Testsuite: Add testcase for OCSP-nonaware client, to supporting server. Bug 1664
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
16Mavroyanopoulos. The revamp is partially a rewrite, partially cut&paste as
17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
a5f239e4
PP
42/* needed to disable PKCS11 autoload unless requested */
43#if GNUTLS_VERSION_NUMBER >= 0x020c00
44# include <gnutls/pkcs11.h>
45#endif
7e07527a
JH
46#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
47# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
48# define DISABLE_OCSP
49#endif
774ef2d7
JH
50#if GNUTLS_VERSION_NUMBER < 0x020a00 && defined(EXPERIMENTAL_EVENT)
51# warning "GnuTLS library version too old; tls:cert event unsupported"
52# undef EXPERIMENTAL_EVENT
a7538db1 53#endif
a7fec7a7
JH
54#if GNUTLS_VERSION_NUMBER >= 0x030306
55# define SUPPORT_CA_DIR
56#else
57# undef SUPPORT_CA_DIR
58#endif
cb1d7830
JH
59#if GNUTLS_VERSION_NUMBER >= 0x030314
60# define SUPPORT_SYSDEFAULT_CABUNDLE
61#endif
7e07527a 62
f2de3a33 63#ifndef DISABLE_OCSP
2b4a568d
JH
64# include <gnutls/ocsp.h>
65#endif
059ec3d9 66
17c76198 67/* GnuTLS 2 vs 3
059ec3d9 68
17c76198
PP
69GnuTLS 3 only:
70 gnutls_global_set_audit_log_function()
059ec3d9 71
17c76198
PP
72Changes:
73 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
74*/
059ec3d9 75
17c76198 76/* Local static variables for GnuTLS */
059ec3d9 77
17c76198 78/* Values for verify_requirement */
059ec3d9 79
e51c7be2 80enum peer_verify_requirement
aa2a70ba 81 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
059ec3d9 82
17c76198
PP
83/* This holds most state for server or client; with this, we can set up an
84outbound TLS-enabled connection in an ACL callout, while not stomping all
85over the TLS variables available for expansion.
059ec3d9 86
17c76198
PP
87Some of these correspond to variables in globals.c; those variables will
88be set to point to content in one of these instances, as appropriate for
89the stage of the process lifetime.
059ec3d9 90
389ca47a 91Not handled here: global tls_channelbinding_b64.
17c76198 92*/
059ec3d9 93
17c76198 94typedef struct exim_gnutls_state {
9d1c15ef 95 gnutls_session_t session;
17c76198 96 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 97 gnutls_priority_t priority_cache;
17c76198 98 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
99 int fd_in;
100 int fd_out;
101 BOOL peer_cert_verified;
102 BOOL trigger_sni_changes;
103 BOOL have_set_peerdn;
17c76198 104 const struct host_item *host;
9d1c15ef
JH
105 gnutls_x509_crt_t peercert;
106 uschar *peerdn;
107 uschar *ciphersuite;
108 uschar *received_sni;
17c76198
PP
109
110 const uschar *tls_certificate;
111 const uschar *tls_privatekey;
112 const uschar *tls_sni; /* client send only, not received */
113 const uschar *tls_verify_certificates;
114 const uschar *tls_crl;
115 const uschar *tls_require_ciphers;
e51c7be2 116
17c76198
PP
117 uschar *exp_tls_certificate;
118 uschar *exp_tls_privatekey;
17c76198
PP
119 uschar *exp_tls_verify_certificates;
120 uschar *exp_tls_crl;
121 uschar *exp_tls_require_ciphers;
44662487 122 uschar *exp_tls_ocsp_file;
55414b25 123 const uschar *exp_tls_verify_cert_hostnames;
774ef2d7 124#ifdef EXPERIMENTAL_EVENT
a7538db1
JH
125 uschar *event_action;
126#endif
17c76198 127
389ca47a 128 tls_support *tlsp; /* set in tls_init() */
817d9f57 129
17c76198
PP
130 uschar *xfer_buffer;
131 int xfer_buffer_lwm;
132 int xfer_buffer_hwm;
133 int xfer_eof;
134 int xfer_error;
17c76198
PP
135} exim_gnutls_state_st;
136
137static const exim_gnutls_state_st exim_gnutls_state_init = {
4fe99a6c 138 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
75fe387d 139 NULL, NULL, NULL, NULL,
17c76198 140 NULL, NULL, NULL, NULL, NULL, NULL,
44662487 141 NULL, NULL, NULL, NULL, NULL, NULL, NULL,
01a4a5c5 142 NULL,
774ef2d7 143#ifdef EXPERIMENTAL_EVENT
a7538db1
JH
144 NULL,
145#endif
817d9f57 146 NULL,
17c76198 147 NULL, 0, 0, 0, 0,
17c76198 148};
83da1223 149
17c76198
PP
150/* Not only do we have our own APIs which don't pass around state, assuming
151it's held in globals, GnuTLS doesn't appear to let us register callback data
152for callbacks, or as part of the session, so we have to keep a "this is the
153context we're currently dealing with" pointer and rely upon being
154single-threaded to keep from processing data on an inbound TLS connection while
155talking to another TLS connection for an outbound check. This does mean that
156there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
157second connection.
158XXX But see gnutls_session_get_ptr()
159*/
059ec3d9 160
17c76198 161static exim_gnutls_state_st state_server, state_client;
059ec3d9 162
17c76198
PP
163/* dh_params are initialised once within the lifetime of a process using TLS;
164if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
165don't want to repeat this. */
83da1223 166
17c76198 167static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 168
17c76198 169/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 170
17c76198 171static const int ssl_session_timeout = 200;
059ec3d9 172
17c76198 173static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 174
17c76198 175/* Guard library core initialisation */
83da1223 176
17c76198 177static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 178
059ec3d9 179
17c76198 180/* ------------------------------------------------------------------------ */
17c76198 181/* macros */
83da1223 182
17c76198 183#define MAX_HOST_LEN 255
83da1223 184
17c76198
PP
185/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
186the library logging; a value less than 0 disables the calls to set up logging
187callbacks. */
2c17bb02 188#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
a7538db1 189# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 190#endif
83da1223 191
2c17bb02 192#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 193# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 194#endif
83da1223 195
af3498d6
PP
196/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
197can ask for a bit-strength. Without that, we stick to the constant we had
198before, for now. */
2c17bb02 199#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 200# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 201#endif
af3498d6 202
17c76198
PP
203#define exim_gnutls_err_check(Label) do { \
204 if (rc != GNUTLS_E_SUCCESS) { return tls_error((Label), gnutls_strerror(rc), host); } } while (0)
059ec3d9 205
17c76198 206#define expand_check_tlsvar(Varname) expand_check(state->Varname, US #Varname, &state->exp_##Varname)
83da1223 207
17c76198 208#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
209# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
210# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
211# define HAVE_GNUTLS_RND
2519e60d
TL
212/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
213 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
214 * isn't available sometimes, so this needs to become a conditional
215 * compilation; the sanest way to deal with this being a problem on
216 * older OSes is to block it in the Local/Makefile with this compiler
217 * definition */
e51c7be2
JH
218# ifndef AVOID_GNUTLS_PKCS11
219# define HAVE_GNUTLS_PKCS11
220# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 221#endif
83da1223 222
af3498d6
PP
223
224
225
226/* ------------------------------------------------------------------------ */
227/* Callback declarations */
228
229#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
230static void exim_gnutls_logger_cb(int level, const char *message);
231#endif
232
233static int exim_sni_handling_cb(gnutls_session_t session);
234
f2de3a33 235#ifndef DISABLE_OCSP
44662487
JH
236static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
237 gnutls_datum_t * ocsp_response);
238#endif
af3498d6
PP
239
240
241
17c76198
PP
242/* ------------------------------------------------------------------------ */
243/* Static functions */
059ec3d9
PH
244
245/*************************************************
246* Handle TLS error *
247*************************************************/
248
249/* Called from lots of places when errors occur before actually starting to do
250the TLS handshake, that is, while the session is still in clear. Always returns
251DEFER for a server and FAIL for a client so that most calls can use "return
252tls_error(...)" to do this processing and then give an appropriate return. A
253single function is used for both server and client, because it is called from
254some shared functions.
255
256Argument:
257 prefix text to include in the logged error
7199e1ee
TF
258 msg additional error string (may be NULL)
259 usually obtained from gnutls_strerror()
17c76198
PP
260 host NULL if setting up a server;
261 the connected host if setting up a client
059ec3d9
PH
262
263Returns: OK/DEFER/FAIL
264*/
265
266static int
17c76198 267tls_error(const uschar *prefix, const char *msg, const host_item *host)
059ec3d9 268{
17c76198
PP
269if (host)
270 {
c562fd30 271 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s)%s%s",
17c76198
PP
272 host->name, host->address, prefix, msg ? ": " : "", msg ? msg : "");
273 return FAIL;
274 }
275else
059ec3d9 276 {
7199e1ee 277 uschar *conn_info = smtp_get_connection_info();
17c76198 278 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee 279 conn_info += 5;
c562fd30 280 /* I'd like to get separated H= here, but too hard for now */
7199e1ee 281 log_write(0, LOG_MAIN, "TLS error on %s (%s)%s%s",
17c76198 282 conn_info, prefix, msg ? ": " : "", msg ? msg : "");
059ec3d9
PH
283 return DEFER;
284 }
059ec3d9
PH
285}
286
287
288
17c76198 289
059ec3d9 290/*************************************************
17c76198 291* Deal with logging errors during I/O *
059ec3d9
PH
292*************************************************/
293
17c76198 294/* We have to get the identity of the peer from saved data.
059ec3d9 295
17c76198
PP
296Argument:
297 state the current GnuTLS exim state container
298 rc the GnuTLS error code, or 0 if it's a local error
299 when text identifying read or write
300 text local error text when ec is 0
059ec3d9 301
17c76198 302Returns: nothing
059ec3d9
PH
303*/
304
17c76198
PP
305static void
306record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 307{
17c76198 308const char *msg;
059ec3d9 309
17c76198
PP
310if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
311 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
312 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
313else
314 msg = gnutls_strerror(rc);
059ec3d9 315
17c76198
PP
316tls_error(when, msg, state->host);
317}
059ec3d9 318
059ec3d9 319
059ec3d9 320
059ec3d9 321
17c76198
PP
322/*************************************************
323* Set various Exim expansion vars *
324*************************************************/
059ec3d9 325
e51c7be2
JH
326#define exim_gnutls_cert_err(Label) \
327 do \
328 { \
329 if (rc != GNUTLS_E_SUCCESS) \
330 { \
331 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
332 (Label), gnutls_strerror(rc)); \
333 return rc; \
334 } \
335 } while (0)
9d1c15ef
JH
336
337static int
338import_cert(const gnutls_datum * cert, gnutls_x509_crt_t * crtp)
339{
340int rc;
341
342rc = gnutls_x509_crt_init(crtp);
343exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
344
345rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
346exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
347
348return rc;
349}
350
351#undef exim_gnutls_cert_err
352
353
17c76198
PP
354/* We set various Exim global variables from the state, once a session has
355been established. With TLS callouts, may need to change this to stack
356variables, or just re-call it with the server state after client callout
357has finished.
059ec3d9 358
9d1c15ef 359Make sure anything set here is unset in tls_getc().
17c76198
PP
360
361Sets:
362 tls_active fd
363 tls_bits strength indicator
364 tls_certificate_verified bool indicator
365 tls_channelbinding_b64 for some SASL mechanisms
366 tls_cipher a string
9d1c15ef 367 tls_peercert pointer to library internal
17c76198
PP
368 tls_peerdn a string
369 tls_sni a (UTF-8) string
9d1c15ef 370 tls_ourcert pointer to library internal
17c76198
PP
371
372Argument:
373 state the relevant exim_gnutls_state_st *
374*/
375
376static void
9d1c15ef 377extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 378{
17c76198 379gnutls_cipher_algorithm_t cipher;
17c76198
PP
380#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
381int old_pool;
382int rc;
383gnutls_datum_t channel;
384#endif
9d1c15ef 385tls_support * tlsp = state->tlsp;
17c76198 386
9d1c15ef 387tlsp->active = state->fd_out;
17c76198
PP
388
389cipher = gnutls_cipher_get(state->session);
390/* returns size in "bytes" */
9d1c15ef 391tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 392
9d1c15ef 393tlsp->cipher = state->ciphersuite;
17c76198 394
817d9f57 395DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 396
9d1c15ef 397tlsp->certificate_verified = state->peer_cert_verified;
059ec3d9 398
17c76198
PP
399/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
400only available for use for authenticators while this TLS session is running. */
401
402tls_channelbinding_b64 = NULL;
403#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
404channel.data = NULL;
405channel.size = 0;
406rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
407if (rc) {
408 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
409} else {
410 old_pool = store_pool;
411 store_pool = POOL_PERM;
412 tls_channelbinding_b64 = auth_b64encode(channel.data, (int)channel.size);
413 store_pool = old_pool;
414 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
415}
416#endif
417
9d1c15ef
JH
418/* peercert is set in peer_status() */
419tlsp->peerdn = state->peerdn;
420tlsp->sni = state->received_sni;
421
422/* record our certificate */
423 {
424 const gnutls_datum * cert = gnutls_certificate_get_ours(state->session);
425 gnutls_x509_crt_t crt;
426
427 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
428 }
059ec3d9
PH
429}
430
431
432
17c76198 433
059ec3d9 434/*************************************************
575643cd 435* Setup up DH parameters *
059ec3d9
PH
436*************************************************/
437
575643cd 438/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
439be re-generated every so often, depending on security policy. What we do is to
440keep these parameters in a file in the spool directory. If the file does not
441exist, we generate them. This means that it is easy to cause a regeneration.
442
443The new file is written as a temporary file and renamed, so that an incomplete
444file is never present. If two processes both compute some new parameters, you
445waste a bit of effort, but it doesn't seem worth messing around with locking to
446prevent this.
447
059ec3d9
PH
448Returns: OK/DEFER/FAIL
449*/
450
451static int
17c76198 452init_server_dh(void)
059ec3d9 453{
17c76198
PP
454int fd, rc;
455unsigned int dh_bits;
b5aea5e1 456gnutls_datum m;
a799883d
PP
457uschar filename_buf[PATH_MAX];
458uschar *filename = NULL;
17c76198 459size_t sz;
a799883d
PP
460uschar *exp_tls_dhparam;
461BOOL use_file_in_spool = FALSE;
462BOOL use_fixed_file = FALSE;
17c76198 463host_item *host = NULL; /* dummy for macros */
059ec3d9 464
17c76198 465DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 466
17c76198
PP
467rc = gnutls_dh_params_init(&dh_server_params);
468exim_gnutls_err_check(US"gnutls_dh_params_init");
059ec3d9 469
a799883d
PP
470m.data = NULL;
471m.size = 0;
472
473if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam))
474 return DEFER;
475
476if (!exp_tls_dhparam)
477 {
478 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
479 m.data = US std_dh_prime_default();
480 m.size = Ustrlen(m.data);
481 }
482else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
483 use_file_in_spool = TRUE;
484else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
485 {
486 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
487 return OK;
488 }
489else if (exp_tls_dhparam[0] != '/')
490 {
491 m.data = US std_dh_prime_named(exp_tls_dhparam);
492 if (m.data == NULL)
493 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
494 m.size = Ustrlen(m.data);
495 }
496else
497 {
498 use_fixed_file = TRUE;
499 filename = exp_tls_dhparam;
500 }
501
502if (m.data)
503 {
504 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
505 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
506 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
507 return OK;
508 }
509
af3498d6
PP
510#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
511/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
512different filename and ensure we have sufficient bits. */
513dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
514if (!dh_bits)
515 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL);
af3498d6 516DEBUG(D_tls)
b34fc30c 517 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
518 dh_bits);
519#else
520dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
521DEBUG(D_tls)
522 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
523 dh_bits);
524#endif
059ec3d9 525
3375e053
PP
526/* Some clients have hard-coded limits. */
527if (dh_bits > tls_dh_max_bits)
528 {
529 DEBUG(D_tls)
530 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
531 tls_dh_max_bits);
532 dh_bits = tls_dh_max_bits;
533 }
534
a799883d
PP
535if (use_file_in_spool)
536 {
537 if (!string_format(filename_buf, sizeof(filename_buf),
538 "%s/gnutls-params-%d", spool_directory, dh_bits))
539 return tls_error(US"overlong filename", NULL, NULL);
540 filename = filename_buf;
541 }
059ec3d9 542
b5aea5e1 543/* Open the cache file for reading and if successful, read it and set up the
575643cd 544parameters. */
059ec3d9
PH
545
546fd = Uopen(filename, O_RDONLY, 0);
b5aea5e1 547if (fd >= 0)
059ec3d9 548 {
b5aea5e1 549 struct stat statbuf;
17c76198
PP
550 FILE *fp;
551 int saved_errno;
552
553 if (fstat(fd, &statbuf) < 0) /* EIO */
554 {
555 saved_errno = errno;
556 (void)close(fd);
557 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL);
558 }
559 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
560 {
561 (void)close(fd);
17c76198
PP
562 return tls_error(US"TLS cache not a file", NULL, NULL);
563 }
564 fp = fdopen(fd, "rb");
565 if (!fp)
566 {
567 saved_errno = errno;
568 (void)close(fd);
569 return tls_error(US"fdopen(TLS cache stat fd) failed",
570 strerror(saved_errno), NULL);
b5aea5e1 571 }
059ec3d9 572
b5aea5e1
PH
573 m.size = statbuf.st_size;
574 m.data = malloc(m.size);
575 if (m.data == NULL)
17c76198
PP
576 {
577 fclose(fp);
578 return tls_error(US"malloc failed", strerror(errno), NULL);
579 }
580 sz = fread(m.data, m.size, 1, fp);
581 if (!sz)
582 {
583 saved_errno = errno;
584 fclose(fp);
585 free(m.data);
586 return tls_error(US"fread failed", strerror(saved_errno), NULL);
587 }
588 fclose(fp);
b5aea5e1 589
17c76198 590 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 591 free(m.data);
17c76198
PP
592 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
593 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
594 }
595
596/* If the file does not exist, fall through to compute new data and cache it.
597If there was any other opening error, it is serious. */
598
182ad5cf
PH
599else if (errno == ENOENT)
600 {
17c76198 601 rc = -1;
182ad5cf 602 DEBUG(D_tls)
17c76198 603 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
604 }
605else
17c76198
PP
606 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
607 NULL, NULL);
b5aea5e1
PH
608
609/* If ret < 0, either the cache file does not exist, or the data it contains
610is not useful. One particular case of this is when upgrading from an older
611release of Exim in which the data was stored in a different format. We don't
612try to be clever and support both formats; we just regenerate new data in this
613case. */
614
17c76198 615if (rc < 0)
b5aea5e1 616 {
17c76198 617 uschar *temp_fn;
201f5254 618 unsigned int dh_bits_gen = dh_bits;
059ec3d9 619
17c76198
PP
620 if ((PATH_MAX - Ustrlen(filename)) < 10)
621 return tls_error(US"Filename too long to generate replacement",
622 CS filename, NULL);
059ec3d9 623
17c76198
PP
624 temp_fn = string_copy(US "%s.XXXXXXX");
625 fd = mkstemp(CS temp_fn); /* modifies temp_fn */
059ec3d9 626 if (fd < 0)
17c76198 627 return tls_error(US"Unable to open temp file", strerror(errno), NULL);
059ec3d9
PH
628 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
629
201f5254
PP
630 /* GnuTLS overshoots!
631 * If we ask for 2236, we might get 2237 or more.
632 * But there's no way to ask GnuTLS how many bits there really are.
633 * We can ask how many bits were used in a TLS session, but that's it!
634 * The prime itself is hidden behind too much abstraction.
635 * So we ask for less, and proceed on a wing and a prayer.
636 * First attempt, subtracted 3 for 2233 and got 2240.
637 */
cae6e576 638 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
639 {
640 dh_bits_gen = dh_bits - 10;
641 DEBUG(D_tls)
642 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
643 dh_bits_gen);
644 }
645
646 DEBUG(D_tls)
647 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
648 dh_bits_gen);
649 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
17c76198
PP
650 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
651
652 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
653 and I confirmed that a NULL call to get the size first is how the GnuTLS
654 sample apps handle this. */
655
656 sz = 0;
657 m.data = NULL;
658 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
659 m.data, &sz);
660 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
661 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
662 m.size = sz;
b5aea5e1
PH
663 m.data = malloc(m.size);
664 if (m.data == NULL)
17c76198 665 return tls_error(US"memory allocation failed", strerror(errno), NULL);
1f00591e 666 /* this will return a size 1 less than the allocation size above */
17c76198 667 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 668 m.data, &sz);
17c76198
PP
669 if (rc != GNUTLS_E_SUCCESS)
670 {
671 free(m.data);
672 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
673 }
1f00591e 674 m.size = sz; /* shrink by 1, probably */
059ec3d9 675
17c76198
PP
676 sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
677 if (sz != m.size)
678 {
679 free(m.data);
680 return tls_error(US"TLS cache write D-H params failed",
681 strerror(errno), NULL);
682 }
b5aea5e1 683 free(m.data);
17c76198
PP
684 sz = write_to_fd_buf(fd, US"\n", 1);
685 if (sz != 1)
686 return tls_error(US"TLS cache write D-H params final newline failed",
687 strerror(errno), NULL);
688
689 rc = close(fd);
690 if (rc)
691 return tls_error(US"TLS cache write close() failed",
692 strerror(errno), NULL);
059ec3d9 693
17c76198
PP
694 if (Urename(temp_fn, filename) < 0)
695 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
696 temp_fn, filename), strerror(errno), NULL);
059ec3d9 697
17c76198 698 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
699 }
700
17c76198 701DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
702return OK;
703}
704
705
706
707
708/*************************************************
17c76198 709* Variables re-expanded post-SNI *
059ec3d9
PH
710*************************************************/
711
17c76198
PP
712/* Called from both server and client code, via tls_init(), and also from
713the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
714
715We can tell the two apart by state->received_sni being non-NULL in callback.
716
717The callback should not call us unless state->trigger_sni_changes is true,
718which we are responsible for setting on the first pass through.
059ec3d9
PH
719
720Arguments:
17c76198 721 state exim_gnutls_state_st *
059ec3d9
PH
722
723Returns: OK/DEFER/FAIL
724*/
725
726static int
17c76198 727tls_expand_session_files(exim_gnutls_state_st *state)
059ec3d9 728{
1365611d 729struct stat statbuf;
059ec3d9 730int rc;
17c76198
PP
731const host_item *host = state->host; /* macro should be reconsidered? */
732uschar *saved_tls_certificate = NULL;
733uschar *saved_tls_privatekey = NULL;
734uschar *saved_tls_verify_certificates = NULL;
735uschar *saved_tls_crl = NULL;
736int cert_count;
737
738/* We check for tls_sni *before* expansion. */
2b4a568d 739if (!host) /* server */
17c76198
PP
740 {
741 if (!state->received_sni)
742 {
d9b2312b
JH
743 if (state->tls_certificate &&
744 (Ustrstr(state->tls_certificate, US"tls_sni") ||
745 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
746 Ustrstr(state->tls_certificate, US"tls_out_sni")
747 ))
17c76198
PP
748 {
749 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
750 state->trigger_sni_changes = TRUE;
751 }
752 }
753 else
754 {
1365611d 755 /* useful for debugging */
17c76198
PP
756 saved_tls_certificate = state->exp_tls_certificate;
757 saved_tls_privatekey = state->exp_tls_privatekey;
758 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
759 saved_tls_crl = state->exp_tls_crl;
760 }
761 }
059ec3d9 762
1365611d
PP
763rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
764exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
765
17c76198
PP
766/* remember: expand_check_tlsvar() is expand_check() but fiddling with
767state members, assuming consistent naming; and expand_check() returns
768false if expansion failed, unless expansion was forced to fail. */
059ec3d9 769
17c76198
PP
770/* check if we at least have a certificate, before doing expensive
771D-H generation. */
059ec3d9 772
17c76198
PP
773if (!expand_check_tlsvar(tls_certificate))
774 return DEFER;
059ec3d9 775
17c76198 776/* certificate is mandatory in server, optional in client */
059ec3d9 777
17c76198
PP
778if ((state->exp_tls_certificate == NULL) ||
779 (*state->exp_tls_certificate == '\0'))
780 {
2b4a568d 781 if (!host)
17c76198
PP
782 return tls_error(US"no TLS server certificate is specified", NULL, NULL);
783 else
784 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
785 }
059ec3d9 786
17c76198 787if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
059ec3d9
PH
788 return DEFER;
789
17c76198
PP
790/* tls_privatekey is optional, defaulting to same file as certificate */
791
792if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 793 {
17c76198
PP
794 state->tls_privatekey = state->tls_certificate;
795 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 796 }
c91535f3 797
059ec3d9 798
17c76198 799if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
800 {
801 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
802 state->exp_tls_certificate, state->exp_tls_privatekey);
803
804 if (state->received_sni)
de365ded 805 {
17c76198
PP
806 if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
807 (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
808 {
b34fc30c 809 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
810 }
811 else
812 {
b34fc30c 813 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 814 }
8e669ac1 815 }
059ec3d9 816
1365611d
PP
817 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
818 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
819 GNUTLS_X509_FMT_PEM);
820 exim_gnutls_err_check(
821 string_sprintf("cert/key setup: cert=%s key=%s",
822 state->exp_tls_certificate, state->exp_tls_privatekey));
823 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
b34fc30c 824 } /* tls_certificate */
059ec3d9 825
2b4a568d
JH
826
827/* Set the OCSP stapling server info */
828
f2de3a33 829#ifndef DISABLE_OCSP
2b4a568d
JH
830if ( !host /* server */
831 && tls_ocsp_file
832 )
833 {
44662487
JH
834 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file",
835 &state->exp_tls_ocsp_file))
2b4a568d
JH
836 return DEFER;
837
44662487
JH
838 /* Use the full callback method for stapling just to get observability.
839 More efficient would be to read the file once only, if it never changed
840 (due to SNI). Would need restart on file update, or watch datestamp. */
841
842 gnutls_certificate_set_ocsp_status_request_function(state->x509_cred,
843 server_ocsp_stapling_cb, state->exp_tls_ocsp_file);
2b4a568d 844
98716abe 845 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", state->exp_tls_ocsp_file);
2b4a568d
JH
846 }
847#endif
848
849
059ec3d9
PH
850/* Set the trusted CAs file if one is provided, and then add the CRL if one is
851provided. Experiment shows that, if the certificate file is empty, an unhelpful
852error message is provided. However, if we just refrain from setting anything up
853in that case, certificate verification fails, which seems to be the correct
854behaviour. */
855
610ff438 856if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 857 {
17c76198 858 if (!expand_check_tlsvar(tls_verify_certificates))
059ec3d9 859 return DEFER;
610ff438
JH
860#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
861 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
862 state->exp_tls_verify_certificates = NULL;
863#endif
17c76198
PP
864 if (state->tls_crl && *state->tls_crl)
865 if (!expand_check_tlsvar(tls_crl))
866 return DEFER;
059ec3d9 867
1365611d
PP
868 if (!(state->exp_tls_verify_certificates &&
869 *state->exp_tls_verify_certificates))
b34fc30c
PP
870 {
871 DEBUG(D_tls)
1365611d
PP
872 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
873 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 874 return OK;
b34fc30c 875 }
1365611d 876 }
83e2f8a2
PP
877else
878 {
879 DEBUG(D_tls)
880 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
881 return OK;
882 }
17c76198 883
cb1d7830
JH
884#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
885if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
886 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
887else
888#endif
1365611d 889 {
cb1d7830
JH
890 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
891 {
892 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
893 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
894 strerror(errno));
895 return DEFER;
896 }
17c76198 897
a7fec7a7 898#ifndef SUPPORT_CA_DIR
cb1d7830
JH
899 /* The test suite passes in /dev/null; we could check for that path explicitly,
900 but who knows if someone has some weird FIFO which always dumps some certs, or
901 other weirdness. The thing we really want to check is that it's not a
902 directory, since while OpenSSL supports that, GnuTLS does not.
903 So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
904 if (S_ISDIR(statbuf.st_mode))
905 {
906 DEBUG(D_tls)
907 debug_printf("verify certificates path is a dir: \"%s\"\n",
908 state->exp_tls_verify_certificates);
909 log_write(0, LOG_MAIN|LOG_PANIC,
910 "tls_verify_certificates \"%s\" is a directory",
911 state->exp_tls_verify_certificates);
912 return DEFER;
913 }
a7fec7a7 914#endif
059ec3d9 915
cb1d7830
JH
916 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
917 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 918
cb1d7830
JH
919 if (statbuf.st_size == 0)
920 {
921 DEBUG(D_tls)
922 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
923 return OK;
924 }
059ec3d9 925
cb1d7830 926 cert_count =
a7fec7a7
JH
927
928#ifdef SUPPORT_CA_DIR
cb1d7830
JH
929 (statbuf.st_mode & S_IFMT) == S_IFDIR
930 ?
931 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
932 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
933 :
a7fec7a7 934#endif
cb1d7830
JH
935 gnutls_certificate_set_x509_trust_file(state->x509_cred,
936 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
937 }
a7fec7a7 938
1365611d
PP
939if (cert_count < 0)
940 {
941 rc = cert_count;
cb1d7830 942 exim_gnutls_err_check(US"setting certificate trust");
1365611d
PP
943 }
944DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 945
5c8cda3a
PP
946if (state->tls_crl && *state->tls_crl &&
947 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 948 {
5c8cda3a
PP
949 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
950 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
951 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
952 if (cert_count < 0)
1365611d 953 {
5c8cda3a 954 rc = cert_count;
1365611d
PP
955 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
956 }
5c8cda3a 957 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 958 }
059ec3d9 959
059ec3d9
PH
960return OK;
961}
962
963
964
965
966/*************************************************
1365611d
PP
967* Set X.509 state variables *
968*************************************************/
969
970/* In GnuTLS, the registered cert/key are not replaced by a later
971set of a cert/key, so for SNI support we need a whole new x509_cred
972structure. Which means various other non-re-expanded pieces of state
973need to be re-set in the new struct, so the setting logic is pulled
974out to this.
975
976Arguments:
977 state exim_gnutls_state_st *
978
979Returns: OK/DEFER/FAIL
980*/
981
982static int
983tls_set_remaining_x509(exim_gnutls_state_st *state)
984{
985int rc;
986const host_item *host = state->host; /* macro should be reconsidered? */
987
988/* Create D-H parameters, or read them from the cache file. This function does
989its own SMTP error messaging. This only happens for the server, TLS D-H ignores
990client-side params. */
991
992if (!state->host)
993 {
994 if (!dh_server_params)
995 {
996 rc = init_server_dh();
997 if (rc != OK) return rc;
998 }
999 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1000 }
1001
1002/* Link the credentials to the session. */
1003
1004rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1005exim_gnutls_err_check(US"gnutls_credentials_set");
1006
1007return OK;
1008}
1009
1010/*************************************************
17c76198 1011* Initialize for GnuTLS *
059ec3d9
PH
1012*************************************************/
1013
17c76198
PP
1014/* Called from both server and client code. In the case of a server, errors
1015before actual TLS negotiation return DEFER.
059ec3d9
PH
1016
1017Arguments:
17c76198
PP
1018 host connected host, if client; NULL if server
1019 certificate certificate file
1020 privatekey private key file
1021 sni TLS SNI to send, sometimes when client; else NULL
1022 cas CA certs file
1023 crl CRL file
1024 require_ciphers tls_require_ciphers setting
817d9f57 1025 caller_state returned state-info structure
059ec3d9 1026
17c76198 1027Returns: OK/DEFER/FAIL
059ec3d9
PH
1028*/
1029
17c76198
PP
1030static int
1031tls_init(
1032 const host_item *host,
1033 const uschar *certificate,
1034 const uschar *privatekey,
1035 const uschar *sni,
1036 const uschar *cas,
1037 const uschar *crl,
1038 const uschar *require_ciphers,
1039 exim_gnutls_state_st **caller_state)
059ec3d9 1040{
17c76198
PP
1041exim_gnutls_state_st *state;
1042int rc;
1043size_t sz;
1044const char *errpos;
1045uschar *p;
1046BOOL want_default_priorities;
1047
1048if (!exim_gnutls_base_init_done)
059ec3d9 1049 {
17c76198
PP
1050 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1051
a5f239e4
PP
1052#ifdef HAVE_GNUTLS_PKCS11
1053 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1054 which loads modules from a config file, which sounds good and may be wanted
1055 by some sysadmin, but also means in common configurations that GNOME keyring
1056 environment variables are used and so breaks for users calling mailq.
1057 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1058 if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
1059 {
1060 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1061 exim_gnutls_err_check(US"gnutls_pkcs11_init");
1062 }
1063#endif
1064
17c76198
PP
1065 rc = gnutls_global_init();
1066 exim_gnutls_err_check(US"gnutls_global_init");
1067
1068#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1069 DEBUG(D_tls)
059ec3d9 1070 {
17c76198
PP
1071 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1072 /* arbitrarily chosen level; bump upto 9 for more */
1073 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1074 }
17c76198
PP
1075#endif
1076
1077 exim_gnutls_base_init_done = TRUE;
059ec3d9 1078 }
059ec3d9 1079
17c76198
PP
1080if (host)
1081 {
1082 state = &state_client;
1083 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 1084 state->tlsp = &tls_out;
17c76198
PP
1085 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1086 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1087 }
1088else
1089 {
1090 state = &state_server;
1091 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 1092 state->tlsp = &tls_in;
17c76198
PP
1093 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1094 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1095 }
1096exim_gnutls_err_check(US"gnutls_init");
059ec3d9 1097
17c76198 1098state->host = host;
059ec3d9 1099
17c76198
PP
1100state->tls_certificate = certificate;
1101state->tls_privatekey = privatekey;
5779e6aa 1102state->tls_require_ciphers = require_ciphers;
17c76198
PP
1103state->tls_sni = sni;
1104state->tls_verify_certificates = cas;
1105state->tls_crl = crl;
059ec3d9 1106
17c76198
PP
1107/* This handles the variables that might get re-expanded after TLS SNI;
1108that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1109
17c76198
PP
1110DEBUG(D_tls)
1111 debug_printf("Expanding various TLS configuration options for session credentials.\n");
1112rc = tls_expand_session_files(state);
1113if (rc != OK) return rc;
059ec3d9 1114
1365611d
PP
1115/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1116requires a new structure afterwards. */
83da1223 1117
1365611d
PP
1118rc = tls_set_remaining_x509(state);
1119if (rc != OK) return rc;
83da1223 1120
17c76198
PP
1121/* set SNI in client, only */
1122if (host)
1123 {
0df4ab80 1124 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni))
17c76198 1125 return DEFER;
0df4ab80 1126 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1127 {
1128 DEBUG(D_tls)
0df4ab80
JH
1129 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1130 sz = Ustrlen(state->tlsp->sni);
17c76198 1131 rc = gnutls_server_name_set(state->session,
0df4ab80 1132 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
17c76198
PP
1133 exim_gnutls_err_check(US"gnutls_server_name_set");
1134 }
1135 }
1136else if (state->tls_sni)
1137 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1138 "have an SNI set for a client [%s]\n", state->tls_sni);
83da1223 1139
17c76198 1140/* This is the priority string support,
42bfef1e 1141http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1142and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1143This was backwards incompatible, but means Exim no longer needs to track
1144all algorithms and provide string forms for them. */
83da1223 1145
17c76198 1146want_default_priorities = TRUE;
83da1223 1147
17c76198 1148if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1149 {
17c76198
PP
1150 if (!expand_check_tlsvar(tls_require_ciphers))
1151 return DEFER;
1152 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1153 {
17c76198
PP
1154 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1155 state->exp_tls_require_ciphers);
1156
1157 rc = gnutls_priority_init(&state->priority_cache,
1158 CS state->exp_tls_require_ciphers, &errpos);
1159 want_default_priorities = FALSE;
1160 p = state->exp_tls_require_ciphers;
83da1223
PH
1161 }
1162 }
17c76198
PP
1163if (want_default_priorities)
1164 {
83e2f8a2
PP
1165 DEBUG(D_tls)
1166 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1167 exim_default_gnutls_priority);
17c76198
PP
1168 rc = gnutls_priority_init(&state->priority_cache,
1169 exim_default_gnutls_priority, &errpos);
1170 p = US exim_default_gnutls_priority;
1171 }
83da1223 1172
17c76198
PP
1173exim_gnutls_err_check(string_sprintf(
1174 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1175 p, errpos - CS p, errpos));
1176
1177rc = gnutls_priority_set(state->session, state->priority_cache);
1178exim_gnutls_err_check(US"gnutls_priority_set");
1179
1180gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1181
1182/* Reduce security in favour of increased compatibility, if the admin
1183decides to make that trade-off. */
1184if (gnutls_compat_mode)
83da1223 1185 {
17c76198
PP
1186#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1187 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1188 gnutls_session_enable_compatibility_mode(state->session);
1189#else
1190 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1191#endif
83da1223
PH
1192 }
1193
17c76198 1194*caller_state = state;
17c76198 1195return OK;
83da1223
PH
1196}
1197
1198
1199
83da1223 1200/*************************************************
17c76198 1201* Extract peer information *
059ec3d9
PH
1202*************************************************/
1203
17c76198 1204/* Called from both server and client code.
4fe99a6c
PP
1205Only this is allowed to set state->peerdn and state->have_set_peerdn
1206and we use that to detect double-calls.
059ec3d9 1207
75fe387d
PP
1208NOTE: the state blocks last while the TLS connection is up, which is fine
1209for logging in the server side, but for the client side, we log after teardown
1210in src/deliver.c. While the session is up, we can twist about states and
1211repoint tls_* globals, but those variables used for logging or other variable
1212expansion that happens _after_ delivery need to have a longer life-time.
1213
1214So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1215doing this more than once per generation of a state context. We set them in
1216the state context, and repoint tls_* to them. After the state goes away, the
1217tls_* copies of the pointers remain valid and client delivery logging is happy.
1218
1219tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1220don't apply.
1221
059ec3d9 1222Arguments:
17c76198 1223 state exim_gnutls_state_st *
059ec3d9 1224
17c76198 1225Returns: OK/DEFER/FAIL
059ec3d9
PH
1226*/
1227
17c76198
PP
1228static int
1229peer_status(exim_gnutls_state_st *state)
059ec3d9 1230{
75fe387d 1231uschar cipherbuf[256];
17c76198 1232const gnutls_datum *cert_list;
75fe387d 1233int old_pool, rc;
17c76198 1234unsigned int cert_list_size = 0;
4fe99a6c
PP
1235gnutls_protocol_t protocol;
1236gnutls_cipher_algorithm_t cipher;
1237gnutls_kx_algorithm_t kx;
1238gnutls_mac_algorithm_t mac;
17c76198
PP
1239gnutls_certificate_type_t ct;
1240gnutls_x509_crt_t crt;
4fe99a6c 1241uschar *p, *dn_buf;
17c76198 1242size_t sz;
059ec3d9 1243
4fe99a6c 1244if (state->have_set_peerdn)
17c76198 1245 return OK;
4fe99a6c 1246state->have_set_peerdn = TRUE;
059ec3d9 1247
4fe99a6c 1248state->peerdn = NULL;
059ec3d9 1249
4fe99a6c
PP
1250/* tls_cipher */
1251cipher = gnutls_cipher_get(state->session);
1252protocol = gnutls_protocol_get_version(state->session);
1253mac = gnutls_mac_get(state->session);
1254kx = gnutls_kx_get(state->session);
1255
75fe387d 1256string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1257 "%s:%s:%d",
1258 gnutls_protocol_get_name(protocol),
1259 gnutls_cipher_suite_get_name(kx, cipher, mac),
1260 (int) gnutls_cipher_get_key_size(cipher) * 8);
1261
1262/* I don't see a way that spaces could occur, in the current GnuTLS
1263code base, but it was a concern in the old code and perhaps older GnuTLS
1264releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1265for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1266 if (isspace(*p))
1267 *p = '-';
75fe387d
PP
1268old_pool = store_pool;
1269store_pool = POOL_PERM;
1270state->ciphersuite = string_copy(cipherbuf);
1271store_pool = old_pool;
817d9f57 1272state->tlsp->cipher = state->ciphersuite;
4fe99a6c
PP
1273
1274/* tls_peerdn */
17c76198 1275cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1276
17c76198
PP
1277if (cert_list == NULL || cert_list_size == 0)
1278 {
17c76198
PP
1279 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1280 cert_list, cert_list_size);
e51c7be2 1281 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198
PP
1282 return tls_error(US"certificate verification failed",
1283 "no certificate received from peer", state->host);
1284 return OK;
1285 }
059ec3d9 1286
17c76198
PP
1287ct = gnutls_certificate_type_get(state->session);
1288if (ct != GNUTLS_CRT_X509)
059ec3d9 1289 {
17c76198 1290 const char *ctn = gnutls_certificate_type_get_name(ct);
17c76198
PP
1291 DEBUG(D_tls)
1292 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1293 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198
PP
1294 return tls_error(US"certificate verification not possible, unhandled type",
1295 ctn, state->host);
1296 return OK;
83da1223 1297 }
059ec3d9 1298
e51c7be2
JH
1299#define exim_gnutls_peer_err(Label) \
1300 do { \
1301 if (rc != GNUTLS_E_SUCCESS) \
1302 { \
1303 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1304 (Label), gnutls_strerror(rc)); \
1305 if (state->verify_requirement >= VERIFY_REQUIRED) \
1306 return tls_error((Label), gnutls_strerror(rc), state->host); \
1307 return OK; \
1308 } \
1309 } while (0)
17c76198 1310
9d1c15ef
JH
1311rc = import_cert(&cert_list[0], &crt);
1312exim_gnutls_peer_err(US"cert 0");
1313
1314state->tlsp->peercert = state->peercert = crt;
17c76198 1315
17c76198
PP
1316sz = 0;
1317rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1318if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1319 {
17c76198
PP
1320 exim_gnutls_peer_err(US"getting size for cert DN failed");
1321 return FAIL; /* should not happen */
059ec3d9 1322 }
17c76198
PP
1323dn_buf = store_get_perm(sz);
1324rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1325exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1326
17c76198
PP
1327state->peerdn = dn_buf;
1328
1329return OK;
1330#undef exim_gnutls_peer_err
1331}
059ec3d9 1332
059ec3d9 1333
059ec3d9 1334
059ec3d9 1335
17c76198
PP
1336/*************************************************
1337* Verify peer certificate *
1338*************************************************/
059ec3d9 1339
17c76198
PP
1340/* Called from both server and client code.
1341*Should* be using a callback registered with
1342gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1343the peer information, but that's too new for some OSes.
059ec3d9 1344
17c76198
PP
1345Arguments:
1346 state exim_gnutls_state_st *
1347 error where to put an error message
059ec3d9 1348
17c76198
PP
1349Returns:
1350 FALSE if the session should be rejected
1351 TRUE if the cert is okay or we just don't care
1352*/
059ec3d9 1353
17c76198
PP
1354static BOOL
1355verify_certificate(exim_gnutls_state_st *state, const char **error)
1356{
1357int rc;
1358unsigned int verify;
1359
1360*error = NULL;
1361
0a92f87f 1362if ((rc = peer_status(state)) != OK)
e6060e2c 1363 {
17c76198 1364 verify = GNUTLS_CERT_INVALID;
0a92f87f 1365 *error = "certificate not supplied";
17c76198
PP
1366 }
1367else
17c76198 1368 rc = gnutls_certificate_verify_peers2(state->session, &verify);
e6060e2c 1369
17c76198
PP
1370/* Handle the result of verification. INVALID seems to be set as well
1371as REVOKED, but leave the test for both. */
059ec3d9 1372
e51c7be2
JH
1373if (rc < 0 ||
1374 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1375 )
17c76198
PP
1376 {
1377 state->peer_cert_verified = FALSE;
0a92f87f
JH
1378 if (!*error)
1379 *error = verify & GNUTLS_CERT_REVOKED
1380 ? "certificate revoked" : "certificate invalid";
059ec3d9 1381
17c76198 1382 DEBUG(D_tls)
e51c7be2 1383 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
4fe99a6c 1384 *error, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1385
e51c7be2 1386 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1387 {
e51c7be2
JH
1388 gnutls_alert_send(state->session,
1389 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
17c76198
PP
1390 return FALSE;
1391 }
1392 DEBUG(D_tls)
4789da3a 1393 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 1394 }
e51c7be2 1395
17c76198
PP
1396else
1397 {
aa2a70ba 1398 if (state->exp_tls_verify_cert_hostnames)
e51c7be2
JH
1399 {
1400 int sep = 0;
55414b25 1401 const uschar * list = state->exp_tls_verify_cert_hostnames;
e51c7be2
JH
1402 uschar * name;
1403 while (name = string_nextinlist(&list, &sep, NULL, 0))
1404 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1405 break;
1406 if (!name)
1407 {
1408 DEBUG(D_tls)
1409 debug_printf("TLS certificate verification failed: cert name mismatch\n");
aa2a70ba
JH
1410 if (state->verify_requirement >= VERIFY_REQUIRED)
1411 {
1412 gnutls_alert_send(state->session,
1413 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1414 return FALSE;
1415 }
1416 return TRUE;
e51c7be2
JH
1417 }
1418 }
17c76198 1419 state->peer_cert_verified = TRUE;
e51c7be2 1420 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 1421 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1422 }
059ec3d9 1423
817d9f57 1424state->tlsp->peerdn = state->peerdn;
059ec3d9 1425
17c76198
PP
1426return TRUE;
1427}
059ec3d9 1428
17c76198
PP
1429
1430
1431
1432/* ------------------------------------------------------------------------ */
1433/* Callbacks */
1434
1435/* Logging function which can be registered with
1436 * gnutls_global_set_log_function()
1437 * gnutls_global_set_log_level() 0..9
1438 */
af3498d6 1439#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1440static void
17c76198 1441exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1442{
8c79eebf
PP
1443 size_t len = strlen(message);
1444 if (len < 1)
1445 {
1446 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1447 return;
1448 }
1449 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1450 message[len-1] == '\n' ? "" : "\n");
17c76198 1451}
af3498d6 1452#endif
059ec3d9 1453
059ec3d9 1454
17c76198
PP
1455/* Called after client hello, should handle SNI work.
1456This will always set tls_sni (state->received_sni) if available,
1457and may trigger presenting different certificates,
1458if state->trigger_sni_changes is TRUE.
059ec3d9 1459
17c76198
PP
1460Should be registered with
1461 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1462
17c76198
PP
1463"This callback must return 0 on success or a gnutls error code to terminate the
1464handshake.".
059ec3d9 1465
17c76198
PP
1466For inability to get SNI information, we return 0.
1467We only return non-zero if re-setup failed.
817d9f57 1468Only used for server-side TLS.
17c76198 1469*/
44bbabb5 1470
17c76198
PP
1471static int
1472exim_sni_handling_cb(gnutls_session_t session)
1473{
1474char sni_name[MAX_HOST_LEN];
1475size_t data_len = MAX_HOST_LEN;
817d9f57 1476exim_gnutls_state_st *state = &state_server;
17c76198
PP
1477unsigned int sni_type;
1478int rc, old_pool;
1479
1480rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1481if (rc != GNUTLS_E_SUCCESS)
1482 {
1483 DEBUG(D_tls) {
1484 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1485 debug_printf("TLS: no SNI presented in handshake.\n");
1486 else
1487 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1488 gnutls_strerror(rc), rc);
1489 };
1490 return 0;
1491 }
1492
17c76198
PP
1493if (sni_type != GNUTLS_NAME_DNS)
1494 {
1495 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1496 return 0;
1497 }
44bbabb5 1498
17c76198
PP
1499/* We now have a UTF-8 string in sni_name */
1500old_pool = store_pool;
1501store_pool = POOL_PERM;
1502state->received_sni = string_copyn(US sni_name, data_len);
1503store_pool = old_pool;
1504
1505/* We set this one now so that variable expansions below will work */
817d9f57 1506state->tlsp->sni = state->received_sni;
17c76198
PP
1507
1508DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1509 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1510
1511if (!state->trigger_sni_changes)
1512 return 0;
1513
1514rc = tls_expand_session_files(state);
1515if (rc != OK)
1516 {
1517 /* If the setup of certs/etc failed before handshake, TLS would not have
1518 been offered. The best we can do now is abort. */
1519 return GNUTLS_E_APPLICATION_ERROR_MIN;
1520 }
1521
1365611d
PP
1522rc = tls_set_remaining_x509(state);
1523if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1524
1525return 0;
059ec3d9
PH
1526}
1527
1528
1529
f2de3a33 1530#ifndef DISABLE_OCSP
44662487
JH
1531
1532static int
1533server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1534 gnutls_datum_t * ocsp_response)
1535{
1536int ret;
1537
44662487
JH
1538if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1539 {
1540 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1541 (char *)ptr);
018058b2 1542 tls_in.ocsp = OCSP_NOT_RESP;
44662487
JH
1543 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1544 }
1545
018058b2 1546tls_in.ocsp = OCSP_VFY_NOT_TRIED;
44662487
JH
1547return 0;
1548}
1549
1550#endif
1551
1552
774ef2d7 1553#ifdef EXPERIMENTAL_EVENT
a7538db1
JH
1554/*
1555We use this callback to get observability and detail-level control
723fe533
JH
1556for an exim TLS connection (either direction), raising a tls:cert event
1557for each cert in the chain presented by the peer. Any event
a7538db1
JH
1558can deny verification.
1559
1560Return 0 for the handshake to continue or non-zero to terminate.
1561*/
1562
1563static int
723fe533 1564verify_cb(gnutls_session_t session)
a7538db1
JH
1565{
1566const gnutls_datum * cert_list;
1567unsigned int cert_list_size = 0;
1568gnutls_x509_crt_t crt;
1569int rc;
b30275b8 1570uschar * yield;
a7538db1
JH
1571exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1572
1573cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1574if (cert_list)
1575 while (cert_list_size--)
1576 {
1577 rc = import_cert(&cert_list[cert_list_size], &crt);
1578 if (rc != GNUTLS_E_SUCCESS)
1579 {
1580 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1581 cert_list_size, gnutls_strerror(rc));
1582 break;
1583 }
1584
1585 state->tlsp->peercert = crt;
b30275b8
JH
1586 if ((yield = event_raise(state->event_action,
1587 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
1588 {
1589 log_write(0, LOG_MAIN,
b30275b8
JH
1590 "SSL verify denied by event-action: depth=%d: %s",
1591 cert_list_size, yield);
a7538db1
JH
1592 return 1; /* reject */
1593 }
1594 state->tlsp->peercert = NULL;
1595 }
1596
1597return 0;
1598}
1599
1600#endif
44662487
JH
1601
1602
17c76198
PP
1603
1604/* ------------------------------------------------------------------------ */
1605/* Exported functions */
1606
1607
1608
1609
059ec3d9
PH
1610/*************************************************
1611* Start a TLS session in a server *
1612*************************************************/
1613
1614/* This is called when Exim is running as a server, after having received
1615the STARTTLS command. It must respond to that command, and then negotiate
1616a TLS session.
1617
1618Arguments:
83da1223 1619 require_ciphers list of allowed ciphers or NULL
059ec3d9
PH
1620
1621Returns: OK on success
1622 DEFER for errors before the start of the negotiation
1623 FAIL for errors during the negotation; the server can't
1624 continue running.
1625*/
1626
1627int
17c76198 1628tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1629{
1630int rc;
7199e1ee 1631const char *error;
17c76198 1632exim_gnutls_state_st *state = NULL;
059ec3d9
PH
1633
1634/* Check for previous activation */
817d9f57 1635if (tls_in.active >= 0)
059ec3d9 1636 {
17c76198 1637 tls_error(US"STARTTLS received after TLS started", "", NULL);
059ec3d9
PH
1638 smtp_printf("554 Already in TLS\r\n");
1639 return FAIL;
1640 }
1641
1642/* Initialize the library. If it fails, it will already have logged the error
1643and sent an SMTP response. */
1644
17c76198 1645DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 1646
17c76198
PP
1647rc = tls_init(NULL, tls_certificate, tls_privatekey,
1648 NULL, tls_verify_certificates, tls_crl,
1649 require_ciphers, &state);
059ec3d9
PH
1650if (rc != OK) return rc;
1651
059ec3d9
PH
1652/* If this is a host for which certificate verification is mandatory or
1653optional, set up appropriately. */
1654
059ec3d9 1655if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 1656 {
e51c7be2
JH
1657 DEBUG(D_tls)
1658 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
1659 state->verify_requirement = VERIFY_REQUIRED;
1660 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1661 }
059ec3d9 1662else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 1663 {
e51c7be2
JH
1664 DEBUG(D_tls)
1665 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
1666 state->verify_requirement = VERIFY_OPTIONAL;
1667 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1668 }
1669else
1670 {
e51c7be2
JH
1671 DEBUG(D_tls)
1672 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
1673 state->verify_requirement = VERIFY_NONE;
1674 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1675 }
059ec3d9 1676
723fe533
JH
1677#ifdef EXPERIMENTAL_EVENT
1678if (event_action)
1679 {
1680 state->event_action = event_action;
1681 gnutls_session_set_ptr(state->session, state);
1682 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1683 }
1684#endif
1685
17c76198
PP
1686/* Register SNI handling; always, even if not in tls_certificate, so that the
1687expansion variable $tls_sni is always available. */
059ec3d9 1688
17c76198
PP
1689gnutls_handshake_set_post_client_hello_function(state->session,
1690 exim_sni_handling_cb);
059ec3d9
PH
1691
1692/* Set context and tell client to go ahead, except in the case of TLS startup
1693on connection, where outputting anything now upsets the clients and tends to
1694make them disconnect. We need to have an explicit fflush() here, to force out
1695the response. Other smtp_printf() calls do not need it, because in non-TLS
1696mode, the fflush() happens when smtp_getc() is called. */
1697
817d9f57 1698if (!state->tlsp->on_connect)
059ec3d9
PH
1699 {
1700 smtp_printf("220 TLS go ahead\r\n");
9d1c15ef 1701 fflush(smtp_out);
059ec3d9
PH
1702 }
1703
1704/* Now negotiate the TLS session. We put our own timer on it, since it seems
1705that the GnuTLS library doesn't. */
1706
17c76198 1707gnutls_transport_set_ptr2(state->session,
44662487
JH
1708 (gnutls_transport_ptr)(long) fileno(smtp_in),
1709 (gnutls_transport_ptr)(long) fileno(smtp_out));
17c76198
PP
1710state->fd_in = fileno(smtp_in);
1711state->fd_out = fileno(smtp_out);
059ec3d9
PH
1712
1713sigalrm_seen = FALSE;
1714if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198
PP
1715do
1716 {
1717 rc = gnutls_handshake(state->session);
619b2b25
PP
1718 } while ((rc == GNUTLS_E_AGAIN) ||
1719 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1720alarm(0);
1721
17c76198 1722if (rc != GNUTLS_E_SUCCESS)
059ec3d9 1723 {
17c76198
PP
1724 tls_error(US"gnutls_handshake",
1725 sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
059ec3d9
PH
1726 /* It seems that, except in the case of a timeout, we have to close the
1727 connection right here; otherwise if the other end is running OpenSSL it hangs
1728 until the server times out. */
1729
1730 if (!sigalrm_seen)
1731 {
f1e894f3
PH
1732 (void)fclose(smtp_out);
1733 (void)fclose(smtp_in);
059ec3d9
PH
1734 }
1735
1736 return FAIL;
1737 }
1738
1739DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1740
17c76198
PP
1741/* Verify after the fact */
1742
9d1c15ef
JH
1743if ( state->verify_requirement != VERIFY_NONE
1744 && !verify_certificate(state, &error))
059ec3d9 1745 {
9d1c15ef 1746 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 1747 {
9d1c15ef
JH
1748 tls_error(US"certificate verification failed", error, NULL);
1749 return FAIL;
17c76198 1750 }
9d1c15ef
JH
1751 DEBUG(D_tls)
1752 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
1753 error);
059ec3d9
PH
1754 }
1755
17c76198
PP
1756/* Figure out peer DN, and if authenticated, etc. */
1757
1758rc = peer_status(state);
1759if (rc != OK) return rc;
1760
1761/* Sets various Exim expansion variables; always safe within server */
1762
9d1c15ef 1763extract_exim_vars_from_tls_state(state);
059ec3d9
PH
1764
1765/* TLS has been set up. Adjust the input functions to read via TLS,
1766and initialize appropriately. */
1767
17c76198 1768state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
1769
1770receive_getc = tls_getc;
1771receive_ungetc = tls_ungetc;
1772receive_feof = tls_feof;
1773receive_ferror = tls_ferror;
58eb016e 1774receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1775
059ec3d9
PH
1776return OK;
1777}
1778
1779
1780
1781
aa2a70ba
JH
1782static void
1783tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
1784 smtp_transport_options_block * ob)
1785{
5130845b 1786if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 1787 {
4af0d74a
JH
1788 state->exp_tls_verify_cert_hostnames =
1789#ifdef EXPERIMENTAL_INTERNATIONAL
1790 string_domain_utf8_to_alabel(host->name, NULL);
1791#else
1792 host->name;
1793#endif
aa2a70ba
JH
1794 DEBUG(D_tls)
1795 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
1796 state->exp_tls_verify_cert_hostnames);
1797 }
1798}
aa2a70ba
JH
1799
1800
059ec3d9
PH
1801/*************************************************
1802* Start a TLS session in a client *
1803*************************************************/
1804
1805/* Called from the smtp transport after STARTTLS has been accepted.
1806
1807Arguments:
1808 fd the fd of the connection
1809 host connected host (for messages)
83da1223 1810 addr the first address (not used)
a7538db1 1811 tb transport (always smtp)
059ec3d9
PH
1812
1813Returns: OK/DEFER/FAIL (because using common functions),
1814 but for a client, DEFER and FAIL have the same meaning
1815*/
1816
1817int
17c76198 1818tls_client_start(int fd, host_item *host,
f5d78688 1819 address_item *addr ARG_UNUSED,
0e66b3b6
JH
1820 transport_instance *tb
1821#ifdef EXPERIMENTAL_DANE
1822 , dne_answer * unused_tlsa_dnsa
1823#endif
1824 )
059ec3d9 1825{
a7538db1
JH
1826smtp_transport_options_block *ob =
1827 (smtp_transport_options_block *)tb->options_block;
059ec3d9 1828int rc;
17c76198
PP
1829const char *error;
1830exim_gnutls_state_st *state = NULL;
f2de3a33 1831#ifndef DISABLE_OCSP
5130845b
JH
1832BOOL require_ocsp =
1833 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
44662487 1834BOOL request_ocsp = require_ocsp ? TRUE
5130845b 1835 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2b4a568d 1836#endif
059ec3d9 1837
17c76198 1838DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 1839
65867078
JH
1840if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
1841 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
1842 ob->tls_require_ciphers, &state)) != OK)
2b4a568d 1843 return rc;
059ec3d9 1844
54c90be1 1845 {
65867078
JH
1846 int dh_min_bits = ob->tls_dh_min_bits;
1847 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1848 {
1849 DEBUG(D_tls)
1850 debug_printf("WARNING: tls_dh_min_bits far too low,"
1851 " clamping %d up to %d\n",
1852 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1853 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1854 }
54c90be1 1855
65867078
JH
1856 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
1857 " acceptable bits to %d\n",
1858 dh_min_bits);
1859 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1860 }
83da1223 1861
2b4a568d
JH
1862/* Stick to the old behaviour for compatibility if tls_verify_certificates is
1863set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
1864the specified host patterns if one of them is defined */
1865
aa2a70ba
JH
1866if ( ( state->exp_tls_verify_certificates
1867 && !ob->tls_verify_hosts
610ff438 1868 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
aa2a70ba 1869 )
5130845b 1870 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
2b4a568d 1871 )
17c76198 1872 {
aa2a70ba 1873 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
1874 DEBUG(D_tls)
1875 debug_printf("TLS: server certificate verification required.\n");
1876 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
1877 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1878 }
5130845b 1879else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
52f93eed 1880 {
aa2a70ba 1881 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
1882 DEBUG(D_tls)
1883 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 1884 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
1885 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1886 }
1887else
1888 {
e51c7be2
JH
1889 DEBUG(D_tls)
1890 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
1891 state->verify_requirement = VERIFY_NONE;
1892 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 1893 }
059ec3d9 1894
f2de3a33
JH
1895#ifndef DISABLE_OCSP
1896 /* supported since GnuTLS 3.1.3 */
44662487 1897if (request_ocsp)
9d1c15ef
JH
1898 {
1899 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
1900 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
1901 NULL, 0, NULL)) != OK)
9d1c15ef
JH
1902 return tls_error(US"cert-status-req",
1903 gnutls_strerror(rc), state->host);
44662487 1904 tls_out.ocsp = OCSP_NOT_RESP;
9d1c15ef 1905 }
2b4a568d
JH
1906#endif
1907
774ef2d7
JH
1908#ifdef EXPERIMENTAL_EVENT
1909if (tb->event_action)
a7538db1 1910 {
774ef2d7 1911 state->event_action = tb->event_action;
a7538db1 1912 gnutls_session_set_ptr(state->session, state);
723fe533 1913 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
1914 }
1915#endif
1916
44662487 1917gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)(long) fd);
17c76198
PP
1918state->fd_in = fd;
1919state->fd_out = fd;
059ec3d9 1920
9d1c15ef 1921DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
1922/* There doesn't seem to be a built-in timeout on connection. */
1923
1924sigalrm_seen = FALSE;
65867078 1925alarm(ob->command_timeout);
17c76198
PP
1926do
1927 {
1928 rc = gnutls_handshake(state->session);
619b2b25
PP
1929 } while ((rc == GNUTLS_E_AGAIN) ||
1930 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
1931alarm(0);
1932
4fe99a6c
PP
1933if (rc != GNUTLS_E_SUCCESS)
1934 return tls_error(US"gnutls_handshake",
1935 sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
1936
17c76198 1937DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 1938
17c76198 1939/* Verify late */
059ec3d9 1940
17c76198
PP
1941if (state->verify_requirement != VERIFY_NONE &&
1942 !verify_certificate(state, &error))
1943 return tls_error(US"certificate verification failed", error, state->host);
059ec3d9 1944
f2de3a33 1945#ifndef DISABLE_OCSP
2b4a568d
JH
1946if (require_ocsp)
1947 {
1948 DEBUG(D_tls)
1949 {
1950 gnutls_datum_t stapling;
1951 gnutls_ocsp_resp_t resp;
1952 gnutls_datum_t printed;
1953 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
1954 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
1955 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
1956 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
1957 )
1958 {
65867078 1959 debug_printf("%.4096s", printed.data);
2b4a568d
JH
1960 gnutls_free(printed.data);
1961 }
1962 else
1963 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host);
1964 }
1965
2b4a568d 1966 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2
JH
1967 {
1968 tls_out.ocsp = OCSP_FAILED;
2b4a568d 1969 return tls_error(US"certificate status check failed", NULL, state->host);
018058b2 1970 }
2b4a568d 1971 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
44662487 1972 tls_out.ocsp = OCSP_VFIED;
2b4a568d
JH
1973 }
1974#endif
1975
17c76198 1976/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 1977
2b4a568d
JH
1978if ((rc = peer_status(state)) != OK)
1979 return rc;
059ec3d9 1980
4fe99a6c 1981/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 1982
9d1c15ef 1983extract_exim_vars_from_tls_state(state);
059ec3d9 1984
059ec3d9
PH
1985return OK;
1986}
1987
1988
1989
17c76198 1990
059ec3d9 1991/*************************************************
17c76198 1992* Close down a TLS session *
059ec3d9
PH
1993*************************************************/
1994
17c76198
PP
1995/* This is also called from within a delivery subprocess forked from the
1996daemon, to shut down the TLS library, without actually doing a shutdown (which
1997would tamper with the TLS session in the parent process).
059ec3d9 1998
17c76198
PP
1999Arguments: TRUE if gnutls_bye is to be called
2000Returns: nothing
059ec3d9
PH
2001*/
2002
17c76198 2003void
817d9f57 2004tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 2005{
817d9f57 2006exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 2007
389ca47a 2008if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
17c76198
PP
2009
2010if (shutdown)
2011 {
2012 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
2013 gnutls_bye(state->session, GNUTLS_SHUT_WR);
2014 }
2015
2016gnutls_deinit(state->session);
2017
389ca47a 2018state->tlsp->active = -1;
17c76198
PP
2019memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2020
2021if ((state_server.session == NULL) && (state_client.session == NULL))
2022 {
2023 gnutls_global_deinit();
2024 exim_gnutls_base_init_done = FALSE;
2025 }
7199e1ee 2026
059ec3d9
PH
2027}
2028
2029
2030
17c76198 2031
059ec3d9
PH
2032/*************************************************
2033* TLS version of getc *
2034*************************************************/
2035
2036/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2037it refills the buffer via the GnuTLS reading function.
817d9f57 2038Only used by the server-side TLS.
059ec3d9 2039
17c76198
PP
2040This feeds DKIM and should be used for all message-body reads.
2041
059ec3d9
PH
2042Arguments: none
2043Returns: the next character or EOF
2044*/
2045
2046int
2047tls_getc(void)
2048{
817d9f57 2049exim_gnutls_state_st *state = &state_server;
17c76198 2050if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
059ec3d9 2051 {
17c76198 2052 ssize_t inbytes;
059ec3d9 2053
17c76198
PP
2054 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2055 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
2056
2057 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 2058 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
059ec3d9
PH
2059 ssl_xfer_buffer_size);
2060 alarm(0);
2061
2062 /* A zero-byte return appears to mean that the TLS session has been
2063 closed down, not that the socket itself has been closed down. Revert to
2064 non-TLS handling. */
2065
2066 if (inbytes == 0)
2067 {
2068 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2069
2070 receive_getc = smtp_getc;
2071 receive_ungetc = smtp_ungetc;
2072 receive_feof = smtp_feof;
2073 receive_ferror = smtp_ferror;
58eb016e 2074 receive_smtp_buffered = smtp_buffered;
059ec3d9 2075
17c76198
PP
2076 gnutls_deinit(state->session);
2077 state->session = NULL;
817d9f57
JH
2078 state->tlsp->active = -1;
2079 state->tlsp->bits = 0;
2080 state->tlsp->certificate_verified = FALSE;
9d1c15ef 2081 tls_channelbinding_b64 = NULL;
817d9f57 2082 state->tlsp->cipher = NULL;
9d1c15ef 2083 state->tlsp->peercert = NULL;
817d9f57 2084 state->tlsp->peerdn = NULL;
059ec3d9
PH
2085
2086 return smtp_getc();
2087 }
2088
2089 /* Handle genuine errors */
2090
2091 else if (inbytes < 0)
2092 {
17c76198
PP
2093 record_io_error(state, (int) inbytes, US"recv", NULL);
2094 state->xfer_error = 1;
059ec3d9
PH
2095 return EOF;
2096 }
80a47a2c 2097#ifndef DISABLE_DKIM
17c76198 2098 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
80a47a2c 2099#endif
17c76198
PP
2100 state->xfer_buffer_hwm = (int) inbytes;
2101 state->xfer_buffer_lwm = 0;
059ec3d9
PH
2102 }
2103
059ec3d9
PH
2104/* Something in the buffer; return next uschar */
2105
17c76198 2106return state->xfer_buffer[state->xfer_buffer_lwm++];
059ec3d9
PH
2107}
2108
2109
2110
17c76198 2111
059ec3d9
PH
2112/*************************************************
2113* Read bytes from TLS channel *
2114*************************************************/
2115
17c76198
PP
2116/* This does not feed DKIM, so if the caller uses this for reading message body,
2117then the caller must feed DKIM.
817d9f57 2118
059ec3d9
PH
2119Arguments:
2120 buff buffer of data
2121 len size of buffer
2122
2123Returns: the number of bytes read
2124 -1 after a failed read
2125*/
2126
2127int
817d9f57 2128tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2129{
817d9f57 2130exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
17c76198 2131ssize_t inbytes;
059ec3d9 2132
17c76198
PP
2133if (len > INT_MAX)
2134 len = INT_MAX;
059ec3d9 2135
17c76198
PP
2136if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2137 DEBUG(D_tls)
2138 debug_printf("*** PROBABLY A BUG *** " \
2139 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2140 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2141
2142DEBUG(D_tls)
2143 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2144 state->session, buff, len);
2145
2146inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
2147if (inbytes > 0) return inbytes;
2148if (inbytes == 0)
2149 {
2150 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2151 }
17c76198 2152else record_io_error(state, (int)inbytes, US"recv", NULL);
059ec3d9
PH
2153
2154return -1;
2155}
2156
2157
2158
17c76198 2159
059ec3d9
PH
2160/*************************************************
2161* Write bytes down TLS channel *
2162*************************************************/
2163
2164/*
2165Arguments:
817d9f57 2166 is_server channel specifier
059ec3d9
PH
2167 buff buffer of data
2168 len number of bytes
2169
2170Returns: the number of bytes after a successful write,
2171 -1 after a failed write
2172*/
2173
2174int
817d9f57 2175tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9 2176{
17c76198
PP
2177ssize_t outbytes;
2178size_t left = len;
817d9f57 2179exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 2180
17c76198 2181DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
059ec3d9
PH
2182while (left > 0)
2183 {
17c76198
PP
2184 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2185 buff, left);
2186 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 2187
17c76198 2188 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
2189 if (outbytes < 0)
2190 {
17c76198 2191 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
2192 return -1;
2193 }
2194 if (outbytes == 0)
2195 {
17c76198 2196 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
2197 return -1;
2198 }
2199
2200 left -= outbytes;
2201 buff += outbytes;
2202 }
2203
17c76198
PP
2204if (len > INT_MAX)
2205 {
2206 DEBUG(D_tls)
2207 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2208 len);
2209 len = INT_MAX;
2210 }
2211
2212return (int) len;
059ec3d9
PH
2213}
2214
2215
2216
17c76198 2217
059ec3d9 2218/*************************************************
17c76198 2219* Random number generation *
059ec3d9
PH
2220*************************************************/
2221
17c76198
PP
2222/* Pseudo-random number generation. The result is not expected to be
2223cryptographically strong but not so weak that someone will shoot themselves
2224in the foot using it as a nonce in input in some email header scheme or
2225whatever weirdness they'll twist this into. The result should handle fork()
2226and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 2227
17c76198
PP
2228Arguments:
2229 max range maximum
2230Returns a random number in range [0, max-1]
059ec3d9
PH
2231*/
2232
af3498d6 2233#ifdef HAVE_GNUTLS_RND
17c76198
PP
2234int
2235vaguely_random_number(int max)
059ec3d9 2236{
17c76198
PP
2237unsigned int r;
2238int i, needed_len;
2239uschar *p;
2240uschar smallbuf[sizeof(r)];
2241
2242if (max <= 1)
2243 return 0;
2244
2245needed_len = sizeof(r);
2246/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2247 * asked for a number less than 10. */
2248for (r = max, i = 0; r; ++i)
2249 r >>= 1;
2250i = (i + 7) / 8;
2251if (i < needed_len)
2252 needed_len = i;
2253
2254i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2255if (i < 0)
059ec3d9 2256 {
17c76198
PP
2257 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2258 return vaguely_random_number_fallback(max);
2259 }
2260r = 0;
2261for (p = smallbuf; needed_len; --needed_len, ++p)
2262 {
2263 r *= 256;
2264 r += *p;
059ec3d9
PH
2265 }
2266
17c76198
PP
2267/* We don't particularly care about weighted results; if someone wants
2268 * smooth distribution and cares enough then they should submit a patch then. */
2269return r % max;
059ec3d9 2270}
af3498d6
PP
2271#else /* HAVE_GNUTLS_RND */
2272int
2273vaguely_random_number(int max)
2274{
2275 return vaguely_random_number_fallback(max);
2276}
2277#endif /* HAVE_GNUTLS_RND */
059ec3d9 2278
36f12725
NM
2279
2280
2281
2282/*************************************************
3375e053
PP
2283* Let tls_require_ciphers be checked at startup *
2284*************************************************/
2285
2286/* The tls_require_ciphers option, if set, must be something which the
2287library can parse.
2288
2289Returns: NULL on success, or error message
2290*/
2291
2292uschar *
2293tls_validate_require_cipher(void)
2294{
2295int rc;
2296uschar *expciphers = NULL;
2297gnutls_priority_t priority_cache;
2298const char *errpos;
2299
2300#define validate_check_rc(Label) do { \
2301 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2302 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2303#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2304
2305if (exim_gnutls_base_init_done)
2306 log_write(0, LOG_MAIN|LOG_PANIC,
2307 "already initialised GnuTLS, Exim developer bug");
2308
a5f239e4 2309#ifdef HAVE_GNUTLS_PKCS11
2519e60d 2310if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
2311 {
2312 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2313 validate_check_rc(US"gnutls_pkcs11_init");
2314 }
2315#endif
3375e053
PP
2316rc = gnutls_global_init();
2317validate_check_rc(US"gnutls_global_init()");
2318exim_gnutls_base_init_done = TRUE;
2319
2320if (!(tls_require_ciphers && *tls_require_ciphers))
2321 return_deinit(NULL);
2322
2323if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2324 return_deinit(US"failed to expand tls_require_ciphers");
2325
2326if (!(expciphers && *expciphers))
2327 return_deinit(NULL);
2328
2329DEBUG(D_tls)
2330 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2331
2332rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2333validate_check_rc(string_sprintf(
2334 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2335 expciphers, errpos - CS expciphers, errpos));
2336
2337#undef return_deinit
2338#undef validate_check_rc
2339gnutls_global_deinit();
2340
2341return NULL;
2342}
2343
2344
2345
2346
2347/*************************************************
36f12725
NM
2348* Report the library versions. *
2349*************************************************/
2350
2351/* See a description in tls-openssl.c for an explanation of why this exists.
2352
2353Arguments: a FILE* to print the results to
2354Returns: nothing
2355*/
2356
2357void
2358tls_version_report(FILE *f)
2359{
754a0503
PP
2360fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2361 " Runtime: %s\n",
2362 LIBGNUTLS_VERSION,
2363 gnutls_check_version(NULL));
36f12725
NM
2364}
2365
2b4a568d
JH
2366/* vi: aw ai sw=2
2367*/
059ec3d9 2368/* End of tls-gnu.c */