format. We don't
614try to be clever and support both formats; we just regenerate new data in this
615case. */
616
17c76198 617if (rc < 0)
b5aea5e1 618 {
17c76198 619 uschar *temp_fn;
201f5254 620 unsigned int dh_bits_gen = dh_bits;
059ec3d9 621
17c76198
PP
622 if ((PATH_MAX - Ustrlen(filename)) < 10)
623 return tls_error(US"Filename too long to generate replacement",
624 CS filename, NULL);
059ec3d9 625
17c76198
PP
626 temp_fn = string_copy(US "%s.XXXXXXX");
627 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
059ec3d9 628 if (fd < 0)
17c76198 629 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
059ec3d9
PH
630 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
631
201f5254
PP
632 /* GnuTLS overshoots!
633 * If we ask for 2236, we might get 2237 or more.
634 * But there's no way to ask GnuTLS how many bits there really are.
635 * We can ask how many bits were used in a TLS session, but that's it!
636 * The prime itself is hidden behind too much abstraction.
637 * So we ask for less, and proceed on a wing and a prayer.
638 * First attempt, subtracted 3 for 2233 and got 2240.
639 */
cae6e576 640 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
641 {
642 dh_bits_gen = dh_bits - 10;
643 DEBUG(D_tls)
644 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
645 dh_bits_gen);
646 }
647
648 DEBUG(D_tls)
649 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
650 dh_bits_gen);
651 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
17c76198
PP
652 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
653
654 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
655 and I confirmed that a NULL call to get the size first is how the GnuTLS
656 sample apps handle this. */
657
658 sz = 0;
659 m.data = NULL;
660 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
661 m.data, &sz);
662 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
663 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
664 m.size = sz;
b5aea5e1
PH
665 m.data = malloc(m.size);
666 if (m.data == NULL)
17c76198 667 return tls_error(US"memory allocation failed", strerror(errno), NULL);
1f00591e 668 /* this will return a size 1 less than the allocation size above */
17c76198 669 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 670 m.data, &sz);
17c76198
PP
671 if (rc != GNUTLS_E_SUCCESS)
672 {
673 free(m.data);
674 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
675 }
1f00591e 676 m.size = sz; /* shrink by 1, probably */
059ec3d9 677
17c76198
PP
678 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
679 if (sz != m.size)
680 {
681 free(m.data);
682 return tls_error(US"TLS cache write D-H params failed",
683 strerror(errno), NULL);
684 }
b5aea5e1 685 free(m.data);
17c76198
PP
686 sz = write_to_fd_buf(fd, US"\n", 1);
687 if (sz != 1)
688 return tls_error(US"TLS cache write D-H params final newline failed",
689 strerror(errno), NULL);
690
691 rc = close(fd);
692 if (rc)
693 return tls_error(US"TLS cache write close() failed",
694 strerror(errno), NULL);
059ec3d9 695
17c76198
PP
696 if (Urename(temp_fn, filename) < 0)
697 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
698 temp_fn, filename), strerror(errno), NULL);
059ec3d9 699
17c76198 700 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
701 }
702
17c76198 703DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
704return OK;
705}
706
707
708
709
710/*************************************************
17c76198 711* Variables re-expanded post-SNI *
059ec3d9
PH
712*************************************************/
713
17c76198
PP
714/* Called from both server and client code, via tls_init(), and also from
715the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
716
717We can tell the two apart by state->received_sni being non-NULL in callback.
718
719The callback should not call us unless state->trigger_sni_changes is true,
720which we are responsible for setting on the first pass through.
059ec3d9
PH
721
722Arguments:
17c76198 723 state exim_gnutls_state_st *
059ec3d9
PH
724
725Returns: OK/DEFER/FAIL
726*/
727
728static int
17c76198 729tls_expand_session_files(exim_gnutls_state_st *state)
059ec3d9 730{
1365611d 731struct stat statbuf;
059ec3d9 732int rc;
17c76198
PP
733const host_item *host = state->host; /* macro should be reconsidered? */
734uschar *saved_tls_certificate = NULL;
735uschar *saved_tls_privatekey = NULL;
736uschar *saved_tls_verify_certificates = NULL;
737uschar *saved_tls_crl = NULL;
738int cert_count;
739
740/* We check for tls_sni *before* expansion. */
2b4a568d 741if (!host) /* server */
17c76198
PP
742 {
743 if (!state->received_sni)
744 {
d9b2312b
JH
745 if (state->tls_certificate &&
746 (Ustrstr(state->tls_certificate, US"tls_sni") ||
747 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
748 Ustrstr(state->tls_certificate, US"tls_out_sni")
749 ))
17c76198
PP
750 {
751 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
752 state->trigger_sni_changes = TRUE;
753 }
754 }
755 else
756 {
1365611d 757 /* useful for debugging */
17c76198
PP
758 saved_tls_certificate = state->exp_tls_certificate;
759 saved_tls_privatekey = state->exp_tls_privatekey;
760 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
761 saved_tls_crl = state->exp_tls_crl;
762 }
763 }
059ec3d9 764
1365611d
PP
765rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
766exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
767
17c76198
PP
768/* remember: expand_check_tlsvar() is expand_check() but fiddling with
769state members, assuming consistent naming; and expand_check() returns
770false if expansion failed, unless expansion was forced to fail. */
059ec3d9 771
17c76198
PP
772/* check if we at least have a certificate, before doing expensive
773D-H generation. */
059ec3d9 774
17c76198
PP
775if (!expand_check_tlsvar(tls_certificate))
776 return DEFER;
059ec3d9 777
17c76198 778/* certificate is mandatory in server, optional in client */
059ec3d9 779
17c76198
PP
780if ((state->exp_tls_certificate == NULL) ||
781 (*state->exp_tls_certificate == '\0'))
782 {
2b4a568d 783 if (!host)
17c76198
PP
784 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
785 else
786 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
787 }
059ec3d9 788
17c76198 789if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
059ec3d9
PH
790 return DEFER;
791
17c76198
PP
792/* tls_privatekey is optional, defaulting to same file as certificate */
793
794if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 795 {
17c76198
PP
796 state->tls_privatekey = state->tls_certificate;
797 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 798 }
c91535f3 799
059ec3d9 800
17c76198 801if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
802 {
803 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
804 state->exp_tls_certificate, state->exp_tls_privatekey);
805
806 if (state->received_sni)
de365ded 807 {
17c76198
PP
808 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
809 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
810 {
b34fc30c 811 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
812 }
813 else
814 {
b34fc30c 815 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 816 }
8e669ac1 817 }
059ec3d9 818
1365611d
PP
819 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
820 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
821 GNUTLS_X509_FMT_PEM);
822 exim_gnutls_err_check(
823 string_sprintf("cert/key setup: cert=%s key=%s",
824 state->exp_tls_certificate, state->exp_tls_privatekey));
825 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
b34fc30c 826 } /* tls_certificate */
059ec3d9 827
2b4a568d
JH
828
829/* Set the OCSP stapling server info */
830
f2de3a33 831#ifndef DISABLE_OCSP
2b4a568d
JH
832if ( !host /* server */
833 && tls_ocsp_file
834 )
835 {
9196d5bf
JH
836 if (gnutls_buggy_ocsp)
837 {
838 DEBUG(D_tls) debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
839 }
840 else
841 {
842 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file",
843 &state->exp_tls_ocsp_file))
844 return DEFER;
2b4a568d 845
9196d5bf
JH
846 /* Use the full callback method for stapling just to get observability.
847 More efficient would be to read the file once only, if it never changed
848 (due to SNI). Would need restart on file update, or watch datestamp. */
44662487 849
9196d5bf
JH
850 gnutls_certificate_set_ocsp_status_request_function(state->x509_cred,
851 server_ocsp_stapling_cb, state->exp_tls_ocsp_file);
2b4a568d 852
9196d5bf
JH
853 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", state->exp_tls_ocsp_file);
854 }
2b4a568d
JH
855 }
856#endif
857
858
059ec3d9
PH
859/* Set the trusted CAs file if one is provided, and then add the CRL if one is
860provided. Experiment shows that, if the certificate file is empty, an unhelpful
861error message is provided. However, if we just refrain from setting anything up
862in that case, certificate verification fails, which seems to be the correct
863behaviour. */
864
610ff438 865if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 866 {
17c76198 867 if (!expand_check_tlsvar(tls_verify_certificates))
059ec3d9 868 return DEFER;
610ff438
JH
869#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
870 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
871 state->exp_tls_verify_certificates = NULL;
872#endif
17c76198
PP
873 if (state->tls_crl && *state->tls_crl)
874 if (!expand_check_tlsvar(tls_crl))
875 return DEFER;
059ec3d9 876
1365611d
PP
877 if (!(state->exp_tls_verify_certificates &&
878 *state->exp_tls_verify_certificates))
b34fc30c
PP
879 {
880 DEBUG(D_tls)
1365611d
PP
881 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
882 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 883 return OK;
b34fc30c 884 }
1365611d 885 }
83e2f8a2
PP
886else
887 {
888 DEBUG(D_tls)
889 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
890 return OK;
891 }
17c76198 892
cb1d7830
JH
893#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
894if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
895 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
896else
897#endif
1365611d 898 {
cb1d7830
JH
899 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
900 {
901 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
902 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
903 strerror(errno));
904 return DEFER;
905 }
17c76198 906
a7fec7a7 907#ifndef SUPPORT_CA_DIR
cb1d7830
JH
908 /* The test suite passes in /dev/null; we could check for that path explicitly,
909 but who knows if someone has some weird FIFO which always dumps some certs, or
910 other weirdness. The thing we really want to check is that it's not a
911 directory, since while OpenSSL supports that, GnuTLS does not.
912 So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
913 if (S_ISDIR(statbuf.st_mode))
914 {
915 DEBUG(D_tls)
916 debug_printf("verify certificates path is a dir: \"%s\"\n",
917 state->exp_tls_verify_certificates);
918 log_write(0, LOG_MAIN|LOG_PANIC,
919 "tls_verify_certificates \"%s\" is a directory",
920 state->exp_tls_verify_certificates);
921 return DEFER;
922 }
a7fec7a7 923#endif
059ec3d9 924
cb1d7830
JH
925 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
926 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 927
cb1d7830
JH
928 if (statbuf.st_size == 0)
929 {
930 DEBUG(D_tls)
931 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
932 return OK;
933 }
059ec3d9 934
cb1d7830 935 cert_count =
a7fec7a7
JH
936
937#ifdef SUPPORT_CA_DIR
cb1d7830
JH
938 (statbuf.st_mode & S_IFMT) == S_IFDIR
939 ?
940 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
941 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
942 :
a7fec7a7 943#endif
cb1d7830
JH
944 gnutls_certificate_set_x509_trust_file(state->x509_cred,
945 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
946 }
a7fec7a7 947
1365611d
PP
948if (cert_count < 0)
949 {
950 rc = cert_count;
cb1d7830 951 exim_gnutls_err_check(US"setting certificate trust");
1365611d
PP
952 }
953DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 954
5c8cda3a
PP
955if (state->tls_crl && *state->tls_crl &&
956 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 957 {
5c8cda3a
PP
958 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
959 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
960 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
961 if (cert_count < 0)
1365611d 962 {
5c8cda3a 963 rc = cert_count;
1365611d
PP
964 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
965 }
5c8cda3a 966 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 967 }
059ec3d9 968
059ec3d9
PH
969return OK;
970}
971
972
973
974
975/*************************************************
1365611d
PP
976* Set X.509 state variables *
977*************************************************/
978
979/* In GnuTLS, the registered cert/key are not replaced by a later
980set of a cert/key, so for SNI support we need a whole new x509_cred
981structure. Which means various other non-re-expanded pieces of state
982need to be re-set in the new struct, so the setting logic is pulled
983out to this.
984
985Arguments:
986 state exim_gnutls_state_st *
987
988Returns: OK/DEFER/FAIL
989*/
990
991static int
992tls_set_remaining_x509(exim_gnutls_state_st *state)
993{
994int rc;
995const host_item *host = state->host; /* macro should be reconsidered? */
996
997/* Create D-H parameters, or read them from the cache file. This function does
998its own SMTP error messaging. This only happens for the server, TLS D-H ignores
999client-side params. */
1000
1001if (!state->host)
1002 {
1003 if (!dh_server_params)
1004 {
1005 rc = init_server_dh();
1006 if (rc != OK) return rc;
1007 }
1008 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1009 }
1010
1011/* Link the credentials to the session. */
1012
1013rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1014exim_gnutls_err_check(US"gnutls_credentials_set");
1015
1016return OK;
1017}
1018
1019/*************************************************
17c76198 1020* Initialize for GnuTLS *
059ec3d9
PH
1021*************************************************/
1022
9196d5bf
JH
1023
1024static BOOL
1025tls_is_buggy_ocsp(void)
1026{
1027const uschar * s;
1028uschar maj, mid, mic;
1029
1030s = CUS gnutls_check_version(NULL);
1031maj = atoi(CCS s);
1032if (maj == 3)
1033 {
1034 while (*s && *s != '.') s++;
1035 mid = atoi(CCS ++s);
1036 if (mid <= 2)
1037 return TRUE;
1038 else if (mid >= 5)
1039 return FALSE;
1040 else
1041 {
1042 while (*s && *s != '.') s++;
1043 mic = atoi(CCS ++s);
1044 return mic <= (mid == 3 ? 16 : 3);
1045 }
1046 }
1047return FALSE;
1048}
1049
1050
1051
17c76198
PP
1052/* Called from both server and client code. In the case of a server, errors
1053before actual TLS negotiation return DEFER.
059ec3d9
PH
1054
1055Arguments:
17c76198
PP
1056 host connected host, if client; NULL if server
1057 certificate certificate file
1058 privatekey private key file
1059 sni TLS SNI to send, sometimes when client; else NULL
1060 cas CA certs file
1061 crl CRL file
1062 require_ciphers tls_require_ciphers setting
817d9f57 1063 caller_state returned state-info structure
059ec3d9 1064
17c76198 1065Returns: OK/DEFER/FAIL
059ec3d9
PH
1066*/
1067
17c76198
PP
1068static int
1069tls_init(
1070 const host_item *host,
1071 const uschar *certificate,
1072 const uschar *privatekey,
1073 const uschar *sni,
1074 const uschar *cas,
1075 const uschar *crl,
1076 const uschar *require_ciphers,
1077 exim_gnutls_state_st **caller_state)
059ec3d9 1078{
17c76198
PP
1079exim_gnutls_state_st *state;
1080int rc;
1081size_t sz;
1082const char *errpos;
1083uschar *p;
1084BOOL want_default_priorities;
1085
1086if (!exim_gnutls_base_init_done)
059ec3d9 1087 {
17c76198
PP
1088 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1089
a5f239e4
PP
1090#ifdef HAVE_GNUTLS_PKCS11
1091 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1092 which loads modules from a config file, which sounds good and may be wanted
1093 by some sysadmin, but also means in common configurations that GNOME keyring
1094 environment variables are used and so breaks for users calling mailq.
1095 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1096 if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
1097 {
1098 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1099 exim_gnutls_err_check(US"gnutls_pkcs11_init");
1100 }
1101#endif
1102
17c76198
PP
1103 rc = gnutls_global_init();
1104 exim_gnutls_err_check(US"gnutls_global_init");
1105
1106#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1107 DEBUG(D_tls)
059ec3d9 1108 {
17c76198
PP
1109 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1110 /* arbitrarily chosen level; bump upto 9 for more */
1111 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1112 }
17c76198
PP
1113#endif
1114
9196d5bf
JH
1115 if ((gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
1116 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
1117
17c76198 1118 exim_gnutls_base_init_done = TRUE;
059ec3d9 1119 }
059ec3d9 1120
17c76198
PP
1121if (host)
1122 {
1123 state = &state_client;
1124 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 1125 state->tlsp = &tls_out;
17c76198
PP
1126 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1127 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1128 }
1129else
1130 {
1131 state = &state_server;
1132 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 1133 state->tlsp = &tls_in;
17c76198
PP
1134 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1135 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1136 }
1137exim_gnutls_err_check(US"gnutls_init");
059ec3d9 1138
17c76198 1139state->host = host;
059ec3d9 1140
17c76198
PP
1141state->tls_certificate = certificate;
1142state->tls_privatekey = privatekey;
5779e6aa 1143state->tls_require_ciphers = require_ciphers;
17c76198
PP
1144state->tls_sni = sni;
1145state->tls_verify_certificates = cas;
1146state->tls_crl = crl;
059ec3d9 1147
17c76198
PP
1148/* This handles the variables that might get re-expanded after TLS SNI;
1149that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1150
17c76198
PP
1151DEBUG(D_tls)
1152 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1153rc = tls_expand_session_files(state);
1154if (rc != OK) return rc;
059ec3d9 1155
1365611d
PP
1156/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1157requires a new structure afterwards. */
83da1223 1158
1365611d
PP
1159rc = tls_set_remaining_x509(state);
1160if (rc != OK) return rc;
83da1223 1161
17c76198
PP
1162/* set SNI in client, only */
1163if (host)
1164 {
0df4ab80 1165 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni))
17c76198 1166 return DEFER;
0df4ab80 1167 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1168 {
1169 DEBUG(D_tls)
0df4ab80
JH
1170 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1171 sz = Ustrlen(state->tlsp->sni);
17c76198 1172 rc = gnutls_server_name_set(state->session,
0df4ab80 1173 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
17c76198
PP
1174 exim_gnutls_err_check(US"gnutls_server_name_set");
1175 }
1176 }
1177else if (state->tls_sni)
1178 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1179 "have an SNI set for a client [%s]\n", state->tls_sni);
83da1223 1180
17c76198 1181/* This is the priority string support,
42bfef1e 1182http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1183and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1184This was backwards incompatible, but means Exim no longer needs to track
1185all algorithms and provide string forms for them. */
83da1223 1186
17c76198 1187want_default_priorities = TRUE;
83da1223 1188
17c76198 1189if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1190 {
17c76198
PP
1191 if (!expand_check_tlsvar(tls_require_ciphers))
1192 return DEFER;
1193 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1194 {
17c76198
PP
1195 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1196 state->exp_tls_require_ciphers);
1197
1198 rc = gnutls_priority_init(&state->priority_cache,
1199 CS state->exp_tls_require_ciphers, &errpos);
1200 want_default_priorities = FALSE;
1201 p = state->exp_tls_require_ciphers;
83da1223
PH
1202 }
1203 }
17c76198
PP
1204if (want_default_priorities)
1205 {
83e2f8a2
PP
1206 DEBUG(D_tls)
1207 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1208 exim_default_gnutls_priority);
17c76198
PP
1209 rc = gnutls_priority_init(&state->priority_cache,
1210 exim_default_gnutls_priority, &errpos);
1211 p = US exim_default_gnutls_priority;
1212 }
83da1223 1213
17c76198
PP
1214exim_gnutls_err_check(string_sprintf(
1215 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1216 p, errpos - CS p, errpos));
1217
1218rc = gnutls_priority_set(state->session, state->priority_cache);
1219exim_gnutls_err_check(US"gnutls_priority_set");
1220
1221gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1222
1223/* Reduce security in favour of increased compatibility, if the admin
1224decides to make that trade-off. */
1225if (gnutls_compat_mode)
83da1223 1226 {
17c76198
PP
1227#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1228 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1229 gnutls_session_enable_compatibility_mode(state->session);
1230#else
1231 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1232#endif
83da1223
PH
1233 }
1234
17c76198 1235*caller_state = state;
17c76198 1236return OK;
83da1223
PH
1237}
1238
1239
1240
83da1223 1241/*************************************************
17c76198 1242* Extract peer information *
059ec3d9
PH
1243*************************************************/
1244
17c76198 1245/* Called from both server and client code.
4fe99a6c
PP
1246Only this is allowed to set state->peerdn and state->have_set_peerdn
1247and we use that to detect double-calls.
059ec3d9 1248
75fe387d
PP
1249NOTE: the state blocks last while the TLS connection is up, which is fine
1250for logging in the server side, but for the client side, we log after teardown
1251in src/deliver.c. While the session is up, we can twist about states and
1252repoint tls_* globals, but those variables used for logging or other variable
1253expansion that happens _after_ delivery need to have a longer life-time.
1254
1255So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1256doing this more than once per generation of a state context. We set them in
1257the state context, and repoint tls_* to them. After the state goes away, the
1258tls_* copies of the pointers remain valid and client delivery logging is happy.
1259
1260tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1261don't apply.
1262
059ec3d9 1263Arguments:
17c76198 1264 state exim_gnutls_state_st *
059ec3d9 1265
17c76198 1266Returns: OK/DEFER/FAIL
059ec3d9
PH
1267*/
1268
17c76198
PP
1269static int
1270peer_status(exim_gnutls_state_st *state)
059ec3d9 1271{
75fe387d 1272uschar cipherbuf[256];
17c76198 1273const gnutls_datum *cert_list;
75fe387d 1274int old_pool, rc;
17c76198 1275unsigned int cert_list_size = 0;
4fe99a6c
PP
1276gnutls_protocol_t protocol;
1277gnutls_cipher_algorithm_t cipher;
1278gnutls_kx_algorithm_t kx;
1279gnutls_mac_algorithm_t mac;
17c76198
PP
1280gnutls_certificate_type_t ct;
1281gnutls_x509_crt_t crt;
4fe99a6c 1282uschar *p, *dn_buf;
17c76198 1283size_t sz;
059ec3d9 1284
4fe99a6c 1285if (state->have_set_peerdn)
17c76198 1286 return OK;
4fe99a6c 1287state->have_set_peerdn = TRUE;
059ec3d9 1288
4fe99a6c 1289state->peerdn = NULL;
059ec3d9 1290
4fe99a6c
PP
1291/* tls_cipher */
1292cipher = gnutls_cipher_get(state->session);
1293protocol = gnutls_protocol_get_version(state->session);
1294mac = gnutls_mac_get(state->session);
1295kx = gnutls_kx_get(state->session);
1296
75fe387d 1297string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1298 "%s:%s:%d",
1299 gnutls_protocol_get_name(protocol),
1300 gnutls_cipher_suite_get_name(kx, cipher, mac),
1301 (int) gnutls_cipher_get_key_size(cipher) * 8);
1302
1303/* I don't see a way that spaces could occur, in the current GnuTLS
1304code base, but it was a concern in the old code and perhaps older GnuTLS
1305releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1306for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1307 if (isspace(*p))
1308 *p = '-';
75fe387d
PP
1309old_pool = store_pool;
1310store_pool = POOL_PERM;
1311state->ciphersuite = string_copy(cipherbuf);
1312store_pool = old_pool;
817d9f57 1313state->tlsp->cipher = state->ciphersuite;
4fe99a6c
PP
1314
1315/* tls_peerdn */
17c76198 1316cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1317
17c76198
PP
1318if (cert_list == NULL || cert_list_size == 0)
1319 {
17c76198
PP
1320 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1321 cert_list, cert_list_size);
e51c7be2 1322 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198
PP
1323 return tls_error(US"certificate verification failed",
1324 "no certificate received from peer", state->host);
1325 return OK;
1326 }
059ec3d9 1327
17c76198
PP
1328ct = gnutls_certificate_type_get(state->session);
1329if (ct != GNUTLS_CRT_X509)
059ec3d9 1330 {
17c76198 1331 const char *ctn = gnutls_certificate_type_get_name(ct);
17c76198
PP
1332 DEBUG(D_tls)
1333 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1334 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198
PP
1335 return tls_error(US"certificate verification not possible, unhandled type",
1336 ctn, state->host);
1337 return OK;
83da1223 1338 }
059ec3d9 1339
e51c7be2
JH
1340#define exim_gnutls_peer_err(Label) \
1341 do { \
1342 if (rc != GNUTLS_E_SUCCESS) \
1343 { \
1344 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1345 (Label), gnutls_strerror(rc)); \
1346 if (state->verify_requirement >= VERIFY_REQUIRED) \
1347 return tls_error((Label), gnutls_strerror(rc), state->host); \
1348 return OK; \
1349 } \
1350 } while (0)
17c76198 1351
9d1c15ef
JH
1352rc = import_cert(&cert_list[0], &crt);
1353exim_gnutls_peer_err(US"cert 0");
1354
1355state->tlsp->peercert = state->peercert = crt;
17c76198 1356
17c76198
PP
1357sz = 0;
1358rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1359if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1360 {
17c76198
PP
1361 exim_gnutls_peer_err(US"getting size for cert DN failed");
1362 return FAIL; /* should not happen */
059ec3d9 1363 }
17c76198
PP
1364dn_buf = store_get_perm(sz);
1365rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1366exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1367
17c76198
PP
1368state->peerdn = dn_buf;
1369
1370return OK;
1371#undef exim_gnutls_peer_err
1372}
059ec3d9 1373
059ec3d9 1374
059ec3d9 1375
059ec3d9 1376
17c76198
PP
1377/*************************************************
1378* Verify peer certificate *
1379*************************************************/
059ec3d9 1380
17c76198
PP
1381/* Called from both server and client code.
1382*Should* be using a callback registered with
1383gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1384the peer information, but that's too new for some OSes.
059ec3d9 1385
17c76198
PP
1386Arguments:
1387 state exim_gnutls_state_st *
1388 error where to put an error message
059ec3d9 1389
17c76198
PP
1390Returns:
1391 FALSE if the session should be rejected
1392 TRUE if the cert is okay or we just don't care
1393*/
059ec3d9 1394
17c76198
PP
1395static BOOL
1396verify_certificate(exim_gnutls_state_st *state, const char **error)
1397{
1398int rc;
1399unsigned int verify;
1400
1401*error = NULL;
1402
0a92f87f 1403if ((rc = peer_status(state)) != OK)
e6060e2c 1404 {
17c76198 1405 verify = GNUTLS_CERT_INVALID;
0a92f87f 1406 *error = "certificate not supplied";
17c76198
PP
1407 }
1408else
17c76198 1409 rc = gnutls_certificate_verify_peers2(state->session, &verify);
e6060e2c 1410
17c76198
PP
1411/* Handle the result of verification. INVALID seems to be set as well
1412as REVOKED, but leave the test for both. */
059ec3d9 1413
e51c7be2
JH
1414if (rc < 0 ||
1415 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1416 )
17c76198
PP
1417 {
1418 state->peer_cert_verified = FALSE;
0a92f87f
JH
1419 if (!*error)
1420 *error = verify & GNUTLS_CERT_REVOKED
1421 ? "certificate revoked" : "certificate invalid";
059ec3d9 1422
17c76198 1423 DEBUG(D_tls)
e51c7be2 1424 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
4fe99a6c 1425 *error, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1426
e51c7be2 1427 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1428 {
e51c7be2
JH
1429 gnutls_alert_send(state->session,
1430 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
17c76198
PP
1431 return FALSE;
1432 }
1433 DEBUG(D_tls)
4789da3a 1434 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 1435 }
e51c7be2 1436
17c76198
PP
1437else
1438 {
aa2a70ba 1439 if (state->exp_tls_verify_cert_hostnames)
e51c7be2
JH
1440 {
1441 int sep = 0;
55414b25 1442 const uschar * list = state->exp_tls_verify_cert_hostnames;
e51c7be2
JH
1443 uschar * name;
1444 while (name = string_nextinlist(&list, &sep, NULL, 0))
1445 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1446 break;
1447 if (!name)
1448 {
1449 DEBUG(D_tls)
1450 debug_printf("TLS certificate verification failed: cert name mismatch\n");
aa2a70ba
JH
1451 if (state->verify_requirement >= VERIFY_REQUIRED)
1452 {
1453 gnutls_alert_send(state->session,
1454 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1455 return FALSE;
1456 }
1457 return TRUE;
e51c7be2
JH
1458 }
1459 }
17c76198 1460 state->peer_cert_verified = TRUE;
e51c7be2 1461 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 1462 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1463 }
059ec3d9 1464
817d9f57 1465state->tlsp->peerdn = state->peerdn;
059ec3d9 1466
17c76198
PP
1467return TRUE;
1468}
059ec3d9 1469
17c76198
PP
1470
1471
1472
1473/* ------------------------------------------------------------------------ */
1474/* Callbacks */
1475
1476/* Logging function which can be registered with
1477 * gnutls_global_set_log_function()
1478 * gnutls_global_set_log_level() 0..9
1479 */
af3498d6 1480#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1481static void
17c76198 1482exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1483{
8c79eebf
PP
1484 size_t len = strlen(message);
1485 if (len < 1)
1486 {
1487 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1488 return;
1489 }
1490 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1491 message[len-1] == '\n' ? "" : "\n");
17c76198 1492}
af3498d6 1493#endif
059ec3d9 1494
059ec3d9 1495
17c76198
PP
1496/* Called after client hello, should handle SNI work.
1497This will always set tls_sni (state->received_sni) if available,
1498and may trigger presenting different certificates,
1499if state->trigger_sni_changes is TRUE.
059ec3d9 1500
17c76198
PP
1501Should be registered with
1502 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1503
17c76198
PP
1504"This callback must return 0 on success or a gnutls error code to terminate the
1505handshake.".
059ec3d9 1506
17c76198
PP
1507For inability to get SNI information, we return 0.
1508We only return non-zero if re-setup failed.
817d9f57 1509Only used for server-side TLS.
17c76198 1510*/
44bbabb5 1511
17c76198
PP
1512static int
1513exim_sni_handling_cb(gnutls_session_t session)
1514{
1515char sni_name[MAX_HOST_LEN];
1516size_t data_len = MAX_HOST_LEN;
817d9f57 1517exim_gnutls_state_st *state = &state_server;
17c76198
PP
1518unsigned int sni_type;
1519int rc, old_pool;
1520
1521rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1522if (rc != GNUTLS_E_SUCCESS)
1523 {
1524 DEBUG(D_tls) {
1525 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1526 debug_printf("TLS: no SNI presented in handshake.\n");
1527 else
1528 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1529 gnutls_strerror(rc), rc);
1530 };
1531 return 0;
1532 }
1533
17c76198
PP
1534if (sni_type != GNUTLS_NAME_DNS)
1535 {
1536 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1537 return 0;
1538 }
44bbabb5 1539
17c76198
PP
1540/* We now have a UTF-8 string in sni_name */
1541old_pool = store_pool;
1542store_pool = POOL_PERM;
1543state->received_sni = string_copyn(US sni_name, data_len);
1544store_pool = old_pool;
1545
1546/* We set this one now so that variable expansions below will work */
817d9f57 1547state->tlsp->sni = state->received_sni;
17c76198
PP
1548
1549DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1550 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1551
1552if (!state->trigger_sni_changes)
1553 return 0;
1554
1555rc = tls_expand_session_files(state);
1556if (rc != OK)
1557 {
1558 /* If the setup of certs/etc failed before handshake, TLS would not have
1559 been offered. The best we can do now is abort. */
1560 return GNUTLS_E_APPLICATION_ERROR_MIN;
1561 }
1562
1365611d
PP
1563rc = tls_set_remaining_x509(state);
1564if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1565
1566return 0;
059ec3d9
PH
1567}
1568
1569
1570
f2de3a33 1571#ifndef DISABLE_OCSP
44662487
JH
1572
1573static int
1574server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1575 gnutls_datum_t * ocsp_response)
1576{
1577int ret;
1578
44662487
JH
1579if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1580 {
1581 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1582 (char *)ptr);
018058b2 1583 tls_in.ocsp = OCSP_NOT_RESP;
44662487
JH
1584 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1585 }
1586
018058b2 1587tls_in.ocsp = OCSP_VFY_NOT_TRIED;
44662487
JH
1588return 0;
1589}
1590
1591#endif
1592
1593
774ef2d7 1594#ifdef EXPERIMENTAL_EVENT
a7538db1
JH
1595/*
1596We use this callback to get observability and detail-level control
723fe533
JH
1597for an exim TLS connection (either direction), raising a tls:cert event
1598for each cert in the chain presented by the peer. Any event
a7538db1
JH
1599can deny verification.
1600
1601Return 0 for the handshake to continue or non-zero to terminate.
1602*/
1603
1604static int
723fe533 1605verify_cb(gnutls_session_t session)
a7538db1
JH
1606{
1607const gnutls_datum * cert_list;
1608unsigned int cert_list_size = 0;
1609gnutls_x509_crt_t crt;
1610int rc;
b30275b8 1611uschar * yield;
a7538db1
JH
1612exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1613
1614cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1615if (cert_list)
1616 while (cert_list_size--)
1617 {
1618 rc = import_cert(&cert_list[cert_list_size], &crt);
1619 if (rc != GNUTLS_E_SUCCESS)
1620 {
1621 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1622 cert_list_size, gnutls_strerror(rc));
1623 break;
1624 }
1625
1626 state->tlsp->peercert = crt;
b30275b8
JH
1627 if ((yield = event_raise(state->event_action,
1628 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
1629 {
1630 log_write(0, LOG_MAIN,
b30275b8
JH
1631 "SSL verify denied by event-action: depth=%d: %s",
1632 cert_list_size, yield);
a7538db1
JH
1633 return 1; /* reject */
1634 }
1635 state->tlsp->peercert = NULL;
1636 }
1637
1638return 0;
1639}
1640
1641#endif
44662487
JH
1642
1643
17c76198
PP
1644
1645/* ------------------------------------------------------------------------ */
1646/* Exported functions */
1647
1648
1649
1650
059ec3d9
PH
1651/*************************************************
1652* Start a TLS session in a server *
1653*************************************************/
1654
1655/* This is called when Exim is running as a server, after having received
1656the STARTTLS command. It must respond to that command, and then negotiate
1657a TLS session.
1658
1659Arguments:
83da1223 1660 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1661
1662Returns: OK on success
1663 DEFER for errors before the start of the negotiation
1664 FAIL for errors during the negotation; the server can't
1665 continue running.
1666*/
1667
1668int
17c76198 1669tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1670{
1671int rc;
7199e1ee 1672const char *error;
17c76198 1673exim_gnutls_state_st *state = NULL;
059ec3d9
PH
1674
1675/* Check for previous activation */
817d9f57 1676if (tls_in.active >= 0)
059ec3d9 1677 {
17c76198 1678 tls_error(US"STARTTLS received after TLS started", "", NULL);
059ec3d9
PH
1679 smtp_printf("554 Already in TLS\r\n");
1680 return FAIL;
1681 }
1682
1683/* Initialize the library. If it fails, it will already have logged the error
1684and sent an SMTP response. */
1685
17c76198 1686DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 1687
17c76198
PP
1688rc = tls_init(NULL, tls_certificate, tls_privatekey,
1689 NULL, tls_verify_certificates, tls_crl,
1690 require_ciphers, &state);
059ec3d9
PH
1691if (rc != OK) return rc;
1692
059ec3d9
PH
1693/* If this is a host for which certificate verification is mandatory or
1694optional, set up appropriately. */
1695
059ec3d9 1696if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 1697 {
e51c7be2
JH
1698 DEBUG(D_tls)
1699 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
1700 state->verify_requirement = VERIFY_REQUIRED;
1701 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1702 }
059ec3d9 1703else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 1704 {
e51c7be2
JH
1705 DEBUG(D_tls)
1706 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
1707 state->verify_requirement = VERIFY_OPTIONAL;
1708 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1709 }
1710else
1711 {
e51c7be2
JH
1712 DEBUG(D_tls)
1713 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
1714 state->verify_requirement = VERIFY_NONE;
1715 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1716 }
059ec3d9 1717
723fe533
JH
1718#ifdef EXPERIMENTAL_EVENT
1719if (event_action)
1720 {
1721 state->event_action = event_action;
1722 gnutls_session_set_ptr(state->session, state);
1723 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1724 }
1725#endif
1726
17c76198
PP
1727/* Register SNI handling; always, even if not in tls_certificate, so that the
1728expansion variable $tls_sni is always available. */
059ec3d9 1729
17c76198
PP
1730gnutls_handshake_set_post_client_hello_function(state->session,
1731 exim_sni_handling_cb);
059ec3d9
PH
1732
1733/* Set context and tell client to go ahead, except in the case of TLS startup
1734on connection, where outputting anything now upsets the clients and tends to
1735make them disconnect. We need to have an explicit fflush() here, to force out
1736the response. Other smtp_printf() calls do not need it, because in non-TLS
1737mode, the fflush() happens when smtp_getc() is called. */
1738
817d9f57 1739if (!state->tlsp->on_connect)
059ec3d9
PH
1740 {
1741 smtp_printf("220 TLS go ahead\r\n");
9d1c15ef 1742 fflush(smtp_out);
059ec3d9
PH
1743 }
1744
1745/* Now negotiate the TLS session. We put our own timer on it, since it seems
1746that the GnuTLS library doesn't. */
1747
17c76198 1748gnutls_transport_set_ptr2(state->session,
44662487
JH
1749 (gnutls_transport_ptr)(long) fileno(smtp_in),
1750 (gnutls_transport_ptr)(long) fileno(smtp_out));
17c76198
PP
1751state->fd_in = fileno(smtp_in);
1752state->fd_out = fileno(smtp_out);
059ec3d9
PH
1753
1754sigalrm_seen = FALSE;
1755if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198
PP
1756do
1757 {
1758 rc = gnutls_handshake(state->session);
619b2b25
PP
1759 } while ((rc == GNUTLS_E_AGAIN) ||
1760 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1761alarm(0);
1762
17c76198 1763if (rc != GNUTLS_E_SUCCESS)
059ec3d9 1764 {
17c76198
PP
1765 tls_error(US"gnutls_handshake",
1766 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
059ec3d9
PH
1767 /* It seems that, except in the case of a timeout, we have to close the
1768 connection right here; otherwise if the other end is running OpenSSL it hangs
1769 until the server times out. */
1770
1771 if (!sigalrm_seen)
1772 {
f1e894f3
PH
1773 (void)fclose(smtp_out);
1774 (void)fclose(smtp_in);
059ec3d9
PH
1775 }
1776
1777 return FAIL;
1778 }
1779
1780DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1781
17c76198
PP
1782/* Verify after the fact */
1783
9d1c15ef
JH
1784if ( state->verify_requirement != VERIFY_NONE
1785 && !verify_certificate(state, &error))
059ec3d9 1786 {
9d1c15ef 1787 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 1788 {
9d1c15ef
JH
1789 tls_error(US"certificate verification failed", error, NULL);
1790 return FAIL;
17c76198 1791 }
9d1c15ef
JH
1792 DEBUG(D_tls)
1793 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1794 error);
059ec3d9
PH
1795 }
1796
17c76198
PP
1797/* Figure out peer DN, and if authenticated, etc. */
1798
1799rc = peer_status(state);
1800if (rc != OK) return rc;
1801
1802/* Sets various Exim expansion variables; always safe within server */
1803
9d1c15ef 1804extract_exim_vars_from_tls_state(state);
059ec3d9
PH
1805
1806/* TLS has been set up. Adjust the input functions to read via TLS,
1807and initialize appropriately. */
1808
17c76198 1809state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
1810
1811receive_getc = tls_getc;
1812receive_ungetc = tls_ungetc;
1813receive_feof = tls_feof;
1814receive_ferror = tls_ferror;
58eb016e 1815receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1816
059ec3d9
PH
1817return OK;
1818}
1819
1820
1821
1822
aa2a70ba
JH
1823static void
1824tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
1825 smtp_transport_options_block * ob)
1826{
5130845b 1827if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 1828 {
4af0d74a
JH
1829 state->exp_tls_verify_cert_hostnames =
1830#ifdef EXPERIMENTAL_INTERNATIONAL
1831 string_domain_utf8_to_alabel(host->name, NULL);
1832#else
1833 host->name;
1834#endif
aa2a70ba
JH
1835 DEBUG(D_tls)
1836 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
1837 state->exp_tls_verify_cert_hostnames);
1838 }
1839}
aa2a70ba
JH
1840
1841
059ec3d9
PH
1842/*************************************************
1843* Start a TLS session in a client *
1844*************************************************/
1845
1846/* Called from the smtp transport after STARTTLS has been accepted.
1847
1848Arguments:
1849 fd the fd of the connection
1850 host connected host (for messages)
83da1223 1851 addr the first address (not used)
a7538db1 1852 tb transport (always smtp)
059ec3d9
PH
1853
1854Returns: OK/DEFER/FAIL (because using common functions),
1855 but for a client, DEFER and FAIL have the same meaning
1856*/
1857
1858int
17c76198 1859tls_client_start(int fd, host_item *host,
f5d78688 1860 address_item *addr ARG_UNUSED,
0e66b3b6
JH
1861 transport_instance *tb
1862#ifdef EXPERIMENTAL_DANE
1863 , dne_answer * unused_tlsa_dnsa
1864#endif
1865 )
059ec3d9 1866{
a7538db1
JH
1867smtp_transport_options_block *ob =
1868 (smtp_transport_options_block *)tb->options_block;
059ec3d9 1869int rc;
17c76198
PP
1870const char *error;
1871exim_gnutls_state_st *state = NULL;
f2de3a33 1872#ifndef DISABLE_OCSP
5130845b
JH
1873BOOL require_ocsp =
1874 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
44662487 1875BOOL request_ocsp = require_ocsp ? TRUE
5130845b 1876 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2b4a568d 1877#endif
059ec3d9 1878
17c76198 1879DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 1880
65867078
JH
1881if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
1882 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
1883 ob->tls_require_ciphers, &state)) != OK)
2b4a568d 1884 return rc;
059ec3d9 1885
54c90be1 1886 {
65867078
JH
1887 int dh_min_bits = ob->tls_dh_min_bits;
1888 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1889 {
1890 DEBUG(D_tls)
1891 debug_printf("WARNING: tls_dh_min_bits far too low,"
1892 " clamping %d up to %d\n",
1893 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1894 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1895 }
54c90be1 1896
65867078
JH
1897 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
1898 " acceptable bits to %d\n",
1899 dh_min_bits);
1900 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1901 }
83da1223 1902
2b4a568d
JH
1903/* Stick to the old behaviour for compatibility if tls_verify_certificates is
1904set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
1905the specified host patterns if one of them is defined */
1906
aa2a70ba
JH
1907if ( ( state->exp_tls_verify_certificates
1908 && !ob->tls_verify_hosts
610ff438 1909 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
aa2a70ba 1910 )
5130845b 1911 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
2b4a568d 1912 )
17c76198 1913 {
aa2a70ba 1914 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
1915 DEBUG(D_tls)
1916 debug_printf("TLS: server certificate verification required.\n");
1917 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
1918 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1919 }
5130845b 1920else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
52f93eed 1921 {
aa2a70ba 1922 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
1923 DEBUG(D_tls)
1924 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 1925 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
1926 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1927 }
1928else
1929 {
e51c7be2
JH
1930 DEBUG(D_tls)
1931 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
1932 state->verify_requirement = VERIFY_NONE;
1933 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 1934 }
059ec3d9 1935
f2de3a33
JH
1936#ifndef DISABLE_OCSP
1937 /* supported since GnuTLS 3.1.3 */
44662487 1938if (request_ocsp)
9d1c15ef
JH
1939 {
1940 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
1941 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
1942 NULL, 0, NULL)) != OK)
9d1c15ef
JH
1943 return tls_error(US"cert-status-req",
1944 gnutls_strerror(rc), state->host);
44662487 1945 tls_out.ocsp = OCSP_NOT_RESP;
9d1c15ef 1946 }
2b4a568d
JH
1947#endif
1948
774ef2d7
JH
1949#ifdef EXPERIMENTAL_EVENT
1950if (tb->event_action)
a7538db1 1951 {
774ef2d7 1952 state->event_action = tb->event_action;
a7538db1 1953 gnutls_session_set_ptr(state->session, state);
723fe533 1954 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
1955 }
1956#endif
1957
44662487 1958gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)(long) fd);
17c76198
PP
1959state->fd_in = fd;
1960state->fd_out = fd;
059ec3d9 1961
9d1c15ef 1962DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
1963/* There doesn't seem to be a built-in timeout on connection. */
1964
1965sigalrm_seen = FALSE;
65867078 1966alarm(ob->command_timeout);
17c76198
PP
1967do
1968 {
1969 rc = gnutls_handshake(state->session);
619b2b25
PP
1970 } while ((rc == GNUTLS_E_AGAIN) ||
1971 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1972alarm(0);
1973
4fe99a6c
PP
1974if (rc != GNUTLS_E_SUCCESS)
1975 return tls_error(US"gnutls_handshake",
1976 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1977
17c76198 1978DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 1979
17c76198 1980/* Verify late */
059ec3d9 1981
17c76198
PP
1982if (state->verify_requirement != VERIFY_NONE &&
1983 !verify_certificate(state, &error))
1984 return tls_error(US"certificate verification failed", error, state->host);
059ec3d9 1985
f2de3a33 1986#ifndef DISABLE_OCSP
2b4a568d
JH
1987if (require_ocsp)
1988 {
1989 DEBUG(D_tls)
1990 {
1991 gnutls_datum_t stapling;
1992 gnutls_ocsp_resp_t resp;
1993 gnutls_datum_t printed;
1994 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
1995 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
1996 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
1997 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
1998 )
1999 {
65867078 2000 debug_printf("%.4096s", printed.data);
2b4a568d
JH
2001 gnutls_free(printed.data);
2002 }
2003 else
2004 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host);
2005 }
2006
2b4a568d 2007 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2
JH
2008 {
2009 tls_out.ocsp = OCSP_FAILED;
2b4a568d 2010 return tls_error(US"certificate status check failed", NULL, state->host);
018058b2 2011 }
2b4a568d 2012 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
44662487 2013 tls_out.ocsp = OCSP_VFIED;
2b4a568d
JH
2014 }
2015#endif
2016
17c76198 2017/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 2018
2b4a568d
JH
2019if ((rc = peer_status(state)) != OK)
2020 return rc;
059ec3d9 2021
4fe99a6c 2022/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 2023
9d1c15ef 2024extract_exim_vars_from_tls_state(state);
059ec3d9 2025
059ec3d9
PH
2026return OK;
2027}
2028
2029
2030
17c76198 2031
059ec3d9 2032/*************************************************
17c76198 2033* Close down a TLS session *
059ec3d9
PH
2034*************************************************/
2035
17c76198
PP
2036/* This is also called from within a delivery subprocess forked from the
2037daemon, to shut down the TLS library, without actually doing a shutdown (which
2038would tamper with the TLS session in the parent process).
059ec3d9 2039
17c76198
PP
2040Arguments: TRUE if gnutls_bye is to be called
2041Returns: nothing
059ec3d9
PH
2042*/
2043
17c76198 2044void
817d9f57 2045tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 2046{
817d9f57 2047exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 2048
389ca47a 2049if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
17c76198
PP
2050
2051if (shutdown)
2052 {
2053 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
2054 gnutls_bye(state->session, GNUTLS_SHUT_WR);
2055 }
2056
2057gnutls_deinit(state->session);
2058
389ca47a 2059state->tlsp->active = -1;
17c76198
PP
2060memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2061
2062if ((state_server.session == NULL) && (state_client.session == NULL))
2063 {
2064 gnutls_global_deinit();
2065 exim_gnutls_base_init_done = FALSE;
2066 }
7199e1ee 2067
059ec3d9
PH
2068}
2069
2070
2071
17c76198 2072
059ec3d9
PH
2073/*************************************************
2074* TLS version of getc *
2075*************************************************/
2076
2077/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2078it refills the buffer via the GnuTLS reading function.
817d9f57 2079Only used by the server-side TLS.
059ec3d9 2080
17c76198
PP
2081This feeds DKIM and should be used for all message-body reads.
2082
059ec3d9
PH
2083Arguments: none
2084Returns: the next character or EOF
2085*/
2086
2087int
2088tls_getc(void)
2089{
817d9f57 2090exim_gnutls_state_st *state = &state_server;
17c76198 2091if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
059ec3d9 2092 {
17c76198 2093 ssize_t inbytes;
059ec3d9 2094
17c76198
PP
2095 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2096 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
2097
2098 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 2099 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
059ec3d9
PH
2100 ssl_xfer_buffer_size);
2101 alarm(0);
2102
2103 /* A zero-byte return appears to mean that the TLS session has been
2104 closed down, not that the socket itself has been closed down. Revert to
2105 non-TLS handling. */
2106
2107 if (inbytes == 0)
2108 {
2109 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2110
2111 receive_getc = smtp_getc;
2112 receive_ungetc = smtp_ungetc;
2113 receive_feof = smtp_feof;
2114 receive_ferror = smtp_ferror;
58eb016e 2115 receive_smtp_buffered = smtp_buffered;
059ec3d9 2116
17c76198
PP
2117 gnutls_deinit(state->session);
2118 state->session = NULL;
817d9f57
JH
2119 state->tlsp->active = -1;
2120 state->tlsp->bits = 0;
2121 state->tlsp->certificate_verified = FALSE;
9d1c15ef 2122 tls_channelbinding_b64 = NULL;
817d9f57 2123 state->tlsp->cipher = NULL;
9d1c15ef 2124 state->tlsp->peercert = NULL;
817d9f57 2125 state->tlsp->peerdn = NULL;
059ec3d9
PH
2126
2127 return smtp_getc();
2128 }
2129
2130 /* Handle genuine errors */
2131
2132 else if (inbytes < 0)
2133 {
17c76198
PP
2134 record_io_error(state, (int) inbytes, US"recv", NULL);
2135 state->xfer_error = 1;
059ec3d9
PH
2136 return EOF;
2137 }
80a47a2c 2138#ifndef DISABLE_DKIM
17c76198 2139 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
80a47a2c 2140#endif
17c76198
PP
2141 state->xfer_buffer_hwm = (int) inbytes;
2142 state->xfer_buffer_lwm = 0;
059ec3d9
PH
2143 }
2144
059ec3d9
PH
2145/* Something in the buffer; return next uschar */
2146
17c76198 2147return state->xfer_buffer[state->xfer_buffer_lwm++];
059ec3d9
PH
2148}
2149
2150
2151
17c76198 2152
059ec3d9
PH
2153/*************************************************
2154* Read bytes from TLS channel *
2155*************************************************/
2156
17c76198
PP
2157/* This does not feed DKIM, so if the caller uses this for reading message body,
2158then the caller must feed DKIM.
817d9f57 2159
059ec3d9
PH
2160Arguments:
2161 buff buffer of data
2162 len size of buffer
2163
2164Returns: the number of bytes read
2165 -1 after a failed read
2166*/
2167
2168int
817d9f57 2169tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2170{
817d9f57 2171exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
17c76198 2172ssize_t inbytes;
059ec3d9 2173
17c76198
PP
2174if (len > INT_MAX)
2175 len = INT_MAX;
059ec3d9 2176
17c76198
PP
2177if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2178 DEBUG(D_tls)
2179 debug_printf("*** PROBABLY A BUG *** " \
2180 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2181 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2182
2183DEBUG(D_tls)
2184 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2185 state->session, buff, len);
2186
2187inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
2188if (inbytes > 0) return inbytes;
2189if (inbytes == 0)
2190 {
2191 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2192 }
17c76198 2193else record_io_error(state, (int)inbytes, US"recv", NULL);
059ec3d9
PH
2194
2195return -1;
2196}
2197
2198
2199
17c76198 2200
059ec3d9
PH
2201/*************************************************
2202* Write bytes down TLS channel *
2203*************************************************/
2204
2205/*
2206Arguments:
817d9f57 2207 is_server channel specifier
059ec3d9
PH
2208 buff buffer of data
2209 len number of bytes
2210
2211Returns: the number of bytes after a successful write,
2212 -1 after a failed write
2213*/
2214
2215int
817d9f57 2216tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9 2217{
17c76198
PP
2218ssize_t outbytes;
2219size_t left = len;
817d9f57 2220exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 2221
17c76198 2222DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
059ec3d9
PH
2223while (left > 0)
2224 {
17c76198
PP
2225 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2226 buff, left);
2227 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 2228
17c76198 2229 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
2230 if (outbytes < 0)
2231 {
17c76198 2232 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
2233 return -1;
2234 }
2235 if (outbytes == 0)
2236 {
17c76198 2237 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
2238 return -1;
2239 }
2240
2241 left -= outbytes;
2242 buff += outbytes;
2243 }
2244
17c76198
PP
2245if (len > INT_MAX)
2246 {
2247 DEBUG(D_tls)
2248 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2249 len);
2250 len = INT_MAX;
2251 }
2252
2253return (int) len;
059ec3d9
PH
2254}
2255
2256
2257
17c76198 2258
059ec3d9 2259/*************************************************
17c76198 2260* Random number generation *
059ec3d9
PH
2261*************************************************/
2262
17c76198
PP
2263/* Pseudo-random number generation. The result is not expected to be
2264cryptographically strong but not so weak that someone will shoot themselves
2265in the foot using it as a nonce in input in some email header scheme or
2266whatever weirdness they'll twist this into. The result should handle fork()
2267and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 2268
17c76198
PP
2269Arguments:
2270 max range maximum
2271Returns a random number in range [0, max-1]
059ec3d9
PH
2272*/
2273
af3498d6 2274#ifdef HAVE_GNUTLS_RND
17c76198
PP
2275int
2276vaguely_random_number(int max)
059ec3d9 2277{
17c76198
PP
2278unsigned int r;
2279int i, needed_len;
2280uschar *p;
2281uschar smallbuf[sizeof(r)];
2282
2283if (max <= 1)
2284 return 0;
2285
2286needed_len = sizeof(r);
2287/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2288 * asked for a number less than 10. */
2289for (r = max, i = 0; r; ++i)
2290 r >>= 1;
2291i = (i + 7) / 8;
2292if (i < needed_len)
2293 needed_len = i;
2294
2295i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2296if (i < 0)
059ec3d9 2297 {
17c76198
PP
2298 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2299 return vaguely_random_number_fallback(max);
2300 }
2301r = 0;
2302for (p = smallbuf; needed_len; --needed_len, ++p)
2303 {
2304 r *= 256;
2305 r += *p;
059ec3d9
PH
2306 }
2307
17c76198
PP
2308/* We don't particularly care about weighted results; if someone wants
2309 * smooth distribution and cares enough then they should submit a patch then. */
2310return r % max;
059ec3d9 2311}
af3498d6
PP
2312#else /* HAVE_GNUTLS_RND */
2313int
2314vaguely_random_number(int max)
2315{
2316 return vaguely_random_number_fallback(max);
2317}
2318#endif /* HAVE_GNUTLS_RND */
059ec3d9 2319
36f12725
NM
2320
2321
2322
2323/*************************************************
3375e053
PP
2324* Let tls_require_ciphers be checked at startup *
2325*************************************************/
2326
2327/* The tls_require_ciphers option, if set, must be something which the
2328library can parse.
2329
2330Returns: NULL on success, or error message
2331*/
2332
2333uschar *
2334tls_validate_require_cipher(void)
2335{
2336int rc;
2337uschar *expciphers = NULL;
2338gnutls_priority_t priority_cache;
2339const char *errpos;
2340
2341#define validate_check_rc(Label) do { \
2342 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2343 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2344#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2345
2346if (exim_gnutls_base_init_done)
2347 log_write(0, LOG_MAIN|LOG_PANIC,
2348 "already initialised GnuTLS, Exim developer bug");
2349
a5f239e4 2350#ifdef HAVE_GNUTLS_PKCS11
2519e60d 2351if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
2352 {
2353 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2354 validate_check_rc(US"gnutls_pkcs11_init");
2355 }
2356#endif
3375e053
PP
2357rc = gnutls_global_init();
2358validate_check_rc(US"gnutls_global_init()");
2359exim_gnutls_base_init_done = TRUE;
2360
2361if (!(tls_require_ciphers && *tls_require_ciphers))
2362 return_deinit(NULL);
2363
2364if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2365 return_deinit(US"failed to expand tls_require_ciphers");
2366
2367if (!(expciphers && *expciphers))
2368 return_deinit(NULL);
2369
2370DEBUG(D_tls)
2371 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2372
2373rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2374validate_check_rc(string_sprintf(
2375 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2376 expciphers, errpos - CS expciphers, errpos));
2377
2378#undef return_deinit
2379#undef validate_check_rc
2380gnutls_global_deinit();
2381
2382return NULL;
2383}
2384
2385
2386
2387
2388/*************************************************
36f12725
NM
2389* Report the library versions. *
2390*************************************************/
2391
2392/* See a description in tls-openssl.c for an explanation of why this exists.
2393
2394Arguments: a FILE* to print the results to
2395Returns: nothing
2396*/
2397
2398void
2399tls_version_report(FILE *f)
2400{
754a0503
PP
2401fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2402 " Runtime: %s\n",
2403 LIBGNUTLS_VERSION,
2404 gnutls_check_version(NULL));
36f12725
NM
2405}
2406
2b4a568d
JH
2407/* vi: aw ai sw=2
2408*/
059ec3d9 2409/* End of tls-gnu.c */