Docs: Remove GNUmake idioms from Makefile, give power to "mv"
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
6aa6fc9c 16Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17c76198 17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
184384c3 42
a5f239e4
PP
43/* needed to disable PKCS11 autoload unless requested */
44#if GNUTLS_VERSION_NUMBER >= 0x020c00
45# include <gnutls/pkcs11.h>
76075bb5 46# define SUPPORT_PARAM_TO_PK_BITS
a5f239e4 47#endif
7e07527a
JH
48#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
49# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
50# define DISABLE_OCSP
51#endif
0cbf2b82 52#if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
774ef2d7 53# warning "GnuTLS library version too old; tls:cert event unsupported"
0cbf2b82 54# define DISABLE_EVENT
a7538db1 55#endif
a7fec7a7
JH
56#if GNUTLS_VERSION_NUMBER >= 0x030306
57# define SUPPORT_CA_DIR
58#else
59# undef SUPPORT_CA_DIR
60#endif
11a04b5a 61#if GNUTLS_VERSION_NUMBER >= 0x030014
cb1d7830
JH
62# define SUPPORT_SYSDEFAULT_CABUNDLE
63#endif
184384c3
JH
64#if GNUTLS_VERSION_NUMBER >= 0x030104
65# define GNUTLS_CERT_VFY_STATUS_PRINT
66#endif
925ac8e4
JH
67#if GNUTLS_VERSION_NUMBER >= 0x030109
68# define SUPPORT_CORK
69#endif
f20cfa4a
JH
70#if GNUTLS_VERSION_NUMBER >= 0x03010a
71# define SUPPORT_GNUTLS_SESS_DESC
72#endif
73#if GNUTLS_VERSION_NUMBER >= 0x030500
74# define SUPPORT_GNUTLS_KEYLOG
75#endif
47195144
JH
76#if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
77# define SUPPORT_SRV_OCSP_STACK
78#endif
c0635b6d
JH
79
80#ifdef SUPPORT_DANE
81# if GNUTLS_VERSION_NUMBER >= 0x030000
82# define DANESSL_USAGE_DANE_TA 2
83# define DANESSL_USAGE_DANE_EE 3
84# else
85# error GnuTLS version too early for DANE
86# endif
87# if GNUTLS_VERSION_NUMBER < 0x999999
88# define GNUTLS_BROKEN_DANE_VALIDATION
89# endif
899b8bbc 90#endif
7e07527a 91
f2de3a33 92#ifndef DISABLE_OCSP
2b4a568d
JH
93# include <gnutls/ocsp.h>
94#endif
899b8bbc
JH
95#ifdef SUPPORT_DANE
96# include <gnutls/dane.h>
97#endif
059ec3d9 98
f1be21cf
JH
99#include "tls-cipher-stdname.c"
100
101
17c76198 102/* GnuTLS 2 vs 3
059ec3d9 103
17c76198
PP
104GnuTLS 3 only:
105 gnutls_global_set_audit_log_function()
059ec3d9 106
17c76198
PP
107Changes:
108 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
109*/
059ec3d9 110
17c76198 111/* Local static variables for GnuTLS */
059ec3d9 112
17c76198 113/* Values for verify_requirement */
059ec3d9 114
e51c7be2 115enum peer_verify_requirement
899b8bbc 116 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
059ec3d9 117
17c76198
PP
118/* This holds most state for server or client; with this, we can set up an
119outbound TLS-enabled connection in an ACL callout, while not stomping all
120over the TLS variables available for expansion.
059ec3d9 121
17c76198
PP
122Some of these correspond to variables in globals.c; those variables will
123be set to point to content in one of these instances, as appropriate for
124the stage of the process lifetime.
059ec3d9 125
389ca47a 126Not handled here: global tls_channelbinding_b64.
17c76198 127*/
059ec3d9 128
17c76198 129typedef struct exim_gnutls_state {
9d1c15ef 130 gnutls_session_t session;
17c76198 131 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 132 gnutls_priority_t priority_cache;
17c76198 133 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
134 int fd_in;
135 int fd_out;
136 BOOL peer_cert_verified;
899b8bbc 137 BOOL peer_dane_verified;
9d1c15ef
JH
138 BOOL trigger_sni_changes;
139 BOOL have_set_peerdn;
5fd28bb8 140 const struct host_item *host; /* NULL if server */
afdb5e9c 141 gnutls_x509_crt_t peercert;
9d1c15ef
JH
142 uschar *peerdn;
143 uschar *ciphersuite;
144 uschar *received_sni;
17c76198
PP
145
146 const uschar *tls_certificate;
147 const uschar *tls_privatekey;
148 const uschar *tls_sni; /* client send only, not received */
149 const uschar *tls_verify_certificates;
150 const uschar *tls_crl;
151 const uschar *tls_require_ciphers;
e51c7be2 152
17c76198
PP
153 uschar *exp_tls_certificate;
154 uschar *exp_tls_privatekey;
17c76198
PP
155 uschar *exp_tls_verify_certificates;
156 uschar *exp_tls_crl;
157 uschar *exp_tls_require_ciphers;
55414b25 158 const uschar *exp_tls_verify_cert_hostnames;
0cbf2b82 159#ifndef DISABLE_EVENT
a7538db1
JH
160 uschar *event_action;
161#endif
899b8bbc
JH
162#ifdef SUPPORT_DANE
163 char * const * dane_data;
164 const int * dane_data_len;
165#endif
17c76198 166
389ca47a 167 tls_support *tlsp; /* set in tls_init() */
817d9f57 168
17c76198
PP
169 uschar *xfer_buffer;
170 int xfer_buffer_lwm;
171 int xfer_buffer_hwm;
8b77d27a
JH
172 BOOL xfer_eof; /*XXX never gets set! */
173 BOOL xfer_error;
17c76198
PP
174} exim_gnutls_state_st;
175
176static const exim_gnutls_state_st exim_gnutls_state_init = {
f2ed27cf
JH
177 .session = NULL,
178 .x509_cred = NULL,
179 .priority_cache = NULL,
180 .verify_requirement = VERIFY_NONE,
181 .fd_in = -1,
182 .fd_out = -1,
183 .peer_cert_verified = FALSE,
899b8bbc 184 .peer_dane_verified = FALSE,
f2ed27cf
JH
185 .trigger_sni_changes =FALSE,
186 .have_set_peerdn = FALSE,
187 .host = NULL,
188 .peercert = NULL,
189 .peerdn = NULL,
190 .ciphersuite = NULL,
191 .received_sni = NULL,
192
193 .tls_certificate = NULL,
194 .tls_privatekey = NULL,
195 .tls_sni = NULL,
196 .tls_verify_certificates = NULL,
197 .tls_crl = NULL,
198 .tls_require_ciphers =NULL,
199
200 .exp_tls_certificate = NULL,
201 .exp_tls_privatekey = NULL,
202 .exp_tls_verify_certificates = NULL,
203 .exp_tls_crl = NULL,
204 .exp_tls_require_ciphers = NULL,
f2ed27cf 205 .exp_tls_verify_cert_hostnames = NULL,
0cbf2b82 206#ifndef DISABLE_EVENT
f2ed27cf 207 .event_action = NULL,
a7538db1 208#endif
f2ed27cf
JH
209 .tlsp = NULL,
210
211 .xfer_buffer = NULL,
212 .xfer_buffer_lwm = 0,
213 .xfer_buffer_hwm = 0,
8b77d27a
JH
214 .xfer_eof = FALSE,
215 .xfer_error = FALSE,
17c76198 216};
83da1223 217
17c76198
PP
218/* Not only do we have our own APIs which don't pass around state, assuming
219it's held in globals, GnuTLS doesn't appear to let us register callback data
220for callbacks, or as part of the session, so we have to keep a "this is the
221context we're currently dealing with" pointer and rely upon being
222single-threaded to keep from processing data on an inbound TLS connection while
223talking to another TLS connection for an outbound check. This does mean that
224there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
225second connection.
226XXX But see gnutls_session_get_ptr()
227*/
059ec3d9 228
74f1a423 229static exim_gnutls_state_st state_server;
059ec3d9 230
17c76198
PP
231/* dh_params are initialised once within the lifetime of a process using TLS;
232if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
233don't want to repeat this. */
83da1223 234
17c76198 235static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 236
17c76198 237/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 238
17c76198 239static const int ssl_session_timeout = 200;
059ec3d9 240
fc243e94 241static const uschar * const exim_default_gnutls_priority = US"NORMAL";
83da1223 242
17c76198 243/* Guard library core initialisation */
83da1223 244
17c76198 245static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 246
4fb7df6d 247#ifndef DISABLE_OCSP
9196d5bf 248static BOOL gnutls_buggy_ocsp = FALSE;
4fb7df6d 249#endif
9196d5bf 250
059ec3d9 251
17c76198 252/* ------------------------------------------------------------------------ */
17c76198 253/* macros */
83da1223 254
17c76198 255#define MAX_HOST_LEN 255
83da1223 256
17c76198
PP
257/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
258the library logging; a value less than 0 disables the calls to set up logging
ef9da2ee
JH
259callbacks. Possibly GNuTLS also looks for an environment variable
260"GNUTLS_DEBUG_LEVEL". */
2c17bb02 261#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
a7538db1 262# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 263#endif
83da1223 264
2c17bb02 265#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 266# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 267#endif
83da1223 268
af3498d6
PP
269/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
270can ask for a bit-strength. Without that, we stick to the constant we had
271before, for now. */
2c17bb02 272#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 273# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 274#endif
af3498d6 275
47195144
JH
276#define exim_gnutls_err_check(rc, Label) do { \
277 if ((rc) != GNUTLS_E_SUCCESS) \
48224640 278 return tls_error((Label), US gnutls_strerror(rc), host, errstr); \
cf0c6164 279 } while (0)
059ec3d9 280
cf0c6164
JH
281#define expand_check_tlsvar(Varname, errstr) \
282 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
83da1223 283
17c76198 284#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
285# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
286# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
287# define HAVE_GNUTLS_RND
2519e60d
TL
288/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
289 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
290 * isn't available sometimes, so this needs to become a conditional
291 * compilation; the sanest way to deal with this being a problem on
292 * older OSes is to block it in the Local/Makefile with this compiler
293 * definition */
e51c7be2
JH
294# ifndef AVOID_GNUTLS_PKCS11
295# define HAVE_GNUTLS_PKCS11
296# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 297#endif
83da1223 298
af3498d6
PP
299
300
301
302/* ------------------------------------------------------------------------ */
303/* Callback declarations */
304
305#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
306static void exim_gnutls_logger_cb(int level, const char *message);
307#endif
308
309static int exim_sni_handling_cb(gnutls_session_t session);
310
f2de3a33 311#ifndef DISABLE_OCSP
44662487
JH
312static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
313 gnutls_datum_t * ocsp_response);
314#endif
af3498d6
PP
315
316
317
17c76198
PP
318/* ------------------------------------------------------------------------ */
319/* Static functions */
059ec3d9
PH
320
321/*************************************************
322* Handle TLS error *
323*************************************************/
324
325/* Called from lots of places when errors occur before actually starting to do
326the TLS handshake, that is, while the session is still in clear. Always returns
327DEFER for a server and FAIL for a client so that most calls can use "return
328tls_error(...)" to do this processing and then give an appropriate return. A
329single function is used for both server and client, because it is called from
330some shared functions.
331
332Argument:
333 prefix text to include in the logged error
7199e1ee
TF
334 msg additional error string (may be NULL)
335 usually obtained from gnutls_strerror()
17c76198
PP
336 host NULL if setting up a server;
337 the connected host if setting up a client
cf0c6164 338 errstr pointer to returned error string
059ec3d9
PH
339
340Returns: OK/DEFER/FAIL
341*/
342
343static int
48224640 344tls_error(const uschar *prefix, const uschar *msg, const host_item *host,
cf0c6164 345 uschar ** errstr)
059ec3d9 346{
cf0c6164 347if (errstr)
48224640 348 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : US"");
cf0c6164 349return host ? FAIL : DEFER;
059ec3d9
PH
350}
351
352
353
17c76198 354
059ec3d9 355/*************************************************
17c76198 356* Deal with logging errors during I/O *
059ec3d9
PH
357*************************************************/
358
17c76198 359/* We have to get the identity of the peer from saved data.
059ec3d9 360
17c76198
PP
361Argument:
362 state the current GnuTLS exim state container
363 rc the GnuTLS error code, or 0 if it's a local error
364 when text identifying read or write
95f52235 365 text local error text when rc is 0
059ec3d9 366
17c76198 367Returns: nothing
059ec3d9
PH
368*/
369
17c76198
PP
370static void
371record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 372{
48224640 373const uschar * msg;
cf0c6164 374uschar * errstr;
059ec3d9 375
17c76198 376if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
95f52235 377 msg = string_sprintf("A TLS fatal alert has been received: %s",
17c76198
PP
378 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
379else
48224640 380 msg = US gnutls_strerror(rc);
059ec3d9 381
cf0c6164
JH
382(void) tls_error(when, msg, state->host, &errstr);
383
384if (state->host)
385 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
386 state->host->name, state->host->address, errstr);
387else
388 {
389 uschar * conn_info = smtp_get_connection_info();
390 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
391 /* I'd like to get separated H= here, but too hard for now */
392 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
393 }
17c76198 394}
059ec3d9 395
059ec3d9 396
059ec3d9 397
059ec3d9 398
17c76198
PP
399/*************************************************
400* Set various Exim expansion vars *
401*************************************************/
059ec3d9 402
e51c7be2
JH
403#define exim_gnutls_cert_err(Label) \
404 do \
405 { \
406 if (rc != GNUTLS_E_SUCCESS) \
407 { \
408 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
409 (Label), gnutls_strerror(rc)); \
410 return rc; \
411 } \
412 } while (0)
9d1c15ef
JH
413
414static int
27f19eb4 415import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
9d1c15ef
JH
416{
417int rc;
418
419rc = gnutls_x509_crt_init(crtp);
420exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
421
422rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
423exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
424
425return rc;
426}
427
428#undef exim_gnutls_cert_err
429
430
17c76198
PP
431/* We set various Exim global variables from the state, once a session has
432been established. With TLS callouts, may need to change this to stack
433variables, or just re-call it with the server state after client callout
434has finished.
059ec3d9 435
9d1c15ef 436Make sure anything set here is unset in tls_getc().
17c76198
PP
437
438Sets:
439 tls_active fd
440 tls_bits strength indicator
441 tls_certificate_verified bool indicator
442 tls_channelbinding_b64 for some SASL mechanisms
443 tls_cipher a string
9d1c15ef 444 tls_peercert pointer to library internal
17c76198
PP
445 tls_peerdn a string
446 tls_sni a (UTF-8) string
9d1c15ef 447 tls_ourcert pointer to library internal
17c76198
PP
448
449Argument:
450 state the relevant exim_gnutls_state_st *
451*/
452
453static void
9d1c15ef 454extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 455{
17c76198 456gnutls_cipher_algorithm_t cipher;
17c76198
PP
457#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
458int old_pool;
459int rc;
460gnutls_datum_t channel;
461#endif
9d1c15ef 462tls_support * tlsp = state->tlsp;
17c76198 463
74f1a423
JH
464tlsp->active.sock = state->fd_out;
465tlsp->active.tls_ctx = state;
17c76198
PP
466
467cipher = gnutls_cipher_get(state->session);
468/* returns size in "bytes" */
9d1c15ef 469tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 470
9d1c15ef 471tlsp->cipher = state->ciphersuite;
17c76198 472
817d9f57 473DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 474
9d1c15ef 475tlsp->certificate_verified = state->peer_cert_verified;
899b8bbc
JH
476#ifdef SUPPORT_DANE
477tlsp->dane_verified = state->peer_dane_verified;
478#endif
059ec3d9 479
17c76198
PP
480/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
481only available for use for authenticators while this TLS session is running. */
482
483tls_channelbinding_b64 = NULL;
484#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
485channel.data = NULL;
486channel.size = 0;
1f20760b
JH
487if ((rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel)))
488 { DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc)); }
489else
490 {
17c76198
PP
491 old_pool = store_pool;
492 store_pool = POOL_PERM;
1f20760b 493 tls_channelbinding_b64 = b64encode(CUS channel.data, (int)channel.size);
17c76198
PP
494 store_pool = old_pool;
495 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
1f20760b 496 }
17c76198
PP
497#endif
498
9d1c15ef
JH
499/* peercert is set in peer_status() */
500tlsp->peerdn = state->peerdn;
501tlsp->sni = state->received_sni;
502
503/* record our certificate */
504 {
27f19eb4 505 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
9d1c15ef
JH
506 gnutls_x509_crt_t crt;
507
508 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
509 }
059ec3d9
PH
510}
511
512
513
17c76198 514
059ec3d9 515/*************************************************
575643cd 516* Setup up DH parameters *
059ec3d9
PH
517*************************************************/
518
575643cd 519/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
520be re-generated every so often, depending on security policy. What we do is to
521keep these parameters in a file in the spool directory. If the file does not
522exist, we generate them. This means that it is easy to cause a regeneration.
523
524The new file is written as a temporary file and renamed, so that an incomplete
525file is never present. If two processes both compute some new parameters, you
526waste a bit of effort, but it doesn't seem worth messing around with locking to
527prevent this.
528
059ec3d9
PH
529Returns: OK/DEFER/FAIL
530*/
531
532static int
cf0c6164 533init_server_dh(uschar ** errstr)
059ec3d9 534{
17c76198
PP
535int fd, rc;
536unsigned int dh_bits;
27f19eb4 537gnutls_datum_t m;
a799883d
PP
538uschar filename_buf[PATH_MAX];
539uschar *filename = NULL;
17c76198 540size_t sz;
a799883d
PP
541uschar *exp_tls_dhparam;
542BOOL use_file_in_spool = FALSE;
543BOOL use_fixed_file = FALSE;
17c76198 544host_item *host = NULL; /* dummy for macros */
059ec3d9 545
17c76198 546DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 547
17c76198 548rc = gnutls_dh_params_init(&dh_server_params);
47195144 549exim_gnutls_err_check(rc, US"gnutls_dh_params_init");
059ec3d9 550
a799883d
PP
551m.data = NULL;
552m.size = 0;
553
cf0c6164 554if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
a799883d
PP
555 return DEFER;
556
557if (!exp_tls_dhparam)
558 {
559 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
560 m.data = US std_dh_prime_default();
561 m.size = Ustrlen(m.data);
562 }
563else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
564 use_file_in_spool = TRUE;
565else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
566 {
567 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
568 return OK;
569 }
570else if (exp_tls_dhparam[0] != '/')
571 {
f5d25c2b 572 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
48224640 573 return tls_error(US"No standard prime named", exp_tls_dhparam, NULL, errstr);
a799883d
PP
574 m.size = Ustrlen(m.data);
575 }
576else
577 {
578 use_fixed_file = TRUE;
579 filename = exp_tls_dhparam;
580 }
581
582if (m.data)
583 {
584 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
47195144 585 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
a799883d
PP
586 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
587 return OK;
588 }
589
af3498d6
PP
590#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
591/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
592different filename and ensure we have sufficient bits. */
593dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
594if (!dh_bits)
cf0c6164 595 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
af3498d6 596DEBUG(D_tls)
b34fc30c 597 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
598 dh_bits);
599#else
600dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
601DEBUG(D_tls)
602 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
603 dh_bits);
604#endif
059ec3d9 605
3375e053
PP
606/* Some clients have hard-coded limits. */
607if (dh_bits > tls_dh_max_bits)
608 {
609 DEBUG(D_tls)
610 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
611 tls_dh_max_bits);
612 dh_bits = tls_dh_max_bits;
613 }
614
a799883d
PP
615if (use_file_in_spool)
616 {
617 if (!string_format(filename_buf, sizeof(filename_buf),
618 "%s/gnutls-params-%d", spool_directory, dh_bits))
cf0c6164 619 return tls_error(US"overlong filename", NULL, NULL, errstr);
a799883d
PP
620 filename = filename_buf;
621 }
059ec3d9 622
b5aea5e1 623/* Open the cache file for reading and if successful, read it and set up the
575643cd 624parameters. */
059ec3d9 625
f5d25c2b 626if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
059ec3d9 627 {
b5aea5e1 628 struct stat statbuf;
17c76198
PP
629 FILE *fp;
630 int saved_errno;
631
632 if (fstat(fd, &statbuf) < 0) /* EIO */
633 {
634 saved_errno = errno;
635 (void)close(fd);
48224640 636 return tls_error(US"TLS cache stat failed", US strerror(saved_errno), NULL, errstr);
17c76198
PP
637 }
638 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
639 {
640 (void)close(fd);
cf0c6164 641 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
17c76198 642 }
40c90bca 643 if (!(fp = fdopen(fd, "rb")))
17c76198
PP
644 {
645 saved_errno = errno;
646 (void)close(fd);
647 return tls_error(US"fdopen(TLS cache stat fd) failed",
48224640 648 US strerror(saved_errno), NULL, errstr);
b5aea5e1 649 }
059ec3d9 650
b5aea5e1 651 m.size = statbuf.st_size;
40c90bca 652 if (!(m.data = malloc(m.size)))
17c76198
PP
653 {
654 fclose(fp);
48224640 655 return tls_error(US"malloc failed", US strerror(errno), NULL, errstr);
17c76198 656 }
40c90bca 657 if (!(sz = fread(m.data, m.size, 1, fp)))
17c76198
PP
658 {
659 saved_errno = errno;
660 fclose(fp);
661 free(m.data);
48224640 662 return tls_error(US"fread failed", US strerror(saved_errno), NULL, errstr);
17c76198
PP
663 }
664 fclose(fp);
b5aea5e1 665
17c76198 666 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 667 free(m.data);
47195144 668 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
17c76198 669 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
670 }
671
672/* If the file does not exist, fall through to compute new data and cache it.
673If there was any other opening error, it is serious. */
674
182ad5cf
PH
675else if (errno == ENOENT)
676 {
17c76198 677 rc = -1;
182ad5cf 678 DEBUG(D_tls)
17c76198 679 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
680 }
681else
17c76198 682 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
cf0c6164 683 NULL, NULL, errstr);
b5aea5e1
PH
684
685/* If ret < 0, either the cache file does not exist, or the data it contains
686is not useful. One particular case of this is when upgrading from an older
687release of Exim in which the data was stored in a different format. We don't
688try to be clever and support both formats; we just regenerate new data in this
689case. */
690
17c76198 691if (rc < 0)
b5aea5e1 692 {
17c76198 693 uschar *temp_fn;
201f5254 694 unsigned int dh_bits_gen = dh_bits;
059ec3d9 695
17c76198
PP
696 if ((PATH_MAX - Ustrlen(filename)) < 10)
697 return tls_error(US"Filename too long to generate replacement",
48224640 698 filename, NULL, errstr);
059ec3d9 699
48224640 700 temp_fn = string_copy(US"%s.XXXXXXX");
f5d25c2b 701 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
48224640 702 return tls_error(US"Unable to open temp file", US strerror(errno), NULL, errstr);
059ec3d9
PH
703 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
704
201f5254
PP
705 /* GnuTLS overshoots!
706 * If we ask for 2236, we might get 2237 or more.
707 * But there's no way to ask GnuTLS how many bits there really are.
708 * We can ask how many bits were used in a TLS session, but that's it!
709 * The prime itself is hidden behind too much abstraction.
710 * So we ask for less, and proceed on a wing and a prayer.
711 * First attempt, subtracted 3 for 2233 and got 2240.
712 */
cae6e576 713 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
714 {
715 dh_bits_gen = dh_bits - 10;
716 DEBUG(D_tls)
717 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
718 dh_bits_gen);
719 }
720
721 DEBUG(D_tls)
722 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
723 dh_bits_gen);
724 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
47195144 725 exim_gnutls_err_check(rc, US"gnutls_dh_params_generate2");
17c76198
PP
726
727 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
728 and I confirmed that a NULL call to get the size first is how the GnuTLS
729 sample apps handle this. */
730
731 sz = 0;
732 m.data = NULL;
733 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
734 m.data, &sz);
735 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
47195144 736 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3(NULL) sizing");
17c76198 737 m.size = sz;
40c90bca 738 if (!(m.data = malloc(m.size)))
48224640 739 return tls_error(US"memory allocation failed", US strerror(errno), NULL, errstr);
40c90bca 740
1f00591e 741 /* this will return a size 1 less than the allocation size above */
17c76198 742 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 743 m.data, &sz);
17c76198
PP
744 if (rc != GNUTLS_E_SUCCESS)
745 {
746 free(m.data);
47195144 747 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3() real");
17c76198 748 }
1f00591e 749 m.size = sz; /* shrink by 1, probably */
059ec3d9 750
f5d25c2b 751 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
17c76198
PP
752 {
753 free(m.data);
754 return tls_error(US"TLS cache write D-H params failed",
48224640 755 US strerror(errno), NULL, errstr);
17c76198 756 }
b5aea5e1 757 free(m.data);
f5d25c2b 758 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
17c76198 759 return tls_error(US"TLS cache write D-H params final newline failed",
48224640 760 US strerror(errno), NULL, errstr);
17c76198 761
f5d25c2b 762 if ((rc = close(fd)))
48224640 763 return tls_error(US"TLS cache write close() failed", US strerror(errno), NULL, errstr);
059ec3d9 764
17c76198
PP
765 if (Urename(temp_fn, filename) < 0)
766 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
48224640 767 temp_fn, filename), US strerror(errno), NULL, errstr);
059ec3d9 768
17c76198 769 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
770 }
771
17c76198 772DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
773return OK;
774}
775
776
777
778
23bb6982
JH
779/* Create and install a selfsigned certificate, for use in server mode */
780
781static int
cf0c6164 782tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
23bb6982
JH
783{
784gnutls_x509_crt_t cert = NULL;
785time_t now;
786gnutls_x509_privkey_t pkey = NULL;
787const uschar * where;
788int rc;
789
790where = US"initialising pkey";
791if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
792
793where = US"initialising cert";
794if ((rc = gnutls_x509_crt_init(&cert))) goto err;
795
796where = US"generating pkey";
797if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
76075bb5 798#ifdef SUPPORT_PARAM_TO_PK_BITS
4312da48
JH
799# ifndef GNUTLS_SEC_PARAM_MEDIUM
800# define GNUTLS_SEC_PARAM_MEDIUM GNUTLS_SEC_PARAM_HIGH
801# endif
6aac3239 802 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_MEDIUM),
76075bb5 803#else
6aac3239 804 2048,
76075bb5
JH
805#endif
806 0)))
23bb6982
JH
807 goto err;
808
809where = US"configuring cert";
1613fd68 810now = 1;
23bb6982
JH
811if ( (rc = gnutls_x509_crt_set_version(cert, 3))
812 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
813 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
814 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
815 || (rc = gnutls_x509_crt_set_key(cert, pkey))
816
817 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
818 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
819 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
820 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
821 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
822 GNUTLS_OID_X520_COMMON_NAME, 0,
823 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
824 )
825 goto err;
826
827where = US"signing cert";
828if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
829
830where = US"installing selfsign cert";
831 /* Since: 2.4.0 */
832if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
833 goto err;
834
835rc = OK;
836
837out:
838 if (cert) gnutls_x509_crt_deinit(cert);
839 if (pkey) gnutls_x509_privkey_deinit(pkey);
840 return rc;
841
842err:
48224640 843 rc = tls_error(where, US gnutls_strerror(rc), NULL, errstr);
23bb6982
JH
844 goto out;
845}
846
847
848
849
47195144
JH
850/* Add certificate and key, from files.
851
852Return:
853 Zero or negative: good. Negate value for certificate index if < 0.
854 Greater than zero: FAIL or DEFER code.
855*/
856
ba86e143
JH
857static int
858tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
859 uschar * certfile, uschar * keyfile, uschar ** errstr)
860{
861int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
862 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
47195144
JH
863if (rc < 0)
864 return tls_error(
865 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
48224640 866 US gnutls_strerror(rc), host, errstr);
47195144 867return -rc;
ba86e143
JH
868}
869
870
059ec3d9 871/*************************************************
17c76198 872* Variables re-expanded post-SNI *
059ec3d9
PH
873*************************************************/
874
17c76198
PP
875/* Called from both server and client code, via tls_init(), and also from
876the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
877
878We can tell the two apart by state->received_sni being non-NULL in callback.
879
880The callback should not call us unless state->trigger_sni_changes is true,
881which we are responsible for setting on the first pass through.
059ec3d9
PH
882
883Arguments:
17c76198 884 state exim_gnutls_state_st *
cf0c6164 885 errstr error string pointer
059ec3d9
PH
886
887Returns: OK/DEFER/FAIL
888*/
889
890static int
ba86e143 891tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
059ec3d9 892{
1365611d 893struct stat statbuf;
059ec3d9 894int rc;
17c76198
PP
895const host_item *host = state->host; /* macro should be reconsidered? */
896uschar *saved_tls_certificate = NULL;
897uschar *saved_tls_privatekey = NULL;
898uschar *saved_tls_verify_certificates = NULL;
899uschar *saved_tls_crl = NULL;
900int cert_count;
901
902/* We check for tls_sni *before* expansion. */
2b4a568d 903if (!host) /* server */
17c76198
PP
904 if (!state->received_sni)
905 {
ba86e143
JH
906 if ( state->tls_certificate
907 && ( Ustrstr(state->tls_certificate, US"tls_sni")
908 || Ustrstr(state->tls_certificate, US"tls_in_sni")
909 || Ustrstr(state->tls_certificate, US"tls_out_sni")
910 ) )
17c76198
PP
911 {
912 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
913 state->trigger_sni_changes = TRUE;
914 }
915 }
916 else
917 {
1365611d 918 /* useful for debugging */
17c76198
PP
919 saved_tls_certificate = state->exp_tls_certificate;
920 saved_tls_privatekey = state->exp_tls_privatekey;
921 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
922 saved_tls_crl = state->exp_tls_crl;
923 }
059ec3d9 924
1365611d 925rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
47195144
JH
926exim_gnutls_err_check(rc, US"gnutls_certificate_allocate_credentials");
927
928#ifdef SUPPORT_SRV_OCSP_STACK
929gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
930#endif
1365611d 931
17c76198
PP
932/* remember: expand_check_tlsvar() is expand_check() but fiddling with
933state members, assuming consistent naming; and expand_check() returns
934false if expansion failed, unless expansion was forced to fail. */
059ec3d9 935
17c76198
PP
936/* check if we at least have a certificate, before doing expensive
937D-H generation. */
059ec3d9 938
cf0c6164 939if (!expand_check_tlsvar(tls_certificate, errstr))
17c76198 940 return DEFER;
059ec3d9 941
17c76198 942/* certificate is mandatory in server, optional in client */
059ec3d9 943
23bb6982
JH
944if ( !state->exp_tls_certificate
945 || !*state->exp_tls_certificate
946 )
2b4a568d 947 if (!host)
cf0c6164 948 return tls_install_selfsign(state, errstr);
17c76198
PP
949 else
950 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
059ec3d9 951
cf0c6164 952if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
059ec3d9
PH
953 return DEFER;
954
17c76198
PP
955/* tls_privatekey is optional, defaulting to same file as certificate */
956
957if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 958 {
17c76198
PP
959 state->tls_privatekey = state->tls_certificate;
960 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 961 }
c91535f3 962
059ec3d9 963
17c76198 964if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
965 {
966 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
967 state->exp_tls_certificate, state->exp_tls_privatekey);
968
969 if (state->received_sni)
23bb6982
JH
970 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
971 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
972 )
17c76198 973 {
b34fc30c 974 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
975 }
976 else
977 {
b34fc30c 978 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 979 }
059ec3d9 980
ba86e143
JH
981 if (!host) /* server */
982 {
983 const uschar * clist = state->exp_tls_certificate;
984 const uschar * klist = state->exp_tls_privatekey;
47195144
JH
985 const uschar * olist;
986 int csep = 0, ksep = 0, osep = 0, cnt = 0;
987 uschar * cfile, * kfile, * ofile;
988
989#ifndef DISABLE_OCSP
990 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
991 return DEFER;
992 olist = ofile;
993#endif
ba86e143
JH
994
995 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
47195144 996
ba86e143
JH
997 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
998 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
47195144 999 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
ba86e143
JH
1000 return rc;
1001 else
47195144
JH
1002 {
1003 int gnutls_cert_index = -rc;
ba86e143 1004 DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile);
47195144
JH
1005
1006 /* Set the OCSP stapling server info */
1007
1008#ifndef DISABLE_OCSP
1009 if (tls_ocsp_file)
1010 if (gnutls_buggy_ocsp)
1011 {
1012 DEBUG(D_tls)
1013 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
1014 }
1015 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1016 {
1017 /* Use the full callback method for stapling just to get
1018 observability. More efficient would be to read the file once only,
1019 if it never changed (due to SNI). Would need restart on file update,
1020 or watch datestamp. */
1021
1022# ifdef SUPPORT_SRV_OCSP_STACK
1023 rc = gnutls_certificate_set_ocsp_status_request_function2(
1024 state->x509_cred, gnutls_cert_index,
1025 server_ocsp_stapling_cb, ofile);
1026
1027 exim_gnutls_err_check(rc,
1028 US"gnutls_certificate_set_ocsp_status_request_function2");
1029# else
1030 if (cnt++ > 0)
1031 {
1032 DEBUG(D_tls)
1033 debug_printf("oops; multiple OCSP files not supported\n");
1034 break;
1035 }
1036 gnutls_certificate_set_ocsp_status_request_function(
1037 state->x509_cred, server_ocsp_stapling_cb, ofile);
1038# endif
1039
1040 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile);
1041 }
1042 else
1043 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1044#endif
1045 }
ba86e143
JH
1046 }
1047 else
1048 {
47195144 1049 if (0 < (rc = tls_add_certfile(state, host,
ba86e143
JH
1050 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1051 return rc;
1052 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1053 }
1054
b34fc30c 1055 } /* tls_certificate */
059ec3d9 1056
2b4a568d 1057
059ec3d9
PH
1058/* Set the trusted CAs file if one is provided, and then add the CRL if one is
1059provided. Experiment shows that, if the certificate file is empty, an unhelpful
1060error message is provided. However, if we just refrain from setting anything up
1061in that case, certificate verification fails, which seems to be the correct
1062behaviour. */
1063
610ff438 1064if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 1065 {
cf0c6164 1066 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
059ec3d9 1067 return DEFER;
610ff438
JH
1068#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1069 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1070 state->exp_tls_verify_certificates = NULL;
1071#endif
17c76198 1072 if (state->tls_crl && *state->tls_crl)
cf0c6164 1073 if (!expand_check_tlsvar(tls_crl, errstr))
17c76198 1074 return DEFER;
059ec3d9 1075
1365611d
PP
1076 if (!(state->exp_tls_verify_certificates &&
1077 *state->exp_tls_verify_certificates))
b34fc30c
PP
1078 {
1079 DEBUG(D_tls)
1365611d
PP
1080 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1081 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 1082 return OK;
b34fc30c 1083 }
1365611d 1084 }
83e2f8a2
PP
1085else
1086 {
1087 DEBUG(D_tls)
1088 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1089 return OK;
1090 }
17c76198 1091
cb1d7830
JH
1092#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1093if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1094 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1095else
1096#endif
1365611d 1097 {
cb1d7830
JH
1098 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1099 {
1100 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1101 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1102 strerror(errno));
1103 return DEFER;
1104 }
17c76198 1105
a7fec7a7 1106#ifndef SUPPORT_CA_DIR
cb1d7830
JH
1107 /* The test suite passes in /dev/null; we could check for that path explicitly,
1108 but who knows if someone has some weird FIFO which always dumps some certs, or
1109 other weirdness. The thing we really want to check is that it's not a
1110 directory, since while OpenSSL supports that, GnuTLS does not.
60f914bc 1111 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
cb1d7830
JH
1112 if (S_ISDIR(statbuf.st_mode))
1113 {
1114 DEBUG(D_tls)
1115 debug_printf("verify certificates path is a dir: \"%s\"\n",
1116 state->exp_tls_verify_certificates);
1117 log_write(0, LOG_MAIN|LOG_PANIC,
1118 "tls_verify_certificates \"%s\" is a directory",
1119 state->exp_tls_verify_certificates);
1120 return DEFER;
1121 }
a7fec7a7 1122#endif
059ec3d9 1123
cb1d7830
JH
1124 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1125 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 1126
cb1d7830
JH
1127 if (statbuf.st_size == 0)
1128 {
1129 DEBUG(D_tls)
1130 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1131 return OK;
1132 }
059ec3d9 1133
cb1d7830 1134 cert_count =
a7fec7a7
JH
1135
1136#ifdef SUPPORT_CA_DIR
cb1d7830
JH
1137 (statbuf.st_mode & S_IFMT) == S_IFDIR
1138 ?
1139 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1140 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1141 :
a7fec7a7 1142#endif
cb1d7830
JH
1143 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1144 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1145 }
a7fec7a7 1146
1365611d
PP
1147if (cert_count < 0)
1148 {
1149 rc = cert_count;
47195144 1150 exim_gnutls_err_check(rc, US"setting certificate trust");
1365611d
PP
1151 }
1152DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 1153
5c8cda3a
PP
1154if (state->tls_crl && *state->tls_crl &&
1155 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 1156 {
5c8cda3a
PP
1157 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1158 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1159 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1160 if (cert_count < 0)
1365611d 1161 {
5c8cda3a 1162 rc = cert_count;
47195144 1163 exim_gnutls_err_check(rc, US"gnutls_certificate_set_x509_crl_file");
1365611d 1164 }
5c8cda3a 1165 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 1166 }
059ec3d9 1167
059ec3d9
PH
1168return OK;
1169}
1170
1171
1172
1173
1174/*************************************************
1365611d
PP
1175* Set X.509 state variables *
1176*************************************************/
1177
1178/* In GnuTLS, the registered cert/key are not replaced by a later
1179set of a cert/key, so for SNI support we need a whole new x509_cred
1180structure. Which means various other non-re-expanded pieces of state
1181need to be re-set in the new struct, so the setting logic is pulled
1182out to this.
1183
1184Arguments:
1185 state exim_gnutls_state_st *
cf0c6164 1186 errstr error string pointer
1365611d
PP
1187
1188Returns: OK/DEFER/FAIL
1189*/
1190
1191static int
cf0c6164 1192tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1365611d
PP
1193{
1194int rc;
1195const host_item *host = state->host; /* macro should be reconsidered? */
1196
1197/* Create D-H parameters, or read them from the cache file. This function does
1198its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1199client-side params. */
1200
1201if (!state->host)
1202 {
1203 if (!dh_server_params)
1204 {
cf0c6164 1205 rc = init_server_dh(errstr);
1365611d
PP
1206 if (rc != OK) return rc;
1207 }
1208 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1209 }
1210
1211/* Link the credentials to the session. */
1212
1213rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
47195144 1214exim_gnutls_err_check(rc, US"gnutls_credentials_set");
1365611d
PP
1215
1216return OK;
1217}
1218
1219/*************************************************
17c76198 1220* Initialize for GnuTLS *
059ec3d9
PH
1221*************************************************/
1222
9196d5bf 1223
4fb7df6d
JH
1224#ifndef DISABLE_OCSP
1225
9196d5bf
JH
1226static BOOL
1227tls_is_buggy_ocsp(void)
1228{
1229const uschar * s;
1230uschar maj, mid, mic;
1231
1232s = CUS gnutls_check_version(NULL);
1233maj = atoi(CCS s);
1234if (maj == 3)
1235 {
1236 while (*s && *s != '.') s++;
1237 mid = atoi(CCS ++s);
1238 if (mid <= 2)
1239 return TRUE;
1240 else if (mid >= 5)
1241 return FALSE;
1242 else
1243 {
1244 while (*s && *s != '.') s++;
1245 mic = atoi(CCS ++s);
1246 return mic <= (mid == 3 ? 16 : 3);
1247 }
1248 }
1249return FALSE;
1250}
1251
4fb7df6d 1252#endif
9196d5bf
JH
1253
1254
17c76198
PP
1255/* Called from both server and client code. In the case of a server, errors
1256before actual TLS negotiation return DEFER.
059ec3d9
PH
1257
1258Arguments:
17c76198
PP
1259 host connected host, if client; NULL if server
1260 certificate certificate file
1261 privatekey private key file
1262 sni TLS SNI to send, sometimes when client; else NULL
1263 cas CA certs file
1264 crl CRL file
1265 require_ciphers tls_require_ciphers setting
817d9f57 1266 caller_state returned state-info structure
cf0c6164 1267 errstr error string pointer
059ec3d9 1268
17c76198 1269Returns: OK/DEFER/FAIL
059ec3d9
PH
1270*/
1271
17c76198
PP
1272static int
1273tls_init(
1274 const host_item *host,
1275 const uschar *certificate,
1276 const uschar *privatekey,
1277 const uschar *sni,
1278 const uschar *cas,
1279 const uschar *crl,
1280 const uschar *require_ciphers,
cf0c6164 1281 exim_gnutls_state_st **caller_state,
74f1a423 1282 tls_support * tlsp,
cf0c6164 1283 uschar ** errstr)
059ec3d9 1284{
00c0dd4e 1285exim_gnutls_state_st * state;
17c76198
PP
1286int rc;
1287size_t sz;
00c0dd4e
JH
1288const char * errpos;
1289const uschar * p;
17c76198
PP
1290
1291if (!exim_gnutls_base_init_done)
059ec3d9 1292 {
17c76198
PP
1293 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1294
a5f239e4
PP
1295#ifdef HAVE_GNUTLS_PKCS11
1296 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1297 which loads modules from a config file, which sounds good and may be wanted
1298 by some sysadmin, but also means in common configurations that GNOME keyring
1299 environment variables are used and so breaks for users calling mailq.
1300 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1301 if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
1302 {
1303 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
47195144 1304 exim_gnutls_err_check(rc, US"gnutls_pkcs11_init");
a5f239e4
PP
1305 }
1306#endif
1307
17c76198 1308 rc = gnutls_global_init();
47195144 1309 exim_gnutls_err_check(rc, US"gnutls_global_init");
17c76198
PP
1310
1311#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1312 DEBUG(D_tls)
059ec3d9 1313 {
17c76198 1314 gnutls_global_set_log_function(exim_gnutls_logger_cb);
aded2255 1315 /* arbitrarily chosen level; bump up to 9 for more */
17c76198 1316 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1317 }
17c76198
PP
1318#endif
1319
4fb7df6d
JH
1320#ifndef DISABLE_OCSP
1321 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
9196d5bf 1322 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
4fb7df6d 1323#endif
9196d5bf 1324
17c76198 1325 exim_gnutls_base_init_done = TRUE;
059ec3d9 1326 }
059ec3d9 1327
17c76198
PP
1328if (host)
1329 {
74f1a423
JH
1330 /* For client-side sessions we allocate a context. This lets us run
1331 several in parallel. */
1332 int old_pool = store_pool;
1333 store_pool = POOL_PERM;
1334 state = store_get(sizeof(exim_gnutls_state_st));
1335 store_pool = old_pool;
1336
17c76198 1337 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1338 state->tlsp = tlsp;
17c76198
PP
1339 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1340 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1341 }
1342else
1343 {
1344 state = &state_server;
1345 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
74f1a423 1346 state->tlsp = tlsp;
17c76198
PP
1347 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1348 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1349 }
47195144 1350exim_gnutls_err_check(rc, US"gnutls_init");
059ec3d9 1351
17c76198 1352state->host = host;
059ec3d9 1353
17c76198
PP
1354state->tls_certificate = certificate;
1355state->tls_privatekey = privatekey;
5779e6aa 1356state->tls_require_ciphers = require_ciphers;
17c76198
PP
1357state->tls_sni = sni;
1358state->tls_verify_certificates = cas;
1359state->tls_crl = crl;
059ec3d9 1360
17c76198
PP
1361/* This handles the variables that might get re-expanded after TLS SNI;
1362that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1363
17c76198
PP
1364DEBUG(D_tls)
1365 debug_printf("Expanding various TLS configuration options for session credentials.\n");
cf0c6164 1366if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
059ec3d9 1367
1365611d
PP
1368/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1369requires a new structure afterwards. */
83da1223 1370
cf0c6164 1371if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
83da1223 1372
17c76198
PP
1373/* set SNI in client, only */
1374if (host)
1375 {
cf0c6164 1376 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
17c76198 1377 return DEFER;
0df4ab80 1378 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1379 {
1380 DEBUG(D_tls)
0df4ab80
JH
1381 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1382 sz = Ustrlen(state->tlsp->sni);
17c76198 1383 rc = gnutls_server_name_set(state->session,
0df4ab80 1384 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
47195144 1385 exim_gnutls_err_check(rc, US"gnutls_server_name_set");
17c76198
PP
1386 }
1387 }
1388else if (state->tls_sni)
1389 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
ba86e143 1390 "have an SNI set for a server [%s]\n", state->tls_sni);
83da1223 1391
17c76198 1392/* This is the priority string support,
42bfef1e 1393http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1394and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1395This was backwards incompatible, but means Exim no longer needs to track
1396all algorithms and provide string forms for them. */
83da1223 1397
fc243e94 1398p = NULL;
17c76198 1399if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1400 {
cf0c6164 1401 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
17c76198
PP
1402 return DEFER;
1403 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1404 {
17c76198 1405 p = state->exp_tls_require_ciphers;
fc243e94 1406 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n", p);
83da1223
PH
1407 }
1408 }
fc243e94 1409if (!p)
17c76198 1410 {
fc243e94 1411 p = exim_default_gnutls_priority;
83e2f8a2 1412 DEBUG(D_tls)
fc243e94 1413 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n", p);
17c76198 1414 }
fc243e94 1415rc = gnutls_priority_init(&state->priority_cache, CCS p, &errpos);
83da1223 1416
47195144 1417exim_gnutls_err_check(rc, string_sprintf(
17c76198
PP
1418 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1419 p, errpos - CS p, errpos));
1420
1421rc = gnutls_priority_set(state->session, state->priority_cache);
47195144 1422exim_gnutls_err_check(rc, US"gnutls_priority_set");
17c76198
PP
1423
1424gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1425
1426/* Reduce security in favour of increased compatibility, if the admin
1427decides to make that trade-off. */
1428if (gnutls_compat_mode)
83da1223 1429 {
17c76198
PP
1430#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1431 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1432 gnutls_session_enable_compatibility_mode(state->session);
1433#else
1434 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1435#endif
83da1223
PH
1436 }
1437
17c76198 1438*caller_state = state;
17c76198 1439return OK;
83da1223
PH
1440}
1441
1442
1443
83da1223 1444/*************************************************
17c76198 1445* Extract peer information *
059ec3d9
PH
1446*************************************************/
1447
f1be21cf
JH
1448static const uschar *
1449cipher_stdname_kcm(gnutls_kx_algorithm_t kx, gnutls_cipher_algorithm_t cipher,
1450 gnutls_mac_algorithm_t mac)
1451{
1452uschar cs_id[2];
1453gnutls_kx_algorithm_t kx_i;
1454gnutls_cipher_algorithm_t cipher_i;
1455gnutls_mac_algorithm_t mac_i;
1456
1457for (size_t i = 0;
1458 gnutls_cipher_suite_info(i, cs_id, &kx_i, &cipher_i, &mac_i, NULL);
1459 i++)
1460 if (kx_i == kx && cipher_i == cipher && mac_i == mac)
1461 return cipher_stdname(cs_id[0], cs_id[1]);
1462return NULL;
1463}
1464
1465
1466
17c76198 1467/* Called from both server and client code.
4fe99a6c
PP
1468Only this is allowed to set state->peerdn and state->have_set_peerdn
1469and we use that to detect double-calls.
059ec3d9 1470
75fe387d
PP
1471NOTE: the state blocks last while the TLS connection is up, which is fine
1472for logging in the server side, but for the client side, we log after teardown
1473in src/deliver.c. While the session is up, we can twist about states and
1474repoint tls_* globals, but those variables used for logging or other variable
1475expansion that happens _after_ delivery need to have a longer life-time.
1476
1477So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1478doing this more than once per generation of a state context. We set them in
1479the state context, and repoint tls_* to them. After the state goes away, the
1480tls_* copies of the pointers remain valid and client delivery logging is happy.
1481
1482tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1483don't apply.
1484
059ec3d9 1485Arguments:
17c76198 1486 state exim_gnutls_state_st *
cf0c6164 1487 errstr pointer to error string
059ec3d9 1488
17c76198 1489Returns: OK/DEFER/FAIL
059ec3d9
PH
1490*/
1491
17c76198 1492static int
cf0c6164 1493peer_status(exim_gnutls_state_st *state, uschar ** errstr)
059ec3d9 1494{
27f19eb4 1495const gnutls_datum_t *cert_list;
75fe387d 1496int old_pool, rc;
17c76198 1497unsigned int cert_list_size = 0;
4fe99a6c
PP
1498gnutls_protocol_t protocol;
1499gnutls_cipher_algorithm_t cipher;
1500gnutls_kx_algorithm_t kx;
1501gnutls_mac_algorithm_t mac;
17c76198
PP
1502gnutls_certificate_type_t ct;
1503gnutls_x509_crt_t crt;
d7978c0f 1504uschar *dn_buf;
17c76198 1505size_t sz;
059ec3d9 1506
4fe99a6c 1507if (state->have_set_peerdn)
17c76198 1508 return OK;
4fe99a6c 1509state->have_set_peerdn = TRUE;
059ec3d9 1510
4fe99a6c 1511state->peerdn = NULL;
059ec3d9 1512
4fe99a6c
PP
1513/* tls_cipher */
1514cipher = gnutls_cipher_get(state->session);
1515protocol = gnutls_protocol_get_version(state->session);
1516mac = gnutls_mac_get(state->session);
1517kx = gnutls_kx_get(state->session);
1518
75fe387d 1519old_pool = store_pool;
f1be21cf
JH
1520 {
1521 store_pool = POOL_PERM;
1522 state->ciphersuite = string_sprintf("%s:%s:%d",
1523 gnutls_protocol_get_name(protocol),
1524 gnutls_cipher_suite_get_name(kx, cipher, mac),
1525 (int) gnutls_cipher_get_key_size(cipher) * 8);
1526
1527 /* I don't see a way that spaces could occur, in the current GnuTLS
1528 code base, but it was a concern in the old code and perhaps older GnuTLS
1529 releases did return "TLS 1.0"; play it safe, just in case. */
1530
1531 for (uschar * p = state->ciphersuite; *p; p++) if (isspace(*p)) *p = '-';
1532 state->tlsp->cipher = state->ciphersuite;
1533
1534 state->tlsp->cipher_stdname = cipher_stdname_kcm(kx, cipher, mac);
1535 }
75fe387d 1536store_pool = old_pool;
4fe99a6c
PP
1537
1538/* tls_peerdn */
17c76198 1539cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1540
f1be21cf 1541if (!cert_list || cert_list_size == 0)
17c76198 1542 {
17c76198
PP
1543 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1544 cert_list, cert_list_size);
e51c7be2 1545 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1546 return tls_error(US"certificate verification failed",
48224640 1547 US"no certificate received from peer", state->host, errstr);
17c76198
PP
1548 return OK;
1549 }
059ec3d9 1550
95f52235 1551if ((ct = gnutls_certificate_type_get(state->session)) != GNUTLS_CRT_X509)
059ec3d9 1552 {
95f52235 1553 const uschar * ctn = US gnutls_certificate_type_get_name(ct);
17c76198
PP
1554 DEBUG(D_tls)
1555 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1556 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1557 return tls_error(US"certificate verification not possible, unhandled type",
cf0c6164 1558 ctn, state->host, errstr);
17c76198 1559 return OK;
83da1223 1560 }
059ec3d9 1561
e51c7be2
JH
1562#define exim_gnutls_peer_err(Label) \
1563 do { \
1564 if (rc != GNUTLS_E_SUCCESS) \
1565 { \
1566 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1567 (Label), gnutls_strerror(rc)); \
1568 if (state->verify_requirement >= VERIFY_REQUIRED) \
48224640 1569 return tls_error((Label), US gnutls_strerror(rc), state->host, errstr); \
e51c7be2
JH
1570 return OK; \
1571 } \
1572 } while (0)
17c76198 1573
9d1c15ef
JH
1574rc = import_cert(&cert_list[0], &crt);
1575exim_gnutls_peer_err(US"cert 0");
1576
1577state->tlsp->peercert = state->peercert = crt;
17c76198 1578
17c76198
PP
1579sz = 0;
1580rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1581if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1582 {
17c76198
PP
1583 exim_gnutls_peer_err(US"getting size for cert DN failed");
1584 return FAIL; /* should not happen */
059ec3d9 1585 }
17c76198
PP
1586dn_buf = store_get_perm(sz);
1587rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1588exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1589
17c76198
PP
1590state->peerdn = dn_buf;
1591
1592return OK;
1593#undef exim_gnutls_peer_err
1594}
059ec3d9 1595
059ec3d9 1596
059ec3d9 1597
059ec3d9 1598
17c76198
PP
1599/*************************************************
1600* Verify peer certificate *
1601*************************************************/
059ec3d9 1602
17c76198
PP
1603/* Called from both server and client code.
1604*Should* be using a callback registered with
1605gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1606the peer information, but that's too new for some OSes.
059ec3d9 1607
17c76198 1608Arguments:
899b8bbc
JH
1609 state exim_gnutls_state_st *
1610 errstr where to put an error message
059ec3d9 1611
17c76198
PP
1612Returns:
1613 FALSE if the session should be rejected
1614 TRUE if the cert is okay or we just don't care
1615*/
059ec3d9 1616
17c76198 1617static BOOL
28646fa9 1618verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
17c76198
PP
1619{
1620int rc;
899b8bbc
JH
1621uint verify;
1622
1623if (state->verify_requirement == VERIFY_NONE)
1624 return TRUE;
17c76198 1625
8008accd 1626DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");
cf0c6164 1627*errstr = NULL;
17c76198 1628
95f52235 1629if ((rc = peer_status(state, errstr)) != OK || !state->peerdn)
e6060e2c 1630 {
17c76198 1631 verify = GNUTLS_CERT_INVALID;
cf0c6164 1632 *errstr = US"certificate not supplied";
17c76198
PP
1633 }
1634else
899b8bbc
JH
1635
1636 {
1637#ifdef SUPPORT_DANE
1638 if (state->verify_requirement == VERIFY_DANE && state->host)
1639 {
1640 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1641 including talking to a DNS resolver. But we want to do that bit ourselves
1642 as the testsuite intercepts and fakes its own DNS environment. */
1643
1644 dane_state_t s;
1645 dane_query_t r;
899b8bbc 1646 uint lsize;
94c13285
JH
1647 const gnutls_datum_t * certlist =
1648 gnutls_certificate_get_peers(state->session, &lsize);
1649 int usage = tls_out.tlsa_usage;
1650
1651# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1652 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1653 dane-verification separately so that we know which selector verified;
570cb1bd 1654 then we know whether to do name-verification (needed for TA but not EE). */
94c13285
JH
1655
1656 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
bd5b3f3c 1657 { /* a mixed-usage bundle */
94c13285
JH
1658 int i, j, nrec;
1659 const char ** dd;
1660 int * ddl;
1661
1662 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1663 nrec++;
1664
1665 dd = store_get(nrec * sizeof(uschar *));
1666 ddl = store_get(nrec * sizeof(int));
1667 nrec--;
1668
1669 if ((rc = dane_state_init(&s, 0)))
1670 goto tlsa_prob;
1671
1672 for (usage = DANESSL_USAGE_DANE_EE;
1673 usage >= DANESSL_USAGE_DANE_TA; usage--)
1674 { /* take records with this usage */
1675 for (j = i = 0; i < nrec; i++)
1676 if (state->dane_data[i][0] == usage)
1677 {
1678 dd[j] = state->dane_data[i];
1679 ddl[j++] = state->dane_data_len[i];
1680 }
1681 if (j)
1682 {
1683 dd[j] = NULL;
1684 ddl[j] = 0;
1685
1686 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1687 goto tlsa_prob;
1688
1689 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1690 gnutls_certificate_type_get(state->session),
1691 r, 0,
1692 usage == DANESSL_USAGE_DANE_EE
1693 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1694 &verify)))
1695 {
1696 DEBUG(D_tls)
1697 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1698 }
1699 else if (verify == 0) /* verification passed */
1700 {
1701 usage = 1 << usage;
1702 break;
1703 }
1704 }
1705 }
899b8bbc 1706
94c13285
JH
1707 if (rc) goto tlsa_prob;
1708 }
1709 else
1710# endif
899b8bbc 1711 {
94c13285
JH
1712 if ( (rc = dane_state_init(&s, 0))
1713 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1714 1, 0))
1715 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1716 gnutls_certificate_type_get(state->session),
5ec37a55 1717 r, 0,
94c13285
JH
1718# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1719 usage == (1 << DANESSL_USAGE_DANE_EE)
1720 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1721# else
1722 0,
1723# endif
1724 &verify))
1725 )
1726 goto tlsa_prob;
899b8bbc 1727 }
94c13285
JH
1728
1729 if (verify != 0) /* verification failed */
899b8bbc
JH
1730 {
1731 gnutls_datum_t str;
1732 (void) dane_verification_status_print(verify, &str, 0);
1733 *errstr = US str.data; /* don't bother to free */
1734 goto badcert;
1735 }
28646fa9 1736
94c13285
JH
1737# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1738 /* If a TA-mode TLSA record was used for verification we must additionally
570cb1bd 1739 verify the cert name (but not the CA chain). For EE-mode, skip it. */
28646fa9 1740
94c13285
JH
1741 if (usage & (1 << DANESSL_USAGE_DANE_EE))
1742# endif
28646fa9 1743 {
570cb1bd 1744 state->peer_dane_verified = state->peer_cert_verified = TRUE;
28646fa9
JH
1745 goto goodcert;
1746 }
570cb1bd
JH
1747# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1748 /* Assume that the name on the A-record is the one that should be matching
1749 the cert. An alternate view is that the domain part of the email address
1750 is also permissible. */
1751
1752 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1753 CS state->host->name))
1754 {
1755 state->peer_dane_verified = state->peer_cert_verified = TRUE;
1756 goto goodcert;
1757 }
1758# endif
899b8bbc 1759 }
570cb1bd 1760#endif /*SUPPORT_DANE*/
899b8bbc 1761
17c76198 1762 rc = gnutls_certificate_verify_peers2(state->session, &verify);
899b8bbc 1763 }
e6060e2c 1764
899b8bbc 1765/* Handle the result of verification. INVALID is set if any others are. */
059ec3d9 1766
28646fa9 1767if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
17c76198
PP
1768 {
1769 state->peer_cert_verified = FALSE;
cf0c6164 1770 if (!*errstr)
184384c3
JH
1771 {
1772#ifdef GNUTLS_CERT_VFY_STATUS_PRINT
1773 DEBUG(D_tls)
1774 {
1775 gnutls_datum_t txt;
1776
1777 if (gnutls_certificate_verification_status_print(verify,
1778 gnutls_certificate_type_get(state->session), &txt, 0)
1779 == GNUTLS_E_SUCCESS)
1780 {
1781 debug_printf("%s\n", txt.data);
1782 gnutls_free(txt.data);
1783 }
1784 }
1785#endif
cf0c6164
JH
1786 *errstr = verify & GNUTLS_CERT_REVOKED
1787 ? US"certificate revoked" : US"certificate invalid";
184384c3 1788 }
059ec3d9 1789
17c76198 1790 DEBUG(D_tls)
e51c7be2 1791 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
cf0c6164 1792 *errstr, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1793
e51c7be2 1794 if (state->verify_requirement >= VERIFY_REQUIRED)
899b8bbc 1795 goto badcert;
17c76198 1796 DEBUG(D_tls)
4789da3a 1797 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 1798 }
e51c7be2 1799
17c76198
PP
1800else
1801 {
5fd28bb8
JH
1802 /* Client side, check the server's certificate name versus the name on the
1803 A-record for the connection we made. What to do for server side - what name
1804 to use for client? We document that there is no such checking for server
1805 side. */
1806
1807 if ( state->exp_tls_verify_cert_hostnames
1808 && !gnutls_x509_crt_check_hostname(state->tlsp->peercert,
1809 CS state->exp_tls_verify_cert_hostnames)
1810 )
e51c7be2 1811 {
5fd28bb8
JH
1812 DEBUG(D_tls)
1813 debug_printf("TLS certificate verification failed: cert name mismatch\n");
1814 if (state->verify_requirement >= VERIFY_REQUIRED)
1815 goto badcert;
1816 return TRUE;
e51c7be2 1817 }
5fd28bb8 1818
17c76198 1819 state->peer_cert_verified = TRUE;
e51c7be2 1820 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 1821 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1822 }
059ec3d9 1823
28646fa9
JH
1824goodcert:
1825 state->tlsp->peerdn = state->peerdn;
1826 return TRUE;
899b8bbc 1827
b83314e3 1828#ifdef SUPPORT_DANE
94c13285 1829tlsa_prob:
624f33df
JH
1830 *errstr = string_sprintf("TLSA record problem: %s",
1831 rc == DANE_E_REQUESTED_DATA_NOT_AVAILABLE ? "none usable" : dane_strerror(rc));
b83314e3
JH
1832#endif
1833
899b8bbc
JH
1834badcert:
1835 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1836 return FALSE;
17c76198 1837}
059ec3d9 1838
17c76198
PP
1839
1840
1841
1842/* ------------------------------------------------------------------------ */
1843/* Callbacks */
1844
1845/* Logging function which can be registered with
1846 * gnutls_global_set_log_function()
1847 * gnutls_global_set_log_level() 0..9
1848 */
af3498d6 1849#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1850static void
17c76198 1851exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1852{
8c79eebf
PP
1853 size_t len = strlen(message);
1854 if (len < 1)
1855 {
1856 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1857 return;
1858 }
1859 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1860 message[len-1] == '\n' ? "" : "\n");
17c76198 1861}
af3498d6 1862#endif
059ec3d9 1863
059ec3d9 1864
17c76198
PP
1865/* Called after client hello, should handle SNI work.
1866This will always set tls_sni (state->received_sni) if available,
1867and may trigger presenting different certificates,
1868if state->trigger_sni_changes is TRUE.
059ec3d9 1869
17c76198
PP
1870Should be registered with
1871 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1872
17c76198
PP
1873"This callback must return 0 on success or a gnutls error code to terminate the
1874handshake.".
059ec3d9 1875
17c76198
PP
1876For inability to get SNI information, we return 0.
1877We only return non-zero if re-setup failed.
817d9f57 1878Only used for server-side TLS.
17c76198 1879*/
44bbabb5 1880
17c76198
PP
1881static int
1882exim_sni_handling_cb(gnutls_session_t session)
1883{
1884char sni_name[MAX_HOST_LEN];
1885size_t data_len = MAX_HOST_LEN;
817d9f57 1886exim_gnutls_state_st *state = &state_server;
17c76198
PP
1887unsigned int sni_type;
1888int rc, old_pool;
cf0c6164 1889uschar * dummy_errstr;
17c76198
PP
1890
1891rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1892if (rc != GNUTLS_E_SUCCESS)
1893 {
1894 DEBUG(D_tls) {
1895 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1896 debug_printf("TLS: no SNI presented in handshake.\n");
1897 else
1898 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1899 gnutls_strerror(rc), rc);
cf0c6164 1900 }
b34fc30c
PP
1901 return 0;
1902 }
1903
17c76198
PP
1904if (sni_type != GNUTLS_NAME_DNS)
1905 {
1906 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1907 return 0;
1908 }
44bbabb5 1909
17c76198
PP
1910/* We now have a UTF-8 string in sni_name */
1911old_pool = store_pool;
1912store_pool = POOL_PERM;
1913state->received_sni = string_copyn(US sni_name, data_len);
1914store_pool = old_pool;
1915
1916/* We set this one now so that variable expansions below will work */
817d9f57 1917state->tlsp->sni = state->received_sni;
17c76198
PP
1918
1919DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1920 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1921
1922if (!state->trigger_sni_changes)
1923 return 0;
1924
cf0c6164 1925if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
17c76198
PP
1926 {
1927 /* If the setup of certs/etc failed before handshake, TLS would not have
1928 been offered. The best we can do now is abort. */
1929 return GNUTLS_E_APPLICATION_ERROR_MIN;
1930 }
1931
cf0c6164 1932rc = tls_set_remaining_x509(state, &dummy_errstr);
1365611d
PP
1933if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1934
1935return 0;
059ec3d9
PH
1936}
1937
1938
1939
f2de3a33 1940#ifndef DISABLE_OCSP
44662487
JH
1941
1942static int
1943server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1944 gnutls_datum_t * ocsp_response)
1945{
1946int ret;
47195144 1947DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
44662487 1948
44662487
JH
1949if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1950 {
1951 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
5903c6ff 1952 CS ptr);
018058b2 1953 tls_in.ocsp = OCSP_NOT_RESP;
44662487
JH
1954 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1955 }
1956
018058b2 1957tls_in.ocsp = OCSP_VFY_NOT_TRIED;
44662487
JH
1958return 0;
1959}
1960
1961#endif
1962
1963
0cbf2b82 1964#ifndef DISABLE_EVENT
a7538db1
JH
1965/*
1966We use this callback to get observability and detail-level control
723fe533
JH
1967for an exim TLS connection (either direction), raising a tls:cert event
1968for each cert in the chain presented by the peer. Any event
a7538db1
JH
1969can deny verification.
1970
1971Return 0 for the handshake to continue or non-zero to terminate.
1972*/
1973
1974static int
723fe533 1975verify_cb(gnutls_session_t session)
a7538db1 1976{
27f19eb4 1977const gnutls_datum_t * cert_list;
a7538db1
JH
1978unsigned int cert_list_size = 0;
1979gnutls_x509_crt_t crt;
1980int rc;
b30275b8 1981uschar * yield;
a7538db1
JH
1982exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1983
bd5b3f3c 1984if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
a7538db1
JH
1985 while (cert_list_size--)
1986 {
bd5b3f3c 1987 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
a7538db1
JH
1988 {
1989 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1990 cert_list_size, gnutls_strerror(rc));
1991 break;
1992 }
1993
1994 state->tlsp->peercert = crt;
b30275b8
JH
1995 if ((yield = event_raise(state->event_action,
1996 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
1997 {
1998 log_write(0, LOG_MAIN,
b30275b8
JH
1999 "SSL verify denied by event-action: depth=%d: %s",
2000 cert_list_size, yield);
a7538db1
JH
2001 return 1; /* reject */
2002 }
2003 state->tlsp->peercert = NULL;
2004 }
2005
2006return 0;
2007}
2008
2009#endif
44662487
JH
2010
2011
f20cfa4a
JH
2012static gstring *
2013ddump(gnutls_datum_t * d)
2014{
2015gstring * g = string_get((d->size+1) * 2);
2016uschar * s = d->data;
2017for (unsigned i = d->size; i > 0; i--, s++)
2018 {
2019 g = string_catn(g, US "0123456789abcdef" + (*s >> 4), 1);
2020 g = string_catn(g, US "0123456789abcdef" + (*s & 0xf), 1);
2021 }
2022return g;
2023}
17c76198
PP
2024
2025/* ------------------------------------------------------------------------ */
2026/* Exported functions */
2027
2028
2029
2030
059ec3d9
PH
2031/*************************************************
2032* Start a TLS session in a server *
2033*************************************************/
2034
2035/* This is called when Exim is running as a server, after having received
2036the STARTTLS command. It must respond to that command, and then negotiate
2037a TLS session.
2038
2039Arguments:
83da1223 2040 require_ciphers list of allowed ciphers or NULL
cf0c6164 2041 errstr pointer to error string
059ec3d9
PH
2042
2043Returns: OK on success
2044 DEFER for errors before the start of the negotiation
4c04137d 2045 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
2046 continue running.
2047*/
2048
2049int
cf0c6164 2050tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
2051{
2052int rc;
cf0c6164 2053exim_gnutls_state_st * state = NULL;
059ec3d9
PH
2054
2055/* Check for previous activation */
74f1a423 2056if (tls_in.active.sock >= 0)
059ec3d9 2057 {
48224640 2058 tls_error(US"STARTTLS received after TLS started", US "", NULL, errstr);
925ac8e4 2059 smtp_printf("554 Already in TLS\r\n", FALSE);
059ec3d9
PH
2060 return FAIL;
2061 }
2062
2063/* Initialize the library. If it fails, it will already have logged the error
2064and sent an SMTP response. */
2065
17c76198 2066DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 2067
cf0c6164 2068if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
17c76198 2069 NULL, tls_verify_certificates, tls_crl,
74f1a423 2070 require_ciphers, &state, &tls_in, errstr)) != OK) return rc;
059ec3d9 2071
059ec3d9
PH
2072/* If this is a host for which certificate verification is mandatory or
2073optional, set up appropriately. */
2074
059ec3d9 2075if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 2076 {
e51c7be2
JH
2077 DEBUG(D_tls)
2078 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
2079 state->verify_requirement = VERIFY_REQUIRED;
2080 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2081 }
059ec3d9 2082else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 2083 {
e51c7be2
JH
2084 DEBUG(D_tls)
2085 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
2086 state->verify_requirement = VERIFY_OPTIONAL;
2087 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2088 }
2089else
2090 {
e51c7be2
JH
2091 DEBUG(D_tls)
2092 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
2093 state->verify_requirement = VERIFY_NONE;
2094 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2095 }
059ec3d9 2096
0cbf2b82 2097#ifndef DISABLE_EVENT
723fe533
JH
2098if (event_action)
2099 {
2100 state->event_action = event_action;
2101 gnutls_session_set_ptr(state->session, state);
2102 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2103 }
2104#endif
2105
17c76198
PP
2106/* Register SNI handling; always, even if not in tls_certificate, so that the
2107expansion variable $tls_sni is always available. */
059ec3d9 2108
17c76198
PP
2109gnutls_handshake_set_post_client_hello_function(state->session,
2110 exim_sni_handling_cb);
059ec3d9
PH
2111
2112/* Set context and tell client to go ahead, except in the case of TLS startup
2113on connection, where outputting anything now upsets the clients and tends to
2114make them disconnect. We need to have an explicit fflush() here, to force out
2115the response. Other smtp_printf() calls do not need it, because in non-TLS
2116mode, the fflush() happens when smtp_getc() is called. */
2117
817d9f57 2118if (!state->tlsp->on_connect)
059ec3d9 2119 {
925ac8e4 2120 smtp_printf("220 TLS go ahead\r\n", FALSE);
9d1c15ef 2121 fflush(smtp_out);
059ec3d9
PH
2122 }
2123
2124/* Now negotiate the TLS session. We put our own timer on it, since it seems
8008accd
JH
2125that the GnuTLS library doesn't.
2126From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
2127to set (and clear down afterwards) up a pull-timeout callback function that does
2128a select, so we're no better off unless avoiding signals becomes an issue. */
059ec3d9 2129
17c76198 2130gnutls_transport_set_ptr2(state->session,
27f19eb4
JH
2131 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2132 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
17c76198
PP
2133state->fd_in = fileno(smtp_in);
2134state->fd_out = fileno(smtp_out);
059ec3d9
PH
2135
2136sigalrm_seen = FALSE;
c2a1bba0 2137if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
17c76198 2138do
17c76198 2139 rc = gnutls_handshake(state->session);
157a7880 2140while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2141ALARM_CLR(0);
059ec3d9 2142
17c76198 2143if (rc != GNUTLS_E_SUCCESS)
059ec3d9 2144 {
059ec3d9
PH
2145 /* It seems that, except in the case of a timeout, we have to close the
2146 connection right here; otherwise if the other end is running OpenSSL it hangs
2147 until the server times out. */
2148
60d10ce7 2149 if (sigalrm_seen)
ad7fc6eb 2150 {
48224640 2151 tls_error(US"gnutls_handshake", US"timed out", NULL, errstr);
ad7fc6eb
JH
2152 gnutls_db_remove_session(state->session);
2153 }
60d10ce7 2154 else
059ec3d9 2155 {
48224640 2156 tls_error(US"gnutls_handshake", US gnutls_strerror(rc), NULL, errstr);
f5d25c2b 2157 (void) gnutls_alert_send_appropriate(state->session, rc);
ad7fc6eb 2158 gnutls_deinit(state->session);
ed62aae3 2159 gnutls_certificate_free_credentials(state->x509_cred);
60d10ce7 2160 millisleep(500);
ad7fc6eb 2161 shutdown(state->fd_out, SHUT_WR);
d7978c0f 2162 for (int i = 1024; fgetc(smtp_in) != EOF && i > 0; ) i--; /* drain skt */
f1e894f3
PH
2163 (void)fclose(smtp_out);
2164 (void)fclose(smtp_in);
60d10ce7 2165 smtp_out = smtp_in = NULL;
059ec3d9
PH
2166 }
2167
2168 return FAIL;
2169 }
2170
f20cfa4a
JH
2171DEBUG(D_tls)
2172 {
2173 debug_printf("gnutls_handshake was successful\n");
2174#ifdef SUPPORT_GNUTLS_SESS_DESC
2175 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2176#endif
2177#ifdef SUPPORT_GNUTLS_KEYLOG
2178 {
2179 gnutls_datum_t c, s;
2180 gstring * gc, * gs;
2181 gnutls_session_get_random(state->session, &c, &s);
2182 gnutls_session_get_master_secret(state->session, &s);
2183 gc = ddump(&c);
2184 gs = ddump(&s);
2185 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2186 }
2187#endif
2188 }
059ec3d9 2189
17c76198
PP
2190/* Verify after the fact */
2191
899b8bbc 2192if (!verify_certificate(state, errstr))
059ec3d9 2193 {
9d1c15ef 2194 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 2195 {
cf0c6164 2196 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
9d1c15ef 2197 return FAIL;
17c76198 2198 }
9d1c15ef
JH
2199 DEBUG(D_tls)
2200 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
cf0c6164 2201 *errstr);
059ec3d9
PH
2202 }
2203
17c76198
PP
2204/* Figure out peer DN, and if authenticated, etc. */
2205
cf0c6164 2206if ((rc = peer_status(state, NULL)) != OK) return rc;
17c76198
PP
2207
2208/* Sets various Exim expansion variables; always safe within server */
2209
9d1c15ef 2210extract_exim_vars_from_tls_state(state);
059ec3d9
PH
2211
2212/* TLS has been set up. Adjust the input functions to read via TLS,
2213and initialize appropriately. */
2214
17c76198 2215state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
2216
2217receive_getc = tls_getc;
0d81dabc 2218receive_getbuf = tls_getbuf;
584e96c6 2219receive_get_cache = tls_get_cache;
059ec3d9
PH
2220receive_ungetc = tls_ungetc;
2221receive_feof = tls_feof;
2222receive_ferror = tls_ferror;
58eb016e 2223receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2224
059ec3d9
PH
2225return OK;
2226}
2227
2228
2229
2230
aa2a70ba
JH
2231static void
2232tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2233 smtp_transport_options_block * ob)
2234{
3fb3231c 2235if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 2236 {
4af0d74a 2237 state->exp_tls_verify_cert_hostnames =
8c5d388a 2238#ifdef SUPPORT_I18N
4af0d74a
JH
2239 string_domain_utf8_to_alabel(host->name, NULL);
2240#else
2241 host->name;
2242#endif
aa2a70ba
JH
2243 DEBUG(D_tls)
2244 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2245 state->exp_tls_verify_cert_hostnames);
2246 }
2247}
aa2a70ba
JH
2248
2249
899b8bbc
JH
2250
2251
2252#ifdef SUPPORT_DANE
2253/* Given our list of RRs from the TLSA lookup, build a lookup block in
2254GnuTLS-DANE's preferred format. Hang it on the state str for later
2255use in DANE verification.
2256
2257We point at the dnsa data not copy it, so it must remain valid until
2258after verification is done.*/
2259
3674140c 2260static BOOL
899b8bbc
JH
2261dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2262{
899b8bbc
JH
2263dns_scan dnss;
2264int i;
2265const char ** dane_data;
2266int * dane_data_len;
2267
d7978c0f
JH
2268i = 1;
2269for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
899b8bbc
JH
2270 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2271 ) if (rr->type == T_TLSA) i++;
2272
2273dane_data = store_get(i * sizeof(uschar *));
2274dane_data_len = store_get(i * sizeof(int));
2275
d7978c0f
JH
2276i = 0;
2277for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
899b8bbc 2278 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1b76ad22 2279 ) if (rr->type == T_TLSA && rr->size > 3)
899b8bbc
JH
2280 {
2281 const uschar * p = rr->data;
3674140c
JH
2282 uint8_t usage = p[0], sel = p[1], type = p[2];
2283
2284 DEBUG(D_tls)
2285 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2286
94c13285
JH
2287 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2288 || (sel != 0 && sel != 1)
2289 )
2290 continue;
3674140c
JH
2291 switch(type)
2292 {
2293 case 0: /* Full: cannot check at present */
2294 break;
2295 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2296 break;
2297 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2298 break;
2299 default: continue;
2300 }
899b8bbc
JH
2301
2302 tls_out.tlsa_usage |= 1<<usage;
48224640 2303 dane_data[i] = CS p;
899b8bbc
JH
2304 dane_data_len[i++] = rr->size;
2305 }
3674140c
JH
2306
2307if (!i) return FALSE;
2308
899b8bbc
JH
2309dane_data[i] = NULL;
2310dane_data_len[i] = 0;
2311
2312state->dane_data = (char * const *)dane_data;
2313state->dane_data_len = dane_data_len;
3674140c 2314return TRUE;
899b8bbc
JH
2315}
2316#endif
2317
2318
2319
059ec3d9
PH
2320/*************************************************
2321* Start a TLS session in a client *
2322*************************************************/
2323
2324/* Called from the smtp transport after STARTTLS has been accepted.
2325
2326Arguments:
c05bdbd6
JH
2327 cctx connection context
2328 conn_args connection details
2329 cookie datum for randomness (not used)
2330 tlsp record details of channel configuration here; must be non-NULL
2331 errstr error string pointer
2332
2333Returns: TRUE for success with TLS session context set in smtp context,
2334 FALSE on error
059ec3d9
PH
2335*/
2336
c05bdbd6
JH
2337BOOL
2338tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2339 void * cookie ARG_UNUSED,
2340 tls_support * tlsp, uschar ** errstr)
059ec3d9 2341{
c05bdbd6
JH
2342host_item * host = conn_args->host; /* for msgs and option-tests */
2343transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
2344smtp_transport_options_block * ob = tb
afdb5e9c
JH
2345 ? (smtp_transport_options_block *)tb->options_block
2346 : &smtp_transport_option_defaults;
059ec3d9 2347int rc;
899b8bbc 2348exim_gnutls_state_st * state = NULL;
c05bdbd6 2349uschar * cipher_list = NULL;
74f1a423 2350
f2de3a33 2351#ifndef DISABLE_OCSP
5130845b 2352BOOL require_ocsp =
3fb3231c 2353 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
44662487 2354BOOL request_ocsp = require_ocsp ? TRUE
3fb3231c 2355 : verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
2b4a568d 2356#endif
059ec3d9 2357
c05bdbd6 2358DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", cctx->sock);
059ec3d9 2359
5ec37a55 2360#ifdef SUPPORT_DANE
c05bdbd6
JH
2361/* If dane is flagged, have either request or require dane for this host, and
2362a TLSA record found. Therefore, dane verify required. Which implies cert must
2363be requested and supplied, dane verify must pass, and cert verify irrelevant
2364(incl. hostnames), and (caller handled) require_tls */
2365
2366if (conn_args->dane && ob->dane_require_tls_ciphers)
5ec37a55
PP
2367 {
2368 /* not using expand_check_tlsvar because not yet in state */
2369 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2370 &cipher_list, errstr))
c05bdbd6 2371 return FALSE;
cf260049
JH
2372 cipher_list = cipher_list && *cipher_list
2373 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
5ec37a55
PP
2374 }
2375#endif
2376
2377if (!cipher_list)
2378 cipher_list = ob->tls_require_ciphers;
2379
74f1a423 2380if (tls_init(host, ob->tls_certificate, ob->tls_privatekey,
65867078 2381 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
74f1a423 2382 cipher_list, &state, tlsp, errstr) != OK)
c05bdbd6 2383 return FALSE;
059ec3d9 2384
54c90be1 2385 {
65867078
JH
2386 int dh_min_bits = ob->tls_dh_min_bits;
2387 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2388 {
2389 DEBUG(D_tls)
2390 debug_printf("WARNING: tls_dh_min_bits far too low,"
2391 " clamping %d up to %d\n",
2392 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2393 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2394 }
54c90be1 2395
65867078
JH
2396 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2397 " acceptable bits to %d\n",
2398 dh_min_bits);
2399 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2400 }
83da1223 2401
94431adb 2402/* Stick to the old behaviour for compatibility if tls_verify_certificates is
2b4a568d
JH
2403set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2404the specified host patterns if one of them is defined */
2405
899b8bbc 2406#ifdef SUPPORT_DANE
c05bdbd6 2407if (conn_args->dane && dane_tlsa_load(state, &conn_args->tlsa_dnsa))
899b8bbc
JH
2408 {
2409 DEBUG(D_tls)
2410 debug_printf("TLS: server certificate DANE required.\n");
2411 state->verify_requirement = VERIFY_DANE;
2412 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
899b8bbc
JH
2413 }
2414else
2415#endif
2416 if ( ( state->exp_tls_verify_certificates
2417 && !ob->tls_verify_hosts
2418 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2419 )
3fb3231c 2420 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
899b8bbc 2421 )
17c76198 2422 {
aa2a70ba 2423 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
2424 DEBUG(D_tls)
2425 debug_printf("TLS: server certificate verification required.\n");
2426 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
2427 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2428 }
3fb3231c 2429else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
52f93eed 2430 {
aa2a70ba 2431 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
2432 DEBUG(D_tls)
2433 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 2434 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
2435 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2436 }
2437else
2438 {
e51c7be2
JH
2439 DEBUG(D_tls)
2440 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
2441 state->verify_requirement = VERIFY_NONE;
2442 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 2443 }
059ec3d9 2444
f2de3a33
JH
2445#ifndef DISABLE_OCSP
2446 /* supported since GnuTLS 3.1.3 */
44662487 2447if (request_ocsp)
9d1c15ef
JH
2448 {
2449 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
2450 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2451 NULL, 0, NULL)) != OK)
74f1a423 2452 {
48224640 2453 tls_error(US"cert-status-req", US gnutls_strerror(rc), state->host, errstr);
c05bdbd6 2454 return FALSE;
74f1a423
JH
2455 }
2456 tlsp->ocsp = OCSP_NOT_RESP;
9d1c15ef 2457 }
2b4a568d
JH
2458#endif
2459
0cbf2b82 2460#ifndef DISABLE_EVENT
afdb5e9c 2461if (tb && tb->event_action)
a7538db1 2462 {
774ef2d7 2463 state->event_action = tb->event_action;
a7538db1 2464 gnutls_session_set_ptr(state->session, state);
723fe533 2465 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
2466 }
2467#endif
2468
c05bdbd6
JH
2469gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) cctx->sock);
2470state->fd_in = cctx->sock;
2471state->fd_out = cctx->sock;
059ec3d9 2472
9d1c15ef 2473DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
2474/* There doesn't seem to be a built-in timeout on connection. */
2475
2476sigalrm_seen = FALSE;
c2a1bba0 2477ALARM(ob->command_timeout);
17c76198 2478do
17c76198 2479 rc = gnutls_handshake(state->session);
f1fed05b 2480while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
c2a1bba0 2481ALARM_CLR(0);
059ec3d9 2482
4fe99a6c 2483if (rc != GNUTLS_E_SUCCESS)
74f1a423 2484 {
60d10ce7
JH
2485 if (sigalrm_seen)
2486 {
2487 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
48224640 2488 tls_error(US"gnutls_handshake", US"timed out", state->host, errstr);
60d10ce7
JH
2489 }
2490 else
48224640 2491 tls_error(US"gnutls_handshake", US gnutls_strerror(rc), state->host, errstr);
c05bdbd6 2492 return FALSE;
74f1a423 2493 }
4fe99a6c 2494
f20cfa4a
JH
2495DEBUG(D_tls)
2496 {
2497 debug_printf("gnutls_handshake was successful\n");
2498#ifdef SUPPORT_GNUTLS_SESS_DESC
2499 debug_printf("%s\n", gnutls_session_get_desc(state->session));
2500#endif
2501#ifdef SUPPORT_GNUTLS_KEYLOG
2502 {
2503 gnutls_datum_t c, s;
2504 gstring * gc, * gs;
2505 gnutls_session_get_random(state->session, &c, &s);
2506 gnutls_session_get_master_secret(state->session, &s);
2507 gc = ddump(&c);
2508 gs = ddump(&s);
2509 debug_printf("CLIENT_RANDOM %.*s %.*s\n", (int)gc->ptr, gc->s, (int)gs->ptr, gs->s);
2510 }
2511#endif
2512 }
059ec3d9 2513
17c76198 2514/* Verify late */
059ec3d9 2515
899b8bbc 2516if (!verify_certificate(state, errstr))
74f1a423
JH
2517 {
2518 tls_error(US"certificate verification failed", *errstr, state->host, errstr);
c05bdbd6 2519 return FALSE;
74f1a423 2520 }
059ec3d9 2521
f2de3a33 2522#ifndef DISABLE_OCSP
2b4a568d
JH
2523if (require_ocsp)
2524 {
2525 DEBUG(D_tls)
2526 {
2527 gnutls_datum_t stapling;
2528 gnutls_ocsp_resp_t resp;
2529 gnutls_datum_t printed;
2530 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2531 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2532 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2533 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2534 )
2535 {
65867078 2536 debug_printf("%.4096s", printed.data);
2b4a568d
JH
2537 gnutls_free(printed.data);
2538 }
2539 else
48224640 2540 (void) tls_error(US"ocsp decode", US gnutls_strerror(rc), state->host, errstr);
2b4a568d
JH
2541 }
2542
2b4a568d 2543 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2 2544 {
74f1a423
JH
2545 tlsp->ocsp = OCSP_FAILED;
2546 tls_error(US"certificate status check failed", NULL, state->host, errstr);
c05bdbd6 2547 return FALSE;
018058b2 2548 }
2b4a568d 2549 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
74f1a423 2550 tlsp->ocsp = OCSP_VFIED;
2b4a568d
JH
2551 }
2552#endif
2553
17c76198 2554/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 2555
74f1a423 2556if (peer_status(state, errstr) != OK)
c05bdbd6 2557 return FALSE;
059ec3d9 2558
4fe99a6c 2559/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 2560
9d1c15ef 2561extract_exim_vars_from_tls_state(state);
059ec3d9 2562
c05bdbd6
JH
2563cctx->tls_ctx = state;
2564return TRUE;
059ec3d9
PH
2565}
2566
2567
2568
17c76198 2569
059ec3d9 2570/*************************************************
17c76198 2571* Close down a TLS session *
059ec3d9
PH
2572*************************************************/
2573
17c76198
PP
2574/* This is also called from within a delivery subprocess forked from the
2575daemon, to shut down the TLS library, without actually doing a shutdown (which
2576would tamper with the TLS session in the parent process).
059ec3d9 2577
dec766a1 2578Arguments:
74f1a423 2579 ct_ctx client context pointer, or NULL for the one global server context
dec766a1 2580 shutdown 1 if TLS close-alert is to be sent,
afdb5e9c 2581 2 if also response to be waited for
dec766a1 2582
17c76198 2583Returns: nothing
059ec3d9
PH
2584*/
2585
17c76198 2586void
74f1a423 2587tls_close(void * ct_ctx, int shutdown)
059ec3d9 2588{
74f1a423 2589exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
059ec3d9 2590
74f1a423 2591if (!state->tlsp || state->tlsp->active.sock < 0) return; /* TLS was not active */
17c76198
PP
2592
2593if (shutdown)
2594 {
dec766a1
WB
2595 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
2596 shutdown > 1 ? " (with response-wait)" : "");
2597
c2a1bba0 2598 ALARM(2);
dec766a1 2599 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
c2a1bba0 2600 ALARM_CLR(0);
17c76198
PP
2601 }
2602
2603gnutls_deinit(state->session);
ed62aae3
HSHR
2604gnutls_certificate_free_credentials(state->x509_cred);
2605
17c76198 2606
74f1a423
JH
2607state->tlsp->active.sock = -1;
2608state->tlsp->active.tls_ctx = NULL;
b808677c 2609if (state->xfer_buffer) store_free(state->xfer_buffer);
17c76198 2610memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
059ec3d9
PH
2611}
2612
2613
2614
17c76198 2615
0d81dabc
JH
2616static BOOL
2617tls_refill(unsigned lim)
2618{
2619exim_gnutls_state_st * state = &state_server;
2620ssize_t inbytes;
2621
2622DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2623 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2624
f1fed05b 2625sigalrm_seen = FALSE;
c2a1bba0 2626if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
4896a319
AM
2627
2628do
2629 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2630 MIN(ssl_xfer_buffer_size, lim));
2631while (inbytes == GNUTLS_E_AGAIN);
2632
c2a1bba0 2633if (smtp_receive_timeout > 0) ALARM_CLR(0);
9723f966
JH
2634
2635if (had_command_timeout) /* set by signal handler */
2636 smtp_command_timeout_exit(); /* does not return */
2637if (had_command_sigterm)
2638 smtp_command_sigterm_exit();
2639if (had_data_timeout)
2640 smtp_data_timeout_exit();
2641if (had_data_sigint)
2642 smtp_data_sigint_exit();
2643
2644/* Timeouts do not get this far. A zero-byte return appears to mean that the
2645TLS session has been closed down, not that the socket itself has been closed
2646down. Revert to non-TLS handling. */
0d81dabc
JH
2647
2648if (sigalrm_seen)
2649 {
2650 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
8b77d27a 2651 state->xfer_error = TRUE;
0d81dabc
JH
2652 return FALSE;
2653 }
2654
2655else if (inbytes == 0)
2656 {
2657 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2658
2659 receive_getc = smtp_getc;
2660 receive_getbuf = smtp_getbuf;
2661 receive_get_cache = smtp_get_cache;
2662 receive_ungetc = smtp_ungetc;
2663 receive_feof = smtp_feof;
2664 receive_ferror = smtp_ferror;
2665 receive_smtp_buffered = smtp_buffered;
2666
2667 gnutls_deinit(state->session);
2668 gnutls_certificate_free_credentials(state->x509_cred);
2669
2670 state->session = NULL;
74f1a423
JH
2671 state->tlsp->active.sock = -1;
2672 state->tlsp->active.tls_ctx = NULL;
0d81dabc
JH
2673 state->tlsp->bits = 0;
2674 state->tlsp->certificate_verified = FALSE;
2675 tls_channelbinding_b64 = NULL;
2676 state->tlsp->cipher = NULL;
2677 state->tlsp->peercert = NULL;
2678 state->tlsp->peerdn = NULL;
2679
2680 return FALSE;
2681 }
2682
2683/* Handle genuine errors */
2684
2685else if (inbytes < 0)
2686 {
95f52235 2687 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
0d81dabc 2688 record_io_error(state, (int) inbytes, US"recv", NULL);
8b77d27a 2689 state->xfer_error = TRUE;
0d81dabc
JH
2690 return FALSE;
2691 }
2692#ifndef DISABLE_DKIM
2693dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2694#endif
2695state->xfer_buffer_hwm = (int) inbytes;
2696state->xfer_buffer_lwm = 0;
2697return TRUE;
2698}
2699
059ec3d9
PH
2700/*************************************************
2701* TLS version of getc *
2702*************************************************/
2703
2704/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2705it refills the buffer via the GnuTLS reading function.
817d9f57 2706Only used by the server-side TLS.
059ec3d9 2707
17c76198
PP
2708This feeds DKIM and should be used for all message-body reads.
2709
aded2255 2710Arguments: lim Maximum amount to read/buffer
059ec3d9
PH
2711Returns: the next character or EOF
2712*/
2713
2714int
bd8fbe36 2715tls_getc(unsigned lim)
059ec3d9 2716{
0d81dabc 2717exim_gnutls_state_st * state = &state_server;
059ec3d9 2718
0d81dabc
JH
2719if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2720 if (!tls_refill(lim))
2721 return state->xfer_error ? EOF : smtp_getc(lim);
ed62aae3 2722
0d81dabc 2723/* Something in the buffer; return next uschar */
059ec3d9 2724
0d81dabc
JH
2725return state->xfer_buffer[state->xfer_buffer_lwm++];
2726}
059ec3d9 2727
0d81dabc
JH
2728uschar *
2729tls_getbuf(unsigned * len)
2730{
2731exim_gnutls_state_st * state = &state_server;
2732unsigned size;
2733uschar * buf;
059ec3d9 2734
0d81dabc
JH
2735if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2736 if (!tls_refill(*len))
059ec3d9 2737 {
0d81dabc
JH
2738 if (!state->xfer_error) return smtp_getbuf(len);
2739 *len = 0;
2740 return NULL;
059ec3d9 2741 }
059ec3d9 2742
0d81dabc
JH
2743if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
2744 size = *len;
2745buf = &state->xfer_buffer[state->xfer_buffer_lwm];
2746state->xfer_buffer_lwm += size;
2747*len = size;
2748return buf;
059ec3d9
PH
2749}
2750
0d81dabc 2751
584e96c6
JH
2752void
2753tls_get_cache()
2754{
9960d1e5 2755#ifndef DISABLE_DKIM
584e96c6
JH
2756exim_gnutls_state_st * state = &state_server;
2757int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2758if (n > 0)
2759 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
584e96c6 2760#endif
9960d1e5 2761}
584e96c6 2762
059ec3d9 2763
925ac8e4
JH
2764BOOL
2765tls_could_read(void)
2766{
2767return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
2768 || gnutls_record_check_pending(state_server.session) > 0;
2769}
2770
2771
059ec3d9 2772
17c76198 2773
059ec3d9
PH
2774/*************************************************
2775* Read bytes from TLS channel *
2776*************************************************/
2777
17c76198
PP
2778/* This does not feed DKIM, so if the caller uses this for reading message body,
2779then the caller must feed DKIM.
817d9f57 2780
059ec3d9 2781Arguments:
74f1a423 2782 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
2783 buff buffer of data
2784 len size of buffer
2785
2786Returns: the number of bytes read
afdb5e9c 2787 -1 after a failed read, including EOF
059ec3d9
PH
2788*/
2789
2790int
74f1a423 2791tls_read(void * ct_ctx, uschar *buff, size_t len)
059ec3d9 2792{
74f1a423 2793exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
17c76198 2794ssize_t inbytes;
059ec3d9 2795
17c76198
PP
2796if (len > INT_MAX)
2797 len = INT_MAX;
059ec3d9 2798
17c76198
PP
2799if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2800 DEBUG(D_tls)
2801 debug_printf("*** PROBABLY A BUG *** " \
2802 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2803 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2804
2805DEBUG(D_tls)
2806 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2807 state->session, buff, len);
2808
4896a319
AM
2809do
2810 inbytes = gnutls_record_recv(state->session, buff, len);
2811while (inbytes == GNUTLS_E_AGAIN);
2812
059ec3d9
PH
2813if (inbytes > 0) return inbytes;
2814if (inbytes == 0)
2815 {
2816 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2817 }
5fd28bb8 2818else
4896a319 2819 {
95f52235 2820 DEBUG(D_tls) debug_printf("%s: err from gnutls_record_recv\n", __FUNCTION__);
4896a319
AM
2821 record_io_error(state, (int)inbytes, US"recv", NULL);
2822 }
059ec3d9
PH
2823
2824return -1;
2825}
2826
2827
2828
17c76198 2829
059ec3d9
PH
2830/*************************************************
2831* Write bytes down TLS channel *
2832*************************************************/
2833
2834/*
2835Arguments:
74f1a423 2836 ct_ctx client context pointer, or NULL for the one global server context
059ec3d9
PH
2837 buff buffer of data
2838 len number of bytes
925ac8e4 2839 more more data expected soon
059ec3d9
PH
2840
2841Returns: the number of bytes after a successful write,
2842 -1 after a failed write
2843*/
2844
2845int
74f1a423 2846tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
059ec3d9 2847{
17c76198
PP
2848ssize_t outbytes;
2849size_t left = len;
74f1a423 2850exim_gnutls_state_st * state = ct_ctx ? ct_ctx : &state_server;
925ac8e4
JH
2851#ifdef SUPPORT_CORK
2852static BOOL corked = FALSE;
2853
2854if (more && !corked) gnutls_record_cork(state->session);
2855#endif
2856
2857DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
2858 buff, left, more ? ", more" : "");
059ec3d9 2859
059ec3d9
PH
2860while (left > 0)
2861 {
17c76198
PP
2862 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2863 buff, left);
4896a319
AM
2864
2865 do
2866 outbytes = gnutls_record_send(state->session, buff, left);
2867 while (outbytes == GNUTLS_E_AGAIN);
059ec3d9 2868
17c76198 2869 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
2870 if (outbytes < 0)
2871 {
1b76ad22 2872 DEBUG(D_tls) debug_printf("%s: gnutls_record_send err\n", __FUNCTION__);
17c76198 2873 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
2874 return -1;
2875 }
2876 if (outbytes == 0)
2877 {
17c76198 2878 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
2879 return -1;
2880 }
2881
2882 left -= outbytes;
2883 buff += outbytes;
2884 }
2885
17c76198
PP
2886if (len > INT_MAX)
2887 {
2888 DEBUG(D_tls)
2889 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2890 len);
2891 len = INT_MAX;
2892 }
2893
925ac8e4
JH
2894#ifdef SUPPORT_CORK
2895if (more != corked)
2896 {
2897 if (!more) (void) gnutls_record_uncork(state->session, 0);
2898 corked = more;
2899 }
2900#endif
2901
17c76198 2902return (int) len;
059ec3d9
PH
2903}
2904
2905
2906
17c76198 2907
059ec3d9 2908/*************************************************
17c76198 2909* Random number generation *
059ec3d9
PH
2910*************************************************/
2911
17c76198
PP
2912/* Pseudo-random number generation. The result is not expected to be
2913cryptographically strong but not so weak that someone will shoot themselves
2914in the foot using it as a nonce in input in some email header scheme or
2915whatever weirdness they'll twist this into. The result should handle fork()
2916and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 2917
17c76198
PP
2918Arguments:
2919 max range maximum
2920Returns a random number in range [0, max-1]
059ec3d9
PH
2921*/
2922
af3498d6 2923#ifdef HAVE_GNUTLS_RND
17c76198
PP
2924int
2925vaguely_random_number(int max)
059ec3d9 2926{
17c76198
PP
2927unsigned int r;
2928int i, needed_len;
17c76198
PP
2929uschar smallbuf[sizeof(r)];
2930
2931if (max <= 1)
2932 return 0;
2933
2934needed_len = sizeof(r);
2935/* Don't take 8 times more entropy than needed if int is 8 octets and we were
d7978c0f
JH
2936asked for a number less than 10. */
2937
17c76198
PP
2938for (r = max, i = 0; r; ++i)
2939 r >>= 1;
2940i = (i + 7) / 8;
2941if (i < needed_len)
2942 needed_len = i;
2943
2944i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2945if (i < 0)
059ec3d9 2946 {
17c76198
PP
2947 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2948 return vaguely_random_number_fallback(max);
2949 }
2950r = 0;
d7978c0f
JH
2951for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
2952 r = r * 256 + *p;
059ec3d9 2953
17c76198
PP
2954/* We don't particularly care about weighted results; if someone wants
2955 * smooth distribution and cares enough then they should submit a patch then. */
2956return r % max;
059ec3d9 2957}
af3498d6
PP
2958#else /* HAVE_GNUTLS_RND */
2959int
2960vaguely_random_number(int max)
2961{
2962 return vaguely_random_number_fallback(max);
2963}
2964#endif /* HAVE_GNUTLS_RND */
059ec3d9 2965
36f12725
NM
2966
2967
2968
2969/*************************************************
3375e053
PP
2970* Let tls_require_ciphers be checked at startup *
2971*************************************************/
2972
2973/* The tls_require_ciphers option, if set, must be something which the
2974library can parse.
2975
2976Returns: NULL on success, or error message
2977*/
2978
2979uschar *
2980tls_validate_require_cipher(void)
2981{
2982int rc;
2983uschar *expciphers = NULL;
2984gnutls_priority_t priority_cache;
2985const char *errpos;
cf0c6164 2986uschar * dummy_errstr;
3375e053
PP
2987
2988#define validate_check_rc(Label) do { \
2989 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2990 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2991#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2992
2993if (exim_gnutls_base_init_done)
2994 log_write(0, LOG_MAIN|LOG_PANIC,
2995 "already initialised GnuTLS, Exim developer bug");
2996
a5f239e4 2997#ifdef HAVE_GNUTLS_PKCS11
2519e60d 2998if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
2999 {
3000 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
3001 validate_check_rc(US"gnutls_pkcs11_init");
3002 }
3003#endif
3375e053
PP
3004rc = gnutls_global_init();
3005validate_check_rc(US"gnutls_global_init()");
3006exim_gnutls_base_init_done = TRUE;
3007
3008if (!(tls_require_ciphers && *tls_require_ciphers))
3009 return_deinit(NULL);
3010
cf0c6164
JH
3011if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
3012 &dummy_errstr))
3375e053
PP
3013 return_deinit(US"failed to expand tls_require_ciphers");
3014
3015if (!(expciphers && *expciphers))
3016 return_deinit(NULL);
3017
3018DEBUG(D_tls)
3019 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
3020
3021rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
3022validate_check_rc(string_sprintf(
3023 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
3024 expciphers, errpos - CS expciphers, errpos));
3025
3026#undef return_deinit
3027#undef validate_check_rc
3028gnutls_global_deinit();
3029
3030return NULL;
3031}
3032
3033
3034
3035
3036/*************************************************
36f12725
NM
3037* Report the library versions. *
3038*************************************************/
3039
3040/* See a description in tls-openssl.c for an explanation of why this exists.
3041
3042Arguments: a FILE* to print the results to
3043Returns: nothing
3044*/
3045
3046void
3047tls_version_report(FILE *f)
3048{
754a0503
PP
3049fprintf(f, "Library version: GnuTLS: Compile: %s\n"
3050 " Runtime: %s\n",
3051 LIBGNUTLS_VERSION,
3052 gnutls_check_version(NULL));
36f12725
NM
3053}
3054
2b4a568d
JH
3055/* vi: aw ai sw=2
3056*/
059ec3d9 3057/* End of tls-gnu.c */