testsuite output changes
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
6aa6fc9c 16Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17c76198 17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
a5f239e4
PP
42/* needed to disable PKCS11 autoload unless requested */
43#if GNUTLS_VERSION_NUMBER >= 0x020c00
44# include <gnutls/pkcs11.h>
76075bb5 45# define SUPPORT_PARAM_TO_PK_BITS
a5f239e4 46#endif
7e07527a
JH
47#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
48# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
49# define DISABLE_OCSP
50#endif
0cbf2b82 51#if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
774ef2d7 52# warning "GnuTLS library version too old; tls:cert event unsupported"
0cbf2b82 53# define DISABLE_EVENT
a7538db1 54#endif
a7fec7a7
JH
55#if GNUTLS_VERSION_NUMBER >= 0x030306
56# define SUPPORT_CA_DIR
57#else
58# undef SUPPORT_CA_DIR
59#endif
11a04b5a 60#if GNUTLS_VERSION_NUMBER >= 0x030014
cb1d7830
JH
61# define SUPPORT_SYSDEFAULT_CABUNDLE
62#endif
7e07527a 63
f2de3a33 64#ifndef DISABLE_OCSP
2b4a568d
JH
65# include <gnutls/ocsp.h>
66#endif
059ec3d9 67
17c76198 68/* GnuTLS 2 vs 3
059ec3d9 69
17c76198
PP
70GnuTLS 3 only:
71 gnutls_global_set_audit_log_function()
059ec3d9 72
17c76198
PP
73Changes:
74 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
75*/
059ec3d9 76
17c76198 77/* Local static variables for GnuTLS */
059ec3d9 78
17c76198 79/* Values for verify_requirement */
059ec3d9 80
e51c7be2 81enum peer_verify_requirement
aa2a70ba 82 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED };
059ec3d9 83
17c76198
PP
84/* This holds most state for server or client; with this, we can set up an
85outbound TLS-enabled connection in an ACL callout, while not stomping all
86over the TLS variables available for expansion.
059ec3d9 87
17c76198
PP
88Some of these correspond to variables in globals.c; those variables will
89be set to point to content in one of these instances, as appropriate for
90the stage of the process lifetime.
059ec3d9 91
389ca47a 92Not handled here: global tls_channelbinding_b64.
17c76198 93*/
059ec3d9 94
17c76198 95typedef struct exim_gnutls_state {
9d1c15ef 96 gnutls_session_t session;
17c76198 97 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 98 gnutls_priority_t priority_cache;
17c76198 99 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
100 int fd_in;
101 int fd_out;
102 BOOL peer_cert_verified;
103 BOOL trigger_sni_changes;
104 BOOL have_set_peerdn;
17c76198 105 const struct host_item *host;
9d1c15ef
JH
106 gnutls_x509_crt_t peercert;
107 uschar *peerdn;
108 uschar *ciphersuite;
109 uschar *received_sni;
17c76198
PP
110
111 const uschar *tls_certificate;
112 const uschar *tls_privatekey;
113 const uschar *tls_sni; /* client send only, not received */
114 const uschar *tls_verify_certificates;
115 const uschar *tls_crl;
116 const uschar *tls_require_ciphers;
e51c7be2 117
17c76198
PP
118 uschar *exp_tls_certificate;
119 uschar *exp_tls_privatekey;
17c76198
PP
120 uschar *exp_tls_verify_certificates;
121 uschar *exp_tls_crl;
122 uschar *exp_tls_require_ciphers;
44662487 123 uschar *exp_tls_ocsp_file;
55414b25 124 const uschar *exp_tls_verify_cert_hostnames;
0cbf2b82 125#ifndef DISABLE_EVENT
a7538db1
JH
126 uschar *event_action;
127#endif
17c76198 128
389ca47a 129 tls_support *tlsp; /* set in tls_init() */
817d9f57 130
17c76198
PP
131 uschar *xfer_buffer;
132 int xfer_buffer_lwm;
133 int xfer_buffer_hwm;
134 int xfer_eof;
135 int xfer_error;
17c76198
PP
136} exim_gnutls_state_st;
137
138static const exim_gnutls_state_st exim_gnutls_state_init = {
4fe99a6c 139 NULL, NULL, NULL, VERIFY_NONE, -1, -1, FALSE, FALSE, FALSE,
75fe387d 140 NULL, NULL, NULL, NULL,
17c76198 141 NULL, NULL, NULL, NULL, NULL, NULL,
44662487 142 NULL, NULL, NULL, NULL, NULL, NULL, NULL,
01a4a5c5 143 NULL,
0cbf2b82 144#ifndef DISABLE_EVENT
a7538db1
JH
145 NULL,
146#endif
817d9f57 147 NULL,
17c76198 148 NULL, 0, 0, 0, 0,
17c76198 149};
83da1223 150
17c76198
PP
151/* Not only do we have our own APIs which don't pass around state, assuming
152it's held in globals, GnuTLS doesn't appear to let us register callback data
153for callbacks, or as part of the session, so we have to keep a "this is the
154context we're currently dealing with" pointer and rely upon being
155single-threaded to keep from processing data on an inbound TLS connection while
156talking to another TLS connection for an outbound check. This does mean that
157there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
158second connection.
159XXX But see gnutls_session_get_ptr()
160*/
059ec3d9 161
17c76198 162static exim_gnutls_state_st state_server, state_client;
059ec3d9 163
17c76198
PP
164/* dh_params are initialised once within the lifetime of a process using TLS;
165if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
166don't want to repeat this. */
83da1223 167
17c76198 168static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 169
17c76198 170/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 171
17c76198 172static const int ssl_session_timeout = 200;
059ec3d9 173
17c76198 174static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 175
17c76198 176/* Guard library core initialisation */
83da1223 177
17c76198 178static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 179
4fb7df6d 180#ifndef DISABLE_OCSP
9196d5bf 181static BOOL gnutls_buggy_ocsp = FALSE;
4fb7df6d 182#endif
9196d5bf 183
059ec3d9 184
17c76198 185/* ------------------------------------------------------------------------ */
17c76198 186/* macros */
83da1223 187
17c76198 188#define MAX_HOST_LEN 255
83da1223 189
17c76198
PP
190/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
191the library logging; a value less than 0 disables the calls to set up logging
192callbacks. */
2c17bb02 193#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
a7538db1 194# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 195#endif
83da1223 196
2c17bb02 197#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 198# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 199#endif
83da1223 200
af3498d6
PP
201/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
202can ask for a bit-strength. Without that, we stick to the constant we had
203before, for now. */
2c17bb02 204#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 205# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 206#endif
af3498d6 207
17c76198 208#define exim_gnutls_err_check(Label) do { \
cf0c6164
JH
209 if (rc != GNUTLS_E_SUCCESS) \
210 return tls_error((Label), gnutls_strerror(rc), host, errstr); \
211 } while (0)
059ec3d9 212
cf0c6164
JH
213#define expand_check_tlsvar(Varname, errstr) \
214 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
83da1223 215
17c76198 216#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
217# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
218# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
219# define HAVE_GNUTLS_RND
2519e60d
TL
220/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
221 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
222 * isn't available sometimes, so this needs to become a conditional
223 * compilation; the sanest way to deal with this being a problem on
224 * older OSes is to block it in the Local/Makefile with this compiler
225 * definition */
e51c7be2
JH
226# ifndef AVOID_GNUTLS_PKCS11
227# define HAVE_GNUTLS_PKCS11
228# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 229#endif
83da1223 230
af3498d6
PP
231
232
233
234/* ------------------------------------------------------------------------ */
235/* Callback declarations */
236
237#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
238static void exim_gnutls_logger_cb(int level, const char *message);
239#endif
240
241static int exim_sni_handling_cb(gnutls_session_t session);
242
f2de3a33 243#ifndef DISABLE_OCSP
44662487
JH
244static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
245 gnutls_datum_t * ocsp_response);
246#endif
af3498d6
PP
247
248
249
17c76198
PP
250/* ------------------------------------------------------------------------ */
251/* Static functions */
059ec3d9
PH
252
253/*************************************************
254* Handle TLS error *
255*************************************************/
256
257/* Called from lots of places when errors occur before actually starting to do
258the TLS handshake, that is, while the session is still in clear. Always returns
259DEFER for a server and FAIL for a client so that most calls can use "return
260tls_error(...)" to do this processing and then give an appropriate return. A
261single function is used for both server and client, because it is called from
262some shared functions.
263
264Argument:
265 prefix text to include in the logged error
7199e1ee
TF
266 msg additional error string (may be NULL)
267 usually obtained from gnutls_strerror()
17c76198
PP
268 host NULL if setting up a server;
269 the connected host if setting up a client
cf0c6164 270 errstr pointer to returned error string
059ec3d9
PH
271
272Returns: OK/DEFER/FAIL
273*/
274
275static int
cf0c6164
JH
276tls_error(const uschar *prefix, const char *msg, const host_item *host,
277 uschar ** errstr)
059ec3d9 278{
cf0c6164
JH
279if (errstr)
280 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : "");
281return host ? FAIL : DEFER;
059ec3d9
PH
282}
283
284
285
17c76198 286
059ec3d9 287/*************************************************
17c76198 288* Deal with logging errors during I/O *
059ec3d9
PH
289*************************************************/
290
17c76198 291/* We have to get the identity of the peer from saved data.
059ec3d9 292
17c76198
PP
293Argument:
294 state the current GnuTLS exim state container
295 rc the GnuTLS error code, or 0 if it's a local error
296 when text identifying read or write
297 text local error text when ec is 0
059ec3d9 298
17c76198 299Returns: nothing
059ec3d9
PH
300*/
301
17c76198
PP
302static void
303record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 304{
cf0c6164
JH
305const char * msg;
306uschar * errstr;
059ec3d9 307
17c76198
PP
308if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
309 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
310 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
311else
312 msg = gnutls_strerror(rc);
059ec3d9 313
cf0c6164
JH
314(void) tls_error(when, msg, state->host, &errstr);
315
316if (state->host)
317 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
318 state->host->name, state->host->address, errstr);
319else
320 {
321 uschar * conn_info = smtp_get_connection_info();
322 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
323 /* I'd like to get separated H= here, but too hard for now */
324 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
325 }
17c76198 326}
059ec3d9 327
059ec3d9 328
059ec3d9 329
059ec3d9 330
17c76198
PP
331/*************************************************
332* Set various Exim expansion vars *
333*************************************************/
059ec3d9 334
e51c7be2
JH
335#define exim_gnutls_cert_err(Label) \
336 do \
337 { \
338 if (rc != GNUTLS_E_SUCCESS) \
339 { \
340 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
341 (Label), gnutls_strerror(rc)); \
342 return rc; \
343 } \
344 } while (0)
9d1c15ef
JH
345
346static int
27f19eb4 347import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
9d1c15ef
JH
348{
349int rc;
350
351rc = gnutls_x509_crt_init(crtp);
352exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
353
354rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
355exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
356
357return rc;
358}
359
360#undef exim_gnutls_cert_err
361
362
17c76198
PP
363/* We set various Exim global variables from the state, once a session has
364been established. With TLS callouts, may need to change this to stack
365variables, or just re-call it with the server state after client callout
366has finished.
059ec3d9 367
9d1c15ef 368Make sure anything set here is unset in tls_getc().
17c76198
PP
369
370Sets:
371 tls_active fd
372 tls_bits strength indicator
373 tls_certificate_verified bool indicator
374 tls_channelbinding_b64 for some SASL mechanisms
375 tls_cipher a string
9d1c15ef 376 tls_peercert pointer to library internal
17c76198
PP
377 tls_peerdn a string
378 tls_sni a (UTF-8) string
9d1c15ef 379 tls_ourcert pointer to library internal
17c76198
PP
380
381Argument:
382 state the relevant exim_gnutls_state_st *
383*/
384
385static void
9d1c15ef 386extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 387{
17c76198 388gnutls_cipher_algorithm_t cipher;
17c76198
PP
389#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
390int old_pool;
391int rc;
392gnutls_datum_t channel;
393#endif
9d1c15ef 394tls_support * tlsp = state->tlsp;
17c76198 395
9d1c15ef 396tlsp->active = state->fd_out;
17c76198
PP
397
398cipher = gnutls_cipher_get(state->session);
399/* returns size in "bytes" */
9d1c15ef 400tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 401
9d1c15ef 402tlsp->cipher = state->ciphersuite;
17c76198 403
817d9f57 404DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 405
9d1c15ef 406tlsp->certificate_verified = state->peer_cert_verified;
059ec3d9 407
17c76198
PP
408/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
409only available for use for authenticators while this TLS session is running. */
410
411tls_channelbinding_b64 = NULL;
412#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
413channel.data = NULL;
414channel.size = 0;
415rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
416if (rc) {
417 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
418} else {
419 old_pool = store_pool;
420 store_pool = POOL_PERM;
f4d091fb 421 tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
17c76198
PP
422 store_pool = old_pool;
423 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
424}
425#endif
426
9d1c15ef
JH
427/* peercert is set in peer_status() */
428tlsp->peerdn = state->peerdn;
429tlsp->sni = state->received_sni;
430
431/* record our certificate */
432 {
27f19eb4 433 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
9d1c15ef
JH
434 gnutls_x509_crt_t crt;
435
436 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
437 }
059ec3d9
PH
438}
439
440
441
17c76198 442
059ec3d9 443/*************************************************
575643cd 444* Setup up DH parameters *
059ec3d9
PH
445*************************************************/
446
575643cd 447/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
448be re-generated every so often, depending on security policy. What we do is to
449keep these parameters in a file in the spool directory. If the file does not
450exist, we generate them. This means that it is easy to cause a regeneration.
451
452The new file is written as a temporary file and renamed, so that an incomplete
453file is never present. If two processes both compute some new parameters, you
454waste a bit of effort, but it doesn't seem worth messing around with locking to
455prevent this.
456
059ec3d9
PH
457Returns: OK/DEFER/FAIL
458*/
459
460static int
cf0c6164 461init_server_dh(uschar ** errstr)
059ec3d9 462{
17c76198
PP
463int fd, rc;
464unsigned int dh_bits;
27f19eb4 465gnutls_datum_t m;
a799883d
PP
466uschar filename_buf[PATH_MAX];
467uschar *filename = NULL;
17c76198 468size_t sz;
a799883d
PP
469uschar *exp_tls_dhparam;
470BOOL use_file_in_spool = FALSE;
471BOOL use_fixed_file = FALSE;
17c76198 472host_item *host = NULL; /* dummy for macros */
059ec3d9 473
17c76198 474DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 475
17c76198
PP
476rc = gnutls_dh_params_init(&dh_server_params);
477exim_gnutls_err_check(US"gnutls_dh_params_init");
059ec3d9 478
a799883d
PP
479m.data = NULL;
480m.size = 0;
481
cf0c6164 482if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
a799883d
PP
483 return DEFER;
484
485if (!exp_tls_dhparam)
486 {
487 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
488 m.data = US std_dh_prime_default();
489 m.size = Ustrlen(m.data);
490 }
491else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
492 use_file_in_spool = TRUE;
493else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
494 {
495 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
496 return OK;
497 }
498else if (exp_tls_dhparam[0] != '/')
499 {
f5d25c2b 500 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
cf0c6164 501 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL, errstr);
a799883d
PP
502 m.size = Ustrlen(m.data);
503 }
504else
505 {
506 use_fixed_file = TRUE;
507 filename = exp_tls_dhparam;
508 }
509
510if (m.data)
511 {
512 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
513 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
514 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
515 return OK;
516 }
517
af3498d6
PP
518#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
519/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
520different filename and ensure we have sufficient bits. */
521dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
522if (!dh_bits)
cf0c6164 523 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
af3498d6 524DEBUG(D_tls)
b34fc30c 525 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
526 dh_bits);
527#else
528dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
529DEBUG(D_tls)
530 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
531 dh_bits);
532#endif
059ec3d9 533
3375e053
PP
534/* Some clients have hard-coded limits. */
535if (dh_bits > tls_dh_max_bits)
536 {
537 DEBUG(D_tls)
538 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
539 tls_dh_max_bits);
540 dh_bits = tls_dh_max_bits;
541 }
542
a799883d
PP
543if (use_file_in_spool)
544 {
545 if (!string_format(filename_buf, sizeof(filename_buf),
546 "%s/gnutls-params-%d", spool_directory, dh_bits))
cf0c6164 547 return tls_error(US"overlong filename", NULL, NULL, errstr);
a799883d
PP
548 filename = filename_buf;
549 }
059ec3d9 550
b5aea5e1 551/* Open the cache file for reading and if successful, read it and set up the
575643cd 552parameters. */
059ec3d9 553
f5d25c2b 554if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
059ec3d9 555 {
b5aea5e1 556 struct stat statbuf;
17c76198
PP
557 FILE *fp;
558 int saved_errno;
559
560 if (fstat(fd, &statbuf) < 0) /* EIO */
561 {
562 saved_errno = errno;
563 (void)close(fd);
cf0c6164 564 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL, errstr);
17c76198
PP
565 }
566 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
567 {
568 (void)close(fd);
cf0c6164 569 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
17c76198 570 }
40c90bca 571 if (!(fp = fdopen(fd, "rb")))
17c76198
PP
572 {
573 saved_errno = errno;
574 (void)close(fd);
575 return tls_error(US"fdopen(TLS cache stat fd) failed",
cf0c6164 576 strerror(saved_errno), NULL, errstr);
b5aea5e1 577 }
059ec3d9 578
b5aea5e1 579 m.size = statbuf.st_size;
40c90bca 580 if (!(m.data = malloc(m.size)))
17c76198
PP
581 {
582 fclose(fp);
cf0c6164 583 return tls_error(US"malloc failed", strerror(errno), NULL, errstr);
17c76198 584 }
40c90bca 585 if (!(sz = fread(m.data, m.size, 1, fp)))
17c76198
PP
586 {
587 saved_errno = errno;
588 fclose(fp);
589 free(m.data);
cf0c6164 590 return tls_error(US"fread failed", strerror(saved_errno), NULL, errstr);
17c76198
PP
591 }
592 fclose(fp);
b5aea5e1 593
17c76198 594 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 595 free(m.data);
17c76198
PP
596 exim_gnutls_err_check(US"gnutls_dh_params_import_pkcs3");
597 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
598 }
599
600/* If the file does not exist, fall through to compute new data and cache it.
601If there was any other opening error, it is serious. */
602
182ad5cf
PH
603else if (errno == ENOENT)
604 {
17c76198 605 rc = -1;
182ad5cf 606 DEBUG(D_tls)
17c76198 607 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
608 }
609else
17c76198 610 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
cf0c6164 611 NULL, NULL, errstr);
b5aea5e1
PH
612
613/* If ret < 0, either the cache file does not exist, or the data it contains
614is not useful. One particular case of this is when upgrading from an older
615release of Exim in which the data was stored in a different format. We don't
616try to be clever and support both formats; we just regenerate new data in this
617case. */
618
17c76198 619if (rc < 0)
b5aea5e1 620 {
17c76198 621 uschar *temp_fn;
201f5254 622 unsigned int dh_bits_gen = dh_bits;
059ec3d9 623
17c76198
PP
624 if ((PATH_MAX - Ustrlen(filename)) < 10)
625 return tls_error(US"Filename too long to generate replacement",
cf0c6164 626 CS filename, NULL, errstr);
059ec3d9 627
17c76198 628 temp_fn = string_copy(US "%s.XXXXXXX");
f5d25c2b 629 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
cf0c6164 630 return tls_error(US"Unable to open temp file", strerror(errno), NULL, errstr);
059ec3d9
PH
631 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
632
201f5254
PP
633 /* GnuTLS overshoots!
634 * If we ask for 2236, we might get 2237 or more.
635 * But there's no way to ask GnuTLS how many bits there really are.
636 * We can ask how many bits were used in a TLS session, but that's it!
637 * The prime itself is hidden behind too much abstraction.
638 * So we ask for less, and proceed on a wing and a prayer.
639 * First attempt, subtracted 3 for 2233 and got 2240.
640 */
cae6e576 641 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
642 {
643 dh_bits_gen = dh_bits - 10;
644 DEBUG(D_tls)
645 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
646 dh_bits_gen);
647 }
648
649 DEBUG(D_tls)
650 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
651 dh_bits_gen);
652 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
17c76198
PP
653 exim_gnutls_err_check(US"gnutls_dh_params_generate2");
654
655 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
656 and I confirmed that a NULL call to get the size first is how the GnuTLS
657 sample apps handle this. */
658
659 sz = 0;
660 m.data = NULL;
661 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
662 m.data, &sz);
663 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
664 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
665 m.size = sz;
40c90bca 666 if (!(m.data = malloc(m.size)))
cf0c6164 667 return tls_error(US"memory allocation failed", strerror(errno), NULL, errstr);
40c90bca 668
1f00591e 669 /* this will return a size 1 less than the allocation size above */
17c76198 670 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 671 m.data, &sz);
17c76198
PP
672 if (rc != GNUTLS_E_SUCCESS)
673 {
674 free(m.data);
675 exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3() real");
676 }
1f00591e 677 m.size = sz; /* shrink by 1, probably */
059ec3d9 678
f5d25c2b 679 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
17c76198
PP
680 {
681 free(m.data);
682 return tls_error(US"TLS cache write D-H params failed",
cf0c6164 683 strerror(errno), NULL, errstr);
17c76198 684 }
b5aea5e1 685 free(m.data);
f5d25c2b 686 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
17c76198 687 return tls_error(US"TLS cache write D-H params final newline failed",
cf0c6164 688 strerror(errno), NULL, errstr);
17c76198 689
f5d25c2b 690 if ((rc = close(fd)))
cf0c6164 691 return tls_error(US"TLS cache write close() failed", strerror(errno), NULL, errstr);
059ec3d9 692
17c76198
PP
693 if (Urename(temp_fn, filename) < 0)
694 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
cf0c6164 695 temp_fn, filename), strerror(errno), NULL, errstr);
059ec3d9 696
17c76198 697 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
698 }
699
17c76198 700DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
701return OK;
702}
703
704
705
706
23bb6982
JH
707/* Create and install a selfsigned certificate, for use in server mode */
708
709static int
cf0c6164 710tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
23bb6982
JH
711{
712gnutls_x509_crt_t cert = NULL;
713time_t now;
714gnutls_x509_privkey_t pkey = NULL;
715const uschar * where;
716int rc;
717
718where = US"initialising pkey";
719if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
720
721where = US"initialising cert";
722if ((rc = gnutls_x509_crt_init(&cert))) goto err;
723
724where = US"generating pkey";
725if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
76075bb5 726#ifdef SUPPORT_PARAM_TO_PK_BITS
23bb6982 727 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_LOW),
76075bb5
JH
728#else
729 1024,
730#endif
731 0)))
23bb6982
JH
732 goto err;
733
734where = US"configuring cert";
735now = 0;
736if ( (rc = gnutls_x509_crt_set_version(cert, 3))
737 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
738 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
739 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
740 || (rc = gnutls_x509_crt_set_key(cert, pkey))
741
742 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
743 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
744 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
745 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
746 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
747 GNUTLS_OID_X520_COMMON_NAME, 0,
748 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
749 )
750 goto err;
751
752where = US"signing cert";
753if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
754
755where = US"installing selfsign cert";
756 /* Since: 2.4.0 */
757if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
758 goto err;
759
760rc = OK;
761
762out:
763 if (cert) gnutls_x509_crt_deinit(cert);
764 if (pkey) gnutls_x509_privkey_deinit(pkey);
765 return rc;
766
767err:
cf0c6164 768 rc = tls_error(where, gnutls_strerror(rc), NULL, errstr);
23bb6982
JH
769 goto out;
770}
771
772
773
774
059ec3d9 775/*************************************************
17c76198 776* Variables re-expanded post-SNI *
059ec3d9
PH
777*************************************************/
778
17c76198
PP
779/* Called from both server and client code, via tls_init(), and also from
780the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
781
782We can tell the two apart by state->received_sni being non-NULL in callback.
783
784The callback should not call us unless state->trigger_sni_changes is true,
785which we are responsible for setting on the first pass through.
059ec3d9
PH
786
787Arguments:
17c76198 788 state exim_gnutls_state_st *
cf0c6164 789 errstr error string pointer
059ec3d9
PH
790
791Returns: OK/DEFER/FAIL
792*/
793
794static int
cf0c6164 795tls_expand_session_files(exim_gnutls_state_st *state, uschar ** errstr)
059ec3d9 796{
1365611d 797struct stat statbuf;
059ec3d9 798int rc;
17c76198
PP
799const host_item *host = state->host; /* macro should be reconsidered? */
800uschar *saved_tls_certificate = NULL;
801uschar *saved_tls_privatekey = NULL;
802uschar *saved_tls_verify_certificates = NULL;
803uschar *saved_tls_crl = NULL;
804int cert_count;
805
806/* We check for tls_sni *before* expansion. */
2b4a568d 807if (!host) /* server */
17c76198
PP
808 if (!state->received_sni)
809 {
d9b2312b
JH
810 if (state->tls_certificate &&
811 (Ustrstr(state->tls_certificate, US"tls_sni") ||
812 Ustrstr(state->tls_certificate, US"tls_in_sni") ||
813 Ustrstr(state->tls_certificate, US"tls_out_sni")
814 ))
17c76198
PP
815 {
816 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
817 state->trigger_sni_changes = TRUE;
818 }
819 }
820 else
821 {
1365611d 822 /* useful for debugging */
17c76198
PP
823 saved_tls_certificate = state->exp_tls_certificate;
824 saved_tls_privatekey = state->exp_tls_privatekey;
825 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
826 saved_tls_crl = state->exp_tls_crl;
827 }
059ec3d9 828
1365611d
PP
829rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
830exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
831
17c76198
PP
832/* remember: expand_check_tlsvar() is expand_check() but fiddling with
833state members, assuming consistent naming; and expand_check() returns
834false if expansion failed, unless expansion was forced to fail. */
059ec3d9 835
17c76198
PP
836/* check if we at least have a certificate, before doing expensive
837D-H generation. */
059ec3d9 838
cf0c6164 839if (!expand_check_tlsvar(tls_certificate, errstr))
17c76198 840 return DEFER;
059ec3d9 841
17c76198 842/* certificate is mandatory in server, optional in client */
059ec3d9 843
23bb6982
JH
844if ( !state->exp_tls_certificate
845 || !*state->exp_tls_certificate
846 )
2b4a568d 847 if (!host)
cf0c6164 848 return tls_install_selfsign(state, errstr);
17c76198
PP
849 else
850 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
059ec3d9 851
cf0c6164 852if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
059ec3d9
PH
853 return DEFER;
854
17c76198
PP
855/* tls_privatekey is optional, defaulting to same file as certificate */
856
857if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 858 {
17c76198
PP
859 state->tls_privatekey = state->tls_certificate;
860 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 861 }
c91535f3 862
059ec3d9 863
17c76198 864if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
865 {
866 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
867 state->exp_tls_certificate, state->exp_tls_privatekey);
868
869 if (state->received_sni)
23bb6982
JH
870 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
871 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
872 )
17c76198 873 {
b34fc30c 874 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
875 }
876 else
877 {
b34fc30c 878 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 879 }
059ec3d9 880
1365611d
PP
881 rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
882 CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
883 GNUTLS_X509_FMT_PEM);
884 exim_gnutls_err_check(
885 string_sprintf("cert/key setup: cert=%s key=%s",
886 state->exp_tls_certificate, state->exp_tls_privatekey));
887 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
b34fc30c 888 } /* tls_certificate */
059ec3d9 889
2b4a568d
JH
890
891/* Set the OCSP stapling server info */
892
f2de3a33 893#ifndef DISABLE_OCSP
2b4a568d
JH
894if ( !host /* server */
895 && tls_ocsp_file
896 )
897 {
9196d5bf
JH
898 if (gnutls_buggy_ocsp)
899 {
900 DEBUG(D_tls) debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
901 }
902 else
903 {
904 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file",
cf0c6164 905 &state->exp_tls_ocsp_file, errstr))
9196d5bf 906 return DEFER;
2b4a568d 907
9196d5bf
JH
908 /* Use the full callback method for stapling just to get observability.
909 More efficient would be to read the file once only, if it never changed
910 (due to SNI). Would need restart on file update, or watch datestamp. */
44662487 911
9196d5bf
JH
912 gnutls_certificate_set_ocsp_status_request_function(state->x509_cred,
913 server_ocsp_stapling_cb, state->exp_tls_ocsp_file);
2b4a568d 914
9196d5bf
JH
915 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", state->exp_tls_ocsp_file);
916 }
2b4a568d
JH
917 }
918#endif
919
920
059ec3d9
PH
921/* Set the trusted CAs file if one is provided, and then add the CRL if one is
922provided. Experiment shows that, if the certificate file is empty, an unhelpful
923error message is provided. However, if we just refrain from setting anything up
924in that case, certificate verification fails, which seems to be the correct
925behaviour. */
926
610ff438 927if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 928 {
cf0c6164 929 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
059ec3d9 930 return DEFER;
610ff438
JH
931#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
932 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
933 state->exp_tls_verify_certificates = NULL;
934#endif
17c76198 935 if (state->tls_crl && *state->tls_crl)
cf0c6164 936 if (!expand_check_tlsvar(tls_crl, errstr))
17c76198 937 return DEFER;
059ec3d9 938
1365611d
PP
939 if (!(state->exp_tls_verify_certificates &&
940 *state->exp_tls_verify_certificates))
b34fc30c
PP
941 {
942 DEBUG(D_tls)
1365611d
PP
943 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
944 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 945 return OK;
b34fc30c 946 }
1365611d 947 }
83e2f8a2
PP
948else
949 {
950 DEBUG(D_tls)
951 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
952 return OK;
953 }
17c76198 954
cb1d7830
JH
955#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
956if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
957 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
958else
959#endif
1365611d 960 {
cb1d7830
JH
961 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
962 {
963 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
964 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
965 strerror(errno));
966 return DEFER;
967 }
17c76198 968
a7fec7a7 969#ifndef SUPPORT_CA_DIR
cb1d7830
JH
970 /* The test suite passes in /dev/null; we could check for that path explicitly,
971 but who knows if someone has some weird FIFO which always dumps some certs, or
972 other weirdness. The thing we really want to check is that it's not a
973 directory, since while OpenSSL supports that, GnuTLS does not.
60f914bc 974 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
cb1d7830
JH
975 if (S_ISDIR(statbuf.st_mode))
976 {
977 DEBUG(D_tls)
978 debug_printf("verify certificates path is a dir: \"%s\"\n",
979 state->exp_tls_verify_certificates);
980 log_write(0, LOG_MAIN|LOG_PANIC,
981 "tls_verify_certificates \"%s\" is a directory",
982 state->exp_tls_verify_certificates);
983 return DEFER;
984 }
a7fec7a7 985#endif
059ec3d9 986
cb1d7830
JH
987 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
988 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 989
cb1d7830
JH
990 if (statbuf.st_size == 0)
991 {
992 DEBUG(D_tls)
993 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
994 return OK;
995 }
059ec3d9 996
cb1d7830 997 cert_count =
a7fec7a7
JH
998
999#ifdef SUPPORT_CA_DIR
cb1d7830
JH
1000 (statbuf.st_mode & S_IFMT) == S_IFDIR
1001 ?
1002 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1003 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1004 :
a7fec7a7 1005#endif
cb1d7830
JH
1006 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1007 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1008 }
a7fec7a7 1009
1365611d
PP
1010if (cert_count < 0)
1011 {
1012 rc = cert_count;
cb1d7830 1013 exim_gnutls_err_check(US"setting certificate trust");
1365611d
PP
1014 }
1015DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 1016
5c8cda3a
PP
1017if (state->tls_crl && *state->tls_crl &&
1018 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 1019 {
5c8cda3a
PP
1020 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1021 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1022 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1023 if (cert_count < 0)
1365611d 1024 {
5c8cda3a 1025 rc = cert_count;
1365611d
PP
1026 exim_gnutls_err_check(US"gnutls_certificate_set_x509_crl_file");
1027 }
5c8cda3a 1028 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 1029 }
059ec3d9 1030
059ec3d9
PH
1031return OK;
1032}
1033
1034
1035
1036
1037/*************************************************
1365611d
PP
1038* Set X.509 state variables *
1039*************************************************/
1040
1041/* In GnuTLS, the registered cert/key are not replaced by a later
1042set of a cert/key, so for SNI support we need a whole new x509_cred
1043structure. Which means various other non-re-expanded pieces of state
1044need to be re-set in the new struct, so the setting logic is pulled
1045out to this.
1046
1047Arguments:
1048 state exim_gnutls_state_st *
cf0c6164 1049 errstr error string pointer
1365611d
PP
1050
1051Returns: OK/DEFER/FAIL
1052*/
1053
1054static int
cf0c6164 1055tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1365611d
PP
1056{
1057int rc;
1058const host_item *host = state->host; /* macro should be reconsidered? */
1059
1060/* Create D-H parameters, or read them from the cache file. This function does
1061its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1062client-side params. */
1063
1064if (!state->host)
1065 {
1066 if (!dh_server_params)
1067 {
cf0c6164 1068 rc = init_server_dh(errstr);
1365611d
PP
1069 if (rc != OK) return rc;
1070 }
1071 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1072 }
1073
1074/* Link the credentials to the session. */
1075
1076rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
1077exim_gnutls_err_check(US"gnutls_credentials_set");
1078
1079return OK;
1080}
1081
1082/*************************************************
17c76198 1083* Initialize for GnuTLS *
059ec3d9
PH
1084*************************************************/
1085
9196d5bf 1086
4fb7df6d
JH
1087#ifndef DISABLE_OCSP
1088
9196d5bf
JH
1089static BOOL
1090tls_is_buggy_ocsp(void)
1091{
1092const uschar * s;
1093uschar maj, mid, mic;
1094
1095s = CUS gnutls_check_version(NULL);
1096maj = atoi(CCS s);
1097if (maj == 3)
1098 {
1099 while (*s && *s != '.') s++;
1100 mid = atoi(CCS ++s);
1101 if (mid <= 2)
1102 return TRUE;
1103 else if (mid >= 5)
1104 return FALSE;
1105 else
1106 {
1107 while (*s && *s != '.') s++;
1108 mic = atoi(CCS ++s);
1109 return mic <= (mid == 3 ? 16 : 3);
1110 }
1111 }
1112return FALSE;
1113}
1114
4fb7df6d 1115#endif
9196d5bf
JH
1116
1117
17c76198
PP
1118/* Called from both server and client code. In the case of a server, errors
1119before actual TLS negotiation return DEFER.
059ec3d9
PH
1120
1121Arguments:
17c76198
PP
1122 host connected host, if client; NULL if server
1123 certificate certificate file
1124 privatekey private key file
1125 sni TLS SNI to send, sometimes when client; else NULL
1126 cas CA certs file
1127 crl CRL file
1128 require_ciphers tls_require_ciphers setting
817d9f57 1129 caller_state returned state-info structure
cf0c6164 1130 errstr error string pointer
059ec3d9 1131
17c76198 1132Returns: OK/DEFER/FAIL
059ec3d9
PH
1133*/
1134
17c76198
PP
1135static int
1136tls_init(
1137 const host_item *host,
1138 const uschar *certificate,
1139 const uschar *privatekey,
1140 const uschar *sni,
1141 const uschar *cas,
1142 const uschar *crl,
1143 const uschar *require_ciphers,
cf0c6164
JH
1144 exim_gnutls_state_st **caller_state,
1145 uschar ** errstr)
059ec3d9 1146{
17c76198
PP
1147exim_gnutls_state_st *state;
1148int rc;
1149size_t sz;
1150const char *errpos;
1151uschar *p;
1152BOOL want_default_priorities;
1153
1154if (!exim_gnutls_base_init_done)
059ec3d9 1155 {
17c76198
PP
1156 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1157
a5f239e4
PP
1158#ifdef HAVE_GNUTLS_PKCS11
1159 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1160 which loads modules from a config file, which sounds good and may be wanted
1161 by some sysadmin, but also means in common configurations that GNOME keyring
1162 environment variables are used and so breaks for users calling mailq.
1163 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1164 if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
1165 {
1166 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
1167 exim_gnutls_err_check(US"gnutls_pkcs11_init");
1168 }
1169#endif
1170
17c76198
PP
1171 rc = gnutls_global_init();
1172 exim_gnutls_err_check(US"gnutls_global_init");
1173
1174#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1175 DEBUG(D_tls)
059ec3d9 1176 {
17c76198
PP
1177 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1178 /* arbitrarily chosen level; bump upto 9 for more */
1179 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1180 }
17c76198
PP
1181#endif
1182
4fb7df6d
JH
1183#ifndef DISABLE_OCSP
1184 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
9196d5bf 1185 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
4fb7df6d 1186#endif
9196d5bf 1187
17c76198 1188 exim_gnutls_base_init_done = TRUE;
059ec3d9 1189 }
059ec3d9 1190
17c76198
PP
1191if (host)
1192 {
1193 state = &state_client;
1194 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 1195 state->tlsp = &tls_out;
17c76198
PP
1196 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1197 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1198 }
1199else
1200 {
1201 state = &state_server;
1202 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 1203 state->tlsp = &tls_in;
17c76198
PP
1204 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1205 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1206 }
1207exim_gnutls_err_check(US"gnutls_init");
059ec3d9 1208
17c76198 1209state->host = host;
059ec3d9 1210
17c76198
PP
1211state->tls_certificate = certificate;
1212state->tls_privatekey = privatekey;
5779e6aa 1213state->tls_require_ciphers = require_ciphers;
17c76198
PP
1214state->tls_sni = sni;
1215state->tls_verify_certificates = cas;
1216state->tls_crl = crl;
059ec3d9 1217
17c76198
PP
1218/* This handles the variables that might get re-expanded after TLS SNI;
1219that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1220
17c76198
PP
1221DEBUG(D_tls)
1222 debug_printf("Expanding various TLS configuration options for session credentials.\n");
cf0c6164 1223if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
059ec3d9 1224
1365611d
PP
1225/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1226requires a new structure afterwards. */
83da1223 1227
cf0c6164 1228if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
83da1223 1229
17c76198
PP
1230/* set SNI in client, only */
1231if (host)
1232 {
cf0c6164 1233 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
17c76198 1234 return DEFER;
0df4ab80 1235 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1236 {
1237 DEBUG(D_tls)
0df4ab80
JH
1238 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1239 sz = Ustrlen(state->tlsp->sni);
17c76198 1240 rc = gnutls_server_name_set(state->session,
0df4ab80 1241 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
17c76198
PP
1242 exim_gnutls_err_check(US"gnutls_server_name_set");
1243 }
1244 }
1245else if (state->tls_sni)
1246 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
1247 "have an SNI set for a client [%s]\n", state->tls_sni);
83da1223 1248
17c76198 1249/* This is the priority string support,
42bfef1e 1250http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1251and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1252This was backwards incompatible, but means Exim no longer needs to track
1253all algorithms and provide string forms for them. */
83da1223 1254
17c76198 1255want_default_priorities = TRUE;
83da1223 1256
17c76198 1257if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1258 {
cf0c6164 1259 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
17c76198
PP
1260 return DEFER;
1261 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1262 {
17c76198
PP
1263 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1264 state->exp_tls_require_ciphers);
1265
1266 rc = gnutls_priority_init(&state->priority_cache,
1267 CS state->exp_tls_require_ciphers, &errpos);
1268 want_default_priorities = FALSE;
1269 p = state->exp_tls_require_ciphers;
83da1223
PH
1270 }
1271 }
17c76198
PP
1272if (want_default_priorities)
1273 {
83e2f8a2
PP
1274 DEBUG(D_tls)
1275 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1276 exim_default_gnutls_priority);
17c76198
PP
1277 rc = gnutls_priority_init(&state->priority_cache,
1278 exim_default_gnutls_priority, &errpos);
1279 p = US exim_default_gnutls_priority;
1280 }
83da1223 1281
17c76198
PP
1282exim_gnutls_err_check(string_sprintf(
1283 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1284 p, errpos - CS p, errpos));
1285
1286rc = gnutls_priority_set(state->session, state->priority_cache);
1287exim_gnutls_err_check(US"gnutls_priority_set");
1288
1289gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1290
1291/* Reduce security in favour of increased compatibility, if the admin
1292decides to make that trade-off. */
1293if (gnutls_compat_mode)
83da1223 1294 {
17c76198
PP
1295#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1296 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1297 gnutls_session_enable_compatibility_mode(state->session);
1298#else
1299 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1300#endif
83da1223
PH
1301 }
1302
17c76198 1303*caller_state = state;
17c76198 1304return OK;
83da1223
PH
1305}
1306
1307
1308
83da1223 1309/*************************************************
17c76198 1310* Extract peer information *
059ec3d9
PH
1311*************************************************/
1312
17c76198 1313/* Called from both server and client code.
4fe99a6c
PP
1314Only this is allowed to set state->peerdn and state->have_set_peerdn
1315and we use that to detect double-calls.
059ec3d9 1316
75fe387d
PP
1317NOTE: the state blocks last while the TLS connection is up, which is fine
1318for logging in the server side, but for the client side, we log after teardown
1319in src/deliver.c. While the session is up, we can twist about states and
1320repoint tls_* globals, but those variables used for logging or other variable
1321expansion that happens _after_ delivery need to have a longer life-time.
1322
1323So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1324doing this more than once per generation of a state context. We set them in
1325the state context, and repoint tls_* to them. After the state goes away, the
1326tls_* copies of the pointers remain valid and client delivery logging is happy.
1327
1328tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1329don't apply.
1330
059ec3d9 1331Arguments:
17c76198 1332 state exim_gnutls_state_st *
cf0c6164 1333 errstr pointer to error string
059ec3d9 1334
17c76198 1335Returns: OK/DEFER/FAIL
059ec3d9
PH
1336*/
1337
17c76198 1338static int
cf0c6164 1339peer_status(exim_gnutls_state_st *state, uschar ** errstr)
059ec3d9 1340{
75fe387d 1341uschar cipherbuf[256];
27f19eb4 1342const gnutls_datum_t *cert_list;
75fe387d 1343int old_pool, rc;
17c76198 1344unsigned int cert_list_size = 0;
4fe99a6c
PP
1345gnutls_protocol_t protocol;
1346gnutls_cipher_algorithm_t cipher;
1347gnutls_kx_algorithm_t kx;
1348gnutls_mac_algorithm_t mac;
17c76198
PP
1349gnutls_certificate_type_t ct;
1350gnutls_x509_crt_t crt;
4fe99a6c 1351uschar *p, *dn_buf;
17c76198 1352size_t sz;
059ec3d9 1353
4fe99a6c 1354if (state->have_set_peerdn)
17c76198 1355 return OK;
4fe99a6c 1356state->have_set_peerdn = TRUE;
059ec3d9 1357
4fe99a6c 1358state->peerdn = NULL;
059ec3d9 1359
4fe99a6c
PP
1360/* tls_cipher */
1361cipher = gnutls_cipher_get(state->session);
1362protocol = gnutls_protocol_get_version(state->session);
1363mac = gnutls_mac_get(state->session);
1364kx = gnutls_kx_get(state->session);
1365
75fe387d 1366string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1367 "%s:%s:%d",
1368 gnutls_protocol_get_name(protocol),
1369 gnutls_cipher_suite_get_name(kx, cipher, mac),
1370 (int) gnutls_cipher_get_key_size(cipher) * 8);
1371
1372/* I don't see a way that spaces could occur, in the current GnuTLS
1373code base, but it was a concern in the old code and perhaps older GnuTLS
1374releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1375for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1376 if (isspace(*p))
1377 *p = '-';
75fe387d
PP
1378old_pool = store_pool;
1379store_pool = POOL_PERM;
1380state->ciphersuite = string_copy(cipherbuf);
1381store_pool = old_pool;
817d9f57 1382state->tlsp->cipher = state->ciphersuite;
4fe99a6c
PP
1383
1384/* tls_peerdn */
17c76198 1385cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1386
17c76198
PP
1387if (cert_list == NULL || cert_list_size == 0)
1388 {
17c76198
PP
1389 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1390 cert_list, cert_list_size);
e51c7be2 1391 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1392 return tls_error(US"certificate verification failed",
cf0c6164 1393 "no certificate received from peer", state->host, errstr);
17c76198
PP
1394 return OK;
1395 }
059ec3d9 1396
17c76198
PP
1397ct = gnutls_certificate_type_get(state->session);
1398if (ct != GNUTLS_CRT_X509)
059ec3d9 1399 {
17c76198 1400 const char *ctn = gnutls_certificate_type_get_name(ct);
17c76198
PP
1401 DEBUG(D_tls)
1402 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1403 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1404 return tls_error(US"certificate verification not possible, unhandled type",
cf0c6164 1405 ctn, state->host, errstr);
17c76198 1406 return OK;
83da1223 1407 }
059ec3d9 1408
e51c7be2
JH
1409#define exim_gnutls_peer_err(Label) \
1410 do { \
1411 if (rc != GNUTLS_E_SUCCESS) \
1412 { \
1413 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1414 (Label), gnutls_strerror(rc)); \
1415 if (state->verify_requirement >= VERIFY_REQUIRED) \
cf0c6164 1416 return tls_error((Label), gnutls_strerror(rc), state->host, errstr); \
e51c7be2
JH
1417 return OK; \
1418 } \
1419 } while (0)
17c76198 1420
9d1c15ef
JH
1421rc = import_cert(&cert_list[0], &crt);
1422exim_gnutls_peer_err(US"cert 0");
1423
1424state->tlsp->peercert = state->peercert = crt;
17c76198 1425
17c76198
PP
1426sz = 0;
1427rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1428if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1429 {
17c76198
PP
1430 exim_gnutls_peer_err(US"getting size for cert DN failed");
1431 return FAIL; /* should not happen */
059ec3d9 1432 }
17c76198
PP
1433dn_buf = store_get_perm(sz);
1434rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1435exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1436
17c76198
PP
1437state->peerdn = dn_buf;
1438
1439return OK;
1440#undef exim_gnutls_peer_err
1441}
059ec3d9 1442
059ec3d9 1443
059ec3d9 1444
059ec3d9 1445
17c76198
PP
1446/*************************************************
1447* Verify peer certificate *
1448*************************************************/
059ec3d9 1449
17c76198
PP
1450/* Called from both server and client code.
1451*Should* be using a callback registered with
1452gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1453the peer information, but that's too new for some OSes.
059ec3d9 1454
17c76198
PP
1455Arguments:
1456 state exim_gnutls_state_st *
cf0c6164 1457 errstr where to put an error message
059ec3d9 1458
17c76198
PP
1459Returns:
1460 FALSE if the session should be rejected
1461 TRUE if the cert is okay or we just don't care
1462*/
059ec3d9 1463
17c76198 1464static BOOL
cf0c6164 1465verify_certificate(exim_gnutls_state_st *state, uschar ** errstr)
17c76198
PP
1466{
1467int rc;
1468unsigned int verify;
1469
cf0c6164 1470*errstr = NULL;
17c76198 1471
cf0c6164 1472if ((rc = peer_status(state, errstr)) != OK)
e6060e2c 1473 {
17c76198 1474 verify = GNUTLS_CERT_INVALID;
cf0c6164 1475 *errstr = US"certificate not supplied";
17c76198
PP
1476 }
1477else
17c76198 1478 rc = gnutls_certificate_verify_peers2(state->session, &verify);
e6060e2c 1479
17c76198
PP
1480/* Handle the result of verification. INVALID seems to be set as well
1481as REVOKED, but leave the test for both. */
059ec3d9 1482
e51c7be2
JH
1483if (rc < 0 ||
1484 verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)
1485 )
17c76198
PP
1486 {
1487 state->peer_cert_verified = FALSE;
cf0c6164
JH
1488 if (!*errstr)
1489 *errstr = verify & GNUTLS_CERT_REVOKED
1490 ? US"certificate revoked" : US"certificate invalid";
059ec3d9 1491
17c76198 1492 DEBUG(D_tls)
e51c7be2 1493 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
cf0c6164 1494 *errstr, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1495
e51c7be2 1496 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1497 {
e51c7be2
JH
1498 gnutls_alert_send(state->session,
1499 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
17c76198
PP
1500 return FALSE;
1501 }
1502 DEBUG(D_tls)
4789da3a 1503 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 1504 }
e51c7be2 1505
17c76198
PP
1506else
1507 {
aa2a70ba 1508 if (state->exp_tls_verify_cert_hostnames)
e51c7be2
JH
1509 {
1510 int sep = 0;
55414b25 1511 const uschar * list = state->exp_tls_verify_cert_hostnames;
e51c7be2 1512 uschar * name;
76075bb5 1513 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
e51c7be2
JH
1514 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1515 break;
1516 if (!name)
1517 {
1518 DEBUG(D_tls)
1519 debug_printf("TLS certificate verification failed: cert name mismatch\n");
aa2a70ba
JH
1520 if (state->verify_requirement >= VERIFY_REQUIRED)
1521 {
1522 gnutls_alert_send(state->session,
1523 GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1524 return FALSE;
1525 }
1526 return TRUE;
e51c7be2
JH
1527 }
1528 }
17c76198 1529 state->peer_cert_verified = TRUE;
e51c7be2 1530 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 1531 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1532 }
059ec3d9 1533
817d9f57 1534state->tlsp->peerdn = state->peerdn;
059ec3d9 1535
17c76198
PP
1536return TRUE;
1537}
059ec3d9 1538
17c76198
PP
1539
1540
1541
1542/* ------------------------------------------------------------------------ */
1543/* Callbacks */
1544
1545/* Logging function which can be registered with
1546 * gnutls_global_set_log_function()
1547 * gnutls_global_set_log_level() 0..9
1548 */
af3498d6 1549#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1550static void
17c76198 1551exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1552{
8c79eebf
PP
1553 size_t len = strlen(message);
1554 if (len < 1)
1555 {
1556 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1557 return;
1558 }
1559 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1560 message[len-1] == '\n' ? "" : "\n");
17c76198 1561}
af3498d6 1562#endif
059ec3d9 1563
059ec3d9 1564
17c76198
PP
1565/* Called after client hello, should handle SNI work.
1566This will always set tls_sni (state->received_sni) if available,
1567and may trigger presenting different certificates,
1568if state->trigger_sni_changes is TRUE.
059ec3d9 1569
17c76198
PP
1570Should be registered with
1571 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1572
17c76198
PP
1573"This callback must return 0 on success or a gnutls error code to terminate the
1574handshake.".
059ec3d9 1575
17c76198
PP
1576For inability to get SNI information, we return 0.
1577We only return non-zero if re-setup failed.
817d9f57 1578Only used for server-side TLS.
17c76198 1579*/
44bbabb5 1580
17c76198
PP
1581static int
1582exim_sni_handling_cb(gnutls_session_t session)
1583{
1584char sni_name[MAX_HOST_LEN];
1585size_t data_len = MAX_HOST_LEN;
817d9f57 1586exim_gnutls_state_st *state = &state_server;
17c76198
PP
1587unsigned int sni_type;
1588int rc, old_pool;
cf0c6164 1589uschar * dummy_errstr;
17c76198
PP
1590
1591rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1592if (rc != GNUTLS_E_SUCCESS)
1593 {
1594 DEBUG(D_tls) {
1595 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1596 debug_printf("TLS: no SNI presented in handshake.\n");
1597 else
1598 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1599 gnutls_strerror(rc), rc);
cf0c6164 1600 }
b34fc30c
PP
1601 return 0;
1602 }
1603
17c76198
PP
1604if (sni_type != GNUTLS_NAME_DNS)
1605 {
1606 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1607 return 0;
1608 }
44bbabb5 1609
17c76198
PP
1610/* We now have a UTF-8 string in sni_name */
1611old_pool = store_pool;
1612store_pool = POOL_PERM;
1613state->received_sni = string_copyn(US sni_name, data_len);
1614store_pool = old_pool;
1615
1616/* We set this one now so that variable expansions below will work */
817d9f57 1617state->tlsp->sni = state->received_sni;
17c76198
PP
1618
1619DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1620 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1621
1622if (!state->trigger_sni_changes)
1623 return 0;
1624
cf0c6164 1625if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
17c76198
PP
1626 {
1627 /* If the setup of certs/etc failed before handshake, TLS would not have
1628 been offered. The best we can do now is abort. */
1629 return GNUTLS_E_APPLICATION_ERROR_MIN;
1630 }
1631
cf0c6164 1632rc = tls_set_remaining_x509(state, &dummy_errstr);
1365611d
PP
1633if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1634
1635return 0;
059ec3d9
PH
1636}
1637
1638
1639
f2de3a33 1640#ifndef DISABLE_OCSP
44662487
JH
1641
1642static int
1643server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1644 gnutls_datum_t * ocsp_response)
1645{
1646int ret;
1647
44662487
JH
1648if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1649 {
1650 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
1651 (char *)ptr);
018058b2 1652 tls_in.ocsp = OCSP_NOT_RESP;
44662487
JH
1653 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1654 }
1655
018058b2 1656tls_in.ocsp = OCSP_VFY_NOT_TRIED;
44662487
JH
1657return 0;
1658}
1659
1660#endif
1661
1662
0cbf2b82 1663#ifndef DISABLE_EVENT
a7538db1
JH
1664/*
1665We use this callback to get observability and detail-level control
723fe533
JH
1666for an exim TLS connection (either direction), raising a tls:cert event
1667for each cert in the chain presented by the peer. Any event
a7538db1
JH
1668can deny verification.
1669
1670Return 0 for the handshake to continue or non-zero to terminate.
1671*/
1672
1673static int
723fe533 1674verify_cb(gnutls_session_t session)
a7538db1 1675{
27f19eb4 1676const gnutls_datum_t * cert_list;
a7538db1
JH
1677unsigned int cert_list_size = 0;
1678gnutls_x509_crt_t crt;
1679int rc;
b30275b8 1680uschar * yield;
a7538db1
JH
1681exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1682
1683cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1684if (cert_list)
1685 while (cert_list_size--)
1686 {
1687 rc = import_cert(&cert_list[cert_list_size], &crt);
1688 if (rc != GNUTLS_E_SUCCESS)
1689 {
1690 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1691 cert_list_size, gnutls_strerror(rc));
1692 break;
1693 }
1694
1695 state->tlsp->peercert = crt;
b30275b8
JH
1696 if ((yield = event_raise(state->event_action,
1697 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
1698 {
1699 log_write(0, LOG_MAIN,
b30275b8
JH
1700 "SSL verify denied by event-action: depth=%d: %s",
1701 cert_list_size, yield);
a7538db1
JH
1702 return 1; /* reject */
1703 }
1704 state->tlsp->peercert = NULL;
1705 }
1706
1707return 0;
1708}
1709
1710#endif
44662487
JH
1711
1712
17c76198
PP
1713
1714/* ------------------------------------------------------------------------ */
1715/* Exported functions */
1716
1717
1718
1719
059ec3d9
PH
1720/*************************************************
1721* Start a TLS session in a server *
1722*************************************************/
1723
1724/* This is called when Exim is running as a server, after having received
1725the STARTTLS command. It must respond to that command, and then negotiate
1726a TLS session.
1727
1728Arguments:
83da1223 1729 require_ciphers list of allowed ciphers or NULL
cf0c6164 1730 errstr pointer to error string
059ec3d9
PH
1731
1732Returns: OK on success
1733 DEFER for errors before the start of the negotiation
4c04137d 1734 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
1735 continue running.
1736*/
1737
1738int
cf0c6164 1739tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
1740{
1741int rc;
cf0c6164 1742exim_gnutls_state_st * state = NULL;
059ec3d9
PH
1743
1744/* Check for previous activation */
817d9f57 1745if (tls_in.active >= 0)
059ec3d9 1746 {
cf0c6164 1747 tls_error(US"STARTTLS received after TLS started", "", NULL, errstr);
059ec3d9
PH
1748 smtp_printf("554 Already in TLS\r\n");
1749 return FAIL;
1750 }
1751
1752/* Initialize the library. If it fails, it will already have logged the error
1753and sent an SMTP response. */
1754
17c76198 1755DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 1756
cf0c6164 1757if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
17c76198 1758 NULL, tls_verify_certificates, tls_crl,
cf0c6164 1759 require_ciphers, &state, errstr)) != OK) return rc;
059ec3d9 1760
059ec3d9
PH
1761/* If this is a host for which certificate verification is mandatory or
1762optional, set up appropriately. */
1763
059ec3d9 1764if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 1765 {
e51c7be2
JH
1766 DEBUG(D_tls)
1767 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
1768 state->verify_requirement = VERIFY_REQUIRED;
1769 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1770 }
059ec3d9 1771else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 1772 {
e51c7be2
JH
1773 DEBUG(D_tls)
1774 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
1775 state->verify_requirement = VERIFY_OPTIONAL;
1776 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
1777 }
1778else
1779 {
e51c7be2
JH
1780 DEBUG(D_tls)
1781 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
1782 state->verify_requirement = VERIFY_NONE;
1783 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
1784 }
059ec3d9 1785
0cbf2b82 1786#ifndef DISABLE_EVENT
723fe533
JH
1787if (event_action)
1788 {
1789 state->event_action = event_action;
1790 gnutls_session_set_ptr(state->session, state);
1791 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
1792 }
1793#endif
1794
17c76198
PP
1795/* Register SNI handling; always, even if not in tls_certificate, so that the
1796expansion variable $tls_sni is always available. */
059ec3d9 1797
17c76198
PP
1798gnutls_handshake_set_post_client_hello_function(state->session,
1799 exim_sni_handling_cb);
059ec3d9
PH
1800
1801/* Set context and tell client to go ahead, except in the case of TLS startup
1802on connection, where outputting anything now upsets the clients and tends to
1803make them disconnect. We need to have an explicit fflush() here, to force out
1804the response. Other smtp_printf() calls do not need it, because in non-TLS
1805mode, the fflush() happens when smtp_getc() is called. */
1806
817d9f57 1807if (!state->tlsp->on_connect)
059ec3d9
PH
1808 {
1809 smtp_printf("220 TLS go ahead\r\n");
9d1c15ef 1810 fflush(smtp_out);
059ec3d9
PH
1811 }
1812
1813/* Now negotiate the TLS session. We put our own timer on it, since it seems
1814that the GnuTLS library doesn't. */
1815
17c76198 1816gnutls_transport_set_ptr2(state->session,
27f19eb4
JH
1817 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
1818 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
17c76198
PP
1819state->fd_in = fileno(smtp_in);
1820state->fd_out = fileno(smtp_out);
059ec3d9
PH
1821
1822sigalrm_seen = FALSE;
1823if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 1824do
17c76198 1825 rc = gnutls_handshake(state->session);
157a7880 1826while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
059ec3d9
PH
1827alarm(0);
1828
17c76198 1829if (rc != GNUTLS_E_SUCCESS)
059ec3d9 1830 {
059ec3d9
PH
1831 /* It seems that, except in the case of a timeout, we have to close the
1832 connection right here; otherwise if the other end is running OpenSSL it hangs
1833 until the server times out. */
1834
60d10ce7 1835 if (sigalrm_seen)
ad7fc6eb 1836 {
cf0c6164 1837 tls_error(US"gnutls_handshake", "timed out", NULL, errstr);
ad7fc6eb
JH
1838 gnutls_db_remove_session(state->session);
1839 }
60d10ce7 1840 else
059ec3d9 1841 {
cf0c6164 1842 tls_error(US"gnutls_handshake", gnutls_strerror(rc), NULL, errstr);
f5d25c2b 1843 (void) gnutls_alert_send_appropriate(state->session, rc);
ad7fc6eb 1844 gnutls_deinit(state->session);
ed62aae3 1845 gnutls_certificate_free_credentials(state->x509_cred);
60d10ce7 1846 millisleep(500);
ad7fc6eb 1847 shutdown(state->fd_out, SHUT_WR);
60d10ce7 1848 for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--; /* drain skt */
f1e894f3
PH
1849 (void)fclose(smtp_out);
1850 (void)fclose(smtp_in);
60d10ce7 1851 smtp_out = smtp_in = NULL;
059ec3d9
PH
1852 }
1853
1854 return FAIL;
1855 }
1856
1857DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
1858
17c76198
PP
1859/* Verify after the fact */
1860
9d1c15ef 1861if ( state->verify_requirement != VERIFY_NONE
cf0c6164 1862 && !verify_certificate(state, errstr))
059ec3d9 1863 {
9d1c15ef 1864 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 1865 {
cf0c6164 1866 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
9d1c15ef 1867 return FAIL;
17c76198 1868 }
9d1c15ef
JH
1869 DEBUG(D_tls)
1870 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
cf0c6164 1871 *errstr);
059ec3d9
PH
1872 }
1873
17c76198
PP
1874/* Figure out peer DN, and if authenticated, etc. */
1875
cf0c6164 1876if ((rc = peer_status(state, NULL)) != OK) return rc;
17c76198
PP
1877
1878/* Sets various Exim expansion variables; always safe within server */
1879
9d1c15ef 1880extract_exim_vars_from_tls_state(state);
059ec3d9
PH
1881
1882/* TLS has been set up. Adjust the input functions to read via TLS,
1883and initialize appropriately. */
1884
17c76198 1885state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
1886
1887receive_getc = tls_getc;
584e96c6 1888receive_get_cache = tls_get_cache;
059ec3d9
PH
1889receive_ungetc = tls_ungetc;
1890receive_feof = tls_feof;
1891receive_ferror = tls_ferror;
58eb016e 1892receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1893
059ec3d9
PH
1894return OK;
1895}
1896
1897
1898
1899
aa2a70ba
JH
1900static void
1901tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
1902 smtp_transport_options_block * ob)
1903{
5130845b 1904if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 1905 {
4af0d74a 1906 state->exp_tls_verify_cert_hostnames =
8c5d388a 1907#ifdef SUPPORT_I18N
4af0d74a
JH
1908 string_domain_utf8_to_alabel(host->name, NULL);
1909#else
1910 host->name;
1911#endif
aa2a70ba
JH
1912 DEBUG(D_tls)
1913 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
1914 state->exp_tls_verify_cert_hostnames);
1915 }
1916}
aa2a70ba
JH
1917
1918
059ec3d9
PH
1919/*************************************************
1920* Start a TLS session in a client *
1921*************************************************/
1922
1923/* Called from the smtp transport after STARTTLS has been accepted.
1924
1925Arguments:
1926 fd the fd of the connection
1927 host connected host (for messages)
83da1223 1928 addr the first address (not used)
a7538db1 1929 tb transport (always smtp)
059ec3d9 1930
cf0c6164
JH
1931 errstr error string pointer
1932
059ec3d9
PH
1933Returns: OK/DEFER/FAIL (because using common functions),
1934 but for a client, DEFER and FAIL have the same meaning
1935*/
1936
1937int
17c76198 1938tls_client_start(int fd, host_item *host,
f5d78688 1939 address_item *addr ARG_UNUSED,
cf0c6164 1940 transport_instance * tb,
0e66b3b6 1941#ifdef EXPERIMENTAL_DANE
cf0c6164 1942 dns_answer * tlsa_dnsa ARG_UNUSED,
0e66b3b6 1943#endif
cf0c6164 1944 uschar ** errstr)
059ec3d9 1945{
a7538db1
JH
1946smtp_transport_options_block *ob =
1947 (smtp_transport_options_block *)tb->options_block;
059ec3d9 1948int rc;
17c76198 1949exim_gnutls_state_st *state = NULL;
f2de3a33 1950#ifndef DISABLE_OCSP
5130845b
JH
1951BOOL require_ocsp =
1952 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
44662487 1953BOOL request_ocsp = require_ocsp ? TRUE
5130845b 1954 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2b4a568d 1955#endif
059ec3d9 1956
17c76198 1957DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 1958
65867078
JH
1959if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
1960 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
cf0c6164 1961 ob->tls_require_ciphers, &state, errstr)) != OK)
2b4a568d 1962 return rc;
059ec3d9 1963
54c90be1 1964 {
65867078
JH
1965 int dh_min_bits = ob->tls_dh_min_bits;
1966 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
1967 {
1968 DEBUG(D_tls)
1969 debug_printf("WARNING: tls_dh_min_bits far too low,"
1970 " clamping %d up to %d\n",
1971 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
1972 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
1973 }
54c90be1 1974
65867078
JH
1975 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
1976 " acceptable bits to %d\n",
1977 dh_min_bits);
1978 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
1979 }
83da1223 1980
94431adb 1981/* Stick to the old behaviour for compatibility if tls_verify_certificates is
2b4a568d
JH
1982set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
1983the specified host patterns if one of them is defined */
1984
aa2a70ba
JH
1985if ( ( state->exp_tls_verify_certificates
1986 && !ob->tls_verify_hosts
610ff438 1987 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
aa2a70ba 1988 )
5130845b 1989 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
2b4a568d 1990 )
17c76198 1991 {
aa2a70ba 1992 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
1993 DEBUG(D_tls)
1994 debug_printf("TLS: server certificate verification required.\n");
1995 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
1996 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
1997 }
5130845b 1998else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
52f93eed 1999 {
aa2a70ba 2000 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
2001 DEBUG(D_tls)
2002 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 2003 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
2004 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2005 }
2006else
2007 {
e51c7be2
JH
2008 DEBUG(D_tls)
2009 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
2010 state->verify_requirement = VERIFY_NONE;
2011 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 2012 }
059ec3d9 2013
f2de3a33
JH
2014#ifndef DISABLE_OCSP
2015 /* supported since GnuTLS 3.1.3 */
44662487 2016if (request_ocsp)
9d1c15ef
JH
2017 {
2018 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
2019 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2020 NULL, 0, NULL)) != OK)
9d1c15ef 2021 return tls_error(US"cert-status-req",
cf0c6164 2022 gnutls_strerror(rc), state->host, errstr);
44662487 2023 tls_out.ocsp = OCSP_NOT_RESP;
9d1c15ef 2024 }
2b4a568d
JH
2025#endif
2026
0cbf2b82 2027#ifndef DISABLE_EVENT
774ef2d7 2028if (tb->event_action)
a7538db1 2029 {
774ef2d7 2030 state->event_action = tb->event_action;
a7538db1 2031 gnutls_session_set_ptr(state->session, state);
723fe533 2032 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
2033 }
2034#endif
2035
27f19eb4 2036gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
17c76198
PP
2037state->fd_in = fd;
2038state->fd_out = fd;
059ec3d9 2039
9d1c15ef 2040DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
2041/* There doesn't seem to be a built-in timeout on connection. */
2042
2043sigalrm_seen = FALSE;
65867078 2044alarm(ob->command_timeout);
17c76198
PP
2045do
2046 {
2047 rc = gnutls_handshake(state->session);
619b2b25
PP
2048 } while ((rc == GNUTLS_E_AGAIN) ||
2049 (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
059ec3d9
PH
2050alarm(0);
2051
4fe99a6c 2052if (rc != GNUTLS_E_SUCCESS)
60d10ce7
JH
2053 if (sigalrm_seen)
2054 {
2055 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
cf0c6164 2056 return tls_error(US"gnutls_handshake", "timed out", state->host, errstr);
60d10ce7
JH
2057 }
2058 else
cf0c6164 2059 return tls_error(US"gnutls_handshake", gnutls_strerror(rc), state->host, errstr);
4fe99a6c 2060
17c76198 2061DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 2062
17c76198 2063/* Verify late */
059ec3d9 2064
17c76198 2065if (state->verify_requirement != VERIFY_NONE &&
cf0c6164
JH
2066 !verify_certificate(state, errstr))
2067 return tls_error(US"certificate verification failed", *errstr, state->host, errstr);
059ec3d9 2068
f2de3a33 2069#ifndef DISABLE_OCSP
2b4a568d
JH
2070if (require_ocsp)
2071 {
2072 DEBUG(D_tls)
2073 {
2074 gnutls_datum_t stapling;
2075 gnutls_ocsp_resp_t resp;
2076 gnutls_datum_t printed;
2077 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2078 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2079 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2080 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2081 )
2082 {
65867078 2083 debug_printf("%.4096s", printed.data);
2b4a568d
JH
2084 gnutls_free(printed.data);
2085 }
2086 else
cf0c6164 2087 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host, errstr);
2b4a568d
JH
2088 }
2089
2b4a568d 2090 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2
JH
2091 {
2092 tls_out.ocsp = OCSP_FAILED;
cf0c6164 2093 return tls_error(US"certificate status check failed", NULL, state->host, errstr);
018058b2 2094 }
2b4a568d 2095 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
44662487 2096 tls_out.ocsp = OCSP_VFIED;
2b4a568d
JH
2097 }
2098#endif
2099
17c76198 2100/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 2101
cf0c6164 2102if ((rc = peer_status(state, errstr)) != OK)
2b4a568d 2103 return rc;
059ec3d9 2104
4fe99a6c 2105/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 2106
9d1c15ef 2107extract_exim_vars_from_tls_state(state);
059ec3d9 2108
059ec3d9
PH
2109return OK;
2110}
2111
2112
2113
17c76198 2114
059ec3d9 2115/*************************************************
17c76198 2116* Close down a TLS session *
059ec3d9
PH
2117*************************************************/
2118
17c76198
PP
2119/* This is also called from within a delivery subprocess forked from the
2120daemon, to shut down the TLS library, without actually doing a shutdown (which
2121would tamper with the TLS session in the parent process).
059ec3d9 2122
17c76198
PP
2123Arguments: TRUE if gnutls_bye is to be called
2124Returns: nothing
059ec3d9
PH
2125*/
2126
17c76198 2127void
817d9f57 2128tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 2129{
817d9f57 2130exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 2131
389ca47a 2132if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
17c76198
PP
2133
2134if (shutdown)
2135 {
f5723109 2136 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
17c76198
PP
2137 gnutls_bye(state->session, GNUTLS_SHUT_WR);
2138 }
2139
2140gnutls_deinit(state->session);
ed62aae3
HSHR
2141gnutls_certificate_free_credentials(state->x509_cred);
2142
17c76198 2143
389ca47a 2144state->tlsp->active = -1;
17c76198
PP
2145memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2146
2147if ((state_server.session == NULL) && (state_client.session == NULL))
2148 {
2149 gnutls_global_deinit();
2150 exim_gnutls_base_init_done = FALSE;
2151 }
059ec3d9
PH
2152}
2153
2154
2155
17c76198 2156
059ec3d9
PH
2157/*************************************************
2158* TLS version of getc *
2159*************************************************/
2160
2161/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2162it refills the buffer via the GnuTLS reading function.
817d9f57 2163Only used by the server-side TLS.
059ec3d9 2164
17c76198
PP
2165This feeds DKIM and should be used for all message-body reads.
2166
bd8fbe36 2167Arguments: lim Maximum amount to read/bufffer
059ec3d9
PH
2168Returns: the next character or EOF
2169*/
2170
2171int
bd8fbe36 2172tls_getc(unsigned lim)
059ec3d9 2173{
817d9f57 2174exim_gnutls_state_st *state = &state_server;
17c76198 2175if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
059ec3d9 2176 {
17c76198 2177 ssize_t inbytes;
059ec3d9 2178
17c76198
PP
2179 DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2180 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
2181
2182 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 2183 inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
bd8fbe36 2184 MIN(ssl_xfer_buffer_size, lim));
059ec3d9
PH
2185 alarm(0);
2186
60d10ce7
JH
2187 /* Timeouts do not get this far; see command_timeout_handler().
2188 A zero-byte return appears to mean that the TLS session has been
059ec3d9
PH
2189 closed down, not that the socket itself has been closed down. Revert to
2190 non-TLS handling. */
2191
60d10ce7
JH
2192 if (sigalrm_seen)
2193 {
2194 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
2195 state->xfer_error = 1;
2196 return EOF;
2197 }
2198
2199 else if (inbytes == 0)
059ec3d9
PH
2200 {
2201 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2202
2203 receive_getc = smtp_getc;
584e96c6 2204 receive_get_cache = smtp_get_cache;
059ec3d9
PH
2205 receive_ungetc = smtp_ungetc;
2206 receive_feof = smtp_feof;
2207 receive_ferror = smtp_ferror;
58eb016e 2208 receive_smtp_buffered = smtp_buffered;
059ec3d9 2209
17c76198 2210 gnutls_deinit(state->session);
ed62aae3
HSHR
2211 gnutls_certificate_free_credentials(state->x509_cred);
2212
17c76198 2213 state->session = NULL;
817d9f57
JH
2214 state->tlsp->active = -1;
2215 state->tlsp->bits = 0;
2216 state->tlsp->certificate_verified = FALSE;
9d1c15ef 2217 tls_channelbinding_b64 = NULL;
817d9f57 2218 state->tlsp->cipher = NULL;
9d1c15ef 2219 state->tlsp->peercert = NULL;
817d9f57 2220 state->tlsp->peerdn = NULL;
059ec3d9 2221
bd8fbe36 2222 return smtp_getc(lim);
059ec3d9
PH
2223 }
2224
2225 /* Handle genuine errors */
2226
2227 else if (inbytes < 0)
2228 {
17c76198
PP
2229 record_io_error(state, (int) inbytes, US"recv", NULL);
2230 state->xfer_error = 1;
059ec3d9
PH
2231 return EOF;
2232 }
80a47a2c 2233#ifndef DISABLE_DKIM
17c76198 2234 dkim_exim_verify_feed(state->xfer_buffer, inbytes);
80a47a2c 2235#endif
17c76198
PP
2236 state->xfer_buffer_hwm = (int) inbytes;
2237 state->xfer_buffer_lwm = 0;
059ec3d9
PH
2238 }
2239
059ec3d9
PH
2240/* Something in the buffer; return next uschar */
2241
17c76198 2242return state->xfer_buffer[state->xfer_buffer_lwm++];
059ec3d9
PH
2243}
2244
584e96c6
JH
2245void
2246tls_get_cache()
2247{
9960d1e5 2248#ifndef DISABLE_DKIM
584e96c6
JH
2249exim_gnutls_state_st * state = &state_server;
2250int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2251if (n > 0)
2252 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
584e96c6 2253#endif
9960d1e5 2254}
584e96c6 2255
059ec3d9
PH
2256
2257
17c76198 2258
059ec3d9
PH
2259/*************************************************
2260* Read bytes from TLS channel *
2261*************************************************/
2262
17c76198
PP
2263/* This does not feed DKIM, so if the caller uses this for reading message body,
2264then the caller must feed DKIM.
817d9f57 2265
059ec3d9
PH
2266Arguments:
2267 buff buffer of data
2268 len size of buffer
2269
2270Returns: the number of bytes read
2271 -1 after a failed read
2272*/
2273
2274int
817d9f57 2275tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2276{
817d9f57 2277exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
17c76198 2278ssize_t inbytes;
059ec3d9 2279
17c76198
PP
2280if (len > INT_MAX)
2281 len = INT_MAX;
059ec3d9 2282
17c76198
PP
2283if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2284 DEBUG(D_tls)
2285 debug_printf("*** PROBABLY A BUG *** " \
2286 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2287 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2288
2289DEBUG(D_tls)
2290 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2291 state->session, buff, len);
2292
2293inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
2294if (inbytes > 0) return inbytes;
2295if (inbytes == 0)
2296 {
2297 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2298 }
17c76198 2299else record_io_error(state, (int)inbytes, US"recv", NULL);
059ec3d9
PH
2300
2301return -1;
2302}
2303
2304
2305
17c76198 2306
059ec3d9
PH
2307/*************************************************
2308* Write bytes down TLS channel *
2309*************************************************/
2310
2311/*
2312Arguments:
817d9f57 2313 is_server channel specifier
059ec3d9
PH
2314 buff buffer of data
2315 len number of bytes
2316
2317Returns: the number of bytes after a successful write,
2318 -1 after a failed write
2319*/
2320
2321int
817d9f57 2322tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9 2323{
17c76198
PP
2324ssize_t outbytes;
2325size_t left = len;
817d9f57 2326exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 2327
17c76198 2328DEBUG(D_tls) debug_printf("tls_do_write(%p, " SIZE_T_FMT ")\n", buff, left);
059ec3d9
PH
2329while (left > 0)
2330 {
17c76198
PP
2331 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2332 buff, left);
2333 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 2334
17c76198 2335 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
2336 if (outbytes < 0)
2337 {
17c76198 2338 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
2339 return -1;
2340 }
2341 if (outbytes == 0)
2342 {
17c76198 2343 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
2344 return -1;
2345 }
2346
2347 left -= outbytes;
2348 buff += outbytes;
2349 }
2350
17c76198
PP
2351if (len > INT_MAX)
2352 {
2353 DEBUG(D_tls)
2354 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2355 len);
2356 len = INT_MAX;
2357 }
2358
2359return (int) len;
059ec3d9
PH
2360}
2361
2362
2363
17c76198 2364
059ec3d9 2365/*************************************************
17c76198 2366* Random number generation *
059ec3d9
PH
2367*************************************************/
2368
17c76198
PP
2369/* Pseudo-random number generation. The result is not expected to be
2370cryptographically strong but not so weak that someone will shoot themselves
2371in the foot using it as a nonce in input in some email header scheme or
2372whatever weirdness they'll twist this into. The result should handle fork()
2373and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 2374
17c76198
PP
2375Arguments:
2376 max range maximum
2377Returns a random number in range [0, max-1]
059ec3d9
PH
2378*/
2379
af3498d6 2380#ifdef HAVE_GNUTLS_RND
17c76198
PP
2381int
2382vaguely_random_number(int max)
059ec3d9 2383{
17c76198
PP
2384unsigned int r;
2385int i, needed_len;
2386uschar *p;
2387uschar smallbuf[sizeof(r)];
2388
2389if (max <= 1)
2390 return 0;
2391
2392needed_len = sizeof(r);
2393/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2394 * asked for a number less than 10. */
2395for (r = max, i = 0; r; ++i)
2396 r >>= 1;
2397i = (i + 7) / 8;
2398if (i < needed_len)
2399 needed_len = i;
2400
2401i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2402if (i < 0)
059ec3d9 2403 {
17c76198
PP
2404 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2405 return vaguely_random_number_fallback(max);
2406 }
2407r = 0;
2408for (p = smallbuf; needed_len; --needed_len, ++p)
2409 {
2410 r *= 256;
2411 r += *p;
059ec3d9
PH
2412 }
2413
17c76198
PP
2414/* We don't particularly care about weighted results; if someone wants
2415 * smooth distribution and cares enough then they should submit a patch then. */
2416return r % max;
059ec3d9 2417}
af3498d6
PP
2418#else /* HAVE_GNUTLS_RND */
2419int
2420vaguely_random_number(int max)
2421{
2422 return vaguely_random_number_fallback(max);
2423}
2424#endif /* HAVE_GNUTLS_RND */
059ec3d9 2425
36f12725
NM
2426
2427
2428
2429/*************************************************
3375e053
PP
2430* Let tls_require_ciphers be checked at startup *
2431*************************************************/
2432
2433/* The tls_require_ciphers option, if set, must be something which the
2434library can parse.
2435
2436Returns: NULL on success, or error message
2437*/
2438
2439uschar *
2440tls_validate_require_cipher(void)
2441{
2442int rc;
2443uschar *expciphers = NULL;
2444gnutls_priority_t priority_cache;
2445const char *errpos;
cf0c6164 2446uschar * dummy_errstr;
3375e053
PP
2447
2448#define validate_check_rc(Label) do { \
2449 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2450 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2451#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2452
2453if (exim_gnutls_base_init_done)
2454 log_write(0, LOG_MAIN|LOG_PANIC,
2455 "already initialised GnuTLS, Exim developer bug");
2456
a5f239e4 2457#ifdef HAVE_GNUTLS_PKCS11
2519e60d 2458if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
2459 {
2460 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2461 validate_check_rc(US"gnutls_pkcs11_init");
2462 }
2463#endif
3375e053
PP
2464rc = gnutls_global_init();
2465validate_check_rc(US"gnutls_global_init()");
2466exim_gnutls_base_init_done = TRUE;
2467
2468if (!(tls_require_ciphers && *tls_require_ciphers))
2469 return_deinit(NULL);
2470
cf0c6164
JH
2471if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
2472 &dummy_errstr))
3375e053
PP
2473 return_deinit(US"failed to expand tls_require_ciphers");
2474
2475if (!(expciphers && *expciphers))
2476 return_deinit(NULL);
2477
2478DEBUG(D_tls)
2479 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2480
2481rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2482validate_check_rc(string_sprintf(
2483 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2484 expciphers, errpos - CS expciphers, errpos));
2485
2486#undef return_deinit
2487#undef validate_check_rc
2488gnutls_global_deinit();
2489
2490return NULL;
2491}
2492
2493
2494
2495
2496/*************************************************
36f12725
NM
2497* Report the library versions. *
2498*************************************************/
2499
2500/* See a description in tls-openssl.c for an explanation of why this exists.
2501
2502Arguments: a FILE* to print the results to
2503Returns: nothing
2504*/
2505
2506void
2507tls_version_report(FILE *f)
2508{
754a0503
PP
2509fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2510 " Runtime: %s\n",
2511 LIBGNUTLS_VERSION,
2512 gnutls_check_version(NULL));
36f12725
NM
2513}
2514
2b4a568d
JH
2515/* vi: aw ai sw=2
2516*/
059ec3d9 2517/* End of tls-gnu.c */