Testsuite: workaround older-perl bug
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
6aa6fc9c 16Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17c76198 17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
a5f239e4
PP
42/* needed to disable PKCS11 autoload unless requested */
43#if GNUTLS_VERSION_NUMBER >= 0x020c00
44# include <gnutls/pkcs11.h>
76075bb5 45# define SUPPORT_PARAM_TO_PK_BITS
a5f239e4 46#endif
7e07527a
JH
47#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
48# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
49# define DISABLE_OCSP
50#endif
0cbf2b82 51#if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
774ef2d7 52# warning "GnuTLS library version too old; tls:cert event unsupported"
0cbf2b82 53# define DISABLE_EVENT
a7538db1 54#endif
a7fec7a7
JH
55#if GNUTLS_VERSION_NUMBER >= 0x030306
56# define SUPPORT_CA_DIR
57#else
58# undef SUPPORT_CA_DIR
59#endif
11a04b5a 60#if GNUTLS_VERSION_NUMBER >= 0x030014
cb1d7830
JH
61# define SUPPORT_SYSDEFAULT_CABUNDLE
62#endif
925ac8e4
JH
63#if GNUTLS_VERSION_NUMBER >= 0x030109
64# define SUPPORT_CORK
65#endif
47195144
JH
66#if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
67# define SUPPORT_SRV_OCSP_STACK
68#endif
c0635b6d
JH
69
70#ifdef SUPPORT_DANE
71# if GNUTLS_VERSION_NUMBER >= 0x030000
72# define DANESSL_USAGE_DANE_TA 2
73# define DANESSL_USAGE_DANE_EE 3
74# else
75# error GnuTLS version too early for DANE
76# endif
77# if GNUTLS_VERSION_NUMBER < 0x999999
78# define GNUTLS_BROKEN_DANE_VALIDATION
79# endif
899b8bbc 80#endif
7e07527a 81
f2de3a33 82#ifndef DISABLE_OCSP
2b4a568d
JH
83# include <gnutls/ocsp.h>
84#endif
899b8bbc
JH
85#ifdef SUPPORT_DANE
86# include <gnutls/dane.h>
87#endif
059ec3d9 88
17c76198 89/* GnuTLS 2 vs 3
059ec3d9 90
17c76198
PP
91GnuTLS 3 only:
92 gnutls_global_set_audit_log_function()
059ec3d9 93
17c76198
PP
94Changes:
95 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
96*/
059ec3d9 97
17c76198 98/* Local static variables for GnuTLS */
059ec3d9 99
17c76198 100/* Values for verify_requirement */
059ec3d9 101
e51c7be2 102enum peer_verify_requirement
899b8bbc 103 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
059ec3d9 104
17c76198
PP
105/* This holds most state for server or client; with this, we can set up an
106outbound TLS-enabled connection in an ACL callout, while not stomping all
107over the TLS variables available for expansion.
059ec3d9 108
17c76198
PP
109Some of these correspond to variables in globals.c; those variables will
110be set to point to content in one of these instances, as appropriate for
111the stage of the process lifetime.
059ec3d9 112
389ca47a 113Not handled here: global tls_channelbinding_b64.
17c76198 114*/
059ec3d9 115
17c76198 116typedef struct exim_gnutls_state {
9d1c15ef 117 gnutls_session_t session;
17c76198 118 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 119 gnutls_priority_t priority_cache;
17c76198 120 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
121 int fd_in;
122 int fd_out;
123 BOOL peer_cert_verified;
899b8bbc 124 BOOL peer_dane_verified;
9d1c15ef
JH
125 BOOL trigger_sni_changes;
126 BOOL have_set_peerdn;
17c76198 127 const struct host_item *host;
9d1c15ef
JH
128 gnutls_x509_crt_t peercert;
129 uschar *peerdn;
130 uschar *ciphersuite;
131 uschar *received_sni;
17c76198
PP
132
133 const uschar *tls_certificate;
134 const uschar *tls_privatekey;
135 const uschar *tls_sni; /* client send only, not received */
136 const uschar *tls_verify_certificates;
137 const uschar *tls_crl;
138 const uschar *tls_require_ciphers;
e51c7be2 139
17c76198
PP
140 uschar *exp_tls_certificate;
141 uschar *exp_tls_privatekey;
17c76198
PP
142 uschar *exp_tls_verify_certificates;
143 uschar *exp_tls_crl;
144 uschar *exp_tls_require_ciphers;
55414b25 145 const uschar *exp_tls_verify_cert_hostnames;
0cbf2b82 146#ifndef DISABLE_EVENT
a7538db1
JH
147 uschar *event_action;
148#endif
899b8bbc
JH
149#ifdef SUPPORT_DANE
150 char * const * dane_data;
151 const int * dane_data_len;
152#endif
17c76198 153
389ca47a 154 tls_support *tlsp; /* set in tls_init() */
817d9f57 155
17c76198
PP
156 uschar *xfer_buffer;
157 int xfer_buffer_lwm;
158 int xfer_buffer_hwm;
8b77d27a
JH
159 BOOL xfer_eof; /*XXX never gets set! */
160 BOOL xfer_error;
17c76198
PP
161} exim_gnutls_state_st;
162
163static const exim_gnutls_state_st exim_gnutls_state_init = {
f2ed27cf
JH
164 .session = NULL,
165 .x509_cred = NULL,
166 .priority_cache = NULL,
167 .verify_requirement = VERIFY_NONE,
168 .fd_in = -1,
169 .fd_out = -1,
170 .peer_cert_verified = FALSE,
899b8bbc 171 .peer_dane_verified = FALSE,
f2ed27cf
JH
172 .trigger_sni_changes =FALSE,
173 .have_set_peerdn = FALSE,
174 .host = NULL,
175 .peercert = NULL,
176 .peerdn = NULL,
177 .ciphersuite = NULL,
178 .received_sni = NULL,
179
180 .tls_certificate = NULL,
181 .tls_privatekey = NULL,
182 .tls_sni = NULL,
183 .tls_verify_certificates = NULL,
184 .tls_crl = NULL,
185 .tls_require_ciphers =NULL,
186
187 .exp_tls_certificate = NULL,
188 .exp_tls_privatekey = NULL,
189 .exp_tls_verify_certificates = NULL,
190 .exp_tls_crl = NULL,
191 .exp_tls_require_ciphers = NULL,
f2ed27cf 192 .exp_tls_verify_cert_hostnames = NULL,
0cbf2b82 193#ifndef DISABLE_EVENT
f2ed27cf 194 .event_action = NULL,
a7538db1 195#endif
f2ed27cf
JH
196 .tlsp = NULL,
197
198 .xfer_buffer = NULL,
199 .xfer_buffer_lwm = 0,
200 .xfer_buffer_hwm = 0,
8b77d27a
JH
201 .xfer_eof = FALSE,
202 .xfer_error = FALSE,
17c76198 203};
83da1223 204
17c76198
PP
205/* Not only do we have our own APIs which don't pass around state, assuming
206it's held in globals, GnuTLS doesn't appear to let us register callback data
207for callbacks, or as part of the session, so we have to keep a "this is the
208context we're currently dealing with" pointer and rely upon being
209single-threaded to keep from processing data on an inbound TLS connection while
210talking to another TLS connection for an outbound check. This does mean that
211there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
212second connection.
213XXX But see gnutls_session_get_ptr()
214*/
059ec3d9 215
17c76198 216static exim_gnutls_state_st state_server, state_client;
059ec3d9 217
17c76198
PP
218/* dh_params are initialised once within the lifetime of a process using TLS;
219if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
220don't want to repeat this. */
83da1223 221
17c76198 222static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 223
17c76198 224/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 225
17c76198 226static const int ssl_session_timeout = 200;
059ec3d9 227
17c76198 228static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 229
17c76198 230/* Guard library core initialisation */
83da1223 231
17c76198 232static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 233
4fb7df6d 234#ifndef DISABLE_OCSP
9196d5bf 235static BOOL gnutls_buggy_ocsp = FALSE;
4fb7df6d 236#endif
9196d5bf 237
059ec3d9 238
17c76198 239/* ------------------------------------------------------------------------ */
17c76198 240/* macros */
83da1223 241
17c76198 242#define MAX_HOST_LEN 255
83da1223 243
17c76198
PP
244/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
245the library logging; a value less than 0 disables the calls to set up logging
ef9da2ee
JH
246callbacks. Possibly GNuTLS also looks for an environment variable
247"GNUTLS_DEBUG_LEVEL". */
2c17bb02 248#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
a7538db1 249# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 250#endif
83da1223 251
2c17bb02 252#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 253# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 254#endif
83da1223 255
af3498d6
PP
256/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
257can ask for a bit-strength. Without that, we stick to the constant we had
258before, for now. */
2c17bb02 259#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 260# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 261#endif
af3498d6 262
47195144
JH
263#define exim_gnutls_err_check(rc, Label) do { \
264 if ((rc) != GNUTLS_E_SUCCESS) \
cf0c6164
JH
265 return tls_error((Label), gnutls_strerror(rc), host, errstr); \
266 } while (0)
059ec3d9 267
cf0c6164
JH
268#define expand_check_tlsvar(Varname, errstr) \
269 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
83da1223 270
17c76198 271#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
272# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
273# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
274# define HAVE_GNUTLS_RND
2519e60d
TL
275/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
276 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
277 * isn't available sometimes, so this needs to become a conditional
278 * compilation; the sanest way to deal with this being a problem on
279 * older OSes is to block it in the Local/Makefile with this compiler
280 * definition */
e51c7be2
JH
281# ifndef AVOID_GNUTLS_PKCS11
282# define HAVE_GNUTLS_PKCS11
283# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 284#endif
83da1223 285
af3498d6
PP
286
287
288
289/* ------------------------------------------------------------------------ */
290/* Callback declarations */
291
292#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
293static void exim_gnutls_logger_cb(int level, const char *message);
294#endif
295
296static int exim_sni_handling_cb(gnutls_session_t session);
297
f2de3a33 298#ifndef DISABLE_OCSP
44662487
JH
299static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
300 gnutls_datum_t * ocsp_response);
301#endif
af3498d6
PP
302
303
304
17c76198
PP
305/* ------------------------------------------------------------------------ */
306/* Static functions */
059ec3d9
PH
307
308/*************************************************
309* Handle TLS error *
310*************************************************/
311
312/* Called from lots of places when errors occur before actually starting to do
313the TLS handshake, that is, while the session is still in clear. Always returns
314DEFER for a server and FAIL for a client so that most calls can use "return
315tls_error(...)" to do this processing and then give an appropriate return. A
316single function is used for both server and client, because it is called from
317some shared functions.
318
319Argument:
320 prefix text to include in the logged error
7199e1ee
TF
321 msg additional error string (may be NULL)
322 usually obtained from gnutls_strerror()
17c76198
PP
323 host NULL if setting up a server;
324 the connected host if setting up a client
cf0c6164 325 errstr pointer to returned error string
059ec3d9
PH
326
327Returns: OK/DEFER/FAIL
328*/
329
330static int
cf0c6164
JH
331tls_error(const uschar *prefix, const char *msg, const host_item *host,
332 uschar ** errstr)
059ec3d9 333{
cf0c6164
JH
334if (errstr)
335 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : "");
336return host ? FAIL : DEFER;
059ec3d9
PH
337}
338
339
340
17c76198 341
059ec3d9 342/*************************************************
17c76198 343* Deal with logging errors during I/O *
059ec3d9
PH
344*************************************************/
345
17c76198 346/* We have to get the identity of the peer from saved data.
059ec3d9 347
17c76198
PP
348Argument:
349 state the current GnuTLS exim state container
350 rc the GnuTLS error code, or 0 if it's a local error
351 when text identifying read or write
352 text local error text when ec is 0
059ec3d9 353
17c76198 354Returns: nothing
059ec3d9
PH
355*/
356
17c76198
PP
357static void
358record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 359{
cf0c6164
JH
360const char * msg;
361uschar * errstr;
059ec3d9 362
17c76198
PP
363if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
364 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
365 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
366else
367 msg = gnutls_strerror(rc);
059ec3d9 368
cf0c6164
JH
369(void) tls_error(when, msg, state->host, &errstr);
370
371if (state->host)
372 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
373 state->host->name, state->host->address, errstr);
374else
375 {
376 uschar * conn_info = smtp_get_connection_info();
377 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
378 /* I'd like to get separated H= here, but too hard for now */
379 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
380 }
17c76198 381}
059ec3d9 382
059ec3d9 383
059ec3d9 384
059ec3d9 385
17c76198
PP
386/*************************************************
387* Set various Exim expansion vars *
388*************************************************/
059ec3d9 389
e51c7be2
JH
390#define exim_gnutls_cert_err(Label) \
391 do \
392 { \
393 if (rc != GNUTLS_E_SUCCESS) \
394 { \
395 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
396 (Label), gnutls_strerror(rc)); \
397 return rc; \
398 } \
399 } while (0)
9d1c15ef
JH
400
401static int
27f19eb4 402import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
9d1c15ef
JH
403{
404int rc;
405
406rc = gnutls_x509_crt_init(crtp);
407exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
408
409rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
410exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
411
412return rc;
413}
414
415#undef exim_gnutls_cert_err
416
417
17c76198
PP
418/* We set various Exim global variables from the state, once a session has
419been established. With TLS callouts, may need to change this to stack
420variables, or just re-call it with the server state after client callout
421has finished.
059ec3d9 422
9d1c15ef 423Make sure anything set here is unset in tls_getc().
17c76198
PP
424
425Sets:
426 tls_active fd
427 tls_bits strength indicator
428 tls_certificate_verified bool indicator
429 tls_channelbinding_b64 for some SASL mechanisms
430 tls_cipher a string
9d1c15ef 431 tls_peercert pointer to library internal
17c76198
PP
432 tls_peerdn a string
433 tls_sni a (UTF-8) string
9d1c15ef 434 tls_ourcert pointer to library internal
17c76198
PP
435
436Argument:
437 state the relevant exim_gnutls_state_st *
438*/
439
440static void
9d1c15ef 441extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 442{
17c76198 443gnutls_cipher_algorithm_t cipher;
17c76198
PP
444#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
445int old_pool;
446int rc;
447gnutls_datum_t channel;
448#endif
9d1c15ef 449tls_support * tlsp = state->tlsp;
17c76198 450
9d1c15ef 451tlsp->active = state->fd_out;
17c76198
PP
452
453cipher = gnutls_cipher_get(state->session);
454/* returns size in "bytes" */
9d1c15ef 455tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 456
9d1c15ef 457tlsp->cipher = state->ciphersuite;
17c76198 458
817d9f57 459DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 460
9d1c15ef 461tlsp->certificate_verified = state->peer_cert_verified;
899b8bbc
JH
462#ifdef SUPPORT_DANE
463tlsp->dane_verified = state->peer_dane_verified;
464#endif
059ec3d9 465
17c76198
PP
466/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
467only available for use for authenticators while this TLS session is running. */
468
469tls_channelbinding_b64 = NULL;
470#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
471channel.data = NULL;
472channel.size = 0;
473rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
474if (rc) {
475 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
476} else {
477 old_pool = store_pool;
478 store_pool = POOL_PERM;
f4d091fb 479 tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
17c76198
PP
480 store_pool = old_pool;
481 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
482}
483#endif
484
9d1c15ef
JH
485/* peercert is set in peer_status() */
486tlsp->peerdn = state->peerdn;
487tlsp->sni = state->received_sni;
488
489/* record our certificate */
490 {
27f19eb4 491 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
9d1c15ef
JH
492 gnutls_x509_crt_t crt;
493
494 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
495 }
059ec3d9
PH
496}
497
498
499
17c76198 500
059ec3d9 501/*************************************************
575643cd 502* Setup up DH parameters *
059ec3d9
PH
503*************************************************/
504
575643cd 505/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
506be re-generated every so often, depending on security policy. What we do is to
507keep these parameters in a file in the spool directory. If the file does not
508exist, we generate them. This means that it is easy to cause a regeneration.
509
510The new file is written as a temporary file and renamed, so that an incomplete
511file is never present. If two processes both compute some new parameters, you
512waste a bit of effort, but it doesn't seem worth messing around with locking to
513prevent this.
514
059ec3d9
PH
515Returns: OK/DEFER/FAIL
516*/
517
518static int
cf0c6164 519init_server_dh(uschar ** errstr)
059ec3d9 520{
17c76198
PP
521int fd, rc;
522unsigned int dh_bits;
27f19eb4 523gnutls_datum_t m;
a799883d
PP
524uschar filename_buf[PATH_MAX];
525uschar *filename = NULL;
17c76198 526size_t sz;
a799883d
PP
527uschar *exp_tls_dhparam;
528BOOL use_file_in_spool = FALSE;
529BOOL use_fixed_file = FALSE;
17c76198 530host_item *host = NULL; /* dummy for macros */
059ec3d9 531
17c76198 532DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 533
17c76198 534rc = gnutls_dh_params_init(&dh_server_params);
47195144 535exim_gnutls_err_check(rc, US"gnutls_dh_params_init");
059ec3d9 536
a799883d
PP
537m.data = NULL;
538m.size = 0;
539
cf0c6164 540if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
a799883d
PP
541 return DEFER;
542
543if (!exp_tls_dhparam)
544 {
545 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
546 m.data = US std_dh_prime_default();
547 m.size = Ustrlen(m.data);
548 }
549else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
550 use_file_in_spool = TRUE;
551else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
552 {
553 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
554 return OK;
555 }
556else if (exp_tls_dhparam[0] != '/')
557 {
f5d25c2b 558 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
cf0c6164 559 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL, errstr);
a799883d
PP
560 m.size = Ustrlen(m.data);
561 }
562else
563 {
564 use_fixed_file = TRUE;
565 filename = exp_tls_dhparam;
566 }
567
568if (m.data)
569 {
570 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
47195144 571 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
a799883d
PP
572 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
573 return OK;
574 }
575
af3498d6
PP
576#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
577/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
578different filename and ensure we have sufficient bits. */
579dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
580if (!dh_bits)
cf0c6164 581 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
af3498d6 582DEBUG(D_tls)
b34fc30c 583 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
584 dh_bits);
585#else
586dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
587DEBUG(D_tls)
588 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
589 dh_bits);
590#endif
059ec3d9 591
3375e053
PP
592/* Some clients have hard-coded limits. */
593if (dh_bits > tls_dh_max_bits)
594 {
595 DEBUG(D_tls)
596 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
597 tls_dh_max_bits);
598 dh_bits = tls_dh_max_bits;
599 }
600
a799883d
PP
601if (use_file_in_spool)
602 {
603 if (!string_format(filename_buf, sizeof(filename_buf),
604 "%s/gnutls-params-%d", spool_directory, dh_bits))
cf0c6164 605 return tls_error(US"overlong filename", NULL, NULL, errstr);
a799883d
PP
606 filename = filename_buf;
607 }
059ec3d9 608
b5aea5e1 609/* Open the cache file for reading and if successful, read it and set up the
575643cd 610parameters. */
059ec3d9 611
f5d25c2b 612if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
059ec3d9 613 {
b5aea5e1 614 struct stat statbuf;
17c76198
PP
615 FILE *fp;
616 int saved_errno;
617
618 if (fstat(fd, &statbuf) < 0) /* EIO */
619 {
620 saved_errno = errno;
621 (void)close(fd);
cf0c6164 622 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL, errstr);
17c76198
PP
623 }
624 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
625 {
626 (void)close(fd);
cf0c6164 627 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
17c76198 628 }
40c90bca 629 if (!(fp = fdopen(fd, "rb")))
17c76198
PP
630 {
631 saved_errno = errno;
632 (void)close(fd);
633 return tls_error(US"fdopen(TLS cache stat fd) failed",
cf0c6164 634 strerror(saved_errno), NULL, errstr);
b5aea5e1 635 }
059ec3d9 636
b5aea5e1 637 m.size = statbuf.st_size;
40c90bca 638 if (!(m.data = malloc(m.size)))
17c76198
PP
639 {
640 fclose(fp);
cf0c6164 641 return tls_error(US"malloc failed", strerror(errno), NULL, errstr);
17c76198 642 }
40c90bca 643 if (!(sz = fread(m.data, m.size, 1, fp)))
17c76198
PP
644 {
645 saved_errno = errno;
646 fclose(fp);
647 free(m.data);
cf0c6164 648 return tls_error(US"fread failed", strerror(saved_errno), NULL, errstr);
17c76198
PP
649 }
650 fclose(fp);
b5aea5e1 651
17c76198 652 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 653 free(m.data);
47195144 654 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
17c76198 655 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
656 }
657
658/* If the file does not exist, fall through to compute new data and cache it.
659If there was any other opening error, it is serious. */
660
182ad5cf
PH
661else if (errno == ENOENT)
662 {
17c76198 663 rc = -1;
182ad5cf 664 DEBUG(D_tls)
17c76198 665 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
666 }
667else
17c76198 668 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
cf0c6164 669 NULL, NULL, errstr);
b5aea5e1
PH
670
671/* If ret < 0, either the cache file does not exist, or the data it contains
672is not useful. One particular case of this is when upgrading from an older
673release of Exim in which the data was stored in a different format. We don't
674try to be clever and support both formats; we just regenerate new data in this
675case. */
676
17c76198 677if (rc < 0)
b5aea5e1 678 {
17c76198 679 uschar *temp_fn;
201f5254 680 unsigned int dh_bits_gen = dh_bits;
059ec3d9 681
17c76198
PP
682 if ((PATH_MAX - Ustrlen(filename)) < 10)
683 return tls_error(US"Filename too long to generate replacement",
cf0c6164 684 CS filename, NULL, errstr);
059ec3d9 685
17c76198 686 temp_fn = string_copy(US "%s.XXXXXXX");
f5d25c2b 687 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
cf0c6164 688 return tls_error(US"Unable to open temp file", strerror(errno), NULL, errstr);
059ec3d9
PH
689 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
690
201f5254
PP
691 /* GnuTLS overshoots!
692 * If we ask for 2236, we might get 2237 or more.
693 * But there's no way to ask GnuTLS how many bits there really are.
694 * We can ask how many bits were used in a TLS session, but that's it!
695 * The prime itself is hidden behind too much abstraction.
696 * So we ask for less, and proceed on a wing and a prayer.
697 * First attempt, subtracted 3 for 2233 and got 2240.
698 */
cae6e576 699 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
700 {
701 dh_bits_gen = dh_bits - 10;
702 DEBUG(D_tls)
703 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
704 dh_bits_gen);
705 }
706
707 DEBUG(D_tls)
708 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
709 dh_bits_gen);
710 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
47195144 711 exim_gnutls_err_check(rc, US"gnutls_dh_params_generate2");
17c76198
PP
712
713 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
714 and I confirmed that a NULL call to get the size first is how the GnuTLS
715 sample apps handle this. */
716
717 sz = 0;
718 m.data = NULL;
719 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
720 m.data, &sz);
721 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
47195144 722 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3(NULL) sizing");
17c76198 723 m.size = sz;
40c90bca 724 if (!(m.data = malloc(m.size)))
cf0c6164 725 return tls_error(US"memory allocation failed", strerror(errno), NULL, errstr);
40c90bca 726
1f00591e 727 /* this will return a size 1 less than the allocation size above */
17c76198 728 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 729 m.data, &sz);
17c76198
PP
730 if (rc != GNUTLS_E_SUCCESS)
731 {
732 free(m.data);
47195144 733 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3() real");
17c76198 734 }
1f00591e 735 m.size = sz; /* shrink by 1, probably */
059ec3d9 736
f5d25c2b 737 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
17c76198
PP
738 {
739 free(m.data);
740 return tls_error(US"TLS cache write D-H params failed",
cf0c6164 741 strerror(errno), NULL, errstr);
17c76198 742 }
b5aea5e1 743 free(m.data);
f5d25c2b 744 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
17c76198 745 return tls_error(US"TLS cache write D-H params final newline failed",
cf0c6164 746 strerror(errno), NULL, errstr);
17c76198 747
f5d25c2b 748 if ((rc = close(fd)))
cf0c6164 749 return tls_error(US"TLS cache write close() failed", strerror(errno), NULL, errstr);
059ec3d9 750
17c76198
PP
751 if (Urename(temp_fn, filename) < 0)
752 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
cf0c6164 753 temp_fn, filename), strerror(errno), NULL, errstr);
059ec3d9 754
17c76198 755 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
756 }
757
17c76198 758DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
759return OK;
760}
761
762
763
764
23bb6982
JH
765/* Create and install a selfsigned certificate, for use in server mode */
766
767static int
cf0c6164 768tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
23bb6982
JH
769{
770gnutls_x509_crt_t cert = NULL;
771time_t now;
772gnutls_x509_privkey_t pkey = NULL;
773const uschar * where;
774int rc;
775
776where = US"initialising pkey";
777if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
778
779where = US"initialising cert";
780if ((rc = gnutls_x509_crt_init(&cert))) goto err;
781
782where = US"generating pkey";
783if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
76075bb5 784#ifdef SUPPORT_PARAM_TO_PK_BITS
23bb6982 785 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_LOW),
76075bb5
JH
786#else
787 1024,
788#endif
789 0)))
23bb6982
JH
790 goto err;
791
792where = US"configuring cert";
1613fd68 793now = 1;
23bb6982
JH
794if ( (rc = gnutls_x509_crt_set_version(cert, 3))
795 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
796 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
797 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
798 || (rc = gnutls_x509_crt_set_key(cert, pkey))
799
800 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
801 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
802 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
803 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
804 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
805 GNUTLS_OID_X520_COMMON_NAME, 0,
806 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
807 )
808 goto err;
809
810where = US"signing cert";
811if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
812
813where = US"installing selfsign cert";
814 /* Since: 2.4.0 */
815if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
816 goto err;
817
818rc = OK;
819
820out:
821 if (cert) gnutls_x509_crt_deinit(cert);
822 if (pkey) gnutls_x509_privkey_deinit(pkey);
823 return rc;
824
825err:
cf0c6164 826 rc = tls_error(where, gnutls_strerror(rc), NULL, errstr);
23bb6982
JH
827 goto out;
828}
829
830
831
832
47195144
JH
833/* Add certificate and key, from files.
834
835Return:
836 Zero or negative: good. Negate value for certificate index if < 0.
837 Greater than zero: FAIL or DEFER code.
838*/
839
ba86e143
JH
840static int
841tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
842 uschar * certfile, uschar * keyfile, uschar ** errstr)
843{
844int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
845 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
47195144
JH
846if (rc < 0)
847 return tls_error(
848 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
849 gnutls_strerror(rc), host, errstr);
850return -rc;
ba86e143
JH
851}
852
853
059ec3d9 854/*************************************************
17c76198 855* Variables re-expanded post-SNI *
059ec3d9
PH
856*************************************************/
857
17c76198
PP
858/* Called from both server and client code, via tls_init(), and also from
859the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
860
861We can tell the two apart by state->received_sni being non-NULL in callback.
862
863The callback should not call us unless state->trigger_sni_changes is true,
864which we are responsible for setting on the first pass through.
059ec3d9
PH
865
866Arguments:
17c76198 867 state exim_gnutls_state_st *
cf0c6164 868 errstr error string pointer
059ec3d9
PH
869
870Returns: OK/DEFER/FAIL
871*/
872
873static int
ba86e143 874tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
059ec3d9 875{
1365611d 876struct stat statbuf;
059ec3d9 877int rc;
17c76198
PP
878const host_item *host = state->host; /* macro should be reconsidered? */
879uschar *saved_tls_certificate = NULL;
880uschar *saved_tls_privatekey = NULL;
881uschar *saved_tls_verify_certificates = NULL;
882uschar *saved_tls_crl = NULL;
883int cert_count;
884
885/* We check for tls_sni *before* expansion. */
2b4a568d 886if (!host) /* server */
17c76198
PP
887 if (!state->received_sni)
888 {
ba86e143
JH
889 if ( state->tls_certificate
890 && ( Ustrstr(state->tls_certificate, US"tls_sni")
891 || Ustrstr(state->tls_certificate, US"tls_in_sni")
892 || Ustrstr(state->tls_certificate, US"tls_out_sni")
893 ) )
17c76198
PP
894 {
895 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
896 state->trigger_sni_changes = TRUE;
897 }
898 }
899 else
900 {
1365611d 901 /* useful for debugging */
17c76198
PP
902 saved_tls_certificate = state->exp_tls_certificate;
903 saved_tls_privatekey = state->exp_tls_privatekey;
904 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
905 saved_tls_crl = state->exp_tls_crl;
906 }
059ec3d9 907
1365611d 908rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
47195144
JH
909exim_gnutls_err_check(rc, US"gnutls_certificate_allocate_credentials");
910
911#ifdef SUPPORT_SRV_OCSP_STACK
912gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
913#endif
1365611d 914
17c76198
PP
915/* remember: expand_check_tlsvar() is expand_check() but fiddling with
916state members, assuming consistent naming; and expand_check() returns
917false if expansion failed, unless expansion was forced to fail. */
059ec3d9 918
17c76198
PP
919/* check if we at least have a certificate, before doing expensive
920D-H generation. */
059ec3d9 921
cf0c6164 922if (!expand_check_tlsvar(tls_certificate, errstr))
17c76198 923 return DEFER;
059ec3d9 924
17c76198 925/* certificate is mandatory in server, optional in client */
059ec3d9 926
23bb6982
JH
927if ( !state->exp_tls_certificate
928 || !*state->exp_tls_certificate
929 )
2b4a568d 930 if (!host)
cf0c6164 931 return tls_install_selfsign(state, errstr);
17c76198
PP
932 else
933 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
059ec3d9 934
cf0c6164 935if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
059ec3d9
PH
936 return DEFER;
937
17c76198
PP
938/* tls_privatekey is optional, defaulting to same file as certificate */
939
940if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 941 {
17c76198
PP
942 state->tls_privatekey = state->tls_certificate;
943 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 944 }
c91535f3 945
059ec3d9 946
17c76198 947if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
948 {
949 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
950 state->exp_tls_certificate, state->exp_tls_privatekey);
951
952 if (state->received_sni)
23bb6982
JH
953 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
954 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
955 )
17c76198 956 {
b34fc30c 957 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
958 }
959 else
960 {
b34fc30c 961 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 962 }
059ec3d9 963
ba86e143
JH
964 if (!host) /* server */
965 {
966 const uschar * clist = state->exp_tls_certificate;
967 const uschar * klist = state->exp_tls_privatekey;
47195144
JH
968 const uschar * olist;
969 int csep = 0, ksep = 0, osep = 0, cnt = 0;
970 uschar * cfile, * kfile, * ofile;
971
972#ifndef DISABLE_OCSP
973 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
974 return DEFER;
975 olist = ofile;
976#endif
ba86e143
JH
977
978 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
47195144 979
ba86e143
JH
980 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
981 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
47195144 982 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
ba86e143
JH
983 return rc;
984 else
47195144
JH
985 {
986 int gnutls_cert_index = -rc;
ba86e143 987 DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile);
47195144
JH
988
989 /* Set the OCSP stapling server info */
990
991#ifndef DISABLE_OCSP
992 if (tls_ocsp_file)
993 if (gnutls_buggy_ocsp)
994 {
995 DEBUG(D_tls)
996 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
997 }
998 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
999 {
1000 /* Use the full callback method for stapling just to get
1001 observability. More efficient would be to read the file once only,
1002 if it never changed (due to SNI). Would need restart on file update,
1003 or watch datestamp. */
1004
1005# ifdef SUPPORT_SRV_OCSP_STACK
1006 rc = gnutls_certificate_set_ocsp_status_request_function2(
1007 state->x509_cred, gnutls_cert_index,
1008 server_ocsp_stapling_cb, ofile);
1009
1010 exim_gnutls_err_check(rc,
1011 US"gnutls_certificate_set_ocsp_status_request_function2");
1012# else
1013 if (cnt++ > 0)
1014 {
1015 DEBUG(D_tls)
1016 debug_printf("oops; multiple OCSP files not supported\n");
1017 break;
1018 }
1019 gnutls_certificate_set_ocsp_status_request_function(
1020 state->x509_cred, server_ocsp_stapling_cb, ofile);
1021# endif
1022
1023 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile);
1024 }
1025 else
1026 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1027#endif
1028 }
ba86e143
JH
1029 }
1030 else
1031 {
47195144 1032 if (0 < (rc = tls_add_certfile(state, host,
ba86e143
JH
1033 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1034 return rc;
1035 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1036 }
1037
b34fc30c 1038 } /* tls_certificate */
059ec3d9 1039
2b4a568d 1040
059ec3d9
PH
1041/* Set the trusted CAs file if one is provided, and then add the CRL if one is
1042provided. Experiment shows that, if the certificate file is empty, an unhelpful
1043error message is provided. However, if we just refrain from setting anything up
1044in that case, certificate verification fails, which seems to be the correct
1045behaviour. */
1046
610ff438 1047if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 1048 {
cf0c6164 1049 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
059ec3d9 1050 return DEFER;
610ff438
JH
1051#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1052 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1053 state->exp_tls_verify_certificates = NULL;
1054#endif
17c76198 1055 if (state->tls_crl && *state->tls_crl)
cf0c6164 1056 if (!expand_check_tlsvar(tls_crl, errstr))
17c76198 1057 return DEFER;
059ec3d9 1058
1365611d
PP
1059 if (!(state->exp_tls_verify_certificates &&
1060 *state->exp_tls_verify_certificates))
b34fc30c
PP
1061 {
1062 DEBUG(D_tls)
1365611d
PP
1063 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1064 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 1065 return OK;
b34fc30c 1066 }
1365611d 1067 }
83e2f8a2
PP
1068else
1069 {
1070 DEBUG(D_tls)
1071 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1072 return OK;
1073 }
17c76198 1074
cb1d7830
JH
1075#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1076if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1077 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1078else
1079#endif
1365611d 1080 {
cb1d7830
JH
1081 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1082 {
1083 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1084 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1085 strerror(errno));
1086 return DEFER;
1087 }
17c76198 1088
a7fec7a7 1089#ifndef SUPPORT_CA_DIR
cb1d7830
JH
1090 /* The test suite passes in /dev/null; we could check for that path explicitly,
1091 but who knows if someone has some weird FIFO which always dumps some certs, or
1092 other weirdness. The thing we really want to check is that it's not a
1093 directory, since while OpenSSL supports that, GnuTLS does not.
60f914bc 1094 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
cb1d7830
JH
1095 if (S_ISDIR(statbuf.st_mode))
1096 {
1097 DEBUG(D_tls)
1098 debug_printf("verify certificates path is a dir: \"%s\"\n",
1099 state->exp_tls_verify_certificates);
1100 log_write(0, LOG_MAIN|LOG_PANIC,
1101 "tls_verify_certificates \"%s\" is a directory",
1102 state->exp_tls_verify_certificates);
1103 return DEFER;
1104 }
a7fec7a7 1105#endif
059ec3d9 1106
cb1d7830
JH
1107 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1108 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 1109
cb1d7830
JH
1110 if (statbuf.st_size == 0)
1111 {
1112 DEBUG(D_tls)
1113 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1114 return OK;
1115 }
059ec3d9 1116
cb1d7830 1117 cert_count =
a7fec7a7
JH
1118
1119#ifdef SUPPORT_CA_DIR
cb1d7830
JH
1120 (statbuf.st_mode & S_IFMT) == S_IFDIR
1121 ?
1122 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1123 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1124 :
a7fec7a7 1125#endif
cb1d7830
JH
1126 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1127 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1128 }
a7fec7a7 1129
1365611d
PP
1130if (cert_count < 0)
1131 {
1132 rc = cert_count;
47195144 1133 exim_gnutls_err_check(rc, US"setting certificate trust");
1365611d
PP
1134 }
1135DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 1136
5c8cda3a
PP
1137if (state->tls_crl && *state->tls_crl &&
1138 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 1139 {
5c8cda3a
PP
1140 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1141 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1142 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1143 if (cert_count < 0)
1365611d 1144 {
5c8cda3a 1145 rc = cert_count;
47195144 1146 exim_gnutls_err_check(rc, US"gnutls_certificate_set_x509_crl_file");
1365611d 1147 }
5c8cda3a 1148 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 1149 }
059ec3d9 1150
059ec3d9
PH
1151return OK;
1152}
1153
1154
1155
1156
1157/*************************************************
1365611d
PP
1158* Set X.509 state variables *
1159*************************************************/
1160
1161/* In GnuTLS, the registered cert/key are not replaced by a later
1162set of a cert/key, so for SNI support we need a whole new x509_cred
1163structure. Which means various other non-re-expanded pieces of state
1164need to be re-set in the new struct, so the setting logic is pulled
1165out to this.
1166
1167Arguments:
1168 state exim_gnutls_state_st *
cf0c6164 1169 errstr error string pointer
1365611d
PP
1170
1171Returns: OK/DEFER/FAIL
1172*/
1173
1174static int
cf0c6164 1175tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1365611d
PP
1176{
1177int rc;
1178const host_item *host = state->host; /* macro should be reconsidered? */
1179
1180/* Create D-H parameters, or read them from the cache file. This function does
1181its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1182client-side params. */
1183
1184if (!state->host)
1185 {
1186 if (!dh_server_params)
1187 {
cf0c6164 1188 rc = init_server_dh(errstr);
1365611d
PP
1189 if (rc != OK) return rc;
1190 }
1191 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1192 }
1193
1194/* Link the credentials to the session. */
1195
1196rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
47195144 1197exim_gnutls_err_check(rc, US"gnutls_credentials_set");
1365611d
PP
1198
1199return OK;
1200}
1201
1202/*************************************************
17c76198 1203* Initialize for GnuTLS *
059ec3d9
PH
1204*************************************************/
1205
9196d5bf 1206
4fb7df6d
JH
1207#ifndef DISABLE_OCSP
1208
9196d5bf
JH
1209static BOOL
1210tls_is_buggy_ocsp(void)
1211{
1212const uschar * s;
1213uschar maj, mid, mic;
1214
1215s = CUS gnutls_check_version(NULL);
1216maj = atoi(CCS s);
1217if (maj == 3)
1218 {
1219 while (*s && *s != '.') s++;
1220 mid = atoi(CCS ++s);
1221 if (mid <= 2)
1222 return TRUE;
1223 else if (mid >= 5)
1224 return FALSE;
1225 else
1226 {
1227 while (*s && *s != '.') s++;
1228 mic = atoi(CCS ++s);
1229 return mic <= (mid == 3 ? 16 : 3);
1230 }
1231 }
1232return FALSE;
1233}
1234
4fb7df6d 1235#endif
9196d5bf
JH
1236
1237
17c76198
PP
1238/* Called from both server and client code. In the case of a server, errors
1239before actual TLS negotiation return DEFER.
059ec3d9
PH
1240
1241Arguments:
17c76198
PP
1242 host connected host, if client; NULL if server
1243 certificate certificate file
1244 privatekey private key file
1245 sni TLS SNI to send, sometimes when client; else NULL
1246 cas CA certs file
1247 crl CRL file
1248 require_ciphers tls_require_ciphers setting
817d9f57 1249 caller_state returned state-info structure
cf0c6164 1250 errstr error string pointer
059ec3d9 1251
17c76198 1252Returns: OK/DEFER/FAIL
059ec3d9
PH
1253*/
1254
17c76198
PP
1255static int
1256tls_init(
1257 const host_item *host,
1258 const uschar *certificate,
1259 const uschar *privatekey,
1260 const uschar *sni,
1261 const uschar *cas,
1262 const uschar *crl,
1263 const uschar *require_ciphers,
cf0c6164
JH
1264 exim_gnutls_state_st **caller_state,
1265 uschar ** errstr)
059ec3d9 1266{
17c76198
PP
1267exim_gnutls_state_st *state;
1268int rc;
1269size_t sz;
1270const char *errpos;
1271uschar *p;
1272BOOL want_default_priorities;
1273
1274if (!exim_gnutls_base_init_done)
059ec3d9 1275 {
17c76198
PP
1276 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1277
a5f239e4
PP
1278#ifdef HAVE_GNUTLS_PKCS11
1279 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1280 which loads modules from a config file, which sounds good and may be wanted
1281 by some sysadmin, but also means in common configurations that GNOME keyring
1282 environment variables are used and so breaks for users calling mailq.
1283 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1284 if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
1285 {
1286 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
47195144 1287 exim_gnutls_err_check(rc, US"gnutls_pkcs11_init");
a5f239e4
PP
1288 }
1289#endif
1290
17c76198 1291 rc = gnutls_global_init();
47195144 1292 exim_gnutls_err_check(rc, US"gnutls_global_init");
17c76198
PP
1293
1294#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1295 DEBUG(D_tls)
059ec3d9 1296 {
17c76198
PP
1297 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1298 /* arbitrarily chosen level; bump upto 9 for more */
1299 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1300 }
17c76198
PP
1301#endif
1302
4fb7df6d
JH
1303#ifndef DISABLE_OCSP
1304 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
9196d5bf 1305 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
4fb7df6d 1306#endif
9196d5bf 1307
17c76198 1308 exim_gnutls_base_init_done = TRUE;
059ec3d9 1309 }
059ec3d9 1310
17c76198
PP
1311if (host)
1312 {
1313 state = &state_client;
1314 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 1315 state->tlsp = &tls_out;
17c76198
PP
1316 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1317 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1318 }
1319else
1320 {
1321 state = &state_server;
1322 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 1323 state->tlsp = &tls_in;
17c76198
PP
1324 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1325 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1326 }
47195144 1327exim_gnutls_err_check(rc, US"gnutls_init");
059ec3d9 1328
17c76198 1329state->host = host;
059ec3d9 1330
17c76198
PP
1331state->tls_certificate = certificate;
1332state->tls_privatekey = privatekey;
5779e6aa 1333state->tls_require_ciphers = require_ciphers;
17c76198
PP
1334state->tls_sni = sni;
1335state->tls_verify_certificates = cas;
1336state->tls_crl = crl;
059ec3d9 1337
17c76198
PP
1338/* This handles the variables that might get re-expanded after TLS SNI;
1339that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1340
17c76198
PP
1341DEBUG(D_tls)
1342 debug_printf("Expanding various TLS configuration options for session credentials.\n");
cf0c6164 1343if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
059ec3d9 1344
1365611d
PP
1345/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1346requires a new structure afterwards. */
83da1223 1347
cf0c6164 1348if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
83da1223 1349
17c76198
PP
1350/* set SNI in client, only */
1351if (host)
1352 {
cf0c6164 1353 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
17c76198 1354 return DEFER;
0df4ab80 1355 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1356 {
1357 DEBUG(D_tls)
0df4ab80
JH
1358 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1359 sz = Ustrlen(state->tlsp->sni);
17c76198 1360 rc = gnutls_server_name_set(state->session,
0df4ab80 1361 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
47195144 1362 exim_gnutls_err_check(rc, US"gnutls_server_name_set");
17c76198
PP
1363 }
1364 }
1365else if (state->tls_sni)
1366 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
ba86e143 1367 "have an SNI set for a server [%s]\n", state->tls_sni);
83da1223 1368
17c76198 1369/* This is the priority string support,
42bfef1e 1370http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1371and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1372This was backwards incompatible, but means Exim no longer needs to track
1373all algorithms and provide string forms for them. */
83da1223 1374
17c76198 1375want_default_priorities = TRUE;
83da1223 1376
17c76198 1377if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1378 {
cf0c6164 1379 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
17c76198
PP
1380 return DEFER;
1381 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1382 {
17c76198
PP
1383 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1384 state->exp_tls_require_ciphers);
1385
1386 rc = gnutls_priority_init(&state->priority_cache,
1387 CS state->exp_tls_require_ciphers, &errpos);
1388 want_default_priorities = FALSE;
1389 p = state->exp_tls_require_ciphers;
83da1223
PH
1390 }
1391 }
17c76198
PP
1392if (want_default_priorities)
1393 {
83e2f8a2
PP
1394 DEBUG(D_tls)
1395 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1396 exim_default_gnutls_priority);
17c76198
PP
1397 rc = gnutls_priority_init(&state->priority_cache,
1398 exim_default_gnutls_priority, &errpos);
1399 p = US exim_default_gnutls_priority;
1400 }
83da1223 1401
47195144 1402exim_gnutls_err_check(rc, string_sprintf(
17c76198
PP
1403 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1404 p, errpos - CS p, errpos));
1405
1406rc = gnutls_priority_set(state->session, state->priority_cache);
47195144 1407exim_gnutls_err_check(rc, US"gnutls_priority_set");
17c76198
PP
1408
1409gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1410
1411/* Reduce security in favour of increased compatibility, if the admin
1412decides to make that trade-off. */
1413if (gnutls_compat_mode)
83da1223 1414 {
17c76198
PP
1415#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1416 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1417 gnutls_session_enable_compatibility_mode(state->session);
1418#else
1419 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1420#endif
83da1223
PH
1421 }
1422
17c76198 1423*caller_state = state;
17c76198 1424return OK;
83da1223
PH
1425}
1426
1427
1428
83da1223 1429/*************************************************
17c76198 1430* Extract peer information *
059ec3d9
PH
1431*************************************************/
1432
17c76198 1433/* Called from both server and client code.
4fe99a6c
PP
1434Only this is allowed to set state->peerdn and state->have_set_peerdn
1435and we use that to detect double-calls.
059ec3d9 1436
75fe387d
PP
1437NOTE: the state blocks last while the TLS connection is up, which is fine
1438for logging in the server side, but for the client side, we log after teardown
1439in src/deliver.c. While the session is up, we can twist about states and
1440repoint tls_* globals, but those variables used for logging or other variable
1441expansion that happens _after_ delivery need to have a longer life-time.
1442
1443So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1444doing this more than once per generation of a state context. We set them in
1445the state context, and repoint tls_* to them. After the state goes away, the
1446tls_* copies of the pointers remain valid and client delivery logging is happy.
1447
1448tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1449don't apply.
1450
059ec3d9 1451Arguments:
17c76198 1452 state exim_gnutls_state_st *
cf0c6164 1453 errstr pointer to error string
059ec3d9 1454
17c76198 1455Returns: OK/DEFER/FAIL
059ec3d9
PH
1456*/
1457
17c76198 1458static int
cf0c6164 1459peer_status(exim_gnutls_state_st *state, uschar ** errstr)
059ec3d9 1460{
75fe387d 1461uschar cipherbuf[256];
27f19eb4 1462const gnutls_datum_t *cert_list;
75fe387d 1463int old_pool, rc;
17c76198 1464unsigned int cert_list_size = 0;
4fe99a6c
PP
1465gnutls_protocol_t protocol;
1466gnutls_cipher_algorithm_t cipher;
1467gnutls_kx_algorithm_t kx;
1468gnutls_mac_algorithm_t mac;
17c76198
PP
1469gnutls_certificate_type_t ct;
1470gnutls_x509_crt_t crt;
4fe99a6c 1471uschar *p, *dn_buf;
17c76198 1472size_t sz;
059ec3d9 1473
4fe99a6c 1474if (state->have_set_peerdn)
17c76198 1475 return OK;
4fe99a6c 1476state->have_set_peerdn = TRUE;
059ec3d9 1477
4fe99a6c 1478state->peerdn = NULL;
059ec3d9 1479
4fe99a6c
PP
1480/* tls_cipher */
1481cipher = gnutls_cipher_get(state->session);
1482protocol = gnutls_protocol_get_version(state->session);
1483mac = gnutls_mac_get(state->session);
1484kx = gnutls_kx_get(state->session);
1485
75fe387d 1486string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1487 "%s:%s:%d",
1488 gnutls_protocol_get_name(protocol),
1489 gnutls_cipher_suite_get_name(kx, cipher, mac),
1490 (int) gnutls_cipher_get_key_size(cipher) * 8);
1491
1492/* I don't see a way that spaces could occur, in the current GnuTLS
1493code base, but it was a concern in the old code and perhaps older GnuTLS
1494releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1495for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1496 if (isspace(*p))
1497 *p = '-';
75fe387d
PP
1498old_pool = store_pool;
1499store_pool = POOL_PERM;
1500state->ciphersuite = string_copy(cipherbuf);
1501store_pool = old_pool;
817d9f57 1502state->tlsp->cipher = state->ciphersuite;
4fe99a6c
PP
1503
1504/* tls_peerdn */
17c76198 1505cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1506
17c76198
PP
1507if (cert_list == NULL || cert_list_size == 0)
1508 {
17c76198
PP
1509 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1510 cert_list, cert_list_size);
e51c7be2 1511 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1512 return tls_error(US"certificate verification failed",
cf0c6164 1513 "no certificate received from peer", state->host, errstr);
17c76198
PP
1514 return OK;
1515 }
059ec3d9 1516
17c76198
PP
1517ct = gnutls_certificate_type_get(state->session);
1518if (ct != GNUTLS_CRT_X509)
059ec3d9 1519 {
17c76198 1520 const char *ctn = gnutls_certificate_type_get_name(ct);
17c76198
PP
1521 DEBUG(D_tls)
1522 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1523 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1524 return tls_error(US"certificate verification not possible, unhandled type",
cf0c6164 1525 ctn, state->host, errstr);
17c76198 1526 return OK;
83da1223 1527 }
059ec3d9 1528
e51c7be2
JH
1529#define exim_gnutls_peer_err(Label) \
1530 do { \
1531 if (rc != GNUTLS_E_SUCCESS) \
1532 { \
1533 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1534 (Label), gnutls_strerror(rc)); \
1535 if (state->verify_requirement >= VERIFY_REQUIRED) \
cf0c6164 1536 return tls_error((Label), gnutls_strerror(rc), state->host, errstr); \
e51c7be2
JH
1537 return OK; \
1538 } \
1539 } while (0)
17c76198 1540
9d1c15ef
JH
1541rc = import_cert(&cert_list[0], &crt);
1542exim_gnutls_peer_err(US"cert 0");
1543
1544state->tlsp->peercert = state->peercert = crt;
17c76198 1545
17c76198
PP
1546sz = 0;
1547rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1548if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1549 {
17c76198
PP
1550 exim_gnutls_peer_err(US"getting size for cert DN failed");
1551 return FAIL; /* should not happen */
059ec3d9 1552 }
17c76198
PP
1553dn_buf = store_get_perm(sz);
1554rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1555exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1556
17c76198
PP
1557state->peerdn = dn_buf;
1558
1559return OK;
1560#undef exim_gnutls_peer_err
1561}
059ec3d9 1562
059ec3d9 1563
059ec3d9 1564
059ec3d9 1565
17c76198
PP
1566/*************************************************
1567* Verify peer certificate *
1568*************************************************/
059ec3d9 1569
17c76198
PP
1570/* Called from both server and client code.
1571*Should* be using a callback registered with
1572gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1573the peer information, but that's too new for some OSes.
059ec3d9 1574
17c76198 1575Arguments:
899b8bbc
JH
1576 state exim_gnutls_state_st *
1577 errstr where to put an error message
059ec3d9 1578
17c76198
PP
1579Returns:
1580 FALSE if the session should be rejected
1581 TRUE if the cert is okay or we just don't care
1582*/
059ec3d9 1583
17c76198 1584static BOOL
28646fa9 1585verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
17c76198
PP
1586{
1587int rc;
899b8bbc
JH
1588uint verify;
1589
1590if (state->verify_requirement == VERIFY_NONE)
1591 return TRUE;
17c76198 1592
cf0c6164 1593*errstr = NULL;
17c76198 1594
cf0c6164 1595if ((rc = peer_status(state, errstr)) != OK)
e6060e2c 1596 {
17c76198 1597 verify = GNUTLS_CERT_INVALID;
cf0c6164 1598 *errstr = US"certificate not supplied";
17c76198
PP
1599 }
1600else
899b8bbc
JH
1601
1602 {
1603#ifdef SUPPORT_DANE
1604 if (state->verify_requirement == VERIFY_DANE && state->host)
1605 {
1606 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1607 including talking to a DNS resolver. But we want to do that bit ourselves
1608 as the testsuite intercepts and fakes its own DNS environment. */
1609
1610 dane_state_t s;
1611 dane_query_t r;
899b8bbc 1612 uint lsize;
94c13285
JH
1613 const gnutls_datum_t * certlist =
1614 gnutls_certificate_get_peers(state->session, &lsize);
1615 int usage = tls_out.tlsa_usage;
1616
1617# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1618 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1619 dane-verification separately so that we know which selector verified;
1620 then we know whether to do CA-chain-verification and name-verification
1621 (needed for TA but not EE). */
1622
1623 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
bd5b3f3c 1624 { /* a mixed-usage bundle */
94c13285
JH
1625 int i, j, nrec;
1626 const char ** dd;
1627 int * ddl;
1628
1629 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1630 nrec++;
1631
1632 dd = store_get(nrec * sizeof(uschar *));
1633 ddl = store_get(nrec * sizeof(int));
1634 nrec--;
1635
1636 if ((rc = dane_state_init(&s, 0)))
1637 goto tlsa_prob;
1638
1639 for (usage = DANESSL_USAGE_DANE_EE;
1640 usage >= DANESSL_USAGE_DANE_TA; usage--)
1641 { /* take records with this usage */
1642 for (j = i = 0; i < nrec; i++)
1643 if (state->dane_data[i][0] == usage)
1644 {
1645 dd[j] = state->dane_data[i];
1646 ddl[j++] = state->dane_data_len[i];
1647 }
1648 if (j)
1649 {
1650 dd[j] = NULL;
1651 ddl[j] = 0;
1652
1653 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1654 goto tlsa_prob;
1655
1656 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1657 gnutls_certificate_type_get(state->session),
1658 r, 0,
1659 usage == DANESSL_USAGE_DANE_EE
1660 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1661 &verify)))
1662 {
1663 DEBUG(D_tls)
1664 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1665 }
1666 else if (verify == 0) /* verification passed */
1667 {
1668 usage = 1 << usage;
1669 break;
1670 }
1671 }
1672 }
899b8bbc 1673
94c13285
JH
1674 if (rc) goto tlsa_prob;
1675 }
1676 else
1677# endif
899b8bbc 1678 {
94c13285
JH
1679 if ( (rc = dane_state_init(&s, 0))
1680 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1681 1, 0))
1682 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1683 gnutls_certificate_type_get(state->session),
5ec37a55 1684 r, 0,
94c13285
JH
1685# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1686 usage == (1 << DANESSL_USAGE_DANE_EE)
1687 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1688# else
1689 0,
1690# endif
1691 &verify))
1692 )
1693 goto tlsa_prob;
899b8bbc 1694 }
94c13285
JH
1695
1696 if (verify != 0) /* verification failed */
899b8bbc
JH
1697 {
1698 gnutls_datum_t str;
1699 (void) dane_verification_status_print(verify, &str, 0);
1700 *errstr = US str.data; /* don't bother to free */
1701 goto badcert;
1702 }
1703 state->peer_dane_verified = TRUE;
28646fa9 1704
94c13285
JH
1705# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1706 /* If a TA-mode TLSA record was used for verification we must additionally
1707 verify the CA chain and the cert name. For EE-mode, skip it. */
28646fa9 1708
94c13285
JH
1709 if (usage & (1 << DANESSL_USAGE_DANE_EE))
1710# endif
28646fa9
JH
1711 {
1712 state->peer_cert_verified = TRUE;
1713 goto goodcert;
1714 }
899b8bbc
JH
1715 }
1716#endif
1717
17c76198 1718 rc = gnutls_certificate_verify_peers2(state->session, &verify);
899b8bbc 1719 }
e6060e2c 1720
899b8bbc 1721/* Handle the result of verification. INVALID is set if any others are. */
059ec3d9 1722
28646fa9 1723if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
17c76198
PP
1724 {
1725 state->peer_cert_verified = FALSE;
cf0c6164
JH
1726 if (!*errstr)
1727 *errstr = verify & GNUTLS_CERT_REVOKED
1728 ? US"certificate revoked" : US"certificate invalid";
059ec3d9 1729
17c76198 1730 DEBUG(D_tls)
e51c7be2 1731 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
cf0c6164 1732 *errstr, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1733
e51c7be2 1734 if (state->verify_requirement >= VERIFY_REQUIRED)
899b8bbc 1735 goto badcert;
17c76198 1736 DEBUG(D_tls)
4789da3a 1737 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 1738 }
e51c7be2 1739
17c76198
PP
1740else
1741 {
aa2a70ba 1742 if (state->exp_tls_verify_cert_hostnames)
e51c7be2
JH
1743 {
1744 int sep = 0;
55414b25 1745 const uschar * list = state->exp_tls_verify_cert_hostnames;
e51c7be2 1746 uschar * name;
76075bb5 1747 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
e51c7be2
JH
1748 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1749 break;
1750 if (!name)
1751 {
1752 DEBUG(D_tls)
1753 debug_printf("TLS certificate verification failed: cert name mismatch\n");
aa2a70ba 1754 if (state->verify_requirement >= VERIFY_REQUIRED)
899b8bbc 1755 goto badcert;
aa2a70ba 1756 return TRUE;
e51c7be2
JH
1757 }
1758 }
17c76198 1759 state->peer_cert_verified = TRUE;
e51c7be2 1760 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 1761 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1762 }
059ec3d9 1763
28646fa9
JH
1764goodcert:
1765 state->tlsp->peerdn = state->peerdn;
1766 return TRUE;
899b8bbc 1767
b83314e3 1768#ifdef SUPPORT_DANE
94c13285
JH
1769tlsa_prob:
1770 *errstr = string_sprintf("TLSA record problem: %s", dane_strerror(rc));
b83314e3
JH
1771#endif
1772
899b8bbc
JH
1773badcert:
1774 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1775 return FALSE;
17c76198 1776}
059ec3d9 1777
17c76198
PP
1778
1779
1780
1781/* ------------------------------------------------------------------------ */
1782/* Callbacks */
1783
1784/* Logging function which can be registered with
1785 * gnutls_global_set_log_function()
1786 * gnutls_global_set_log_level() 0..9
1787 */
af3498d6 1788#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1789static void
17c76198 1790exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1791{
8c79eebf
PP
1792 size_t len = strlen(message);
1793 if (len < 1)
1794 {
1795 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1796 return;
1797 }
1798 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1799 message[len-1] == '\n' ? "" : "\n");
17c76198 1800}
af3498d6 1801#endif
059ec3d9 1802
059ec3d9 1803
17c76198
PP
1804/* Called after client hello, should handle SNI work.
1805This will always set tls_sni (state->received_sni) if available,
1806and may trigger presenting different certificates,
1807if state->trigger_sni_changes is TRUE.
059ec3d9 1808
17c76198
PP
1809Should be registered with
1810 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1811
17c76198
PP
1812"This callback must return 0 on success or a gnutls error code to terminate the
1813handshake.".
059ec3d9 1814
17c76198
PP
1815For inability to get SNI information, we return 0.
1816We only return non-zero if re-setup failed.
817d9f57 1817Only used for server-side TLS.
17c76198 1818*/
44bbabb5 1819
17c76198
PP
1820static int
1821exim_sni_handling_cb(gnutls_session_t session)
1822{
1823char sni_name[MAX_HOST_LEN];
1824size_t data_len = MAX_HOST_LEN;
817d9f57 1825exim_gnutls_state_st *state = &state_server;
17c76198
PP
1826unsigned int sni_type;
1827int rc, old_pool;
cf0c6164 1828uschar * dummy_errstr;
17c76198
PP
1829
1830rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1831if (rc != GNUTLS_E_SUCCESS)
1832 {
1833 DEBUG(D_tls) {
1834 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1835 debug_printf("TLS: no SNI presented in handshake.\n");
1836 else
1837 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1838 gnutls_strerror(rc), rc);
cf0c6164 1839 }
b34fc30c
PP
1840 return 0;
1841 }
1842
17c76198
PP
1843if (sni_type != GNUTLS_NAME_DNS)
1844 {
1845 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1846 return 0;
1847 }
44bbabb5 1848
17c76198
PP
1849/* We now have a UTF-8 string in sni_name */
1850old_pool = store_pool;
1851store_pool = POOL_PERM;
1852state->received_sni = string_copyn(US sni_name, data_len);
1853store_pool = old_pool;
1854
1855/* We set this one now so that variable expansions below will work */
817d9f57 1856state->tlsp->sni = state->received_sni;
17c76198
PP
1857
1858DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1859 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1860
1861if (!state->trigger_sni_changes)
1862 return 0;
1863
cf0c6164 1864if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
17c76198
PP
1865 {
1866 /* If the setup of certs/etc failed before handshake, TLS would not have
1867 been offered. The best we can do now is abort. */
1868 return GNUTLS_E_APPLICATION_ERROR_MIN;
1869 }
1870
cf0c6164 1871rc = tls_set_remaining_x509(state, &dummy_errstr);
1365611d
PP
1872if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1873
1874return 0;
059ec3d9
PH
1875}
1876
1877
1878
f2de3a33 1879#ifndef DISABLE_OCSP
44662487
JH
1880
1881static int
1882server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1883 gnutls_datum_t * ocsp_response)
1884{
1885int ret;
47195144 1886DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
44662487 1887
44662487
JH
1888if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1889 {
1890 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
5903c6ff 1891 CS ptr);
018058b2 1892 tls_in.ocsp = OCSP_NOT_RESP;
44662487
JH
1893 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1894 }
1895
018058b2 1896tls_in.ocsp = OCSP_VFY_NOT_TRIED;
44662487
JH
1897return 0;
1898}
1899
1900#endif
1901
1902
0cbf2b82 1903#ifndef DISABLE_EVENT
a7538db1
JH
1904/*
1905We use this callback to get observability and detail-level control
723fe533
JH
1906for an exim TLS connection (either direction), raising a tls:cert event
1907for each cert in the chain presented by the peer. Any event
a7538db1
JH
1908can deny verification.
1909
1910Return 0 for the handshake to continue or non-zero to terminate.
1911*/
1912
1913static int
723fe533 1914verify_cb(gnutls_session_t session)
a7538db1 1915{
27f19eb4 1916const gnutls_datum_t * cert_list;
a7538db1
JH
1917unsigned int cert_list_size = 0;
1918gnutls_x509_crt_t crt;
1919int rc;
b30275b8 1920uschar * yield;
a7538db1
JH
1921exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1922
bd5b3f3c 1923if ((cert_list = gnutls_certificate_get_peers(session, &cert_list_size)))
a7538db1
JH
1924 while (cert_list_size--)
1925 {
bd5b3f3c 1926 if ((rc = import_cert(&cert_list[cert_list_size], &crt)) != GNUTLS_E_SUCCESS)
a7538db1
JH
1927 {
1928 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1929 cert_list_size, gnutls_strerror(rc));
1930 break;
1931 }
1932
1933 state->tlsp->peercert = crt;
b30275b8
JH
1934 if ((yield = event_raise(state->event_action,
1935 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
1936 {
1937 log_write(0, LOG_MAIN,
b30275b8
JH
1938 "SSL verify denied by event-action: depth=%d: %s",
1939 cert_list_size, yield);
a7538db1
JH
1940 return 1; /* reject */
1941 }
1942 state->tlsp->peercert = NULL;
1943 }
1944
1945return 0;
1946}
1947
1948#endif
44662487
JH
1949
1950
17c76198
PP
1951
1952/* ------------------------------------------------------------------------ */
1953/* Exported functions */
1954
1955
1956
1957
059ec3d9
PH
1958/*************************************************
1959* Start a TLS session in a server *
1960*************************************************/
1961
1962/* This is called when Exim is running as a server, after having received
1963the STARTTLS command. It must respond to that command, and then negotiate
1964a TLS session.
1965
1966Arguments:
83da1223 1967 require_ciphers list of allowed ciphers or NULL
cf0c6164 1968 errstr pointer to error string
059ec3d9
PH
1969
1970Returns: OK on success
1971 DEFER for errors before the start of the negotiation
4c04137d 1972 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
1973 continue running.
1974*/
1975
1976int
cf0c6164 1977tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
1978{
1979int rc;
cf0c6164 1980exim_gnutls_state_st * state = NULL;
059ec3d9
PH
1981
1982/* Check for previous activation */
817d9f57 1983if (tls_in.active >= 0)
059ec3d9 1984 {
cf0c6164 1985 tls_error(US"STARTTLS received after TLS started", "", NULL, errstr);
925ac8e4 1986 smtp_printf("554 Already in TLS\r\n", FALSE);
059ec3d9
PH
1987 return FAIL;
1988 }
1989
1990/* Initialize the library. If it fails, it will already have logged the error
1991and sent an SMTP response. */
1992
17c76198 1993DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 1994
cf0c6164 1995if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
17c76198 1996 NULL, tls_verify_certificates, tls_crl,
cf0c6164 1997 require_ciphers, &state, errstr)) != OK) return rc;
059ec3d9 1998
059ec3d9
PH
1999/* If this is a host for which certificate verification is mandatory or
2000optional, set up appropriately. */
2001
059ec3d9 2002if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 2003 {
e51c7be2
JH
2004 DEBUG(D_tls)
2005 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
2006 state->verify_requirement = VERIFY_REQUIRED;
2007 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2008 }
059ec3d9 2009else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 2010 {
e51c7be2
JH
2011 DEBUG(D_tls)
2012 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
2013 state->verify_requirement = VERIFY_OPTIONAL;
2014 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2015 }
2016else
2017 {
e51c7be2
JH
2018 DEBUG(D_tls)
2019 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
2020 state->verify_requirement = VERIFY_NONE;
2021 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2022 }
059ec3d9 2023
0cbf2b82 2024#ifndef DISABLE_EVENT
723fe533
JH
2025if (event_action)
2026 {
2027 state->event_action = event_action;
2028 gnutls_session_set_ptr(state->session, state);
2029 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2030 }
2031#endif
2032
17c76198
PP
2033/* Register SNI handling; always, even if not in tls_certificate, so that the
2034expansion variable $tls_sni is always available. */
059ec3d9 2035
17c76198
PP
2036gnutls_handshake_set_post_client_hello_function(state->session,
2037 exim_sni_handling_cb);
059ec3d9
PH
2038
2039/* Set context and tell client to go ahead, except in the case of TLS startup
2040on connection, where outputting anything now upsets the clients and tends to
2041make them disconnect. We need to have an explicit fflush() here, to force out
2042the response. Other smtp_printf() calls do not need it, because in non-TLS
2043mode, the fflush() happens when smtp_getc() is called. */
2044
817d9f57 2045if (!state->tlsp->on_connect)
059ec3d9 2046 {
925ac8e4 2047 smtp_printf("220 TLS go ahead\r\n", FALSE);
9d1c15ef 2048 fflush(smtp_out);
059ec3d9
PH
2049 }
2050
2051/* Now negotiate the TLS session. We put our own timer on it, since it seems
2052that the GnuTLS library doesn't. */
2053
17c76198 2054gnutls_transport_set_ptr2(state->session,
27f19eb4
JH
2055 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2056 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
17c76198
PP
2057state->fd_in = fileno(smtp_in);
2058state->fd_out = fileno(smtp_out);
059ec3d9
PH
2059
2060sigalrm_seen = FALSE;
2061if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 2062do
17c76198 2063 rc = gnutls_handshake(state->session);
157a7880 2064while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
059ec3d9
PH
2065alarm(0);
2066
17c76198 2067if (rc != GNUTLS_E_SUCCESS)
059ec3d9 2068 {
059ec3d9
PH
2069 /* It seems that, except in the case of a timeout, we have to close the
2070 connection right here; otherwise if the other end is running OpenSSL it hangs
2071 until the server times out. */
2072
60d10ce7 2073 if (sigalrm_seen)
ad7fc6eb 2074 {
cf0c6164 2075 tls_error(US"gnutls_handshake", "timed out", NULL, errstr);
ad7fc6eb
JH
2076 gnutls_db_remove_session(state->session);
2077 }
60d10ce7 2078 else
059ec3d9 2079 {
cf0c6164 2080 tls_error(US"gnutls_handshake", gnutls_strerror(rc), NULL, errstr);
f5d25c2b 2081 (void) gnutls_alert_send_appropriate(state->session, rc);
ad7fc6eb 2082 gnutls_deinit(state->session);
ed62aae3 2083 gnutls_certificate_free_credentials(state->x509_cred);
60d10ce7 2084 millisleep(500);
ad7fc6eb 2085 shutdown(state->fd_out, SHUT_WR);
60d10ce7 2086 for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--; /* drain skt */
f1e894f3
PH
2087 (void)fclose(smtp_out);
2088 (void)fclose(smtp_in);
60d10ce7 2089 smtp_out = smtp_in = NULL;
059ec3d9
PH
2090 }
2091
2092 return FAIL;
2093 }
2094
2095DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2096
17c76198
PP
2097/* Verify after the fact */
2098
899b8bbc 2099if (!verify_certificate(state, errstr))
059ec3d9 2100 {
9d1c15ef 2101 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 2102 {
cf0c6164 2103 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
9d1c15ef 2104 return FAIL;
17c76198 2105 }
9d1c15ef
JH
2106 DEBUG(D_tls)
2107 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
cf0c6164 2108 *errstr);
059ec3d9
PH
2109 }
2110
17c76198
PP
2111/* Figure out peer DN, and if authenticated, etc. */
2112
cf0c6164 2113if ((rc = peer_status(state, NULL)) != OK) return rc;
17c76198
PP
2114
2115/* Sets various Exim expansion variables; always safe within server */
2116
9d1c15ef 2117extract_exim_vars_from_tls_state(state);
059ec3d9
PH
2118
2119/* TLS has been set up. Adjust the input functions to read via TLS,
2120and initialize appropriately. */
2121
17c76198 2122state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
2123
2124receive_getc = tls_getc;
0d81dabc 2125receive_getbuf = tls_getbuf;
584e96c6 2126receive_get_cache = tls_get_cache;
059ec3d9
PH
2127receive_ungetc = tls_ungetc;
2128receive_feof = tls_feof;
2129receive_ferror = tls_ferror;
58eb016e 2130receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2131
059ec3d9
PH
2132return OK;
2133}
2134
2135
2136
2137
aa2a70ba
JH
2138static void
2139tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2140 smtp_transport_options_block * ob)
2141{
5130845b 2142if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 2143 {
4af0d74a 2144 state->exp_tls_verify_cert_hostnames =
8c5d388a 2145#ifdef SUPPORT_I18N
4af0d74a
JH
2146 string_domain_utf8_to_alabel(host->name, NULL);
2147#else
2148 host->name;
2149#endif
aa2a70ba
JH
2150 DEBUG(D_tls)
2151 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2152 state->exp_tls_verify_cert_hostnames);
2153 }
2154}
aa2a70ba
JH
2155
2156
899b8bbc
JH
2157
2158
2159#ifdef SUPPORT_DANE
2160/* Given our list of RRs from the TLSA lookup, build a lookup block in
2161GnuTLS-DANE's preferred format. Hang it on the state str for later
2162use in DANE verification.
2163
2164We point at the dnsa data not copy it, so it must remain valid until
2165after verification is done.*/
2166
3674140c 2167static BOOL
899b8bbc
JH
2168dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2169{
2170dns_record * rr;
2171dns_scan dnss;
2172int i;
2173const char ** dane_data;
2174int * dane_data_len;
2175
2176for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 1;
2177 rr;
2178 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2179 ) if (rr->type == T_TLSA) i++;
2180
2181dane_data = store_get(i * sizeof(uschar *));
2182dane_data_len = store_get(i * sizeof(int));
2183
2184for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 0;
2185 rr;
2186 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2187 ) if (rr->type == T_TLSA)
2188 {
2189 const uschar * p = rr->data;
3674140c
JH
2190 uint8_t usage = p[0], sel = p[1], type = p[2];
2191
2192 DEBUG(D_tls)
2193 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2194
94c13285
JH
2195 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2196 || (sel != 0 && sel != 1)
2197 )
2198 continue;
3674140c
JH
2199 switch(type)
2200 {
2201 case 0: /* Full: cannot check at present */
2202 break;
2203 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2204 break;
2205 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2206 break;
2207 default: continue;
2208 }
899b8bbc
JH
2209
2210 tls_out.tlsa_usage |= 1<<usage;
2211 dane_data[i] = p;
2212 dane_data_len[i++] = rr->size;
2213 }
3674140c
JH
2214
2215if (!i) return FALSE;
2216
899b8bbc
JH
2217dane_data[i] = NULL;
2218dane_data_len[i] = 0;
2219
2220state->dane_data = (char * const *)dane_data;
2221state->dane_data_len = dane_data_len;
3674140c 2222return TRUE;
899b8bbc
JH
2223}
2224#endif
2225
2226
2227
059ec3d9
PH
2228/*************************************************
2229* Start a TLS session in a client *
2230*************************************************/
2231
2232/* Called from the smtp transport after STARTTLS has been accepted.
2233
2234Arguments:
2235 fd the fd of the connection
2236 host connected host (for messages)
83da1223 2237 addr the first address (not used)
a7538db1 2238 tb transport (always smtp)
899b8bbc
JH
2239 tlsa_dnsa non-NULL, either request or require dane for this host, and
2240 a TLSA record found. Therefore, dane verify required.
2241 Which implies cert must be requested and supplied, dane
2242 verify must pass, and cert verify irrelevant (incl.
2243 hostnames), and (caller handled) require_tls
cf0c6164
JH
2244 errstr error string pointer
2245
059ec3d9
PH
2246Returns: OK/DEFER/FAIL (because using common functions),
2247 but for a client, DEFER and FAIL have the same meaning
2248*/
2249
2250int
17c76198 2251tls_client_start(int fd, host_item *host,
f5d78688 2252 address_item *addr ARG_UNUSED,
cf0c6164 2253 transport_instance * tb,
c0635b6d 2254#ifdef SUPPORT_DANE
899b8bbc 2255 dns_answer * tlsa_dnsa,
0e66b3b6 2256#endif
cf0c6164 2257 uschar ** errstr)
059ec3d9 2258{
a7538db1
JH
2259smtp_transport_options_block *ob =
2260 (smtp_transport_options_block *)tb->options_block;
059ec3d9 2261int rc;
899b8bbc 2262exim_gnutls_state_st * state = NULL;
5ec37a55 2263uschar *cipher_list = NULL;
f2de3a33 2264#ifndef DISABLE_OCSP
5130845b
JH
2265BOOL require_ocsp =
2266 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
44662487 2267BOOL request_ocsp = require_ocsp ? TRUE
5130845b 2268 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2b4a568d 2269#endif
059ec3d9 2270
17c76198 2271DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 2272
5ec37a55 2273#ifdef SUPPORT_DANE
cf260049 2274if (tlsa_dnsa && ob->dane_require_tls_ciphers)
5ec37a55
PP
2275 {
2276 /* not using expand_check_tlsvar because not yet in state */
2277 if (!expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2278 &cipher_list, errstr))
2279 return DEFER;
cf260049
JH
2280 cipher_list = cipher_list && *cipher_list
2281 ? ob->dane_require_tls_ciphers : ob->tls_require_ciphers;
5ec37a55
PP
2282 }
2283#endif
2284
2285if (!cipher_list)
2286 cipher_list = ob->tls_require_ciphers;
2287
65867078
JH
2288if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2289 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
5ec37a55 2290 cipher_list, &state, errstr)) != OK)
2b4a568d 2291 return rc;
059ec3d9 2292
54c90be1 2293 {
65867078
JH
2294 int dh_min_bits = ob->tls_dh_min_bits;
2295 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2296 {
2297 DEBUG(D_tls)
2298 debug_printf("WARNING: tls_dh_min_bits far too low,"
2299 " clamping %d up to %d\n",
2300 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2301 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2302 }
54c90be1 2303
65867078
JH
2304 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2305 " acceptable bits to %d\n",
2306 dh_min_bits);
2307 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2308 }
83da1223 2309
94431adb 2310/* Stick to the old behaviour for compatibility if tls_verify_certificates is
2b4a568d
JH
2311set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2312the specified host patterns if one of them is defined */
2313
899b8bbc 2314#ifdef SUPPORT_DANE
3674140c 2315if (tlsa_dnsa && dane_tlsa_load(state, tlsa_dnsa))
899b8bbc
JH
2316 {
2317 DEBUG(D_tls)
2318 debug_printf("TLS: server certificate DANE required.\n");
2319 state->verify_requirement = VERIFY_DANE;
2320 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
899b8bbc
JH
2321 }
2322else
2323#endif
2324 if ( ( state->exp_tls_verify_certificates
2325 && !ob->tls_verify_hosts
2326 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2327 )
2328 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
2329 )
17c76198 2330 {
aa2a70ba 2331 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
2332 DEBUG(D_tls)
2333 debug_printf("TLS: server certificate verification required.\n");
2334 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
2335 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2336 }
5130845b 2337else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
52f93eed 2338 {
aa2a70ba 2339 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
2340 DEBUG(D_tls)
2341 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 2342 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
2343 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2344 }
2345else
2346 {
e51c7be2
JH
2347 DEBUG(D_tls)
2348 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
2349 state->verify_requirement = VERIFY_NONE;
2350 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 2351 }
059ec3d9 2352
f2de3a33
JH
2353#ifndef DISABLE_OCSP
2354 /* supported since GnuTLS 3.1.3 */
44662487 2355if (request_ocsp)
9d1c15ef
JH
2356 {
2357 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
2358 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2359 NULL, 0, NULL)) != OK)
9d1c15ef 2360 return tls_error(US"cert-status-req",
cf0c6164 2361 gnutls_strerror(rc), state->host, errstr);
44662487 2362 tls_out.ocsp = OCSP_NOT_RESP;
9d1c15ef 2363 }
2b4a568d
JH
2364#endif
2365
0cbf2b82 2366#ifndef DISABLE_EVENT
774ef2d7 2367if (tb->event_action)
a7538db1 2368 {
774ef2d7 2369 state->event_action = tb->event_action;
a7538db1 2370 gnutls_session_set_ptr(state->session, state);
723fe533 2371 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
2372 }
2373#endif
2374
27f19eb4 2375gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
17c76198
PP
2376state->fd_in = fd;
2377state->fd_out = fd;
059ec3d9 2378
9d1c15ef 2379DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
2380/* There doesn't seem to be a built-in timeout on connection. */
2381
2382sigalrm_seen = FALSE;
65867078 2383alarm(ob->command_timeout);
17c76198 2384do
17c76198 2385 rc = gnutls_handshake(state->session);
f1fed05b 2386while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
059ec3d9
PH
2387alarm(0);
2388
4fe99a6c 2389if (rc != GNUTLS_E_SUCCESS)
60d10ce7
JH
2390 if (sigalrm_seen)
2391 {
2392 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
cf0c6164 2393 return tls_error(US"gnutls_handshake", "timed out", state->host, errstr);
60d10ce7
JH
2394 }
2395 else
cf0c6164 2396 return tls_error(US"gnutls_handshake", gnutls_strerror(rc), state->host, errstr);
4fe99a6c 2397
17c76198 2398DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 2399
17c76198 2400/* Verify late */
059ec3d9 2401
899b8bbc 2402if (!verify_certificate(state, errstr))
cf0c6164 2403 return tls_error(US"certificate verification failed", *errstr, state->host, errstr);
059ec3d9 2404
f2de3a33 2405#ifndef DISABLE_OCSP
2b4a568d
JH
2406if (require_ocsp)
2407 {
2408 DEBUG(D_tls)
2409 {
2410 gnutls_datum_t stapling;
2411 gnutls_ocsp_resp_t resp;
2412 gnutls_datum_t printed;
2413 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2414 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2415 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2416 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2417 )
2418 {
65867078 2419 debug_printf("%.4096s", printed.data);
2b4a568d
JH
2420 gnutls_free(printed.data);
2421 }
2422 else
cf0c6164 2423 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host, errstr);
2b4a568d
JH
2424 }
2425
2b4a568d 2426 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2
JH
2427 {
2428 tls_out.ocsp = OCSP_FAILED;
cf0c6164 2429 return tls_error(US"certificate status check failed", NULL, state->host, errstr);
018058b2 2430 }
2b4a568d 2431 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
44662487 2432 tls_out.ocsp = OCSP_VFIED;
2b4a568d
JH
2433 }
2434#endif
2435
17c76198 2436/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 2437
cf0c6164 2438if ((rc = peer_status(state, errstr)) != OK)
2b4a568d 2439 return rc;
059ec3d9 2440
4fe99a6c 2441/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 2442
9d1c15ef 2443extract_exim_vars_from_tls_state(state);
059ec3d9 2444
059ec3d9
PH
2445return OK;
2446}
2447
2448
2449
17c76198 2450
059ec3d9 2451/*************************************************
17c76198 2452* Close down a TLS session *
059ec3d9
PH
2453*************************************************/
2454
17c76198
PP
2455/* This is also called from within a delivery subprocess forked from the
2456daemon, to shut down the TLS library, without actually doing a shutdown (which
2457would tamper with the TLS session in the parent process).
059ec3d9 2458
dec766a1
WB
2459Arguments:
2460 shutdown 1 if TLS close-alert is to be sent,
2461 2 if also response to be waited for
2462
17c76198 2463Returns: nothing
059ec3d9
PH
2464*/
2465
17c76198 2466void
dec766a1 2467tls_close(BOOL is_server, int shutdown)
059ec3d9 2468{
817d9f57 2469exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 2470
389ca47a 2471if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
17c76198
PP
2472
2473if (shutdown)
2474 {
dec766a1
WB
2475 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
2476 shutdown > 1 ? " (with response-wait)" : "");
2477
2478 alarm(2);
2479 gnutls_bye(state->session, shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
2480 alarm(0);
17c76198
PP
2481 }
2482
2483gnutls_deinit(state->session);
ed62aae3
HSHR
2484gnutls_certificate_free_credentials(state->x509_cred);
2485
17c76198 2486
389ca47a 2487state->tlsp->active = -1;
b808677c 2488if (state->xfer_buffer) store_free(state->xfer_buffer);
17c76198
PP
2489memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2490
b808677c 2491if (!state_server.session && !state_client.session)
17c76198
PP
2492 {
2493 gnutls_global_deinit();
2494 exim_gnutls_base_init_done = FALSE;
2495 }
059ec3d9
PH
2496}
2497
2498
2499
17c76198 2500
0d81dabc
JH
2501static BOOL
2502tls_refill(unsigned lim)
2503{
2504exim_gnutls_state_st * state = &state_server;
2505ssize_t inbytes;
2506
2507DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2508 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2509
f1fed05b 2510sigalrm_seen = FALSE;
0d81dabc
JH
2511if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2512inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2513 MIN(ssl_xfer_buffer_size, lim));
9723f966
JH
2514if (smtp_receive_timeout > 0) alarm(0);
2515
2516if (had_command_timeout) /* set by signal handler */
2517 smtp_command_timeout_exit(); /* does not return */
2518if (had_command_sigterm)
2519 smtp_command_sigterm_exit();
2520if (had_data_timeout)
2521 smtp_data_timeout_exit();
2522if (had_data_sigint)
2523 smtp_data_sigint_exit();
2524
2525/* Timeouts do not get this far. A zero-byte return appears to mean that the
2526TLS session has been closed down, not that the socket itself has been closed
2527down. Revert to non-TLS handling. */
0d81dabc
JH
2528
2529if (sigalrm_seen)
2530 {
2531 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
8b77d27a 2532 state->xfer_error = TRUE;
0d81dabc
JH
2533 return FALSE;
2534 }
2535
2536else if (inbytes == 0)
2537 {
2538 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2539
2540 receive_getc = smtp_getc;
2541 receive_getbuf = smtp_getbuf;
2542 receive_get_cache = smtp_get_cache;
2543 receive_ungetc = smtp_ungetc;
2544 receive_feof = smtp_feof;
2545 receive_ferror = smtp_ferror;
2546 receive_smtp_buffered = smtp_buffered;
2547
2548 gnutls_deinit(state->session);
2549 gnutls_certificate_free_credentials(state->x509_cred);
2550
2551 state->session = NULL;
2552 state->tlsp->active = -1;
2553 state->tlsp->bits = 0;
2554 state->tlsp->certificate_verified = FALSE;
2555 tls_channelbinding_b64 = NULL;
2556 state->tlsp->cipher = NULL;
2557 state->tlsp->peercert = NULL;
2558 state->tlsp->peerdn = NULL;
2559
2560 return FALSE;
2561 }
2562
2563/* Handle genuine errors */
2564
2565else if (inbytes < 0)
2566 {
2567 record_io_error(state, (int) inbytes, US"recv", NULL);
8b77d27a 2568 state->xfer_error = TRUE;
0d81dabc
JH
2569 return FALSE;
2570 }
2571#ifndef DISABLE_DKIM
2572dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2573#endif
2574state->xfer_buffer_hwm = (int) inbytes;
2575state->xfer_buffer_lwm = 0;
2576return TRUE;
2577}
2578
059ec3d9
PH
2579/*************************************************
2580* TLS version of getc *
2581*************************************************/
2582
2583/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2584it refills the buffer via the GnuTLS reading function.
817d9f57 2585Only used by the server-side TLS.
059ec3d9 2586
17c76198
PP
2587This feeds DKIM and should be used for all message-body reads.
2588
bd8fbe36 2589Arguments: lim Maximum amount to read/bufffer
059ec3d9
PH
2590Returns: the next character or EOF
2591*/
2592
2593int
bd8fbe36 2594tls_getc(unsigned lim)
059ec3d9 2595{
0d81dabc 2596exim_gnutls_state_st * state = &state_server;
059ec3d9 2597
0d81dabc
JH
2598if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2599 if (!tls_refill(lim))
2600 return state->xfer_error ? EOF : smtp_getc(lim);
ed62aae3 2601
0d81dabc 2602/* Something in the buffer; return next uschar */
059ec3d9 2603
0d81dabc
JH
2604return state->xfer_buffer[state->xfer_buffer_lwm++];
2605}
059ec3d9 2606
0d81dabc
JH
2607uschar *
2608tls_getbuf(unsigned * len)
2609{
2610exim_gnutls_state_st * state = &state_server;
2611unsigned size;
2612uschar * buf;
059ec3d9 2613
0d81dabc
JH
2614if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2615 if (!tls_refill(*len))
059ec3d9 2616 {
0d81dabc
JH
2617 if (!state->xfer_error) return smtp_getbuf(len);
2618 *len = 0;
2619 return NULL;
059ec3d9 2620 }
059ec3d9 2621
0d81dabc
JH
2622if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
2623 size = *len;
2624buf = &state->xfer_buffer[state->xfer_buffer_lwm];
2625state->xfer_buffer_lwm += size;
2626*len = size;
2627return buf;
059ec3d9
PH
2628}
2629
0d81dabc 2630
584e96c6
JH
2631void
2632tls_get_cache()
2633{
9960d1e5 2634#ifndef DISABLE_DKIM
584e96c6
JH
2635exim_gnutls_state_st * state = &state_server;
2636int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2637if (n > 0)
2638 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
584e96c6 2639#endif
9960d1e5 2640}
584e96c6 2641
059ec3d9 2642
925ac8e4
JH
2643BOOL
2644tls_could_read(void)
2645{
2646return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
2647 || gnutls_record_check_pending(state_server.session) > 0;
2648}
2649
2650
059ec3d9 2651
17c76198 2652
059ec3d9
PH
2653/*************************************************
2654* Read bytes from TLS channel *
2655*************************************************/
2656
17c76198
PP
2657/* This does not feed DKIM, so if the caller uses this for reading message body,
2658then the caller must feed DKIM.
817d9f57 2659
059ec3d9
PH
2660Arguments:
2661 buff buffer of data
2662 len size of buffer
2663
2664Returns: the number of bytes read
2665 -1 after a failed read
2666*/
2667
2668int
817d9f57 2669tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2670{
817d9f57 2671exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
17c76198 2672ssize_t inbytes;
059ec3d9 2673
17c76198
PP
2674if (len > INT_MAX)
2675 len = INT_MAX;
059ec3d9 2676
17c76198
PP
2677if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2678 DEBUG(D_tls)
2679 debug_printf("*** PROBABLY A BUG *** " \
2680 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2681 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2682
2683DEBUG(D_tls)
2684 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2685 state->session, buff, len);
2686
2687inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
2688if (inbytes > 0) return inbytes;
2689if (inbytes == 0)
2690 {
2691 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2692 }
17c76198 2693else record_io_error(state, (int)inbytes, US"recv", NULL);
059ec3d9
PH
2694
2695return -1;
2696}
2697
2698
2699
17c76198 2700
059ec3d9
PH
2701/*************************************************
2702* Write bytes down TLS channel *
2703*************************************************/
2704
2705/*
2706Arguments:
817d9f57 2707 is_server channel specifier
059ec3d9
PH
2708 buff buffer of data
2709 len number of bytes
925ac8e4 2710 more more data expected soon
059ec3d9
PH
2711
2712Returns: the number of bytes after a successful write,
2713 -1 after a failed write
2714*/
2715
2716int
925ac8e4 2717tls_write(BOOL is_server, const uschar *buff, size_t len, BOOL more)
059ec3d9 2718{
17c76198
PP
2719ssize_t outbytes;
2720size_t left = len;
817d9f57 2721exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
925ac8e4
JH
2722#ifdef SUPPORT_CORK
2723static BOOL corked = FALSE;
2724
2725if (more && !corked) gnutls_record_cork(state->session);
2726#endif
2727
2728DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
2729 buff, left, more ? ", more" : "");
059ec3d9 2730
059ec3d9
PH
2731while (left > 0)
2732 {
17c76198
PP
2733 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2734 buff, left);
2735 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 2736
17c76198 2737 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
2738 if (outbytes < 0)
2739 {
17c76198 2740 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
2741 return -1;
2742 }
2743 if (outbytes == 0)
2744 {
17c76198 2745 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
2746 return -1;
2747 }
2748
2749 left -= outbytes;
2750 buff += outbytes;
2751 }
2752
17c76198
PP
2753if (len > INT_MAX)
2754 {
2755 DEBUG(D_tls)
2756 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2757 len);
2758 len = INT_MAX;
2759 }
2760
925ac8e4
JH
2761#ifdef SUPPORT_CORK
2762if (more != corked)
2763 {
2764 if (!more) (void) gnutls_record_uncork(state->session, 0);
2765 corked = more;
2766 }
2767#endif
2768
17c76198 2769return (int) len;
059ec3d9
PH
2770}
2771
2772
2773
17c76198 2774
059ec3d9 2775/*************************************************
17c76198 2776* Random number generation *
059ec3d9
PH
2777*************************************************/
2778
17c76198
PP
2779/* Pseudo-random number generation. The result is not expected to be
2780cryptographically strong but not so weak that someone will shoot themselves
2781in the foot using it as a nonce in input in some email header scheme or
2782whatever weirdness they'll twist this into. The result should handle fork()
2783and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 2784
17c76198
PP
2785Arguments:
2786 max range maximum
2787Returns a random number in range [0, max-1]
059ec3d9
PH
2788*/
2789
af3498d6 2790#ifdef HAVE_GNUTLS_RND
17c76198
PP
2791int
2792vaguely_random_number(int max)
059ec3d9 2793{
17c76198
PP
2794unsigned int r;
2795int i, needed_len;
2796uschar *p;
2797uschar smallbuf[sizeof(r)];
2798
2799if (max <= 1)
2800 return 0;
2801
2802needed_len = sizeof(r);
2803/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2804 * asked for a number less than 10. */
2805for (r = max, i = 0; r; ++i)
2806 r >>= 1;
2807i = (i + 7) / 8;
2808if (i < needed_len)
2809 needed_len = i;
2810
2811i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2812if (i < 0)
059ec3d9 2813 {
17c76198
PP
2814 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2815 return vaguely_random_number_fallback(max);
2816 }
2817r = 0;
2818for (p = smallbuf; needed_len; --needed_len, ++p)
2819 {
2820 r *= 256;
2821 r += *p;
059ec3d9
PH
2822 }
2823
17c76198
PP
2824/* We don't particularly care about weighted results; if someone wants
2825 * smooth distribution and cares enough then they should submit a patch then. */
2826return r % max;
059ec3d9 2827}
af3498d6
PP
2828#else /* HAVE_GNUTLS_RND */
2829int
2830vaguely_random_number(int max)
2831{
2832 return vaguely_random_number_fallback(max);
2833}
2834#endif /* HAVE_GNUTLS_RND */
059ec3d9 2835
36f12725
NM
2836
2837
2838
2839/*************************************************
3375e053
PP
2840* Let tls_require_ciphers be checked at startup *
2841*************************************************/
2842
2843/* The tls_require_ciphers option, if set, must be something which the
2844library can parse.
2845
2846Returns: NULL on success, or error message
2847*/
2848
2849uschar *
2850tls_validate_require_cipher(void)
2851{
2852int rc;
2853uschar *expciphers = NULL;
2854gnutls_priority_t priority_cache;
2855const char *errpos;
cf0c6164 2856uschar * dummy_errstr;
3375e053
PP
2857
2858#define validate_check_rc(Label) do { \
2859 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2860 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2861#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2862
2863if (exim_gnutls_base_init_done)
2864 log_write(0, LOG_MAIN|LOG_PANIC,
2865 "already initialised GnuTLS, Exim developer bug");
2866
a5f239e4 2867#ifdef HAVE_GNUTLS_PKCS11
2519e60d 2868if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
2869 {
2870 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2871 validate_check_rc(US"gnutls_pkcs11_init");
2872 }
2873#endif
3375e053
PP
2874rc = gnutls_global_init();
2875validate_check_rc(US"gnutls_global_init()");
2876exim_gnutls_base_init_done = TRUE;
2877
2878if (!(tls_require_ciphers && *tls_require_ciphers))
2879 return_deinit(NULL);
2880
cf0c6164
JH
2881if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
2882 &dummy_errstr))
3375e053
PP
2883 return_deinit(US"failed to expand tls_require_ciphers");
2884
2885if (!(expciphers && *expciphers))
2886 return_deinit(NULL);
2887
2888DEBUG(D_tls)
2889 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2890
2891rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2892validate_check_rc(string_sprintf(
2893 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2894 expciphers, errpos - CS expciphers, errpos));
2895
2896#undef return_deinit
2897#undef validate_check_rc
2898gnutls_global_deinit();
2899
2900return NULL;
2901}
2902
2903
2904
2905
2906/*************************************************
36f12725
NM
2907* Report the library versions. *
2908*************************************************/
2909
2910/* See a description in tls-openssl.c for an explanation of why this exists.
2911
2912Arguments: a FILE* to print the results to
2913Returns: nothing
2914*/
2915
2916void
2917tls_version_report(FILE *f)
2918{
754a0503
PP
2919fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2920 " Runtime: %s\n",
2921 LIBGNUTLS_VERSION,
2922 gnutls_check_version(NULL));
36f12725
NM
2923}
2924
2b4a568d
JH
2925/* vi: aw ai sw=2
2926*/
059ec3d9 2927/* End of tls-gnu.c */