Fix memory leak during multi-message reception using STARTTLS
[exim.git] / src / src / tls-gnu.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
17c76198 8/* Copyright (c) Phil Pennock 2012 */
059ec3d9 9
17c76198
PP
10/* This file provides TLS/SSL support for Exim using the GnuTLS library,
11one of the available supported implementations. This file is #included into
12tls.c when USE_GNUTLS has been set.
059ec3d9 13
17c76198
PP
14The code herein is a revamp of GnuTLS integration using the current APIs; the
15original tls-gnu.c was based on a patch which was contributed by Nikos
6aa6fc9c 16Mavrogiannopoulos. The revamp is partially a rewrite, partially cut&paste as
17c76198 17appropriate.
059ec3d9 18
17c76198
PP
19APIs current as of GnuTLS 2.12.18; note that the GnuTLS manual is for GnuTLS 3,
20which is not widely deployed by OS vendors. Will note issues below, which may
21assist in updating the code in the future. Another sources of hints is
22mod_gnutls for Apache (SNI callback registration and handling).
059ec3d9 23
17c76198
PP
24Keeping client and server variables more split than before and is currently
25the norm, in anticipation of TLS in ACL callouts.
059ec3d9 26
17c76198
PP
27I wanted to switch to gnutls_certificate_set_verify_function() so that
28certificate rejection could happen during handshake where it belongs, rather
29than being dropped afterwards, but that was introduced in 2.10.0 and Debian
30(6.0.5) is still on 2.8.6. So for now we have to stick with sub-par behaviour.
059ec3d9 31
17c76198
PP
32(I wasn't looking for libraries quite that old, when updating to get rid of
33compiler warnings of deprecated APIs. If it turns out that a lot of the rest
34require current GnuTLS, then we'll drop support for the ancient libraries).
35*/
b5aea5e1 36
17c76198
PP
37#include <gnutls/gnutls.h>
38/* needed for cert checks in verification and DN extraction: */
39#include <gnutls/x509.h>
40/* man-page is incorrect, gnutls_rnd() is not in gnutls.h: */
41#include <gnutls/crypto.h>
a5f239e4
PP
42/* needed to disable PKCS11 autoload unless requested */
43#if GNUTLS_VERSION_NUMBER >= 0x020c00
44# include <gnutls/pkcs11.h>
76075bb5 45# define SUPPORT_PARAM_TO_PK_BITS
a5f239e4 46#endif
7e07527a
JH
47#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
48# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
49# define DISABLE_OCSP
50#endif
0cbf2b82 51#if GNUTLS_VERSION_NUMBER < 0x020a00 && !defined(DISABLE_EVENT)
774ef2d7 52# warning "GnuTLS library version too old; tls:cert event unsupported"
0cbf2b82 53# define DISABLE_EVENT
a7538db1 54#endif
a7fec7a7
JH
55#if GNUTLS_VERSION_NUMBER >= 0x030306
56# define SUPPORT_CA_DIR
57#else
58# undef SUPPORT_CA_DIR
59#endif
11a04b5a 60#if GNUTLS_VERSION_NUMBER >= 0x030014
cb1d7830
JH
61# define SUPPORT_SYSDEFAULT_CABUNDLE
62#endif
925ac8e4
JH
63#if GNUTLS_VERSION_NUMBER >= 0x030109
64# define SUPPORT_CORK
65#endif
47195144
JH
66#if GNUTLS_VERSION_NUMBER >= 0x030506 && !defined(DISABLE_OCSP)
67# define SUPPORT_SRV_OCSP_STACK
68#endif
c0635b6d
JH
69
70#ifdef SUPPORT_DANE
71# if GNUTLS_VERSION_NUMBER >= 0x030000
72# define DANESSL_USAGE_DANE_TA 2
73# define DANESSL_USAGE_DANE_EE 3
74# else
75# error GnuTLS version too early for DANE
76# endif
77# if GNUTLS_VERSION_NUMBER < 0x999999
78# define GNUTLS_BROKEN_DANE_VALIDATION
79# endif
899b8bbc 80#endif
7e07527a 81
f2de3a33 82#ifndef DISABLE_OCSP
2b4a568d
JH
83# include <gnutls/ocsp.h>
84#endif
899b8bbc
JH
85#ifdef SUPPORT_DANE
86# include <gnutls/dane.h>
87#endif
059ec3d9 88
17c76198 89/* GnuTLS 2 vs 3
059ec3d9 90
17c76198
PP
91GnuTLS 3 only:
92 gnutls_global_set_audit_log_function()
059ec3d9 93
17c76198
PP
94Changes:
95 gnutls_certificate_verify_peers2(): is new, drop the 2 for old version
96*/
059ec3d9 97
17c76198 98/* Local static variables for GnuTLS */
059ec3d9 99
17c76198 100/* Values for verify_requirement */
059ec3d9 101
e51c7be2 102enum peer_verify_requirement
899b8bbc 103 { VERIFY_NONE, VERIFY_OPTIONAL, VERIFY_REQUIRED, VERIFY_DANE };
059ec3d9 104
17c76198
PP
105/* This holds most state for server or client; with this, we can set up an
106outbound TLS-enabled connection in an ACL callout, while not stomping all
107over the TLS variables available for expansion.
059ec3d9 108
17c76198
PP
109Some of these correspond to variables in globals.c; those variables will
110be set to point to content in one of these instances, as appropriate for
111the stage of the process lifetime.
059ec3d9 112
389ca47a 113Not handled here: global tls_channelbinding_b64.
17c76198 114*/
059ec3d9 115
17c76198 116typedef struct exim_gnutls_state {
9d1c15ef 117 gnutls_session_t session;
17c76198 118 gnutls_certificate_credentials_t x509_cred;
9d1c15ef 119 gnutls_priority_t priority_cache;
17c76198 120 enum peer_verify_requirement verify_requirement;
9d1c15ef
JH
121 int fd_in;
122 int fd_out;
123 BOOL peer_cert_verified;
899b8bbc 124 BOOL peer_dane_verified;
9d1c15ef
JH
125 BOOL trigger_sni_changes;
126 BOOL have_set_peerdn;
17c76198 127 const struct host_item *host;
9d1c15ef
JH
128 gnutls_x509_crt_t peercert;
129 uschar *peerdn;
130 uschar *ciphersuite;
131 uschar *received_sni;
17c76198
PP
132
133 const uschar *tls_certificate;
134 const uschar *tls_privatekey;
135 const uschar *tls_sni; /* client send only, not received */
136 const uschar *tls_verify_certificates;
137 const uschar *tls_crl;
138 const uschar *tls_require_ciphers;
e51c7be2 139
17c76198
PP
140 uschar *exp_tls_certificate;
141 uschar *exp_tls_privatekey;
17c76198
PP
142 uschar *exp_tls_verify_certificates;
143 uschar *exp_tls_crl;
144 uschar *exp_tls_require_ciphers;
55414b25 145 const uschar *exp_tls_verify_cert_hostnames;
0cbf2b82 146#ifndef DISABLE_EVENT
a7538db1
JH
147 uschar *event_action;
148#endif
899b8bbc
JH
149#ifdef SUPPORT_DANE
150 char * const * dane_data;
151 const int * dane_data_len;
152#endif
17c76198 153
389ca47a 154 tls_support *tlsp; /* set in tls_init() */
817d9f57 155
17c76198
PP
156 uschar *xfer_buffer;
157 int xfer_buffer_lwm;
158 int xfer_buffer_hwm;
159 int xfer_eof;
160 int xfer_error;
17c76198
PP
161} exim_gnutls_state_st;
162
163static const exim_gnutls_state_st exim_gnutls_state_init = {
f2ed27cf
JH
164 .session = NULL,
165 .x509_cred = NULL,
166 .priority_cache = NULL,
167 .verify_requirement = VERIFY_NONE,
168 .fd_in = -1,
169 .fd_out = -1,
170 .peer_cert_verified = FALSE,
899b8bbc 171 .peer_dane_verified = FALSE,
f2ed27cf
JH
172 .trigger_sni_changes =FALSE,
173 .have_set_peerdn = FALSE,
174 .host = NULL,
175 .peercert = NULL,
176 .peerdn = NULL,
177 .ciphersuite = NULL,
178 .received_sni = NULL,
179
180 .tls_certificate = NULL,
181 .tls_privatekey = NULL,
182 .tls_sni = NULL,
183 .tls_verify_certificates = NULL,
184 .tls_crl = NULL,
185 .tls_require_ciphers =NULL,
186
187 .exp_tls_certificate = NULL,
188 .exp_tls_privatekey = NULL,
189 .exp_tls_verify_certificates = NULL,
190 .exp_tls_crl = NULL,
191 .exp_tls_require_ciphers = NULL,
f2ed27cf 192 .exp_tls_verify_cert_hostnames = NULL,
0cbf2b82 193#ifndef DISABLE_EVENT
f2ed27cf 194 .event_action = NULL,
a7538db1 195#endif
f2ed27cf
JH
196 .tlsp = NULL,
197
198 .xfer_buffer = NULL,
199 .xfer_buffer_lwm = 0,
200 .xfer_buffer_hwm = 0,
201 .xfer_eof = 0,
202 .xfer_error = 0,
17c76198 203};
83da1223 204
17c76198
PP
205/* Not only do we have our own APIs which don't pass around state, assuming
206it's held in globals, GnuTLS doesn't appear to let us register callback data
207for callbacks, or as part of the session, so we have to keep a "this is the
208context we're currently dealing with" pointer and rely upon being
209single-threaded to keep from processing data on an inbound TLS connection while
210talking to another TLS connection for an outbound check. This does mean that
211there's no way for heart-beats to be responded to, for the duration of the
a7538db1
JH
212second connection.
213XXX But see gnutls_session_get_ptr()
214*/
059ec3d9 215
17c76198 216static exim_gnutls_state_st state_server, state_client;
059ec3d9 217
17c76198
PP
218/* dh_params are initialised once within the lifetime of a process using TLS;
219if we used TLS in a long-lived daemon, we'd have to reconsider this. But we
220don't want to repeat this. */
83da1223 221
17c76198 222static gnutls_dh_params_t dh_server_params = NULL;
059ec3d9 223
17c76198 224/* No idea how this value was chosen; preserving it. Default is 3600. */
059ec3d9 225
17c76198 226static const int ssl_session_timeout = 200;
059ec3d9 227
17c76198 228static const char * const exim_default_gnutls_priority = "NORMAL";
83da1223 229
17c76198 230/* Guard library core initialisation */
83da1223 231
17c76198 232static BOOL exim_gnutls_base_init_done = FALSE;
059ec3d9 233
4fb7df6d 234#ifndef DISABLE_OCSP
9196d5bf 235static BOOL gnutls_buggy_ocsp = FALSE;
4fb7df6d 236#endif
9196d5bf 237
059ec3d9 238
17c76198 239/* ------------------------------------------------------------------------ */
17c76198 240/* macros */
83da1223 241
17c76198 242#define MAX_HOST_LEN 255
83da1223 243
17c76198
PP
244/* Set this to control gnutls_global_set_log_level(); values 0 to 9 will setup
245the library logging; a value less than 0 disables the calls to set up logging
ef9da2ee
JH
246callbacks. Possibly GNuTLS also looks for an environment variable
247"GNUTLS_DEBUG_LEVEL". */
2c17bb02 248#ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
a7538db1 249# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
2c17bb02 250#endif
83da1223 251
2c17bb02 252#ifndef EXIM_CLIENT_DH_MIN_BITS
a7538db1 253# define EXIM_CLIENT_DH_MIN_BITS 1024
2c17bb02 254#endif
83da1223 255
af3498d6
PP
256/* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
257can ask for a bit-strength. Without that, we stick to the constant we had
258before, for now. */
2c17bb02 259#ifndef EXIM_SERVER_DH_BITS_PRE2_12
a7538db1 260# define EXIM_SERVER_DH_BITS_PRE2_12 1024
2c17bb02 261#endif
af3498d6 262
47195144
JH
263#define exim_gnutls_err_check(rc, Label) do { \
264 if ((rc) != GNUTLS_E_SUCCESS) \
cf0c6164
JH
265 return tls_error((Label), gnutls_strerror(rc), host, errstr); \
266 } while (0)
059ec3d9 267
cf0c6164
JH
268#define expand_check_tlsvar(Varname, errstr) \
269 expand_check(state->Varname, US #Varname, &state->exp_##Varname, errstr)
83da1223 270
17c76198 271#if GNUTLS_VERSION_NUMBER >= 0x020c00
e51c7be2
JH
272# define HAVE_GNUTLS_SESSION_CHANNEL_BINDING
273# define HAVE_GNUTLS_SEC_PARAM_CONSTANTS
274# define HAVE_GNUTLS_RND
2519e60d
TL
275/* The security fix we provide with the gnutls_allow_auto_pkcs11 option
276 * (4.82 PP/09) introduces a compatibility regression. The symbol simply
277 * isn't available sometimes, so this needs to become a conditional
278 * compilation; the sanest way to deal with this being a problem on
279 * older OSes is to block it in the Local/Makefile with this compiler
280 * definition */
e51c7be2
JH
281# ifndef AVOID_GNUTLS_PKCS11
282# define HAVE_GNUTLS_PKCS11
283# endif /* AVOID_GNUTLS_PKCS11 */
17c76198 284#endif
83da1223 285
af3498d6
PP
286
287
288
289/* ------------------------------------------------------------------------ */
290/* Callback declarations */
291
292#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
293static void exim_gnutls_logger_cb(int level, const char *message);
294#endif
295
296static int exim_sni_handling_cb(gnutls_session_t session);
297
f2de3a33 298#ifndef DISABLE_OCSP
44662487
JH
299static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
300 gnutls_datum_t * ocsp_response);
301#endif
af3498d6
PP
302
303
304
17c76198
PP
305/* ------------------------------------------------------------------------ */
306/* Static functions */
059ec3d9
PH
307
308/*************************************************
309* Handle TLS error *
310*************************************************/
311
312/* Called from lots of places when errors occur before actually starting to do
313the TLS handshake, that is, while the session is still in clear. Always returns
314DEFER for a server and FAIL for a client so that most calls can use "return
315tls_error(...)" to do this processing and then give an appropriate return. A
316single function is used for both server and client, because it is called from
317some shared functions.
318
319Argument:
320 prefix text to include in the logged error
7199e1ee
TF
321 msg additional error string (may be NULL)
322 usually obtained from gnutls_strerror()
17c76198
PP
323 host NULL if setting up a server;
324 the connected host if setting up a client
cf0c6164 325 errstr pointer to returned error string
059ec3d9
PH
326
327Returns: OK/DEFER/FAIL
328*/
329
330static int
cf0c6164
JH
331tls_error(const uschar *prefix, const char *msg, const host_item *host,
332 uschar ** errstr)
059ec3d9 333{
cf0c6164
JH
334if (errstr)
335 *errstr = string_sprintf("(%s)%s%s", prefix, msg ? ": " : "", msg ? msg : "");
336return host ? FAIL : DEFER;
059ec3d9
PH
337}
338
339
340
17c76198 341
059ec3d9 342/*************************************************
17c76198 343* Deal with logging errors during I/O *
059ec3d9
PH
344*************************************************/
345
17c76198 346/* We have to get the identity of the peer from saved data.
059ec3d9 347
17c76198
PP
348Argument:
349 state the current GnuTLS exim state container
350 rc the GnuTLS error code, or 0 if it's a local error
351 when text identifying read or write
352 text local error text when ec is 0
059ec3d9 353
17c76198 354Returns: nothing
059ec3d9
PH
355*/
356
17c76198
PP
357static void
358record_io_error(exim_gnutls_state_st *state, int rc, uschar *when, uschar *text)
059ec3d9 359{
cf0c6164
JH
360const char * msg;
361uschar * errstr;
059ec3d9 362
17c76198
PP
363if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
364 msg = CS string_sprintf("%s: %s", US gnutls_strerror(rc),
365 US gnutls_alert_get_name(gnutls_alert_get(state->session)));
366else
367 msg = gnutls_strerror(rc);
059ec3d9 368
cf0c6164
JH
369(void) tls_error(when, msg, state->host, &errstr);
370
371if (state->host)
372 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection %s",
373 state->host->name, state->host->address, errstr);
374else
375 {
376 uschar * conn_info = smtp_get_connection_info();
377 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0) conn_info += 5;
378 /* I'd like to get separated H= here, but too hard for now */
379 log_write(0, LOG_MAIN, "TLS error on %s %s", conn_info, errstr);
380 }
17c76198 381}
059ec3d9 382
059ec3d9 383
059ec3d9 384
059ec3d9 385
17c76198
PP
386/*************************************************
387* Set various Exim expansion vars *
388*************************************************/
059ec3d9 389
e51c7be2
JH
390#define exim_gnutls_cert_err(Label) \
391 do \
392 { \
393 if (rc != GNUTLS_E_SUCCESS) \
394 { \
395 DEBUG(D_tls) debug_printf("TLS: cert problem: %s: %s\n", \
396 (Label), gnutls_strerror(rc)); \
397 return rc; \
398 } \
399 } while (0)
9d1c15ef
JH
400
401static int
27f19eb4 402import_cert(const gnutls_datum_t * cert, gnutls_x509_crt_t * crtp)
9d1c15ef
JH
403{
404int rc;
405
406rc = gnutls_x509_crt_init(crtp);
407exim_gnutls_cert_err(US"gnutls_x509_crt_init (crt)");
408
409rc = gnutls_x509_crt_import(*crtp, cert, GNUTLS_X509_FMT_DER);
410exim_gnutls_cert_err(US"failed to import certificate [gnutls_x509_crt_import(cert)]");
411
412return rc;
413}
414
415#undef exim_gnutls_cert_err
416
417
17c76198
PP
418/* We set various Exim global variables from the state, once a session has
419been established. With TLS callouts, may need to change this to stack
420variables, or just re-call it with the server state after client callout
421has finished.
059ec3d9 422
9d1c15ef 423Make sure anything set here is unset in tls_getc().
17c76198
PP
424
425Sets:
426 tls_active fd
427 tls_bits strength indicator
428 tls_certificate_verified bool indicator
429 tls_channelbinding_b64 for some SASL mechanisms
430 tls_cipher a string
9d1c15ef 431 tls_peercert pointer to library internal
17c76198
PP
432 tls_peerdn a string
433 tls_sni a (UTF-8) string
9d1c15ef 434 tls_ourcert pointer to library internal
17c76198
PP
435
436Argument:
437 state the relevant exim_gnutls_state_st *
438*/
439
440static void
9d1c15ef 441extract_exim_vars_from_tls_state(exim_gnutls_state_st * state)
17c76198 442{
17c76198 443gnutls_cipher_algorithm_t cipher;
17c76198
PP
444#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
445int old_pool;
446int rc;
447gnutls_datum_t channel;
448#endif
9d1c15ef 449tls_support * tlsp = state->tlsp;
17c76198 450
9d1c15ef 451tlsp->active = state->fd_out;
17c76198
PP
452
453cipher = gnutls_cipher_get(state->session);
454/* returns size in "bytes" */
9d1c15ef 455tlsp->bits = gnutls_cipher_get_key_size(cipher) * 8;
17c76198 456
9d1c15ef 457tlsp->cipher = state->ciphersuite;
17c76198 458
817d9f57 459DEBUG(D_tls) debug_printf("cipher: %s\n", state->ciphersuite);
17c76198 460
9d1c15ef 461tlsp->certificate_verified = state->peer_cert_verified;
899b8bbc
JH
462#ifdef SUPPORT_DANE
463tlsp->dane_verified = state->peer_dane_verified;
464#endif
059ec3d9 465
17c76198
PP
466/* note that tls_channelbinding_b64 is not saved to the spool file, since it's
467only available for use for authenticators while this TLS session is running. */
468
469tls_channelbinding_b64 = NULL;
470#ifdef HAVE_GNUTLS_SESSION_CHANNEL_BINDING
471channel.data = NULL;
472channel.size = 0;
473rc = gnutls_session_channel_binding(state->session, GNUTLS_CB_TLS_UNIQUE, &channel);
474if (rc) {
475 DEBUG(D_tls) debug_printf("Channel binding error: %s\n", gnutls_strerror(rc));
476} else {
477 old_pool = store_pool;
478 store_pool = POOL_PERM;
f4d091fb 479 tls_channelbinding_b64 = b64encode(channel.data, (int)channel.size);
17c76198
PP
480 store_pool = old_pool;
481 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage.\n");
482}
483#endif
484
9d1c15ef
JH
485/* peercert is set in peer_status() */
486tlsp->peerdn = state->peerdn;
487tlsp->sni = state->received_sni;
488
489/* record our certificate */
490 {
27f19eb4 491 const gnutls_datum_t * cert = gnutls_certificate_get_ours(state->session);
9d1c15ef
JH
492 gnutls_x509_crt_t crt;
493
494 tlsp->ourcert = cert && import_cert(cert, &crt)==0 ? crt : NULL;
495 }
059ec3d9
PH
496}
497
498
499
17c76198 500
059ec3d9 501/*************************************************
575643cd 502* Setup up DH parameters *
059ec3d9
PH
503*************************************************/
504
575643cd 505/* Generating the D-H parameters may take a long time. They only need to
059ec3d9
PH
506be re-generated every so often, depending on security policy. What we do is to
507keep these parameters in a file in the spool directory. If the file does not
508exist, we generate them. This means that it is easy to cause a regeneration.
509
510The new file is written as a temporary file and renamed, so that an incomplete
511file is never present. If two processes both compute some new parameters, you
512waste a bit of effort, but it doesn't seem worth messing around with locking to
513prevent this.
514
059ec3d9
PH
515Returns: OK/DEFER/FAIL
516*/
517
518static int
cf0c6164 519init_server_dh(uschar ** errstr)
059ec3d9 520{
17c76198
PP
521int fd, rc;
522unsigned int dh_bits;
27f19eb4 523gnutls_datum_t m;
a799883d
PP
524uschar filename_buf[PATH_MAX];
525uschar *filename = NULL;
17c76198 526size_t sz;
a799883d
PP
527uschar *exp_tls_dhparam;
528BOOL use_file_in_spool = FALSE;
529BOOL use_fixed_file = FALSE;
17c76198 530host_item *host = NULL; /* dummy for macros */
059ec3d9 531
17c76198 532DEBUG(D_tls) debug_printf("Initialising GnuTLS server params.\n");
059ec3d9 533
17c76198 534rc = gnutls_dh_params_init(&dh_server_params);
47195144 535exim_gnutls_err_check(rc, US"gnutls_dh_params_init");
059ec3d9 536
a799883d
PP
537m.data = NULL;
538m.size = 0;
539
cf0c6164 540if (!expand_check(tls_dhparam, US"tls_dhparam", &exp_tls_dhparam, errstr))
a799883d
PP
541 return DEFER;
542
543if (!exp_tls_dhparam)
544 {
545 DEBUG(D_tls) debug_printf("Loading default hard-coded DH params\n");
546 m.data = US std_dh_prime_default();
547 m.size = Ustrlen(m.data);
548 }
549else if (Ustrcmp(exp_tls_dhparam, "historic") == 0)
550 use_file_in_spool = TRUE;
551else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
552 {
553 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
554 return OK;
555 }
556else if (exp_tls_dhparam[0] != '/')
557 {
f5d25c2b 558 if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
cf0c6164 559 return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL, errstr);
a799883d
PP
560 m.size = Ustrlen(m.data);
561 }
562else
563 {
564 use_fixed_file = TRUE;
565 filename = exp_tls_dhparam;
566 }
567
568if (m.data)
569 {
570 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
47195144 571 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
a799883d
PP
572 DEBUG(D_tls) debug_printf("Loaded fixed standard D-H parameters\n");
573 return OK;
574 }
575
af3498d6
PP
576#ifdef HAVE_GNUTLS_SEC_PARAM_CONSTANTS
577/* If you change this constant, also change dh_param_fn_ext so that we can use a
17c76198
PP
578different filename and ensure we have sufficient bits. */
579dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_NORMAL);
580if (!dh_bits)
cf0c6164 581 return tls_error(US"gnutls_sec_param_to_pk_bits() failed", NULL, NULL, errstr);
af3498d6 582DEBUG(D_tls)
b34fc30c 583 debug_printf("GnuTLS tells us that for D-H PK, NORMAL is %d bits.\n",
af3498d6
PP
584 dh_bits);
585#else
586dh_bits = EXIM_SERVER_DH_BITS_PRE2_12;
587DEBUG(D_tls)
588 debug_printf("GnuTLS lacks gnutls_sec_param_to_pk_bits(), using %d bits.\n",
589 dh_bits);
590#endif
059ec3d9 591
3375e053
PP
592/* Some clients have hard-coded limits. */
593if (dh_bits > tls_dh_max_bits)
594 {
595 DEBUG(D_tls)
596 debug_printf("tls_dh_max_bits clamping override, using %d bits instead.\n",
597 tls_dh_max_bits);
598 dh_bits = tls_dh_max_bits;
599 }
600
a799883d
PP
601if (use_file_in_spool)
602 {
603 if (!string_format(filename_buf, sizeof(filename_buf),
604 "%s/gnutls-params-%d", spool_directory, dh_bits))
cf0c6164 605 return tls_error(US"overlong filename", NULL, NULL, errstr);
a799883d
PP
606 filename = filename_buf;
607 }
059ec3d9 608
b5aea5e1 609/* Open the cache file for reading and if successful, read it and set up the
575643cd 610parameters. */
059ec3d9 611
f5d25c2b 612if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
059ec3d9 613 {
b5aea5e1 614 struct stat statbuf;
17c76198
PP
615 FILE *fp;
616 int saved_errno;
617
618 if (fstat(fd, &statbuf) < 0) /* EIO */
619 {
620 saved_errno = errno;
621 (void)close(fd);
cf0c6164 622 return tls_error(US"TLS cache stat failed", strerror(saved_errno), NULL, errstr);
17c76198
PP
623 }
624 if (!S_ISREG(statbuf.st_mode))
b5aea5e1
PH
625 {
626 (void)close(fd);
cf0c6164 627 return tls_error(US"TLS cache not a file", NULL, NULL, errstr);
17c76198 628 }
40c90bca 629 if (!(fp = fdopen(fd, "rb")))
17c76198
PP
630 {
631 saved_errno = errno;
632 (void)close(fd);
633 return tls_error(US"fdopen(TLS cache stat fd) failed",
cf0c6164 634 strerror(saved_errno), NULL, errstr);
b5aea5e1 635 }
059ec3d9 636
b5aea5e1 637 m.size = statbuf.st_size;
40c90bca 638 if (!(m.data = malloc(m.size)))
17c76198
PP
639 {
640 fclose(fp);
cf0c6164 641 return tls_error(US"malloc failed", strerror(errno), NULL, errstr);
17c76198 642 }
40c90bca 643 if (!(sz = fread(m.data, m.size, 1, fp)))
17c76198
PP
644 {
645 saved_errno = errno;
646 fclose(fp);
647 free(m.data);
cf0c6164 648 return tls_error(US"fread failed", strerror(saved_errno), NULL, errstr);
17c76198
PP
649 }
650 fclose(fp);
b5aea5e1 651
17c76198 652 rc = gnutls_dh_params_import_pkcs3(dh_server_params, &m, GNUTLS_X509_FMT_PEM);
b5aea5e1 653 free(m.data);
47195144 654 exim_gnutls_err_check(rc, US"gnutls_dh_params_import_pkcs3");
17c76198 655 DEBUG(D_tls) debug_printf("read D-H parameters from file \"%s\"\n", filename);
b5aea5e1
PH
656 }
657
658/* If the file does not exist, fall through to compute new data and cache it.
659If there was any other opening error, it is serious. */
660
182ad5cf
PH
661else if (errno == ENOENT)
662 {
17c76198 663 rc = -1;
182ad5cf 664 DEBUG(D_tls)
17c76198 665 debug_printf("D-H parameter cache file \"%s\" does not exist\n", filename);
182ad5cf
PH
666 }
667else
17c76198 668 return tls_error(string_open_failed(errno, "\"%s\" for reading", filename),
cf0c6164 669 NULL, NULL, errstr);
b5aea5e1
PH
670
671/* If ret < 0, either the cache file does not exist, or the data it contains
672is not useful. One particular case of this is when upgrading from an older
673release of Exim in which the data was stored in a different format. We don't
674try to be clever and support both formats; we just regenerate new data in this
675case. */
676
17c76198 677if (rc < 0)
b5aea5e1 678 {
17c76198 679 uschar *temp_fn;
201f5254 680 unsigned int dh_bits_gen = dh_bits;
059ec3d9 681
17c76198
PP
682 if ((PATH_MAX - Ustrlen(filename)) < 10)
683 return tls_error(US"Filename too long to generate replacement",
cf0c6164 684 CS filename, NULL, errstr);
059ec3d9 685
17c76198 686 temp_fn = string_copy(US "%s.XXXXXXX");
f5d25c2b 687 if ((fd = mkstemp(CS temp_fn)) < 0) /* modifies temp_fn */
cf0c6164 688 return tls_error(US"Unable to open temp file", strerror(errno), NULL, errstr);
059ec3d9
PH
689 (void)fchown(fd, exim_uid, exim_gid); /* Probably not necessary */
690
201f5254
PP
691 /* GnuTLS overshoots!
692 * If we ask for 2236, we might get 2237 or more.
693 * But there's no way to ask GnuTLS how many bits there really are.
694 * We can ask how many bits were used in a TLS session, but that's it!
695 * The prime itself is hidden behind too much abstraction.
696 * So we ask for less, and proceed on a wing and a prayer.
697 * First attempt, subtracted 3 for 2233 and got 2240.
698 */
cae6e576 699 if (dh_bits >= EXIM_CLIENT_DH_MIN_BITS + 10)
201f5254
PP
700 {
701 dh_bits_gen = dh_bits - 10;
702 DEBUG(D_tls)
703 debug_printf("being paranoid about DH generation, make it '%d' bits'\n",
704 dh_bits_gen);
705 }
706
707 DEBUG(D_tls)
708 debug_printf("requesting generation of %d bit Diffie-Hellman prime ...\n",
709 dh_bits_gen);
710 rc = gnutls_dh_params_generate2(dh_server_params, dh_bits_gen);
47195144 711 exim_gnutls_err_check(rc, US"gnutls_dh_params_generate2");
17c76198
PP
712
713 /* gnutls_dh_params_export_pkcs3() will tell us the exact size, every time,
714 and I confirmed that a NULL call to get the size first is how the GnuTLS
715 sample apps handle this. */
716
717 sz = 0;
718 m.data = NULL;
719 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
720 m.data, &sz);
721 if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
47195144 722 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3(NULL) sizing");
17c76198 723 m.size = sz;
40c90bca 724 if (!(m.data = malloc(m.size)))
cf0c6164 725 return tls_error(US"memory allocation failed", strerror(errno), NULL, errstr);
40c90bca 726
1f00591e 727 /* this will return a size 1 less than the allocation size above */
17c76198 728 rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
1f00591e 729 m.data, &sz);
17c76198
PP
730 if (rc != GNUTLS_E_SUCCESS)
731 {
732 free(m.data);
47195144 733 exim_gnutls_err_check(rc, US"gnutls_dh_params_export_pkcs3() real");
17c76198 734 }
1f00591e 735 m.size = sz; /* shrink by 1, probably */
059ec3d9 736
f5d25c2b 737 if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
17c76198
PP
738 {
739 free(m.data);
740 return tls_error(US"TLS cache write D-H params failed",
cf0c6164 741 strerror(errno), NULL, errstr);
17c76198 742 }
b5aea5e1 743 free(m.data);
f5d25c2b 744 if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
17c76198 745 return tls_error(US"TLS cache write D-H params final newline failed",
cf0c6164 746 strerror(errno), NULL, errstr);
17c76198 747
f5d25c2b 748 if ((rc = close(fd)))
cf0c6164 749 return tls_error(US"TLS cache write close() failed", strerror(errno), NULL, errstr);
059ec3d9 750
17c76198
PP
751 if (Urename(temp_fn, filename) < 0)
752 return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
cf0c6164 753 temp_fn, filename), strerror(errno), NULL, errstr);
059ec3d9 754
17c76198 755 DEBUG(D_tls) debug_printf("wrote D-H parameters to file \"%s\"\n", filename);
059ec3d9
PH
756 }
757
17c76198 758DEBUG(D_tls) debug_printf("initialized server D-H parameters\n");
059ec3d9
PH
759return OK;
760}
761
762
763
764
23bb6982
JH
765/* Create and install a selfsigned certificate, for use in server mode */
766
767static int
cf0c6164 768tls_install_selfsign(exim_gnutls_state_st * state, uschar ** errstr)
23bb6982
JH
769{
770gnutls_x509_crt_t cert = NULL;
771time_t now;
772gnutls_x509_privkey_t pkey = NULL;
773const uschar * where;
774int rc;
775
776where = US"initialising pkey";
777if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
778
779where = US"initialising cert";
780if ((rc = gnutls_x509_crt_init(&cert))) goto err;
781
782where = US"generating pkey";
783if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
76075bb5 784#ifdef SUPPORT_PARAM_TO_PK_BITS
23bb6982 785 gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_LOW),
76075bb5
JH
786#else
787 1024,
788#endif
789 0)))
23bb6982
JH
790 goto err;
791
792where = US"configuring cert";
793now = 0;
794if ( (rc = gnutls_x509_crt_set_version(cert, 3))
795 || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
796 || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
797 || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
798 || (rc = gnutls_x509_crt_set_key(cert, pkey))
799
800 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
801 GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
802 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
803 GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
804 || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
805 GNUTLS_OID_X520_COMMON_NAME, 0,
806 smtp_active_hostname, Ustrlen(smtp_active_hostname)))
807 )
808 goto err;
809
810where = US"signing cert";
811if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
812
813where = US"installing selfsign cert";
814 /* Since: 2.4.0 */
815if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
816 goto err;
817
818rc = OK;
819
820out:
821 if (cert) gnutls_x509_crt_deinit(cert);
822 if (pkey) gnutls_x509_privkey_deinit(pkey);
823 return rc;
824
825err:
cf0c6164 826 rc = tls_error(where, gnutls_strerror(rc), NULL, errstr);
23bb6982
JH
827 goto out;
828}
829
830
831
832
47195144
JH
833/* Add certificate and key, from files.
834
835Return:
836 Zero or negative: good. Negate value for certificate index if < 0.
837 Greater than zero: FAIL or DEFER code.
838*/
839
ba86e143
JH
840static int
841tls_add_certfile(exim_gnutls_state_st * state, const host_item * host,
842 uschar * certfile, uschar * keyfile, uschar ** errstr)
843{
844int rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
845 CS certfile, CS keyfile, GNUTLS_X509_FMT_PEM);
47195144
JH
846if (rc < 0)
847 return tls_error(
848 string_sprintf("cert/key setup: cert=%s key=%s", certfile, keyfile),
849 gnutls_strerror(rc), host, errstr);
850return -rc;
ba86e143
JH
851}
852
853
059ec3d9 854/*************************************************
17c76198 855* Variables re-expanded post-SNI *
059ec3d9
PH
856*************************************************/
857
17c76198
PP
858/* Called from both server and client code, via tls_init(), and also from
859the SNI callback after receiving an SNI, if tls_certificate includes "tls_sni".
860
861We can tell the two apart by state->received_sni being non-NULL in callback.
862
863The callback should not call us unless state->trigger_sni_changes is true,
864which we are responsible for setting on the first pass through.
059ec3d9
PH
865
866Arguments:
17c76198 867 state exim_gnutls_state_st *
cf0c6164 868 errstr error string pointer
059ec3d9
PH
869
870Returns: OK/DEFER/FAIL
871*/
872
873static int
ba86e143 874tls_expand_session_files(exim_gnutls_state_st * state, uschar ** errstr)
059ec3d9 875{
1365611d 876struct stat statbuf;
059ec3d9 877int rc;
17c76198
PP
878const host_item *host = state->host; /* macro should be reconsidered? */
879uschar *saved_tls_certificate = NULL;
880uschar *saved_tls_privatekey = NULL;
881uschar *saved_tls_verify_certificates = NULL;
882uschar *saved_tls_crl = NULL;
883int cert_count;
884
885/* We check for tls_sni *before* expansion. */
2b4a568d 886if (!host) /* server */
17c76198
PP
887 if (!state->received_sni)
888 {
ba86e143
JH
889 if ( state->tls_certificate
890 && ( Ustrstr(state->tls_certificate, US"tls_sni")
891 || Ustrstr(state->tls_certificate, US"tls_in_sni")
892 || Ustrstr(state->tls_certificate, US"tls_out_sni")
893 ) )
17c76198
PP
894 {
895 DEBUG(D_tls) debug_printf("We will re-expand TLS session files if we receive SNI.\n");
896 state->trigger_sni_changes = TRUE;
897 }
898 }
899 else
900 {
1365611d 901 /* useful for debugging */
17c76198
PP
902 saved_tls_certificate = state->exp_tls_certificate;
903 saved_tls_privatekey = state->exp_tls_privatekey;
904 saved_tls_verify_certificates = state->exp_tls_verify_certificates;
905 saved_tls_crl = state->exp_tls_crl;
906 }
059ec3d9 907
1365611d 908rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
47195144
JH
909exim_gnutls_err_check(rc, US"gnutls_certificate_allocate_credentials");
910
911#ifdef SUPPORT_SRV_OCSP_STACK
912gnutls_certificate_set_flags(state->x509_cred, GNUTLS_CERTIFICATE_API_V2);
913#endif
1365611d 914
17c76198
PP
915/* remember: expand_check_tlsvar() is expand_check() but fiddling with
916state members, assuming consistent naming; and expand_check() returns
917false if expansion failed, unless expansion was forced to fail. */
059ec3d9 918
17c76198
PP
919/* check if we at least have a certificate, before doing expensive
920D-H generation. */
059ec3d9 921
cf0c6164 922if (!expand_check_tlsvar(tls_certificate, errstr))
17c76198 923 return DEFER;
059ec3d9 924
17c76198 925/* certificate is mandatory in server, optional in client */
059ec3d9 926
23bb6982
JH
927if ( !state->exp_tls_certificate
928 || !*state->exp_tls_certificate
929 )
2b4a568d 930 if (!host)
cf0c6164 931 return tls_install_selfsign(state, errstr);
17c76198
PP
932 else
933 DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
059ec3d9 934
cf0c6164 935if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey, errstr))
059ec3d9
PH
936 return DEFER;
937
17c76198
PP
938/* tls_privatekey is optional, defaulting to same file as certificate */
939
940if (state->tls_privatekey == NULL || *state->tls_privatekey == '\0')
059ec3d9 941 {
17c76198
PP
942 state->tls_privatekey = state->tls_certificate;
943 state->exp_tls_privatekey = state->exp_tls_certificate;
059ec3d9 944 }
c91535f3 945
059ec3d9 946
17c76198 947if (state->exp_tls_certificate && *state->exp_tls_certificate)
059ec3d9
PH
948 {
949 DEBUG(D_tls) debug_printf("certificate file = %s\nkey file = %s\n",
17c76198
PP
950 state->exp_tls_certificate, state->exp_tls_privatekey);
951
952 if (state->received_sni)
23bb6982
JH
953 if ( Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
954 && Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0
955 )
17c76198 956 {
b34fc30c 957 DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
17c76198
PP
958 }
959 else
960 {
b34fc30c 961 DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
17c76198 962 }
059ec3d9 963
ba86e143
JH
964 if (!host) /* server */
965 {
966 const uschar * clist = state->exp_tls_certificate;
967 const uschar * klist = state->exp_tls_privatekey;
47195144
JH
968 const uschar * olist;
969 int csep = 0, ksep = 0, osep = 0, cnt = 0;
970 uschar * cfile, * kfile, * ofile;
971
972#ifndef DISABLE_OCSP
973 if (!expand_check(tls_ocsp_file, US"tls_ocsp_file", &ofile, errstr))
974 return DEFER;
975 olist = ofile;
976#endif
ba86e143
JH
977
978 while (cfile = string_nextinlist(&clist, &csep, NULL, 0))
47195144 979
ba86e143
JH
980 if (!(kfile = string_nextinlist(&klist, &ksep, NULL, 0)))
981 return tls_error(US"cert/key setup: out of keys", NULL, host, errstr);
47195144 982 else if (0 < (rc = tls_add_certfile(state, host, cfile, kfile, errstr)))
ba86e143
JH
983 return rc;
984 else
47195144
JH
985 {
986 int gnutls_cert_index = -rc;
ba86e143 987 DEBUG(D_tls) debug_printf("TLS: cert/key %s registered\n", cfile);
47195144
JH
988
989 /* Set the OCSP stapling server info */
990
991#ifndef DISABLE_OCSP
992 if (tls_ocsp_file)
993 if (gnutls_buggy_ocsp)
994 {
995 DEBUG(D_tls)
996 debug_printf("GnuTLS library is buggy for OCSP; avoiding\n");
997 }
998 else if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
999 {
1000 /* Use the full callback method for stapling just to get
1001 observability. More efficient would be to read the file once only,
1002 if it never changed (due to SNI). Would need restart on file update,
1003 or watch datestamp. */
1004
1005# ifdef SUPPORT_SRV_OCSP_STACK
1006 rc = gnutls_certificate_set_ocsp_status_request_function2(
1007 state->x509_cred, gnutls_cert_index,
1008 server_ocsp_stapling_cb, ofile);
1009
1010 exim_gnutls_err_check(rc,
1011 US"gnutls_certificate_set_ocsp_status_request_function2");
1012# else
1013 if (cnt++ > 0)
1014 {
1015 DEBUG(D_tls)
1016 debug_printf("oops; multiple OCSP files not supported\n");
1017 break;
1018 }
1019 gnutls_certificate_set_ocsp_status_request_function(
1020 state->x509_cred, server_ocsp_stapling_cb, ofile);
1021# endif
1022
1023 DEBUG(D_tls) debug_printf("OCSP response file = %s\n", ofile);
1024 }
1025 else
1026 DEBUG(D_tls) debug_printf("ran out of OCSP response files in list\n");
1027#endif
1028 }
ba86e143
JH
1029 }
1030 else
1031 {
47195144 1032 if (0 < (rc = tls_add_certfile(state, host,
ba86e143
JH
1033 state->exp_tls_certificate, state->exp_tls_privatekey, errstr)))
1034 return rc;
1035 DEBUG(D_tls) debug_printf("TLS: cert/key registered\n");
1036 }
1037
b34fc30c 1038 } /* tls_certificate */
059ec3d9 1039
2b4a568d 1040
059ec3d9
PH
1041/* Set the trusted CAs file if one is provided, and then add the CRL if one is
1042provided. Experiment shows that, if the certificate file is empty, an unhelpful
1043error message is provided. However, if we just refrain from setting anything up
1044in that case, certificate verification fails, which seems to be the correct
1045behaviour. */
1046
610ff438 1047if (state->tls_verify_certificates && *state->tls_verify_certificates)
059ec3d9 1048 {
cf0c6164 1049 if (!expand_check_tlsvar(tls_verify_certificates, errstr))
059ec3d9 1050 return DEFER;
610ff438
JH
1051#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
1052 if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1053 state->exp_tls_verify_certificates = NULL;
1054#endif
17c76198 1055 if (state->tls_crl && *state->tls_crl)
cf0c6164 1056 if (!expand_check_tlsvar(tls_crl, errstr))
17c76198 1057 return DEFER;
059ec3d9 1058
1365611d
PP
1059 if (!(state->exp_tls_verify_certificates &&
1060 *state->exp_tls_verify_certificates))
b34fc30c
PP
1061 {
1062 DEBUG(D_tls)
1365611d
PP
1063 debug_printf("TLS: tls_verify_certificates expanded empty, ignoring\n");
1064 /* With no tls_verify_certificates, we ignore tls_crl too */
17c76198 1065 return OK;
b34fc30c 1066 }
1365611d 1067 }
83e2f8a2
PP
1068else
1069 {
1070 DEBUG(D_tls)
1071 debug_printf("TLS: tls_verify_certificates not set or empty, ignoring\n");
1072 return OK;
1073 }
17c76198 1074
cb1d7830
JH
1075#ifdef SUPPORT_SYSDEFAULT_CABUNDLE
1076if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
1077 cert_count = gnutls_certificate_set_x509_system_trust(state->x509_cred);
1078else
1079#endif
1365611d 1080 {
cb1d7830
JH
1081 if (Ustat(state->exp_tls_verify_certificates, &statbuf) < 0)
1082 {
1083 log_write(0, LOG_MAIN|LOG_PANIC, "could not stat %s "
1084 "(tls_verify_certificates): %s", state->exp_tls_verify_certificates,
1085 strerror(errno));
1086 return DEFER;
1087 }
17c76198 1088
a7fec7a7 1089#ifndef SUPPORT_CA_DIR
cb1d7830
JH
1090 /* The test suite passes in /dev/null; we could check for that path explicitly,
1091 but who knows if someone has some weird FIFO which always dumps some certs, or
1092 other weirdness. The thing we really want to check is that it's not a
1093 directory, since while OpenSSL supports that, GnuTLS does not.
60f914bc 1094 So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
cb1d7830
JH
1095 if (S_ISDIR(statbuf.st_mode))
1096 {
1097 DEBUG(D_tls)
1098 debug_printf("verify certificates path is a dir: \"%s\"\n",
1099 state->exp_tls_verify_certificates);
1100 log_write(0, LOG_MAIN|LOG_PANIC,
1101 "tls_verify_certificates \"%s\" is a directory",
1102 state->exp_tls_verify_certificates);
1103 return DEFER;
1104 }
a7fec7a7 1105#endif
059ec3d9 1106
cb1d7830
JH
1107 DEBUG(D_tls) debug_printf("verify certificates = %s size=" OFF_T_FMT "\n",
1108 state->exp_tls_verify_certificates, statbuf.st_size);
059ec3d9 1109
cb1d7830
JH
1110 if (statbuf.st_size == 0)
1111 {
1112 DEBUG(D_tls)
1113 debug_printf("cert file empty, no certs, no verification, ignoring any CRL\n");
1114 return OK;
1115 }
059ec3d9 1116
cb1d7830 1117 cert_count =
a7fec7a7
JH
1118
1119#ifdef SUPPORT_CA_DIR
cb1d7830
JH
1120 (statbuf.st_mode & S_IFMT) == S_IFDIR
1121 ?
1122 gnutls_certificate_set_x509_trust_dir(state->x509_cred,
1123 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM)
1124 :
a7fec7a7 1125#endif
cb1d7830
JH
1126 gnutls_certificate_set_x509_trust_file(state->x509_cred,
1127 CS state->exp_tls_verify_certificates, GNUTLS_X509_FMT_PEM);
1128 }
a7fec7a7 1129
1365611d
PP
1130if (cert_count < 0)
1131 {
1132 rc = cert_count;
47195144 1133 exim_gnutls_err_check(rc, US"setting certificate trust");
1365611d
PP
1134 }
1135DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n", cert_count);
059ec3d9 1136
5c8cda3a
PP
1137if (state->tls_crl && *state->tls_crl &&
1138 state->exp_tls_crl && *state->exp_tls_crl)
1365611d 1139 {
5c8cda3a
PP
1140 DEBUG(D_tls) debug_printf("loading CRL file = %s\n", state->exp_tls_crl);
1141 cert_count = gnutls_certificate_set_x509_crl_file(state->x509_cred,
1142 CS state->exp_tls_crl, GNUTLS_X509_FMT_PEM);
1143 if (cert_count < 0)
1365611d 1144 {
5c8cda3a 1145 rc = cert_count;
47195144 1146 exim_gnutls_err_check(rc, US"gnutls_certificate_set_x509_crl_file");
1365611d 1147 }
5c8cda3a 1148 DEBUG(D_tls) debug_printf("Processed %d CRLs.\n", cert_count);
1365611d 1149 }
059ec3d9 1150
059ec3d9
PH
1151return OK;
1152}
1153
1154
1155
1156
1157/*************************************************
1365611d
PP
1158* Set X.509 state variables *
1159*************************************************/
1160
1161/* In GnuTLS, the registered cert/key are not replaced by a later
1162set of a cert/key, so for SNI support we need a whole new x509_cred
1163structure. Which means various other non-re-expanded pieces of state
1164need to be re-set in the new struct, so the setting logic is pulled
1165out to this.
1166
1167Arguments:
1168 state exim_gnutls_state_st *
cf0c6164 1169 errstr error string pointer
1365611d
PP
1170
1171Returns: OK/DEFER/FAIL
1172*/
1173
1174static int
cf0c6164 1175tls_set_remaining_x509(exim_gnutls_state_st *state, uschar ** errstr)
1365611d
PP
1176{
1177int rc;
1178const host_item *host = state->host; /* macro should be reconsidered? */
1179
1180/* Create D-H parameters, or read them from the cache file. This function does
1181its own SMTP error messaging. This only happens for the server, TLS D-H ignores
1182client-side params. */
1183
1184if (!state->host)
1185 {
1186 if (!dh_server_params)
1187 {
cf0c6164 1188 rc = init_server_dh(errstr);
1365611d
PP
1189 if (rc != OK) return rc;
1190 }
1191 gnutls_certificate_set_dh_params(state->x509_cred, dh_server_params);
1192 }
1193
1194/* Link the credentials to the session. */
1195
1196rc = gnutls_credentials_set(state->session, GNUTLS_CRD_CERTIFICATE, state->x509_cred);
47195144 1197exim_gnutls_err_check(rc, US"gnutls_credentials_set");
1365611d
PP
1198
1199return OK;
1200}
1201
1202/*************************************************
17c76198 1203* Initialize for GnuTLS *
059ec3d9
PH
1204*************************************************/
1205
9196d5bf 1206
4fb7df6d
JH
1207#ifndef DISABLE_OCSP
1208
9196d5bf
JH
1209static BOOL
1210tls_is_buggy_ocsp(void)
1211{
1212const uschar * s;
1213uschar maj, mid, mic;
1214
1215s = CUS gnutls_check_version(NULL);
1216maj = atoi(CCS s);
1217if (maj == 3)
1218 {
1219 while (*s && *s != '.') s++;
1220 mid = atoi(CCS ++s);
1221 if (mid <= 2)
1222 return TRUE;
1223 else if (mid >= 5)
1224 return FALSE;
1225 else
1226 {
1227 while (*s && *s != '.') s++;
1228 mic = atoi(CCS ++s);
1229 return mic <= (mid == 3 ? 16 : 3);
1230 }
1231 }
1232return FALSE;
1233}
1234
4fb7df6d 1235#endif
9196d5bf
JH
1236
1237
17c76198
PP
1238/* Called from both server and client code. In the case of a server, errors
1239before actual TLS negotiation return DEFER.
059ec3d9
PH
1240
1241Arguments:
17c76198
PP
1242 host connected host, if client; NULL if server
1243 certificate certificate file
1244 privatekey private key file
1245 sni TLS SNI to send, sometimes when client; else NULL
1246 cas CA certs file
1247 crl CRL file
1248 require_ciphers tls_require_ciphers setting
817d9f57 1249 caller_state returned state-info structure
cf0c6164 1250 errstr error string pointer
059ec3d9 1251
17c76198 1252Returns: OK/DEFER/FAIL
059ec3d9
PH
1253*/
1254
17c76198
PP
1255static int
1256tls_init(
1257 const host_item *host,
1258 const uschar *certificate,
1259 const uschar *privatekey,
1260 const uschar *sni,
1261 const uschar *cas,
1262 const uschar *crl,
1263 const uschar *require_ciphers,
cf0c6164
JH
1264 exim_gnutls_state_st **caller_state,
1265 uschar ** errstr)
059ec3d9 1266{
17c76198
PP
1267exim_gnutls_state_st *state;
1268int rc;
1269size_t sz;
1270const char *errpos;
1271uschar *p;
1272BOOL want_default_priorities;
1273
1274if (!exim_gnutls_base_init_done)
059ec3d9 1275 {
17c76198
PP
1276 DEBUG(D_tls) debug_printf("GnuTLS global init required.\n");
1277
a5f239e4
PP
1278#ifdef HAVE_GNUTLS_PKCS11
1279 /* By default, gnutls_global_init will init PKCS11 support in auto mode,
1280 which loads modules from a config file, which sounds good and may be wanted
1281 by some sysadmin, but also means in common configurations that GNOME keyring
1282 environment variables are used and so breaks for users calling mailq.
1283 To prevent this, we init PKCS11 first, which is the documented approach. */
2519e60d 1284 if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
1285 {
1286 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
47195144 1287 exim_gnutls_err_check(rc, US"gnutls_pkcs11_init");
a5f239e4
PP
1288 }
1289#endif
1290
17c76198 1291 rc = gnutls_global_init();
47195144 1292 exim_gnutls_err_check(rc, US"gnutls_global_init");
17c76198
PP
1293
1294#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
1295 DEBUG(D_tls)
059ec3d9 1296 {
17c76198
PP
1297 gnutls_global_set_log_function(exim_gnutls_logger_cb);
1298 /* arbitrarily chosen level; bump upto 9 for more */
1299 gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL);
059ec3d9 1300 }
17c76198
PP
1301#endif
1302
4fb7df6d
JH
1303#ifndef DISABLE_OCSP
1304 if (tls_ocsp_file && (gnutls_buggy_ocsp = tls_is_buggy_ocsp()))
9196d5bf 1305 log_write(0, LOG_MAIN, "OCSP unusable with this GnuTLS library version");
4fb7df6d 1306#endif
9196d5bf 1307
17c76198 1308 exim_gnutls_base_init_done = TRUE;
059ec3d9 1309 }
059ec3d9 1310
17c76198
PP
1311if (host)
1312 {
1313 state = &state_client;
1314 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 1315 state->tlsp = &tls_out;
17c76198
PP
1316 DEBUG(D_tls) debug_printf("initialising GnuTLS client session\n");
1317 rc = gnutls_init(&state->session, GNUTLS_CLIENT);
1318 }
1319else
1320 {
1321 state = &state_server;
1322 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
817d9f57 1323 state->tlsp = &tls_in;
17c76198
PP
1324 DEBUG(D_tls) debug_printf("initialising GnuTLS server session\n");
1325 rc = gnutls_init(&state->session, GNUTLS_SERVER);
1326 }
47195144 1327exim_gnutls_err_check(rc, US"gnutls_init");
059ec3d9 1328
17c76198 1329state->host = host;
059ec3d9 1330
17c76198
PP
1331state->tls_certificate = certificate;
1332state->tls_privatekey = privatekey;
5779e6aa 1333state->tls_require_ciphers = require_ciphers;
17c76198
PP
1334state->tls_sni = sni;
1335state->tls_verify_certificates = cas;
1336state->tls_crl = crl;
059ec3d9 1337
17c76198
PP
1338/* This handles the variables that might get re-expanded after TLS SNI;
1339that's tls_certificate, tls_privatekey, tls_verify_certificates, tls_crl */
059ec3d9 1340
17c76198
PP
1341DEBUG(D_tls)
1342 debug_printf("Expanding various TLS configuration options for session credentials.\n");
cf0c6164 1343if ((rc = tls_expand_session_files(state, errstr)) != OK) return rc;
059ec3d9 1344
1365611d
PP
1345/* These are all other parts of the x509_cred handling, since SNI in GnuTLS
1346requires a new structure afterwards. */
83da1223 1347
cf0c6164 1348if ((rc = tls_set_remaining_x509(state, errstr)) != OK) return rc;
83da1223 1349
17c76198
PP
1350/* set SNI in client, only */
1351if (host)
1352 {
cf0c6164 1353 if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni, errstr))
17c76198 1354 return DEFER;
0df4ab80 1355 if (state->tlsp->sni && *state->tlsp->sni)
17c76198
PP
1356 {
1357 DEBUG(D_tls)
0df4ab80
JH
1358 debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
1359 sz = Ustrlen(state->tlsp->sni);
17c76198 1360 rc = gnutls_server_name_set(state->session,
0df4ab80 1361 GNUTLS_NAME_DNS, state->tlsp->sni, sz);
47195144 1362 exim_gnutls_err_check(rc, US"gnutls_server_name_set");
17c76198
PP
1363 }
1364 }
1365else if (state->tls_sni)
1366 DEBUG(D_tls) debug_printf("*** PROBABLY A BUG *** " \
ba86e143 1367 "have an SNI set for a server [%s]\n", state->tls_sni);
83da1223 1368
17c76198 1369/* This is the priority string support,
42bfef1e 1370http://www.gnutls.org/manual/html_node/Priority-Strings.html
17c76198
PP
1371and replaces gnutls_require_kx, gnutls_require_mac & gnutls_require_protocols.
1372This was backwards incompatible, but means Exim no longer needs to track
1373all algorithms and provide string forms for them. */
83da1223 1374
17c76198 1375want_default_priorities = TRUE;
83da1223 1376
17c76198 1377if (state->tls_require_ciphers && *state->tls_require_ciphers)
83da1223 1378 {
cf0c6164 1379 if (!expand_check_tlsvar(tls_require_ciphers, errstr))
17c76198
PP
1380 return DEFER;
1381 if (state->exp_tls_require_ciphers && *state->exp_tls_require_ciphers)
83da1223 1382 {
17c76198
PP
1383 DEBUG(D_tls) debug_printf("GnuTLS session cipher/priority \"%s\"\n",
1384 state->exp_tls_require_ciphers);
1385
1386 rc = gnutls_priority_init(&state->priority_cache,
1387 CS state->exp_tls_require_ciphers, &errpos);
1388 want_default_priorities = FALSE;
1389 p = state->exp_tls_require_ciphers;
83da1223
PH
1390 }
1391 }
17c76198
PP
1392if (want_default_priorities)
1393 {
83e2f8a2
PP
1394 DEBUG(D_tls)
1395 debug_printf("GnuTLS using default session cipher/priority \"%s\"\n",
1396 exim_default_gnutls_priority);
17c76198
PP
1397 rc = gnutls_priority_init(&state->priority_cache,
1398 exim_default_gnutls_priority, &errpos);
1399 p = US exim_default_gnutls_priority;
1400 }
83da1223 1401
47195144 1402exim_gnutls_err_check(rc, string_sprintf(
17c76198
PP
1403 "gnutls_priority_init(%s) failed at offset %ld, \"%.6s..\"",
1404 p, errpos - CS p, errpos));
1405
1406rc = gnutls_priority_set(state->session, state->priority_cache);
47195144 1407exim_gnutls_err_check(rc, US"gnutls_priority_set");
17c76198
PP
1408
1409gnutls_db_set_cache_expiration(state->session, ssl_session_timeout);
1410
1411/* Reduce security in favour of increased compatibility, if the admin
1412decides to make that trade-off. */
1413if (gnutls_compat_mode)
83da1223 1414 {
17c76198
PP
1415#if LIBGNUTLS_VERSION_NUMBER >= 0x020104
1416 DEBUG(D_tls) debug_printf("lowering GnuTLS security, compatibility mode\n");
1417 gnutls_session_enable_compatibility_mode(state->session);
1418#else
1419 DEBUG(D_tls) debug_printf("Unable to set gnutls_compat_mode - GnuTLS version too old\n");
1420#endif
83da1223
PH
1421 }
1422
17c76198 1423*caller_state = state;
17c76198 1424return OK;
83da1223
PH
1425}
1426
1427
1428
83da1223 1429/*************************************************
17c76198 1430* Extract peer information *
059ec3d9
PH
1431*************************************************/
1432
17c76198 1433/* Called from both server and client code.
4fe99a6c
PP
1434Only this is allowed to set state->peerdn and state->have_set_peerdn
1435and we use that to detect double-calls.
059ec3d9 1436
75fe387d
PP
1437NOTE: the state blocks last while the TLS connection is up, which is fine
1438for logging in the server side, but for the client side, we log after teardown
1439in src/deliver.c. While the session is up, we can twist about states and
1440repoint tls_* globals, but those variables used for logging or other variable
1441expansion that happens _after_ delivery need to have a longer life-time.
1442
1443So for those, we get the data from POOL_PERM; the re-invoke guard keeps us from
1444doing this more than once per generation of a state context. We set them in
1445the state context, and repoint tls_* to them. After the state goes away, the
1446tls_* copies of the pointers remain valid and client delivery logging is happy.
1447
1448tls_certificate_verified is a BOOL, so the tls_peerdn and tls_cipher issues
1449don't apply.
1450
059ec3d9 1451Arguments:
17c76198 1452 state exim_gnutls_state_st *
cf0c6164 1453 errstr pointer to error string
059ec3d9 1454
17c76198 1455Returns: OK/DEFER/FAIL
059ec3d9
PH
1456*/
1457
17c76198 1458static int
cf0c6164 1459peer_status(exim_gnutls_state_st *state, uschar ** errstr)
059ec3d9 1460{
75fe387d 1461uschar cipherbuf[256];
27f19eb4 1462const gnutls_datum_t *cert_list;
75fe387d 1463int old_pool, rc;
17c76198 1464unsigned int cert_list_size = 0;
4fe99a6c
PP
1465gnutls_protocol_t protocol;
1466gnutls_cipher_algorithm_t cipher;
1467gnutls_kx_algorithm_t kx;
1468gnutls_mac_algorithm_t mac;
17c76198
PP
1469gnutls_certificate_type_t ct;
1470gnutls_x509_crt_t crt;
4fe99a6c 1471uschar *p, *dn_buf;
17c76198 1472size_t sz;
059ec3d9 1473
4fe99a6c 1474if (state->have_set_peerdn)
17c76198 1475 return OK;
4fe99a6c 1476state->have_set_peerdn = TRUE;
059ec3d9 1477
4fe99a6c 1478state->peerdn = NULL;
059ec3d9 1479
4fe99a6c
PP
1480/* tls_cipher */
1481cipher = gnutls_cipher_get(state->session);
1482protocol = gnutls_protocol_get_version(state->session);
1483mac = gnutls_mac_get(state->session);
1484kx = gnutls_kx_get(state->session);
1485
75fe387d 1486string_format(cipherbuf, sizeof(cipherbuf),
4fe99a6c
PP
1487 "%s:%s:%d",
1488 gnutls_protocol_get_name(protocol),
1489 gnutls_cipher_suite_get_name(kx, cipher, mac),
1490 (int) gnutls_cipher_get_key_size(cipher) * 8);
1491
1492/* I don't see a way that spaces could occur, in the current GnuTLS
1493code base, but it was a concern in the old code and perhaps older GnuTLS
1494releases did return "TLS 1.0"; play it safe, just in case. */
75fe387d 1495for (p = cipherbuf; *p != '\0'; ++p)
4fe99a6c
PP
1496 if (isspace(*p))
1497 *p = '-';
75fe387d
PP
1498old_pool = store_pool;
1499store_pool = POOL_PERM;
1500state->ciphersuite = string_copy(cipherbuf);
1501store_pool = old_pool;
817d9f57 1502state->tlsp->cipher = state->ciphersuite;
4fe99a6c
PP
1503
1504/* tls_peerdn */
17c76198 1505cert_list = gnutls_certificate_get_peers(state->session, &cert_list_size);
83da1223 1506
17c76198
PP
1507if (cert_list == NULL || cert_list_size == 0)
1508 {
17c76198
PP
1509 DEBUG(D_tls) debug_printf("TLS: no certificate from peer (%p & %d)\n",
1510 cert_list, cert_list_size);
e51c7be2 1511 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1512 return tls_error(US"certificate verification failed",
cf0c6164 1513 "no certificate received from peer", state->host, errstr);
17c76198
PP
1514 return OK;
1515 }
059ec3d9 1516
17c76198
PP
1517ct = gnutls_certificate_type_get(state->session);
1518if (ct != GNUTLS_CRT_X509)
059ec3d9 1519 {
17c76198 1520 const char *ctn = gnutls_certificate_type_get_name(ct);
17c76198
PP
1521 DEBUG(D_tls)
1522 debug_printf("TLS: peer cert not X.509 but instead \"%s\"\n", ctn);
e51c7be2 1523 if (state->verify_requirement >= VERIFY_REQUIRED)
17c76198 1524 return tls_error(US"certificate verification not possible, unhandled type",
cf0c6164 1525 ctn, state->host, errstr);
17c76198 1526 return OK;
83da1223 1527 }
059ec3d9 1528
e51c7be2
JH
1529#define exim_gnutls_peer_err(Label) \
1530 do { \
1531 if (rc != GNUTLS_E_SUCCESS) \
1532 { \
1533 DEBUG(D_tls) debug_printf("TLS: peer cert problem: %s: %s\n", \
1534 (Label), gnutls_strerror(rc)); \
1535 if (state->verify_requirement >= VERIFY_REQUIRED) \
cf0c6164 1536 return tls_error((Label), gnutls_strerror(rc), state->host, errstr); \
e51c7be2
JH
1537 return OK; \
1538 } \
1539 } while (0)
17c76198 1540
9d1c15ef
JH
1541rc = import_cert(&cert_list[0], &crt);
1542exim_gnutls_peer_err(US"cert 0");
1543
1544state->tlsp->peercert = state->peercert = crt;
17c76198 1545
17c76198
PP
1546sz = 0;
1547rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
1548if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
83da1223 1549 {
17c76198
PP
1550 exim_gnutls_peer_err(US"getting size for cert DN failed");
1551 return FAIL; /* should not happen */
059ec3d9 1552 }
17c76198
PP
1553dn_buf = store_get_perm(sz);
1554rc = gnutls_x509_crt_get_dn(crt, CS dn_buf, &sz);
1555exim_gnutls_peer_err(US"failed to extract certificate DN [gnutls_x509_crt_get_dn(cert 0)]");
9d1c15ef 1556
17c76198
PP
1557state->peerdn = dn_buf;
1558
1559return OK;
1560#undef exim_gnutls_peer_err
1561}
059ec3d9 1562
059ec3d9 1563
059ec3d9 1564
059ec3d9 1565
17c76198
PP
1566/*************************************************
1567* Verify peer certificate *
1568*************************************************/
059ec3d9 1569
17c76198
PP
1570/* Called from both server and client code.
1571*Should* be using a callback registered with
1572gnutls_certificate_set_verify_function() to fail the handshake if we dislike
1573the peer information, but that's too new for some OSes.
059ec3d9 1574
17c76198 1575Arguments:
899b8bbc
JH
1576 state exim_gnutls_state_st *
1577 errstr where to put an error message
059ec3d9 1578
17c76198
PP
1579Returns:
1580 FALSE if the session should be rejected
1581 TRUE if the cert is okay or we just don't care
1582*/
059ec3d9 1583
17c76198 1584static BOOL
28646fa9 1585verify_certificate(exim_gnutls_state_st * state, uschar ** errstr)
17c76198
PP
1586{
1587int rc;
899b8bbc
JH
1588uint verify;
1589
1590if (state->verify_requirement == VERIFY_NONE)
1591 return TRUE;
17c76198 1592
cf0c6164 1593*errstr = NULL;
17c76198 1594
cf0c6164 1595if ((rc = peer_status(state, errstr)) != OK)
e6060e2c 1596 {
17c76198 1597 verify = GNUTLS_CERT_INVALID;
cf0c6164 1598 *errstr = US"certificate not supplied";
17c76198
PP
1599 }
1600else
899b8bbc
JH
1601
1602 {
1603#ifdef SUPPORT_DANE
1604 if (state->verify_requirement == VERIFY_DANE && state->host)
1605 {
1606 /* Using dane_verify_session_crt() would be easy, as it does it all for us
1607 including talking to a DNS resolver. But we want to do that bit ourselves
1608 as the testsuite intercepts and fakes its own DNS environment. */
1609
1610 dane_state_t s;
1611 dane_query_t r;
899b8bbc 1612 uint lsize;
94c13285
JH
1613 const gnutls_datum_t * certlist =
1614 gnutls_certificate_get_peers(state->session, &lsize);
1615 int usage = tls_out.tlsa_usage;
1616
1617# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1618 /* Split the TLSA records into two sets, TA and EE selectors. Run the
1619 dane-verification separately so that we know which selector verified;
1620 then we know whether to do CA-chain-verification and name-verification
1621 (needed for TA but not EE). */
1622
1623 if (usage == ((1<<DANESSL_USAGE_DANE_TA) | (1<<DANESSL_USAGE_DANE_EE)))
1624 { /* a mixed-usage bundle */
1625 int i, j, nrec;
1626 const char ** dd;
1627 int * ddl;
1628
1629 for(nrec = 0; state->dane_data_len[nrec]; ) nrec++;
1630 nrec++;
1631
1632 dd = store_get(nrec * sizeof(uschar *));
1633 ddl = store_get(nrec * sizeof(int));
1634 nrec--;
1635
1636 if ((rc = dane_state_init(&s, 0)))
1637 goto tlsa_prob;
1638
1639 for (usage = DANESSL_USAGE_DANE_EE;
1640 usage >= DANESSL_USAGE_DANE_TA; usage--)
1641 { /* take records with this usage */
1642 for (j = i = 0; i < nrec; i++)
1643 if (state->dane_data[i][0] == usage)
1644 {
1645 dd[j] = state->dane_data[i];
1646 ddl[j++] = state->dane_data_len[i];
1647 }
1648 if (j)
1649 {
1650 dd[j] = NULL;
1651 ddl[j] = 0;
1652
1653 if ((rc = dane_raw_tlsa(s, &r, (char * const *)dd, ddl, 1, 0)))
1654 goto tlsa_prob;
1655
1656 if ((rc = dane_verify_crt_raw(s, certlist, lsize,
1657 gnutls_certificate_type_get(state->session),
1658 r, 0,
1659 usage == DANESSL_USAGE_DANE_EE
1660 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1661 &verify)))
1662 {
1663 DEBUG(D_tls)
1664 debug_printf("TLSA record problem: %s\n", dane_strerror(rc));
1665 }
1666 else if (verify == 0) /* verification passed */
1667 {
1668 usage = 1 << usage;
1669 break;
1670 }
1671 }
1672 }
899b8bbc 1673
94c13285
JH
1674 if (rc) goto tlsa_prob;
1675 }
1676 else
1677# endif
899b8bbc 1678 {
94c13285
JH
1679 if ( (rc = dane_state_init(&s, 0))
1680 || (rc = dane_raw_tlsa(s, &r, state->dane_data, state->dane_data_len,
1681 1, 0))
1682 || (rc = dane_verify_crt_raw(s, certlist, lsize,
1683 gnutls_certificate_type_get(state->session),
1684 r, 0,
1685# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1686 usage == (1 << DANESSL_USAGE_DANE_EE)
1687 ? DANE_VFLAG_ONLY_CHECK_EE_USAGE : 0,
1688# else
1689 0,
1690# endif
1691 &verify))
1692 )
1693 goto tlsa_prob;
899b8bbc 1694 }
94c13285
JH
1695
1696 if (verify != 0) /* verification failed */
899b8bbc
JH
1697 {
1698 gnutls_datum_t str;
1699 (void) dane_verification_status_print(verify, &str, 0);
1700 *errstr = US str.data; /* don't bother to free */
1701 goto badcert;
1702 }
1703 state->peer_dane_verified = TRUE;
28646fa9 1704
94c13285
JH
1705# ifdef GNUTLS_BROKEN_DANE_VALIDATION
1706 /* If a TA-mode TLSA record was used for verification we must additionally
1707 verify the CA chain and the cert name. For EE-mode, skip it. */
28646fa9 1708
94c13285
JH
1709 if (usage & (1 << DANESSL_USAGE_DANE_EE))
1710# endif
28646fa9
JH
1711 {
1712 state->peer_cert_verified = TRUE;
1713 goto goodcert;
1714 }
899b8bbc
JH
1715 }
1716#endif
1717
17c76198 1718 rc = gnutls_certificate_verify_peers2(state->session, &verify);
899b8bbc 1719 }
e6060e2c 1720
899b8bbc 1721/* Handle the result of verification. INVALID is set if any others are. */
059ec3d9 1722
28646fa9 1723if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
17c76198
PP
1724 {
1725 state->peer_cert_verified = FALSE;
cf0c6164
JH
1726 if (!*errstr)
1727 *errstr = verify & GNUTLS_CERT_REVOKED
1728 ? US"certificate revoked" : US"certificate invalid";
059ec3d9 1729
17c76198 1730 DEBUG(D_tls)
e51c7be2 1731 debug_printf("TLS certificate verification failed (%s): peerdn=\"%s\"\n",
cf0c6164 1732 *errstr, state->peerdn ? state->peerdn : US"<unset>");
059ec3d9 1733
e51c7be2 1734 if (state->verify_requirement >= VERIFY_REQUIRED)
899b8bbc 1735 goto badcert;
17c76198 1736 DEBUG(D_tls)
4789da3a 1737 debug_printf("TLS verify failure overridden (host in tls_try_verify_hosts)\n");
17c76198 1738 }
e51c7be2 1739
17c76198
PP
1740else
1741 {
aa2a70ba 1742 if (state->exp_tls_verify_cert_hostnames)
e51c7be2
JH
1743 {
1744 int sep = 0;
55414b25 1745 const uschar * list = state->exp_tls_verify_cert_hostnames;
e51c7be2 1746 uschar * name;
76075bb5 1747 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
e51c7be2
JH
1748 if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
1749 break;
1750 if (!name)
1751 {
1752 DEBUG(D_tls)
1753 debug_printf("TLS certificate verification failed: cert name mismatch\n");
aa2a70ba 1754 if (state->verify_requirement >= VERIFY_REQUIRED)
899b8bbc 1755 goto badcert;
aa2a70ba 1756 return TRUE;
e51c7be2
JH
1757 }
1758 }
17c76198 1759 state->peer_cert_verified = TRUE;
e51c7be2 1760 DEBUG(D_tls) debug_printf("TLS certificate verified: peerdn=\"%s\"\n",
4fe99a6c 1761 state->peerdn ? state->peerdn : US"<unset>");
17c76198 1762 }
059ec3d9 1763
28646fa9
JH
1764goodcert:
1765 state->tlsp->peerdn = state->peerdn;
1766 return TRUE;
899b8bbc 1767
b83314e3 1768#ifdef SUPPORT_DANE
94c13285
JH
1769tlsa_prob:
1770 *errstr = string_sprintf("TLSA record problem: %s", dane_strerror(rc));
b83314e3
JH
1771#endif
1772
899b8bbc
JH
1773badcert:
1774 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);
1775 return FALSE;
17c76198 1776}
059ec3d9 1777
17c76198
PP
1778
1779
1780
1781/* ------------------------------------------------------------------------ */
1782/* Callbacks */
1783
1784/* Logging function which can be registered with
1785 * gnutls_global_set_log_function()
1786 * gnutls_global_set_log_level() 0..9
1787 */
af3498d6 1788#if EXIM_GNUTLS_LIBRARY_LOG_LEVEL >= 0
059ec3d9 1789static void
17c76198 1790exim_gnutls_logger_cb(int level, const char *message)
059ec3d9 1791{
8c79eebf
PP
1792 size_t len = strlen(message);
1793 if (len < 1)
1794 {
1795 DEBUG(D_tls) debug_printf("GnuTLS<%d> empty debug message\n", level);
1796 return;
1797 }
1798 DEBUG(D_tls) debug_printf("GnuTLS<%d>: %s%s", level, message,
1799 message[len-1] == '\n' ? "" : "\n");
17c76198 1800}
af3498d6 1801#endif
059ec3d9 1802
059ec3d9 1803
17c76198
PP
1804/* Called after client hello, should handle SNI work.
1805This will always set tls_sni (state->received_sni) if available,
1806and may trigger presenting different certificates,
1807if state->trigger_sni_changes is TRUE.
059ec3d9 1808
17c76198
PP
1809Should be registered with
1810 gnutls_handshake_set_post_client_hello_function()
059ec3d9 1811
17c76198
PP
1812"This callback must return 0 on success or a gnutls error code to terminate the
1813handshake.".
059ec3d9 1814
17c76198
PP
1815For inability to get SNI information, we return 0.
1816We only return non-zero if re-setup failed.
817d9f57 1817Only used for server-side TLS.
17c76198 1818*/
44bbabb5 1819
17c76198
PP
1820static int
1821exim_sni_handling_cb(gnutls_session_t session)
1822{
1823char sni_name[MAX_HOST_LEN];
1824size_t data_len = MAX_HOST_LEN;
817d9f57 1825exim_gnutls_state_st *state = &state_server;
17c76198
PP
1826unsigned int sni_type;
1827int rc, old_pool;
cf0c6164 1828uschar * dummy_errstr;
17c76198
PP
1829
1830rc = gnutls_server_name_get(session, sni_name, &data_len, &sni_type, 0);
b34fc30c
PP
1831if (rc != GNUTLS_E_SUCCESS)
1832 {
1833 DEBUG(D_tls) {
1834 if (rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1835 debug_printf("TLS: no SNI presented in handshake.\n");
1836 else
1837 debug_printf("TLS failure: gnutls_server_name_get(): %s [%d]\n",
1838 gnutls_strerror(rc), rc);
cf0c6164 1839 }
b34fc30c
PP
1840 return 0;
1841 }
1842
17c76198
PP
1843if (sni_type != GNUTLS_NAME_DNS)
1844 {
1845 DEBUG(D_tls) debug_printf("TLS: ignoring SNI of unhandled type %u\n", sni_type);
1846 return 0;
1847 }
44bbabb5 1848
17c76198
PP
1849/* We now have a UTF-8 string in sni_name */
1850old_pool = store_pool;
1851store_pool = POOL_PERM;
1852state->received_sni = string_copyn(US sni_name, data_len);
1853store_pool = old_pool;
1854
1855/* We set this one now so that variable expansions below will work */
817d9f57 1856state->tlsp->sni = state->received_sni;
17c76198
PP
1857
1858DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", sni_name,
1859 state->trigger_sni_changes ? "" : " (unused for certificate selection)");
1860
1861if (!state->trigger_sni_changes)
1862 return 0;
1863
cf0c6164 1864if ((rc = tls_expand_session_files(state, &dummy_errstr)) != OK)
17c76198
PP
1865 {
1866 /* If the setup of certs/etc failed before handshake, TLS would not have
1867 been offered. The best we can do now is abort. */
1868 return GNUTLS_E_APPLICATION_ERROR_MIN;
1869 }
1870
cf0c6164 1871rc = tls_set_remaining_x509(state, &dummy_errstr);
1365611d
PP
1872if (rc != OK) return GNUTLS_E_APPLICATION_ERROR_MIN;
1873
1874return 0;
059ec3d9
PH
1875}
1876
1877
1878
f2de3a33 1879#ifndef DISABLE_OCSP
44662487
JH
1880
1881static int
1882server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
1883 gnutls_datum_t * ocsp_response)
1884{
1885int ret;
47195144 1886DEBUG(D_tls) debug_printf("OCSP stapling callback: %s\n", US ptr);
44662487 1887
44662487
JH
1888if ((ret = gnutls_load_file(ptr, ocsp_response)) < 0)
1889 {
1890 DEBUG(D_tls) debug_printf("Failed to load ocsp stapling file %s\n",
5903c6ff 1891 CS ptr);
018058b2 1892 tls_in.ocsp = OCSP_NOT_RESP;
44662487
JH
1893 return GNUTLS_E_NO_CERTIFICATE_STATUS;
1894 }
1895
018058b2 1896tls_in.ocsp = OCSP_VFY_NOT_TRIED;
44662487
JH
1897return 0;
1898}
1899
1900#endif
1901
1902
0cbf2b82 1903#ifndef DISABLE_EVENT
a7538db1
JH
1904/*
1905We use this callback to get observability and detail-level control
723fe533
JH
1906for an exim TLS connection (either direction), raising a tls:cert event
1907for each cert in the chain presented by the peer. Any event
a7538db1
JH
1908can deny verification.
1909
1910Return 0 for the handshake to continue or non-zero to terminate.
1911*/
1912
1913static int
723fe533 1914verify_cb(gnutls_session_t session)
a7538db1 1915{
27f19eb4 1916const gnutls_datum_t * cert_list;
a7538db1
JH
1917unsigned int cert_list_size = 0;
1918gnutls_x509_crt_t crt;
1919int rc;
b30275b8 1920uschar * yield;
a7538db1
JH
1921exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
1922
1923cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
1924if (cert_list)
1925 while (cert_list_size--)
1926 {
1927 rc = import_cert(&cert_list[cert_list_size], &crt);
1928 if (rc != GNUTLS_E_SUCCESS)
1929 {
1930 DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
1931 cert_list_size, gnutls_strerror(rc));
1932 break;
1933 }
1934
1935 state->tlsp->peercert = crt;
b30275b8
JH
1936 if ((yield = event_raise(state->event_action,
1937 US"tls:cert", string_sprintf("%d", cert_list_size))))
a7538db1
JH
1938 {
1939 log_write(0, LOG_MAIN,
b30275b8
JH
1940 "SSL verify denied by event-action: depth=%d: %s",
1941 cert_list_size, yield);
a7538db1
JH
1942 return 1; /* reject */
1943 }
1944 state->tlsp->peercert = NULL;
1945 }
1946
1947return 0;
1948}
1949
1950#endif
44662487
JH
1951
1952
17c76198
PP
1953
1954/* ------------------------------------------------------------------------ */
1955/* Exported functions */
1956
1957
1958
1959
059ec3d9
PH
1960/*************************************************
1961* Start a TLS session in a server *
1962*************************************************/
1963
1964/* This is called when Exim is running as a server, after having received
1965the STARTTLS command. It must respond to that command, and then negotiate
1966a TLS session.
1967
1968Arguments:
83da1223 1969 require_ciphers list of allowed ciphers or NULL
cf0c6164 1970 errstr pointer to error string
059ec3d9
PH
1971
1972Returns: OK on success
1973 DEFER for errors before the start of the negotiation
4c04137d 1974 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
1975 continue running.
1976*/
1977
1978int
cf0c6164 1979tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
1980{
1981int rc;
cf0c6164 1982exim_gnutls_state_st * state = NULL;
059ec3d9
PH
1983
1984/* Check for previous activation */
817d9f57 1985if (tls_in.active >= 0)
059ec3d9 1986 {
cf0c6164 1987 tls_error(US"STARTTLS received after TLS started", "", NULL, errstr);
925ac8e4 1988 smtp_printf("554 Already in TLS\r\n", FALSE);
059ec3d9
PH
1989 return FAIL;
1990 }
1991
1992/* Initialize the library. If it fails, it will already have logged the error
1993and sent an SMTP response. */
1994
17c76198 1995DEBUG(D_tls) debug_printf("initialising GnuTLS as a server\n");
059ec3d9 1996
cf0c6164 1997if ((rc = tls_init(NULL, tls_certificate, tls_privatekey,
17c76198 1998 NULL, tls_verify_certificates, tls_crl,
cf0c6164 1999 require_ciphers, &state, errstr)) != OK) return rc;
059ec3d9 2000
059ec3d9
PH
2001/* If this is a host for which certificate verification is mandatory or
2002optional, set up appropriately. */
2003
059ec3d9 2004if (verify_check_host(&tls_verify_hosts) == OK)
17c76198 2005 {
e51c7be2
JH
2006 DEBUG(D_tls)
2007 debug_printf("TLS: a client certificate will be required.\n");
17c76198
PP
2008 state->verify_requirement = VERIFY_REQUIRED;
2009 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2010 }
059ec3d9 2011else if (verify_check_host(&tls_try_verify_hosts) == OK)
17c76198 2012 {
e51c7be2
JH
2013 DEBUG(D_tls)
2014 debug_printf("TLS: a client certificate will be requested but not required.\n");
17c76198
PP
2015 state->verify_requirement = VERIFY_OPTIONAL;
2016 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2017 }
2018else
2019 {
e51c7be2
JH
2020 DEBUG(D_tls)
2021 debug_printf("TLS: a client certificate will not be requested.\n");
17c76198
PP
2022 state->verify_requirement = VERIFY_NONE;
2023 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
2024 }
059ec3d9 2025
0cbf2b82 2026#ifndef DISABLE_EVENT
723fe533
JH
2027if (event_action)
2028 {
2029 state->event_action = event_action;
2030 gnutls_session_set_ptr(state->session, state);
2031 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
2032 }
2033#endif
2034
17c76198
PP
2035/* Register SNI handling; always, even if not in tls_certificate, so that the
2036expansion variable $tls_sni is always available. */
059ec3d9 2037
17c76198
PP
2038gnutls_handshake_set_post_client_hello_function(state->session,
2039 exim_sni_handling_cb);
059ec3d9
PH
2040
2041/* Set context and tell client to go ahead, except in the case of TLS startup
2042on connection, where outputting anything now upsets the clients and tends to
2043make them disconnect. We need to have an explicit fflush() here, to force out
2044the response. Other smtp_printf() calls do not need it, because in non-TLS
2045mode, the fflush() happens when smtp_getc() is called. */
2046
817d9f57 2047if (!state->tlsp->on_connect)
059ec3d9 2048 {
925ac8e4 2049 smtp_printf("220 TLS go ahead\r\n", FALSE);
9d1c15ef 2050 fflush(smtp_out);
059ec3d9
PH
2051 }
2052
2053/* Now negotiate the TLS session. We put our own timer on it, since it seems
2054that the GnuTLS library doesn't. */
2055
17c76198 2056gnutls_transport_set_ptr2(state->session,
27f19eb4
JH
2057 (gnutls_transport_ptr_t)(long) fileno(smtp_in),
2058 (gnutls_transport_ptr_t)(long) fileno(smtp_out));
17c76198
PP
2059state->fd_in = fileno(smtp_in);
2060state->fd_out = fileno(smtp_out);
059ec3d9
PH
2061
2062sigalrm_seen = FALSE;
2063if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
17c76198 2064do
17c76198 2065 rc = gnutls_handshake(state->session);
157a7880 2066while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
059ec3d9
PH
2067alarm(0);
2068
17c76198 2069if (rc != GNUTLS_E_SUCCESS)
059ec3d9 2070 {
059ec3d9
PH
2071 /* It seems that, except in the case of a timeout, we have to close the
2072 connection right here; otherwise if the other end is running OpenSSL it hangs
2073 until the server times out. */
2074
60d10ce7 2075 if (sigalrm_seen)
ad7fc6eb 2076 {
cf0c6164 2077 tls_error(US"gnutls_handshake", "timed out", NULL, errstr);
ad7fc6eb
JH
2078 gnutls_db_remove_session(state->session);
2079 }
60d10ce7 2080 else
059ec3d9 2081 {
cf0c6164 2082 tls_error(US"gnutls_handshake", gnutls_strerror(rc), NULL, errstr);
f5d25c2b 2083 (void) gnutls_alert_send_appropriate(state->session, rc);
ad7fc6eb 2084 gnutls_deinit(state->session);
ed62aae3 2085 gnutls_certificate_free_credentials(state->x509_cred);
60d10ce7 2086 millisleep(500);
ad7fc6eb 2087 shutdown(state->fd_out, SHUT_WR);
60d10ce7 2088 for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--; /* drain skt */
f1e894f3
PH
2089 (void)fclose(smtp_out);
2090 (void)fclose(smtp_in);
60d10ce7 2091 smtp_out = smtp_in = NULL;
059ec3d9
PH
2092 }
2093
2094 return FAIL;
2095 }
2096
2097DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
2098
17c76198
PP
2099/* Verify after the fact */
2100
899b8bbc 2101if (!verify_certificate(state, errstr))
059ec3d9 2102 {
9d1c15ef 2103 if (state->verify_requirement != VERIFY_OPTIONAL)
17c76198 2104 {
cf0c6164 2105 (void) tls_error(US"certificate verification failed", *errstr, NULL, errstr);
9d1c15ef 2106 return FAIL;
17c76198 2107 }
9d1c15ef
JH
2108 DEBUG(D_tls)
2109 debug_printf("TLS: continuing on only because verification was optional, after: %s\n",
cf0c6164 2110 *errstr);
059ec3d9
PH
2111 }
2112
17c76198
PP
2113/* Figure out peer DN, and if authenticated, etc. */
2114
cf0c6164 2115if ((rc = peer_status(state, NULL)) != OK) return rc;
17c76198
PP
2116
2117/* Sets various Exim expansion variables; always safe within server */
2118
9d1c15ef 2119extract_exim_vars_from_tls_state(state);
059ec3d9
PH
2120
2121/* TLS has been set up. Adjust the input functions to read via TLS,
2122and initialize appropriately. */
2123
17c76198 2124state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9
PH
2125
2126receive_getc = tls_getc;
0d81dabc 2127receive_getbuf = tls_getbuf;
584e96c6 2128receive_get_cache = tls_get_cache;
059ec3d9
PH
2129receive_ungetc = tls_ungetc;
2130receive_feof = tls_feof;
2131receive_ferror = tls_ferror;
58eb016e 2132receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2133
059ec3d9
PH
2134return OK;
2135}
2136
2137
2138
2139
aa2a70ba
JH
2140static void
2141tls_client_setup_hostname_checks(host_item * host, exim_gnutls_state_st * state,
2142 smtp_transport_options_block * ob)
2143{
5130845b 2144if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
aa2a70ba 2145 {
4af0d74a 2146 state->exp_tls_verify_cert_hostnames =
8c5d388a 2147#ifdef SUPPORT_I18N
4af0d74a
JH
2148 string_domain_utf8_to_alabel(host->name, NULL);
2149#else
2150 host->name;
2151#endif
aa2a70ba
JH
2152 DEBUG(D_tls)
2153 debug_printf("TLS: server cert verification includes hostname: \"%s\".\n",
2154 state->exp_tls_verify_cert_hostnames);
2155 }
2156}
aa2a70ba
JH
2157
2158
899b8bbc
JH
2159
2160
2161#ifdef SUPPORT_DANE
2162/* Given our list of RRs from the TLSA lookup, build a lookup block in
2163GnuTLS-DANE's preferred format. Hang it on the state str for later
2164use in DANE verification.
2165
2166We point at the dnsa data not copy it, so it must remain valid until
2167after verification is done.*/
2168
3674140c 2169static BOOL
899b8bbc
JH
2170dane_tlsa_load(exim_gnutls_state_st * state, dns_answer * dnsa)
2171{
2172dns_record * rr;
2173dns_scan dnss;
2174int i;
2175const char ** dane_data;
2176int * dane_data_len;
2177
2178for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 1;
2179 rr;
2180 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2181 ) if (rr->type == T_TLSA) i++;
2182
2183dane_data = store_get(i * sizeof(uschar *));
2184dane_data_len = store_get(i * sizeof(int));
2185
2186for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS), i = 0;
2187 rr;
2188 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2189 ) if (rr->type == T_TLSA)
2190 {
2191 const uschar * p = rr->data;
3674140c
JH
2192 uint8_t usage = p[0], sel = p[1], type = p[2];
2193
2194 DEBUG(D_tls)
2195 debug_printf("TLSA: %d %d %d size %d\n", usage, sel, type, rr->size);
2196
94c13285
JH
2197 if ( (usage != DANESSL_USAGE_DANE_TA && usage != DANESSL_USAGE_DANE_EE)
2198 || (sel != 0 && sel != 1)
2199 )
2200 continue;
3674140c
JH
2201 switch(type)
2202 {
2203 case 0: /* Full: cannot check at present */
2204 break;
2205 case 1: if (rr->size != 3 + 256/8) continue; /* sha2-256 */
2206 break;
2207 case 2: if (rr->size != 3 + 512/8) continue; /* sha2-512 */
2208 break;
2209 default: continue;
2210 }
899b8bbc
JH
2211
2212 tls_out.tlsa_usage |= 1<<usage;
2213 dane_data[i] = p;
2214 dane_data_len[i++] = rr->size;
2215 }
3674140c
JH
2216
2217if (!i) return FALSE;
2218
899b8bbc
JH
2219dane_data[i] = NULL;
2220dane_data_len[i] = 0;
2221
2222state->dane_data = (char * const *)dane_data;
2223state->dane_data_len = dane_data_len;
3674140c 2224return TRUE;
899b8bbc
JH
2225}
2226#endif
2227
2228
2229
059ec3d9
PH
2230/*************************************************
2231* Start a TLS session in a client *
2232*************************************************/
2233
2234/* Called from the smtp transport after STARTTLS has been accepted.
2235
2236Arguments:
2237 fd the fd of the connection
2238 host connected host (for messages)
83da1223 2239 addr the first address (not used)
a7538db1 2240 tb transport (always smtp)
899b8bbc
JH
2241 tlsa_dnsa non-NULL, either request or require dane for this host, and
2242 a TLSA record found. Therefore, dane verify required.
2243 Which implies cert must be requested and supplied, dane
2244 verify must pass, and cert verify irrelevant (incl.
2245 hostnames), and (caller handled) require_tls
cf0c6164
JH
2246 errstr error string pointer
2247
059ec3d9
PH
2248Returns: OK/DEFER/FAIL (because using common functions),
2249 but for a client, DEFER and FAIL have the same meaning
2250*/
2251
2252int
17c76198 2253tls_client_start(int fd, host_item *host,
f5d78688 2254 address_item *addr ARG_UNUSED,
cf0c6164 2255 transport_instance * tb,
c0635b6d 2256#ifdef SUPPORT_DANE
899b8bbc 2257 dns_answer * tlsa_dnsa,
0e66b3b6 2258#endif
cf0c6164 2259 uschar ** errstr)
059ec3d9 2260{
a7538db1
JH
2261smtp_transport_options_block *ob =
2262 (smtp_transport_options_block *)tb->options_block;
059ec3d9 2263int rc;
899b8bbc 2264exim_gnutls_state_st * state = NULL;
f2de3a33 2265#ifndef DISABLE_OCSP
5130845b
JH
2266BOOL require_ocsp =
2267 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
44662487 2268BOOL request_ocsp = require_ocsp ? TRUE
5130845b 2269 : verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2b4a568d 2270#endif
059ec3d9 2271
17c76198 2272DEBUG(D_tls) debug_printf("initialising GnuTLS as a client on fd %d\n", fd);
059ec3d9 2273
65867078
JH
2274if ((rc = tls_init(host, ob->tls_certificate, ob->tls_privatekey,
2275 ob->tls_sni, ob->tls_verify_certificates, ob->tls_crl,
cf0c6164 2276 ob->tls_require_ciphers, &state, errstr)) != OK)
2b4a568d 2277 return rc;
059ec3d9 2278
54c90be1 2279 {
65867078
JH
2280 int dh_min_bits = ob->tls_dh_min_bits;
2281 if (dh_min_bits < EXIM_CLIENT_DH_MIN_MIN_BITS)
2282 {
2283 DEBUG(D_tls)
2284 debug_printf("WARNING: tls_dh_min_bits far too low,"
2285 " clamping %d up to %d\n",
2286 dh_min_bits, EXIM_CLIENT_DH_MIN_MIN_BITS);
2287 dh_min_bits = EXIM_CLIENT_DH_MIN_MIN_BITS;
2288 }
54c90be1 2289
65867078
JH
2290 DEBUG(D_tls) debug_printf("Setting D-H prime minimum"
2291 " acceptable bits to %d\n",
2292 dh_min_bits);
2293 gnutls_dh_set_prime_bits(state->session, dh_min_bits);
2294 }
83da1223 2295
94431adb 2296/* Stick to the old behaviour for compatibility if tls_verify_certificates is
2b4a568d
JH
2297set but both tls_verify_hosts and tls_try_verify_hosts are unset. Check only
2298the specified host patterns if one of them is defined */
2299
899b8bbc 2300#ifdef SUPPORT_DANE
3674140c 2301if (tlsa_dnsa && dane_tlsa_load(state, tlsa_dnsa))
899b8bbc
JH
2302 {
2303 DEBUG(D_tls)
2304 debug_printf("TLS: server certificate DANE required.\n");
2305 state->verify_requirement = VERIFY_DANE;
2306 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
899b8bbc
JH
2307 }
2308else
2309#endif
2310 if ( ( state->exp_tls_verify_certificates
2311 && !ob->tls_verify_hosts
2312 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2313 )
2314 || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
2315 )
17c76198 2316 {
aa2a70ba 2317 tls_client_setup_hostname_checks(host, state, ob);
aa2a70ba
JH
2318 DEBUG(D_tls)
2319 debug_printf("TLS: server certificate verification required.\n");
2320 state->verify_requirement = VERIFY_REQUIRED;
52f93eed
WB
2321 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUIRE);
2322 }
5130845b 2323else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
52f93eed 2324 {
aa2a70ba 2325 tls_client_setup_hostname_checks(host, state, ob);
e51c7be2
JH
2326 DEBUG(D_tls)
2327 debug_printf("TLS: server certificate verification optional.\n");
52f93eed 2328 state->verify_requirement = VERIFY_OPTIONAL;
17c76198
PP
2329 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_REQUEST);
2330 }
2331else
2332 {
e51c7be2
JH
2333 DEBUG(D_tls)
2334 debug_printf("TLS: server certificate verification not required.\n");
52f93eed
WB
2335 state->verify_requirement = VERIFY_NONE;
2336 gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
17c76198 2337 }
059ec3d9 2338
f2de3a33
JH
2339#ifndef DISABLE_OCSP
2340 /* supported since GnuTLS 3.1.3 */
44662487 2341if (request_ocsp)
9d1c15ef
JH
2342 {
2343 DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
65867078
JH
2344 if ((rc = gnutls_ocsp_status_request_enable_client(state->session,
2345 NULL, 0, NULL)) != OK)
9d1c15ef 2346 return tls_error(US"cert-status-req",
cf0c6164 2347 gnutls_strerror(rc), state->host, errstr);
44662487 2348 tls_out.ocsp = OCSP_NOT_RESP;
9d1c15ef 2349 }
2b4a568d
JH
2350#endif
2351
0cbf2b82 2352#ifndef DISABLE_EVENT
774ef2d7 2353if (tb->event_action)
a7538db1 2354 {
774ef2d7 2355 state->event_action = tb->event_action;
a7538db1 2356 gnutls_session_set_ptr(state->session, state);
723fe533 2357 gnutls_certificate_set_verify_function(state->x509_cred, verify_cb);
a7538db1
JH
2358 }
2359#endif
2360
27f19eb4 2361gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr_t)(long) fd);
17c76198
PP
2362state->fd_in = fd;
2363state->fd_out = fd;
059ec3d9 2364
9d1c15ef 2365DEBUG(D_tls) debug_printf("about to gnutls_handshake\n");
059ec3d9
PH
2366/* There doesn't seem to be a built-in timeout on connection. */
2367
2368sigalrm_seen = FALSE;
65867078 2369alarm(ob->command_timeout);
17c76198 2370do
17c76198 2371 rc = gnutls_handshake(state->session);
f1fed05b 2372while (rc == GNUTLS_E_AGAIN || rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
059ec3d9
PH
2373alarm(0);
2374
4fe99a6c 2375if (rc != GNUTLS_E_SUCCESS)
60d10ce7
JH
2376 if (sigalrm_seen)
2377 {
2378 gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
cf0c6164 2379 return tls_error(US"gnutls_handshake", "timed out", state->host, errstr);
60d10ce7
JH
2380 }
2381 else
cf0c6164 2382 return tls_error(US"gnutls_handshake", gnutls_strerror(rc), state->host, errstr);
4fe99a6c 2383
17c76198 2384DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
059ec3d9 2385
17c76198 2386/* Verify late */
059ec3d9 2387
899b8bbc 2388if (!verify_certificate(state, errstr))
cf0c6164 2389 return tls_error(US"certificate verification failed", *errstr, state->host, errstr);
059ec3d9 2390
f2de3a33 2391#ifndef DISABLE_OCSP
2b4a568d
JH
2392if (require_ocsp)
2393 {
2394 DEBUG(D_tls)
2395 {
2396 gnutls_datum_t stapling;
2397 gnutls_ocsp_resp_t resp;
2398 gnutls_datum_t printed;
2399 if ( (rc= gnutls_ocsp_status_request_get(state->session, &stapling)) == 0
2400 && (rc= gnutls_ocsp_resp_init(&resp)) == 0
2401 && (rc= gnutls_ocsp_resp_import(resp, &stapling)) == 0
2402 && (rc= gnutls_ocsp_resp_print(resp, GNUTLS_OCSP_PRINT_FULL, &printed)) == 0
2403 )
2404 {
65867078 2405 debug_printf("%.4096s", printed.data);
2b4a568d
JH
2406 gnutls_free(printed.data);
2407 }
2408 else
cf0c6164 2409 (void) tls_error(US"ocsp decode", gnutls_strerror(rc), state->host, errstr);
2b4a568d
JH
2410 }
2411
2b4a568d 2412 if (gnutls_ocsp_status_request_is_checked(state->session, 0) == 0)
018058b2
JH
2413 {
2414 tls_out.ocsp = OCSP_FAILED;
cf0c6164 2415 return tls_error(US"certificate status check failed", NULL, state->host, errstr);
018058b2 2416 }
2b4a568d 2417 DEBUG(D_tls) debug_printf("Passed OCSP checking\n");
44662487 2418 tls_out.ocsp = OCSP_VFIED;
2b4a568d
JH
2419 }
2420#endif
2421
17c76198 2422/* Figure out peer DN, and if authenticated, etc. */
059ec3d9 2423
cf0c6164 2424if ((rc = peer_status(state, errstr)) != OK)
2b4a568d 2425 return rc;
059ec3d9 2426
4fe99a6c 2427/* Sets various Exim expansion variables; may need to adjust for ACL callouts */
059ec3d9 2428
9d1c15ef 2429extract_exim_vars_from_tls_state(state);
059ec3d9 2430
059ec3d9
PH
2431return OK;
2432}
2433
2434
2435
17c76198 2436
059ec3d9 2437/*************************************************
17c76198 2438* Close down a TLS session *
059ec3d9
PH
2439*************************************************/
2440
17c76198
PP
2441/* This is also called from within a delivery subprocess forked from the
2442daemon, to shut down the TLS library, without actually doing a shutdown (which
2443would tamper with the TLS session in the parent process).
059ec3d9 2444
17c76198
PP
2445Arguments: TRUE if gnutls_bye is to be called
2446Returns: nothing
059ec3d9
PH
2447*/
2448
17c76198 2449void
817d9f57 2450tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 2451{
817d9f57 2452exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
059ec3d9 2453
389ca47a 2454if (!state->tlsp || state->tlsp->active < 0) return; /* TLS was not active */
17c76198
PP
2455
2456if (shutdown)
2457 {
f5723109 2458 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS\n");
17c76198
PP
2459 gnutls_bye(state->session, GNUTLS_SHUT_WR);
2460 }
2461
2462gnutls_deinit(state->session);
ed62aae3
HSHR
2463gnutls_certificate_free_credentials(state->x509_cred);
2464
17c76198 2465
389ca47a 2466state->tlsp->active = -1;
b808677c 2467if (state->xfer_buffer) store_free(state->xfer_buffer);
17c76198
PP
2468memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
2469
b808677c 2470if (!state_server.session && !state_client.session)
17c76198
PP
2471 {
2472 gnutls_global_deinit();
2473 exim_gnutls_base_init_done = FALSE;
2474 }
059ec3d9
PH
2475}
2476
2477
2478
17c76198 2479
0d81dabc
JH
2480static BOOL
2481tls_refill(unsigned lim)
2482{
2483exim_gnutls_state_st * state = &state_server;
2484ssize_t inbytes;
2485
2486DEBUG(D_tls) debug_printf("Calling gnutls_record_recv(%p, %p, %u)\n",
2487 state->session, state->xfer_buffer, ssl_xfer_buffer_size);
2488
f1fed05b 2489sigalrm_seen = FALSE;
0d81dabc
JH
2490if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2491inbytes = gnutls_record_recv(state->session, state->xfer_buffer,
2492 MIN(ssl_xfer_buffer_size, lim));
2493alarm(0);
2494
2495/* Timeouts do not get this far; see command_timeout_handler().
2496 A zero-byte return appears to mean that the TLS session has been
2497 closed down, not that the socket itself has been closed down. Revert to
2498 non-TLS handling. */
2499
2500if (sigalrm_seen)
2501 {
2502 DEBUG(D_tls) debug_printf("Got tls read timeout\n");
2503 state->xfer_error = 1;
2504 return FALSE;
2505 }
2506
2507else if (inbytes == 0)
2508 {
2509 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2510
2511 receive_getc = smtp_getc;
2512 receive_getbuf = smtp_getbuf;
2513 receive_get_cache = smtp_get_cache;
2514 receive_ungetc = smtp_ungetc;
2515 receive_feof = smtp_feof;
2516 receive_ferror = smtp_ferror;
2517 receive_smtp_buffered = smtp_buffered;
2518
2519 gnutls_deinit(state->session);
2520 gnutls_certificate_free_credentials(state->x509_cred);
2521
2522 state->session = NULL;
2523 state->tlsp->active = -1;
2524 state->tlsp->bits = 0;
2525 state->tlsp->certificate_verified = FALSE;
2526 tls_channelbinding_b64 = NULL;
2527 state->tlsp->cipher = NULL;
2528 state->tlsp->peercert = NULL;
2529 state->tlsp->peerdn = NULL;
2530
2531 return FALSE;
2532 }
2533
2534/* Handle genuine errors */
2535
2536else if (inbytes < 0)
2537 {
2538 record_io_error(state, (int) inbytes, US"recv", NULL);
2539 state->xfer_error = 1;
2540 return FALSE;
2541 }
2542#ifndef DISABLE_DKIM
2543dkim_exim_verify_feed(state->xfer_buffer, inbytes);
2544#endif
2545state->xfer_buffer_hwm = (int) inbytes;
2546state->xfer_buffer_lwm = 0;
2547return TRUE;
2548}
2549
059ec3d9
PH
2550/*************************************************
2551* TLS version of getc *
2552*************************************************/
2553
2554/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2555it refills the buffer via the GnuTLS reading function.
817d9f57 2556Only used by the server-side TLS.
059ec3d9 2557
17c76198
PP
2558This feeds DKIM and should be used for all message-body reads.
2559
bd8fbe36 2560Arguments: lim Maximum amount to read/bufffer
059ec3d9
PH
2561Returns: the next character or EOF
2562*/
2563
2564int
bd8fbe36 2565tls_getc(unsigned lim)
059ec3d9 2566{
0d81dabc 2567exim_gnutls_state_st * state = &state_server;
059ec3d9 2568
0d81dabc
JH
2569if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2570 if (!tls_refill(lim))
2571 return state->xfer_error ? EOF : smtp_getc(lim);
ed62aae3 2572
0d81dabc 2573/* Something in the buffer; return next uschar */
059ec3d9 2574
0d81dabc
JH
2575return state->xfer_buffer[state->xfer_buffer_lwm++];
2576}
059ec3d9 2577
0d81dabc
JH
2578uschar *
2579tls_getbuf(unsigned * len)
2580{
2581exim_gnutls_state_st * state = &state_server;
2582unsigned size;
2583uschar * buf;
059ec3d9 2584
0d81dabc
JH
2585if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
2586 if (!tls_refill(*len))
059ec3d9 2587 {
0d81dabc
JH
2588 if (!state->xfer_error) return smtp_getbuf(len);
2589 *len = 0;
2590 return NULL;
059ec3d9 2591 }
059ec3d9 2592
0d81dabc
JH
2593if ((size = state->xfer_buffer_hwm - state->xfer_buffer_lwm) > *len)
2594 size = *len;
2595buf = &state->xfer_buffer[state->xfer_buffer_lwm];
2596state->xfer_buffer_lwm += size;
2597*len = size;
2598return buf;
059ec3d9
PH
2599}
2600
0d81dabc 2601
584e96c6
JH
2602void
2603tls_get_cache()
2604{
9960d1e5 2605#ifndef DISABLE_DKIM
584e96c6
JH
2606exim_gnutls_state_st * state = &state_server;
2607int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
2608if (n > 0)
2609 dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
584e96c6 2610#endif
9960d1e5 2611}
584e96c6 2612
059ec3d9 2613
925ac8e4
JH
2614BOOL
2615tls_could_read(void)
2616{
2617return state_server.xfer_buffer_lwm < state_server.xfer_buffer_hwm
2618 || gnutls_record_check_pending(state_server.session) > 0;
2619}
2620
2621
059ec3d9 2622
17c76198 2623
059ec3d9
PH
2624/*************************************************
2625* Read bytes from TLS channel *
2626*************************************************/
2627
17c76198
PP
2628/* This does not feed DKIM, so if the caller uses this for reading message body,
2629then the caller must feed DKIM.
817d9f57 2630
059ec3d9
PH
2631Arguments:
2632 buff buffer of data
2633 len size of buffer
2634
2635Returns: the number of bytes read
2636 -1 after a failed read
2637*/
2638
2639int
817d9f57 2640tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2641{
817d9f57 2642exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
17c76198 2643ssize_t inbytes;
059ec3d9 2644
17c76198
PP
2645if (len > INT_MAX)
2646 len = INT_MAX;
059ec3d9 2647
17c76198
PP
2648if (state->xfer_buffer_lwm < state->xfer_buffer_hwm)
2649 DEBUG(D_tls)
2650 debug_printf("*** PROBABLY A BUG *** " \
2651 "tls_read() called with data in the tls_getc() buffer, %d ignored\n",
2652 state->xfer_buffer_hwm - state->xfer_buffer_lwm);
2653
2654DEBUG(D_tls)
2655 debug_printf("Calling gnutls_record_recv(%p, %p, " SIZE_T_FMT ")\n",
2656 state->session, buff, len);
2657
2658inbytes = gnutls_record_recv(state->session, buff, len);
059ec3d9
PH
2659if (inbytes > 0) return inbytes;
2660if (inbytes == 0)
2661 {
2662 DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
2663 }
17c76198 2664else record_io_error(state, (int)inbytes, US"recv", NULL);
059ec3d9
PH
2665
2666return -1;
2667}
2668
2669
2670
17c76198 2671
059ec3d9
PH
2672/*************************************************
2673* Write bytes down TLS channel *
2674*************************************************/
2675
2676/*
2677Arguments:
817d9f57 2678 is_server channel specifier
059ec3d9
PH
2679 buff buffer of data
2680 len number of bytes
925ac8e4 2681 more more data expected soon
059ec3d9
PH
2682
2683Returns: the number of bytes after a successful write,
2684 -1 after a failed write
2685*/
2686
2687int
925ac8e4 2688tls_write(BOOL is_server, const uschar *buff, size_t len, BOOL more)
059ec3d9 2689{
17c76198
PP
2690ssize_t outbytes;
2691size_t left = len;
817d9f57 2692exim_gnutls_state_st *state = is_server ? &state_server : &state_client;
925ac8e4
JH
2693#ifdef SUPPORT_CORK
2694static BOOL corked = FALSE;
2695
2696if (more && !corked) gnutls_record_cork(state->session);
2697#endif
2698
2699DEBUG(D_tls) debug_printf("%s(%p, " SIZE_T_FMT "%s)\n", __FUNCTION__,
2700 buff, left, more ? ", more" : "");
059ec3d9 2701
059ec3d9
PH
2702while (left > 0)
2703 {
17c76198
PP
2704 DEBUG(D_tls) debug_printf("gnutls_record_send(SSL, %p, " SIZE_T_FMT ")\n",
2705 buff, left);
2706 outbytes = gnutls_record_send(state->session, buff, left);
059ec3d9 2707
17c76198 2708 DEBUG(D_tls) debug_printf("outbytes=" SSIZE_T_FMT "\n", outbytes);
059ec3d9
PH
2709 if (outbytes < 0)
2710 {
17c76198 2711 record_io_error(state, outbytes, US"send", NULL);
059ec3d9
PH
2712 return -1;
2713 }
2714 if (outbytes == 0)
2715 {
17c76198 2716 record_io_error(state, 0, US"send", US"TLS channel closed on write");
059ec3d9
PH
2717 return -1;
2718 }
2719
2720 left -= outbytes;
2721 buff += outbytes;
2722 }
2723
17c76198
PP
2724if (len > INT_MAX)
2725 {
2726 DEBUG(D_tls)
2727 debug_printf("Whoops! Wrote more bytes (" SIZE_T_FMT ") than INT_MAX\n",
2728 len);
2729 len = INT_MAX;
2730 }
2731
925ac8e4
JH
2732#ifdef SUPPORT_CORK
2733if (more != corked)
2734 {
2735 if (!more) (void) gnutls_record_uncork(state->session, 0);
2736 corked = more;
2737 }
2738#endif
2739
17c76198 2740return (int) len;
059ec3d9
PH
2741}
2742
2743
2744
17c76198 2745
059ec3d9 2746/*************************************************
17c76198 2747* Random number generation *
059ec3d9
PH
2748*************************************************/
2749
17c76198
PP
2750/* Pseudo-random number generation. The result is not expected to be
2751cryptographically strong but not so weak that someone will shoot themselves
2752in the foot using it as a nonce in input in some email header scheme or
2753whatever weirdness they'll twist this into. The result should handle fork()
2754and avoid repeating sequences. OpenSSL handles that for us.
059ec3d9 2755
17c76198
PP
2756Arguments:
2757 max range maximum
2758Returns a random number in range [0, max-1]
059ec3d9
PH
2759*/
2760
af3498d6 2761#ifdef HAVE_GNUTLS_RND
17c76198
PP
2762int
2763vaguely_random_number(int max)
059ec3d9 2764{
17c76198
PP
2765unsigned int r;
2766int i, needed_len;
2767uschar *p;
2768uschar smallbuf[sizeof(r)];
2769
2770if (max <= 1)
2771 return 0;
2772
2773needed_len = sizeof(r);
2774/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2775 * asked for a number less than 10. */
2776for (r = max, i = 0; r; ++i)
2777 r >>= 1;
2778i = (i + 7) / 8;
2779if (i < needed_len)
2780 needed_len = i;
2781
2782i = gnutls_rnd(GNUTLS_RND_NONCE, smallbuf, needed_len);
2783if (i < 0)
059ec3d9 2784 {
17c76198
PP
2785 DEBUG(D_all) debug_printf("gnutls_rnd() failed, using fallback.\n");
2786 return vaguely_random_number_fallback(max);
2787 }
2788r = 0;
2789for (p = smallbuf; needed_len; --needed_len, ++p)
2790 {
2791 r *= 256;
2792 r += *p;
059ec3d9
PH
2793 }
2794
17c76198
PP
2795/* We don't particularly care about weighted results; if someone wants
2796 * smooth distribution and cares enough then they should submit a patch then. */
2797return r % max;
059ec3d9 2798}
af3498d6
PP
2799#else /* HAVE_GNUTLS_RND */
2800int
2801vaguely_random_number(int max)
2802{
2803 return vaguely_random_number_fallback(max);
2804}
2805#endif /* HAVE_GNUTLS_RND */
059ec3d9 2806
36f12725
NM
2807
2808
2809
2810/*************************************************
3375e053
PP
2811* Let tls_require_ciphers be checked at startup *
2812*************************************************/
2813
2814/* The tls_require_ciphers option, if set, must be something which the
2815library can parse.
2816
2817Returns: NULL on success, or error message
2818*/
2819
2820uschar *
2821tls_validate_require_cipher(void)
2822{
2823int rc;
2824uschar *expciphers = NULL;
2825gnutls_priority_t priority_cache;
2826const char *errpos;
cf0c6164 2827uschar * dummy_errstr;
3375e053
PP
2828
2829#define validate_check_rc(Label) do { \
2830 if (rc != GNUTLS_E_SUCCESS) { if (exim_gnutls_base_init_done) gnutls_global_deinit(); \
2831 return string_sprintf("%s failed: %s", (Label), gnutls_strerror(rc)); } } while (0)
2832#define return_deinit(Label) do { gnutls_global_deinit(); return (Label); } while (0)
2833
2834if (exim_gnutls_base_init_done)
2835 log_write(0, LOG_MAIN|LOG_PANIC,
2836 "already initialised GnuTLS, Exim developer bug");
2837
a5f239e4 2838#ifdef HAVE_GNUTLS_PKCS11
2519e60d 2839if (!gnutls_allow_auto_pkcs11)
a5f239e4
PP
2840 {
2841 rc = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
2842 validate_check_rc(US"gnutls_pkcs11_init");
2843 }
2844#endif
3375e053
PP
2845rc = gnutls_global_init();
2846validate_check_rc(US"gnutls_global_init()");
2847exim_gnutls_base_init_done = TRUE;
2848
2849if (!(tls_require_ciphers && *tls_require_ciphers))
2850 return_deinit(NULL);
2851
cf0c6164
JH
2852if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
2853 &dummy_errstr))
3375e053
PP
2854 return_deinit(US"failed to expand tls_require_ciphers");
2855
2856if (!(expciphers && *expciphers))
2857 return_deinit(NULL);
2858
2859DEBUG(D_tls)
2860 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2861
2862rc = gnutls_priority_init(&priority_cache, CS expciphers, &errpos);
2863validate_check_rc(string_sprintf(
2864 "gnutls_priority_init(%s) failed at offset %ld, \"%.8s..\"",
2865 expciphers, errpos - CS expciphers, errpos));
2866
2867#undef return_deinit
2868#undef validate_check_rc
2869gnutls_global_deinit();
2870
2871return NULL;
2872}
2873
2874
2875
2876
2877/*************************************************
36f12725
NM
2878* Report the library versions. *
2879*************************************************/
2880
2881/* See a description in tls-openssl.c for an explanation of why this exists.
2882
2883Arguments: a FILE* to print the results to
2884Returns: nothing
2885*/
2886
2887void
2888tls_version_report(FILE *f)
2889{
754a0503
PP
2890fprintf(f, "Library version: GnuTLS: Compile: %s\n"
2891 " Runtime: %s\n",
2892 LIBGNUTLS_VERSION,
2893 gnutls_check_version(NULL));
36f12725
NM
2894}
2895
2b4a568d
JH
2896/* vi: aw ai sw=2
2897*/
059ec3d9 2898/* End of tls-gnu.c */